@feltdb/core 0.5.7 → 0.6.1

package/dist/create/server-source/crates/feltdb-server/src/membership_policy.rs

@@ -0,0 +1,488 @@
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::HashMap;
+
+/// Explicit membership policy configuration.
+/// Replaces name discovery with manifest configuration.
+/// No magic User/Organization/Membership relationships.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct MembershipPolicy {
+    /// Name of this membership relationship (e.g., "organization_members", "team_members").
+    pub name: String,
+
+    /// Collection where membership records are stored.
+    pub collection: String,
+
+    /// Field in membership record that identifies the actor (e.g., "user_id").
+    pub actor_field: String,
+
+    /// Field in membership record that identifies the tenant (e.g., "organization_id").
+    pub tenant_field: String,
+
+    /// Optional role field in membership record (e.g., "role").
+    pub role_field: Option<String>,
+
+    /// Optional status field (e.g., "status" with values "active", "suspended").
+    pub status_field: Option<String>,
+
+    /// Statuses considered "active" for membership verification.
+    #[serde(default = "default_active_statuses")]
+    pub active_statuses: Vec<String>,
+}
+
+fn default_active_statuses() -> Vec<String> {
+    vec!["active".into(), "verified".into()]
+}
+
+/// Store for membership policies.
+#[derive(Debug, Clone)]
+pub struct MembershipPolicyStore {
+    policies: HashMap<String, MembershipPolicy>,
+}
+
+impl MembershipPolicyStore {
+    /// Creates a new membership policy store.
+    pub fn new() -> Self {
+        Self {
+            policies: HashMap::new(),
+        }
+    }
+
+    /// Registers a new membership policy.
+    pub fn register(&mut self, policy: MembershipPolicy) {
+        self.policies.insert(policy.name.clone(), policy);
+    }
+
+    /// Gets a membership policy by name.
+    pub fn get(&self, name: &str) -> Option<&MembershipPolicy> {
+        self.policies.get(name)
+    }
+
+    /// Gets a policy by collection name.
+    pub fn get_by_collection(&self, collection: &str) -> Option<&MembershipPolicy> {
+        self.policies.values().find(|p| p.collection == collection)
+    }
+
+    /// Loads default policies.
+    pub fn with_defaults() -> Self {
+        let mut store = Self::new();
+
+        // Organization members policy
+        store.register(MembershipPolicy {
+            name: "organization_members".into(),
+            collection: "organization_members".into(),
+            actor_field: "user_id".into(),
+            tenant_field: "organization_id".into(),
+            role_field: Some("role".into()),
+            status_field: Some("status".into()),
+            active_statuses: vec!["active".into(), "verified".into()],
+        });
+
+        // Team members policy
+        store.register(MembershipPolicy {
+            name: "team_members".into(),
+            collection: "team_members".into(),
+            actor_field: "user_id".into(),
+            tenant_field: "team_id".into(),
+            role_field: Some("role".into()),
+            status_field: Some("status".into()),
+            active_statuses: vec!["active".into()],
+        });
+
+        store
+    }
+}
+
+impl Default for MembershipPolicyStore {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+/// Membership verification context.
+#[derive(Debug, Clone)]
+pub struct MembershipVerificationContext {
+    pub actor_id: String,
+    pub tenant_id: String,
+    pub required_role: Option<String>,
+}
+
+/// Membership verification result.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum MembershipDecision {
+    Verified { role: Option<String> },
+    Denied(String),
+}
+
+impl MembershipDecision {
+    pub fn is_verified(&self) -> bool {
+        matches!(self, MembershipDecision::Verified { .. })
+    }
+
+    pub fn role(&self) -> Option<&str> {
+        match self {
+            MembershipDecision::Verified { role } => role.as_deref(),
+            MembershipDecision::Denied(_) => None,
+        }
+    }
+
+    pub fn error_message(&self) -> Option<&str> {
+        match self {
+            MembershipDecision::Verified { .. } => None,
+            MembershipDecision::Denied(msg) => Some(msg),
+        }
+    }
+}
+
+/// Verifies membership relationships.
+pub struct MembershipVerifier {
+    store: MembershipPolicyStore,
+}
+
+impl MembershipVerifier {
+    pub fn new(store: MembershipPolicyStore) -> Self {
+        Self { store }
+    }
+
+    /// Verifies membership using a policy.
