@feltdb/core 0.4.12 → 0.4.14

package/dist/create/server-source/crates/feltdb-server/src/tenancy.rs

@@ -0,0 +1,1097 @@
+use std::{
+    fs,
+    path::PathBuf,
+    sync::{Arc, RwLock},
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use argon2::{
+    password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
+    Argon2,
+};
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+use rand::{distributions::Alphanumeric, Rng};
+use serde::{Deserialize, Serialize};
+
+use crate::authorization::{authorize, AuthorizationRequest, Membership, RoleGrant, Subject};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Tenant {
+    pub id: String,
+    pub name: String,
+    pub slug: String,
+    pub created_by: String,
+    pub created_at: u64,
+    pub updated_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Application {
+    pub id: String,
+    pub tenant_id: String,
+    pub name: String,
+    pub slug: String,
+    pub namespace: String,
+    pub created_by: String,
+    pub created_at: u64,
+    pub updated_at: u64,
+    #[serde(default = "application_status")]
+    pub status: String,
+    #[serde(default)]
+    pub active_revision: Option<String>,
+    #[serde(default)]
+    pub environment_revisions: std::collections::BTreeMap<String, String>,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TenantMembership {
+    pub tenant_id: String,
+    pub user_id: String,
+    pub role: String,
+    pub status: MembershipStatus,
+    pub created_at: u64,
+    pub updated_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ApplicationMembership {
+    pub application_id: String,
+    pub user_id: String,
+    pub role: String,
+    pub status: MembershipStatus,
+    pub created_at: u64,
+    pub updated_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PlatformUser {
+    pub user_id: String,
+    pub identity: String,
+    pub status: MembershipStatus,
+    pub created_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum MembershipStatus {
+    Active,
+    Revoked,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Invitation {
+    pub id: String,
+    pub tenant_id: String,
+    pub application_id: Option<String>,
+    pub email: String,
+    pub role: String,
+    pub invited_by: String,
+    pub token_hash: String,
+    pub expires_at: u64,
+    pub accepted_at: Option<u64>,
+    pub revoked_at: Option<u64>,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PlatformAuditEvent {
+    pub event: String,
+    pub actor: String,
+    pub tenant_id: String,
+    pub application_id: Option<String>,
+    pub target: String,
+    pub at: u64,
+}
+
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct PlatformRecords {
+    #[serde(default)]
+    users: Vec<PlatformUser>,
+    tenants: Vec<Tenant>,
+    applications: Vec<Application>,
+    tenant_memberships: Vec<TenantMembership>,
+    application_memberships: Vec<ApplicationMembership>,
+    invitations: Vec<Invitation>,
+    audit: Vec<PlatformAuditEvent>,
+}
+
+#[derive(Clone)]
+pub struct TenancyStore {
+    path: PathBuf,
+    records: Arc<RwLock<PlatformRecords>>,
+}
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+fn id(prefix: &str) -> String {
+    let value: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(18)
+        .map(char::from)
+        .collect();
+    format!("{prefix}_{value}")
+}
+fn slug(value: &str) -> String {
+    value
+        .to_lowercase()
+        .chars()
+        .map(|character| {
+            if character.is_ascii_alphanumeric() {
+                character
+            } else {
+                '-'
+            }
+        })
+        .collect::<String>()
+        .split('-')
+        .filter(|part| !part.is_empty())
+        .collect::<Vec<_>>()
+        .join("-")
+}
+fn platform_owner_user(user_id: &str) -> bool {
+    std::env::var("FELTDB_PLATFORM_OWNERS")
+        .unwrap_or_default()
+        .split(',')
+        .map(|owner| owner.trim().to_lowercase())
+        .filter(|owner| !owner.is_empty())
+        .map(|owner| format!("user_{}", URL_SAFE_NO_PAD.encode(owner).chars().take(18).collect::<String>()))
+        .any(|owner_id| owner_id == user_id)
+}
+
+pub fn tenant_role_grants() -> Vec<RoleGrant> {
+    vec![
+        RoleGrant {
+            role: "owner".into(),
+            capabilities: vec!["*".into()],
+        },
+        RoleGrant {
+            role: "admin".into(),
+            capabilities: vec![
+                "applications:read".into(),
+                "applications:write".into(),
+                "members:read".into(),
+                "members:write".into(),
+                "members:invite".into(),
+                "audit:read".into(),
+            ],
+        },
+        RoleGrant {
+            role: "member".into(),
+            capabilities: vec!["applications:read".into(), "members:read".into()],
+        },
+        RoleGrant {
+            role: "viewer".into(),
+            capabilities: vec!["applications:read".into()],
+        },
+    ]
+}
+
+pub fn application_role_grants() -> Vec<RoleGrant> {
+    vec![
+        RoleGrant {
+            role: "owner".into(),
+            capabilities: vec!["*".into()],
