create-feltdb 0.5.0 → 0.5.2

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.5.0';
+export const FELTDB_PACKAGE_VERSION = '0.5.2';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/crates/feltdb/src/application.rs

@@ -959,6 +959,18 @@ pub struct RevisionAuditEvent {
     pub diff_hash: Option<String>,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct RevisionRecovery {
+    pub recovery_id: String,
+    pub application_id: String,
+    pub environment: String,
+    pub source_revision: String,
+    pub target_revision: String,
+    pub approved_by: String,
+    pub reason: String,
+    pub authorization_level: String,
+    pub recovered_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "SCREAMING_SNAKE_CASE")]
 pub enum ChangeSafety {
     Safe,
@@ -1099,6 +1111,10 @@ struct RevisionRecords {
     previews: Vec<ApplicationPreview>,
     environment_pointers: BTreeMap<String, BTreeMap<String, String>>,
     audit: Vec<RevisionAuditEvent>,
+    #[serde(default)]
+    untrusted_revisions: BTreeMap<String, BTreeMap<String, String>>,
+    #[serde(default)]
+    recoveries: Vec<RevisionRecovery>,
 }
 #[derive(Clone)]
 pub struct ApplicationStore {
@@ -1462,6 +1478,15 @@ impl ApplicationStore {
             })
             .ok_or("revision not found")?
             .clone();
+        if r.untrusted_revisions
+            .get(app)
+            .is_some_and(|values| values.contains_key(&revision.revision_id))
+        {
+            return Err("revision is permanently untrusted".into());
+        }
+        if manifest_hash(&revision.manifest)? != revision.manifest_hash {
+            return Err("revision integrity check failed".into());
+        }
         if !revision
             .manifest
             .environments
@@ -1536,6 +1561,108 @@ impl ApplicationStore {
         Ok(promotion)
     }
 
