@feltdb/core 0.7.3 → 0.8.0

package/dist/create/server-source/crates/feltdb-server/src/application_contract.rs

@@ -283,10 +283,18 @@ impl ApplicationContractStore {
                     confidence: 0.0,
                     evidence_required: vec!["contract evidence".into()],
                     suggested_questions: vec![match p {
-                        "actors" => "Who will use this application, and what roles do they have?".into(),
-                        "entities" => "What information or records should the application keep track of?".into(),
+                        "actors" => {
+                            "Who will use this application, and what roles do they have?".into()
+                        }
+                        "entities" => {
+                            "What information or records should the application keep track of?"
+                                .into()
+                        }
                         "actions" => "What should people be able to do with those records?".into(),
-                        "permissions" => "Who can view, create, edit, delete, or administer this information?".into(),
+                        "permissions" => {
+                            "Who can view, create, edit, delete, or administer this information?"
+                                .into()
+                        }
                         _ => format!("What should FeltDB understand about {p}?"),
                     }],
                     candidate_resolutions: vec![],

package/dist/create/server-source/crates/feltdb-server/src/authenticated_principal.rs

@@ -154,7 +154,6 @@ fn now() -> u64 {
         .as_secs()
 }
 
-
 #[cfg(test)]
 mod tests {
     use super::*;

package/dist/create/server-source/crates/feltdb-server/src/certification_harness.rs

@@ -224,10 +224,7 @@ impl CertificationHarness {
 
     /// Gets the count of tests in a category.
     pub fn test_count(&self, category: TestCategory) -> usize {
-        self.results
-            .get(&category)
-            .map(|v| v.len())
-            .unwrap_or(0)
+        self.results.get(&category).map(|v| v.len()).unwrap_or(0)
     }
 
     /// Gets all failed tests.
@@ -439,13 +436,10 @@ mod tests {
 
     #[test]
     fn test_execution_plan_builder() {
-        let plan = TestExecutionPlan::new(
-            TestSuiteDefinition::standard(),
-            TestEnvironment::Local,
-        )
-        .with_parallel()
-        .with_timeout(600)
-        .with_retry(3);
+        let plan = TestExecutionPlan::new(TestSuiteDefinition::standard(), TestEnvironment::Local)
+            .with_parallel()
+            .with_timeout(600)
+            .with_retry(3);
 
         assert!(plan.parallel_execution);
         assert_eq!(plan.timeout_secs, 600);
@@ -480,19 +474,18 @@ mod tests {
     fn test_environment_strings() {
         assert_eq!(TestEnvironment::Local.as_str(), "local");
         assert_eq!(TestEnvironment::ManagedStaging.as_str(), "managed_staging");
-        assert_eq!(TestEnvironment::ManagedProduction.as_str(), "managed_production");
+        assert_eq!(
+            TestEnvironment::ManagedProduction.as_str(),
+            "managed_production"
+        );
     }
 
     #[test]
     fn certification_report_serialization() {
         let mut harness = CertificationHarness::new(TestEnvironment::Local);
 
-        let result = TestResult::new(
-            "test_1".into(),
-            TestCategory::Operations,
-            "test_1".into(),
-        )
-        .passed(50);
+        let result =
+            TestResult::new("test_1".into(), TestCategory::Operations, "test_1".into()).passed(50);
 
         harness.record_result(result);
 
@@ -512,11 +505,19 @@ mod tests {
 
         for i in 0..3 {
             let result = if i == 1 {
-                TestResult::new(format!("test_{}", i), TestCategory::Authorization, format!("test_{}", i))
-                    .failed("test failed".into(), 50)
+                TestResult::new(
+                    format!("test_{}", i),
+                    TestCategory::Authorization,
+                    format!("test_{}", i),
+                )
+                .failed("test failed".into(), 50)
             } else {
-                TestResult::new(format!("test_{}", i), TestCategory::Authorization, format!("test_{}", i))
-                    .passed(50)
+                TestResult::new(
+                    format!("test_{}", i),
+                    TestCategory::Authorization,
+                    format!("test_{}", i),
+                )
+                .passed(50)
             };
             harness.record_result(result);
         }

package/dist/create/server-source/crates/feltdb-server/src/delegation_token.rs

@@ -132,10 +132,7 @@ impl DelegationTokenIssuer {
         let payload = self.canonicalize_for_signing(&token)?;
         let signature = self.sign(&payload)?;
 
-        Ok(DelegationToken {
-            signature,
-            ..token
-        })
+        Ok(DelegationToken { signature, ..token })
     }
 
