@feltdb/core 0.4.15 → 0.4.16

package/dist/cli/index.js

@@ -23,7 +23,7 @@ import * as path from 'path';
 import * as readline from 'readline';
 import { getClient } from './api-client.js';
 import { loadFeltDBConfig, createDefaultConfig, validateModel, } from './config.js';
-const VERSION = '0.4.15';
+const VERSION = '0.4.16';
 function prompt(question) {
     const rl = readline.createInterface({
         input: process.stdin,

package/dist/create/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.4.15';
+export const FELTDB_PACKAGE_VERSION = '0.4.16';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/create/server-source/crates/feltdb/Cargo.toml

@@ -15,7 +15,7 @@ rand = "0.8"
 bincode = "1"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-tokio = { version = "1", features = ["net", "io-util"] }
+tokio = { version = "1", features = ["net", "io-util", "rt-multi-thread"] }
 
 [dev-dependencies]
 criterion = { version = "0.5", features = ["html_reports"] }

package/dist/create/server-source/crates/feltdb/src/application.rs

@@ -152,6 +152,10 @@ pub struct PolicyDefinition {
     pub name: String,
     pub resource: String,
     #[serde(default)]
+    pub read: Option<String>,
+    #[serde(default)]
+    pub write: Option<String>,
+    #[serde(default)]
     pub capabilities: Vec<String>,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -363,6 +367,10 @@ pub struct ValidationReport {
     pub issues: Vec<ValidationIssue>,
 }
 
+fn is_valid_policy_subject(subject: &str) -> bool {
+    matches!(subject, "authenticated" | "owner" | "member")
+}
+
 fn unique(
     issues: &mut Vec<ValidationIssue>,
     category: &str,
@@ -734,6 +742,24 @@ pub fn validate_manifest(
                 ));
             }
         }
+        if let Some(ref read_subject) = policy.read {
+            if !is_valid_policy_subject(read_subject) {
+                issues.push(issue(
+                    "semantic",
+                    format!("policies.{}.read", policy.name),
+                    &format!("invalid policy subject '{}'", read_subject),
+                ));
+            }
+        }
+        if let Some(ref write_subject) = policy.write {
+            if !is_valid_policy_subject(write_subject) {
+                issues.push(issue(
+                    "semantic",
+                    format!("policies.{}.write", policy.name),
+                    &format!("invalid policy subject '{}'", write_subject),
+                ));
+            }
+        }
     }
     let state_schema = crate::state_contract::schema_from_manifest(manifest, "validation");
     let schema_validation = crate::state_contract::validate_schema(&state_schema);
@@ -2241,4 +2267,71 @@ mod tests {
             Some(promotion.diff_hash.as_str())
         );
     }
+
+    #[test]
+    fn policy_with_valid_authenticated_subject() {
+        let mut manifest = ApplicationManifest::empty("tenant", "app", "test");
+        manifest.policies.push(PolicyDefinition {
+            name: "TodoPolicy".into(),
+            resource: "Todo".into(),
+            read: Some("authenticated".into()),
+            write: Some("authenticated".into()),
+            capabilities: vec![],
+        });
+
+        let report = validate_manifest(&manifest, "tenant", "app", None);
+        assert!(report.valid, "Policy with authenticated subject should be valid: {:?}", report.issues);
+    }
+
+    #[test]
+    fn policy_with_valid_owner_subject() {
+        let mut manifest = ApplicationManifest::empty("tenant", "app", "test");
+        manifest.policies.push(PolicyDefinition {
+            name: "ProjectPolicy".into(),
+            resource: "Project".into(),
+            read: Some("authenticated".into()),
+            write: Some("owner".into()),
+            capabilities: vec![],
+        });
+
+        let report = validate_manifest(&manifest, "tenant", "app", None);
+        assert!(report.valid, "Policy with owner subject should be valid: {:?}", report.issues);
+    }
+
+    #[test]
+    fn policy_with_invalid_subject_rejected() {
+        let mut manifest = ApplicationManifest::empty("tenant", "app", "test");
+        manifest.policies.push(PolicyDefinition {
+            name: "BadPolicy".into(),
+            resource: "BadCollection".into(),
+            read: Some("unknown_subject".into()),
+            write: None,
+            capabilities: vec![],
+        });
+
+        let report = validate_manifest(&manifest, "tenant", "app", None);
+        assert!(!report.valid, "Policy with unknown subject should be invalid");
+        assert!(
+            report.issues.iter().any(|i|
+                i.path.contains("BadPolicy") && i.path.contains("read") &&
+                i.message.contains("invalid policy subject")
+            ),
+            "Should have error about invalid policy subject"
+        );
+    }
+
+    #[test]
+    fn policy_without_subjects_is_valid() {
+        let mut manifest = ApplicationManifest::empty("tenant", "app", "test");
+        manifest.policies.push(PolicyDefinition {
+            name: "LegacyPolicy".into(),
+            resource: "SomeCollection".into(),
+            read: None,
+            write: None,
+            capabilities: vec!["some:capability".into()],
+        });
+
+        let report = validate_manifest(&manifest, "tenant", "app", None);
+        assert!(report.valid, "Policy without subjects should be valid (backward compatible)");
+    }
 }