@feltdb/core 0.8.1 → 0.8.3

package/dist/create/server-source/crates/feltdb/src/state_contract.rs

@@ -22,7 +22,9 @@
 
 use crate::{
     application::{ApplicationManifest, ApplicationRevision, FieldDefinition},
-    policy_evaluation::{PolicyEvaluator, PolicySubject, RecordAuthorizationContext, Actor, AuthorizationState},
+    policy_evaluation::{
+        Actor, AuthorizationState, PolicyEvaluator, PolicySubject, RecordAuthorizationContext,
+    },
     AtomicMutation, AtomicPrecondition, FeltDb, StoredRow,
 };
 use serde::{Deserialize, Serialize};
@@ -616,7 +618,9 @@ pub fn begin_read(
             "authorization context does not match schema",
         ));
     }
-    let snapshot = db.state_rows().map_err(StateFailure::storage)?;
+    let snapshot = db
+        .state_rows_for_namespace(state_namespace)
+        .map_err(StateFailure::storage)?;
     Ok(ReadContext {
         application_id: schema.application_id.clone(),
         revision_id: schema.revision_id.clone(),
@@ -1344,11 +1348,17 @@ pub fn execute_query(
         .collect::<Vec<_>>();
 
     if let Some(policy) = &read_policy {
-        let actor = if context.authorization.subject.is_empty() || context.authorization.subject == ":" {
-            None
-        } else {
-            context.authorization.subject.split(':').nth(1).map(|id| Actor::new(id))
-        };
+        let actor =
+            if context.authorization.subject.is_empty() || context.authorization.subject == ":" {
+                None
+            } else {
+                context
+                    .authorization
+                    .subject
+                    .split(':')
+                    .nth(1)
+                    .map(|id| Actor::new(id))
+            };
 
         // Create authorization state for policies that need to verify relationships
         let auth_state = AuthorizationState::new(
@@ -1367,8 +1377,7 @@ pub fn execute_query(
                     authorization_state: Some(auth_state.clone()),
                 };
 
-                PolicyEvaluator::evaluate_record(policy.clone(), &record_context)
-                    .is_ok()
+                PolicyEvaluator::evaluate_record(policy.clone(), &record_context).is_ok()
             } else {
                 true
             }
@@ -1618,6 +1627,8 @@ pub struct TransactionRequest {
     #[serde(default)]
     pub state_namespace: Option<String>,
     #[serde(default)]
+    /// Optimistic authority revision. A mismatched revision is rejected.
+    #[serde(rename = "base_revision")]
     pub causal_parent: Option<u64>,
     pub authorization: AuthorizationContext,
     pub operations: Vec<TransactionOperation>,
@@ -1642,6 +1653,9 @@ pub struct TransactionAudit {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TransactionResult {
     pub transaction_id: String,
+    pub base_revision: u64,
+    pub commit_revision: u64,
+    pub status: crate::TransactionStatus,
     pub state_before: u64,
     pub state_after: u64,
     pub causal_cursor: BTreeMap<String, u64>,
@@ -1899,7 +1913,7 @@ fn validate_record(collection: &CollectionSchema, value: &mut Value) -> Result<(
     }
     if object
         .keys()
-        .any(|name| !collection.fields.iter().any(|f| &f.name == name))
+        .any(|name| name != "__version" && !collection.fields.iter().any(|f| &f.name == name))
     {
         return Err(StateFailure::new(
             "VALIDATION_FAILED",
@@ -1972,13 +1986,42 @@ fn execute_transaction_with_policies(
         .transaction_id
         .clone()
         .unwrap_or_else(|| format!("tx_{:x}", Sha256::digest(&canonical)));
+    // Client transaction identities are application-local. The managed store
+    // serves many applications from one durable log, so using the bare client
+    // id as the substrate id lets one application collide with another.
+    // Hash the authorization boundary into the private storage identity while
+    // preserving the caller's id in every public result and audit record.
+    let storage_transaction_id = format!(
+        "txscope_{:x}_{}",
+        Sha256::digest(
+            format!(
+                "{}\0{}\0{}",
+                request.tenant_id,
+                request.application_id,
+                request
+                    .state_namespace
+                    .as_deref()
+                    .unwrap_or(&request.application_id)
+            )
+            .as_bytes()
+        ),
+        transaction_id
+    );
     let payload_hash = format!("sha256:{:x}", Sha256::digest(&canonical));
     if db
-        .has_applied_transaction(&transaction_id)
+        .has_applied_transaction(&storage_transaction_id)
         .map_err(StateFailure::storage)?
     {
-        if db.applied_transaction_payload_hash(&transaction_id).map_err(StateFailure::storage)?.as_deref() != Some(payload_hash.as_str()) {
-            return Err(StateFailure::new("CONFLICT", "transaction ID was already committed with a different canonical payload"));
+        if db
+            .applied_transaction_payload_hash(&storage_transaction_id)
+            .map_err(StateFailure::storage)?
+            .as_deref()
+            != Some(payload_hash.as_str())
+        {
+            return Err(StateFailure::new(
+                "CONFLICT",
+                "transaction ID was already committed with a different canonical payload",
+            ));
         }
         let state = db.sequence().map_err(StateFailure::storage)?;
         let cursor = db
@@ -2002,6 +2045,9 @@ fn execute_transaction_with_policies(
         };
         return Ok(TransactionResult {
             transaction_id,
+            base_revision: db.current_revision().map_err(StateFailure::storage)?,
+            commit_revision: db.current_revision().map_err(StateFailure::storage)?,
+            status: crate::TransactionStatus::Committed,
             state_before: state,
             state_after: state,
             causal_cursor: cursor,
@@ -2111,7 +2157,9 @@ fn execute_transaction_with_policies(
             .unwrap_or_else(|| persisted.map(|row| Some(row.value.clone())).unwrap_or(None));
 
