@feltdb/core 0.4.12 → 0.4.13

package/dist/create/server-source/crates/feltdb-server/src/backup.rs

@@ -0,0 +1,416 @@
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::{
+    fs::{self, File},
+    io::{self, Read, Write},
+    path::{Path, PathBuf},
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+pub const BACKUP_FORMAT: u32 = 1;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct BackupEntry {
+    pub path: String,
+    pub bytes: u64,
+    pub sha256: String,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct BackupManifest {
+    pub format: u32,
+    pub created_ms: u64,
+    pub entries: Vec<BackupEntry>,
+}
+
+pub fn server_artifacts(data: &Path, keys: &Path, audit: &Path) -> Vec<(String, PathBuf)> {
+    vec![
+        ("state.log".into(), data.to_path_buf()),
+        ("state.checkpoint".into(), data.with_extension("checkpoint")),
+        ("state.sync.json".into(), data.with_extension("sync.json")),
+        (
+            "state.cluster.json".into(),
+            data.with_extension("cluster.json"),
+        ),
+        (
+            "state.membership.json".into(),
+            data.with_extension("membership.json"),
+        ),
+        (
+            "state.leases.json".into(),
+            data.with_extension("leases.json"),
+        ),
+        ("state.content".into(), data.with_extension("content")),
+        ("platform.json".into(), data.with_extension("platform.json")),
+        (
+            "applications.json".into(),
+            data.with_extension("applications.json"),
+        ),
+        (
+            "application-runtimes.json".into(),
+            data.with_extension("application-runtimes.json"),
+        ),
+        (
+            "principals.json".into(),
+            data.with_extension("principals.json"),
+        ),
+        (
+            "connections.json".into(),
+            data.with_extension("connections.json"),
+        ),
+        (
+            "revoked-sessions.json".into(),
+            data.with_extension("revoked-sessions.json"),
+        ),
+        ("api-keys.json".into(), keys.to_path_buf()),
+        ("audit.log".into(), audit.to_path_buf()),
+    ]
+}
+
+pub fn create_bundle(output: &Path, artifacts: &[(String, PathBuf)]) -> io::Result<BackupManifest> {
+    create_bundle_with_virtual(output, artifacts, &[])
+}
+
+pub fn create_bundle_with_virtual(
+    output: &Path,
+    artifacts: &[(String, PathBuf)],
+    virtual_files: &[(String, Vec<u8>)],
+) -> io::Result<BackupManifest> {
+    if output.exists() {
+        return Err(io::Error::new(
+            io::ErrorKind::AlreadyExists,
+            "backup output already exists",
+        ));
+    }
+    let staging = output.with_extension("partial");
+    if staging.exists() {
+        return Err(io::Error::new(
+            io::ErrorKind::AlreadyExists,
+            "an interrupted backup staging directory exists",
+        ));
+    }
+    fs::create_dir_all(staging.join("files"))?;
+    let result = (|| {
+        let mut entries = Vec::new();
+        for (label, source) in artifacts {
+            validate_relative(label)?;
+            if !source.exists() {
+                continue;
+            }
+            copy_source(
+                source,
+                &staging.join("files").join(label),
+                &format!("files/{label}"),
+                &mut entries,
+            )?;
+        }
+        for (label, bytes) in virtual_files {
+            validate_relative(label)?;
+            let destination = staging.join("files").join(label);
+            if let Some(parent) = destination.parent() {
+                fs::create_dir_all(parent)?;
+            }
+            write_synced(&destination, bytes)?;
+            entries.push(BackupEntry {
+                path: format!("files/{label}"),
+                bytes: bytes.len() as u64,
+                sha256: hash_file(&destination)?,
+            });
+        }
+        entries.sort_by(|left, right| left.path.cmp(&right.path));
+        let manifest = BackupManifest {
+            format: BACKUP_FORMAT,
+            created_ms: SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap_or_default()
+                .as_millis() as u64,
+            entries,
+        };
+        write_synced(
+            &staging.join("manifest.json"),
+            &serde_json::to_vec_pretty(&manifest).map_err(io::Error::other)?,
+        )?;
+        sync_directory(&staging)?;
+        fs::rename(&staging, output)?;
+        if let Some(parent) = output.parent() {
+            sync_directory(parent)?;
+        }
+        Ok(manifest)
+    })();
+    if result.is_err() {
+        let _ = fs::remove_dir_all(&staging);
+    }
+    result
+}
+
+pub fn verify_bundle(archive: &Path) -> io::Result<BackupManifest> {
+    if archive.with_extension("partial").exists() {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            "interrupted backup staging directory detected",
+        ));
+    }
+    let manifest: BackupManifest =
+        serde_json::from_slice(&fs::read(archive.join("manifest.json"))?)
