@feltdb/core 0.4.12 → 0.4.14

package/dist/create/server-source/crates/feltdb-server/src/principals.rs

@@ -0,0 +1,510 @@
+use crate::{
+    authorization::{authorize, AuthorizationRequest, Subject},
+    tenancy::TenancyStore,
+};
+use rand::{distributions::Alphanumeric, Rng};
+use serde::{Deserialize, Serialize};
+use std::{
+    fs,
+    path::PathBuf,
+    sync::{Arc, RwLock},
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PrincipalKind {
+    Agent,
+    Workload,
+    Service,
+    Worker,
+    Connection,
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PrincipalStatus {
+    Active,
+    Suspended,
+    Running,
+    Completed,
+    Failed,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PrincipalRecord {
+    pub id: String,
+    pub application_id: String,
+    pub kind: PrincipalKind,
+    pub name: String,
+    pub version: u64,
+    pub status: PrincipalStatus,
+    pub created_by: String,
+    pub created_at: u64,
+    pub capabilities: Vec<String>,
+    pub parent_id: Option<String>,
+    pub worker_id: Option<String>,
+    pub started_at: Option<u64>,
+    pub completed_at: Option<u64>,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PrincipalAuditEvent {
+    pub event: String,
+    pub actor: String,
+    pub principal_id: String,
+    pub application_id: String,
+    pub capability: Option<String>,
+    pub decision: Option<bool>,
+    pub at: u64,
+}
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct PrincipalRecords {
+    principals: Vec<PrincipalRecord>,
+    audit: Vec<PrincipalAuditEvent>,
+}
+#[derive(Clone)]
+pub struct PrincipalStore {
+    path: PathBuf,
+    records: Arc<RwLock<PrincipalRecords>>,
+}
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+fn id(prefix: &str) -> String {
+    let value: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(18)
+        .map(char::from)
+        .collect();
+    format!("{prefix}_{value}")
+}
+fn kind_subject(record: &PrincipalRecord) -> Subject {
+    match record.kind {
+        PrincipalKind::Agent => Subject::Agent(record.id.clone()),
+        PrincipalKind::Workload => Subject::Workload(record.id.clone()),
+        PrincipalKind::Service => Subject::Service(record.id.clone()),
+        PrincipalKind::Worker => Subject::Worker(record.id.clone()),
+        PrincipalKind::Connection => Subject::Connection(record.id.clone()),
+    }
+}
+
+impl PrincipalStore {
+    pub fn load(path: impl Into<PathBuf>) -> Result<Self, String> {
+        let path = path.into();
+        let records = if path.exists() {
+            serde_json::from_slice(&fs::read(&path).map_err(|error| error.to_string())?)
+                .map_err(|error| error.to_string())?
+        } else {
+            PrincipalRecords::default()
+        };
+        Ok(Self {
+            path,
+            records: Arc::new(RwLock::new(records)),
+        })
+    }
+    fn persist(&self, records: &PrincipalRecords) -> Result<(), String> {
+        if let Some(parent) = self.path.parent() {
+            fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+        }
+        let temporary = self.path.with_extension("tmp");
+        fs::write(
+            &temporary,
+            serde_json::to_vec_pretty(records).map_err(|error| error.to_string())?,
+        )
+        .map_err(|error| error.to_string())?;
+        fs::rename(temporary, &self.path).map_err(|error| error.to_string())
+    }
+    fn event(
+        records: &mut PrincipalRecords,
+        event: &str,
+        actor: &str,
+        principal: &PrincipalRecord,
+        capability: Option<&str>,
+        decision: Option<bool>,
+    ) {
+        records.audit.push(PrincipalAuditEvent {
+            event: event.into(),
+            actor: actor.into(),
+            principal_id: principal.id.clone(),
+            application_id: principal.application_id.clone(),
+            capability: capability.map(str::to_string),
+            decision,
+            at: now(),
+        });
+    }
+    fn application_context(tenancy: &TenancyStore, application_id: &str) -> Result<String, String> {
+        tenancy
+            .application_tenant(application_id)
+            .ok_or("application not found".into())
+    }
+
+    pub fn list(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+    ) -> Result<Vec<PrincipalRecord>, String> {
+        let tenant_id = Self::application_context(tenancy, application_id)?;
+        if !tenancy.authorize_application(actor, &tenant_id, application_id, "applications:read") {
+            return Err("forbidden".into());
+        }
+        Ok(self
+            .records
+            .read()
+            .map_err(|_| "principal store lock poisoned")?
