create-feltdb 0.11.2 → 0.11.3

package/dist/server-source/crates/feltdb-server/src/main.rs

@@ -42,6 +42,7 @@ use feltdb::{
         Grant, GrantSigner, GrantStore, Subject as GrantSubject,
     },
     cardinality_endpoint::{CardinalityContext, CardinalityDiagnosticResponse},
+    execute_decision_transport,
     policy_evaluation::{
         Actor, AuthorizationState, PolicyContext, PolicyEvaluator, PolicySubject,
         RecordAuthorizationContext,
@@ -61,7 +62,8 @@ use feltdb::{
         WorkerRegistration,
     },
     workload::{CreateWorkload, WorkloadStore},
-    AtomicMutation, DatabaseSnapshot, FeltDb, FlowError, JsonCasResult, Operation,
+    AtomicMutation, DatabaseSnapshot, DecisionError, DecisionPrincipal,
+    DecisionTransportExecutionRequest, FeltDb, FlowError, JsonCasResult, Operation,
     PeerAdvertisement, PeerId, RecordPrecondition, StateRevision, StateTriggerStore, StoredRow,
 };
 use feltdb_server::{
@@ -77,8 +79,8 @@ use feltdb_server::{
         server_artifacts, verify_bundle,
     },
     causal::{
-        decode_cursor, decode_scoped_cursor, encode_cursor, encode_scoped_cursor, CausalEvent,
-        CanonicalEventAuthority,
+        decode_cursor, decode_scoped_cursor, encode_cursor, encode_scoped_cursor,
+        CanonicalEventAuthority, CausalEvent,
     },
     certification::default_report,
     clock::LeaseClock,
@@ -159,14 +161,13 @@ fn api_error_body(status: StatusCode, message: String) -> Value {
     // that code. Other forbidden details retain the non-disclosing canonical
     // `FORBIDDEN` wire contract.
     let explicit_code = object.get("code").and_then(Value::as_str);
-    let resolved_code = if status != StatusCode::FORBIDDEN
-        || explicit_code == Some("CURSOR_SCOPE_VIOLATION")
-    {
-        explicit_code.unwrap_or(code)
-    } else {
-        code
-    }
-    .to_string();
+    let resolved_code =
+        if status != StatusCode::FORBIDDEN || explicit_code == Some("CURSOR_SCOPE_VIOLATION") {
+            explicit_code.unwrap_or(code)
+        } else {
+            code
+        }
+        .to_string();
     object.insert("error".into(), json!(resolved_code));
     object.insert("code".into(), json!(resolved_code));
     object.entry("message").or_insert_with(|| {
@@ -643,6 +644,42 @@ fn grant_subject(principal: &Principal) -> GrantSubject {
         _ => GrantSubject::Service(id),
     }
 }
+
+fn decision_subject(principal: &Principal) -> GrantSubject {
+    let id = principal
+        .identity_id
+        .clone()
+        .unwrap_or_else(|| principal.key_id.clone());
+    match principal.subject_type.as_str() {
+        "human" | "user" => GrantSubject::Human(id),
+        "agent" => GrantSubject::Agent(id),
+        "workload" => GrantSubject::Workload(id),
+        "worker" => GrantSubject::Worker(id),
+        "connection" => GrantSubject::Connection(id),
+        _ => GrantSubject::Service(id),
+    }
+}
+
+fn bind_decision_authorization_principal(
+    principal: &Principal,
+    mut input: DecisionTransportExecutionRequest,
+) -> Result<DecisionTransportExecutionRequest, ApiError> {
+    if let Some(authorization) = input.authorization.as_mut() {
+        let requested = authorization.principal.as_ref().ok_or_else(|| {
+            semantic_decision_error(DecisionError::new(
+                "DECISION_INVALID_RESULT",
+                "authorization config requires a principal",
+            ))
+        })?;
+        authorization.principal = Some(DecisionPrincipal {
+            subject: decision_subject(principal),
+            tenant_id: requested.tenant_id.clone(),
+            application_id: requested.application_id.clone(),
+            capability: "state:read".into(),
+        });
+    }
+    Ok(input)
+}
 fn authorization_error(error: feltdb::authorization::AuthorizationError) -> ApiError {
     let status = if error.code == "GRANT_INVALID" {
         StatusCode::BAD_REQUEST
@@ -1477,7 +1514,12 @@ fn worker_error(error: feltdb::worker_mesh::WorkerMeshError) -> ApiError {
         serde_json::to_string(&error).unwrap_or(error.message),
     )
 }
-fn release_worker_claim_projection(state: &AppState, workload_id: &str, worker_id: &str, claim_id: &str) {
+fn release_worker_claim_projection(
+    state: &AppState,