+            .map_err(io::Error::other)?;
+    if manifest.format != BACKUP_FORMAT {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("unsupported backup format {}", manifest.format),
+        ));
+    }
+    for entry in &manifest.entries {
+        validate_relative(&entry.path)?;
+        let path = archive.join(&entry.path);
+        let metadata = fs::symlink_metadata(&path)?;
+        if !metadata.is_file() || metadata.len() != entry.bytes || hash_file(&path)? != entry.sha256
+        {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("backup entry failed verification: {}", entry.path),
+            ));
+        }
+    }
+    Ok(manifest)
+}
+
+/// Select the newest verified recovery point whose completed manifest timestamp
+/// does not exceed `at_ms`. Every manifest-bearing child is verified first so a
+/// corrupt recent backup cannot cause a silent fallback to older data.
+pub fn select_bundle_at(catalog: &Path, at_ms: u64) -> io::Result<PathBuf> {
+    let mut candidates = Vec::new();
+    for entry in fs::read_dir(catalog)? {
+        let path = entry?.path();
+        if !path.is_dir() || !path.join("manifest.json").is_file() {
+            continue;
+        }
+        let manifest = verify_bundle(&path)?;
+        if manifest.created_ms <= at_ms {
+            candidates.push((manifest.created_ms, path));
+        }
+    }
+    candidates
+        .into_iter()
+        .max_by(|left, right| left.0.cmp(&right.0).then_with(|| left.1.cmp(&right.1)))
+        .map(|(_, path)| path)
+        .ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::NotFound,
+                format!("no verified recovery point exists at or before {at_ms}"),
+            )
+        })
+}
+
+pub fn restore_bundle(archive: &Path, output: &Path) -> io::Result<BackupManifest> {
+    let manifest = verify_bundle(archive)?;
+    if output.exists() {
+        return Err(io::Error::new(
+            io::ErrorKind::AlreadyExists,
+            "restore output already exists",
+        ));
+    }
+    let staging = output.with_extension("restore.partial");
+    if staging.exists() {
+        return Err(io::Error::new(
+            io::ErrorKind::AlreadyExists,
+            "an interrupted restore staging directory exists",
+        ));
+    }
+    fs::create_dir_all(&staging)?;
+    let result = (|| {
+        copy_tree(&archive.join("files"), &staging.join("files"))?;
+        write_synced(
+            &staging.join("manifest.json"),
+            &fs::read(archive.join("manifest.json"))?,
+        )?;
+        sync_directory(&staging)?;
+        fs::rename(&staging, output)?;
+        if let Some(parent) = output.parent() {
+            sync_directory(parent)?;
+        }
+        Ok(manifest.clone())
+    })();
+    if result.is_err() {
+        let _ = fs::remove_dir_all(&staging);
+    }
+    result
+}
+
+fn copy_source(
+    source: &Path,
+    destination: &Path,
+    relative: &str,
+    entries: &mut Vec<BackupEntry>,
+) -> io::Result<()> {
+    let metadata = fs::symlink_metadata(source)?;
+    if metadata.file_type().is_symlink() {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            "backup sources may not contain symlinks",
+        ));
+    }
+    if metadata.is_dir() {
+        fs::create_dir_all(destination)?;
+        let mut children = fs::read_dir(source)?.collect::<Result<Vec<_>, _>>()?;
+        children.sort_by_key(|value| value.file_name());
+        for child in children {
+            copy_source(
+                &child.path(),
+                &destination.join(child.file_name()),
+                &format!("{relative}/{}", child.file_name().to_string_lossy()),
+                entries,
+            )?;
+        }
+    } else if metadata.is_file() {
