create-feltdb 0.4.11 → 0.4.13

package/dist/server-source/crates/feltdb-server/src/auth.rs

@@ -0,0 +1,308 @@
+use std::{
+    fs,
+    path::{Path, PathBuf},
+    sync::{Arc, RwLock},
+};
+
+use argon2::{
+    password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
+    Argon2,
+};
+use rand::{distributions::Alphanumeric, Rng};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Deserialize)]
+struct LegacyApiKeyStore {
+    tokens: Vec<LegacyApiKeyRecord>,
+}
+
+#[derive(Debug, Deserialize)]
+struct LegacyApiKeyRecord {
+    id: String,
+    #[serde(default = "default_legacy_key_name")]
+    name: String,
+    secret: String,
+    namespace: String,
+    scopes: Vec<String>,
+}
+
+fn default_legacy_key_name() -> String {
+    "managed-instance".to_string()
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ApiKeyRecord {
+    pub id: String,
+    pub name: String,
+    pub hash: String,
+    pub scopes: Vec<String>,
+    pub namespaces: Vec<String>,
+    #[serde(default)]
+    pub revoked: bool,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ApiKeySummary {
+    pub id: String,
+    pub name: String,
+    pub scopes: Vec<String>,
+    pub namespaces: Vec<String>,
+    pub revoked: bool,
+}
+
+#[derive(Debug, Clone)]
+pub struct Principal {
+    pub key_id: String,
+    pub scopes: Vec<String>,
+    pub subject_type: String,
+    pub identity_id: Option<String>,
+    pub session_id: Option<String>,
+}
+
+impl Principal {
+    pub fn permits(&self, required: &str) -> bool {
+        self.scopes
+            .iter()
+            .any(|scope| scope == "*" || scope == required)
+    }
+}
+
+#[derive(Clone)]
+pub struct KeyStore {
+    path: PathBuf,
+    records: Arc<RwLock<Vec<ApiKeyRecord>>>,
+}
+
+impl KeyStore {
+    pub fn load(path: impl Into<PathBuf>) -> Result<Self, String> {
+        let path = path.into();
+        let (records, migrated) = if path.exists() {
+            let bytes = fs::read(&path).map_err(|error| error.to_string())?;
+            match serde_json::from_slice::<Vec<ApiKeyRecord>>(&bytes) {
+                Ok(records) => (records, false),
+                Err(current_error) => {
+                    let legacy: LegacyApiKeyStore = serde_json::from_slice(&bytes)
+                        .map_err(|_| format!("invalid API key store: {current_error}"))?;
+                    let mut records = Vec::with_capacity(legacy.tokens.len());
+                    for token in legacy.tokens {
+                        let salt = SaltString::generate(&mut OsRng);
+                        let hash = Argon2::default()
+                            .hash_password(token.secret.as_bytes(), &salt)
+                            .map_err(|error| error.to_string())?