     /// Canonicalizes token for consistent signing/verification.
@@ -180,11 +177,7 @@ impl DelegationTokenIssuer {
 
 impl DelegationTokenValidator {
     /// Creates a new token validator.
-    pub fn new(
-        expected_issuer: String,
-        expected_audience: String,
-        shared_secret: Vec<u8>,
-    ) -> Self {
+    pub fn new(expected_issuer: String, expected_audience: String, shared_secret: Vec<u8>) -> Self {
         Self {
             expected_issuer,
             expected_audience,
@@ -316,8 +309,7 @@ mod tests {
     fn issue_and_validate_delegation_token() {
         let secret = test_shared_secret();
         let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
-        let validator =
-            DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
+        let validator = DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
 
         let token = issuer
             .issue(
@@ -337,8 +329,7 @@ mod tests {
     fn reject_expired_token() {
         let secret = test_shared_secret();
         let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
-        let validator =
-            DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
+        let validator = DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
 
         let mut token = issuer
             .issue(
@@ -450,8 +441,7 @@ mod tests {
     fn tampering_invalidates_signature() {
         let secret = test_shared_secret();
         let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
-        let validator =
-            DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
+        let validator = DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
 
         let mut token = issuer
             .issue(

package/dist/create/server-source/crates/feltdb-server/src/durable_operations.rs

@@ -114,10 +114,7 @@ impl DurableOperationStore {
             .map_err(|_| "store lock poisoned".to_string())?;
 
         if ops.contains_key(&operation_id) {
-            return Err(format!(
-                "operation already exists: {}",
-                operation_id
-            ));
+            return Err(format!("operation already exists: {}", operation_id));
         }
 
         let now = now();
@@ -158,7 +155,8 @@ impl DurableOperationStore {
             .ok_or(format!("operation not found: {}", operation_id))?;
 
         // Can only claim Pending or Unknown operations
-        if operation.state != OperationState::Pending && operation.state != OperationState::Unknown {
+        if operation.state != OperationState::Pending && operation.state != OperationState::Unknown
+        {
             return Err(format!(
                 "cannot claim operation in state {:?}",
                 operation.state
@@ -339,7 +337,8 @@ impl DurableOperationStore {
         }
 
         // Must be in Claimed or Running state
-        if operation.state != OperationState::Claimed && operation.state != OperationState::Running {
+        if operation.state != OperationState::Claimed && operation.state != OperationState::Running
+        {
             return Err(format!(
                 "cannot fail operation in state {:?}",
                 operation.state
@@ -356,10 +355,7 @@ impl DurableOperationStore {
     }
 
     /// Marks an operation as Unknown (when lease expires).
-    pub fn mark_unknown(
-        &self,
-        operation_id: &str,
-    ) -> Result<DurableOperation, String> {
+    pub fn mark_unknown(&self, operation_id: &str) -> Result<DurableOperation, String> {
         let mut ops = self
             .operations
             .write()
@@ -372,7 +368,8 @@ impl DurableOperationStore {
         let now = now();
 
         // Can only mark Unknown if in Claimed or Running state
-        if operation.state != OperationState::Claimed && operation.state != OperationState::Running {
+        if operation.state != OperationState::Claimed && operation.state != OperationState::Running
+        {
             return Err(format!(
                 "cannot mark Unknown operation in state {:?}",
                 operation.state
@@ -484,9 +481,7 @@ impl DurableOperationStore {
             .map_err(|_| "store lock poisoned".to_string())?;
 
         let before_len = ops.len();
-        ops.retain(|_, op| {
-            !(op.state == OperationState::Completed && op.updated_at < cutoff_time)
-        });
+        ops.retain(|_, op| !(op.state == OperationState::Completed && op.updated_at < cutoff_time));
         let after_len = ops.len();
 
         Ok(before_len - after_len)
@@ -755,9 +750,7 @@ mod tests {
             .claim_operation("op_123", "worker_1".into(), 60)
             .expect("claim failed");
 
-        let unknown = store
-            .mark_unknown("op_123")
-            .expect("mark unknown failed");
+        let unknown = store.mark_unknown("op_123").expect("mark unknown failed");
         assert_eq!(unknown.state, OperationState::Unknown);
 
         let reconciled = store
@@ -826,9 +819,7 @@ mod tests {
             )
             .expect("create failed");
 
-        let ops = store
-            .list_operations("tenant_prod")
-            .expect("list failed");
+        let ops = store.list_operations("tenant_prod").expect("list failed");
         assert_eq!(ops.len(), 2);
     }
 
