@feltdb/core 0.5.7 → 0.6.1

package/dist/create/server-source/crates/feltdb-server/src/snapshot_cursor.rs

@@ -0,0 +1,378 @@
+use base64::Engine;
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Snapshot-bound pagination cursor.
+/// Prevents reading from different snapshots within a single pagination session.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SnapshotCursor {
+    /// Unique identifier for the snapshot version.
+    pub snapshot_id: String,
+
+    /// Position/offset within the snapshot.
+    pub position: usize,
+
+    /// Collection being paginated.
+    pub collection: String,
+
+    /// Snapshot version number.
+    pub snapshot_version: u64,
+
+    /// Hash of authorization context (prevents reuse with different auth).
+    pub auth_context_hash: String,
+
+    /// When this cursor was created.
+    pub created_at: u64,
+
+    /// Hash of the cursor payload for verification.
+    pub checksum: String,
+}
+
+/// Pagination request parameters.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PaginationRequest {
+    pub collection: String,
+    pub limit: usize,
+    pub cursor: Option<String>, // Base64-encoded SnapshotCursor
+}
+
+/// Pagination response.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PaginationResponse<T> {
+    pub records: Vec<T>,
+    pub next_cursor: Option<String>, // Base64-encoded cursor or None if end
+    pub snapshot_version: u64,
+    pub total_returned: usize,
+}
+
+/// Pagination cursor codec.
+pub struct CursorCodec;
+
+impl CursorCodec {
+    /// Encodes a cursor to a base64 string.
+    pub fn encode(cursor: &SnapshotCursor) -> Result<String, String> {
+        let json = serde_json::to_string(cursor)
+            .map_err(|e| format!("failed to serialize cursor: {e}"))?;
+        Ok(base64::engine::general_purpose::STANDARD.encode(json))
+    }
+
+    /// Decodes a cursor from a base64 string.
+    pub fn decode(encoded: &str) -> Result<SnapshotCursor, String> {
+        let bytes = base64::engine::general_purpose::STANDARD
+            .decode(encoded)
+            .map_err(|e| format!("invalid cursor encoding: {e}"))?;
+        let json = String::from_utf8(bytes)
+            .map_err(|e| format!("cursor not valid UTF-8: {e}"))?;
+        serde_json::from_str(&json).map_err(|e| format!("invalid cursor JSON: {e}"))
+    }
+}
+
+/// Snapshot cursor factory and validator.
+pub struct SnapshotCursorManager {
+    /// Expected collection (prevents cursor reuse across collections).
+    expected_collection: String,
+}
+
+impl SnapshotCursorManager {
+    pub fn new(collection: String) -> Self {
+        Self {
+            expected_collection: collection,
+        }
+    }
+
+    /// Creates a new cursor for pagination.
+    pub fn create_cursor(
+        &self,
+        snapshot_id: String,
+        snapshot_version: u64,
+        position: usize,
+        auth_context_hash: String,
+    ) -> Result<String, String> {
+        let cursor = SnapshotCursor {
+            snapshot_id: snapshot_id.clone(),
+            position,
+            collection: self.expected_collection.clone(),
+            snapshot_version,
+            auth_context_hash: auth_context_hash.clone(),
+            created_at: now(),
+            checksum: String::new(), // Will be computed below
+        };
+
+        let checksum = self.compute_checksum(&cursor)?;
+        let cursor_with_checksum = SnapshotCursor {
+            checksum,
+            ..cursor
+        };
+
+        CursorCodec::encode(&cursor_with_checksum)
+    }
+
+    /// Validates a cursor.
+    pub fn validate_cursor(
+        &self,
+        encoded_cursor: &str,
+        current_snapshot_id: &str,
+        current_snapshot_version: u64,
+        current_auth_context_hash: &str,
+    ) -> Result<SnapshotCursor, String> {
+        let cursor = CursorCodec::decode(encoded_cursor)?;
+
+        // Verify collection
+        if cursor.collection != self.expected_collection {
+            return Err(format!(
+                "cursor collection mismatch: expected {}, got {}",
+                self.expected_collection, cursor.collection
+            ));
+        }
+
+        // Verify snapshot hasn't changed
+        if cursor.snapshot_id != current_snapshot_id {
+            return Err(format!(
+                "snapshot changed: cursor has {} but current is {}",
+                cursor.snapshot_id, current_snapshot_id
+            ));
+        }
+
+        // Verify snapshot version consistency
+        if cursor.snapshot_version != current_snapshot_version {
+            return Err(format!(
+                "snapshot version mismatch: cursor version {}, current version {}",
+                cursor.snapshot_version, current_snapshot_version
+            ));
+        }
+
+        // Verify authorization context hasn't changed
+        if cursor.auth_context_hash != current_auth_context_hash {
+            return Err(
+                "authorization context changed since cursor creation".into(),
+            );
+        }
+
+        // Verify checksum
+        self.verify_checksum(&cursor)?;
+
+        Ok(cursor)
+    }
+
+    /// Gets the next position for pagination.
+    pub fn next_position(&self, cursor: &SnapshotCursor, returned_count: usize) -> usize {
+        cursor.position + returned_count
+    }
+
+    /// Checks if this is likely the end of results.
+    pub fn is_end(&self, returned_count: usize, limit: usize) -> bool {
+        returned_count < limit
+    }
+
+    /// Computes hash of authorization context.
+    pub fn hash_auth_context(actor_id: &str, tenant_id: &str, required_role: Option<&str>) -> String {
+        let mut hasher = Sha256::new();
+        hasher.update(actor_id.as_bytes());
+        hasher.update(tenant_id.as_bytes());
+        if let Some(role) = required_role {
+            hasher.update(role.as_bytes());
+        }
+        format!("{:x}", hasher.finalize())
+    }
+
+    fn compute_checksum(&self, cursor: &SnapshotCursor) -> Result<String, String> {
+        let mut hasher = Sha256::new();
+
+        hasher.update(cursor.snapshot_id.as_bytes());
+        hasher.update(cursor.position.to_le_bytes());
+        hasher.update(cursor.collection.as_bytes());
+        hasher.update(cursor.snapshot_version.to_le_bytes());
+        hasher.update(cursor.auth_context_hash.as_bytes());
+        hasher.update(cursor.created_at.to_le_bytes());
+
+        Ok(format!("{:x}", hasher.finalize()))
