@feltdb/core 0.7.4 → 0.8.1

package/dist/create/server-source/crates/feltdb-server/src/identity.rs

@@ -137,35 +137,93 @@ impl IdentityStore {
             .identities
             .clone())
     }
-    pub fn sign_up(&self, email: &str, password: &str, display_name: Option<String>) -> Result<(Identity, IdentitySession, String), String> {
+    pub fn sign_up(
+        &self,
+        email: &str,
+        password: &str,
+        display_name: Option<String>,
+    ) -> Result<(Identity, IdentitySession, String), String> {
         let normalized = email.trim().to_lowercase();
-        if normalized.is_empty() || password.len() < 8 { return Err("email and a password of at least 8 characters are required".into()); }
-        if self.state.read().map_err(|_| "identity lock poisoned")?.identities.iter().any(|value| value.email.as_deref() == Some(&normalized)) {
+        if normalized.is_empty() || password.len() < 8 {
+            return Err("email and a password of at least 8 characters are required".into());
+        }
+        if self
+            .state
+            .read()
+            .map_err(|_| "identity lock poisoned")?
+            .identities
+            .iter()
+            .any(|value| value.email.as_deref() == Some(&normalized))
+        {
             return Err("identity already exists".into());
         }
-        let mut identity = self.normalize("password", &normalized, Some(normalized.clone()), display_name, serde_json::json!({}))?;
+        let mut identity = self.normalize(
+            "password",
+            &normalized,
+            Some(normalized.clone()),
+            display_name,
+            serde_json::json!({}),
+        )?;
         identity.status = IdentityStatus::Active;
         let mut state = self.state.write().map_err(|_| "identity lock poisoned")?;
-        if let Some(stored) = state.identities.iter_mut().find(|value| value.identity_id == identity.identity_id) { stored.status = IdentityStatus::Active; }
-        state.password_hashes.insert(identity.subject_id.clone(), Self::hash_password(password)?);
+        if let Some(stored) = state
+            .identities
+            .iter_mut()
+            .find(|value| value.identity_id == identity.identity_id)
+        {
+            stored.status = IdentityStatus::Active;
+        }
+        state
+            .password_hashes
+            .insert(identity.subject_id.clone(), Self::hash_password(password)?);
         self.persist(&state)?;
         drop(state);
         let (session, token) = self.issue_session(&identity, "password", None, 15 * 60)?;
         Ok((identity, session, token))
     }
-    pub fn sign_in(&self, email: &str, password: &str) -> Result<(Identity, IdentitySession, String), String> {
+    pub fn sign_in(
+        &self,
+        email: &str,
+        password: &str,
+    ) -> Result<(Identity, IdentitySession, String), String> {
         let normalized = email.trim().to_lowercase();
         let state = self.state.read().map_err(|_| "identity lock poisoned")?;
-        let identity = state.identities.iter().find(|value| value.email.as_deref() == Some(&normalized) && value.status == IdentityStatus::Active).cloned().ok_or("invalid credentials")?;
-        let valid = state.password_hashes.get(&identity.subject_id).is_some_and(|hash| Self::verify_password(hash, password));
+        let identity = state
+            .identities
+            .iter()
+            .find(|value| {
+                value.email.as_deref() == Some(&normalized)
+                    && value.status == IdentityStatus::Active
+            })
+            .cloned()
+            .ok_or("invalid credentials")?;
+        let valid = state
+            .password_hashes
+            .get(&identity.subject_id)
+            .is_some_and(|hash| Self::verify_password(hash, password));
         drop(state);
-        if !valid { return Err("invalid credentials".into()); }
+        if !valid {
+            return Err("invalid credentials".into());
+        }
         let (session, token) = self.issue_session(&identity, "password", None, 15 * 60)?;
         Ok((identity, session, token))
     }
     pub fn authenticate_session(&self, token: &str) -> Option<IdentitySession> {
         let current = now();
-        self.state.read().ok()?.sessions.iter().find(|value| value.refresh_hash.as_deref().is_some_and(|hash| Self::verify_password(hash, token)) && value.status == "active" && value.expires_at > current).cloned()
+        self.state
+            .read()
+            .ok()?
+            .sessions
+            .iter()
+            .find(|value| {
+                value
+                    .refresh_hash
+                    .as_deref()
+                    .is_some_and(|hash| Self::verify_password(hash, token))
+                    && value.status == "active"
+                    && value.expires_at > current
+            })
+            .cloned()
     }
     pub fn sessions(&self, subject: &str) -> Result<Vec<IdentitySession>, String> {
         Ok(self
@@ -282,11 +340,18 @@ mod tests {
     fn actor_tokens_are_short_lived_hashed_and_revocable() {
         let p = std::env::temp_dir().join(format!("identity-session-{}.json", id("test")));
         let store = IdentityStore::load(&p).unwrap();
-        let (identity, session, token) = store.sign_up("actor@example.com", "correct horse", Some("Actor".into())).unwrap();
+        let (identity, session, token) = store
+            .sign_up("actor@example.com", "correct horse", Some("Actor".into()))
+            .unwrap();
         assert!(session.expires_at - session.issued_at <= 15 * 60);
         assert_ne!(session.refresh_hash.as_deref(), Some(token.as_str()));
-        assert_eq!(store.authenticate_session(&token).unwrap().subject_id, identity.subject_id);
-        store.revoke_session(&identity.subject_id, &session.session_id, "test").unwrap();
+        assert_eq!(
+            store.authenticate_session(&token).unwrap().subject_id,
+            identity.subject_id
+        );
+        store
+            .revoke_session(&identity.subject_id, &session.session_id, "test")
+            .unwrap();
         assert!(store.authenticate_session(&token).is_none());
         let _ = std::fs::remove_file(p);
     }

