@feltdb/core 0.8.0 → 0.8.2

package/dist/create/server-source/crates/feltdb/tests/authority_process.rs

@@ -0,0 +1,297 @@
+#![cfg(unix)]
+
+use feltdb::{
+    authority::{
+        AuthorityClient, AuthorityTransaction, EmbeddedAuthority, FeltDbAuthority, ReadKind,
+    },
+    AtomicMutation,
+};
+use serde_json::json;
+use std::{
+    process::{Child, Command},
+    time::Duration,
+};
+use tempfile::TempDir;
+
+static PROCESS_TESTS: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+struct RunningAuthority {
+    child: Child,
+    socket: std::path::PathBuf,
+    storage: std::path::PathBuf,
+}
+
+impl Drop for RunningAuthority {
+    fn drop(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
+
+fn start(directory: &TempDir) -> RunningAuthority {
+    let socket = directory.path().join("authority.sock");
+    let storage = directory.path().join("authority.db");
+    let child = Command::new(env!("CARGO_BIN_EXE_feltdb-authority"))
+        .arg(&socket)
+        .arg(&storage)
+        .spawn()
+        .expect("authority starts");
+    for _ in 0..200 {
+        if socket.exists() {
+            return RunningAuthority {
+                child,
+                socket,
+                storage,
+            };
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+    panic!("authority socket was not ready");
+}
+
+fn writer(socket: &std::path::Path, id: usize) -> Child {
+    Command::new(env!("CARGO_BIN_EXE_feltdb-authority-client"))
+        .arg(socket)
+        .arg(id.to_string())
+        .spawn()
+        .expect("writer starts")
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn seed_34002_ten_process_writers_preserve_ten_records() {
+    let _process_test = PROCESS_TESTS
+        .lock()
+        .unwrap_or_else(|error| error.into_inner());
+    let directory = TempDir::new().unwrap();
+    let authority = start(&directory);
+    let mut writers: Vec<_> = (0..10).map(|id| writer(&authority.socket, id)).collect();
+    for writer in &mut writers {
+        assert!(writer.wait().unwrap().success());
+    }
+    let read = AuthorityClient::connect(&authority.socket)
+        .read_authoritative()
+        .await
+        .unwrap();
+    assert_eq!(read.authoritative_revision, 10);
+    assert_eq!(
+        read.rows
+            .iter()
+            .filter(|row| row.capability == "registrations")
+            .count(),
+        10
+    );
+    assert!(!directory.path().join("authority.tmp").exists());
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn same_revision_is_coherent_across_disposable_clients() {
+    let _process_test = PROCESS_TESTS
+        .lock()
+        .unwrap_or_else(|error| error.into_inner());
+    let directory = TempDir::new().unwrap();
+    let authority = start(&directory);
+    let mut writers: Vec<_> = (0..10).map(|id| writer(&authority.socket, id)).collect();
+    for writer in &mut writers {
+        assert!(writer.wait().unwrap().success());
+    }
+    let first = AuthorityClient::connect(&authority.socket)
+        .read_authoritative()
+        .await
+        .unwrap();
+    let second = AuthorityClient::connect(&authority.socket)
+        .read_authoritative()
+        .await
+        .unwrap();
+    assert_eq!(first.authoritative_revision, second.authoritative_revision);
+    assert_eq!(first.content_hash, second.content_hash);
+    assert_eq!(first.rows.len(), second.rows.len());
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn authoritative_reads_during_concurrent_writes_are_committed_states() {
+    let _process_test = PROCESS_TESTS
+        .lock()
+        .unwrap_or_else(|error| error.into_inner());
+    let directory = TempDir::new().unwrap();
