create-feltdb 0.5.2 → 0.5.4

package/dist/managed-account.js

@@ -15,18 +15,22 @@ export async function configureManagedAccount(options) {
         body: JSON.stringify({ email: options.email, password: options.password }),
     });
     await responseJson(authenticated, 'Could not create or sign in to the managed account');
+    // fetch follows the feltdb.com -> www.feltdb.com redirect. Reuse the final
+    // origin so Node does not strip the explicit Cookie header on later
+    // cross-origin redirects.
+    const sessionOrigin = authenticated.url ? new URL(authenticated.url).origin : accountUrl;
     const cookie = authenticated.headers.get('set-cookie')?.split(';', 1)[0];
     if (!cookie)
         throw new Error('Managed account service did not return a secure session');
     const headers = { Cookie: cookie, 'Content-Type': 'application/json' };
-    const tenants = await responseJson(await request(`${accountUrl}/api/tenants`, { headers }), 'Could not load managed workspaces');
+    const tenants = await responseJson(await request(`${sessionOrigin}/api/tenants`, { headers }), 'Could not load managed workspaces');
     let tenant = Array.isArray(tenants) ? tenants[0] : undefined;
     if (!tenant) {
-        tenant = await responseJson(await request(`${accountUrl}/api/tenants`, {
+        tenant = await responseJson(await request(`${sessionOrigin}/api/tenants`, {
             method: 'POST', headers, body: JSON.stringify({ name: `${options.applicationName} Workspace` }),
         }), 'Could not create the managed workspace');
     }
-    const applicationsUrl = `${accountUrl}/api/tenants/${encodeURIComponent(tenant.id)}/applications`;
+    const applicationsUrl = `${sessionOrigin}/api/tenants/${encodeURIComponent(tenant.id)}/applications`;
     const applications = await responseJson(await request(applicationsUrl, { headers }), 'Could not load managed applications');
     let application = Array.isArray(applications)
         ? applications.find(value => value.name === options.applicationName)
@@ -36,7 +40,10 @@ export async function configureManagedAccount(options) {
             method: 'POST', headers, body: JSON.stringify({ name: options.applicationName }),
         }), 'Could not create the managed application');
     }
-    const key = await responseJson(await request(`${apiUrl}/api/keys`, {
+    // Provision through the account origin that issued the human session. The
+    // resulting key is still used against apiUrl, but setup must not require a
+    // browser session to be trusted by every managed data-plane hostname.
+    const key = await responseJson(await request(`${sessionOrigin}/api/keys`, {
         method: 'POST', headers,
         body: JSON.stringify({
             id: `${options.applicationName}-cli`,

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.5.2';
+export const FELTDB_PACKAGE_VERSION = '0.5.4';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/crates/feltdb/src/lib.rs

@@ -308,6 +308,7 @@ struct Inner {
     capability_locations: CapabilityLocationRegistry,
     bootstrapped: bool,
     applied_transactions: HashSet<String>,
+    transaction_payload_hashes: HashMap<String, String>,
     collection_cardinality: HashMap<String, u64>,
 }
 
@@ -361,6 +362,8 @@ pub enum JsonCasResult {
 struct TransactionLogRecord {
     record_type: String,
     transaction_id: String,
+    #[serde(default)]
+    payload_hash: Option<String>,
     state_before: u64,
     state_after: u64,
     rows: Vec<StoredRow>,
@@ -894,6 +897,10 @@ impl FeltDb {
             .contains(transaction_id))
     }
 