+    #[allow(clippy::too_many_arguments)]
+    pub fn recover_environment_pointer(
+        &self,
+        tenant: &str,
+        app: &str,
+        environment: &str,
+        expected_current_revision: &str,
+        target_revision: &str,
+        actor: &str,
+        reason: &str,
+        authorization_level: &str,
+        recovery_id: &str,
+    ) -> Result<RevisionRecovery, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "application store lock poisoned")?;
+        if let Some(existing) = records
+            .recoveries
+            .iter()
+            .find(|value| value.recovery_id == recovery_id)
+        {
+            if existing.application_id == app
+                && existing.environment == environment
+                && existing.source_revision == expected_current_revision
+                && existing.target_revision == target_revision
+            {
+                return Ok(existing.clone());
+            }
+            return Err("recovery_id_conflict".into());
+        }
+        let current = records
+            .environment_pointers
+            .get(app)
+            .and_then(|values| values.get(environment))
+            .cloned()
+            .unwrap_or_default();
+        if current != expected_current_revision {
+            return Err(format!("expected_revision_mismatch:{current}"));
+        }
+        let target = records
+            .revisions
+            .iter()
+            .find(|value| {
+                value.tenant_id == tenant
+                    && value.application_id == app
+                    && (value.revision_id == target_revision
+                        || value.revision_number.to_string() == target_revision)
+            })
+            .ok_or("target revision not found")?
+            .clone();
+        if manifest_hash(&target.manifest)? != target.manifest_hash {
+            return Err("target revision integrity check failed".into());
+        }
+        if records
+            .untrusted_revisions
+            .get(app)
+            .is_some_and(|values| values.contains_key(&target.revision_id))
+        {
+            return Err("target revision is permanently untrusted".into());
+        }
+        let recovery = RevisionRecovery {
+            recovery_id: recovery_id.into(),
+            application_id: app.into(),
+            environment: environment.into(),
+            source_revision: expected_current_revision.into(),
+            target_revision: target.revision_id.clone(),
+            approved_by: actor.into(),
+            reason: reason.into(),
+            authorization_level: authorization_level.into(),
+            recovered_at: now(),
+        };
+        records
+            .untrusted_revisions
+            .entry(app.into())
+            .or_default()
+            .insert(expected_current_revision.into(), recovery_id.into());
+        records
+            .environment_pointers
+            .entry(app.into())
+            .or_default()
+            .insert(environment.into(), target.revision_id.clone());
+        records.recoveries.push(recovery.clone());
+        Self::event(
+            &mut records,
+            "application.revision.recovered",
+            tenant,
+            app,
+            actor,
+            Some(&target),
+            Some(expected_current_revision.into()),
+        );
+        if let Some(event) = records.audit.last_mut() {
+            event.environment = Some(environment.into());
+            event.from_revision = Some(expected_current_revision.into());
+            event.to_revision = Some(target.revision_id);
+            event.correlation_id = recovery_id.into();
+        }
+        self.persist(&records)?;
+        Ok(recovery)
+    }
+
     pub fn history(&self, tenant: &str, app: &str, environment: &str) -> Vec<RevisionPromotion> {
         self.records
             .read()
@@ -2148,6 +2275,41 @@ mod tests {
         assert_eq!(s.pointers("a")["production"], r2.revision_id);
         assert_eq!(s.history("t", "a", "production").len(), 2);
     }
+
+    #[test]
+    fn recovery_is_atomic_idempotent_durable_and_permanently_untrusts_source() {
+        let s = store("revision-recovery");
+        let d = s.create_draft("t", "a", "App", "owner", None).unwrap();
+        let corrupt = s.commit("t", "a", &d.draft_id, "owner").unwrap();
+        s.move_environment_pointer("t", "a", &corrupt.revision_id, "staging", None,
+            "owner", "initial", true, false).unwrap();
+        let d = s.create_draft("t", "a", "App", "owner", Some(&corrupt.revision_id)).unwrap();
+        let clean = s.commit("t", "a", &d.draft_id, "owner").unwrap();
+
+        // Historical source corruption must not prevent recovery away from it.
+        {
+            let mut records = s.records.write().unwrap();
+            records.revisions.iter_mut().find(|value| value.revision_id == corrupt.revision_id)
+                .unwrap().manifest.metadata.name = "corrupted without updating its integrity hash".into();
+            s.persist(&records).unwrap();
+        }
+        let recovered = s.recover_environment_pointer("t", "a", "staging", &corrupt.revision_id,
+            &clean.revision_id, "sherpa", "Replace corrupt historical revision", "ELEVATED",
+            "recovery-1").unwrap();
+        assert_eq!(recovered.target_revision, clean.revision_id);
+        assert_eq!(s.recover_environment_pointer("t", "a", "staging", &corrupt.revision_id,
+            &clean.revision_id, "sherpa", "Replace corrupt historical revision", "ELEVATED",
+            "recovery-1").unwrap(), recovered);
+        assert!(s.move_environment_pointer("t", "a", &corrupt.revision_id, "staging",
+            Some(&clean.revision_id), "owner", "rollback", true, true).unwrap_err()
+            .contains("untrusted"));
+
+        let reloaded = ApplicationStore::load(s.path.clone()).unwrap();
+        assert_eq!(reloaded.pointers("a")["staging"], clean.revision_id);
+        let records = reloaded.records.read().unwrap();
+        assert_eq!(records.recoveries.len(), 1);
+        assert!(records.untrusted_revisions["a"].contains_key(&corrupt.revision_id));
+    }
     #[test]
     fn preview_remains_bound_when_production_moves() {
         let s = store("preview-bound");
@@ -2280,7 +2442,11 @@ mod tests {
         });
 
         let report = validate_manifest(&manifest, "tenant", "app", None);
-        assert!(report.valid, "Policy with authenticated subject should be valid: {:?}", report.issues);
+        assert!(
+            report.valid,
+            "Policy with authenticated subject should be valid: {:?}",
+            report.issues
+        );
     }
 
     #[test]
@@ -2295,7 +2461,11 @@ mod tests {
         });
 
         let report = validate_manifest(&manifest, "tenant", "app", None);
-        assert!(report.valid, "Policy with owner subject should be valid: {:?}", report.issues);
+        assert!(
+            report.valid,
+            "Policy with owner subject should be valid: {:?}",
+            report.issues
+        );
     }
 