+        if let Some(parent) = destination.parent() {
+            fs::create_dir_all(parent)?;
+        }
+        fs::copy(source, destination)?;
+        sync_file(destination)?;
+        entries.push(BackupEntry {
+            path: relative.into(),
+            bytes: metadata.len(),
+            sha256: hash_file(destination)?,
+        });
+    }
+    Ok(())
+}
+fn copy_tree(source: &Path, destination: &Path) -> io::Result<()> {
+    if !source.exists() {
+        return Ok(());
+    }
+    let mut ignored = Vec::new();
+    copy_source(source, destination, "files", &mut ignored)
+}
+fn validate_relative(value: &str) -> io::Result<()> {
+    let path = Path::new(value);
+    if value.is_empty()
+        || path.is_absolute()
+        || path.components().any(|part| {
+            matches!(
+                part,
+                std::path::Component::ParentDir
+                    | std::path::Component::RootDir
+                    | std::path::Component::Prefix(_)
+            )
+        })
+    {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "backup path must be relative and traversal-free",
+        ));
+    }
+    Ok(())
+}
+fn hash_file(path: &Path) -> io::Result<String> {
+    let mut file = File::open(path)?;
+    let mut hash = Sha256::new();
+    let mut buffer = [0; 64 * 1024];
+    loop {
+        let count = file.read(&mut buffer)?;
+        if count == 0 {
+            break;
+        }
+        hash.update(&buffer[..count]);
+    }
+    Ok(format!("{:x}", hash.finalize()))
+}
+fn write_synced(path: &Path, value: &[u8]) -> io::Result<()> {
+    let mut file = File::create(path)?;
+    file.write_all(value)?;
+    file.sync_all()
+}
+fn sync_file(path: &Path) -> io::Result<()> {
+    File::open(path)?.sync_all()
+}
+fn sync_directory(path: &Path) -> io::Result<()> {
+    File::open(path)?.sync_all()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn backup_verifies_restores_and_rejects_corruption() {
+        let root = std::env::temp_dir().join(format!(
+            "feltdb-backup-{}-{}",
+            std::process::id(),
+            rand::random::<u64>()
+        ));
+        fs::create_dir_all(root.join("source/content")).unwrap();
+        fs::write(root.join("source/state.log"), b"canonical operations").unwrap();
+        fs::write(root.join("source/content/object"), b"content bytes").unwrap();
+        let archive = root.join("archive");
+        let artifacts = vec![
+            ("state.log".into(), root.join("source/state.log")),
+            ("content".into(), root.join("source/content")),
+        ];
+        let created = create_bundle(&archive, &artifacts).unwrap();
+        assert_eq!(created.entries.len(), 2);
+        assert_eq!(verify_bundle(&archive).unwrap().entries.len(), 2);
+        let restored = root.join("restored");
+        restore_bundle(&archive, &restored).unwrap();
+        assert_eq!(
+            fs::read(restored.join("files/state.log")).unwrap(),
+            b"canonical operations"
+        );
+        fs::write(archive.join("files/state.log"), b"corrupt").unwrap();
+        assert_eq!(
+            verify_bundle(&archive).unwrap_err().kind(),
+            io::ErrorKind::InvalidData
+        );
+        let _ = fs::remove_dir_all(root);
+    }
+    #[test]
+    fn partial_backups_are_detected_and_never_restored() {
+        let root = std::env::temp_dir().join(format!(
+            "feltdb-partial-{}-{}",
+            std::process::id(),
+            rand::random::<u64>()
+        ));
+        let archive = root.join("archive");
+        fs::create_dir_all(archive.with_extension("partial")).unwrap();
+        assert_eq!(
+            verify_bundle(&archive).unwrap_err().kind(),
