@feltdb/core 0.7.4 → 0.8.0

package/dist/create/server-source/crates/feltdb-server/src/durable_operations.rs

@@ -114,10 +114,7 @@ impl DurableOperationStore {
             .map_err(|_| "store lock poisoned".to_string())?;
 
         if ops.contains_key(&operation_id) {
-            return Err(format!(
-                "operation already exists: {}",
-                operation_id
-            ));
+            return Err(format!("operation already exists: {}", operation_id));
         }
 
         let now = now();
@@ -158,7 +155,8 @@ impl DurableOperationStore {
             .ok_or(format!("operation not found: {}", operation_id))?;
 
         // Can only claim Pending or Unknown operations
-        if operation.state != OperationState::Pending && operation.state != OperationState::Unknown {
+        if operation.state != OperationState::Pending && operation.state != OperationState::Unknown
+        {
             return Err(format!(
                 "cannot claim operation in state {:?}",
                 operation.state
@@ -339,7 +337,8 @@ impl DurableOperationStore {
         }
 
         // Must be in Claimed or Running state
-        if operation.state != OperationState::Claimed && operation.state != OperationState::Running {
+        if operation.state != OperationState::Claimed && operation.state != OperationState::Running
+        {
             return Err(format!(
                 "cannot fail operation in state {:?}",
                 operation.state
@@ -356,10 +355,7 @@ impl DurableOperationStore {
     }
 
     /// Marks an operation as Unknown (when lease expires).
-    pub fn mark_unknown(
-        &self,
-        operation_id: &str,
-    ) -> Result<DurableOperation, String> {
+    pub fn mark_unknown(&self, operation_id: &str) -> Result<DurableOperation, String> {
         let mut ops = self
             .operations
             .write()
@@ -372,7 +368,8 @@ impl DurableOperationStore {
         let now = now();
 
         // Can only mark Unknown if in Claimed or Running state
-        if operation.state != OperationState::Claimed && operation.state != OperationState::Running {
+        if operation.state != OperationState::Claimed && operation.state != OperationState::Running
+        {
             return Err(format!(
                 "cannot mark Unknown operation in state {:?}",
                 operation.state
@@ -484,9 +481,7 @@ impl DurableOperationStore {
             .map_err(|_| "store lock poisoned".to_string())?;
 
         let before_len = ops.len();
-        ops.retain(|_, op| {
-            !(op.state == OperationState::Completed && op.updated_at < cutoff_time)
-        });
+        ops.retain(|_, op| !(op.state == OperationState::Completed && op.updated_at < cutoff_time));
         let after_len = ops.len();
 
         Ok(before_len - after_len)
@@ -755,9 +750,7 @@ mod tests {
             .claim_operation("op_123", "worker_1".into(), 60)
             .expect("claim failed");
 
-        let unknown = store
-            .mark_unknown("op_123")
-            .expect("mark unknown failed");
+        let unknown = store.mark_unknown("op_123").expect("mark unknown failed");
         assert_eq!(unknown.state, OperationState::Unknown);
 
         let reconciled = store
@@ -826,9 +819,7 @@ mod tests {
             )
             .expect("create failed");
 
-        let ops = store
-            .list_operations("tenant_prod")
-            .expect("list failed");
+        let ops = store.list_operations("tenant_prod").expect("list failed");
         assert_eq!(ops.len(), 2);
     }
 
@@ -915,9 +906,7 @@ mod tests {
             .expect("cleanup failed");
         assert_eq!(deleted, 1);
 
-        let ops = store
-            .list_operations("tenant_prod")
-            .expect("list failed");
+        let ops = store.list_operations("tenant_prod").expect("list failed");
         assert_eq!(ops.len(), 1);
         assert_eq!(ops[0].operation_id, "op_pending");
     }
@@ -978,11 +967,7 @@ mod tests {
             .expect("start failed");
 
         store
-            .complete_operation(
-                "op_123",
-                "worker_1",
-                serde_json::json!({"result": "done"}),
-            )
+            .complete_operation("op_123", "worker_1", serde_json::json!({"result": "done"}))
             .expect("complete failed");
 
         let final_op = store.get_operation("op_123").expect("get failed");

