@feltdb/core 0.4.20 → 0.5.1

package/dist/create/server-source/crates/feltdb-server/src/main.rs

@@ -40,8 +40,8 @@ use feltdb::{
         authorize as authorize_resource, AuthorizationRequest as ResourceAuthorizationRequest,
         Grant, GrantSigner, GrantStore, Subject as GrantSubject,
     },
-    policy_evaluation::{Actor, PolicyContext, PolicyEvaluator, PolicySubject},
     cardinality_endpoint::{CardinalityContext, CardinalityDiagnosticResponse},
+    policy_evaluation::{Actor, PolicyContext, PolicyEvaluator, PolicySubject},
     state_contract::{
         begin_read, compare_schemas, execute_query as execute_state_query, execute_transaction,
         schema_from_revision, validate_schema, AuthorizationContext, CanonicalQuery, QueryFilter,
@@ -76,7 +76,7 @@ use feltdb_server::{
     connections::{ConnectionProvider, ConnectionStatus, ConnectionStore, SecretReference},
     content::ContentStore,
     identity::IdentityStore,
-    key_management::{list_keys, create_key, revoke_key},
+    key_management::{create_key, list_keys, revoke_key},
     key_provider::provider_from_environment,
     leases::LeaseStore,
     metrics::Metrics,
@@ -103,7 +103,9 @@ struct ApiError(StatusCode, String);
 
 impl IntoResponse for ApiError {
     fn into_response(self) -> Response {
-        (self.0, Json(json!({ "error": self.1 }))).into_response()
+        let body =
+            serde_json::from_str::<Value>(&self.1).unwrap_or_else(|_| json!({ "error": self.1 }));
+        (self.0, Json(body)).into_response()
     }
 }
 
@@ -2027,9 +2029,10 @@ fn is_platform_owner(principal: &Principal) -> bool {
         .any(|owner| !owner.is_empty() && owner == identity)
 }
 fn require_platform_owner(principal: &Principal) -> Result<(), ApiError> {
-    is_platform_owner(principal)
-        .then_some(())
-        .ok_or(ApiError(StatusCode::FORBIDDEN, "platform owner access required".into()))
+    is_platform_owner(principal).then_some(()).ok_or(ApiError(
+        StatusCode::FORBIDDEN,
+        "platform owner access required".into(),
+    ))
 }
 async fn platform_access(Extension(principal): Extension<Principal>) -> Json<Value> {
     let platform_role = is_platform_owner(&principal).then_some("super_owner");
@@ -2365,7 +2368,11 @@ async fn evaluate_application_contract(
 ) -> Result<Json<Value>, ApiError> {
     Ok(Json(json!(state
         .contracts
-        .evaluate(&user_contract_key(&principal, &id), &input.outcome, &principal.key_id)
+        .evaluate(
+            &user_contract_key(&principal, &id),
+            &input.outcome,
+            &principal.key_id
+        )
         .map_err(control_error)?)))
 }
 async fn patch_application_contract(
@@ -2384,7 +2391,10 @@ async fn application_contract_gaps(
     Extension(principal): Extension<Principal>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    let c = state.contracts.get(&user_contract_key(&principal, &id)).map_err(control_error)?;
+    let c = state
+        .contracts
+        .get(&user_contract_key(&principal, &id))
+        .map_err(control_error)?;
     Ok(Json(json!({"gaps":c.gaps})))
 }
 async fn application_contract_readiness(
@@ -4495,12 +4505,7 @@ async fn run_runtime_action(
         schema_version: contract.state.schema.schema_version,
         state_namespace: Some(contract.environment.state_namespace.clone()),
         causal_parent: None,
-        authorization: state_authorization(
-            &principal,
-            &contract,
-            &definition.collection,
-            "write",
-        ),
+        authorization: state_authorization(&principal, &contract, &definition.collection, "write"),
         operations: vec![TransactionOperation {
             kind,
             collection: definition.collection.clone(),
@@ -4603,12 +4608,7 @@ async fn run_runtime_query(
         &state.db,
         &contract.state.schema,
         &contract.environment.state_namespace,
-        state_authorization(
-            &principal,
-            &contract,
-            &definition.collection,
-            "read",
-        ),
+        state_authorization(&principal, &contract, &definition.collection, "read"),
     )
     .map_err(state_contract_error)?;
 