+    let authority = start(&directory);
+    let mut writers: Vec<_> = (0..10).map(|id| writer(&authority.socket, id)).collect();
+    let client = AuthorityClient::connect(&authority.socket);
+    let mut last_revision = 0;
+    while writers
+        .iter_mut()
+        .any(|writer| writer.try_wait().unwrap().is_none())
+    {
+        let read = client.read_authoritative().await.unwrap();
+        assert!(read.authoritative_revision >= last_revision);
+        assert_eq!(read.observed_revision, read.authoritative_revision);
+        assert_eq!(read.rows.len() as u64, read.authoritative_revision);
+        last_revision = read.authoritative_revision;
+    }
+    for writer in &mut writers {
+        if writer.try_wait().unwrap().is_none() {
+            assert!(writer.wait().unwrap().success());
+        }
+    }
+    assert_eq!(client.read_authoritative().await.unwrap().rows.len(), 10);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn recorded_deterministic_stress_seeds_preserve_every_commit() {
+    let _process_test = PROCESS_TESTS
+        .lock()
+        .unwrap_or_else(|error| error.into_inner());
+    for seed in [34002_u64, 1, 7, 42, 34003] {
+        let directory = TempDir::new().unwrap();
+        let authority = start(&directory);
+        let mut order: Vec<usize> = (0..10).collect();
+        order.rotate_left((seed as usize) % 10);
+        if seed & 1 == 1 {
+            order.reverse();
+        }
+        let mut writers: Vec<_> = order
+            .into_iter()
+            .map(|id| writer(&authority.socket, id))
+            .collect();
+        for writer in &mut writers {
+            assert!(writer.wait().unwrap().success(), "seed {seed}");
+        }
+        let read = AuthorityClient::connect(&authority.socket)
+            .read_authoritative()
+            .await
+            .unwrap();
+        assert_eq!(read.rows.len(), 10, "seed {seed}");
+        assert_eq!(read.authoritative_revision, 10, "seed {seed}");
+    }
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn stale_snapshot_is_explicit_and_stale_commit_is_rejected() {
+    let _process_test = PROCESS_TESTS
+        .lock()
+        .unwrap_or_else(|error| error.into_inner());
+    let directory = TempDir::new().unwrap();
+    let embedded = EmbeddedAuthority::open(directory.path().join("embedded.db")).unwrap();
+    let snapshot = embedded.snapshot().unwrap();
+    assert_eq!(snapshot.kind, ReadKind::Snapshot);
+    let commit = |id: &str, base_revision| AuthorityTransaction {
+        transaction_id: id.into(),
+        base_revision,
+        preconditions: vec![],
+        record_preconditions: vec![],
+        mutations: vec![AtomicMutation {
+            capability: "cells".into(),
+            key: format!("cells:{id}"),
+            value: Some(json!({"id": id})),
+        }],
+        audit: None,
+    };
+    let first = embedded
+        .commit(commit("first", Some(snapshot.observed_revision)))
+        .await
+        .unwrap();
+    assert_eq!(first.commit_revision, snapshot.observed_revision + 1);
+    let duplicate = embedded
+        .commit(commit("first", Some(snapshot.observed_revision)))
+        .await
+        .unwrap();
+    assert!(duplicate.duplicate);
+    assert_eq!(duplicate.base_revision, first.base_revision);
+    assert_eq!(duplicate.commit_revision, first.commit_revision);
+    let error = embedded
+        .commit(commit("stale", Some(snapshot.observed_revision)))
+        .await
+        .unwrap_err();
+    assert_eq!(error.code, "REVISION_CONFLICT");
+    assert_eq!(error.authoritative_revision, Some(first.commit_revision));
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn authority_restart_recovers_revision_and_continues_monotonically() {
