create-feltdb 0.5.0 → 0.5.1

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.5.0';
+export const FELTDB_PACKAGE_VERSION = '0.5.1';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/crates/feltdb/src/application.rs

@@ -959,6 +959,18 @@ pub struct RevisionAuditEvent {
     pub diff_hash: Option<String>,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct RevisionRecovery {
+    pub recovery_id: String,
+    pub application_id: String,
+    pub environment: String,
+    pub source_revision: String,
+    pub target_revision: String,
+    pub approved_by: String,
+    pub reason: String,
+    pub authorization_level: String,
+    pub recovered_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "SCREAMING_SNAKE_CASE")]
 pub enum ChangeSafety {
     Safe,
@@ -1099,6 +1111,10 @@ struct RevisionRecords {
     previews: Vec<ApplicationPreview>,
     environment_pointers: BTreeMap<String, BTreeMap<String, String>>,
     audit: Vec<RevisionAuditEvent>,
+    #[serde(default)]
+    untrusted_revisions: BTreeMap<String, BTreeMap<String, String>>,
+    #[serde(default)]
+    recoveries: Vec<RevisionRecovery>,
 }
 #[derive(Clone)]
 pub struct ApplicationStore {
@@ -1462,6 +1478,15 @@ impl ApplicationStore {
             })
             .ok_or("revision not found")?
             .clone();
+        if r.untrusted_revisions
+            .get(app)
+            .is_some_and(|values| values.contains_key(&revision.revision_id))
+        {
+            return Err("revision is permanently untrusted".into());
+        }
+        if manifest_hash(&revision.manifest)? != revision.manifest_hash {
+            return Err("revision integrity check failed".into());
+        }
         if !revision
             .manifest
             .environments
@@ -1536,6 +1561,108 @@ impl ApplicationStore {
         Ok(promotion)
     }
 