+    workload_id: &str,
+    worker_id: &str,
+    claim_id: &str,
+) {
     match state.mesh.lock() {
         Ok(mut mesh) => {
             if let Err(error) = mesh.release_claim(worker_id, claim_id) {
@@ -1793,12 +1835,7 @@ async fn complete_workload(
             unix_seconds_i64(),
         )
         .map_err(workload_error)?;
-    release_worker_claim_projection(
-        &state,
-        &id,
-        &input.fence.worker_id,
-        &input.fence.claim_id,
-    );
+    release_worker_claim_projection(&state, &id, &input.fence.worker_id, &input.fence.claim_id);
     Ok(Json(json!(result)))
 }
 async fn fail_workload(
@@ -1822,12 +1859,7 @@ async fn fail_workload(
             unix_seconds_i64(),
         )
         .map_err(workload_error)?;
-    release_worker_claim_projection(
-        &state,
-        &id,
-        &input.fence.worker_id,
-        &input.fence.claim_id,
-    );
+    release_worker_claim_projection(&state, &id, &input.fence.worker_id, &input.fence.claim_id);
     Ok(Json(json!({"state":status})))
 }
 async fn confirm_workload_cancelled(
@@ -3230,25 +3262,33 @@ async fn causal_chain(
     State(state): State<AppState>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    Ok(Json(json!({"events":state.events.list(&id).map_err(control_error)?})))
+    Ok(Json(
+        json!({"events":state.events.list(&id).map_err(control_error)?}),
+    ))
 }
 async fn workload_timeline(
     State(state): State<AppState>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    Ok(Json(json!({"events":state.events.workload(&id).map_err(control_error)?})))
+    Ok(Json(
+        json!({"events":state.events.workload(&id).map_err(control_error)?}),
+    ))
 }
 async fn execution_timeline(
     State(state): State<AppState>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    Ok(Json(json!({"events":state.events.execution(&id).map_err(control_error)?})))
+    Ok(Json(
+        json!({"events":state.events.execution(&id).map_err(control_error)?}),
+    ))
 }
 async fn revision_timeline(
     State(state): State<AppState>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    Ok(Json(json!({"events":state.events.revision(&id).map_err(control_error)?})))
+    Ok(Json(
+        json!({"events":state.events.revision(&id).map_err(control_error)?}),
+    ))
 }
 async fn export_bundle(
     State(state): State<AppState>,
@@ -7579,13 +7619,21 @@ async fn get_state_version(
     ))
 }
 fn require_bound_tenant(headers: &HeaderMap, tenant: &str) -> Result<(), ApiError> {
-    let Some(bound) = headers.get("feltdb-tenant-id") else { return Ok(()); };
-    if bound.to_str().ok() == Some(tenant) { return Ok(()); }
-    Err(ApiError(StatusCode::FORBIDDEN, json!({
-        "code":"AUTHORITY_SCOPE_MISMATCH",
-        "message":"request tenant does not match the authenticated application authority",
-        "http_status":403
-    }).to_string()))
+    let Some(bound) = headers.get("feltdb-tenant-id") else {
+        return Ok(());
+    };
+    if bound.to_str().ok() == Some(tenant) {
+        return Ok(());
+    }
+    Err(ApiError(
+        StatusCode::FORBIDDEN,
+        json!({
+            "code":"AUTHORITY_SCOPE_MISMATCH",
+            "message":"request tenant does not match the authenticated application authority",
+            "http_status":403
+        })
+        .to_string(),
+    ))
 }
 
 async fn execute_canonical_query(
@@ -7643,6 +7691,49 @@ async fn execute_canonical_query(
     Ok(Json(json!(result)))
 }
 
+fn semantic_decision_error(error: feltdb::DecisionError) -> ApiError {
+    let status = match error.code.as_str() {
+        "DECISION_RECORD_NOT_FOUND" => StatusCode::NOT_FOUND,
+        "DECISION_STORAGE_ERROR" => StatusCode::SERVICE_UNAVAILABLE,
+        "DECISION_INVALID_RESULT"
+        | "DECISION_INVALID_OPTION"
+        | "DECISION_INVALID_DISTRIBUTION"
+        | "DECISION_CONTEXT_EMPTY" => StatusCode::UNPROCESSABLE_ENTITY,
+        _ => StatusCode::BAD_REQUEST,
+    };
+    ApiError::structured(
+        status,
+        json!({
+            "code": error.code,
+            "message": error.message,
+            "http_status": status.as_u16(),
+        }),
+    )
+}
+
