@feltdb/core 0.5.7 → 0.6.1

package/dist/create/server-source/crates/feltdb-server/src/tenant_policies.rs

@@ -0,0 +1,525 @@
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use std::collections::HashMap;
+
+/// Declarative tenant policy for resource authorization.
+/// Defines which field(s) contain the tenant ID for a resource.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TenantPolicy {
+    /// Resource name (e.g., "release_jobs", "workflows", "users").
+    pub resource: String,
+
+    /// Field in the resource that contains the tenant ID.
+    /// For nested fields, use dot notation: "organization.id"
+    pub tenant_field: String,
+
+    /// Optional: Additional ownership fields that must match the actor.
+    /// Prevents one actor from managing another actor's resources.
+    pub owner_field: Option<String>,
+
+    /// Operations this policy applies to.
+    pub operations: PolicyOperations,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PolicyOperations {
+    /// Read operations (SELECT, GET)
+    pub read: bool,
+    /// Write operations (INSERT, UPDATE)
+    pub write: bool,
+    /// Delete operations (DELETE)
+    pub delete: bool,
+}
+
+/// Store for tenant policies.
+#[derive(Debug, Clone)]
+pub struct TenantPolicyStore {
+    policies: HashMap<String, TenantPolicy>,
+}
+
+impl TenantPolicyStore {
+    /// Creates a new policy store.
+    pub fn new() -> Self {
+        Self {
+            policies: HashMap::new(),
+        }
+    }
+
+    /// Registers a new tenant policy.
+    pub fn register(&mut self, policy: TenantPolicy) {
+        self.policies.insert(policy.resource.clone(), policy);
+    }
+
+    /// Gets a policy for a resource.
+    pub fn get(&self, resource: &str) -> Option<&TenantPolicy> {
+        self.policies.get(resource)
+    }
+
+    /// Loads default policies (can be overridden).
+    pub fn with_defaults() -> Self {
+        let mut store = Self::new();
+
+        // Release jobs policy
+        store.register(TenantPolicy {
+            resource: "release_jobs".into(),
+            tenant_field: "tenant_id".into(),
+            owner_field: Some("created_by".into()),
+            operations: PolicyOperations {
+                read: true,
+                write: true,
+                delete: true,
+            },
+        });
+
+        // Workflows policy
+        store.register(TenantPolicy {
+            resource: "workflows".into(),
+            tenant_field: "tenant_id".into(),
+            owner_field: Some("owner_id".into()),
+            operations: PolicyOperations {
+                read: true,
+                write: true,
+                delete: false,
+            },
+        });
+
+        // Users policy (no tenant field - organization members)
+        store.register(TenantPolicy {
+            resource: "organization_members".into(),
+            tenant_field: "organization_id".into(),
+            owner_field: Some("user_id".into()),
+            operations: PolicyOperations {
+                read: true,
+                write: false,
+                delete: true,
+            },
+        });
+
+        store
+    }
+}
+
+impl Default for TenantPolicyStore {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+/// Authorization context for policy evaluation.
+#[derive(Debug, Clone)]
+pub struct PolicyAuthorizationContext {
+    /// Actor ID performing the operation.
+    pub actor_id: String,
+    /// Tenant ID from authenticated principal.
+    pub tenant_id: String,
+    /// Operation: "read", "write", "delete"
+    pub operation: String,
+}
+
+/// Policy evaluation result.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PolicyDecision {
+    Allowed,
+    Denied(String),
+}
+
+impl PolicyDecision {
+    pub fn is_allowed(&self) -> bool {
+        matches!(self, PolicyDecision::Allowed)
+    }
+
+    pub fn error_message(&self) -> Option<&str> {
+        match self {
+            PolicyDecision::Allowed => None,
+            PolicyDecision::Denied(msg) => Some(msg),
+        }
+    }
+}
+
+/// Policy evaluator for authorization decisions.
+pub struct PolicyEvaluator {
+    store: TenantPolicyStore,
+}
+
+impl PolicyEvaluator {
+    pub fn new(store: TenantPolicyStore) -> Self {
+        Self { store }
+    }
+
+    /// Authorizes a read operation.