package/dist/create/server-source/crates/feltdb-server/src/identity.rs

@@ -137,35 +137,93 @@ impl IdentityStore {
             .identities
             .clone())
     }
-    pub fn sign_up(&self, email: &str, password: &str, display_name: Option<String>) -> Result<(Identity, IdentitySession, String), String> {
+    pub fn sign_up(
+        &self,
+        email: &str,
+        password: &str,
+        display_name: Option<String>,
+    ) -> Result<(Identity, IdentitySession, String), String> {
         let normalized = email.trim().to_lowercase();
-        if normalized.is_empty() || password.len() < 8 { return Err("email and a password of at least 8 characters are required".into()); }
-        if self.state.read().map_err(|_| "identity lock poisoned")?.identities.iter().any(|value| value.email.as_deref() == Some(&normalized)) {
+        if normalized.is_empty() || password.len() < 8 {
+            return Err("email and a password of at least 8 characters are required".into());
+        }
+        if self
+            .state
+            .read()
+            .map_err(|_| "identity lock poisoned")?
+            .identities
+            .iter()
+            .any(|value| value.email.as_deref() == Some(&normalized))
+        {
             return Err("identity already exists".into());
         }
-        let mut identity = self.normalize("password", &normalized, Some(normalized.clone()), display_name, serde_json::json!({}))?;
+        let mut identity = self.normalize(
+            "password",
+            &normalized,
+            Some(normalized.clone()),
+            display_name,
+            serde_json::json!({}),
+        )?;
         identity.status = IdentityStatus::Active;
         let mut state = self.state.write().map_err(|_| "identity lock poisoned")?;
-        if let Some(stored) = state.identities.iter_mut().find(|value| value.identity_id == identity.identity_id) { stored.status = IdentityStatus::Active; }
-        state.password_hashes.insert(identity.subject_id.clone(), Self::hash_password(password)?);
+        if let Some(stored) = state
+            .identities
+            .iter_mut()
+            .find(|value| value.identity_id == identity.identity_id)
+        {
+            stored.status = IdentityStatus::Active;
+        }
+        state
+            .password_hashes
+            .insert(identity.subject_id.clone(), Self::hash_password(password)?);
         self.persist(&state)?;
         drop(state);
         let (session, token) = self.issue_session(&identity, "password", None, 15 * 60)?;
         Ok((identity, session, token))
     }
-    pub fn sign_in(&self, email: &str, password: &str) -> Result<(Identity, IdentitySession, String), String> {
+    pub fn sign_in(
+        &self,
+        email: &str,
+        password: &str,
+    ) -> Result<(Identity, IdentitySession, String), String> {
         let normalized = email.trim().to_lowercase();
         let state = self.state.read().map_err(|_| "identity lock poisoned")?;
-        let identity = state.identities.iter().find(|value| value.email.as_deref() == Some(&normalized) && value.status == IdentityStatus::Active).cloned().ok_or("invalid credentials")?;
-        let valid = state.password_hashes.get(&identity.subject_id).is_some_and(|hash| Self::verify_password(hash, password));
+        let identity = state
+            .identities
+            .iter()
+            .find(|value| {
+                value.email.as_deref() == Some(&normalized)
+                    && value.status == IdentityStatus::Active
+            })
+            .cloned()
+            .ok_or("invalid credentials")?;
+        let valid = state
+            .password_hashes
+            .get(&identity.subject_id)
+            .is_some_and(|hash| Self::verify_password(hash, password));
         drop(state);
-        if !valid { return Err("invalid credentials".into()); }
+        if !valid {
+            return Err("invalid credentials".into());
+        }
         let (session, token) = self.issue_session(&identity, "password", None, 15 * 60)?;
         Ok((identity, session, token))
     }
     pub fn authenticate_session(&self, token: &str) -> Option<IdentitySession> {
         let current = now();
-        self.state.read().ok()?.sessions.iter().find(|value| value.refresh_hash.as_deref().is_some_and(|hash| Self::verify_password(hash, token)) && value.status == "active" && value.expires_at > current).cloned()
+        self.state
+            .read()
+            .ok()?
+            .sessions
+            .iter()
+            .find(|value| {
+                value
+                    .refresh_hash
+                    .as_deref()
+                    .is_some_and(|hash| Self::verify_password(hash, token))
+                    && value.status == "active"
+                    && value.expires_at > current
+            })
+            .cloned()
     }
     pub fn sessions(&self, subject: &str) -> Result<Vec<IdentitySession>, String> {
         Ok(self
@@ -282,11 +340,18 @@ mod tests {
     fn actor_tokens_are_short_lived_hashed_and_revocable() {
         let p = std::env::temp_dir().join(format!("identity-session-{}.json", id("test")));
         let store = IdentityStore::load(&p).unwrap();
-        let (identity, session, token) = store.sign_up("actor@example.com", "correct horse", Some("Actor".into())).unwrap();
+        let (identity, session, token) = store
+            .sign_up("actor@example.com", "correct horse", Some("Actor".into()))
+            .unwrap();
         assert!(session.expires_at - session.issued_at <= 15 * 60);
         assert_ne!(session.refresh_hash.as_deref(), Some(token.as_str()));
-        assert_eq!(store.authenticate_session(&token).unwrap().subject_id, identity.subject_id);
-        store.revoke_session(&identity.subject_id, &session.session_id, "test").unwrap();
+        assert_eq!(
+            store.authenticate_session(&token).unwrap().subject_id,
+            identity.subject_id
+        );
+        store
+            .revoke_session(&identity.subject_id, &session.session_id, "test")
+            .unwrap();
         assert!(store.authenticate_session(&token).is_none());
         let _ = std::fs::remove_file(p);
     }

