@feltdb/core 0.4.11 → 0.4.13

package/dist/create/server-source/crates/feltdb-server/src/content.rs

@@ -0,0 +1,111 @@
+use sha2::{Digest, Sha256};
+use std::{fs, io, path::PathBuf, sync::Arc};
+
+#[derive(Clone)]
+pub struct ContentStore {
+    root: Arc<PathBuf>,
+}
+
+impl ContentStore {
+    pub fn new(root: PathBuf) -> io::Result<Self> {
+        fs::create_dir_all(&root)?;
+        Ok(Self {
+            root: Arc::new(root),
+        })
+    }
+    pub fn hash(bytes: &[u8]) -> String {
+        Sha256::digest(bytes)
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect()
+    }
+    pub fn valid_hash(hash: &str) -> bool {
+        hash.len() == 64
+            && hash
+                .bytes()
+                .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+    }
+    pub fn store(&self, bytes: &[u8]) -> io::Result<String> {
+        let hash = Self::hash(bytes);
+        self.store_verified(&hash, bytes)?;
+        Ok(hash)
+    }
+    pub fn store_verified(&self, hash: &str, bytes: &[u8]) -> io::Result<()> {
+        if !Self::valid_hash(hash) || Self::hash(bytes) != hash {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "content hash mismatch",
+            ));
+        }
+        let path = self.root.join(hash);
+        if path.exists() {
+            return Ok(());
+        }
+        let temporary = self
+            .root
+            .join(format!(".{hash}.tmp-{}", std::process::id()));
+        fs::write(&temporary, bytes)?;
+        match fs::rename(&temporary, &path) {
+            Ok(()) => Ok(()),
+            Err(_error) if path.exists() => {
+                let _ = fs::remove_file(temporary);
+                Ok(())
+            }
+            Err(error) => Err(error),
+        }
+    }
+    pub fn get(&self, hash: &str) -> io::Result<Option<Vec<u8>>> {
+        if !Self::valid_hash(hash) {
+            return Ok(None);
+        }
+        let path = self.root.join(hash);
+        match fs::read(path) {
+            Ok(bytes) if Self::hash(&bytes) == hash => Ok(Some(bytes)),
+            Ok(_) => Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "stored content failed verification",
+            )),
+            Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(None),
+            Err(error) => Err(error),
+        }
+    }
+    pub fn exists(&self, hash: &str) -> io::Result<bool> {
+        Ok(self.get(hash)?.is_some())
+    }
+    pub fn delete(&self, hash: &str) -> io::Result<bool> {
+        if !Self::valid_hash(hash) {
+            return Ok(false);
+        }
+        match fs::remove_file(self.root.join(hash)) {
+            Ok(()) => Ok(true),
+            Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(false),
+            Err(error) => Err(error),
+        }
+    }
+    pub fn verify(&self, hash: &str) -> io::Result<bool> {
+        self.get(hash).map(|value| value.is_some())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn content_is_verified_deduplicated_and_durable() {
+        let root = std::env::temp_dir().join(format!("feltdb-content-{}", std::process::id()));
+        let _ = fs::remove_dir_all(&root);
+        let store = ContentStore::new(root.clone()).unwrap();
+        let hash = store.store(b"customer content").unwrap();
+        assert_eq!(store.store(b"customer content").unwrap(), hash);
+        assert_eq!(
+            ContentStore::new(root.clone())
+                .unwrap()
+                .get(&hash)
+                .unwrap()
+                .unwrap(),
+            b"customer content"
+        );
+        assert!(store.store_verified(&hash, b"tampered").is_err());
+        let _ = fs::remove_dir_all(root);
+    }
+}

package/dist/create/server-source/crates/feltdb-server/src/identity.rs

@@ -0,0 +1,250 @@
+use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
+use password_hash::{rand_core::OsRng, SaltString};
+use rand::{distributions::Alphanumeric, Rng};
+use serde::{Deserialize, Serialize};
+use std::{
+    fs,
+    path::PathBuf,
+    sync::{Arc, RwLock},
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+fn id(prefix: &str) -> String {
+    format!(
+        "{}_{}",
+        prefix,
+        rand::thread_rng()
+            .sample_iter(&Alphanumeric)
+            .take(18)
+            .map(char::from)
+            .collect::<String>()
+    )
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum IdentityStatus {
+    Unverified,
+    Active,
+    Suspended,
+    Locked,
+    Revoked,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Identity {
+    pub identity_id: String,
+    pub subject_id: String,
+    pub provider: String,
+    pub provider_subject: String,
+    pub email: Option<String>,
+    pub display_name: Option<String>,
+    pub status: IdentityStatus,
+    pub created_at: u64,
+    pub metadata: serde_json::Value,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct IdentitySession {
+    pub session_id: String,
+    pub identity_id: String,
+    pub subject_id: String,
+    pub issued_at: u64,
+    pub expires_at: u64,
+    pub last_seen_at: u64,
+    pub device: Option<String>,
+    pub provider: String,
+    pub status: String,
+    pub revocation_reason: Option<String>,
+    pub refresh_hash: Option<String>,
+}
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct State {
+    identities: Vec<Identity>,
+    sessions: Vec<IdentitySession>,
+    password_hashes: std::collections::HashMap<String, String>,
+}
+#[derive(Clone)]
+pub struct IdentityStore {
+    path: PathBuf,
+    state: Arc<RwLock<State>>,
+}
+
+impl IdentityStore {
+    pub fn load(path: impl Into<PathBuf>) -> Result<Self, String> {
+        let path = path.into();
+        let state = if path.exists() {
+            serde_json::from_slice(&fs::read(&path).map_err(|e| e.to_string())?)
