@feltdb/core 0.9.0 → 0.10.0

package/dist/create/server-source/crates/feltdb-server/src/principals.rs

@@ -1,15 +1,10 @@
-use crate::{
-    authorization::{authorize, AuthorizationRequest, Subject},
-    tenancy::TenancyStore,
-};
-use rand::{distributions::Alphanumeric, Rng};
+//! Principal domain records.
+//!
+//! Persistence intentionally does not live in this module. Canonical runtime
+//! authority and the isolated one-way legacy reader are implemented by
+//! `canonical_principals`; there is no JSON-backed `PrincipalStore`.
+
 use serde::{Deserialize, Serialize};
-use std::{
-    fs,
-    path::PathBuf,
-    sync::{Arc, RwLock},
-    time::{SystemTime, UNIX_EPOCH},
-};
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
@@ -20,6 +15,7 @@ pub enum PrincipalKind {
     Worker,
     Connection,
 }
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum PrincipalStatus {
@@ -29,6 +25,7 @@ pub enum PrincipalStatus {
     Completed,
     Failed,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PrincipalRecord {
     pub id: String,
@@ -45,6 +42,7 @@ pub struct PrincipalRecord {
     pub started_at: Option<u64>,
     pub completed_at: Option<u64>,
 }
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PrincipalAuditEvent {
     pub event: String,
@@ -55,493 +53,3 @@ pub struct PrincipalAuditEvent {
     pub decision: Option<bool>,
     pub at: u64,
 }
-#[derive(Debug, Default, Serialize, Deserialize)]
-struct PrincipalRecords {
-    principals: Vec<PrincipalRecord>,
-    audit: Vec<PrincipalAuditEvent>,
-}
-#[derive(Clone)]
-pub struct PrincipalStore {
-    path: PathBuf,
-    records: Arc<RwLock<PrincipalRecords>>,
-}
-
-fn now() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs()
-}
-fn id(prefix: &str) -> String {
-    let value: String = rand::thread_rng()
-        .sample_iter(&Alphanumeric)
-        .take(18)
-        .map(char::from)
-        .collect();
-    format!("{prefix}_{value}")
-}
-fn kind_subject(record: &PrincipalRecord) -> Subject {
-    match record.kind {
-        PrincipalKind::Agent => Subject::Agent(record.id.clone()),
-        PrincipalKind::Workload => Subject::Workload(record.id.clone()),
-        PrincipalKind::Service => Subject::Service(record.id.clone()),
-        PrincipalKind::Worker => Subject::Worker(record.id.clone()),
-        PrincipalKind::Connection => Subject::Connection(record.id.clone()),
-    }
-}
-
-impl PrincipalStore {
-    pub fn load(path: impl Into<PathBuf>) -> Result<Self, String> {
-        let path = path.into();
-        let records = if path.exists() {
-            serde_json::from_slice(&fs::read(&path).map_err(|error| error.to_string())?)
-                .map_err(|error| error.to_string())?
-        } else {
-            PrincipalRecords::default()
-        };
-        Ok(Self {
-            path,
-            records: Arc::new(RwLock::new(records)),
-        })
-    }
-    fn persist(&self, records: &PrincipalRecords) -> Result<(), String> {
-        if let Some(parent) = self.path.parent() {
-            fs::create_dir_all(parent).map_err(|error| error.to_string())?;
-        }
-        let temporary = self.path.with_extension("tmp");
-        fs::write(
-            &temporary,
-            serde_json::to_vec_pretty(records).map_err(|error| error.to_string())?,
-        )
-        .map_err(|error| error.to_string())?;
-        fs::rename(temporary, &self.path).map_err(|error| error.to_string())
-    }
-    fn event(
-        records: &mut PrincipalRecords,
-        event: &str,
-        actor: &str,
-        principal: &PrincipalRecord,
-        capability: Option<&str>,
-        decision: Option<bool>,
-    ) {
-        records.audit.push(PrincipalAuditEvent {
-            event: event.into(),
-            actor: actor.into(),
-            principal_id: principal.id.clone(),
-            application_id: principal.application_id.clone(),
-            capability: capability.map(str::to_string),
-            decision,
-            at: now(),
-        });
-    }
-    fn application_context(tenancy: &TenancyStore, application_id: &str) -> Result<String, String> {
-        tenancy
-            .application_tenant(application_id)
-            .ok_or("application not found".into())
-    }
-
-    pub fn list(
-        &self,
-        actor: &str,
-        tenancy: &TenancyStore,
-        application_id: &str,
-    ) -> Result<Vec<PrincipalRecord>, String> {
-        let tenant_id = Self::application_context(tenancy, application_id)?;
-        if !tenancy.authorize_application(actor, &tenant_id, application_id, "applications:read") {
-            return Err("forbidden".into());
-        }
-        Ok(self
-            .records
-            .read()
-            .map_err(|_| "principal store lock poisoned")?