+        },
+        RoleGrant {
+            role: "promoter".into(),
+            capabilities: vec![
+                "application:read".into(),
+                "application:revision:read".into(),
+                "application:runtime:run".into(),
+                "application:runtime:stop".into(),
+                "application:revision:promote".into(),
+                "application:revision:rollback".into(),
+                "application:environment:read".into(),
+                "application:environment:write".into(),
+            ],
+        },
+        RoleGrant {
+            role: "editor".into(),
+            capabilities: vec![
+                "applications:read".into(),
+                "applications:write".into(),
+                "application:read".into(),
+                "application:write".into(),
+                "application:revision:create".into(),
+                "application:revision:read".into(),
+                "application:revision:preview".into(),
+                "application:environment:read".into(),
+                "application:runtime:run".into(),
+                "application:runtime:stop".into(),
+                "state:read".into(),
+                "state:write".into(),
+                "workflows:read".into(),
+                "workflows:write".into(),
+                "agents:read".into(),
+                "agents:write".into(),
+                "connections:read".into(),
+                "connections:write".into(),
+            ],
+        },
+        RoleGrant {
+            role: "operator".into(),
+            capabilities: vec![
+                "applications:read".into(),
+                "application:revision:read".into(),
+                "application:revision:rollback".into(),
+                "application:environment:read".into(),
+                "application:environment:write".into(),
+                "state:read".into(),
+                "workflows:read".into(),
+                "workflows:run".into(),
+                "workloads:read".into(),
+                "workloads:execute".into(),
+                "deployment:execute".into(),
+            ],
+        },
+        RoleGrant {
+            role: "viewer".into(),
+            capabilities: vec![
+                "applications:read".into(),
+                "application:read".into(),
+                "application:revision:read".into(),
+                "application:environment:read".into(),
+                "state:read".into(),
+            ],
+        },
+    ]
+}
+fn application_status() -> String {
+    "active".into()
+}
+
+impl TenancyStore {
+    pub fn load(path: impl Into<PathBuf>) -> Result<Self, String> {
+        let path = path.into();
+        let records = if path.exists() {
+            serde_json::from_slice(&fs::read(&path).map_err(|error| error.to_string())?)
+                .map_err(|error| error.to_string())?
+        } else {
+            PlatformRecords::default()
+        };
+        Ok(Self {
+            path,
+            records: Arc::new(RwLock::new(records)),
+        })
+    }
+    fn persist(&self, records: &PlatformRecords) -> Result<(), String> {
+        if let Some(parent) = self.path.parent() {
+            fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+        }
+        let temporary = self.path.with_extension("tmp");
+        fs::write(
+            &temporary,
+            serde_json::to_vec_pretty(records).map_err(|error| error.to_string())?,
+        )
+        .map_err(|error| error.to_string())?;
+        fs::rename(temporary, &self.path).map_err(|error| error.to_string())
+    }
+    fn audit(
+        records: &mut PlatformRecords,
+        event: &str,
+        actor: &str,
+        tenant_id: &str,
+        application_id: Option<&str>,
+        target: &str,
+    ) {
+        records.audit.push(PlatformAuditEvent {
+            event: event.into(),
+            actor: actor.into(),
+            tenant_id: tenant_id.into(),
+            application_id: application_id.map(str::to_string),
+            target: target.into(),
+            at: now(),
+        });
+    }
+
+    pub fn tenants_for(&self, user_id: &str) -> Vec<Tenant> {
+        self.records
+            .read()
+            .map(|records| {
+                records
+                    .tenant_memberships
+                    .iter()
+                    .filter(|membership| {
+                        membership.user_id == user_id
+                            && membership.status == MembershipStatus::Active
+                    })
+                    .filter_map(|membership| {
+                        records
+                            .tenants
+                            .iter()
+                            .find(|tenant| tenant.id == membership.tenant_id)
+                            .cloned()
+                    })
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+    pub fn platform_inventory(
+        &self,
+    ) -> Result<(
+        Vec<PlatformUser>,
+        Vec<Tenant>,
+        Vec<Application>,
+        Vec<TenantMembership>,
+        Vec<ApplicationMembership>,
+    ), String> {
+        let records = self