+                .map_err(|e| e.to_string())?
+        } else {
+            State::default()
+        };
+        Ok(Self {
+            path,
+            state: Arc::new(RwLock::new(state)),
+        })
+    }
+    fn persist(&self, s: &State) -> Result<(), String> {
+        if let Some(p) = self.path.parent() {
+            fs::create_dir_all(p).map_err(|e| e.to_string())?
+        }
+        fs::write(
+            &self.path,
+            serde_json::to_vec_pretty(s).map_err(|e| e.to_string())?,
+        )
+        .map_err(|e| e.to_string())
+    }
+    pub fn normalize(
+        &self,
+        provider: &str,
+        provider_subject: &str,
+        email: Option<String>,
+        display_name: Option<String>,
+        metadata: serde_json::Value,
+    ) -> Result<Identity, String> {
+        let mut s = self.state.write().map_err(|_| "identity lock poisoned")?;
+        if let Some(i) = s
+            .identities
+            .iter()
+            .find(|i| i.provider == provider && i.provider_subject == provider_subject)
+        {
+            return Ok(i.clone());
+        }
+        let x = Identity {
+            identity_id: id("identity"),
+            subject_id: id("subject"),
+            provider: provider.into(),
+            provider_subject: provider_subject.into(),
+            email,
+            display_name,
+            status: IdentityStatus::Unverified,
+            created_at: now(),
+            metadata,
+        };
+        s.identities.push(x.clone());
+        self.persist(&s)?;
+        Ok(x)
+    }
+    pub fn list(&self) -> Result<Vec<Identity>, String> {
+        Ok(self
+            .state
+            .read()
+            .map_err(|_| "identity lock poisoned")?
+            .identities
+            .clone())
+    }
+    pub fn sessions(&self, subject: &str) -> Result<Vec<IdentitySession>, String> {
+        Ok(self
+            .state
+            .read()
+            .map_err(|_| "identity lock poisoned")?