+    #[allow(clippy::too_many_arguments)]
+    pub fn recover_environment_pointer(
+        &self,
+        tenant: &str,
+        app: &str,
+        environment: &str,
+        expected_current_revision: &str,
+        target_revision: &str,
+        actor: &str,
+        reason: &str,
+        authorization_level: &str,
+        recovery_id: &str,
+    ) -> Result<RevisionRecovery, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "application store lock poisoned")?;
+        if let Some(existing) = records
+            .recoveries
+            .iter()
+            .find(|value| value.recovery_id == recovery_id)
+        {
+            if existing.application_id == app
+                && existing.environment == environment
+                && existing.source_revision == expected_current_revision
+                && existing.target_revision == target_revision
+            {
+                return Ok(existing.clone());
+            }
+            return Err("recovery_id_conflict".into());
+        }
+        let current = records
+            .environment_pointers
+            .get(app)
+            .and_then(|values| values.get(environment))
+            .cloned()
+            .unwrap_or_default();
+        if current != expected_current_revision {
+            return Err(format!("expected_revision_mismatch:{current}"));
+        }
+        let target = records
+            .revisions
+            .iter()
+            .find(|value| {
+                value.tenant_id == tenant
+                    && value.application_id == app
+                    && (value.revision_id == target_revision
+                        || value.revision_number.to_string() == target_revision)
+            })
+            .ok_or("target revision not found")?
+            .clone();
+        if manifest_hash(&target.manifest)? != target.manifest_hash {
+            return Err("target revision integrity check failed".into());
+        }
+        if records
+            .untrusted_revisions
+            .get(app)
+            .is_some_and(|values| values.contains_key(&target.revision_id))
+        {
+            return Err("target revision is permanently untrusted".into());
+        }
+        let recovery = RevisionRecovery {
+            recovery_id: recovery_id.into(),
+            application_id: app.into(),
+            environment: environment.into(),
+            source_revision: expected_current_revision.into(),
+            target_revision: target.revision_id.clone(),
+            approved_by: actor.into(),
+            reason: reason.into(),
+            authorization_level: authorization_level.into(),
+            recovered_at: now(),
+        };
+        records
+            .untrusted_revisions
+            .entry(app.into())
+            .or_default()
+            .insert(expected_current_revision.into(), recovery_id.into());
+        records
+            .environment_pointers
+            .entry(app.into())
+            .or_default()
+            .insert(environment.into(), target.revision_id.clone());
+        records.recoveries.push(recovery.clone());
+        Self::event(
+            &mut records,
+            "application.revision.recovered",
+            tenant,
+            app,
+            actor,
+            Some(&target),
+            Some(expected_current_revision.into()),
+        );
+        if let Some(event) = records.audit.last_mut() {
+            event.environment = Some(environment.into());
+            event.from_revision = Some(expected_current_revision.into());
+            event.to_revision = Some(target.revision_id);
+            event.correlation_id = recovery_id.into();
+        }
+        self.persist(&records)?;
+        Ok(recovery)
+    }
+
     pub fn history(&self, tenant: &str, app: &str, environment: &str) -> Vec<RevisionPromotion> {
         self.records
             .read()
@@ -2148,6 +2275,41 @@ mod tests {
         assert_eq!(s.pointers("a")["production"], r2.revision_id);
         assert_eq!(s.history("t", "a", "production").len(), 2);
     }
+
+    #[test]
+    fn recovery_is_atomic_idempotent_durable_and_permanently_untrusts_source() {
+        let s = store("revision-recovery");
+        let d = s.create_draft("t", "a", "App", "owner", None).unwrap();
+        let corrupt = s.commit("t", "a", &d.draft_id, "owner").unwrap();
+        s.move_environment_pointer("t", "a", &corrupt.revision_id, "staging", None,
+            "owner", "initial", true, false).unwrap();
+        let d = s.create_draft("t", "a", "App", "owner", Some(&corrupt.revision_id)).unwrap();
+        let clean = s.commit("t", "a", &d.draft_id, "owner").unwrap();
+
+        // Historical source corruption must not prevent recovery away from it.
+        {
+            let mut records = s.records.write().unwrap();
+            records.revisions.iter_mut().find(|value| value.revision_id == corrupt.revision_id)
+                .unwrap().manifest.metadata.name = "corrupted without updating its integrity hash".into();
+            s.persist(&records).unwrap();
+        }
+        let recovered = s.recover_environment_pointer("t", "a", "staging", &corrupt.revision_id,
+            &clean.revision_id, "sherpa", "Replace corrupt historical revision", "ELEVATED",
+            "recovery-1").unwrap();
+        assert_eq!(recovered.target_revision, clean.revision_id);
+        assert_eq!(s.recover_environment_pointer("t", "a", "staging", &corrupt.revision_id,
+            &clean.revision_id, "sherpa", "Replace corrupt historical revision", "ELEVATED",
+            "recovery-1").unwrap(), recovered);
+        assert!(s.move_environment_pointer("t", "a", &corrupt.revision_id, "staging",
+            Some(&clean.revision_id), "owner", "rollback", true, true).unwrap_err()
+            .contains("untrusted"));
+
+        let reloaded = ApplicationStore::load(s.path.clone()).unwrap();
+        assert_eq!(reloaded.pointers("a")["staging"], clean.revision_id);
+        let records = reloaded.records.read().unwrap();
+        assert_eq!(records.recoveries.len(), 1);
+        assert!(records.untrusted_revisions["a"].contains_key(&corrupt.revision_id));
+    }
     #[test]
     fn preview_remains_bound_when_production_moves() {
         let s = store("preview-bound");
@@ -2280,7 +2442,11 @@ mod tests {
         });
 
         let report = validate_manifest(&manifest, "tenant", "app", None);
-        assert!(report.valid, "Policy with authenticated subject should be valid: {:?}", report.issues);
+        assert!(
+            report.valid,
+            "Policy with authenticated subject should be valid: {:?}",
+            report.issues
+        );
     }
 
     #[test]
@@ -2295,7 +2461,11 @@ mod tests {
         });
 
         let report = validate_manifest(&manifest, "tenant", "app", None);
-        assert!(report.valid, "Policy with owner subject should be valid: {:?}", report.issues);
+        assert!(
+            report.valid,
+            "Policy with owner subject should be valid: {:?}",
+            report.issues
+        );
     }
 
     #[test]
@@ -2310,12 +2480,14 @@ mod tests {
         });
 
         let report = validate_manifest(&manifest, "tenant", "app", None);
-        assert!(!report.valid, "Policy with unknown subject should be invalid");
         assert!(
-            report.issues.iter().any(|i|
-                i.path.contains("BadPolicy") && i.path.contains("read") &&
-                i.message.contains("invalid policy subject")
-            ),
+            !report.valid,
+            "Policy with unknown subject should be invalid"
+        );
+        assert!(
+            report.issues.iter().any(|i| i.path.contains("BadPolicy")
+                && i.path.contains("read")
+                && i.message.contains("invalid policy subject")),
             "Should have error about invalid policy subject"
         );
     }
@@ -2332,6 +2504,9 @@ mod tests {
         });
 