+            .principals
+            .iter()
+            .filter(|principal| principal.application_id == application_id)
+            .cloned()
+            .collect())
+    }
+    pub fn create(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+        kind: PrincipalKind,
+        name: &str,
+    ) -> Result<PrincipalRecord, String> {
+        let tenant_id = Self::application_context(tenancy, application_id)?;
+        let required = match kind {
+            PrincipalKind::Agent => "agents:write",
+            PrincipalKind::Connection => "connections:write",
+            _ => "applications:write",
+        };
+        if !tenancy.authorize_application(actor, &tenant_id, application_id, required) {
+            return Err("forbidden".into());
+        }
+        let prefix = match kind {
+            PrincipalKind::Agent => "agent",
+            PrincipalKind::Workload => "workload",
+            PrincipalKind::Service => "service",
+            PrincipalKind::Worker => "worker",
+            PrincipalKind::Connection => "connection",
+        };
+        let principal = PrincipalRecord {
+            id: id(prefix),
+            application_id: application_id.into(),
+            kind,
+            name: name.into(),
+            version: 1,
+            status: PrincipalStatus::Active,
+            created_by: actor.into(),
+            created_at: now(),
+            capabilities: vec![],
+            parent_id: None,
+            worker_id: None,
+            started_at: None,
+            completed_at: None,
+        };
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "principal store lock poisoned")?;
+        records.principals.push(principal.clone());
+        Self::event(
+            &mut records,
+            "principal.created",
+            actor,
+            &principal,
+            None,
+            None,
+        );
+        self.persist(&records)?;
+        Ok(principal)
+    }
+    pub fn grant(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        principal_id: &str,
+        capability: &str,
+    ) -> Result<PrincipalRecord, String> {
+        if capability == "secrets:plaintext" {
+            return Err("plaintext secret access cannot be granted".into());
+        }
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "principal store lock poisoned")?;
+        let index = records
+            .principals
+            .iter()
+            .position(|principal| principal.id == principal_id)
+            .ok_or("principal not found")?;
+        let application_id = records.principals[index].application_id.clone();
+        let tenant_id = Self::application_context(tenancy, &application_id)?;
+        if actor == principal_id
+            || !tenancy.authorize_application(
+                actor,
+                &tenant_id,
+                &application_id,
+                "applications:write",
+            )
+        {
+            return Err("forbidden".into());
+        }
+        if !records.principals[index]
+            .capabilities
+            .iter()
+            .any(|existing| existing == capability)
+        {
+            records.principals[index]
+                .capabilities
+                .push(capability.into());
+            records.principals[index].version += 1;
+        }
+        let principal = records.principals[index].clone();
+        Self::event(
+            &mut records,
+            "principal.capability_granted",
+            actor,
+            &principal,
+            Some(capability),
+            None,
+        );
+        self.persist(&records)?;
+        Ok(principal)
+    }
+    pub fn authorize(&self, principal_id: &str, application_id: &str, capability: &str) -> bool {
+        let mut records = match self.records.write() {
+            Ok(records) => records,
+            Err(_) => return false,
+        };
+        let Some(principal) = records
+            .principals
+            .iter()
+            .find(|principal| principal.id == principal_id)
+            .cloned()
+        else {
+            return false;
+        };
+        let active = matches!(
+            principal.status,
+            PrincipalStatus::Active | PrincipalStatus::Running
+        ) && principal.application_id == application_id;
+        let allowed = active
+            && capability != "secrets:plaintext"
+            && authorize(&AuthorizationRequest {
+                subject: &kind_subject(&principal),
+                tenant_id: "delegated",
+                application_id: Some(application_id),
+                capability,
+                direct_grants: &principal.capabilities,
+                memberships: &[],
+                roles: &[],
+            })
+            .allowed;
+        Self::event(
+            &mut records,
+            "principal.authorized",
+            principal_id,
+            &principal,
+            Some(capability),
+            Some(allowed),
+        );
+        let _ = self.persist(&records);
+        allowed
+    }
+    pub fn create_workload(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        agent_id: &str,
+    ) -> Result<PrincipalRecord, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "principal store lock poisoned")?;
+        let agent = records
+            .principals
+            .iter()
+            .find(|principal| principal.id == agent_id && principal.kind == PrincipalKind::Agent)
+            .cloned()
+            .ok_or("agent not found")?;
+        let tenant_id = Self::application_context(tenancy, &agent.application_id)?;
+        if !tenancy.authorize_application(
+            actor,
+            &tenant_id,
+            &agent.application_id,
+            "workloads:execute",
+        ) && !tenancy.authorize_application(
+            actor,
+            &tenant_id,
+            &agent.application_id,
+            "applications:write",
+        ) {
+            return Err("forbidden".into());
+        }
+        let workload = PrincipalRecord {
+            id: id("workload"),
+            application_id: agent.application_id.clone(),
+            kind: PrincipalKind::Workload,
+            name: format!("{} execution", agent.name),