+    let _process_test = PROCESS_TESTS
+        .lock()
+        .unwrap_or_else(|error| error.into_inner());
+    let directory = TempDir::new().unwrap();
+    let mut authority = start(&directory);
+    let mut writers: Vec<_> = (0..3).map(|id| writer(&authority.socket, id)).collect();
+    for writer in &mut writers {
+        assert!(writer.wait().unwrap().success());
+    }
+    authority.child.kill().unwrap();
+    authority.child.wait().unwrap();
+    let _ = std::fs::remove_file(&authority.socket);
+    let restarted = start(&directory);
+    let client = AuthorityClient::connect(&restarted.socket);
+    assert_eq!(client.current_revision().await.unwrap(), 3);
+    let mut next = writer(&restarted.socket, 4);
+    assert!(next.wait().unwrap().success());
+    assert_eq!(client.current_revision().await.unwrap(), 4);
+    assert_eq!(client.read_authoritative().await.unwrap().rows.len(), 4);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn torn_commit_tail_recovers_only_the_previous_committed_revision() {
+    use std::io::Write;
+    let _process_test = PROCESS_TESTS
+        .lock()
+        .unwrap_or_else(|error| error.into_inner());
+    let directory = TempDir::new().unwrap();
+    let mut authority = start(&directory);
+    let mut first = writer(&authority.socket, 1);
+    assert!(first.wait().unwrap().success());
+    authority.child.kill().unwrap();
+    authority.child.wait().unwrap();
+    let mut log = std::fs::OpenOptions::new()
+        .append(true)
+        .open(&authority.storage)
+        .unwrap();
+    log.write_all(br#"{"record_type":"feltdb.transaction.v1","transaction_id":"torn""#)
+        .unwrap();
+    log.sync_all().unwrap();
+    let _ = std::fs::remove_file(&authority.socket);
+    let recovered = start(&directory);
+    let client = AuthorityClient::connect(&recovered.socket);
+    let read = client.read_authoritative().await.unwrap();
+    assert_eq!(read.authoritative_revision, 1);
+    assert_eq!(read.rows.len(), 1);
+    let mut second = writer(&recovered.socket, 2);
+    assert!(second.wait().unwrap().success());
+    assert_eq!(client.current_revision().await.unwrap(), 2);
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn f2_authority_schedule_exposes_the_removal_at_a_new_revision() {
+    let _process_test = PROCESS_TESTS
+        .lock()
+        .unwrap_or_else(|error| error.into_inner());
+    let directory = TempDir::new().unwrap();
+    let authority = start(&directory);
+    let client = AuthorityClient::connect(&authority.socket);
+    let mut initial = writer(&authority.socket, 1);
+    assert!(initial.wait().unwrap().success());
+    let consumer_snapshot = client.read_authoritative().await.unwrap();
+    client
+        .commit(AuthorityTransaction {
+            transaction_id: "provider-removes-registration".into(),
+            base_revision: Some(consumer_snapshot.authoritative_revision),
+            preconditions: vec![],
+            record_preconditions: vec![],
+            mutations: vec![AtomicMutation {
+                capability: "registrations".into(),
+                key: "registrations:1".into(),
+                value: None,
+            }],
+            audit: None,
+        })
+        .await
+        .unwrap();
+    let resumed = AuthorityClient::connect(&authority.socket)
+        .read_authoritative()
+        .await
+        .unwrap();
+    assert!(resumed.authoritative_revision > consumer_snapshot.observed_revision);
+    assert!(resumed.rows.iter().all(|row| row.key != "registrations:1"));
+    assert!(consumer_snapshot
+        .rows
+        .iter()
+        .any(|row| row.key == "registrations:1"));
+}

