@feltdb/core 0.4.15 → 0.4.16

package/dist/create/server-source/crates/feltdb/src/lib.rs

@@ -7,6 +7,9 @@ pub mod admission;
 pub mod application;
 pub mod application_runtime;
 pub mod authorization;
+pub mod policy_evaluation;
+#[cfg(test)]
+mod authorization_security_tests;
 pub mod capabilities;
 mod capability;
 mod content_distribution;
@@ -233,6 +236,7 @@ use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex};
 use std::time::{SystemTime, UNIX_EPOCH};
 use tokio::sync::broadcast;
+use crate::state_contract::AuthorizationContext;
 
 pub type Result<T> = std::result::Result<T, FlowError>;
 
@@ -485,6 +489,112 @@ impl FeltDb {
         Ok(())
     }
 
+    /// Evaluate authorization for a mutation
+    fn evaluate_authorization(&self, context: &AuthorizationContext) -> Result<()> {
+        // Check basic capabilities
+        if !context.capabilities.contains(&"state:write".to_string()) {
+            return Err(FlowError::CapabilityError(
+                "AUTHORIZATION_DENIED:missing_state_write_capability".to_string(),
+            ));
+        }
+
+        // Tenant isolation check happens implicitly at mutation boundary
+        // by only checking against current database tenant_id
+
+        Ok(())
+    }
+
+    /// Insert a record with authorization context
+    pub fn insert_with_authorization<T: Serialize>(
+        &self,
+        key: &str,
+        value: T,
+        context: &AuthorizationContext,
+    ) -> Result<()> {
+        // Authorize mutation inside FeltDB boundary
+        self.evaluate_authorization(context)?;
+
+        let capability = key
+            .split_once(':')
+            .map(|(cap, _)| cap)
+            .unwrap_or("default")
+            .to_string();
+
+        // Check if capability is writable
+        if !context.writable_collections.is_empty()
+            && !context.writable_collections.contains(&capability)
+        {
+            return Err(FlowError::CapabilityError(
+                format!("AUTHORIZATION_DENIED:not_writable_collection:{}", capability),
+            ));
+        }
+
+        // Authorized: apply mutation
+        self.insert_internal(capability, key.to_string(), value)?;
+        Ok(())
+    }
+
+    /// Update a record with authorization context
+    pub fn update_with_authorization<T: Serialize>(
+        &self,
+        key: &str,
+        value: T,
+        context: &AuthorizationContext,
+    ) -> Result<()> {
+        // Authorize mutation inside FeltDB boundary
+        self.evaluate_authorization(context)?;
+
+        let capability = key
+            .split_once(':')
+            .map(|(cap, _)| cap)
+            .unwrap_or("default")
+            .to_string();
+
+        // Check if capability is writable
+        if !context.writable_collections.is_empty()
+            && !context.writable_collections.contains(&capability)
+        {
+            return Err(FlowError::CapabilityError(
+                format!("AUTHORIZATION_DENIED:not_writable_collection:{}", capability),
+            ));
+        }
+
+        // Authorized: apply mutation
+        // Pre-state evaluation would happen here in full implementation
+        self.update_internal(capability, key.to_string(), value)?;
+        Ok(())
+    }
+
+    /// Delete a record with authorization context
+    pub fn delete_with_authorization(
+        &self,
+        key: &str,
+        context: &AuthorizationContext,
+    ) -> Result<()> {
+        // Authorize mutation inside FeltDB boundary
+        self.evaluate_authorization(context)?;
+
+        let capability = key
+            .split_once(':')
+            .map(|(cap, _)| cap)
+            .unwrap_or("default")
+            .to_string();
+
+        // Check if capability is writable
+        if !context.writable_collections.is_empty()
+            && !context.writable_collections.contains(&capability)
+        {
+            return Err(FlowError::CapabilityError(
+                format!("AUTHORIZATION_DENIED:not_writable_collection:{}", capability),
+            ));
+        }
+
+        // Authorized: apply mutation
+        // Pre-state evaluation would happen here in full implementation
+        self.delete_internal(capability, key.to_string())?;
+        Ok(())
+    }
+
     pub fn get<T: DeserializeOwned>(&self, key: &str) -> Result<Option<T>> {
         let capability = key
             .split_once(':')
@@ -785,6 +895,35 @@ impl FeltDb {
         Ok(commit)
     }
 
+    /// Apply atomic transaction with authorization context (atomic rejection on deny)
+    pub fn apply_atomic_transaction_with_authorization(
+        &self,
+        transaction_id: &str,
+        expected_parent: Option<u64>,
+        preconditions: &[AtomicPrecondition],
+        mutations: &[AtomicMutation],
+        audit: Option<Value>,
+        context: &AuthorizationContext,
+    ) -> Result<AtomicCommit> {
+        // Authorize ALL mutations before applying ANY of them (atomicity guarantee)
+        self.evaluate_authorization(context)?;
+
+        // Check writable collections for all mutations
+        for mutation in mutations {
+            if !context.writable_collections.is_empty()
+                && !context.writable_collections.contains(&mutation.capability)
+            {
+                return Err(FlowError::CapabilityError(format!(
+                    "AUTHORIZATION_DENIED:not_writable_collection:{}",
+                    mutation.capability
+                )));
+            }
+        }
+
+        // All authorized: proceed with atomic transaction (no partial application)
+        self.apply_atomic_transaction(transaction_id, expected_parent, preconditions, mutations, audit)
+    }
+
     fn insert_internal<T: Serialize>(
         &self,
         capability: String,