@feltdb/core 0.5.6 → 0.6.0

package/dist/create/server-source/crates/feltdb-server/src/delegation_token.rs

@@ -0,0 +1,472 @@
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Signed delegation token for federated identity.
+/// Enables Sherpa to delegate operations to FeltDB without direct credentials.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DelegationToken {
+    /// Unique token ID for idempotency and revocation tracking.
+    pub token_id: String,
+
+    /// Service that issued this token (e.g., "sherpa", "apple", "stripe").
+    pub issuer: String,
+
+    /// Service this token is intended for (e.g., "feltdb").
+    pub audience: String,
+
+    /// ID of the service key used to sign this token.
+    pub service_key_id: String,
+
+    /// Actor ID this token delegates to.
+    pub actor_id: String,
+
+    /// Tenant ID this token is scoped to.
+    pub tenant_id: String,
+
+    /// Roles granted by this delegation.
+    pub roles: Vec<String>,
+
+    /// Scope constraint for this delegation (e.g., "read_only", "write_release_jobs").
+    pub scope: DelegationScope,
+
+    /// When this token was issued (Unix seconds).
+    pub issued_at: u64,
+
+    /// When this token expires (Unix seconds).
+    pub expires_at: u64,
+
+    /// Signature of the token (issuer must verify).
+    pub signature: String,
+
+    /// Hash algorithm used for signature (e.g., "sha256").
+    pub signature_algorithm: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum DelegationScope {
+    Unrestricted,
+    ReadOnly,
+    WriteReleaseJobs,
+    ExecuteWorkflows,
+    ManagePrincipals,
+    Custom(String),
+}
+
+impl DelegationScope {
+    pub fn allows_operation(&self, operation: &str) -> bool {
+        match self {
+            DelegationScope::Unrestricted => true,
+            DelegationScope::ReadOnly => operation == "read",
+            DelegationScope::WriteReleaseJobs => {
+                operation == "read" || operation == "write:release_jobs"
+            }
+            DelegationScope::ExecuteWorkflows => {
+                operation == "read" || operation == "execute:workflows"
+            }
+            DelegationScope::ManagePrincipals => {
+                operation == "read" || operation == "write:principals"
+            }
+            DelegationScope::Custom(constraint) => operation.starts_with(constraint),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct DelegationTokenIssuer {
+    /// Shared secret for signing (in production, loaded from HSM).
+    /// Both issuer and validator must have the same secret.
+    shared_secret: Vec<u8>,
+    /// Service name (e.g., "sherpa").
+    service_name: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct DelegationTokenValidator {
+    /// Shared secret for verification (same as issuer's).
+    shared_secret: Vec<u8>,
+    /// Expected issuer service name.
+    expected_issuer: String,
+    /// Audience we expect (e.g., "feltdb").
+    expected_audience: String,
+}
+
+impl DelegationTokenIssuer {
+    /// Creates a new token issuer (for testing; production uses HSM).
+    pub fn new(service_name: String, shared_secret: Vec<u8>) -> Self {
+        Self {
+            shared_secret,
+            service_name,
+        }
+    }
+
+    /// Issues a new delegation token.
+    pub fn issue(
+        &self,
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+        scope: DelegationScope,
+        ttl_seconds: u64,
+    ) -> Result<DelegationToken, String> {
+        let now = now();
+        let token_id = generate_token_id();
+
+        let token = DelegationToken {
+            token_id: token_id.clone(),
+            issuer: self.service_name.clone(),
+            audience: "feltdb".into(),
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            scope,
+            issued_at: now,
+            expires_at: now + ttl_seconds,
+            signature: String::new(),
+            signature_algorithm: "sha256-hmac".into(),
+        };
+
+        let payload = self.canonicalize_for_signing(&token)?;
+        let signature = self.sign(&payload)?;
+
+        Ok(DelegationToken {
+            signature,
+            ..token
+        })
+    }
+
+    /// Canonicalizes token for consistent signing/verification.
+    fn canonicalize_for_signing(&self, token: &DelegationToken) -> Result<String, String> {
+        let mut hasher = Sha256::new();
+
+        hasher.update(token.token_id.as_bytes());
+        hasher.update(token.issuer.as_bytes());
+        hasher.update(token.audience.as_bytes());
+        hasher.update(token.service_key_id.as_bytes());
+        hasher.update(token.actor_id.as_bytes());
+        hasher.update(token.tenant_id.as_bytes());
+        hasher.update(token.issued_at.to_le_bytes());
+        hasher.update(token.expires_at.to_le_bytes());
+
+        for role in &token.roles {
+            hasher.update(role.as_bytes());
+        }
+
+        let scope_str = serde_json::to_string(&token.scope)
+            .map_err(|e| format!("failed to serialize scope: {e}"))?;
+        hasher.update(scope_str.as_bytes());
+
+        Ok(format!("{:x}", hasher.finalize()))
+    }
+
+    /// Signs the canonicalized payload.