         // Per-operation record authorization
-        let write_policy = collection_write_policies.and_then(|policies| policies.get(&operation.collection)).or(uniform_write_policy);
+        let write_policy = collection_write_policies
+            .and_then(|policies| policies.get(&operation.collection))
+            .or(uniform_write_policy);
         if let Some(policy) = write_policy {
             let actor = if request.authorization.subject.is_empty()
                 || request.authorization.subject == ":"
@@ -2135,9 +2183,9 @@ fn execute_transaction_with_policies(
                 TransactionOperationKind::Update | TransactionOperationKind::Delete => {
                     // For update/delete: authorize against EXISTING record (before changes)
                     // This prevents authorization bypass via ownership/org changes
-                    existing_value.clone().ok_or_else(|| {
-                        StateFailure::new("CONFLICT", "record does not exist")
-                    })?
+                    existing_value
+                        .clone()
+                        .ok_or_else(|| StateFailure::new("CONFLICT", "record does not exist"))?
                 }
             };
 
@@ -2160,16 +2208,15 @@ fn execute_transaction_with_policies(
                 authorization_state: Some(auth_state),
             };
 
-            PolicyEvaluator::evaluate_record(policy.clone(), &record_context)
-                .map_err(|_| {
-                    StateFailure::new(
-                        "AUTHORIZATION_DENIED",
-                        &format!(
-                            "record authorization failed for operation on {}:{}",
-                            operation.collection, key
-                        ),
-                    )
-                })?;
+            PolicyEvaluator::evaluate_record(policy.clone(), &record_context).map_err(|_| {
+                StateFailure::new(
+                    "AUTHORIZATION_DENIED",
+                    &format!(
+                        "record authorization failed for operation on {}:{}",
+                        operation.collection, key
+                    ),
+                )
+            })?;
         }
 