         let report = validate_manifest(&manifest, "tenant", "app", None);
-        assert!(report.valid, "Policy without subjects should be valid (backward compatible)");
+        assert!(
+            report.valid,
+            "Policy without subjects should be valid (backward compatible)"
+        );
     }
 }

package/dist/server-source/crates/feltdb-server/src/main.rs

@@ -40,8 +40,8 @@ use feltdb::{
         authorize as authorize_resource, AuthorizationRequest as ResourceAuthorizationRequest,
         Grant, GrantSigner, GrantStore, Subject as GrantSubject,
     },
-    policy_evaluation::{Actor, PolicyContext, PolicyEvaluator, PolicySubject},
     cardinality_endpoint::{CardinalityContext, CardinalityDiagnosticResponse},
+    policy_evaluation::{Actor, PolicyContext, PolicyEvaluator, PolicySubject},
     state_contract::{
         begin_read, compare_schemas, execute_query as execute_state_query, execute_transaction,
         schema_from_revision, validate_schema, AuthorizationContext, CanonicalQuery, QueryFilter,
@@ -76,7 +76,7 @@ use feltdb_server::{
     connections::{ConnectionProvider, ConnectionStatus, ConnectionStore, SecretReference},
     content::ContentStore,
     identity::IdentityStore,
-    key_management::{list_keys, create_key, revoke_key},
+    key_management::{create_key, list_keys, revoke_key},
     key_provider::provider_from_environment,
     leases::LeaseStore,
     metrics::Metrics,
@@ -103,7 +103,9 @@ struct ApiError(StatusCode, String);
 
 impl IntoResponse for ApiError {
     fn into_response(self) -> Response {
-        (self.0, Json(json!({ "error": self.1 }))).into_response()
+        let body =
+            serde_json::from_str::<Value>(&self.1).unwrap_or_else(|_| json!({ "error": self.1 }));
+        (self.0, Json(body)).into_response()
     }
 }
 
@@ -2027,9 +2029,10 @@ fn is_platform_owner(principal: &Principal) -> bool {
         .any(|owner| !owner.is_empty() && owner == identity)
 }
 fn require_platform_owner(principal: &Principal) -> Result<(), ApiError> {
-    is_platform_owner(principal)
-        .then_some(())
-        .ok_or(ApiError(StatusCode::FORBIDDEN, "platform owner access required".into()))
+    is_platform_owner(principal).then_some(()).ok_or(ApiError(
+        StatusCode::FORBIDDEN,
+        "platform owner access required".into(),
+    ))
 }
 async fn platform_access(Extension(principal): Extension<Principal>) -> Json<Value> {
     let platform_role = is_platform_owner(&principal).then_some("super_owner");
@@ -2365,7 +2368,11 @@ async fn evaluate_application_contract(
 ) -> Result<Json<Value>, ApiError> {
     Ok(Json(json!(state
         .contracts
-        .evaluate(&user_contract_key(&principal, &id), &input.outcome, &principal.key_id)
+        .evaluate(
+            &user_contract_key(&principal, &id),
+            &input.outcome,
+            &principal.key_id
+        )
         .map_err(control_error)?)))
 }
 async fn patch_application_contract(
@@ -2384,7 +2391,10 @@ async fn application_contract_gaps(
     Extension(principal): Extension<Principal>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    let c = state.contracts.get(&user_contract_key(&principal, &id)).map_err(control_error)?;
+    let c = state
+        .contracts
+        .get(&user_contract_key(&principal, &id))
+        .map_err(control_error)?;
     Ok(Json(json!({"gaps":c.gaps})))
 }
 async fn application_contract_readiness(
@@ -4495,12 +4505,7 @@ async fn run_runtime_action(
         schema_version: contract.state.schema.schema_version,
         state_namespace: Some(contract.environment.state_namespace.clone()),
         causal_parent: None,
-        authorization: state_authorization(
-            &principal,
-            &contract,
-            &definition.collection,
-            "write",
-        ),
+        authorization: state_authorization(&principal, &contract, &definition.collection, "write"),
         operations: vec![TransactionOperation {
             kind,
             collection: definition.collection.clone(),
@@ -4603,12 +4608,7 @@ async fn run_runtime_query(
         &state.db,
         &contract.state.schema,
         &contract.environment.state_namespace,
-        state_authorization(
-            &principal,
-            &contract,
-            &definition.collection,
-            "read",
-        ),
+        state_authorization(&principal, &contract, &definition.collection, "read"),
     )
     .map_err(state_contract_error)?;
 
