create-feltdb 0.11.8 → 0.11.9

package/dist/server-source/crates/feltdb/src/workload_diagnostics.rs

@@ -135,10 +135,18 @@ pub enum Phase {
     /// AuditWrite` is therefore routing plus decode plus encode, measured as a
     /// difference of two spans rather than asserted.
     HandlerBody,
+    /// Resolving a managed request's application contract: the revision, the
+    /// runtime inventory it is validated against, and the resolved runtime.
+    /// Every `/v1` request pays it, so it must not depend on unrelated state.
+    ContractResolution,
+    /// Cloning one state namespace's rows for a state-contract read or
+    /// transaction. Proportional to that application's stored rows, not to
+    /// other applications'.
+    NamespaceSnapshot,
 }
 
 impl Phase {
-    pub const ALL: [Phase; 25] = [
+    pub const ALL: [Phase; 27] = [
         Phase::StateLockWait,
         Phase::StateLockHold,
         Phase::IndexedQuery,
@@ -164,6 +172,8 @@ impl Phase {
         Phase::AuditGroupSync,
         Phase::AuditClose,
         Phase::HandlerBody,
+        Phase::ContractResolution,
+        Phase::NamespaceSnapshot,
     ];
 
     /// The stable name this phase is reported under.
@@ -194,6 +204,8 @@ impl Phase {
             Phase::AuditGroupSync => "audit_group_sync",
             Phase::AuditClose => "audit_close",
             Phase::HandlerBody => "handler_body",
+            Phase::ContractResolution => "contract_resolution",
+            Phase::NamespaceSnapshot => "namespace_snapshot",
         }
     }
 
@@ -210,9 +222,11 @@ impl Phase {
             // The predicate runs on both executions, so its parent is the lock
             // rather than either query phase.
             Phase::PredicateEvaluation => Some(Phase::StateLockHold),
-            Phase::Authorization | Phase::AuditWrite | Phase::HandlerBody => {
-                Some(Phase::HttpHandler)
-            }
+            Phase::Authorization
+            | Phase::AuditWrite
+            | Phase::HandlerBody
+            | Phase::ContractResolution
+            | Phase::NamespaceSnapshot => Some(Phase::HttpHandler),
             Phase::Ordering | Phase::ResultMaterialization => Some(Phase::HandlerBody),
             Phase::RecordMutation | Phase::IndexMaintenance | Phase::Persistence => {
                 Some(Phase::StateLockHold)

package/dist/server-source/crates/feltdb-server/src/main.rs

@@ -601,6 +601,14 @@ struct CanonicalTransactionRequest {
     environment: String,
     transaction: TransactionRequest,
 }
+#[derive(Deserialize)]
+struct CanonicalReadBasisRequest {
+    application_id: String,
+    revision_id: String,
+    #[serde(default = "production_environment")]
+    environment: String,
+    reads: feltdb::ReadSet,
+}
 fn production_environment() -> String {
     "production".into()
 }
@@ -1207,6 +1215,7 @@ async fn push_sync(
             ),
             operations: vec![operation.operation.clone()],
             preconditions: vec![],
+            fences: vec![],
         };
         let _transaction_permit = state
             .state_transaction_admission
@@ -4620,12 +4629,15 @@ fn runtime_inventory(
         .filter(|value| value.status == ConnectionStatus::Active)
         .map(|value| value.id)
         .collect();
-    let snapshot = state.db.export_snapshot()?;
+    // Every managed request resolves its contract through here, so this reads
+    // only the capability registry's own rows. A whole-database snapshot would
+    // clone, sort, and hash every tenant's state per request.
     let mut capabilities = BTreeSet::new();
-    for row in snapshot
-        .rows
+    for row in state
+        .db
+        .list_collection("_flow_capabilities")?
         .iter()
-        .filter(|row| row.capability == "_flow_capabilities" && !row.deleted)
+        .filter(|row| !row.deleted)
     {
         if let Some(name) = row.value.get("name").and_then(Value::as_str) {
             capabilities.insert(name.to_string());
@@ -4653,6 +4665,8 @@ fn revision_contract(
     revision_id: &str,
     environment: &str,
 ) -> Result<ApplicationRuntimeContract, ApiError> {
+    let _span =
+        feltdb::workload_diagnostics::span(feltdb::workload_diagnostics::Phase::ContractResolution);
     let tenant = application_scope(state, actor, application_id, "application:revision:read")?;
     let revision = state
         .applications
@@ -7209,6 +7223,7 @@ async fn run_runtime_action(
             if_version,
         }],
         preconditions: vec![],
+        fences: vec![],
     };
     let write_policy = contract
         .policies
@@ -7658,11 +7673,34 @@ async fn execute_canonical_query(
         &input.revision_id,
         &input.environment,
     )?;
+    let authorization = if feltdb::state_contract::is_substrate_collection(&input.query.collection)
+    {
+        let mut authorization = state_authorization_legacy(
+            &principal,
+            &tenant,
+            &input.application_id,
+            &contract.revision_id,
+            "state:denied",
+        );
+        if application_scope(
+            &state,
+            &principal.key_id,
+            &input.application_id,
+            "composition:read",
+        )
+        .is_ok()
+        {
+            authorization.capabilities.insert("composition:read".into());
+        }
+        authorization
+    } else {
+        state_authorization(&principal, &contract, &input.query.collection, "read")
+    };
     let context = feltdb::state_contract::begin_query_read(
         &state.db,
         &contract.state.schema,
         &contract.environment.state_namespace,
-        state_authorization(&principal, &contract, &input.query.collection, "read"),
+        authorization,
     )
     .map_err(state_contract_error)?;
 