+            .records
+            .read()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        Ok((
+            records.users.clone(),
+            records.tenants.clone(),
+            records.applications.clone(),
+            records.tenant_memberships.clone(),
+            records.application_memberships.clone(),
+        ))
+    }
+
+    pub fn register_platform_user(&self, user_id: &str, identity: &str) -> Result<(), String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        if records.users.iter().any(|user| user.user_id == user_id) {
+            return Ok(());
+        }
+        records.users.push(PlatformUser {
+            user_id: user_id.into(),
+            identity: identity.trim().to_lowercase(),
+            status: MembershipStatus::Active,
+            created_at: now(),
+        });
+        self.persist(&records)
+    }
+
+    pub fn platform_update_user(
+        &self,
+        actor: &str,
+        user_id: &str,
+        status: MembershipStatus,
+    ) -> Result<PlatformUser, String> {
+        if actor == user_id {
+            return Err("platform owners cannot suspend their own active session".into());
+        }
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let user = records
+            .users
+            .iter_mut()
+            .find(|user| user.user_id == user_id)
+            .ok_or("platform user not found")?;
+        user.status = status;
+        let updated = user.clone();
+        Self::audit(&mut records, "platform.user.updated", actor, "platform", None, user_id);
+        self.persist(&records)?;
+        Ok(updated)
+    }
+
+    pub fn platform_user_active(&self, user_id: &str) -> bool {
+        self.records.read().is_ok_and(|records| {
+            records
+                .users
+                .iter()
+                .find(|user| user.user_id == user_id)
+                .is_none_or(|user| user.status == MembershipStatus::Active)
+        })
+    }
+
+    pub fn platform_update_application_member(
+        &self,
+        actor: &str,
+        application_id: &str,
+        user_id: &str,
+        role: &str,
+        status: MembershipStatus,
+    ) -> Result<ApplicationMembership, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let tenant_id = records
+            .applications
+            .iter()
+            .find(|application| application.id == application_id)
+            .map(|application| application.tenant_id.clone())
+            .ok_or("application not found")?;
+        let membership = records
+            .application_memberships
+            .iter_mut()
+            .find(|membership| {
+                membership.application_id == application_id && membership.user_id == user_id
+            })
+            .ok_or("application membership not found")?;
+        membership.role = role.into();
+        membership.status = status;
+        membership.updated_at = now();
+        let updated = membership.clone();
+        Self::audit(
+            &mut records,
+            "application.membership.updated_by_platform_owner",
+            actor,
+            &tenant_id,
+            Some(application_id),
+            user_id,
+        );
+        self.persist(&records)?;
+        Ok(updated)
+    }
+    pub fn tenant_for(&self, user_id: &str, tenant_id: &str) -> Option<Tenant> {
+        if !self.authorize_tenant(user_id, tenant_id, "applications:read") {
+            return None;
+        }
+        self.records
+            .read()
+            .ok()?
+            .tenants
+            .iter()
+            .find(|tenant| tenant.id == tenant_id)
+            .cloned()
+    }
+    pub fn applications_for(&self, user_id: &str, tenant_id: &str) -> Vec<Application> {
+        self.records
+            .read()
+            .map(|records| {
+                records
+                    .application_memberships
+                    .iter()
+                    .filter(|membership| {
+                        membership.user_id == user_id
+                            && membership.status == MembershipStatus::Active
+                    })
+                    .filter_map(|membership| {
+                        records
+                            .applications
+                            .iter()
+                            .find(|app| {
+                                app.id == membership.application_id && app.tenant_id == tenant_id
+                            })
+                            .cloned()
+                    })
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+    pub fn application_for(&self, user_id: &str, application_id: &str) -> Option<Application> {
+        let records = self.records.read().ok()?;
+        let app = records
+            .applications
+            .iter()
+            .find(|app| app.id == application_id)?
+            .clone();
+        drop(records);
+        self.authorize_application(user_id, &app.tenant_id, &app.id, "applications:read")
+            .then_some(app)
+    }
+    pub fn application_tenant(&self, application_id: &str) -> Option<String> {
+        self.records
+            .read()
+            .ok()?