+async fn execute_semantic_decision_transport(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Json(input): Json<DecisionTransportExecutionRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let input = bind_decision_authorization_principal(&principal, input)?;
+    let response =
+        execute_decision_transport(&state.db, &input).map_err(semantic_decision_error)?;
+    audit(
+        &state,
+        &principal.key_id,
+        "semantic_decision.execute",
+        &response.evaluation.provenance.cache_key,
+        if response.evaluation.cached {
+            "cache"
+        } else {
+            "runtime"
+        },
+        200,
+    );
+    Ok(Json(json!(response)))
+}
+
 #[derive(serde::Deserialize)]
 struct RevisionRecoveryRequest {
     #[serde(rename = "applicationId")]
@@ -7813,11 +7904,15 @@ async fn execute_canonical_transaction(
         &input.environment,
     )?;
     if !input.transaction.tenant_id.is_empty() && input.transaction.tenant_id != tenant {
-        return Err(ApiError(StatusCode::FORBIDDEN, json!({
-            "code":"AUTHORITY_SCOPE_MISMATCH",
-            "message":"transaction tenant does not match the bound authority",
-            "http_status":403
-        }).to_string()));
+        return Err(ApiError(
+            StatusCode::FORBIDDEN,
+            json!({
+                "code":"AUTHORITY_SCOPE_MISMATCH",
+                "message":"transaction tenant does not match the bound authority",
+                "http_status":403
+            })
+            .to_string(),
+        ));
     }
     input.transaction.tenant_id = tenant.clone();
     input.transaction.application_id = input.application_id.clone();
@@ -7983,12 +8078,18 @@ fn catchup_status(
     authority_position: HashMap<String, u64>,
     retained_from: HashMap<String, u64>,
 ) -> CatchupStatus {
-    let lag = authority_position.iter().map(|(origin, sequence)| {
-        sequence.saturating_sub(peer_position.get(origin).copied().unwrap_or(0))
-    }).sum();
+    let lag = authority_position
+        .iter()
+        .map(|(origin, sequence)| {
+            sequence.saturating_sub(peer_position.get(origin).copied().unwrap_or(0))
+        })
+        .sum();
     let recovery_required = authority_position.iter().any(|(origin, through)| {
         let position = peer_position.get(origin).copied().unwrap_or(0);
-        let floor = retained_from.get(origin).copied().unwrap_or(through.saturating_add(1));
+        let floor = retained_from
+            .get(origin)
+            .copied()
+            .unwrap_or(through.saturating_add(1));
         position < *through && position.saturating_add(1) < floor
     });
     let catchup_mode = if recovery_required {
@@ -8005,7 +8106,12 @@ fn catchup_status(
         authority_position,
         retained_from,
         lag,
-        recoverability: if recovery_required { "rebootstrap_required" } else { "recoverable" }.into(),
+        recoverability: if recovery_required {
+            "rebootstrap_required"
+        } else {
+            "recoverable"
+        }
+        .into(),
         catchup_mode: catchup_mode.into(),
         recovery_required,
     }
@@ -8487,7 +8593,8 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let provider_store = ProviderStore::load(config.data.with_extension("providers.json"))?;
     let readiness_probe = config.data.with_extension("readiness");
     let tenancy_store = TenancyStore::load(config.data.with_extension("platform.json"))?;
-    let application_store = ApplicationStore::load(config.data.with_extension("applications.json"))?;
+    let application_store =
+        ApplicationStore::load(config.data.with_extension("applications.json"))?;
     let principal_authority =
         feltdb_server::canonical_principals::CanonicalPrincipalAuthority::new(db.clone());
     let legacy_principals = config.data.with_extension("principals.json");
@@ -8835,7 +8942,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             get(control_plane_record_provenance),
         )
         .route("/v1/control-plane/agents", get(control_plane_agents))
-        .route("/v1/control-plane/agents/{agent_id}", get(control_plane_agent))
+        .route(
+            "/v1/control-plane/agents/{agent_id}",
+            get(control_plane_agent),
+        )
         .route("/v1/state/resources", get(state_resources))