+            .sessions
+            .iter()
+            .filter(|x| x.subject_id == subject)
+            .cloned()
+            .collect())
+    }
+    pub fn issue_session(
+        &self,
+        identity: &Identity,
+        provider: &str,
+        device: Option<String>,
+        ttl: u64,
+    ) -> Result<IdentitySession, String> {
+        let mut s = self.state.write().map_err(|_| "identity lock poisoned")?;
+        let t = now();
+        let x = IdentitySession {
+            session_id: id("session"),
+            identity_id: identity.identity_id.clone(),
+            subject_id: identity.subject_id.clone(),
+            issued_at: t,
+            expires_at: t + ttl,
+            last_seen_at: t,
+            device,
+            provider: provider.into(),
+            status: "active".into(),
+            revocation_reason: None,
+            refresh_hash: Some(id("refresh")),
+        };
+        s.sessions.push(x.clone());
+        self.persist(&s)?;
+        Ok(x)
+    }
+    pub fn revoke_session(&self, subject: &str, session: &str, reason: &str) -> Result<(), String> {
+        let mut s = self.state.write().map_err(|_| "identity lock poisoned")?;
+        let x = s
+            .sessions
+            .iter_mut()
+            .find(|x| x.subject_id == subject && x.session_id == session)
+            .ok_or("session not found")?;
+        x.status = "revoked".into();
+        x.revocation_reason = Some(reason.into());
+        self.persist(&s)
+    }
+    pub fn revoke_all(&self, subject: &str) -> Result<usize, String> {
+        let mut s = self.state.write().map_err(|_| "identity lock poisoned")?;
+        let mut n = 0;
+        for x in s
+            .sessions
+            .iter_mut()
+            .filter(|x| x.subject_id == subject && x.status == "active")
+        {
+            x.status = "revoked".into();
+            x.revocation_reason = Some("logout_all".into());
+            n += 1
+        }
+        self.persist(&s)?;
+        Ok(n)
+    }
+    pub fn hash_password(password: &str) -> Result<String, String> {
+        let salt = SaltString::generate(&mut OsRng);
+        Argon2::default()
+            .hash_password(password.as_bytes(), &salt)
+            .map(|x| x.to_string())
+            .map_err(|e| e.to_string())
+    }
+    pub fn verify_password(hash: &str, password: &str) -> bool {
+        PasswordHash::new(hash)
+            .map(|x| {
+                Argon2::default()
+                    .verify_password(password.as_bytes(), &x)
+                    .is_ok()
+            })
+            .unwrap_or(false)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn provider_identity_is_normalized_and_persisted() {
+        let p = std::env::temp_dir().join(format!("identity-{}.json", now()));
+        let s = IdentityStore::load(&p).unwrap();
+        let a = s
+            .normalize(
+                "github",
+                "42",
+                Some("a@example.com".into()),
+                None,
+                serde_json::json!({}),
+            )
+            .unwrap();
+        let b = s
+            .normalize("github", "42", None, None, serde_json::json!({}))
+            .unwrap();
+        assert_eq!(a.identity_id, b.identity_id);
+        assert_eq!(s.list().unwrap().len(), 1);
+    }
+    #[test]
+    fn password_hash_never_equals_password() {
+        let h = IdentityStore::hash_password("correct horse").unwrap();
+        assert_ne!(h, "correct horse");
+        assert!(IdentityStore::verify_password(&h, "correct horse"));
+        assert!(!IdentityStore::verify_password(&h, "wrong"));
+    }
+}

package/dist/create/server-source/crates/feltdb-server/src/key_management.rs

@@ -0,0 +1,78 @@
+use axum::{
+    extract::{Path, State},
+    http::StatusCode,
+    Json,
+};
+use serde::{Deserialize, Serialize};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use crate::{auth::ApiKeySummary, app_state::AppState};
+
+#[derive(Debug, Serialize)]
+pub struct KeyListResponse {
+    pub tokens: Vec<ApiKeySummary>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateKeyRequest {
+    pub id: Option<String>,
+    pub namespace: String,
+    pub scopes: Vec<String>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct CreateKeyResponse {
+    pub secret: String,
+    pub id: String,
+}
+
+pub async fn list_keys(
+    State(state): State<AppState>,
+) -> Result<Json<KeyListResponse>, (StatusCode, String)> {
+    let tokens = state
+        .keys
+        .list()
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
+    Ok(Json(KeyListResponse { tokens }))
+}
+
+pub async fn create_key(
+    State(state): State<AppState>,