+    pub fn authorize_read(
+        &self,
+        context: &PolicyAuthorizationContext,
+        resource: &str,
+        record: &Value,
+    ) -> PolicyDecision {
+        let policy = match self.store.get(resource) {
+            Some(p) => p,
+            None => return PolicyDecision::Allowed, // No policy = allowed
+        };
+
+        if !policy.operations.read {
+            return PolicyDecision::Denied(format!(
+                "read operation not allowed on {}",
+                resource
+            ));
+        }
+
+        self.check_tenant_access(context, &policy, record)
+    }
+
+    /// Authorizes a write (insert) operation.
+    pub fn authorize_write(
+        &self,
+        context: &PolicyAuthorizationContext,
+        resource: &str,
+        new_record: &Value,
+    ) -> PolicyDecision {
+        let policy = match self.store.get(resource) {
+            Some(p) => p,
+            None => return PolicyDecision::Allowed,
+        };
+
+        if !policy.operations.write {
+            return PolicyDecision::Denied(format!(
+                "write operation not allowed on {}",
+                resource
+            ));
+        }
+
+        // Check that new record has correct tenant_id
+        self.check_tenant_access(context, &policy, new_record)
+    }
+
+    /// Authorizes an update operation.
+    /// Must authorize both the existing record and the new state.
+    pub fn authorize_update(
+        &self,
+        context: &PolicyAuthorizationContext,
+        resource: &str,
+        existing_record: &Value,
+        new_record: &Value,
+    ) -> PolicyDecision {
+        let policy = match self.store.get(resource) {
+            Some(p) => p,
+            None => return PolicyDecision::Allowed,
+        };
+
+        if !policy.operations.write {
+            return PolicyDecision::Denied(format!(
+                "write operation not allowed on {}",
+                resource
+            ));
+        }
+
+        // Must authorize existing record
+        if let PolicyDecision::Denied(msg) = self.check_tenant_access(context, &policy, existing_record)
+        {
+            return PolicyDecision::Denied(format!("cannot update: {}", msg));
+        }
+
+        // Must authorize new record state
+        if let PolicyDecision::Denied(msg) = self.check_tenant_access(context, &policy, new_record) {
+            return PolicyDecision::Denied(format!("update would result in: {}", msg));
+        }
+
+        // Check that tenant_id hasn't changed
+        let existing_tenant = self.extract_tenant_id(&policy, existing_record);
+        let new_tenant = self.extract_tenant_id(&policy, new_record);
+
+        if existing_tenant != new_tenant {
+            return PolicyDecision::Denied("tenant_id cannot be changed".into());
+        }
+
+        // Check that owner_id hasn't changed (if policy has owner_field)
+        if let Some(owner_field) = &policy.owner_field {
+            let existing_owner = self.extract_field(owner_field, existing_record);
+            let new_owner = self.extract_field(owner_field, new_record);
+
+            if existing_owner != new_owner {
+                return PolicyDecision::Denied(format!("{} cannot be changed", owner_field));
+            }
+        }
+
+        PolicyDecision::Allowed
+    }
+
+    /// Authorizes a delete operation.
+    pub fn authorize_delete(
+        &self,
+        context: &PolicyAuthorizationContext,
+        resource: &str,
+        record: &Value,
+    ) -> PolicyDecision {
+        let policy = match self.store.get(resource) {
+            Some(p) => p,
+            None => return PolicyDecision::Allowed,
+        };
+
+        if !policy.operations.delete {
+            return PolicyDecision::Denied(format!(
+                "delete operation not allowed on {}",
+                resource
+            ));
+        }
+
+        self.check_tenant_access(context, &policy, record)
+    }
+
+    /// Filters records to only those the actor can access.