+    /// In production, this would use HSM/KMS.
+    fn sign(&self, payload: &str) -> Result<String, String> {
+        use hmac::{Hmac, Mac};
+        use sha2::Sha256;
+
+        type HmacSha256 = Hmac<Sha256>;
+
+        let mut mac = HmacSha256::new_from_slice(&self.shared_secret)
+            .map_err(|e| format!("invalid shared secret: {e}"))?;
+        mac.update(payload.as_bytes());
+
+        Ok(format!("{:x}", mac.finalize().into_bytes()))
+    }
+}
+
+impl DelegationTokenValidator {
+    /// Creates a new token validator.
+    pub fn new(
+        expected_issuer: String,
+        expected_audience: String,
+        shared_secret: Vec<u8>,
+    ) -> Self {
+        Self {
+            expected_issuer,
+            expected_audience,
+            shared_secret,
+        }
+    }
+
+    /// Validates a delegation token.
+    pub fn validate(&self, token: &DelegationToken) -> Result<(), String> {
+        self.check_not_expired(token)?;
+        self.check_issuer(token)?;
+        self.check_audience(token)?;
+        self.check_signature(token)?;
+
+        Ok(())
+    }
+
+    fn check_not_expired(&self, token: &DelegationToken) -> Result<(), String> {
+        let now = now();
+        if now > token.expires_at {
+            return Err(format!(
+                "token expired at {} (current time: {})",
+                token.expires_at, now
+            ));
+        }
+        Ok(())
+    }
+
+    fn check_issuer(&self, token: &DelegationToken) -> Result<(), String> {
+        if token.issuer != self.expected_issuer {
+            return Err(format!(
+                "issuer mismatch: expected {} but got {}",
+                self.expected_issuer, token.issuer
+            ));
+        }
+        Ok(())
+    }
+
+    fn check_audience(&self, token: &DelegationToken) -> Result<(), String> {
+        if token.audience != self.expected_audience {
+            return Err(format!(
+                "audience mismatch: expected {} but got {}",
+                self.expected_audience, token.audience
+            ));
+        }
+        Ok(())
+    }
+
+    fn check_signature(&self, token: &DelegationToken) -> Result<(), String> {
+        let mut token_copy = token.clone();
+        let original_sig = token_copy.signature.clone();
+        token_copy.signature = String::new();
+
+        let payload = self.canonicalize_for_signing(&token_copy)?;
+        self.verify_signature(&payload, &original_sig)
+    }
+
+    /// Canonicalizes token for verification (mirrors issuer logic).
+    fn canonicalize_for_signing(&self, token: &DelegationToken) -> Result<String, String> {
+        let mut hasher = Sha256::new();
+
+        hasher.update(token.token_id.as_bytes());
+        hasher.update(token.issuer.as_bytes());
+        hasher.update(token.audience.as_bytes());
+        hasher.update(token.service_key_id.as_bytes());
+        hasher.update(token.actor_id.as_bytes());
+        hasher.update(token.tenant_id.as_bytes());
+        hasher.update(token.issued_at.to_le_bytes());
+        hasher.update(token.expires_at.to_le_bytes());
+
+        for role in &token.roles {
+            hasher.update(role.as_bytes());
+        }
+
+        let scope_str = serde_json::to_string(&token.scope)
+            .map_err(|e| format!("failed to serialize scope: {e}"))?;
+        hasher.update(scope_str.as_bytes());
+
+        Ok(format!("{:x}", hasher.finalize()))
+    }
+
+    /// Verifies signature using the shared secret.