+    }
+
+    fn verify_checksum(&self, cursor: &SnapshotCursor) -> Result<(), String> {
+        let mut cursor_copy = cursor.clone();
+        let expected_checksum = cursor_copy.checksum.clone();
+        cursor_copy.checksum = String::new();
+
+        let computed = self.compute_checksum(&cursor_copy)?;
+        if computed != expected_checksum {
+            return Err("cursor checksum verification failed".into());
+        }
+
+        Ok(())
+    }
+}
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn encode_and_decode_cursor() {
+        let cursor = SnapshotCursor {
+            snapshot_id: "snap_123".into(),
+            position: 100,
+            collection: "release_jobs".into(),
+            snapshot_version: 5,
+            auth_context_hash: "hash_abc".into(),
+            created_at: 1234567890,
+            checksum: "checksum_xyz".into(),
+        };
+
+        let encoded = CursorCodec::encode(&cursor).expect("encode failed");
+        let decoded = CursorCodec::decode(&encoded).expect("decode failed");
+
+        assert_eq!(decoded.snapshot_id, cursor.snapshot_id);
+        assert_eq!(decoded.position, cursor.position);
+        assert_eq!(decoded.collection, cursor.collection);
+    }
+
+    #[test]
+    fn create_and_validate_cursor() {
+        let manager = SnapshotCursorManager::new("release_jobs".into());
+        let auth_hash = SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", None);
+
+        let encoded = manager
+            .create_cursor("snap_123".into(), 5, 0, auth_hash.clone())
+            .expect("create failed");
+
+        let validated = manager
+            .validate_cursor(&encoded, "snap_123", 5, &auth_hash)
+            .expect("validate failed");
+
+        assert_eq!(validated.position, 0);
+        assert_eq!(validated.snapshot_version, 5);
+    }
+
+    #[test]
+    fn reject_cursor_from_different_collection() {
+        let manager = SnapshotCursorManager::new("release_jobs".into());
+        let auth_hash = SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", None);
+
+        let cursor = SnapshotCursor {
+            snapshot_id: "snap_123".into(),
+            position: 100,
+            collection: "workflows".into(), // Wrong collection
+            snapshot_version: 5,
+            auth_context_hash: auth_hash.clone(),
+            created_at: now(),
+            checksum: "checksum_xyz".into(),
+        };
+
+        let encoded = CursorCodec::encode(&cursor).expect("encode failed");
+
+        let result = manager.validate_cursor(&encoded, "snap_123", 5, &auth_hash);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn reject_cursor_when_snapshot_changes() {
+        let manager = SnapshotCursorManager::new("release_jobs".into());
+        let auth_hash = SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", None);
+
+        let encoded = manager
+            .create_cursor("snap_123".into(), 5, 100, auth_hash.clone())
+            .expect("create failed");
+
+        // Try to use with different snapshot
+        let result = manager.validate_cursor(&encoded, "snap_456", 5, &auth_hash);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn reject_cursor_when_auth_context_changes() {
+        let manager = SnapshotCursorManager::new("release_jobs".into());
+        let auth_hash1 =
+            SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", None);
+        let auth_hash2 =
+            SnapshotCursorManager::hash_auth_context("user_123", "tenant_other", None);
+
+        let encoded = manager
+            .create_cursor("snap_123".into(), 5, 0, auth_hash1)
+            .expect("create failed");
+
+        // Try to use with different auth context
+        let result = manager.validate_cursor(&encoded, "snap_123", 5, &auth_hash2);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn compute_next_position() {
+        let manager = SnapshotCursorManager::new("release_jobs".into());
+        let cursor = SnapshotCursor {
+            snapshot_id: "snap_123".into(),
+            position: 100,
+            collection: "release_jobs".into(),
+            snapshot_version: 5,
+            auth_context_hash: "hash_abc".into(),
+            created_at: now(),
+            checksum: "checksum_xyz".into(),
+        };
+
+        let next = manager.next_position(&cursor, 50);
+        assert_eq!(next, 150);
+    }
+
+    #[test]
+    fn detect_end_of_results() {
+        let manager = SnapshotCursorManager::new("release_jobs".into());
+
+        // Returned less than limit = end
+        assert!(manager.is_end(10, 20));
+        // Returned equals limit = might have more
+        assert!(!manager.is_end(20, 20));
+        // Returned 0 = definitely end
+        assert!(manager.is_end(0, 20));
+    }
+
+    #[test]
+    fn auth_context_hash_includes_all_components() {
+        let hash1 = SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", None);
+        let hash2 =
+            SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", Some("admin"));
+        let hash3 = SnapshotCursorManager::hash_auth_context("user_456", "tenant_prod", None);
+
+        // Different role = different hash
+        assert_ne!(hash1, hash2);
+        // Different actor = different hash
+        assert_ne!(hash1, hash3);
+        // Same inputs = same hash
+        let hash1_repeat =
+            SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", None);
+        assert_eq!(hash1, hash1_repeat);
+    }
+
+    #[test]
+    fn invalid_base64_rejected() {
+        let result = CursorCodec::decode("not valid base64!!!");
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn tampered_checksum_rejected() {
+        let manager = SnapshotCursorManager::new("release_jobs".into());
+        let auth_hash = SnapshotCursorManager::hash_auth_context("user_123", "tenant_prod", None);
+
+        let cursor = SnapshotCursor {
+            snapshot_id: "snap_123".into(),
+            position: 100,
+            collection: "release_jobs".into(),
+            snapshot_version: 5,
+            auth_context_hash: auth_hash.clone(),
+            created_at: now(),
+            checksum: "fake_checksum".into(),
+        };
+
+        let encoded = CursorCodec::encode(&cursor).expect("encode failed");
+
+        let result = manager.validate_cursor(&encoded, "snap_123", 5, &auth_hash);
+        assert!(result.is_err());
+    }
+}