@@ -4712,7 +4712,7 @@ fn state_authorization(
     principal: &Principal,
     contract: &ApplicationRuntimeContract,
     collection: &str,
-    operation: &str,  // "read" or "write"
+    operation: &str, // "read" or "write"
 ) -> AuthorizationContext {
     let subject = format!("{}:{}", principal.subject_type, principal.key_id);
 
@@ -4888,12 +4888,7 @@ async fn execute_canonical_query(
         &state.db,
         &contract.state.schema,
         &contract.environment.state_namespace,
-        state_authorization(
-            &principal,
-            &contract,
-            &input.query.collection,
-            "read",
-        ),
+        state_authorization(&principal, &contract, &input.query.collection, "read"),
     )
     .map_err(state_contract_error)?;
 
@@ -4905,8 +4900,14 @@ async fn execute_canonical_query(
         .find(|p| p.resource == input.query.collection)
         .and_then(|p| p.read.as_ref().and_then(|s| PolicySubject::from_str(s)));
 
-    let result = execute_state_query(&state.db, &contract.state.schema, &context, &input.query, read_policy)
-        .map_err(state_contract_error)?;
+    let result = execute_state_query(
+        &state.db,
+        &contract.state.schema,
+        &context,
+        &input.query,
+        read_policy,
+    )
+    .map_err(state_contract_error)?;
     audit(
         &state,
         &principal.key_id,
@@ -4917,6 +4918,156 @@ async fn execute_canonical_query(
     );
     Ok(Json(json!(result)))
 }
+
+#[derive(serde::Deserialize)]
+struct RevisionRecoveryRequest {
+    #[serde(rename = "applicationId")]
+    application_id: String,
+    #[serde(rename = "targetRevision")]
+    target_revision: String,
+    #[serde(rename = "expectedCurrentRevision")]
+    expected_current_revision: String,
+    authorization: String,
+    actor: String,
+    reason: String,
+    #[serde(default)]
+    environment: Option<String>,
+    #[serde(default)]
+    #[serde(rename = "recoveryId")]
+    recovery_id: Option<String>,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+struct RevisionRecoveryResponse {
+    success: bool,
+    #[serde(rename = "pointerMoved")]
+    pointer_moved: bool,
+    #[serde(rename = "sourceMarkedUntrusted")]
+    source_marked_untrusted: bool,
+    #[serde(rename = "auditDurable")]
+    audit_durable: bool,
+    #[serde(rename = "recoveryId")]
+    recovery_id: String,
+    #[serde(rename = "targetRevision")]
+    target_revision: String,
+    #[serde(rename = "currentRevision")]
+    current_revision: String,
+    audit: serde_json::Value,
+}
+
+fn revision_recovery_error(
+    status: StatusCode,
+    code: &str,
+    message: String,
+    request_id: &str,
+    transaction_id: &str,
+) -> ApiError {
+    ApiError(
+        status,
+        json!({"code":code,"message":message,"request_id":request_id,
+        "transaction_id":transaction_id,"http_status":status.as_u16()})
+        .to_string(),
+    )
+}
+
+async fn execute_revision_recovery(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Json(input): Json<RevisionRecoveryRequest>,
+) -> Result<Json<RevisionRecoveryResponse>, ApiError> {
+    let request_id = uuid::Uuid::new_v4().to_string();
+    let transaction_id = input
+        .recovery_id
+        .clone()
+        .unwrap_or_else(|| uuid::Uuid::new_v4().to_string());
+
+    // Validate authorization level
+    let auth_level = input.authorization.as_str();
+
+    if !["ELEVATED", "ADMIN", "EMERGENCY"].contains(&auth_level) {
+        return Err(revision_recovery_error(
+            StatusCode::FORBIDDEN,
+            "PERMISSION_DENIED",
+            "Recovery requires ELEVATED, ADMIN, or EMERGENCY authorization".into(),
+            &request_id,
+            &transaction_id,
+        ));
+    }
+
+    // Validate input
+    if input.reason.len() < 10 {
+        return Err(revision_recovery_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "PRECONDITION_FAILED",
+            "Recovery reason must be at least 10 characters".into(),
+            &request_id,
+            &transaction_id,
+        ));
+    }
+
+    let recovery_id = transaction_id.clone();
+    let environment = input
+        .environment
+        .unwrap_or_else(|| "production".to_string());
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:revision:promote",
+    )?;
+    let recovery = state
+        .applications
+        .recover_environment_pointer(
+            &tenant,
+            &input.application_id,
+            &environment,
+            &input.expected_current_revision,
+            &input.target_revision,
+            &input.actor,
+            &input.reason,
+            auth_level,
+            &recovery_id,
+        )
+        .map_err(|message| {
+            let (status, code) = if message.starts_with("expected_revision_mismatch")