     #[test]
@@ -2310,12 +2480,14 @@ mod tests {
         });
 
         let report = validate_manifest(&manifest, "tenant", "app", None);
-        assert!(!report.valid, "Policy with unknown subject should be invalid");
         assert!(
-            report.issues.iter().any(|i|
-                i.path.contains("BadPolicy") && i.path.contains("read") &&
-                i.message.contains("invalid policy subject")
-            ),
+            !report.valid,
+            "Policy with unknown subject should be invalid"
+        );
+        assert!(
+            report.issues.iter().any(|i| i.path.contains("BadPolicy")
+                && i.path.contains("read")
+                && i.message.contains("invalid policy subject")),
             "Should have error about invalid policy subject"
         );
     }
@@ -2332,6 +2504,9 @@ mod tests {
         });
 
         let report = validate_manifest(&manifest, "tenant", "app", None);
-        assert!(report.valid, "Policy without subjects should be valid (backward compatible)");
+        assert!(
+            report.valid,
+            "Policy without subjects should be valid (backward compatible)"
+        );
     }
 }

package/dist/server-source/crates/feltdb/src/lib.rs

@@ -2,6 +2,8 @@
 mod acceptance_tests;
 #[cfg(test)]
 mod admission_contract_tests;
+#[cfg(test)]
+mod managed_cas_tests;
 mod acquisition;
 pub mod admission;
 pub mod application;
@@ -329,6 +331,32 @@ pub struct AtomicCommit {
     pub rows: Vec<StoredRow>,
     pub duplicate: bool,
 }
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub enum JsonCasResult {
+    Updated {
+        current_version: u64,
+        current_epoch: u64,
+        value: Value,
+    },
+    VersionConflict {
+        current_version: u64,
+        current_epoch: u64,
+    },
+    AuthorityConflict {
+        current_version: u64,
+        current_epoch: u64,
+    },
+    LeaseConflict {
+        current_version: u64,
+        current_epoch: u64,
+    },
+    ReplicationConflict {
+        current_version: u64,
+        current_epoch: u64,
+    },
+    NotFound,
+}
 #[derive(Debug, Clone, Serialize, Deserialize)]
 struct TransactionLogRecord {
     record_type: String,
@@ -478,6 +506,151 @@ impl FeltDb {
         Ok(())
     }
 
+    /// Atomically compare the logical record version and authority epoch before
+    /// durably replacing a JSON object. Failed predicates append no operation
+    /// and emit no change event.
+    pub fn compare_and_set_json(
+        &self,
+        key: &str,
+        expected_version: u64,
+        expected_epoch: Option<u64>,
+        expected_lease_id: Option<&str>,
+        reject_if_diverged: bool,
+        mut value: Value,
+    ) -> Result<JsonCasResult> {
+        let capability = key
+            .split_once(':')
+            .map(|(cap, _)| cap)
+            .unwrap_or("default")
+            .to_string();
+        let rust_type = type_name::<Value>().to_string();
+        let (result, event) = {
+            let mut inner = self.inner.lock().expect("lock poisoned");
+            let Some(current) = inner.rows.get(&capability).and_then(|rows| rows.get(key)) else {
+                return Ok(JsonCasResult::NotFound);
+            };
+            let current_version = current
+                .value
+                .get("__version")
+                .and_then(Value::as_u64)
+                .unwrap_or(1);
+            let current_epoch = current
+                .value
+                .pointer("/authority/epoch")
+                .and_then(Value::as_u64)
+                .unwrap_or(0);
+            if current_version != expected_version {
+                return Ok(JsonCasResult::VersionConflict {
+                    current_version,
+                    current_epoch,
+                });
+            }
+            if expected_epoch.is_some_and(|expected| expected != current_epoch) {
+                return Ok(JsonCasResult::AuthorityConflict {
+                    current_version,
+                    current_epoch,
+                });
+            }
+            let persisted_lease = current.value.get("lease").filter(|lease| !lease.is_null());