         .route(
             "/v1/state/resources/{resource}/history",
@@ -8912,6 +9022,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         )
         .route("/v1/state/version", get(get_state_version))
         .route("/v1/query", axum::routing::post(execute_canonical_query))
+        .route(
+            "/v1/experimental/semantic-decisions",
+            axum::routing::post(execute_semantic_decision_transport),
+        )
         .route(
             "/v1/transactions",
             axum::routing::post(execute_canonical_transaction),
@@ -9510,6 +9624,7 @@ async fn authenticate(
     } else if path == "/v1/state/diff"
         || path == "/v1/state/conflicts"
         || path == "/v1/state/reconciliation/plan"
+        || path == "/v1/experimental/semantic-decisions"
     {
         // Describing state is reading it. These are POSTs because they take
         // three revision identities and a plan, not because they change
@@ -9647,8 +9762,7 @@ fn audit(
     // change that policy. What changed is that the failure is no longer
     // invisible — `AuditLog::record` has already counted it, timestamped it and
     // degraded the audit health state by the time this returns.
-    let _span =
-        feltdb::workload_diagnostics::span(feltdb::workload_diagnostics::Phase::AuditWrite);
+    let _span = feltdb::workload_diagnostics::span(feltdb::workload_diagnostics::Phase::AuditWrite);
     if let Err(error) = state.audit.record(AuditEvent {
         timestamp_ms: 0,
         namespace: &state.namespace,
@@ -10447,14 +10561,21 @@ async fn sync_pull(
     let peer_position = request.versions;
     let authority_position = state.db.operation_versions()?;
     let retained_from = state.db.retained_operation_floors()?;
-    let catchup = catchup_status(request.requester, peer_position.clone(), authority_position.clone(), retained_from);
+    let catchup = catchup_status(
+        request.requester,
+        peer_position.clone(),
+        authority_position.clone(),
+        retained_from,
+    );
     if catchup.recovery_required {
         return Err(ApiError::structured(
             StatusCode::CONFLICT,
-            serde_json::to_value(&catchup).unwrap_or_else(|_| json!({
-                "catchup_mode": "snapshot_rebootstrap_required",
-                "recovery_required": true
-            })),
+            serde_json::to_value(&catchup).unwrap_or_else(|_| {
+                json!({
+                    "catchup_mode": "snapshot_rebootstrap_required",
+                    "recovery_required": true
+                })
+            }),
         ));
     }
     let operations = state.db.operations_since(&peer_position)?;
@@ -12786,7 +12907,11 @@ fn declare_configured_equality_indexes(db: &FeltDb) -> Result<Vec<String>, Strin
         return Ok(Vec::new());
     };
     let mut declared = Vec::new();
-    for entry in declaration.split(',').map(str::trim).filter(|entry| !entry.is_empty()) {
+    for entry in declaration
+        .split(',')
+        .map(str::trim)
+        .filter(|entry| !entry.is_empty())
+    {
         let Some((collection, field)) = entry.split_once('.') else {
             return Err(format!(
                 "FELTDB_EQUALITY_INDEXES entry {entry:?} must be written as collection.field"
@@ -12880,11 +13005,12 @@ fn bounded_query_records(
 ) -> Result<Vec<feltdb::StoredRow>, ApiError> {
     if execution != BoundedQueryExecution::Scan {
         let equalities = bounded_query_equalities(&request.conditions);
-        let indexed = state.db.query_collection_by_equality(
-            &request.collection,
-            &equalities,
-            |row| bounded_query_matches(row, &request.conditions),
-        )?;
+        let indexed =
+            state
+                .db
+                .query_collection_by_equality(&request.collection, &equalities, |row| {
+                    bounded_query_matches(row, &request.conditions)
+                })?;
         if let Some(records) = indexed {
             return Ok(records);
         }
@@ -12897,15 +13023,18 @@ fn bounded_query_records(
             ));
         }
     }
-    Ok(state.db.query_collection(&request.collection, None, |row| {
-        bounded_query_matches(row, &request.conditions)
-    })?)