+            io::ErrorKind::InvalidData
+        );
+        assert!(restore_bundle(&archive, &root.join("restore")).is_err());
+        assert!(!root.join("restore").exists());
+        let _ = fs::remove_dir_all(root);
+    }
+
+    #[test]
+    fn point_in_time_selection_uses_latest_verified_preceding_bundle() {
+        let root = std::env::temp_dir().join(format!(
+            "feltdb-point-in-time-{}-{}",
+            std::process::id(),
+            rand::random::<u64>()
+        ));
+        fs::create_dir_all(&root).unwrap();
+        let source = root.join("source.log");
+        fs::write(&source, b"first").unwrap();
+        let first = create_bundle(
+            &root.join("catalog/first"),
+            &[("state.log".into(), source.clone())],
+        )
+        .unwrap();
+        std::thread::sleep(std::time::Duration::from_millis(2));
+        fs::write(&source, b"second").unwrap();
+        let second = create_bundle(
+            &root.join("catalog/second"),
+            &[("state.log".into(), source)],
+        )
+        .unwrap();
+
+        assert_eq!(
+            select_bundle_at(&root.join("catalog"), first.created_ms).unwrap(),
+            root.join("catalog/first")
+        );
+        assert_eq!(
+            select_bundle_at(&root.join("catalog"), second.created_ms).unwrap(),
+            root.join("catalog/second")
+        );
+        assert!(select_bundle_at(&root.join("catalog"), first.created_ms - 1).is_err());
+        fs::remove_dir_all(root).unwrap();
+    }
+}

package/dist/create/server-source/crates/feltdb-server/src/causal.rs

@@ -0,0 +1,218 @@
+use rand::{distributions::Alphanumeric, Rng};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::{
+    collections::BTreeMap,
+    fs,
+    path::PathBuf,
+    sync::{Arc, RwLock},
+    time::{SystemTime, UNIX_EPOCH},
+};
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CausalEvent {
+    pub event_id: String,
+    pub causal_id: String,
+    pub parent_event_id: Option<String>,
+    pub timestamp: u64,
+    pub tenant_id: String,
+    pub application_id: String,
+    pub revision_id: Option<String>,
+    pub subject_id: String,
+    pub subject_type: String,
+    pub authorization_decision_id: Option<String>,
+    pub capability: Option<String>,
+    pub resource: Option<String>,
+    pub operation: String,
+    pub workload_id: Option<String>,
+    pub attempt_id: Option<String>,
+    pub worker_id: Option<String>,
+    pub connection_id: Option<String>,
+    pub execution_id: Option<String>,
+    pub state_version: Option<String>,
+    pub operation_ids: Vec<String>,
+    pub artifact_ids: Vec<String>,
+    pub result_id: Option<String>,
+    pub status: String,
+    pub error_code: Option<String>,
+    pub metadata: BTreeMap<String, Value>,
+    pub schema_version: u32,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CausalContext {
+    pub causal_id: String,
+    pub parent_event_id: Option<String>,
+}
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct Records {
+    events: Vec<CausalEvent>,
+}
+#[derive(Clone)]
+pub struct CausalStore {
+    path: PathBuf,
+    records: Arc<RwLock<Records>>,
+}
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+fn id(prefix: &str) -> String {
+    format!(
+        "{prefix}_{}",
+        rand::thread_rng()
+            .sample_iter(&Alphanumeric)
+            .take(18)
+            .map(char::from)
+            .collect::<String>()
+    )
+}
+impl CausalStore {
+    pub fn load(path: impl Into<PathBuf>) -> Result<Self, String> {
+        let path = path.into();
+        let records = if path.exists() {
+            serde_json::from_slice(&fs::read(&path).map_err(|e| e.to_string())?)
+                .map_err(|e| e.to_string())?