package/dist/create/server-source/crates/feltdb-server/src/tenancy.rs

@@ -1,4 +1,5 @@
 use std::{
+    collections::BTreeSet,
     fs,
     path::PathBuf,
     sync::{Arc, RwLock},
@@ -578,6 +579,54 @@ impl TenancyStore {
         Ok(tenant)
     }
 
+    /// Removes an isolated certification tenant selected by an exact application ID.
+    /// This deliberately refuses non-certification resources and avoids global inventory access.
+    pub fn delete_certification_fixture(&self, application_id: &str) -> Result<String, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let application = records
+            .applications
+            .iter()
+            .find(|application| application.id == application_id)
+            .cloned()
+            .ok_or("application not found")?;
+        let tenant = records
+            .tenants
+            .iter()
+            .find(|tenant| tenant.id == application.tenant_id)
+            .cloned()
+            .ok_or("tenant not found")?;
+        if !application.name.to_lowercase().contains("certification")
+            || !tenant.name.to_lowercase().contains("certification")
+        {
+            return Err("refusing to delete a non-certification fixture".into());
+        }
+        let tenant_id = tenant.id.clone();
+        let application_ids = records
+            .applications
+            .iter()
+            .filter(|candidate| candidate.tenant_id == tenant_id)
+            .map(|candidate| candidate.id.clone())
+            .collect::<BTreeSet<_>>();
+        records
+            .applications
+            .retain(|candidate| candidate.tenant_id != tenant_id);
+        records
+            .application_memberships
+            .retain(|membership| !application_ids.contains(&membership.application_id));
+        records
+            .tenant_memberships
+            .retain(|membership| membership.tenant_id != tenant_id);
+        records
+            .invitations
+            .retain(|invitation| invitation.tenant_id != tenant_id);
+        records.tenants.retain(|candidate| candidate.id != tenant_id);
+        self.persist(&records)?;
+        Ok(tenant_id)
+    }
+
     pub fn create_application(
         &self,
         actor: &str,