+                            .to_string();
+                        records.push(ApiKeyRecord {
+                            id: token.id,
+                            name: token.name,
+                            hash,
+                            scopes: token.scopes,
+                            namespaces: vec![token.namespace],
+                            revoked: false,
+                        });
+                    }
+                    (records, true)
+                }
+            }
+        } else {
+            (Vec::new(), false)
+        };
+        let store = Self {
+            path,
+            records: Arc::new(RwLock::new(records)),
+        };
+        if migrated {
+            store.persist()?;
+        }
+        Ok(store)
+    }
+
+    pub fn authenticate(&self, token: &str, namespace: &str) -> Option<Principal> {
+        if !token.starts_with("fdb_live_") || token.len() > 256 {
+            return None;
+        }
+        let records = self.records.read().ok()?;
+        records
+            .iter()
+            .filter(|record| !record.revoked)
+            .find_map(|record| {
+                let namespace_allowed = record
+                    .namespaces
+                    .iter()
+                    .any(|allowed| allowed == "*" || allowed == namespace);
+                let parsed = PasswordHash::new(&record.hash).ok()?;
+                if namespace_allowed
+                    && Argon2::default()
+                        .verify_password(token.as_bytes(), &parsed)
+                        .is_ok()
+                {
+                    Some(Principal {
+                        key_id: record.id.clone(),
+                        scopes: record.scopes.clone(),
+                        subject_type: "service".into(),
+                        identity_id: None,
+                        session_id: None,
+                    })
+                } else {
+                    None
+                }
+            })
+    }
+
+    pub fn create(
+        &self,
+        name: String,
+        scopes: Vec<String>,
+        namespaces: Vec<String>,
+    ) -> Result<String, String> {
+        let secret: String = rand::thread_rng()
+            .sample_iter(&Alphanumeric)
+            .take(48)
+            .map(char::from)
+            .collect();
+        let token = format!("fdb_live_{secret}");
+        let salt = SaltString::generate(&mut OsRng);
+        let hash = Argon2::default()
+            .hash_password(token.as_bytes(), &salt)
+            .map_err(|error| error.to_string())?
+            .to_string();
+        let id: String = rand::thread_rng()
+            .sample_iter(&Alphanumeric)
+            .take(12)
+            .map(char::from)
+            .collect();
+        self.records
+            .write()
+            .map_err(|_| "API key store lock poisoned".to_string())?
+            .push(ApiKeyRecord {
+                id,
+                name,
+                hash,
+                scopes,
+                namespaces,
+                revoked: false,
+            });
+        self.persist()?;
+        Ok(token)
+    }
+
+    pub fn list(&self) -> Result<Vec<ApiKeySummary>, String> {
+        Ok(self
+            .records
+            .read()
+            .map_err(|_| "API key store lock poisoned".to_string())?
+            .iter()
+            .map(|record| ApiKeySummary {
+                id: record.id.clone(),
+                name: record.name.clone(),
+                scopes: record.scopes.clone(),
+                namespaces: record.namespaces.clone(),
+                revoked: record.revoked,
+            })
+            .collect())
+    }
+
+    pub fn revoke(&self, id: &str) -> Result<bool, String> {
+        let found = {
+            let mut records = self
+                .records
+                .write()
+                .map_err(|_| "API key store lock poisoned".to_string())?;
+            match records.iter_mut().find(|record| record.id == id) {
+                Some(record) => {
+                    record.revoked = true;
+                    true
+                }
+                None => false,
+            }
+        };
+        if found {
+            self.persist()?;
+        }
+        Ok(found)
+    }
+
+    fn persist(&self) -> Result<(), String> {
+        if let Some(parent) = self.path.parent() {
+            fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+        }
+        let temporary = self.path.with_extension("tmp");
+        let records = self
+            .records
+            .read()
+            .map_err(|_| "API key store lock poisoned".to_string())?;