         let value = match operation.kind {
@@ -2304,7 +2351,7 @@ fn execute_transaction_with_policies(
     }
     let commit = db
         .apply_atomic_transaction_content_addressed(
-            &transaction_id,
+            &storage_transaction_id,
             Some(&payload_hash),
             request.causal_parent,
             &preconditions,
@@ -2367,6 +2414,9 @@ fn execute_transaction_with_policies(
     };
     Ok(TransactionResult {
         transaction_id,
+        base_revision: commit.base_revision,
+        commit_revision: commit.commit_revision,
+        status: commit.status,
         state_before: commit.state_before,
         state_after: commit.state_after,
         causal_cursor: cursor,
@@ -2609,7 +2659,9 @@ mod tests {
         stale.transaction_id = Some("stale".into());
         stale.causal_parent = Some(0);
         assert_eq!(
-            execute_transaction(&db, &schema, &stale, None).unwrap_err().code,
+            execute_transaction(&db, &schema, &stale, None)
+                .unwrap_err()
+                .code,
             "CONFLICT"
         );
     }
@@ -2786,16 +2838,149 @@ mod tests {
     }
     #[test]
     fn explicit_transaction_id_is_bound_to_canonical_payload_across_restart() {
-        let path=std::env::temp_dir().join(format!("feltdb-content-id-{}-{}.log",std::process::id(),crate::now_ms()));
-        let schema=schema();
-        let request=TransactionRequest{transaction_id:Some("stable-client-id".into()),tenant_id:"tenant".into(),application_id:"app".into(),revision_id:"rev".into(),schema_version:1,state_namespace:None,causal_parent:None,authorization:auth(),preconditions:vec![],operations:vec![TransactionOperation{kind:TransactionOperationKind::Insert,collection:"incidents".into(),id:"content-bound".into(),value:serde_json::json!({"title":"Original"}),if_version:None}]};
-        {let db=crate::open(&path).unwrap();assert!(!execute_transaction(&db,&schema,&request,None).unwrap().duplicate);assert!(execute_transaction(&db,&schema,&request,None).unwrap().duplicate);}
-        let reopened=crate::open(&path).unwrap();assert!(execute_transaction(&reopened,&schema,&request,None).unwrap().duplicate);
-        let mut changed=request.clone();changed.operations[0].value=serde_json::json!({"title":"Changed"});
-        let failure=execute_transaction(&reopened,&schema,&changed,None).unwrap_err();assert_eq!(failure.code,"CONFLICT");assert!(failure.message.contains("different canonical payload"));
+        let path = std::env::temp_dir().join(format!(
+            "feltdb-content-id-{}-{}.log",
+            std::process::id(),
+            crate::now_ms()
+        ));
+        let schema = schema();
+        let request = TransactionRequest {
+            transaction_id: Some("stable-client-id".into()),
+            tenant_id: "tenant".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            schema_version: 1,
+            state_namespace: None,
+            causal_parent: None,
+            authorization: auth(),
+            preconditions: vec![],
+            operations: vec![TransactionOperation {
+                kind: TransactionOperationKind::Insert,
+                collection: "incidents".into(),
+                id: "content-bound".into(),
+                value: serde_json::json!({"title":"Original"}),
+                if_version: None,
+            }],
+        };
+        {
+            let db = crate::open(&path).unwrap();
+            assert!(
+                !execute_transaction(&db, &schema, &request, None)
+                    .unwrap()
+                    .duplicate
+            );
+            assert!(
+                execute_transaction(&db, &schema, &request, None)
+                    .unwrap()
+                    .duplicate
+            );
+        }
+        let reopened = crate::open(&path).unwrap();
+        assert!(
+            execute_transaction(&reopened, &schema, &request, None)
+                .unwrap()
+                .duplicate
+        );
+        let mut changed = request.clone();
+        changed.operations[0].value = serde_json::json!({"title":"Changed"});
+        let failure = execute_transaction(&reopened, &schema, &changed, None).unwrap_err();
+        assert_eq!(failure.code, "CONFLICT");
+        assert!(failure.message.contains("different canonical payload"));
         std::fs::remove_file(path).ok();
     }
     #[test]
+    fn explicit_transaction_id_is_isolated_between_applications() {
+        fn application(
+            app: &str,
+            namespace: &str,
+            transaction: &str,
+            record: &str,
+        ) -> (StateSchema, TransactionRequest) {
+            let mut schema = schema();
+            schema.application_id = app.into();
+            let mut authorization = auth();
+            authorization.application_id = app.into();
+            let request = TransactionRequest {
+                transaction_id: Some(transaction.into()),
+                tenant_id: "tenant".into(),
+                application_id: app.into(),
+                revision_id: "rev".into(),
+                schema_version: 1,
+                state_namespace: Some(namespace.into()),
+                causal_parent: None,
+                authorization,
+                preconditions: vec![],
+                operations: vec![TransactionOperation {
+                    kind: TransactionOperationKind::Insert,
+                    collection: "incidents".into(),
+                    id: record.into(),
+                    value: serde_json::json!({"title":format!("{app}-{record}")}),
+                    if_version: None,
+                }],
+            };
+            (schema, request)
+        }
+        for (name, order) in [
+            (
+                "a-then-b",
+                vec![("app-a", "shared-1", "one"), ("app-b", "shared-1", "one")],
+            ),
+            (
+                "b-then-a",
+                vec![("app-b", "shared-1", "one"), ("app-a", "shared-1", "one")],
+            ),
+            (
+                "interleaved",
+                vec![
+                    ("app-a", "shared-1", "one"),
+                    ("app-b", "shared-1", "one"),
+                    ("app-a", "shared-2", "two"),
+                    ("app-b", "shared-2", "two"),
+                ],
+            ),
+        ] {
+            let path = std::env::temp_dir().join(format!(
+                "feltdb-app-isolation-{name}-{}-{}.log",
+                std::process::id(),
+                crate::now_ms()
+            ));
+            {
+                let db = crate::open(&path).unwrap();
+                for (app, transaction, record) in &order {
+                    let (schema, request) =
+                        application(app, &format!("{app}:production"), transaction, record);
+                    assert!(
+                        !execute_transaction(&db, &schema, &request, None)
+                            .unwrap()
+                            .duplicate
+                    );
+                }
+            }
+            let reopened = crate::open(&path).unwrap();
+            for (app, transaction, record) in &order {
+                let (schema, request) =
+                    application(app, &format!("{app}:production"), transaction, record);
+                assert!(
+                    execute_transaction(&reopened, &schema, &request, None)
+                        .unwrap()
+                        .duplicate
+                );
+                let rows = reopened.state_rows().unwrap();
+                assert_eq!(
+                    rows.iter()
+                        .filter(
+                            |row| row.capability == format!("{app}:production:incidents")
+                                && row.key == *record
+                                && !row.deleted
+                        )
+                        .count(),
+                    1
+                );
+            }
+            std::fs::remove_file(path).ok();
+        }
+    }
+    #[test]
     fn read_context_remains_a_stable_snapshot() {
         let db = db("snapshot-read");
         let schema = schema();
@@ -2880,7 +3065,7 @@ mod tests {
         }
         let reopened = FeltDb::open(path).unwrap();
         assert_eq!(reopened.export_snapshot().unwrap().rows.len(), 2);
-        assert!(reopened.has_applied_transaction("replay-tx").unwrap());
+        assert_eq!(reopened.current_revision().unwrap(), 1);
     }
     #[test]
     fn indexed_equality_query_uses_index_not_scan() {
@@ -3324,7 +3509,10 @@ mod tests {
         };
 