+    Json(req): Json<CreateKeyRequest>,
+) -> Result<(StatusCode, Json<CreateKeyResponse>), (StatusCode, String)> {
+    let timestamp = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs();
+
+    let id = req.id.unwrap_or_else(|| format!("key-{}", timestamp));
+    let secret = state
+        .keys
+        .create(
+            id.clone(),
+            req.scopes,
+            vec![req.namespace],
+        )
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
+
+    Ok((
+        StatusCode::CREATED,
+        Json(CreateKeyResponse { secret, id }),
+    ))
+}
+
+pub async fn revoke_key(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+) -> Result<StatusCode, (StatusCode, String)> {
+    let found = state
+        .keys
+        .revoke(&id)
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
+
+    if found {
+        Ok(StatusCode::NO_CONTENT)
+    } else {
+        Err((StatusCode::NOT_FOUND, "Key not found".to_string()))
+    }
+}

package/dist/create/server-source/crates/feltdb-server/src/key_provider.rs

@@ -0,0 +1,247 @@
+use base64::{engine::general_purpose::STANDARD, Engine};
+use rand::RngCore;
+use ring::aead::{Aad, LessSafeKey, Nonce, UnboundKey, AES_256_GCM};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::{
+    collections::BTreeMap,
+    fs,
+    path::PathBuf,
+    sync::{Arc, RwLock},
+};
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, PartialOrd, Ord)]
+pub struct KeyScope {
+    pub tenant_id: String,
+    pub application_id: Option<String>,
+    pub purpose: String,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct KeyReference {
+    pub provider: String,
+    pub key_id: String,
+    pub version: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct WrappedKey {
+    pub nonce: String,
+    pub ciphertext: String,
+    pub algorithm: String,
+}
+#[derive(Debug, Clone, Serialize)]
+pub struct KeyProviderHealth {
+    pub provider: String,
+    pub available: bool,
+    pub active_key: String,
+    pub rotation_due: bool,
+}
+pub trait KeyProvider: Send + Sync {
+    fn active_key(&self, scope: &KeyScope) -> Result<KeyReference, String>;
+    fn encrypt_dek(
+        &self,
+        scope: &KeyScope,
+        dek: &[u8],
+    ) -> Result<(KeyReference, WrappedKey), String>;
+    fn decrypt_dek(
+        &self,
+        key: &KeyReference,
+        wrapped: &WrappedKey,
+        scope: &KeyScope,
+    ) -> Result<Vec<u8>, String>;
+    fn rotate(&self, scope: &KeyScope) -> Result<KeyReference, String>;
+    fn health(&self, scope: &KeyScope) -> KeyProviderHealth;
+}
+#[derive(Serialize, Deserialize, Default)]
+struct LocalKeys {
+    active: BTreeMap<String, u64>,
+    keys: BTreeMap<String, String>,
+}
+#[derive(Clone)]
+pub struct LocalKeyProvider {
+    path: PathBuf,
+    root: Arc<[u8; 32]>,
+    data: Arc<RwLock<LocalKeys>>,
+}
+fn scope_id(s: &KeyScope) -> String {
+    format!(
+        "{}|{}|{}",
+        s.tenant_id,
+        s.application_id.as_deref().unwrap_or("*"),
+        s.purpose
+    )
+}
+fn scope_hash(s: &str) -> String {
+    Sha256::digest(s.as_bytes())[..6]
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect()
+}
+fn aad(s: &KeyScope, k: &KeyReference) -> Vec<u8> {
+    format!(
+        "feltdb-kek-v1|{}|{}|{}|{}",
+        scope_id(s),
+        k.provider,
+        k.key_id,
+        k.version
+    )
+    .into_bytes()
+}
+impl LocalKeyProvider {
+    pub fn load(path: impl Into<PathBuf>, root: [u8; 32]) -> Result<Self, String> {
+        let path = path.into();
+        let data = if path.exists() {
+            serde_json::from_slice(&fs::read(&path).map_err(|_| "key provider unavailable")?)
+                .map_err(|_| "key provider metadata invalid")?
+        } else {
+            LocalKeys::default()
+        };
+        Ok(Self {
+            path,
+            root: Arc::new(root),
+            data: Arc::new(RwLock::new(data)),
+        })
+    }
+    fn persist(&self, d: &LocalKeys) -> Result<(), String> {
+        if let Some(p) = self.path.parent() {
+            fs::create_dir_all(p).map_err(|_| "key provider unavailable")?;
+        }
+        let t = self.path.with_extension("tmp");
+        fs::write(
+            &t,
+            serde_json::to_vec_pretty(d).map_err(|_| "key provider metadata invalid")?,
+        )
+        .map_err(|_| "key provider unavailable")?;
+        fs::rename(t, &self.path).map_err(|_| "key provider unavailable".to_string())
+    }
+    fn material(&self, k: &KeyReference) -> Result<[u8; 32], String> {
+        let d = self.data.read().map_err(|_| "key provider unavailable")?;
+        let seed = STANDARD
+            .decode(d.keys.get(&k.key_id).ok_or("key unavailable or revoked")?)