+        let bytes = serde_json::to_vec_pretty(&*records).map_err(|error| error.to_string())?;
+        fs::write(&temporary, bytes).map_err(|error| error.to_string())?;
+        fs::rename(&temporary, &self.path).map_err(|error| error.to_string())?;
+        Ok(())
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    #[test]
+    fn keys_are_hashed_scoped_and_namespace_bound() {
+        let path = std::env::temp_dir().join(format!(
+            "feltdb-keys-{}.json",
+            SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let store = KeyStore::load(&path).unwrap();
+        let token = store
+            .create(
+                "test".to_string(),
+                vec!["state:read".to_string()],
+                vec!["alpha".to_string()],
+            )
+            .unwrap();
+
+        let file = fs::read_to_string(&path).unwrap();
+        assert!(!file.contains(&token));
+        assert!(store
+            .authenticate(&token, "alpha")
+            .unwrap()
+            .permits("state:read"));
+        assert!(store.authenticate(&token, "beta").is_none());
+        assert!(store.authenticate("fdb_live_wrong", "alpha").is_none());
+        let id = store.list().unwrap().pop().unwrap().id;
+        assert!(store.revoke(&id).unwrap());
+        assert!(store.authenticate(&token, "alpha").is_none());
+        assert!(!store.revoke("missing").unwrap());
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn legacy_managed_key_store_is_migrated() {
+        let path = std::env::temp_dir().join(format!(
+            "feltdb-legacy-keys-{}.json",
+            SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let token = "fdb_live_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV";
+        fs::write(
+            &path,
+            format!(
+                r#"{{"tokens":[{{"id":"default-token","secret":"{token}","namespace":"alpha","scopes":["state:read"],"created_at":"2026-01-01T00:00:00Z","expires_at":"2026-12-31T00:00:00Z"}}]}}"#
+            ),
+        )
+        .unwrap();
+
+        let store = KeyStore::load(&path).unwrap();
+        assert!(store.authenticate(token, "alpha").is_some());
+        assert!(store.authenticate(token, "beta").is_none());
+        let migrated = fs::read_to_string(&path).unwrap();
+        assert!(migrated.trim_start().starts_with('['));
+        assert!(!migrated.contains(token));
+        assert!(migrated.contains("managed-instance"));
+        let _ = fs::remove_file(path);
+    }
+}

package/dist/server-source/crates/feltdb-server/src/authorization.rs

@@ -0,0 +1,228 @@
+use serde::{Deserialize, Serialize};
+
+/// Every FeltDB surface resolves to one of these subjects before authorization.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", content = "id", rename_all = "snake_case")]
+pub enum Subject {
+    User(String),
+    Service(String),
+    Workload(String),
+    Agent(String),
+    Connection(String),
+    Worker(String),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Membership {
+    pub subject_id: String,
+    pub tenant_id: String,
+    pub application_id: Option<String>,
+    pub roles: Vec<String>,
+    #[serde(default)]
+    pub revoked: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RoleGrant {
+    pub role: String,
+    pub capabilities: Vec<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AuthorizationRequest<'a> {
+    pub subject: &'a Subject,
+    pub tenant_id: &'a str,
+    pub application_id: Option<&'a str>,
+    pub capability: &'a str,
+    /// Direct grants are used by machine credentials and narrowly delegated identities.
+    pub direct_grants: &'a [String],
+    pub memberships: &'a [Membership],
+    pub roles: &'a [RoleGrant],
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct AuthorizationDecision {
+    pub allowed: bool,
+    pub capability: String,
+    pub reason: &'static str,
+}
+
+impl Subject {
+    pub fn id(&self) -> &str {
+        match self {
+            Self::User(id)
+            | Self::Service(id)
+            | Self::Workload(id)
+            | Self::Agent(id)
+            | Self::Connection(id)
+            | Self::Worker(id) => id,
+        }
+    }
+
+    fn can_use_direct_grants(&self) -> bool {
+        !matches!(self, Self::User(_))
+    }
+}
+
+fn grants(capabilities: &[String], required: &str) -> bool {
+    capabilities
+        .iter()
+        .any(|grant| grant == "*" || grant == required)
+}
+
+/// Canonical FeltDB authorization decision.
+///
+/// Human users must pass tenant and application membership before role grants are
+/// evaluated. Non-human subjects use credentials or delegated capabilities that
+/// are already bound to a tenant/application by their authenticator.