package/dist/create/server-source/crates/feltdb-server/src/key_management.rs

@@ -1,12 +1,15 @@
 use axum::{
-    extract::{Path, State},
+    extract::{Extension, Path, State},
     http::StatusCode,
     Json,
 };
 use serde::{Deserialize, Serialize};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use crate::{auth::ApiKeySummary, app_state::AppState};
+use crate::{
+    app_state::AppState,
+    auth::{ApiKeySummary, Principal},
+};
 
 #[derive(Debug, Serialize)]
 pub struct KeyListResponse {
@@ -18,6 +21,7 @@ pub struct CreateKeyRequest {
     pub id: Option<String>,
     pub namespace: String,
     pub scopes: Vec<String>,
+    pub application_id: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -38,6 +42,7 @@ pub async fn list_keys(
 
 pub async fn create_key(
     State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
     Json(req): Json<CreateKeyRequest>,
 ) -> Result<(StatusCode, Json<CreateKeyResponse>), (StatusCode, String)> {
     let timestamp = SystemTime::now()
@@ -46,15 +51,31 @@ pub async fn create_key(
         .as_secs();
 
     let name = req.id.unwrap_or_else(|| format!("key-{}", timestamp));
+    let scopes = req.scopes;
+    let mut authentication_namespaces = vec![req.namespace];
+    if !authentication_namespaces
+        .iter()
+        .any(|value| value == state.namespace.as_ref())
+    {
+        authentication_namespaces.push(state.namespace.to_string());
+    }
     let key = state
         .keys
-        .create(
-            name,
-            req.scopes,
-            vec![req.namespace],
-        )
+        .create(name, scopes.clone(), authentication_namespaces)
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
 
+    if let Some(application_id) = req.application_id {
+        if let Err(error) = state.tenancy.register_application_service(
+            &principal.key_id,
+            &key.id,
+            &application_id,
+            scopes,
+        ) {
+            let _ = state.keys.revoke(&key.id);
+            return Err((StatusCode::FORBIDDEN, error));
+        }
+    }
+
     Ok((
         StatusCode::CREATED,
         Json(CreateKeyResponse {

package/dist/create/server-source/crates/feltdb-server/src/lib.rs

@@ -6,17 +6,17 @@ pub mod auth;
 pub mod authenticated_principal;
 pub mod authorization;
 pub mod backup;
-pub mod certification_harness;
-pub mod delegation_token;
-pub mod durable_operations;
-pub mod key_management;
 pub mod causal;
 pub mod certification;
+pub mod certification_harness;
 pub mod clock;
 pub mod cluster;
 pub mod connections;
 pub mod content;
+pub mod delegation_token;
+pub mod durable_operations;
 pub mod identity;
+pub mod key_management;
 pub mod key_provider;
 pub mod leases;
 pub mod managed_diagnostics;
@@ -29,8 +29,8 @@ pub mod releases;
 pub mod request_telemetry;
 pub mod sessions;
 pub mod snapshot_cursor;
-pub mod tenant_policies;
 pub mod tenancy;
+pub mod tenant_policies;
 pub mod transaction_idempotency;
 pub mod transaction_recovery;
 pub mod versions;