@@ -4712,7 +4712,7 @@ fn state_authorization(
     principal: &Principal,
     contract: &ApplicationRuntimeContract,
     collection: &str,
-    operation: &str,  // "read" or "write"
+    operation: &str, // "read" or "write"
 ) -> AuthorizationContext {
     let subject = format!("{}:{}", principal.subject_type, principal.key_id);
 
@@ -4888,12 +4888,7 @@ async fn execute_canonical_query(
         &state.db,
         &contract.state.schema,
         &contract.environment.state_namespace,
-        state_authorization(
-            &principal,
-            &contract,
-            &input.query.collection,
-            "read",
-        ),
+        state_authorization(&principal, &contract, &input.query.collection, "read"),
     )
     .map_err(state_contract_error)?;
 
@@ -4905,8 +4900,14 @@ async fn execute_canonical_query(
         .find(|p| p.resource == input.query.collection)
         .and_then(|p| p.read.as_ref().and_then(|s| PolicySubject::from_str(s)));
 
-    let result = execute_state_query(&state.db, &contract.state.schema, &context, &input.query, read_policy)
-        .map_err(state_contract_error)?;
+    let result = execute_state_query(
+        &state.db,
+        &contract.state.schema,
+        &context,
+        &input.query,
+        read_policy,
+    )
+    .map_err(state_contract_error)?;
     audit(
         &state,
         &principal.key_id,
@@ -4917,6 +4918,156 @@ async fn execute_canonical_query(
     );
     Ok(Json(json!(result)))
 }
+
+#[derive(serde::Deserialize)]
+struct RevisionRecoveryRequest {
+    #[serde(rename = "applicationId")]
+    application_id: String,
+    #[serde(rename = "targetRevision")]
+    target_revision: String,
+    #[serde(rename = "expectedCurrentRevision")]
+    expected_current_revision: String,
+    authorization: String,
+    actor: String,
+    reason: String,
+    #[serde(default)]
+    environment: Option<String>,
+    #[serde(default)]
+    #[serde(rename = "recoveryId")]
+    recovery_id: Option<String>,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+struct RevisionRecoveryResponse {
+    success: bool,
+    #[serde(rename = "pointerMoved")]
+    pointer_moved: bool,
+    #[serde(rename = "sourceMarkedUntrusted")]
+    source_marked_untrusted: bool,
+    #[serde(rename = "auditDurable")]
+    audit_durable: bool,
+    #[serde(rename = "recoveryId")]
+    recovery_id: String,
+    #[serde(rename = "targetRevision")]
+    target_revision: String,
+    #[serde(rename = "currentRevision")]
+    current_revision: String,
+    audit: serde_json::Value,
+}
+
+fn revision_recovery_error(
+    status: StatusCode,
+    code: &str,
+    message: String,
+    request_id: &str,
+    transaction_id: &str,
+) -> ApiError {
+    ApiError(
+        status,
+        json!({"code":code,"message":message,"request_id":request_id,
+        "transaction_id":transaction_id,"http_status":status.as_u16()})
+        .to_string(),
+    )
+}
+
+async fn execute_revision_recovery(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Json(input): Json<RevisionRecoveryRequest>,
+) -> Result<Json<RevisionRecoveryResponse>, ApiError> {
+    let request_id = uuid::Uuid::new_v4().to_string();
+    let transaction_id = input
+        .recovery_id
+        .clone()
+        .unwrap_or_else(|| uuid::Uuid::new_v4().to_string());
+
+    // Validate authorization level
+    let auth_level = input.authorization.as_str();
+
+    if !["ELEVATED", "ADMIN", "EMERGENCY"].contains(&auth_level) {
+        return Err(revision_recovery_error(
+            StatusCode::FORBIDDEN,
+            "PERMISSION_DENIED",
+            "Recovery requires ELEVATED, ADMIN, or EMERGENCY authorization".into(),
+            &request_id,
+            &transaction_id,
+        ));
+    }
+
+    // Validate input
+    if input.reason.len() < 10 {
+        return Err(revision_recovery_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "PRECONDITION_FAILED",
+            "Recovery reason must be at least 10 characters".into(),
+            &request_id,
+            &transaction_id,
+        ));
+    }
+
+    let recovery_id = transaction_id.clone();
+    let environment = input
+        .environment
+        .unwrap_or_else(|| "production".to_string());
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:revision:promote",
+    )?;
+    let recovery = state
+        .applications
+        .recover_environment_pointer(
+            &tenant,
+            &input.application_id,
+            &environment,
+            &input.expected_current_revision,
+            &input.target_revision,
+            &input.actor,
+            &input.reason,
+            auth_level,