+            .applications
+            .iter()
+            .find(|app| app.id == application_id)
+            .map(|app| app.tenant_id.clone())
+    }
+    pub fn application_members_for(
+        &self,
+        actor: &str,
+        tenant_id: &str,
+        application_id: &str,
+    ) -> Result<Vec<ApplicationMembership>, String> {
+        if !self.authorize_application(actor, tenant_id, application_id, "members:read") {
+            return Err("forbidden".into());
+        }
+        Ok(self
+            .records
+            .read()
+            .map_err(|_| "tenancy store lock poisoned")?
+            .application_memberships
+            .iter()
+            .filter(|membership| {
+                membership.application_id == application_id
+                    && membership.status == MembershipStatus::Active
+            })
+            .cloned()
+            .collect())
+    }
+    pub fn audit_for_application(
+        &self,
+        actor: &str,
+        tenant_id: &str,
+        application_id: &str,
+    ) -> Result<Vec<PlatformAuditEvent>, String> {
+        if !self.authorize_application(actor, tenant_id, application_id, "audit:read") {
+            return Err("forbidden".into());
+        }
+        Ok(self
+            .records
+            .read()
+            .map_err(|_| "tenancy store lock poisoned")?
+            .audit
+            .iter()
+            .filter(|event| event.application_id.as_deref() == Some(application_id))
+            .cloned()
+            .collect())
+    }
+
+    pub fn create_tenant(&self, creator: &str, name: &str) -> Result<Tenant, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let tenant_slug = slug(name);
+        if tenant_slug.is_empty()
+            || records
+                .tenants
+                .iter()
+                .any(|tenant| tenant.slug == tenant_slug)
+        {
+            return Err("tenant slug is unavailable".into());
+        }
+        let timestamp = now();
+        let tenant = Tenant {
+            id: id("tenant"),
+            name: name.into(),
+            slug: tenant_slug,
+            created_by: creator.into(),
+            created_at: timestamp,
+            updated_at: timestamp,
+        };
+        records.tenant_memberships.push(TenantMembership {
+            tenant_id: tenant.id.clone(),
+            user_id: creator.into(),
+            role: "owner".into(),
+            status: MembershipStatus::Active,
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        records.tenants.push(tenant.clone());
+        Self::audit(
+            &mut records,
+            "tenant.created",
+            creator,
+            &tenant.id,
+            None,
+            &tenant.id,
+        );
+        self.persist(&records)?;
+        Ok(tenant)
+    }
+
+    pub fn create_application(
+        &self,
+        actor: &str,
+        tenant_id: &str,
+        name: &str,
+    ) -> Result<Application, String> {
+        if !self.authorize_tenant(actor, tenant_id, "applications:write") {
+            return Err("forbidden".into());
+        }
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let app_slug = slug(name);
+        if records
+            .applications
+            .iter()
+            .any(|app| app.tenant_id == tenant_id && app.slug == app_slug)
+        {
+            return Err("application slug is unavailable".into());
+        }
+        let timestamp = now();
+        let application = Application {
+            id: id("app"),
+            tenant_id: tenant_id.into(),
+            name: name.into(),
+            slug: app_slug.clone(),
+            namespace: format!("{tenant_id}:{app_slug}"),
+            created_by: actor.into(),
+            created_at: timestamp,
+            updated_at: timestamp,
+            status: application_status(),
+            active_revision: None,
+            environment_revisions: Default::default(),
+        };
+        records.application_memberships.push(ApplicationMembership {
+            application_id: application.id.clone(),
+            user_id: actor.into(),
+            role: "owner".into(),
+            status: MembershipStatus::Active,
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        records.applications.push(application.clone());
+        Self::audit(
+            &mut records,
+            "application.created",
+            actor,
+            tenant_id,
+            Some(&application.id),
+            &application.id,
+        );
+        self.persist(&records)?;
+        Ok(application)
+    }
+
+    pub fn delete_application(&self, actor: &str, application_id: &str) -> Result<(), String> {
+        let tenant_id = self
+            .application_tenant(application_id)
+            .ok_or_else(|| "application not found".to_string())?;
+        if !self.authorize_application(actor, &tenant_id, application_id, "applications:write") {
+            return Err("forbidden".into());
+        }
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        Self::audit(
+            &mut records,
+            "application.deleted",
+            actor,
+            &tenant_id,
+            Some(application_id),