@@ -7885,6 +7923,76 @@ async fn execute_revision_recovery(
     Ok(Json(response))
 }
 
+/// Whether `principal` may read every record of `collection` — the condition
+/// for a read basis, captured or committed, to cover it.
+///
+/// A token digests every row it covers, and a refused fence reveals that one
+/// of them changed. Both are reads, so both require the right to read the whole
+/// collection: `state:read` under a read policy that does not depend on the
+/// record (none, or `authenticated`), or `composition:read` for a substrate
+/// collection. Owner, member, and self policies filter rows per actor; a read
+/// basis over such a collection is refused rather than digested.
+fn read_basis_readable(
+    state: &AppState,
+    principal: &Principal,
+    contract: &ApplicationRuntimeContract,
+    collection: &str,
+) -> bool {
+    if feltdb::state_contract::is_substrate_collection(collection) {
+        return application_scope(
+            state,
+            &principal.key_id,
+            &contract.application_id,
+            "composition:read",
+        )
+        .is_ok();
+    }
+    if !state_authorization(principal, contract, collection, "read")
+        .capabilities
+        .contains("state:read")
+    {
+        return false;
+    }
+    matches!(
+        matching_state_policy(contract, collection)
+            .and_then(|policy| policy.read.as_deref())
+            .and_then(PolicySubject::from_str),
+        None | Some(PolicySubject::Authenticated)
+    )
+}
+
+/// Capture a read basis over the application's state namespace.
+async fn capture_canonical_read_basis(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    headers: HeaderMap,
+    Json(input): Json<CanonicalReadBasisRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "state:read",
+    )?;
+    require_bound_tenant(&headers, &tenant)?;
+    let contract = revision_contract(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        &input.revision_id,
+        &input.environment,
+    )?;
+    let basis = feltdb::state_contract::capture_read_basis(
+        &state.db,
+        &contract.state.schema,
+        &contract.environment.state_namespace,
+        &input.reads,
+        &|collection| read_basis_readable(&state, &principal, &contract, collection),
+    )
+    .map_err(state_contract_error)?;
+    Ok(Json(json!(basis)))
+}
+
 async fn execute_canonical_transaction(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
@@ -7921,14 +8029,49 @@ async fn execute_canonical_transaction(
     input.transaction.revision_id = contract.revision_id.clone();
     input.transaction.schema_version = contract.state.schema.schema_version;
     input.transaction.state_namespace = Some(contract.environment.state_namespace.clone());
-    let collections = input
+    let (substrate, collections): (Vec<String>, Vec<String>) = input
         .transaction
         .operations
         .iter()
         .map(|operation| operation.collection.clone())
-        .collect::<Vec<_>>();
-    let (authorized, write_policies) =
-        authorize_transaction_collections(&principal, &contract, &tenant, &collections);
+        .partition(|collection| feltdb::state_contract::is_substrate_collection(collection));
+    let (authorized, write_policies) = if collections.is_empty() && !substrate.is_empty() {
+        (tenant == contract.tenant_id, BTreeMap::new())
+    } else {
+        authorize_transaction_collections(&principal, &contract, &tenant, &collections)
+    };
+    // Substrate records are written only under the dedicated capability.
+    let substrate_authorized = substrate.is_empty()
+        || application_scope(
+            &state,
+            &principal.key_id,
+            &input.application_id,
+            "composition:write",
+        )
+        .is_ok();
+    // A fence is a read of everything it covers: the committer must be able to
+    // read all of it, exactly as capturing it required.
+    for fence in &input.transaction.fences {
+        for collection in fence
+            .reads
+            .records
+            .iter()
+            .map(|record| record.collection.as_str())
+            .chain(
+                fence
+                    .reads
+                    .predicates
+                    .iter()
+                    .map(|predicate| predicate.collection.as_str()),
+            )
+        {
+            if !read_basis_readable(&state, &principal, &contract, collection) {
+                return Err(state_contract_error(
+                    feltdb::state_contract::read_basis_denied(collection),
+                ));
+            }
+        }
+    }
     input.transaction.authorization = state_authorization_legacy(
         &principal,
         &tenant,
@@ -7940,6 +8083,13 @@ async fn execute_canonical_transaction(
             "state:denied"
         },
     );
+    if authorized && substrate_authorized && !substrate.is_empty() {
+        input
+            .transaction
+            .authorization
+            .capabilities
+            .insert("composition:write".into());
+    }
     let _transaction_permit = state
         .state_transaction_admission
         .acquire()
@@ -9036,6 +9186,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             "/v1/transactions",
             axum::routing::post(execute_canonical_transaction),
         )
+        .route(
+            "/v1/transactions/read-basis",
+            axum::routing::post(capture_canonical_read_basis),
+        )
         .route(
             "/v1/revision/recover",
             axum::routing::post(execute_revision_recovery),
@@ -9312,6 +9466,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             axum::routing::delete(delete_connection_control),
         )
         .route("/transactions", axum::routing::post(commit_transaction))
+        .route(
+            "/transactions/read-basis",
+            axum::routing::post(capture_read_basis),
+        )
         .route("/query", axum::routing::post(execute_bounded_query))
         .route("/revision", get(get_revision))
         .route(
@@ -9631,6 +9789,8 @@ async fn authenticate(
         || path == "/v1/state/conflicts"
         || path == "/v1/state/reconciliation/plan"
         || path == "/v1/experimental/semantic-decisions"
+        || path == "/transactions/read-basis"
+        || path == "/v1/transactions/read-basis"
     {
         // Describing state is reading it. These are POSTs because they take
         // three revision identities and a plan, not because they change
@@ -13873,6 +14033,28 @@ struct AtomicTxRequest {
     /// exactly as before.
     #[serde(default)]
     preconditions: Vec<AtomicTxPreconditionRequest>,
+    /// Read bases this authority issued (`POST /transactions/read-basis`),
+    /// re-evaluated inside the commit lock. Absent means no fence.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    fences: Vec<feltdb::ReadBasis>,
+}
+
+/// Capture a read basis: what the authority holds, now, for a set of records
+/// and equality predicates. Reading, so it requires `state:read`.
+async fn capture_read_basis(
+    State(state): State<AppState>,
+    Json(reads): Json<feltdb::ReadSet>,
+) -> Result<Json<feltdb::ReadBasis>, ApiError> {
+    state
+        .db
+        .read_basis(&reads)
+        .map(Json)
+        .map_err(|error| match error {
+            FlowError::CapabilityError(message) if message.starts_with("INVALID_READ_SET:") => {
+                ApiError(StatusCode::BAD_REQUEST, message)
+            }
+            other => ApiError(StatusCode::INTERNAL_SERVER_ERROR, other.to_string()),
+        })
 }
 