+    pub fn filter_records(
+        &self,
+        context: &PolicyAuthorizationContext,
+        resource: &str,
+        records: Vec<Value>,
+    ) -> Vec<Value> {
+        let policy = match self.store.get(resource) {
+            Some(p) => p,
+            None => return records, // No policy = all allowed
+        };
+
+        records
+            .into_iter()
+            .filter(|record| {
+                self.check_tenant_access(context, &policy, record)
+                    .is_allowed()
+            })
+            .collect()
+    }
+
+    /// Checks if a record belongs to the actor's tenant.
+    fn check_tenant_access(
+        &self,
+        context: &PolicyAuthorizationContext,
+        policy: &TenantPolicy,
+        record: &Value,
+    ) -> PolicyDecision {
+        let record_tenant = self.extract_tenant_id(policy, record);
+
+        if record_tenant != Some(context.tenant_id.clone()) {
+            return PolicyDecision::Denied(format!(
+                "record belongs to different tenant"
+            ));
+        }
+
+        // Check owner field if policy specifies one
+        if let Some(owner_field) = &policy.owner_field {
+            let record_owner = self.extract_field(owner_field, record);
+            if let Some(owner) = record_owner {
+                if owner != context.actor_id {
+                    return PolicyDecision::Denied(format!(
+                        "record owned by different actor: {}",
+                        owner
+                    ));
+                }
+            }
+        }
+
+        PolicyDecision::Allowed
+    }
+
+    /// Extracts tenant ID from a record using the policy's tenant_field.
+    fn extract_tenant_id(&self, policy: &TenantPolicy, record: &Value) -> Option<String> {
+        self.extract_field(&policy.tenant_field, record)
+    }
+
+    /// Extracts a field value from a record (supports dot notation for nested fields).
+    fn extract_field(&self, field_path: &str, record: &Value) -> Option<String> {
+        let parts: Vec<&str> = field_path.split('.').collect();
+        let mut current = record;
+
+        for part in parts {
+            current = &current[part];
+            if current.is_null() {
+                return None;
+            }
+        }
+
+        current.as_str().map(|s| s.to_string())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_context() -> PolicyAuthorizationContext {
+        PolicyAuthorizationContext {
+            actor_id: "user_123".into(),
+            tenant_id: "tenant_prod".into(),
+            operation: "read".into(),
+        }
+    }
+
+    fn test_record(tenant_id: &str, owner: Option<&str>) -> Value {
+        let mut record = json!({
+            "id": "job_123",
+            "tenant_id": tenant_id,
+            "name": "Deploy Release",
+            "status": "pending"
+        });
+
+        if let Some(owner_id) = owner {
+            record["created_by"] = json!(owner_id);
+        }
+
+        record
+    }
+
+    fn test_evaluator() -> PolicyEvaluator {
+        PolicyEvaluator::new(TenantPolicyStore::with_defaults())
+    }
+
+    #[test]
+    fn allow_read_same_tenant() {
+        let evaluator = test_evaluator();
+        let context = test_context();
+        let record = test_record("tenant_prod", Some("user_123"));
+
+        let decision = evaluator.authorize_read(&context, "release_jobs", &record);
+        assert_eq!(decision, PolicyDecision::Allowed);
+    }
+
+    #[test]
+    fn deny_read_cross_tenant() {
+        let evaluator = test_evaluator();
+        let context = test_context();
+        let record = test_record("tenant_other", Some("user_123"));
+
+        let decision = evaluator.authorize_read(&context, "release_jobs", &record);
+        assert!(matches!(decision, PolicyDecision::Denied(_)));
+    }
+
+    #[test]
+    fn deny_insert_cross_tenant() {
+        let evaluator = test_evaluator();
+        let context = test_context();
+        let record = test_record("tenant_other", Some("user_123"));
+
+        let decision = evaluator.authorize_write(&context, "release_jobs", &record);
+        assert!(matches!(decision, PolicyDecision::Denied(_)));
+    }
+
+    #[test]
+    fn deny_update_tenant_change() {
+        let evaluator = test_evaluator();