+            application_id,
+        );
+        records
+            .applications
+            .retain(|application| application.id != application_id);
+        records
+            .application_memberships
+            .retain(|membership| membership.application_id != application_id);
+        self.persist(&records)
+    }
+
+    pub fn rename_application(
+        &self,
+        actor: &str,
+        application_id: &str,
+        name: &str,
+    ) -> Result<Application, String> {
+        let tenant_id = self
+            .application_tenant(application_id)
+            .ok_or_else(|| "application not found".to_string())?;
+        if !self.authorize_application(actor, &tenant_id, application_id, "applications:write") {
+            return Err("forbidden".into());
+        }
+        let next_name = name.trim();
+        if next_name.is_empty() {
+            return Err("application name is required".into());
+        }
+        let next_slug = slug(next_name);
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        if records.applications.iter().any(|app| {
+            app.id != application_id && app.tenant_id == tenant_id && app.slug == next_slug
+        }) {
+            return Err("application slug is unavailable".into());
+        }
+        let app = records
+            .applications
+            .iter_mut()
+            .find(|app| app.id == application_id)
+            .ok_or("application not found")?;
+        app.name = next_name.into();
+        app.slug = next_slug.clone();
+        app.namespace = format!("{tenant_id}:{next_slug}");
+        app.updated_at = now();
+        let updated = app.clone();
+        Self::audit(
+            &mut records,
+            "application.renamed",
+            actor,
+            &tenant_id,
+            Some(application_id),
+            application_id,
+        );
+        self.persist(&records)?;
+        Ok(updated)
+    }
+
+    pub fn set_revision_pointer(
+        &self,
+        actor: &str,
+        tenant_id: &str,
+        application_id: &str,
+        environment: &str,
+        revision_id: &str,
+    ) -> Result<Application, String> {
+        if !self.authorize_application(
+            actor,
+            tenant_id,
+            application_id,
+            "application:revision:promote",
+        ) && !self.authorize_application(
+            actor,
+            tenant_id,
+            application_id,
+            "application:revision:rollback",
+        ) {
+            return Err("forbidden".into());
+        }
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let app = records
+            .applications
+            .iter_mut()
+            .find(|app| app.id == application_id && app.tenant_id == tenant_id)
+            .ok_or("application not found")?;
+        app.environment_revisions
+            .insert(environment.into(), revision_id.into());
+        if environment == "production" {
+            app.active_revision = Some(revision_id.into());
+        }
+        app.updated_at = now();
+        let result = app.clone();
+        Self::audit(
+            &mut records,
+            "revision.promoted",
+            actor,
+            tenant_id,
+            Some(application_id),
+            revision_id,
+        );
+        self.persist(&records)?;
+        Ok(result)
+    }
+
+    pub fn authorize_tenant(&self, user_id: &str, tenant_id: &str, capability: &str) -> bool {
+        if !self.platform_user_active(user_id) {
+            return false;
+        }
+        if platform_owner_user(user_id) {
+            return self
+                .records
+                .read()
+                .is_ok_and(|records| records.tenants.iter().any(|tenant| tenant.id == tenant_id));
+        }
+        let records = match self.records.read() {
+            Ok(records) => records,
+            Err(_) => return false,
+        };
+        let memberships: Vec<Membership> = records
+            .tenant_memberships
+            .iter()
+            .map(|membership| Membership {
+                subject_id: membership.user_id.clone(),
+                tenant_id: membership.tenant_id.clone(),
+                application_id: None,
+                roles: vec![membership.role.clone()],
+                revoked: membership.status == MembershipStatus::Revoked,
+            })
+            .collect();
+        authorize(&AuthorizationRequest {
+            subject: &Subject::User(user_id.into()),
+            tenant_id,
+            application_id: None,
+            capability,
+            direct_grants: &[],
+            memberships: &memberships,
+            roles: &tenant_role_grants(),
+        })
+        .allowed
+    }
+
+    pub fn authorize_application(
+        &self,
+        user_id: &str,
+        tenant_id: &str,
+        application_id: &str,
+        capability: &str,
+    ) -> bool {
+        if !self.platform_user_active(user_id) {
+            return false;
+        }
+        let records = match self.records.read() {
+            Ok(records) => records,
+            Err(_) => return false,
+        };
+        if !records
+            .applications
+            .iter()