-            .principals
-            .iter()
-            .filter(|principal| principal.application_id == application_id)
-            .cloned()
-            .collect())
-    }
-    /// One principal's own audit trail: grants, creations, and the
-    /// authorization decisions taken for it.
-    ///
-    /// The store has recorded these since it existed and nothing read them
-    /// back. A human governing an agent needs exactly this — what the agent was
-    /// allowed to do, when, and who allowed it — so it is readable under the
-    /// same application authorization as listing principals.
-    pub fn audit_for(
-        &self,
-        actor: &str,
-        tenancy: &TenancyStore,
-        application_id: &str,
-        principal_id: Option<&str>,
-        limit: usize,
-    ) -> Result<Vec<PrincipalAuditEvent>, String> {
-        let tenant_id = Self::application_context(tenancy, application_id)?;
-        if !tenancy.authorize_application(actor, &tenant_id, application_id, "applications:read") {
-            return Err("forbidden".into());
-        }
-        let records = self
-            .records
-            .read()
-            .map_err(|_| "principal store lock poisoned")?;
-        let mut events: Vec<PrincipalAuditEvent> = records
-            .audit
-            .iter()
-            .filter(|event| event.application_id == application_id)
-            .filter(|event| principal_id.is_none_or(|id| event.principal_id == id))
-            .cloned()
-            .collect();
-        // Newest first: an operator reads the most recent decision, then
-        // works backwards.
-        events.reverse();
-        events.truncate(limit);
-        Ok(events)
-    }
-
-    pub fn create(
-        &self,
-        actor: &str,
-        tenancy: &TenancyStore,
-        application_id: &str,
-        kind: PrincipalKind,
-        name: &str,
-    ) -> Result<PrincipalRecord, String> {
-        let tenant_id = Self::application_context(tenancy, application_id)?;
-        let required = match kind {
-            PrincipalKind::Agent => "agents:write",
-            PrincipalKind::Connection => "connections:write",
-            _ => "applications:write",
-        };
-        if !tenancy.authorize_application(actor, &tenant_id, application_id, required) {
-            return Err("forbidden".into());
-        }
-        let prefix = match kind {
-            PrincipalKind::Agent => "agent",
-            PrincipalKind::Workload => "workload",
-            PrincipalKind::Service => "service",
-            PrincipalKind::Worker => "worker",
-            PrincipalKind::Connection => "connection",
-        };
-        let principal = PrincipalRecord {
-            id: id(prefix),
-            application_id: application_id.into(),
-            kind,
-            name: name.into(),
-            version: 1,
-            status: PrincipalStatus::Active,
-            created_by: actor.into(),
-            created_at: now(),
-            capabilities: vec![],
-            parent_id: None,
-            worker_id: None,
-            started_at: None,
-            completed_at: None,
-        };
-        let mut records = self
-            .records
-            .write()
-            .map_err(|_| "principal store lock poisoned")?;
-        records.principals.push(principal.clone());
-        Self::event(
-            &mut records,
-            "principal.created",
-            actor,
-            &principal,
-            None,
-            None,
-        );
-        self.persist(&records)?;
-        Ok(principal)
-    }
-    pub fn grant(
-        &self,
-        actor: &str,
-        tenancy: &TenancyStore,
-        principal_id: &str,
-        capability: &str,
-    ) -> Result<PrincipalRecord, String> {
-        if capability == "secrets:plaintext" {
-            return Err("plaintext secret access cannot be granted".into());
-        }
-        let mut records = self
-            .records
-            .write()
-            .map_err(|_| "principal store lock poisoned")?;
-        let index = records
-            .principals
-            .iter()
-            .position(|principal| principal.id == principal_id)
-            .ok_or("principal not found")?;
-        let application_id = records.principals[index].application_id.clone();
-        let tenant_id = Self::application_context(tenancy, &application_id)?;
-        if actor == principal_id
-            || !tenancy.authorize_application(
-                actor,
-                &tenant_id,
-                &application_id,
-                "applications:write",
-            )
-        {
-            return Err("forbidden".into());
-        }
-        if !records.principals[index]
-            .capabilities
-            .iter()
-            .any(|existing| existing == capability)
-        {
-            records.principals[index]
-                .capabilities
-                .push(capability.into());
-            records.principals[index].version += 1;
-        }
-        let principal = records.principals[index].clone();
-        Self::event(
-            &mut records,
-            "principal.capability_granted",
-            actor,
-            &principal,
-            Some(capability),
-            None,
-        );
-        self.persist(&records)?;
-        Ok(principal)
-    }
-    pub fn authorize(&self, principal_id: &str, application_id: &str, capability: &str) -> bool {