+                || message == "recovery_id_conflict"
+            {
+                (StatusCode::CONFLICT, "CONFLICT")
+            } else if message.contains("not found") {
+                (StatusCode::NOT_FOUND, "PRECONDITION_FAILED")
+            } else if message.contains("integrity") || message.contains("untrusted") {
+                (StatusCode::UNPROCESSABLE_ENTITY, "VALIDATION_FAILED")
+            } else {
+                (StatusCode::SERVICE_UNAVAILABLE, "STORAGE_FAILURE")
+            };
+            revision_recovery_error(status, code, message, &request_id, &transaction_id)
+        })?;
+
+    // Build response
+    let response = RevisionRecoveryResponse {
+        success: true,
+        pointer_moved: true,
+        source_marked_untrusted: true,
+        audit_durable: true,
+        recovery_id: recovery_id.clone(),
+        target_revision: recovery.target_revision.clone(),
+        current_revision: recovery.target_revision.clone(),
+        audit: json!(recovery),
+    };
+
+    // Audit log
+    audit(
+        &state,
+        &principal.key_id,
+        "revision.recover",
+        &recovery_id,
+        "allowed",
+        200,
+    );
+
+    Ok(Json(response))
+}
+
 async fn execute_canonical_transaction(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
@@ -4942,24 +5093,27 @@ async fn execute_canonical_transaction(
     input.transaction.state_namespace = Some(contract.environment.state_namespace.clone());
     // For transactions with operations, use the first operation's collection for policy evaluation
     // Multi-collection transactions will still be checked at the operation level in execute_transaction
-    let collection = input.transaction.operations
+    let collection = input
+        .transaction
+        .operations
         .first()
         .map(|op| op.collection.clone())
         .unwrap_or_default();
-    input.transaction.authorization = state_authorization(
-        &principal,
-        &contract,
-        &collection,
-        "write",
-    );
+    input.transaction.authorization =
+        state_authorization(&principal, &contract, &collection, "write");
     let write_policy = contract
         .policies
         .definitions
         .iter()
         .find(|p| p.resource == collection)
         .and_then(|p| p.write.as_ref().and_then(|s| PolicySubject::from_str(s)));
-    let result = execute_transaction(&state.db, &contract.state.schema, &input.transaction, write_policy)
-        .map_err(state_contract_error)?;
+    let result = execute_transaction(
+        &state.db,
+        &contract.state.schema,
+        &input.transaction,
+        write_policy,
+    )
+    .map_err(state_contract_error)?;
     audit(
         &state,
         &principal.key_id,
@@ -4975,13 +5129,19 @@ async fn get_cardinality_diagnostic(
     State(state): State<AppState>,
     Path(pattern): Path<String>,
 ) -> Result<Json<CardinalityDiagnosticResponse>, ApiError> {
-    let all_cardinalities = state.db.list_cardinalities()
+    let all_cardinalities = state
+        .db
+        .list_cardinalities()
         .map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
-    let actual_rows = state.db.diagnostic_row_count(&pattern)
+    let actual_rows = state
+        .db
+        .diagnostic_row_count(&pattern)
         .map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
-    let persisted_capability_keys = state.db.diagnostic_capability_keys(&pattern)
+    let persisted_capability_keys = state
+        .db
+        .diagnostic_capability_keys(&pattern)
         .map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
     let matching_keys: Vec<_> = all_cardinalities
@@ -4992,10 +5152,7 @@ async fn get_cardinality_diagnostic(
 
     let cardinality_map_keys: Vec<String> = matching_keys.iter().map(|(k, _)| k.clone()).collect();
 
-    let maintained = matching_keys
-        .iter()
-        .map(|(_, v)| v)
-        .sum::<u64>();
+    let maintained = matching_keys.iter().map(|(_, v)| v).sum::<u64>();
 
     let now_ms = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
@@ -5752,6 +5909,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             "/v1/transactions",
             axum::routing::post(execute_canonical_transaction),
         )
+        .route(
+            "/v1/revision/recover",
+            axum::routing::post(execute_revision_recovery),
+        )
         .route(
             "/debug/cardinality/{pattern}",
             get(get_cardinality_diagnostic),

package/package.json

@@ -2,7 +2,7 @@
   "name": "create-feltdb",
   "private": false,
   "description": "Create a new FeltDB application with one command",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "license": "MIT",
   "bin": {
     "create-feltdb": "bin/create-feltdb.js"