+            .any(|app| app.id == application_id && app.tenant_id == tenant_id)
+        {
+            return false;
+        }
+        if platform_owner_user(user_id) {
+            return true;
+        }
+        let memberships: Vec<Membership> = records
+            .application_memberships
+            .iter()
+            .filter_map(|membership| {
+                let app = records
+                    .applications
+                    .iter()
+                    .find(|app| app.id == membership.application_id)?;
+                Some(Membership {
+                    subject_id: membership.user_id.clone(),
+                    tenant_id: app.tenant_id.clone(),
+                    application_id: Some(membership.application_id.clone()),
+                    roles: vec![membership.role.clone()],
+                    revoked: membership.status == MembershipStatus::Revoked,
+                })
+            })
+            .collect();
+        authorize(&AuthorizationRequest {
+            subject: &Subject::User(user_id.into()),
+            tenant_id,
+            application_id: Some(application_id),
+            capability,
+            direct_grants: &[],
+            memberships: &memberships,
+            roles: &application_role_grants(),
+        })
+        .allowed
+    }
+
+    pub fn invite(
+        &self,
+        actor: &str,
+        tenant_id: &str,
+        application_id: Option<&str>,
+        email: &str,
+        role: &str,
+        ttl_seconds: u64,
+    ) -> Result<(Invitation, String), String> {
+        let capability = "members:invite";
+        let allowed = application_id
+            .map(|app| self.authorize_application(actor, tenant_id, app, capability))
+            .unwrap_or_else(|| self.authorize_tenant(actor, tenant_id, capability));
+        if !allowed {
+            return Err("forbidden".into());
+        }
+        let token: String = rand::thread_rng()
+            .sample_iter(&Alphanumeric)
+            .take(48)
+            .map(char::from)
+            .collect();
+        let token_hash = Argon2::default()
+            .hash_password(token.as_bytes(), &SaltString::generate(&mut OsRng))
+            .map_err(|error| error.to_string())?
+            .to_string();
+        let invitation = Invitation {
+            id: id("invite"),
+            tenant_id: tenant_id.into(),
+            application_id: application_id.map(str::to_string),
+            email: email.trim().to_lowercase(),
+            role: role.into(),
+            invited_by: actor.into(),
+            token_hash,
+            expires_at: now() + ttl_seconds,
+            accepted_at: None,
+            revoked_at: None,
+        };
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        records.invitations.push(invitation.clone());
+        Self::audit(
+            &mut records,
+            if application_id.is_some() {
+                "application.member_invited"
+            } else {
+                "member.invited"
+            },
+            actor,
+            tenant_id,
+            application_id,
+            &invitation.email,
+        );
+        self.persist(&records)?;
+        Ok((invitation, token))
+    }
+
+    pub fn accept_invitation(&self, user_id: &str, email: &str, token: &str) -> Result<(), String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let timestamp = now();
+        let index = records
+            .invitations
+            .iter()
+            .position(|invitation| {
+                invitation.email == email.trim().to_lowercase()
+                    && invitation.accepted_at.is_none()
+                    && invitation.revoked_at.is_none()
+                    && invitation.expires_at > timestamp
+                    && PasswordHash::new(&invitation.token_hash)
+                        .ok()
+                        .map(|hash| {
+                            Argon2::default()
+                                .verify_password(token.as_bytes(), &hash)
+                                .is_ok()
+                        })
+                        .unwrap_or(false)
+            })
+            .ok_or("invitation is invalid or expired")?;
+        let invitation = records.invitations[index].clone();
+        if let Some(application_id) = &invitation.application_id {
+            if !records.application_memberships.iter().any(|membership| {
+                membership.application_id == *application_id
+                    && membership.user_id == user_id
+                    && membership.status == MembershipStatus::Active
+            }) {
+                records.application_memberships.push(ApplicationMembership {
+                    application_id: application_id.clone(),
+                    user_id: user_id.into(),
+                    role: invitation.role.clone(),
+                    status: MembershipStatus::Active,
+                    created_at: timestamp,
+                    updated_at: timestamp,
+                });
+            }
+        } else if !records.tenant_memberships.iter().any(|membership| {
+            membership.tenant_id == invitation.tenant_id
+                && membership.user_id == user_id