+        let context = test_context();
+        let existing = test_record("tenant_prod", Some("user_123"));
+        let mut updated = existing.clone();
+        updated["tenant_id"] = json!("tenant_other");
+
+        let decision = evaluator.authorize_update(&context, "release_jobs", &existing, &updated);
+        assert!(matches!(decision, PolicyDecision::Denied(_)));
+    }
+
+    #[test]
+    fn deny_update_owner_change() {
+        let evaluator = test_evaluator();
+        let context = test_context();
+        let existing = test_record("tenant_prod", Some("user_123"));
+        let mut updated = existing.clone();
+        updated["created_by"] = json!("user_other");
+
+        let decision = evaluator.authorize_update(&context, "release_jobs", &existing, &updated);
+        assert!(matches!(decision, PolicyDecision::Denied(_)));
+    }
+
+    #[test]
+    fn allow_update_same_tenant_and_owner() {
+        let evaluator = test_evaluator();
+        let context = test_context();
+        let existing = test_record("tenant_prod", Some("user_123"));
+        let mut updated = existing.clone();
+        updated["name"] = json!("Deploy Release Updated");
+
+        let decision = evaluator.authorize_update(&context, "release_jobs", &existing, &updated);
+        assert_eq!(decision, PolicyDecision::Allowed);
+    }
+
+    #[test]
+    fn deny_delete_cross_tenant() {
+        let evaluator = test_evaluator();
+        let context = test_context();
+        let record = test_record("tenant_other", None);
+
+        let decision = evaluator.authorize_delete(&context, "release_jobs", &record);
+        assert!(matches!(decision, PolicyDecision::Denied(_)));
+    }
+
+    #[test]
+    fn filter_records_by_tenant() {
+        let evaluator = test_evaluator();
+        let context = test_context();
+
+        let records = vec![
+            test_record("tenant_prod", Some("user_123")),
+            test_record("tenant_other", Some("user_123")),
+            test_record("tenant_prod", Some("user_123")),
+        ];
+
+        let filtered = evaluator.filter_records(&context, "release_jobs", records);
+        assert_eq!(filtered.len(), 2);
+    }
+
+    #[test]
+    fn no_policy_allows_operation() {
+        let evaluator = PolicyEvaluator::new(TenantPolicyStore::new());
+        let context = test_context();
+        let record = json!({"any": "record"});
+
+        let decision = evaluator.authorize_read(&context, "unknown_resource", &record);
+        assert_eq!(decision, PolicyDecision::Allowed);
+    }
+
+    #[test]
+    fn deny_operation_when_not_permitted() {
+        let evaluator = test_evaluator();
+        let context = test_context();
+        let record = test_record("tenant_prod", None);
+
+        // Workflows policy doesn't allow delete
+        let decision = evaluator.authorize_delete(&context, "workflows", &record);
+        assert!(matches!(decision, PolicyDecision::Denied(_)));
+    }
+
+    #[test]
+    fn extract_nested_tenant_field() {
+        let mut store = TenantPolicyStore::new();
+        store.register(TenantPolicy {
+            resource: "nested_test".into(),
+            tenant_field: "organization.id".into(),
+            owner_field: None,
+            operations: PolicyOperations {
+                read: true,
+                write: true,
+                delete: true,
+            },
+        });
+
+        let evaluator = PolicyEvaluator::new(store);
+        let mut context = test_context();
+        context.tenant_id = "org_123".into();
+
+        let record = json!({
+            "id": "item_1",
+            "organization": {
+                "id": "org_123"
+            }
+        });
+
+        let decision = evaluator.authorize_read(&context, "nested_test", &record);
+        assert_eq!(decision, PolicyDecision::Allowed);
+    }
+
+    #[test]
+    fn owner_isolation_prevents_cross_actor_access() {
+        let evaluator = test_evaluator();
+        let mut context = test_context();
+        context.actor_id = "user_different".into();
+
+        let record = test_record("tenant_prod", Some("user_123"));
+
+        let decision = evaluator.authorize_read(&context, "release_jobs", &record);
+        assert!(matches!(decision, PolicyDecision::Denied(_)));
+    }
+}