+    pub fn verify(
+        &self,
+        context: &MembershipVerificationContext,
+        policy_name: &str,
+        membership_record: &Value,
+    ) -> MembershipDecision {
+        let policy = match self.store.get(policy_name) {
+            Some(p) => p,
+            None => return MembershipDecision::Denied(format!("policy not found: {}", policy_name)),
+        };
+
+        // Verify actor field
+        let record_actor = self.extract_string(&policy.actor_field, membership_record);
+        if record_actor != Some(context.actor_id.clone()) {
+            return MembershipDecision::Denied(format!(
+                "actor mismatch: expected {} but got {:?}",
+                context.actor_id, record_actor
+            ));
+        }
+
+        // Verify tenant field
+        let record_tenant = self.extract_string(&policy.tenant_field, membership_record);
+        if record_tenant != Some(context.tenant_id.clone()) {
+            return MembershipDecision::Denied(format!(
+                "tenant mismatch: expected {} but got {:?}",
+                context.tenant_id, record_tenant
+            ));
+        }
+
+        // Check status if configured
+        if let Some(status_field) = &policy.status_field {
+            let status = self.extract_string(status_field, membership_record);
+            if let Some(status_val) = status {
+                if !policy.active_statuses.contains(&status_val) {
+                    return MembershipDecision::Denied(format!(
+                        "membership status not active: {}",
+                        status_val
+                    ));
+                }
+            }
+        }
+
+        // Extract role
+        let role = policy
+            .role_field
+            .as_ref()
+            .and_then(|f| self.extract_string(f, membership_record));
+
+        // Verify required role if specified
+        if let Some(required) = &context.required_role {
+            if let Some(actual) = &role {
+                if actual != required {
+                    return MembershipDecision::Denied(format!(
+                        "role mismatch: required {} but got {}",
+                        required, actual
+                    ));
+                }
+            } else {
+                return MembershipDecision::Denied(format!("required role not found: {}", required));
+            }
+        }
+
+        MembershipDecision::Verified { role }
+    }
+
+    /// Verifies membership from a collection of records.
+    /// Returns Some(role) if verified, None if not found or denied.
+    pub fn verify_from_records(
+        &self,
+        context: &MembershipVerificationContext,
+        policy_name: &str,
+        records: &[Value],
+    ) -> MembershipDecision {
+        // Find matching membership record
+        let policy = match self.store.get(policy_name) {
+            Some(p) => p,
+            None => return MembershipDecision::Denied(format!("policy not found: {}", policy_name)),
+        };
+
+        for record in records {
+            let record_actor = self.extract_string(&policy.actor_field, record);
+            let record_tenant = self.extract_string(&policy.tenant_field, record);
+
+            if record_actor == Some(context.actor_id.clone())
+                && record_tenant == Some(context.tenant_id.clone())
+            {
+                return self.verify(context, policy_name, record);
+            }
+        }
+
+        MembershipDecision::Denied(format!(
+            "no membership record found for actor {} in tenant {}",
+            context.actor_id, context.tenant_id
+        ))
+    }
+
+    /// Gets all roles an actor has in a tenant.
+    pub fn get_roles(
+        &self,
+        actor_id: &str,
+        tenant_id: &str,
+        policy_name: &str,
+        records: &[Value],
+    ) -> Vec<String> {
+        let policy = match self.store.get(policy_name) {
+            Some(p) => p,
+            None => return vec![],
+        };
+
+        let mut roles = vec![];
+
+        for record in records {
+            let record_actor = self.extract_string(&policy.actor_field, record);
+            let record_tenant = self.extract_string(&policy.tenant_field, record);
+
+            if record_actor.as_deref() == Some(actor_id) && record_tenant.as_deref() == Some(tenant_id)
+            {
+                // Check status
+                if let Some(status_field) = &policy.status_field {
+                    let status = self.extract_string(status_field, record);
+                    if let Some(status_val) = status {
+                        if !policy.active_statuses.contains(&status_val) {
+                            continue; // Skip inactive records
+                        }
+                    }
+                }
+
+                // Extract role if configured
+                if let Some(role_field) = &policy.role_field {
+                    if let Some(role) = self.extract_string(role_field, record) {
+                        if !roles.contains(&role) {
+                            roles.push(role);
+                        }
+                    }
+                }
+            }
+        }
+
+        roles
+    }
+
+    /// Extracts a string value from a record.