+                && membership.status == MembershipStatus::Active
+        }) {
+            records.tenant_memberships.push(TenantMembership {
+                tenant_id: invitation.tenant_id.clone(),
+                user_id: user_id.into(),
+                role: invitation.role.clone(),
+                status: MembershipStatus::Active,
+                created_at: timestamp,
+                updated_at: timestamp,
+            });
+        }
+        records.invitations[index].accepted_at = Some(timestamp);
+        Self::audit(
+            &mut records,
+            "member.accepted",
+            user_id,
+            &invitation.tenant_id,
+            invitation.application_id.as_deref(),
+            user_id,
+        );
+        self.persist(&records)
+    }
+
+    pub fn revoke_application_member(
+        &self,
+        actor: &str,
+        tenant_id: &str,
+        application_id: &str,
+        user_id: &str,
+    ) -> Result<(), String> {
+        if !self.authorize_application(actor, tenant_id, application_id, "members:write") {
+            return Err("forbidden".into());
+        }
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let membership = records
+            .application_memberships
+            .iter_mut()
+            .find(|membership| {
+                membership.application_id == application_id && membership.user_id == user_id
+            })
+            .ok_or("membership not found")?;
+        membership.status = MembershipStatus::Revoked;
+        membership.updated_at = now();
+        Self::audit(
+            &mut records,
+            "application.member_removed",
+            actor,
+            tenant_id,
+            Some(application_id),
+            user_id,
+        );
+        self.persist(&records)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn store(name: &str) -> TenancyStore {
+        let path = std::env::temp_dir().join(format!("feltdb-{name}-{}.json", id("test")));
+        TenancyStore::load(path).unwrap()
+    }
+
+    #[test]
+    fn tenant_and_application_are_isolated() {
+        let store = store("isolation");
+        let tenant_a = store.create_tenant("user_a", "Acme").unwrap();
+        let tenant_b = store.create_tenant("user_b", "Beta").unwrap();
+        let app_a = store
+            .create_application("user_a", &tenant_a.id, "Operations")
+            .unwrap();
+        let app_b = store
+            .create_application("user_b", &tenant_b.id, "Analytics")
+            .unwrap();
+        assert!(store.authorize_application("user_a", &tenant_a.id, &app_a.id, "state:write"));
+        assert!(!store.authorize_application("user_a", &tenant_b.id, &app_b.id, "state:read"));
+        assert!(!store.authorize_application("user_a", &tenant_a.id, &app_b.id, "state:read"));
+    }
+
+    #[test]
+    fn invitation_acceptance_and_revocation_change_authorization() {
+        let store = store("invitation");
+        let tenant = store.create_tenant("owner", "Acme").unwrap();
+        let app = store
+            .create_application("owner", &tenant.id, "Support")
+            .unwrap();
+        let (_, token) = store
+            .invite(
+                "owner",
+                &tenant.id,
+                Some(&app.id),
+                "viewer@example.com",
+                "viewer",
+                3600,
+            )
+            .unwrap();
+        assert!(!store.authorize_application("viewer", &tenant.id, &app.id, "state:read"));
+        store
+            .accept_invitation("viewer", "viewer@example.com", &token)
+            .unwrap();
+        assert!(store.authorize_application("viewer", &tenant.id, &app.id, "state:read"));
+        assert!(!store.authorize_application("viewer", &tenant.id, &app.id, "state:write"));
+        store
+            .revoke_application_member("owner", &tenant.id, &app.id, "viewer")
+            .unwrap();
+        assert!(!store.authorize_application("viewer", &tenant.id, &app.id, "state:read"));
+    }
+
+    #[test]
+    fn revision_promotion_is_stronger_than_draft_editing() {
+        let store = store("revision-roles");
+        let tenant = store.create_tenant("owner", "Acme").unwrap();
+        let app = store
+            .create_application("owner", &tenant.id, "Studio")
+            .unwrap();
+        for (user, role) in [("editor", "editor"), ("promoter", "promoter")] {
+            let email = format!("{user}@example.com");
+            let (_, token) = store
+                .invite("owner", &tenant.id, Some(&app.id), &email, role, 3600)
+                .unwrap();
+            store.accept_invitation(user, &email, &token).unwrap();
+        }
+        assert!(store.authorize_application(
+            "editor",
+            &tenant.id,
+            &app.id,
+            "application:revision:create"
+        ));
+        assert!(!store.authorize_application(
+            "editor",
+            &tenant.id,
+            &app.id,
+            "application:revision:promote"
+        ));
+        assert!(store.authorize_application(
+            "promoter",
+            &tenant.id,
+            &app.id,
+            "application:revision:promote"
+        ));
+    }
+}