-        let mut records = match self.records.write() {
-            Ok(records) => records,
-            Err(_) => return false,
-        };
-        let Some(principal) = records
-            .principals
-            .iter()
-            .find(|principal| principal.id == principal_id)
-            .cloned()
-        else {
-            return false;
-        };
-        let active = matches!(
-            principal.status,
-            PrincipalStatus::Active | PrincipalStatus::Running
-        ) && principal.application_id == application_id;
-        let allowed = active
-            && capability != "secrets:plaintext"
-            && authorize(&AuthorizationRequest {
-                subject: &kind_subject(&principal),
-                tenant_id: "delegated",
-                application_id: Some(application_id),
-                capability,
-                direct_grants: &principal.capabilities,
-                memberships: &[],
-                roles: &[],
-            })
-            .allowed;
-        Self::event(
-            &mut records,
-            "principal.authorized",
-            principal_id,
-            &principal,
-            Some(capability),
-            Some(allowed),
-        );
-        let _ = self.persist(&records);
-        allowed
-    }
-    pub fn create_workload(
-        &self,
-        actor: &str,
-        tenancy: &TenancyStore,
-        agent_id: &str,
-    ) -> Result<PrincipalRecord, String> {
-        let mut records = self
-            .records
-            .write()
-            .map_err(|_| "principal store lock poisoned")?;
-        let agent = records
-            .principals
-            .iter()
-            .find(|principal| principal.id == agent_id && principal.kind == PrincipalKind::Agent)
-            .cloned()
-            .ok_or("agent not found")?;
-        let tenant_id = Self::application_context(tenancy, &agent.application_id)?;
-        if !tenancy.authorize_application(
-            actor,
-            &tenant_id,
-            &agent.application_id,
-            "workloads:execute",
-        ) && !tenancy.authorize_application(
-            actor,
-            &tenant_id,
-            &agent.application_id,
-            "applications:write",
-        ) {
-            return Err("forbidden".into());
-        }
-        let workload = PrincipalRecord {
-            id: id("workload"),
-            application_id: agent.application_id.clone(),
-            kind: PrincipalKind::Workload,
-            name: format!("{} execution", agent.name),
-            version: agent.version,
-            status: PrincipalStatus::Running,
-            created_by: actor.into(),
-            created_at: now(),
-            capabilities: agent.capabilities.clone(),
-            parent_id: Some(agent.id),
-            worker_id: None,
-            started_at: Some(now()),
-            completed_at: None,
-        };
-        records.principals.push(workload.clone());
-        Self::event(
-            &mut records,
-            "workload.created",
-            actor,
-            &workload,
-            None,
-            None,
-        );
-        self.persist(&records)?;
-        Ok(workload)
-    }
-    pub fn assign_worker(
-        &self,
-        actor: &str,
-        tenancy: &TenancyStore,
-        workload_id: &str,
-        worker_id: &str,
-    ) -> Result<(), String> {
-        let mut records = self
-            .records
-            .write()
-            .map_err(|_| "principal store lock poisoned")?;
-        let workload_index = records
-            .principals
-            .iter()
-            .position(|principal| {
-                principal.id == workload_id && principal.kind == PrincipalKind::Workload
-            })
-            .ok_or("workload not found")?;
-        let worker = records
-            .principals
-            .iter()
-            .find(|principal| principal.id == worker_id && principal.kind == PrincipalKind::Worker)
-            .cloned()
-            .ok_or("worker not found")?;
-        let app_id = records.principals[workload_index].application_id.clone();
-        if worker.application_id != app_id {
-            return Err("cross-application worker assignment denied".into());
-        }
-        let tenant_id = Self::application_context(tenancy, &app_id)?;
-        if !tenancy.authorize_application(actor, &tenant_id, &app_id, "applications:write") {
-            return Err("forbidden".into());
-        }
-        records.principals[workload_index].worker_id = Some(worker_id.into());
-        self.persist(&records)
-    }
-    pub fn worker_can_execute(&self, worker_id: &str, workload_id: &str) -> bool {
-        self.records
-            .read()
-            .map(|records| {
-                records.principals.iter().any(|principal| {
-                    principal.id == workload_id
-                        && principal.kind == PrincipalKind::Workload
-                        && principal.worker_id.as_deref() == Some(worker_id)
-                        && principal.status == PrincipalStatus::Running
-                })
-            })
-            .unwrap_or(false)
-    }
-    pub fn execution_snapshot(
-        &self,
-        worker_id: &str,
-        workload_id: &str,
-    ) -> Option<(String, String, Vec<String>)> {
-        self.records
-            .read()
-            .ok()?