+            &recovery_id,
+        )
+        .map_err(|message| {
+            let (status, code) = if message.starts_with("expected_revision_mismatch")
+                || message == "recovery_id_conflict"
+            {
+                (StatusCode::CONFLICT, "CONFLICT")
+            } else if message.contains("not found") {
+                (StatusCode::NOT_FOUND, "PRECONDITION_FAILED")
+            } else if message.contains("integrity") || message.contains("untrusted") {
+                (StatusCode::UNPROCESSABLE_ENTITY, "VALIDATION_FAILED")
+            } else {
+                (StatusCode::SERVICE_UNAVAILABLE, "STORAGE_FAILURE")
+            };
+            revision_recovery_error(status, code, message, &request_id, &transaction_id)
+        })?;
+
+    // Build response
+    let response = RevisionRecoveryResponse {
+        success: true,
+        pointer_moved: true,
+        source_marked_untrusted: true,
+        audit_durable: true,
+        recovery_id: recovery_id.clone(),
+        target_revision: recovery.target_revision.clone(),
+        current_revision: recovery.target_revision.clone(),
+        audit: json!(recovery),
+    };
+
+    // Audit log
+    audit(
+        &state,
+        &principal.key_id,
+        "revision.recover",
+        &recovery_id,
+        "allowed",
+        200,
+    );
+
+    Ok(Json(response))
+}
+
 async fn execute_canonical_transaction(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
@@ -4942,24 +5093,27 @@ async fn execute_canonical_transaction(
     input.transaction.state_namespace = Some(contract.environment.state_namespace.clone());
     // For transactions with operations, use the first operation's collection for policy evaluation
     // Multi-collection transactions will still be checked at the operation level in execute_transaction
-    let collection = input.transaction.operations
+    let collection = input
+        .transaction
+        .operations
         .first()
         .map(|op| op.collection.clone())
         .unwrap_or_default();
-    input.transaction.authorization = state_authorization(
-        &principal,
-        &contract,
-        &collection,
-        "write",
-    );
+    input.transaction.authorization =
+        state_authorization(&principal, &contract, &collection, "write");
     let write_policy = contract
         .policies
         .definitions
         .iter()
         .find(|p| p.resource == collection)
         .and_then(|p| p.write.as_ref().and_then(|s| PolicySubject::from_str(s)));
-    let result = execute_transaction(&state.db, &contract.state.schema, &input.transaction, write_policy)
-        .map_err(state_contract_error)?;
+    let result = execute_transaction(
+        &state.db,
+        &contract.state.schema,
+        &input.transaction,
+        write_policy,
+    )
+    .map_err(state_contract_error)?;
     audit(
         &state,
         &principal.key_id,
@@ -4975,13 +5129,19 @@ async fn get_cardinality_diagnostic(
     State(state): State<AppState>,
     Path(pattern): Path<String>,
 ) -> Result<Json<CardinalityDiagnosticResponse>, ApiError> {
-    let all_cardinalities = state.db.list_cardinalities()
+    let all_cardinalities = state
+        .db
+        .list_cardinalities()
         .map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
-    let actual_rows = state.db.diagnostic_row_count(&pattern)
+    let actual_rows = state
+        .db
+        .diagnostic_row_count(&pattern)
         .map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
-    let persisted_capability_keys = state.db.diagnostic_capability_keys(&pattern)
+    let persisted_capability_keys = state
+        .db
+        .diagnostic_capability_keys(&pattern)
         .map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
     let matching_keys: Vec<_> = all_cardinalities
@@ -4992,10 +5152,7 @@ async fn get_cardinality_diagnostic(
 
     let cardinality_map_keys: Vec<String> = matching_keys.iter().map(|(k, _)| k.clone()).collect();
 
-    let maintained = matching_keys
-        .iter()
-        .map(|(_, v)| v)
-        .sum::<u64>();
+    let maintained = matching_keys.iter().map(|(_, v)| v).sum::<u64>();
 
     let now_ms = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
@@ -5752,6 +5909,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             "/v1/transactions",
             axum::routing::post(execute_canonical_transaction),
         )
+        .route(
+            "/v1/revision/recover",
+            axum::routing::post(execute_revision_recovery),
+        )
         .route(
             "/debug/cardinality/{pattern}",
             get(get_cardinality_diagnostic),