+    fn extract_string(&self, field: &str, record: &Value) -> Option<String> {
+        record
+            .get(field)
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    fn test_context() -> MembershipVerificationContext {
+        MembershipVerificationContext {
+            actor_id: "user_123".into(),
+            tenant_id: "org_acme".into(),
+            required_role: None,
+        }
+    }
+
+    fn test_membership(user_id: &str, org_id: &str, role: &str, status: &str) -> Value {
+        json!({
+            "user_id": user_id,
+            "organization_id": org_id,
+            "role": role,
+            "status": status
+        })
+    }
+
+    fn test_verifier() -> MembershipVerifier {
+        MembershipVerifier::new(MembershipPolicyStore::with_defaults())
+    }
+
+    #[test]
+    fn verify_active_membership() {
+        let verifier = test_verifier();
+        let context = test_context();
+        let record = test_membership("user_123", "org_acme", "admin", "active");
+
+        let decision = verifier.verify(&context, "organization_members", &record);
+        assert_eq!(
+            decision,
+            MembershipDecision::Verified {
+                role: Some("admin".into())
+            }
+        );
+    }
+
+    #[test]
+    fn deny_actor_mismatch() {
+        let verifier = test_verifier();
+        let context = test_context();
+        let record = test_membership("user_other", "org_acme", "admin", "active");
+
+        let decision = verifier.verify(&context, "organization_members", &record);
+        assert!(matches!(decision, MembershipDecision::Denied(_)));
+    }
+
+    #[test]
+    fn deny_tenant_mismatch() {
+        let verifier = test_verifier();
+        let context = test_context();
+        let record = test_membership("user_123", "org_other", "admin", "active");
+
+        let decision = verifier.verify(&context, "organization_members", &record);
+        assert!(matches!(decision, MembershipDecision::Denied(_)));
+    }
+
+    #[test]
+    fn deny_inactive_status() {
+        let verifier = test_verifier();
+        let context = test_context();
+        let record = test_membership("user_123", "org_acme", "admin", "suspended");
+
+        let decision = verifier.verify(&context, "organization_members", &record);
+        assert!(matches!(decision, MembershipDecision::Denied(_)));
+    }
+
+    #[test]
+    fn verify_with_required_role() {
+        let verifier = test_verifier();
+        let mut context = test_context();
+        context.required_role = Some("admin".into());
+        let record = test_membership("user_123", "org_acme", "admin", "active");
+
+        let decision = verifier.verify(&context, "organization_members", &record);
+        assert_eq!(
+            decision,
+            MembershipDecision::Verified {
+                role: Some("admin".into())
+            }
+        );
+    }
+
+    #[test]
+    fn deny_wrong_required_role() {
+        let verifier = test_verifier();
+        let mut context = test_context();
+        context.required_role = Some("owner".into());
+        let record = test_membership("user_123", "org_acme", "admin", "active");
+
+        let decision = verifier.verify(&context, "organization_members", &record);
+        assert!(matches!(decision, MembershipDecision::Denied(_)));
+    }
+
+    #[test]
+    fn get_all_roles() {
+        let verifier = test_verifier();
+        let records = vec![
+            test_membership("user_123", "org_acme", "admin", "active"),
+            test_membership("user_123", "org_acme", "reviewer", "active"),
+            test_membership("user_123", "org_other", "admin", "active"),
+        ];
+
+        let roles = verifier.get_roles("user_123", "org_acme", "organization_members", &records);
+        assert_eq!(roles.len(), 2);
+        assert!(roles.contains(&"admin".into()));
+        assert!(roles.contains(&"reviewer".into()));
+    }
+
+    #[test]
+    fn verify_from_records_finds_matching() {
+        let verifier = test_verifier();
+        let context = test_context();
+        let records = vec![
+            test_membership("user_other", "org_acme", "admin", "active"),
+            test_membership("user_123", "org_acme", "viewer", "active"),
+        ];
+
+        let decision = verifier.verify_from_records(&context, "organization_members", &records);
+        assert_eq!(
+            decision,
+            MembershipDecision::Verified {
+                role: Some("viewer".into())
+            }
+        );
+    }
+
+    #[test]
+    fn deny_when_no_matching_record() {
+        let verifier = test_verifier();
+        let context = test_context();
+        let records = vec![test_membership("user_other", "org_acme", "admin", "active")];
+
+        let decision = verifier.verify_from_records(&context, "organization_members", &records);
+        assert!(matches!(decision, MembershipDecision::Denied(_)));
+    }
+
+    #[test]
+    fn skip_inactive_when_getting_roles() {
+        let verifier = test_verifier();
+        let records = vec![
+            test_membership("user_123", "org_acme", "admin", "active"),
+            test_membership("user_123", "org_acme", "suspended_role", "suspended"),
+        ];
+
+        let roles = verifier.get_roles("user_123", "org_acme", "organization_members", &records);
+        assert_eq!(roles.len(), 1);
+        assert_eq!(roles[0], "admin");
+    }
+
+    #[test]
+    fn handle_missing_optional_fields() {
+        let verifier = test_verifier();
+        let context = test_context();
+        let record = json!({
+            "user_id": "user_123",
+            "organization_id": "org_acme"
+            // No role or status fields
+        });
+
+        let decision = verifier.verify(&context, "organization_members", &record);
+        // Should still verify even without optional fields
+        assert!(matches!(decision, MembershipDecision::Verified { .. }));
+    }
+
+    #[test]
+    fn no_policy_denied() {
+        let verifier = test_verifier();
+        let context = test_context();
+        let record = test_membership("user_123", "org_acme", "admin", "active");
+
+        let decision = verifier.verify(&context, "nonexistent_policy", &record);
+        assert!(matches!(decision, MembershipDecision::Denied(_)));
+    }
+
+    #[test]
+    fn duplicate_roles_not_added() {
+        let verifier = test_verifier();
+        let records = vec![
+            test_membership("user_123", "org_acme", "admin", "active"),
+            test_membership("user_123", "org_acme", "admin", "active"),
+        ];
+
+        let roles = verifier.get_roles("user_123", "org_acme", "organization_members", &records);
+        assert_eq!(roles.len(), 1);
+    }
+}