@@ -915,9 +906,7 @@ mod tests {
             .expect("cleanup failed");
         assert_eq!(deleted, 1);
 
-        let ops = store
-            .list_operations("tenant_prod")
-            .expect("list failed");
+        let ops = store.list_operations("tenant_prod").expect("list failed");
         assert_eq!(ops.len(), 1);
         assert_eq!(ops[0].operation_id, "op_pending");
     }
@@ -978,11 +967,7 @@ mod tests {
             .expect("start failed");
 
         store
-            .complete_operation(
-                "op_123",
-                "worker_1",
-                serde_json::json!({"result": "done"}),
-            )
+            .complete_operation("op_123", "worker_1", serde_json::json!({"result": "done"}))
             .expect("complete failed");
 
         let final_op = store.get_operation("op_123").expect("get failed");

package/dist/create/server-source/crates/feltdb-server/src/identity.rs

@@ -137,6 +137,94 @@ impl IdentityStore {
             .identities
             .clone())
     }
+    pub fn sign_up(
+        &self,
+        email: &str,
+        password: &str,
+        display_name: Option<String>,
+    ) -> Result<(Identity, IdentitySession, String), String> {
+        let normalized = email.trim().to_lowercase();
+        if normalized.is_empty() || password.len() < 8 {
+            return Err("email and a password of at least 8 characters are required".into());
+        }
+        if self
+            .state
+            .read()
+            .map_err(|_| "identity lock poisoned")?
+            .identities
+            .iter()
+            .any(|value| value.email.as_deref() == Some(&normalized))
+        {
+            return Err("identity already exists".into());
+        }
+        let mut identity = self.normalize(
+            "password",
+            &normalized,
+            Some(normalized.clone()),
+            display_name,
+            serde_json::json!({}),
+        )?;
+        identity.status = IdentityStatus::Active;
+        let mut state = self.state.write().map_err(|_| "identity lock poisoned")?;
+        if let Some(stored) = state
+            .identities
+            .iter_mut()
+            .find(|value| value.identity_id == identity.identity_id)
+        {
+            stored.status = IdentityStatus::Active;
+        }
+        state
+            .password_hashes
+            .insert(identity.subject_id.clone(), Self::hash_password(password)?);
+        self.persist(&state)?;
+        drop(state);
+        let (session, token) = self.issue_session(&identity, "password", None, 15 * 60)?;
+        Ok((identity, session, token))
+    }
+    pub fn sign_in(
+        &self,
+        email: &str,
+        password: &str,
+    ) -> Result<(Identity, IdentitySession, String), String> {
+        let normalized = email.trim().to_lowercase();
+        let state = self.state.read().map_err(|_| "identity lock poisoned")?;
+        let identity = state
+            .identities
+            .iter()
+            .find(|value| {
+                value.email.as_deref() == Some(&normalized)
+                    && value.status == IdentityStatus::Active
+            })
+            .cloned()
+            .ok_or("invalid credentials")?;
+        let valid = state
+            .password_hashes
+            .get(&identity.subject_id)
+            .is_some_and(|hash| Self::verify_password(hash, password));
+        drop(state);
+        if !valid {
+            return Err("invalid credentials".into());
+        }
+        let (session, token) = self.issue_session(&identity, "password", None, 15 * 60)?;
+        Ok((identity, session, token))
+    }
+    pub fn authenticate_session(&self, token: &str) -> Option<IdentitySession> {
+        let current = now();
+        self.state
+            .read()
+            .ok()?
+            .sessions
+            .iter()
+            .find(|value| {
+                value
+                    .refresh_hash
+                    .as_deref()
+                    .is_some_and(|hash| Self::verify_password(hash, token))
+                    && value.status == "active"
+                    && value.expires_at > current
+            })
+            .cloned()
+    }
     pub fn sessions(&self, subject: &str) -> Result<Vec<IdentitySession>, String> {
         Ok(self
             .state
@@ -154,9 +242,10 @@ impl IdentityStore {
         provider: &str,
         device: Option<String>,
         ttl: u64,
-    ) -> Result<IdentitySession, String> {
+    ) -> Result<(IdentitySession, String), String> {
         let mut s = self.state.write().map_err(|_| "identity lock poisoned")?;
         let t = now();
+        let token = id("session_token");
         let x = IdentitySession {
             session_id: id("session"),
             identity_id: identity.identity_id.clone(),
@@ -168,11 +257,11 @@ impl IdentityStore {
             provider: provider.into(),
             status: "active".into(),
             revocation_reason: None,
-            refresh_hash: Some(id("refresh")),
+            refresh_hash: Some(Self::hash_password(&token)?),
         };
         s.sessions.push(x.clone());
         self.persist(&s)?;
-        Ok(x)
+        Ok((x, token))
     }
     pub fn revoke_session(&self, subject: &str, session: &str, reason: &str) -> Result<(), String> {
         let mut s = self.state.write().map_err(|_| "identity lock poisoned")?;
@@ -247,4 +336,23 @@ mod tests {
         assert!(IdentityStore::verify_password(&h, "correct horse"));
         assert!(!IdentityStore::verify_password(&h, "wrong"));
     }
+    #[test]
+    fn actor_tokens_are_short_lived_hashed_and_revocable() {
+        let p = std::env::temp_dir().join(format!("identity-session-{}.json", id("test")));
+        let store = IdentityStore::load(&p).unwrap();
+        let (identity, session, token) = store
+            .sign_up("actor@example.com", "correct horse", Some("Actor".into()))
+            .unwrap();
+        assert!(session.expires_at - session.issued_at <= 15 * 60);
+        assert_ne!(session.refresh_hash.as_deref(), Some(token.as_str()));
+        assert_eq!(
+            store.authenticate_session(&token).unwrap().subject_id,
+            identity.subject_id
+        );
+        store
+            .revoke_session(&identity.subject_id, &session.session_id, "test")
+            .unwrap();
+        assert!(store.authenticate_session(&token).is_none());
+        let _ = std::fs::remove_file(p);
+    }
 }