 #[derive(Serialize)]
@@ -13934,6 +14116,8 @@ async fn commit_transaction(
     let mut record_preconditions: Vec<RecordPrecondition> = Vec::new();
     let mut seen = std::collections::HashSet::new();
 
+    let fences = request.fences.clone();
+
     // Transaction-level preconditions first, on records the transaction need
     // not write at all.
     for condition in &request.preconditions {
@@ -14011,12 +14195,13 @@ async fn commit_transaction(
     let operations = mutations.len();
     let commit = state
         .db
-        .apply_atomic_transaction_guarded(
+        .apply_atomic_transaction_fenced(
             &request.transaction_id,
             Some(&payload_hash),
             None,
             &[],
             &record_preconditions,
+            &fences,
             &mutations,
             None,
         )
@@ -14036,6 +14221,9 @@ async fn commit_transaction(
                         "failure": *failure,
                     }),
                 ),
+                FlowError::CapabilityError(message) if message.starts_with("INVALID_READ_SET:") => {
+                    ApiError(StatusCode::BAD_REQUEST, message)
+                }
                 FlowError::CapabilityError(message)
                     if message.starts_with("TRANSACTION_ID_PAYLOAD_MISMATCH:") =>
                 {

package/package.json

@@ -2,7 +2,7 @@
   "name": "create-feltdb",
   "private": false,
   "description": "Create a new FeltDB application with one command",
-  "version": "0.11.8",
+  "version": "0.11.9",
   "license": "MIT",
   "bin": {
     "create-feltdb": "bin/create-feltdb.js"