+        } else {
+            Records::default()
+        };
+        Ok(Self {
+            path,
+            records: Arc::new(RwLock::new(records)),
+        })
+    }
+    fn persist(&self, r: &Records) -> Result<(), String> {
+        if let Some(p) = self.path.parent() {
+            fs::create_dir_all(p).map_err(|e| e.to_string())?
+        }
+        let tmp = self.path.with_extension("tmp");
+        fs::write(
+            &tmp,
+            serde_json::to_vec_pretty(r).map_err(|e| e.to_string())?,
+        )
+        .map_err(|e| e.to_string())?;
+        fs::rename(tmp, &self.path).map_err(|e| e.to_string())
+    }
+    pub fn append(&self, mut event: CausalEvent) -> Result<CausalEvent, String> {
+        if event.causal_id.is_empty() {
+            event.causal_id = id("causal")
+        }
+        event.event_id = if event.event_id.is_empty() {
+            id("event")
+        } else {
+            event.event_id
+        };
+        event.timestamp = if event.timestamp == 0 {
+            now()
+        } else {
+            event.timestamp
+        };
+        event.schema_version = 1;
+        let mut r = self
+            .records
+            .write()
+            .map_err(|_| "causal store lock poisoned")?;
+        if r.events.iter().any(|e| e.event_id == event.event_id) {
+            return Ok(event);
+        }
+        r.events.push(event.clone());
+        self.persist(&r)?;
+        Ok(event)
+    }
+    pub fn list(&self, causal_id: &str) -> Vec<CausalEvent> {
+        self.records
+            .read()
+            .map(|r| {
+                r.events
+                    .iter()
+                    .filter(|e| e.causal_id == causal_id)
+                    .cloned()
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+    pub fn workload(&self, id: &str) -> Vec<CausalEvent> {
+        self.records
+            .read()
+            .map(|r| {
+                r.events
+                    .iter()
+                    .filter(|e| e.workload_id.as_deref() == Some(id))
+                    .cloned()
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+    pub fn execution(&self, id: &str) -> Vec<CausalEvent> {
+        self.records
+            .read()
+            .map(|r| {
+                r.events
+                    .iter()
+                    .filter(|e| e.execution_id.as_deref() == Some(id))
+                    .cloned()
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+    pub fn revision(&self, id: &str) -> Vec<CausalEvent> {
+        self.records
+            .read()
+            .map(|r| {
+                r.events
+                    .iter()
+                    .filter(|e| e.revision_id.as_deref() == Some(id))
+                    .cloned()
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+    pub fn all(&self) -> Vec<CausalEvent> {
+        self.records
+            .read()
+            .map(|r| r.events.clone())
+            .unwrap_or_default()
+    }
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn causal_chain_is_durable_idempotent_and_queryable() {
+        let p = std::env::temp_dir().join(format!("causal-{}", now()));
+        let s = CausalStore::load(&p).unwrap();
+        let e = CausalEvent {
+            event_id: "e1".into(),
+            causal_id: "c1".into(),
+            parent_event_id: None,
+            timestamp: 0,
+            tenant_id: "t".into(),
+            application_id: "a".into(),
+            revision_id: Some("r".into()),
+            subject_id: "u".into(),
+            subject_type: "human".into(),
+            authorization_decision_id: None,
+            capability: None,
+            resource: None,
+            operation: "test".into(),
+            workload_id: Some("w".into()),
+            attempt_id: None,
+            worker_id: None,
+            connection_id: None,
+            execution_id: None,
+            state_version: None,
+            operation_ids: vec![],
+            artifact_ids: vec![],
+            result_id: None,
+            status: "succeeded".into(),
+            error_code: None,
+            metadata: BTreeMap::new(),
+            schema_version: 0,
+        };
+        s.append(e.clone()).unwrap();
+        s.append(e).unwrap();
+        assert_eq!(s.list("c1").len(), 1);
+        assert_eq!(s.workload("w").len(), 1);
+        let _ = fs::remove_file(p);
+    }
+}