package/dist/create/server-source/crates/feltdb-server/src/auth.rs

@@ -10,6 +10,7 @@ use argon2::{
 };
 use rand::{distributions::Alphanumeric, Rng};
 use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
 
 #[derive(Debug, Deserialize)]
 struct LegacyApiKeyStore {
@@ -128,18 +129,18 @@ impl KeyStore {
         let records = self.records.read().ok()?;
         records
             .iter()
+            // Newly issued high-entropy keys use the fast digest format and
+            // are appended to the store. Check them before legacy Argon2
+            // records so current requests never pay historical password-hash
+            // verification costs.
+            .rev()
             .filter(|record| !record.revoked)
             .find_map(|record| {
                 let namespace_allowed = record
                     .namespaces
                     .iter()
                     .any(|allowed| allowed == "*" || allowed == namespace);
-                let parsed = PasswordHash::new(&record.hash).ok()?;
-                if namespace_allowed
-                    && Argon2::default()
-                        .verify_password(token.as_bytes(), &parsed)
-                        .is_ok()
-                {
+                if namespace_allowed && verify_api_key(token, &record.hash) {
                     Some(Principal {
                         key_id: record.id.clone(),
                         scopes: record.scopes.clone(),
@@ -165,11 +166,10 @@ impl KeyStore {
             .map(char::from)
             .collect();
         let token = format!("fdb_live_{secret}");
-        let salt = SaltString::generate(&mut OsRng);
-        let hash = Argon2::default()
-            .hash_password(token.as_bytes(), &salt)
-            .map_err(|error| error.to_string())?
-            .to_string();
+        // Service keys are high-entropy random secrets, not user-selected
+        // passwords. A deterministic digest keeps them out of the credential
+        // store without imposing Argon2's CPU cost on every API request.
+        let hash = hash_api_key(&token);
         let id: String = rand::thread_rng()
             .sample_iter(&Alphanumeric)
             .take(12)
@@ -246,6 +246,35 @@ impl KeyStore {
     }
 }
 
+fn hash_api_key(token: &str) -> String {
+    let digest = Sha256::digest(token.as_bytes());
+    let encoded = digest
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect::<String>();
+    format!("sha256:{encoded}")
+}
+
+fn verify_api_key(token: &str, stored_hash: &str) -> bool {
+    if stored_hash.starts_with("sha256:") {
+        let candidate = hash_api_key(token);
+        return candidate.len() == stored_hash.len()
+            && ring::constant_time::verify_slices_are_equal(
+                candidate.as_bytes(),
+                stored_hash.as_bytes(),
+            )
+            .is_ok();
+    }
+
+    PasswordHash::new(stored_hash)
+        .ok()
+        .is_some_and(|parsed| {
+            Argon2::default()
+                .verify_password(token.as_bytes(), &parsed)
+                .is_ok()
+        })
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -272,6 +301,7 @@ mod tests {
 
         let file = fs::read_to_string(&path).unwrap();
         assert!(!file.contains(&token));
+        assert!(file.contains("sha256:"));
         assert!(store
             .authenticate(&token, "alpha")
             .unwrap()

package/dist/create/server-source/crates/feltdb-server/src/connections.rs

@@ -590,6 +590,20 @@ impl ConnectionStore {
             .cloned()
             .collect())
     }
+
+    /// Internal inventory lookup used after the caller has already passed an
+    /// application-scoped runtime or promotion authorization check.
+    pub fn application_connections(&self, application_id: &str) -> Result<Vec<Connection>, String> {
+        Ok(self
+            .records
+            .read()
+            .map_err(|_| "connection store lock poisoned")?
+            .connections
+            .iter()
+            .filter(|connection| connection.application_id == application_id)
+            .cloned()
+            .collect())
+    }
     pub fn disable(
         &self,
         actor: &str,

package/dist/create/server-source/crates/feltdb-server/src/key_management.rs

@@ -59,9 +59,14 @@ pub async fn create_key(
     {
         authentication_namespaces.push(state.namespace.to_string());
     }
-    let key = state
-        .keys
-        .create(name, scopes.clone(), authentication_namespaces)
+    // Argon2 is intentionally CPU/memory expensive. Running it on the async
+    // request worker makes readiness and unrelated control-plane requests
+    // unavailable while qualification creates several scoped keys.
+    let keys = state.keys.clone();
+    let key_scopes = scopes.clone();
+    let key = tokio::task::spawn_blocking(move || keys.create(name, key_scopes, authentication_namespaces))
+        .await
+        .map_err(|error| (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()))?
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
 
     if let Some(application_id) = req.application_id {