+            let lease_matches = match (persisted_lease, expected_lease_id) {
+                (None, None) => true,
+                (None, Some(_)) => false,
+                (Some(lease), Some(expected_id)) => {
+                    lease.get("leaseId").and_then(Value::as_str) == Some(expected_id)
+                        && lease
+                            .get("expiresAt")
+                            .and_then(Value::as_u64)
+                            .is_some_and(|expires_at| expires_at > now_ms() as u64)
+                }
+                (Some(lease), None) => lease
+                    .get("expiresAt")
+                    .and_then(Value::as_u64)
+                    .is_some_and(|expires_at| expires_at <= now_ms() as u64),
+            };
+            if !lease_matches {
+                return Ok(JsonCasResult::LeaseConflict {
+                    current_version,
+                    current_epoch,
+                });
+            }
+            if reject_if_diverged && capability == "_cells" {
+                let replica_key = key
+                    .strip_prefix("_cells:")
+                    .map(|suffix| format!("_replicas:{suffix}"));
+                let divergent = replica_key.as_ref().and_then(|replica_key| {
+                    inner
+                        .rows
+                        .get("_replicas")
+                        .and_then(|rows| rows.get(replica_key))
+                        .and_then(|row| row.value.get("divergent"))
+                        .and_then(Value::as_bool)
+                }) == Some(true);
+                if divergent {
+                    return Ok(JsonCasResult::ReplicationConflict {
+                        current_version,
+                        current_epoch,
+                    });
+                }
+            }
+
+            let object = value.as_object_mut().ok_or_else(|| {
+                FlowError::CapabilityError("CAS value must be a JSON object".to_string())
+            })?;
+            object.insert("__version".to_string(), Value::from(expected_version + 1));
+
+            inner.sequence += 1;
+            inner.sync_state.increment_vector_clock();
+            let vector_clock = inner.sync_state.get_or_init_vector_clock().clone();
+            let operation = Operation::update(
+                inner.sequence,
+                inner.instance_id.clone(),
+                inner.sequence,
+                key.to_string(),
+                value.clone(),
+                rust_type.clone(),
+                capability.clone(),
+            )
+            .with_vector_clock(vector_clock);
+            let row = StoredRow {
+                capability: capability.clone(),
+                key: key.to_string(),
+                rust_type: rust_type.clone(),
+                value: value.clone(),
+                unix_ms: now_ms(),
+                content_hash: Some(operation.content_hash.clone()),
+                flow_ref: None,
+                deleted: false,
+                operation: Some(operation.clone()),
+            };
+            append_event(&inner.path, &row)?;
+            inner.change_log.add_operation(operation);
+            inner
+                .rows
+                .entry(capability.clone())
+                .or_default()
+                .insert(key.to_string(), row.clone());
+            let event = ChangeEvent {
+                capability,
+                key: key.to_string(),
+                rust_type,
+                unix_ms: row.unix_ms,
+            };
+            (
+                JsonCasResult::Updated {
+                    current_version: expected_version + 1,
+                    current_epoch: value
+                        .pointer("/authority/epoch")
+                        .and_then(Value::as_u64)
+                        .unwrap_or(current_epoch),
+                    value,
+                },
+                event,
+            )
+        };
+        let _ = self.event_tx.send(event);
+        Ok(result)
+    }
+
     /// Delete a record with vector clock tracking
     pub fn delete(&self, key: &str) -> Result<()> {
         let capability = key