         let result = execute_query(&db, &schema, &context, &query, None);
-        assert!(result.is_ok(), "Query should succeed with state:read capability");
+        assert!(
+            result.is_ok(),
+            "Query should succeed with state:read capability"
+        );
     }
 
     #[test]
@@ -3571,7 +3759,10 @@ mod tests {
         let result = execute_query(&db, &schema, &context, &query, None);
         assert!(result.is_ok(), "Authenticated read must be allowed");
         let query_result = result.unwrap();
-        assert!(query_result.records.len() >= 1, "Query should return the inserted record");
+        assert!(
+            query_result.records.len() >= 1,
+            "Query should return the inserted record"
+        );
     }
 
     #[test]
@@ -3612,7 +3803,10 @@ mod tests {
 
         let result = execute_transaction(&db, &schema, &request, None);
         assert!(result.is_ok(), "Authenticated write must be allowed");
-        assert!(result.unwrap().state_after > 0, "Transaction should have succeeded");
+        assert!(
+            result.unwrap().state_after > 0,
+            "Transaction should have succeeded"
+        );
     }
 
     #[test]
@@ -3693,9 +3887,11 @@ mod tests {
             references: vec![],
         };
 
-        let verify_result = execute_query(&db, &schema, &verify_context, &verify_query, None).unwrap();
+        let verify_result =
+            execute_query(&db, &schema, &verify_context, &verify_query, None).unwrap();
         assert_eq!(
-            verify_result.records.len(), 1,
+            verify_result.records.len(),
+            1,
             "Only initial record should exist; denied transaction must not partially commit"
         );
     }
@@ -3810,7 +4006,10 @@ mod tests {
         };
 
         let result = execute_query(&db, &schema, &read_context, &query, None);
-        assert!(result.is_ok(), "Member policy read should be allowed with state:read");
+        assert!(
+            result.is_ok(),
+            "Member policy read should be allowed with state:read"
+        );
     }
 
     #[test]
@@ -4129,14 +4328,8 @@ mod tests {
         }
 
         let bob_read = begin_read(&db, &schema, "app", bob_context).unwrap();
-        let bob_result = execute_query(
-            &db,
-            &schema,
-            &bob_read,
-            &query,
-            Some(PolicySubject::Owner),
-        )
-        .expect("query should succeed");
+        let bob_result = execute_query(&db, &schema, &bob_read, &query, Some(PolicySubject::Owner))
+            .expect("query should succeed");
 
         assert_eq!(
             bob_result.records.len(),