+    Ok(state
+        .db
+        .query_collection(&request.collection, None, |row| {
+            bounded_query_matches(row, &request.conditions)
+        })?)
 }
 
 fn issue_bounded_cursor(
     state: &AppState,
     mut cursor: BoundedQueryCursor,
-) -> Result<String, ApiError> {    let token = uuid::Uuid::new_v4().simple().to_string();
+) -> Result<String, ApiError> {
+    let token = uuid::Uuid::new_v4().simple().to_string();
     let now = unix_seconds_i64().max(0) as u64;
     cursor.created_at = now;
     let mut cursors = state.bounded_query_cursors.lock().map_err(|_| {
@@ -13356,9 +13485,10 @@ async fn commit_transaction(
     // mutations and retained across compaction.
     let payload_hash = format!(
         "sha256:{:x}",
-        Sha256::digest(serde_json::to_vec(&request).map_err(|error| {
-            ApiError(StatusCode::BAD_REQUEST, error.to_string())
-        })?)
+        Sha256::digest(
+            serde_json::to_vec(&request)
+                .map_err(|error| { ApiError(StatusCode::BAD_REQUEST, error.to_string()) })?
+        )
     );
 
     // Validate every operation before any of them is turned into a mutation, so
@@ -14276,7 +14406,9 @@ async fn control_plane_rebuild_index(
         "{}:{}",
         contract.environment.state_namespace, request.collection
     );
-    let created = state.db.create_equality_index(&capability, &request.field)?;
+    let created = state
+        .db
+        .create_equality_index(&capability, &request.field)?;
     Ok(Json(json!({
         "collection": request.collection,
         "field": request.field,
@@ -14324,10 +14456,9 @@ async fn control_plane_operations(
     let matched = operations
         .iter()
         .filter(|operation| {
-            query
-                .collection
-                .as_deref()
-                .is_none_or(|collection| control_plane::collection_of(&operation.capability) == collection)
+            query.collection.as_deref().is_none_or(|collection| {
+                control_plane::collection_of(&operation.capability) == collection
+            })
         })
         .filter(|operation| {
             query.kind.as_deref().is_none_or(|kind| {
@@ -14353,9 +14484,7 @@ async fn control_plane_operations(
 }
 
 /// Peers, causal position, and what replication still owes.
-async fn control_plane_replication(
-    State(state): State<AppState>,
-) -> Result<Json<Value>, ApiError> {
+async fn control_plane_replication(State(state): State<AppState>) -> Result<Json<Value>, ApiError> {
     let db = state.db.clone();
     let namespace = state.namespace.to_string();
     let scan_namespace = namespace.clone();
@@ -14408,8 +14537,7 @@ async fn control_plane_applications(
                 .iter()
                 .map(|(environment, revision_id)| {
                     let instance = instances.iter().find(|instance| {
-                        instance.environment == *environment
-                            && instance.revision_id == *revision_id
+                        instance.environment == *environment && instance.revision_id == *revision_id
                     });
                     json!({
                         "environment": environment,
@@ -14722,10 +14850,7 @@ async fn control_plane_record_provenance(
 /// Computed from the two things that actually decide it: the capabilities the
 /// principal holds, and the actions and policies the contract declares. Nothing
 /// is inferred from the agent's name or history.