-            .principals
-            .iter()
-            .find(|principal| {
-                principal.id == workload_id
-                    && principal.kind == PrincipalKind::Workload
-                    && principal.worker_id.as_deref() == Some(worker_id)
-                    && principal.status == PrincipalStatus::Running
-            })
-            .map(|workload| {
-                (
-                    workload.application_id.clone(),
-                    workload.id.clone(),
-                    workload.capabilities.clone(),
-                )
-            })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    fn stores() -> (TenancyStore, PrincipalStore, String, String) {
-        let suffix = id("test");
-        let tenancy =
-            TenancyStore::load(std::env::temp_dir().join(format!("{suffix}-tenancy.json")))
-                .unwrap();
-        let tenant = tenancy.create_tenant("owner", "Acme Principals").unwrap();
-        let app = tenancy
-            .create_application("owner", &tenant.id, "Operations")
-            .unwrap();
-        let principals =
-            PrincipalStore::load(std::env::temp_dir().join(format!("{suffix}-principals.json")))
-                .unwrap();
-        (tenancy, principals, tenant.id, app.id)
-    }
-    #[test]
-    fn agent_and_workload_are_scoped_without_escalation() {
-        let (tenancy, principals, _, app) = stores();
-        let agent = principals
-            .create("owner", &tenancy, &app, PrincipalKind::Agent, "Coordinator")
-            .unwrap();
-        principals
-            .grant("owner", &tenancy, &agent.id, "state:read")
-            .unwrap();
-        assert!(principals.authorize(&agent.id, &app, "state:read"));
-        assert!(!principals.authorize(&agent.id, &app, "state:write"));
-        assert!(!principals.authorize(&agent.id, "app_other", "state:read"));
-        assert!(principals
-            .grant(&agent.id, &tenancy, &agent.id, "state:write")
-            .is_err());
-        let workload = principals
-            .create_workload("owner", &tenancy, &agent.id)
-            .unwrap();
-        assert!(principals.authorize(&workload.id, &app, "state:read"));
-        assert!(!principals.authorize(&workload.id, &app, "state:write"));
-    }
-    #[test]
-    fn worker_only_executes_assigned_workload_and_secrets_remain_opaque() {
-        let (tenancy, principals, _, app) = stores();
-        let agent = principals
-            .create("owner", &tenancy, &app, PrincipalKind::Agent, "Agent")
-            .unwrap();
-        principals
-            .grant("owner", &tenancy, &agent.id, "connection:use")
-            .unwrap();
-        assert!(principals
-            .grant("owner", &tenancy, &agent.id, "secrets:plaintext")
-            .is_err());
-        let workload = principals
-            .create_workload("owner", &tenancy, &agent.id)
-            .unwrap();
-        let worker = principals
-            .create(
-                "owner",
-                &tenancy,
-                &app,
-                PrincipalKind::Worker,
-                "worker-east",
-            )
-            .unwrap();
-        assert!(!principals.worker_can_execute(&worker.id, &workload.id));
-        principals
-            .assign_worker("owner", &tenancy, &workload.id, &worker.id)
-            .unwrap();
-        assert!(principals.worker_can_execute(&worker.id, &workload.id));
-    }
-}

package/dist/create/server-source/crates/feltdb-server/src/tenancy.rs

@@ -656,6 +656,28 @@ impl TenancyStore {
             .find(|app| app.id == application_id)
             .map(|app| app.tenant_id.clone())
     }
+    /// Return all tenant scopes asserted by canonical tenancy application
+    /// records. Migration code uses the complete set so duplicate/conflicting
+    /// ownership cannot be hidden by a first-match lookup.
+    pub fn application_tenant_candidates(&self, application_id: &str) -> Vec<String> {
+        self.records
+            .read()
+            .map(|records| {
+                records
+                    .applications
+                    .iter()
+                    .filter(|application| application.id == application_id)
+                    .map(|application| application.tenant_id.clone())
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+    pub fn tenant_exists(&self, tenant_id: &str) -> bool {
+        self.records
+            .read()
+            .map(|records| records.tenants.iter().any(|tenant| tenant.id == tenant_id))
+            .unwrap_or(false)
+    }
     pub fn application_members_for(
         &self,
         actor: &str,