+    fn verify_signature(&self, payload: &str, signature: &str) -> Result<(), String> {
+        use hmac::{Hmac, Mac};
+        use sha2::Sha256;
+
+        type HmacSha256 = Hmac<Sha256>;
+
+        let mut mac = HmacSha256::new_from_slice(&self.shared_secret)
+            .map_err(|e| format!("invalid shared secret: {e}"))?;
+        mac.update(payload.as_bytes());
+
+        let expected_sig = format!("{:x}", mac.finalize().into_bytes());
+        if expected_sig == signature {
+            Ok(())
+        } else {
+            Err("signature verification failed".into())
+        }
+    }
+}
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+fn generate_token_id() -> String {
+    use rand::{distributions::Alphanumeric, Rng};
+
+    let value: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(32)
+        .map(char::from)
+        .collect();
+    format!("tok_{}", value)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_shared_secret() -> Vec<u8> {
+        b"test_shared_secret_32_bytes______".to_vec()
+    }
+
+    #[test]
+    fn issue_and_validate_delegation_token() {
+        let secret = test_shared_secret();
+        let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
+        let validator =
+            DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
+
+        let token = issuer
+            .issue(
+                "key_sherpa".into(),
+                "app_acme".into(),
+                "tenant_prod".into(),
+                vec!["execute".into()],
+                DelegationScope::ExecuteWorkflows,
+                3600,
+            )
+            .expect("failed to issue token");
+
+        assert!(validator.validate(&token).is_ok());
+    }
+
+    #[test]
+    fn reject_expired_token() {
+        let secret = test_shared_secret();
+        let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
+        let validator =
+            DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
+
+        let mut token = issuer
+            .issue(
+                "key_sherpa".into(),
+                "app_acme".into(),
+                "tenant_prod".into(),
+                vec!["execute".into()],
+                DelegationScope::ExecuteWorkflows,
+                1, // 1 second TTL
+            )
+            .expect("failed to issue token");
+
+        // Simulate expiration
+        token.expires_at = now() - 1;
+
+        assert!(validator.validate(&token).is_err());
+    }
+
+    #[test]
+    fn reject_wrong_issuer() {
+        let secret = test_shared_secret();
+        let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
+        let validator =
+            DelegationTokenValidator::new("other_service".into(), "feltdb".into(), secret);
+
+        let token = issuer
+            .issue(
+                "key_sherpa".into(),
+                "app_acme".into(),
+                "tenant_prod".into(),
+                vec!["execute".into()],
+                DelegationScope::ExecuteWorkflows,
+                3600,
+            )
+            .expect("failed to issue token");
+
+        assert!(validator.validate(&token).is_err());
+    }
+
+    #[test]
+    fn reject_wrong_audience() {
+        let secret = test_shared_secret();
+        let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
+        let validator =
+            DelegationTokenValidator::new("sherpa".into(), "other_service".into(), secret);
+
+        let token = issuer
+            .issue(
+                "key_sherpa".into(),
+                "app_acme".into(),
+                "tenant_prod".into(),
+                vec!["execute".into()],
+                DelegationScope::ExecuteWorkflows,
+                3600,
+            )
+            .expect("failed to issue token");
+
+        assert!(validator.validate(&token).is_err());
+    }
+
+    #[test]
+    fn scope_enforces_constraints() {
+        let read_only = DelegationScope::ReadOnly;
+        assert!(read_only.allows_operation("read"));
+        assert!(!read_only.allows_operation("write"));
+
+        let write_jobs = DelegationScope::WriteReleaseJobs;
+        assert!(write_jobs.allows_operation("read"));
+        assert!(write_jobs.allows_operation("write:release_jobs"));
+        assert!(!write_jobs.allows_operation("write:principals"));
+
+        let unrestricted = DelegationScope::Unrestricted;
+        assert!(unrestricted.allows_operation("read"));
+        assert!(unrestricted.allows_operation("write"));
+        assert!(unrestricted.allows_operation("delete"));
+    }
+
+    #[test]
+    fn token_id_is_unique() {
+        let secret = test_shared_secret();
+        let issuer = DelegationTokenIssuer::new("sherpa".into(), secret);
+
+        let token1 = issuer
+            .issue(
+                "key_sherpa".into(),
+                "app_acme".into(),
+                "tenant_prod".into(),
+                vec![],
+                DelegationScope::ReadOnly,
+                3600,
+            )
+            .expect("failed to issue token 1");
+
+        let token2 = issuer
+            .issue(
+                "key_sherpa".into(),
+                "app_acme".into(),
+                "tenant_prod".into(),
+                vec![],
+                DelegationScope::ReadOnly,
+                3600,
+            )
+            .expect("failed to issue token 2");
+
+        assert_ne!(token1.token_id, token2.token_id);
+    }
+
+    #[test]
+    fn tampering_invalidates_signature() {
+        let secret = test_shared_secret();
+        let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
+        let validator =
+            DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
+
+        let mut token = issuer
+            .issue(
+                "key_sherpa".into(),
+                "app_acme".into(),
+                "tenant_prod".into(),
+                vec!["execute".into()],
+                DelegationScope::ExecuteWorkflows,
+                3600,
+            )
+            .expect("failed to issue token");
+
+        // Tamper with the token
+        token.actor_id = "app_other".into();
+
+        assert!(validator.validate(&token).is_err());
+    }
+}