package/dist/create/server-source/crates/feltdb-server/src/key_management.rs

@@ -1,12 +1,15 @@
 use axum::{
-    extract::{Path, State},
+    extract::{Extension, Path, State},
     http::StatusCode,
     Json,
 };
 use serde::{Deserialize, Serialize};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use crate::{auth::ApiKeySummary, app_state::AppState};
+use crate::{
+    app_state::AppState,
+    auth::{ApiKeySummary, Principal},
+};
 
 #[derive(Debug, Serialize)]
 pub struct KeyListResponse {
@@ -18,6 +21,7 @@ pub struct CreateKeyRequest {
     pub id: Option<String>,
     pub namespace: String,
     pub scopes: Vec<String>,
+    pub application_id: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -38,6 +42,7 @@ pub async fn list_keys(
 
 pub async fn create_key(
     State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
     Json(req): Json<CreateKeyRequest>,
 ) -> Result<(StatusCode, Json<CreateKeyResponse>), (StatusCode, String)> {
     let timestamp = SystemTime::now()
@@ -46,15 +51,31 @@ pub async fn create_key(
         .as_secs();
 
     let name = req.id.unwrap_or_else(|| format!("key-{}", timestamp));
+    let scopes = req.scopes;
+    let mut authentication_namespaces = vec![req.namespace];
+    if !authentication_namespaces
+        .iter()
+        .any(|value| value == state.namespace.as_ref())
+    {
+        authentication_namespaces.push(state.namespace.to_string());
+    }
     let key = state
         .keys
-        .create(
-            name,
-            req.scopes,
-            vec![req.namespace],
-        )
+        .create(name, scopes.clone(), authentication_namespaces)
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
 
+    if let Some(application_id) = req.application_id {
+        if let Err(error) = state.tenancy.register_application_service(
+            &principal.key_id,
+            &key.id,
+            &application_id,
+            scopes,
+        ) {
+            let _ = state.keys.revoke(&key.id);
+            return Err((StatusCode::FORBIDDEN, error));
+        }
+    }
+
     Ok((
         StatusCode::CREATED,
         Json(CreateKeyResponse {

package/dist/create/server-source/crates/feltdb-server/src/lib.rs

@@ -6,17 +6,17 @@ pub mod auth;
 pub mod authenticated_principal;
 pub mod authorization;
 pub mod backup;
-pub mod certification_harness;
-pub mod delegation_token;
-pub mod durable_operations;
-pub mod key_management;
 pub mod causal;
 pub mod certification;
+pub mod certification_harness;
 pub mod clock;
 pub mod cluster;
 pub mod connections;
 pub mod content;
+pub mod delegation_token;
+pub mod durable_operations;
 pub mod identity;
+pub mod key_management;
 pub mod key_provider;
 pub mod leases;
 pub mod managed_diagnostics;
@@ -29,8 +29,8 @@ pub mod releases;
 pub mod request_telemetry;
 pub mod sessions;
 pub mod snapshot_cursor;
-pub mod tenant_policies;
 pub mod tenancy;
+pub mod tenant_policies;
 pub mod transaction_idempotency;
 pub mod transaction_recovery;
 pub mod versions;