package/dist/server-source/crates/feltdb/src/managed_cas_tests.rs

@@ -0,0 +1,231 @@
+use std::{fs, path::PathBuf};
+
+use serde_json::json;
+
+use crate::{FeltDb, JsonCasResult};
+
+fn database(name: &str) -> (FeltDb, PathBuf) {
+    let path = std::env::temp_dir().join(format!(
+        "feltdb-managed-cas-{name}-{}-{}.log",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    (FeltDb::open(&path).unwrap(), path)
+}
+
+#[test]
+fn version_and_epoch_are_one_atomic_predicate() {
+    let (db, path) = database("predicate");
+    let key = "_cells:cell-1";
+    db.insert(
+        key,
+        json!({
+            "id": "cell-1",
+            "version": 42,
+            "value": "before",
+            "authority": { "owner": "A", "epoch": 7, "lifecycle": "active" },
+            "__version": 1
+        }),
+    )
+    .unwrap();
+
+    let stale_epoch = db
+        .compare_and_set_json(
+            key,
+            1,
+            Some(6),
+            None,
+            false,
+            json!({
+                "id": "cell-1",
+                "version": 42,
+                "value": "stale",
+                "authority": { "owner": "stale", "epoch": 7, "lifecycle": "active" }
+            }),
+        )
+        .unwrap();
+    assert_eq!(
+        stale_epoch,
+        JsonCasResult::AuthorityConflict {
+            current_version: 1,
+            current_epoch: 7,
+        }
+    );
+    assert_eq!(db.get_value(key).unwrap().unwrap()["value"], "before");
+
+    let updated = db
+        .compare_and_set_json(
+            key,
+            1,
+            Some(7),
+            None,
+            false,
+            json!({
+                "id": "cell-1",
+                "version": 42,
+                "value": "after",
+                "authority": { "owner": "B", "epoch": 8, "lifecycle": "active" }
+            }),
+        )
+        .unwrap();
+    assert!(matches!(
+        updated,
+        JsonCasResult::Updated {
+            current_version: 2,
+            current_epoch: 8,
+            ..
+        }
+    ));
+
+    let stale_version = db
+        .compare_and_set_json(key, 1, Some(8), None, false, json!({ "value": "lost" }))
+        .unwrap();
+    assert_eq!(
+        stale_version,
+        JsonCasResult::VersionConflict {
+            current_version: 2,
+            current_epoch: 8,
+        }
+    );
+    let final_value = db.get_value(key).unwrap().unwrap();
+    assert_eq!(final_value["value"], "after");
+    assert_eq!(final_value["__version"], 2);
+    assert_eq!(final_value["authority"]["epoch"], 8);
+
+    drop(db);
+    let _ = fs::remove_file(path);
+}
+
+#[test]
+fn lease_is_checked_with_the_server_clock_inside_cas() {
+    let (db, path) = database("lease");
+    let key = "_cells:leased";
+    let future = crate::now_ms() as u64 + 60_000;
+    db.insert(
+        key,
+        json!({
+            "value": "before",
+            "authority": { "epoch": 3 },
+            "lease": { "leaseId": "lease-good", "expiresAt": future },
+            "__version": 1
+        }),
+    )
+    .unwrap();
+
+    for expected_lease_id in [None, Some("lease-wrong")] {
+        assert_eq!(
+            db.compare_and_set_json(
+                key,
+                1,
+                Some(3),
+                expected_lease_id,
+                false,
+                json!({ "value": "rejected", "authority": { "epoch": 3 } }),
+            )
+            .unwrap(),
+            JsonCasResult::LeaseConflict {
+                current_version: 1,
+                current_epoch: 3,
+            }
+        );
+        assert_eq!(db.get_value(key).unwrap().unwrap()["value"], "before");
+    }
+
+    assert!(matches!(
+        db.compare_and_set_json(
+            key,
+            1,
+            Some(3),
+            Some("lease-good"),
+            false,
+            json!({ "value": "accepted", "authority": { "epoch": 3 }, "lease": { "leaseId": "lease-good", "expiresAt": future } }),
+        )
+        .unwrap(),
+        JsonCasResult::Updated { .. }
+    ));
+
+    let expired_key = "_cells:expired";
+    db.insert(
+        expired_key,
+        json!({
+            "value": "before",
+            "authority": { "epoch": 3 },
+            "lease": { "leaseId": "lease-expired", "expiresAt": 1 },
+            "__version": 1
+        }),
+    )
+    .unwrap();
+    assert_eq!(
+        db.compare_and_set_json(
+            expired_key,
+            1,
+            Some(3),
+            Some("lease-expired"),
+            false,
+            json!({ "value": "rejected", "authority": { "epoch": 3 } }),
+        )
+        .unwrap(),
+        JsonCasResult::LeaseConflict {
+            current_version: 1,
+            current_epoch: 3,
+        }
+    );
+    assert_eq!(db.get_value(expired_key).unwrap().unwrap()["value"], "before");
+
+    drop(db);
+    let _ = fs::remove_file(path);
+}
+
+#[test]
+fn divergent_replica_blocks_promotion_inside_cas() {
+    let (db, path) = database("divergence");
+    let cell_key = "_cells:replica";
+    let replica_key = "_replicas:replica";
+    db.insert(
+        cell_key,
+        json!({
+            "version": 42,
+            "value": "A",
+            "authority": { "owner": "A", "epoch": 7 },
+            "lease": null,
+            "__version": 42
+        }),
+    )
+    .unwrap();
+    db.insert(
+        replica_key,
+        json!({ "version": 42, "value": "B", "divergent": true }),
+    )
+    .unwrap();
+    let sequence_before = db.sequence().unwrap();
+    let value_before = db.get_value(cell_key).unwrap().unwrap();
+
+    assert_eq!(
+        db.compare_and_set_json(
+            cell_key,
+            42,
+            Some(7),
+            None,
+            true,
+            json!({
+                "version": 43,
+                "value": "A",
+                "authority": { "owner": "B", "epoch": 8 },
+                "lease": null
+            }),
+        )
+        .unwrap(),
+        JsonCasResult::ReplicationConflict {
+            current_version: 42,
+            current_epoch: 7,
+        }
+    );
+    assert_eq!(db.sequence().unwrap(), sequence_before);
+    assert_eq!(db.get_value(cell_key).unwrap().unwrap(), value_before);
+
+    drop(db);
+    let _ = fs::remove_file(path);
+}