+            version: agent.version,
+            status: PrincipalStatus::Running,
+            created_by: actor.into(),
+            created_at: now(),
+            capabilities: agent.capabilities.clone(),
+            parent_id: Some(agent.id),
+            worker_id: None,
+            started_at: Some(now()),
+            completed_at: None,
+        };
+        records.principals.push(workload.clone());
+        Self::event(
+            &mut records,
+            "workload.created",
+            actor,
+            &workload,
+            None,
+            None,
+        );
+        self.persist(&records)?;
+        Ok(workload)
+    }
+    pub fn assign_worker(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        workload_id: &str,
+        worker_id: &str,
+    ) -> Result<(), String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "principal store lock poisoned")?;
+        let workload_index = records
+            .principals
+            .iter()
+            .position(|principal| {
+                principal.id == workload_id && principal.kind == PrincipalKind::Workload
+            })
+            .ok_or("workload not found")?;
+        let worker = records
+            .principals
+            .iter()
+            .find(|principal| principal.id == worker_id && principal.kind == PrincipalKind::Worker)
+            .cloned()
+            .ok_or("worker not found")?;
+        let app_id = records.principals[workload_index].application_id.clone();
+        if worker.application_id != app_id {
+            return Err("cross-application worker assignment denied".into());
+        }
+        let tenant_id = Self::application_context(tenancy, &app_id)?;
+        if !tenancy.authorize_application(actor, &tenant_id, &app_id, "applications:write") {
+            return Err("forbidden".into());
+        }
+        records.principals[workload_index].worker_id = Some(worker_id.into());
+        self.persist(&records)
+    }
+    pub fn worker_can_execute(&self, worker_id: &str, workload_id: &str) -> bool {
+        self.records
+            .read()
+            .map(|records| {
+                records.principals.iter().any(|principal| {
+                    principal.id == workload_id
+                        && principal.kind == PrincipalKind::Workload
+                        && principal.worker_id.as_deref() == Some(worker_id)
+                        && principal.status == PrincipalStatus::Running
+                })
+            })
+            .unwrap_or(false)
+    }
+    pub fn execution_snapshot(
+        &self,
+        worker_id: &str,
+        workload_id: &str,
+    ) -> Option<(String, String, Vec<String>)> {
+        self.records
+            .read()
+            .ok()?
+            .principals
+            .iter()
+            .find(|principal| {
+                principal.id == workload_id
+                    && principal.kind == PrincipalKind::Workload
+                    && principal.worker_id.as_deref() == Some(worker_id)
+                    && principal.status == PrincipalStatus::Running
+            })
+            .map(|workload| {
+                (
+                    workload.application_id.clone(),
+                    workload.id.clone(),
+                    workload.capabilities.clone(),
+                )
+            })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn stores() -> (TenancyStore, PrincipalStore, String, String) {
+        let suffix = id("test");
+        let tenancy =
+            TenancyStore::load(std::env::temp_dir().join(format!("{suffix}-tenancy.json")))
+                .unwrap();
+        let tenant = tenancy.create_tenant("owner", "Acme Principals").unwrap();
+        let app = tenancy
+            .create_application("owner", &tenant.id, "Operations")
+            .unwrap();
+        let principals =
+            PrincipalStore::load(std::env::temp_dir().join(format!("{suffix}-principals.json")))
+                .unwrap();
+        (tenancy, principals, tenant.id, app.id)
+    }
+    #[test]
+    fn agent_and_workload_are_scoped_without_escalation() {
+        let (tenancy, principals, _, app) = stores();
+        let agent = principals
+            .create("owner", &tenancy, &app, PrincipalKind::Agent, "Coordinator")
+            .unwrap();
+        principals
+            .grant("owner", &tenancy, &agent.id, "state:read")
+            .unwrap();
+        assert!(principals.authorize(&agent.id, &app, "state:read"));
+        assert!(!principals.authorize(&agent.id, &app, "state:write"));
+        assert!(!principals.authorize(&agent.id, "app_other", "state:read"));
+        assert!(principals
+            .grant(&agent.id, &tenancy, &agent.id, "state:write")
+            .is_err());
+        let workload = principals
+            .create_workload("owner", &tenancy, &agent.id)
+            .unwrap();
+        assert!(principals.authorize(&workload.id, &app, "state:read"));
+        assert!(!principals.authorize(&workload.id, &app, "state:write"));
+    }
+    #[test]
+    fn worker_only_executes_assigned_workload_and_secrets_remain_opaque() {
+        let (tenancy, principals, _, app) = stores();
+        let agent = principals
+            .create("owner", &tenancy, &app, PrincipalKind::Agent, "Agent")
+            .unwrap();
+        principals
+            .grant("owner", &tenancy, &agent.id, "connection:use")
+            .unwrap();
+        assert!(principals
+            .grant("owner", &tenancy, &agent.id, "secrets:plaintext")
+            .is_err());
+        let workload = principals
+            .create_workload("owner", &tenancy, &agent.id)
+            .unwrap();
+        let worker = principals
+            .create(
+                "owner",
+                &tenancy,
+                &app,
+                PrincipalKind::Worker,
+                "worker-east",
+            )
+            .unwrap();
+        assert!(!principals.worker_can_execute(&worker.id, &workload.id));
+        principals
+            .assign_worker("owner", &tenancy, &workload.id, &worker.id)
+            .unwrap();
+        assert!(principals.worker_can_execute(&worker.id, &workload.id));
+    }
+}