-fn agent_access(
-    contract: &ApplicationRuntimeContract,
-    capabilities: &[String],
-) -> Vec<Value> {
+fn agent_access(contract: &ApplicationRuntimeContract, capabilities: &[String]) -> Vec<Value> {
     let holds = |required: &[String]| required.iter().all(|value| capabilities.contains(value));
     contract
         .state
@@ -15101,7 +15226,10 @@ async fn state_diff(
         object.insert("to".into(), control_plane::revision_summary_to_json(&to));
         object.insert(
             "relationship".into(),
-            json!(match (from.resource == to.resource, to.parent_id.as_ref() == Some(&from.id)) {
+            json!(match (
+                from.resource == to.resource,
+                to.parent_id.as_ref() == Some(&from.id)
+            ) {
                 (true, true) => "parent",
                 (true, false) => "same-resource",
                 (false, _) => "cross-resource",
@@ -15146,7 +15274,15 @@ async fn state_conflicts(
 fn control_plane_reconciliation_inputs(
     store: &feltdb::StateStore,
     request: &control_plane::ReconciliationPlanRequest,
-) -> Result<(StateRevision, StateRevision, StateRevision, feltdb::ReconciliationPlan), ApiError> {
+) -> Result<
+    (
+        StateRevision,
+        StateRevision,
+        StateRevision,
+        feltdb::ReconciliationPlan,
+    ),
+    ApiError,
+> {
     let plan = request.to_plan().map_err(|message| {
         control_plane_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_plan", message)
     })?;
@@ -15169,11 +15305,10 @@ async fn state_reconciliation_plan(
     let store = control_plane_state_store(&state)?;
     let (base, left, right, plan) = control_plane_reconciliation_inputs(&store, &request)?;
     let classification = feltdb::ConflictClassification::classify(&base, &left, &right);
-    let preview = feltdb::apply_reconciliation_plan(&base, &left, &right, &plan).map_err(
-        |message| {
+    let preview =
+        feltdb::apply_reconciliation_plan(&base, &left, &right, &plan).map_err(|message| {
             control_plane_error(StatusCode::UNPROCESSABLE_ENTITY, "plan_refused", message)
-        },
-    )?;
+        })?;
     let mut content = serde_json::from_str::<Value>(&preview).unwrap_or(Value::Null);
     redact_inspection_value(&mut content);
     Ok(Json(json!({
@@ -15221,11 +15356,7 @@ async fn state_reconciliation_execute(
             outcome.materialized_state.authority.clone(),
         )
         .map_err(|error| {
-            control_plane_error(
-                StatusCode::CONFLICT,
-                "revision_refused",
-                error.to_string(),
-            )
+            control_plane_error(StatusCode::CONFLICT, "revision_refused", error.to_string())
         })?;
     // The two must agree. They are computed by the same constructor from the
     // same content, parent and authority, so a disagreement means the store and
@@ -15359,7 +15490,10 @@ mod worker_identity_tests {
 
 #[cfg(test)]
 mod authority_gate_tests {
-    use super::{api_error_body, authorize_transaction_collections, require_bound_tenant, state_authorization};
+    use super::{
+        api_error_body, authorize_transaction_collections, require_bound_tenant,
+        state_authorization,
+    };
     use axum::http::{HeaderMap, HeaderValue, StatusCode};
     use feltdb::{
         application::{
@@ -15476,7 +15610,10 @@ mod authority_gate_tests {
         let error = require_bound_tenant(&headers, "tenant-b").unwrap_err();
         assert_eq!(error.0, StatusCode::FORBIDDEN);
         let body: serde_json::Value = serde_json::from_str(&error.1).unwrap();
-        assert_eq!(body.get("code").and_then(serde_json::Value::as_str), Some("AUTHORITY_SCOPE_MISMATCH"));
+        assert_eq!(
+            body.get("code").and_then(serde_json::Value::as_str),
+            Some("AUTHORITY_SCOPE_MISMATCH")
+        );
     }
 
     #[test]