package/dist/create/server-source/crates/feltdb-server/src/key_management.rs

@@ -1,12 +1,15 @@
 use axum::{
-    extract::{Path, State},
+    extract::{Extension, Path, State},
     http::StatusCode,
     Json,
 };
 use serde::{Deserialize, Serialize};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use crate::{auth::ApiKeySummary, app_state::AppState};
+use crate::{
+    app_state::AppState,
+    auth::{ApiKeySummary, Principal},
+};
 
 #[derive(Debug, Serialize)]
 pub struct KeyListResponse {
@@ -18,6 +21,7 @@ pub struct CreateKeyRequest {
     pub id: Option<String>,
     pub namespace: String,
     pub scopes: Vec<String>,
+    pub application_id: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -38,6 +42,7 @@ pub async fn list_keys(
 
 pub async fn create_key(
     State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
     Json(req): Json<CreateKeyRequest>,
 ) -> Result<(StatusCode, Json<CreateKeyResponse>), (StatusCode, String)> {
     let timestamp = SystemTime::now()
@@ -46,15 +51,31 @@ pub async fn create_key(
         .as_secs();
 
     let name = req.id.unwrap_or_else(|| format!("key-{}", timestamp));
+    let scopes = req.scopes;
+    let mut authentication_namespaces = vec![req.namespace];
+    if !authentication_namespaces
+        .iter()
+        .any(|value| value == state.namespace.as_ref())
+    {
+        authentication_namespaces.push(state.namespace.to_string());
+    }
     let key = state
         .keys
-        .create(
-            name,
-            req.scopes,
-            vec![req.namespace],
-        )
+        .create(name, scopes.clone(), authentication_namespaces)
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
 
+    if let Some(application_id) = req.application_id {
+        if let Err(error) = state.tenancy.register_application_service(
+            &principal.key_id,
+            &key.id,
+            &application_id,
+            scopes,
+        ) {
+            let _ = state.keys.revoke(&key.id);
+            return Err((StatusCode::FORBIDDEN, error));
+        }
+    }
+
     Ok((
         StatusCode::CREATED,
         Json(CreateKeyResponse {

package/dist/create/server-source/crates/feltdb-server/src/lib.rs

@@ -6,17 +6,17 @@ pub mod auth;
 pub mod authenticated_principal;
 pub mod authorization;
 pub mod backup;
-pub mod certification_harness;
-pub mod delegation_token;
-pub mod durable_operations;
-pub mod key_management;
 pub mod causal;
 pub mod certification;
+pub mod certification_harness;
 pub mod clock;
 pub mod cluster;
 pub mod connections;
 pub mod content;
+pub mod delegation_token;
+pub mod durable_operations;
 pub mod identity;
+pub mod key_management;
 pub mod key_provider;
 pub mod leases;
 pub mod managed_diagnostics;
@@ -29,8 +29,8 @@ pub mod releases;
 pub mod request_telemetry;
 pub mod sessions;
 pub mod snapshot_cursor;
-pub mod tenant_policies;
 pub mod tenancy;
+pub mod tenant_policies;
 pub mod transaction_idempotency;
 pub mod transaction_recovery;
 pub mod versions;