+pub fn authorize(request: &AuthorizationRequest<'_>) -> AuthorizationDecision {
+    if request.subject.can_use_direct_grants() && grants(request.direct_grants, request.capability)
+    {
+        return AuthorizationDecision {
+            allowed: true,
+            capability: request.capability.into(),
+            reason: "direct capability grant",
+        };
+    }
+
+    let memberships: Vec<&Membership> = request
+        .memberships
+        .iter()
+        .filter(|membership| {
+            !membership.revoked
+                && membership.subject_id == request.subject.id()
+                && membership.tenant_id == request.tenant_id
+                && match (request.application_id, membership.application_id.as_deref()) {
+                    (Some(required), Some(allowed)) => required == allowed,
+                    (Some(_), None) => false,
+                    (None, None) => true,
+                    (None, Some(_)) => true,
+                }
+        })
+        .collect();
+
+    if memberships.is_empty() {
+        return AuthorizationDecision {
+            allowed: false,
+            capability: request.capability.into(),
+            reason: "no active membership for resource scope",
+        };
+    }
+
+    let allowed = memberships
+        .iter()
+        .flat_map(|membership| membership.roles.iter())
+        .any(|role| {
+            request
+                .roles
+                .iter()
+                .any(|grant| grant.role == *role && grants(&grant.capabilities, request.capability))
+        });
+    AuthorizationDecision {
+        allowed,
+        capability: request.capability.into(),
+        reason: if allowed {
+            "role grants capability"
+        } else {
+            "capability not granted"
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn roles() -> Vec<RoleGrant> {
+        vec![RoleGrant {
+            role: "operator".into(),
+            capabilities: vec!["state:read".into(), "workflows:run".into()],
+        }]
+    }
+
+    #[test]
+    fn user_requires_matching_application_membership_and_role() {
+        let subject = Subject::User("user_1".into());
+        let memberships = vec![Membership {
+            subject_id: "user_1".into(),
+            tenant_id: "tenant_a".into(),
+            application_id: Some("app_a".into()),
+            roles: vec!["operator".into()],
+            revoked: false,
+        }];
+        let role_grants = roles();
+        let allowed = authorize(&AuthorizationRequest {
+            subject: &subject,
+            tenant_id: "tenant_a",
+            application_id: Some("app_a"),
+            capability: "state:read",
+            direct_grants: &[],
+            memberships: &memberships,
+            roles: &role_grants,
+        });
+        assert!(allowed.allowed);
+        let cross_app = authorize(&AuthorizationRequest {
+            subject: &subject,
+            tenant_id: "tenant_a",
+            application_id: Some("app_b"),
+            capability: "state:read",
+            direct_grants: &[],
+            memberships: &memberships,
+            roles: &role_grants,
+        });
+        assert!(!cross_app.allowed);
+    }
+
+    #[test]
+    fn role_does_not_grant_unlisted_capability() {
+        let subject = Subject::User("user_1".into());
+        let memberships = vec![Membership {
+            subject_id: "user_1".into(),
+            tenant_id: "tenant_a".into(),
+            application_id: Some("app_a".into()),
+            roles: vec!["operator".into()],
+            revoked: false,
+        }];
+        let role_grants = roles();
+        let decision = authorize(&AuthorizationRequest {
+            subject: &subject,
+            tenant_id: "tenant_a",
+            application_id: Some("app_a"),
+            capability: "members:write",
+            direct_grants: &[],
+            memberships: &memberships,
+            roles: &role_grants,
+        });
+        assert!(!decision.allowed);
+    }
+
+    #[test]
+    fn machine_identity_uses_scoped_direct_grants() {
+        let subject = Subject::Workload("workload_7".into());
+        let grants = vec!["state:read".into()];
+        assert!(
+            authorize(&AuthorizationRequest {
+                subject: &subject,
+                tenant_id: "tenant_a",
+                application_id: Some("app_a"),
+                capability: "state:read",
+                direct_grants: &grants,
+                memberships: &[],
+                roles: &[]
+            })
+            .allowed
+        );
+        assert!(
+            !authorize(&AuthorizationRequest {
+                subject: &subject,
+                tenant_id: "tenant_a",
+                application_id: Some("app_a"),
+                capability: "state:write",
+                direct_grants: &grants,
+                memberships: &[],
+                roles: &[]
+            })
+            .allowed
+        );
+    }
+}