+            .map_err(|_| "key provider metadata invalid")?;
+        Ok(Sha256::digest([self.root.as_slice(), seed.as_slice()].concat()).into())
+    }
+    fn ensure(&self, s: &KeyScope) -> Result<KeyReference, String> {
+        self.active_key(s).or_else(|_| self.rotate(s))
+    }
+}
+impl KeyProvider for LocalKeyProvider {
+    fn active_key(&self, s: &KeyScope) -> Result<KeyReference, String> {
+        let d = self.data.read().map_err(|_| "key provider unavailable")?;
+        let v = *d.active.get(&scope_id(s)).ok_or("no active key")?;
+        Ok(KeyReference {
+            provider: "local".into(),
+            key_id: format!("key-{}-{v}", scope_hash(&scope_id(s))),
+            version: v,
+        })
+    }
+    fn encrypt_dek(&self, s: &KeyScope, dek: &[u8]) -> Result<(KeyReference, WrappedKey), String> {
+        let kr = self.ensure(s)?;
+        let material = self.material(&kr)?;
+        let key = LessSafeKey::new(
+            UnboundKey::new(&AES_256_GCM, &material).map_err(|_| "key provider unavailable")?,
+        );
+        let mut n = [0; 12];
+        rand::thread_rng().fill_bytes(&mut n);
+        let mut v = dek.to_vec();
+        key.seal_in_place_append_tag(
+            Nonce::assume_unique_for_key(n),
+            Aad::from(aad(s, &kr)),
+            &mut v,
+        )
+        .map_err(|_| "DEK wrap failed")?;
+        Ok((
+            kr,
+            WrappedKey {
+                nonce: STANDARD.encode(n),
+                ciphertext: STANDARD.encode(v),
+                algorithm: "AES-256-GCM".into(),
+            },
+        ))
+    }
+    fn decrypt_dek(
+        &self,
+        kr: &KeyReference,
+        w: &WrappedKey,
+        s: &KeyScope,
+    ) -> Result<Vec<u8>, String> {
+        if kr.provider != "local" {
+            return Err("incompatible key provider".into());
+        }
+        let material = self.material(kr)?;
+        let key = LessSafeKey::new(
+            UnboundKey::new(&AES_256_GCM, &material).map_err(|_| "key provider unavailable")?,
+        );
+        let n: [u8; 12] = STANDARD
+            .decode(&w.nonce)
+            .map_err(|_| "wrapped key invalid")?
+            .try_into()
+            .map_err(|_| "wrapped key invalid")?;
+        let mut v = STANDARD
+            .decode(&w.ciphertext)
+            .map_err(|_| "wrapped key invalid")?;
+        let len = key
+            .open_in_place(
+                Nonce::assume_unique_for_key(n),
+                Aad::from(aad(s, kr)),
+                &mut v,
+            )
+            .map_err(|_| "DEK unwrap failed")?
+            .len();
+        v.truncate(len);
+        Ok(v)
+    }
+    fn rotate(&self, s: &KeyScope) -> Result<KeyReference, String> {
+        let mut d = self.data.write().map_err(|_| "key provider unavailable")?;
+        let sid = scope_id(s);
+        let v = d.active.get(&sid).copied().unwrap_or(0) + 1;
+        let kid = format!("key-{}-{v}", scope_hash(&sid));
+        let mut seed = [0; 32];
+        rand::thread_rng().fill_bytes(&mut seed);
+        d.keys.insert(kid.clone(), STANDARD.encode(seed));
+        d.active.insert(sid, v);
+        self.persist(&d)?;
+        Ok(KeyReference {
+            provider: "local".into(),
+            key_id: kid,
+            version: v,
+        })
+    }
+    fn health(&self, s: &KeyScope) -> KeyProviderHealth {
+        match self.active_key(s) {
+            Ok(k) => KeyProviderHealth {
+                provider: "local".into(),
+                available: true,
+                active_key: k.key_id,
+                rotation_due: false,
+            },
+            Err(_) => KeyProviderHealth {
+                provider: "local".into(),
+                available: false,
+                active_key: "uninitialized".into(),
+                rotation_due: false,
+            },
+        }
+    }
+}
+pub fn provider_from_environment(
+    path: PathBuf,
+    production: bool,
+) -> Result<Arc<dyn KeyProvider>, String> {
+    let kind = std::env::var("FELTDB_KEY_PROVIDER").unwrap_or_else(|_| "local".into());
+    if kind != "local" && kind != "env" {
+        return Err(format!("key provider '{kind}' is not installed"));
+    }
+    let material = std::env::var("FELTDB_MASTER_KEY")
+        .or_else(|_| std::env::var("FELTDB_SECRET_KEY"))
+        .map_err(|_| {
+            if production {
+                "production requires an explicit key provider and root key"
+            } else {
+                "FELTDB_MASTER_KEY is required; keys are never generated implicitly"
+            }
+        })?;
+    Ok(Arc::new(LocalKeyProvider::load(
+        path,
+        Sha256::digest(material.as_bytes()).into(),
+    )?))
+}