+    pub fn applied_transaction_payload_hash(&self, transaction_id: &str) -> Result<Option<String>> {
+        Ok(self.inner.lock().expect("lock poisoned").transaction_payload_hashes.get(transaction_id).cloned())
+    }
+
     /// Atomically validates and durably applies an ordered mutation batch.
     /// The complete transaction is represented by one log record and becomes
     /// visible in memory only after that record has been appended successfully.
@@ -904,10 +911,29 @@ impl FeltDb {
         preconditions: &[AtomicPrecondition],
         mutations: &[AtomicMutation],
         audit: Option<Value>,
+    ) -> Result<AtomicCommit> {
+        self.apply_atomic_transaction_content_addressed(transaction_id, None, expected_parent, preconditions, mutations, audit)
+    }
+
+    /// Applies a transaction whose identifier is durably bound to a canonical
+    /// payload hash. The same ID with a different payload is always a conflict.
+    pub fn apply_atomic_transaction_content_addressed(
+        &self,
+        transaction_id: &str,
+        payload_hash: Option<&str>,
+        expected_parent: Option<u64>,
+        preconditions: &[AtomicPrecondition],
+        mutations: &[AtomicMutation],
+        audit: Option<Value>,
     ) -> Result<AtomicCommit> {
         let (commit, events) = {
             let mut inner = self.inner.lock().expect("lock poisoned");
             if inner.applied_transactions.contains(transaction_id) {
+                if let Some(expected_hash) = payload_hash {
+                    if inner.transaction_payload_hashes.get(transaction_id).map(String::as_str) != Some(expected_hash) {
+                        return Err(FlowError::CapabilityError(format!("TRANSACTION_ID_PAYLOAD_MISMATCH:{transaction_id}")));
+                    }
+                }
                 return Ok(AtomicCommit {
                     transaction_id: transaction_id.into(),
                     state_before: inner.sequence,
@@ -1002,6 +1028,7 @@ impl FeltDb {
             let record = TransactionLogRecord {
                 record_type: "feltdb.transaction.v1".into(),
                 transaction_id: transaction_id.into(),
+                payload_hash: payload_hash.map(str::to_owned),
                 state_before,
                 state_after: next_sequence,
                 rows: rows.clone(),
@@ -1042,6 +1069,7 @@ impl FeltDb {
             }
             inner.sync_state.merge_vector_clock(&vector_clock);
             inner.applied_transactions.insert(transaction_id.into());
+            if let Some(hash) = payload_hash { inner.transaction_payload_hashes.insert(transaction_id.into(), hash.into()); }
             let events = rows
                 .iter()
                 .map(|row| ChangeEvent {
@@ -2137,6 +2165,9 @@ fn replay_log(inner: &mut Inner) -> Result<()> {
         }
         if value.get("record_type").and_then(Value::as_str) == Some("feltdb.transaction.v1") {
             let transaction: TransactionLogRecord = serde_json::from_value(value)?;
+            if let Some(hash) = transaction.payload_hash.clone() {
+                inner.transaction_payload_hashes.insert(transaction.transaction_id.clone(), hash);
+            }
             if inner
                 .applied_transactions
                 .insert(transaction.transaction_id)

package/dist/server-source/crates/feltdb/src/state_contract.rs

@@ -1913,6 +1913,23 @@ pub fn execute_transaction(
     schema: &StateSchema,
     request: &TransactionRequest,
     write_policy: Option<PolicySubject>,
+) -> Result<TransactionResult, StateFailure> {
+    execute_transaction_with_policies(db, schema, request, write_policy.as_ref(), None)
+}
+pub fn execute_transaction_with_collection_policies(
+    db: &FeltDb,
+    schema: &StateSchema,
+    request: &TransactionRequest,
+    write_policies: &BTreeMap<String, PolicySubject>,
+) -> Result<TransactionResult, StateFailure> {
+    execute_transaction_with_policies(db, schema, request, None, Some(write_policies))
+}
+fn execute_transaction_with_policies(
+    db: &FeltDb,
+    schema: &StateSchema,
+    request: &TransactionRequest,
+    uniform_write_policy: Option<&PolicySubject>,
+    collection_write_policies: Option<&BTreeMap<String, PolicySubject>>,
 ) -> Result<TransactionResult, StateFailure> {
     if request.application_id != schema.application_id
         || request.revision_id != schema.revision_id
@@ -1944,19 +1961,25 @@ pub fn execute_transaction(
         request.application_id.as_str(),
         request.revision_id.as_str(),
         request.schema_version,
+        request.state_namespace.as_deref(),
         request.causal_parent,
         &request.authorization.subject,
+        &request.preconditions,
         &request.operations,
     ))
     .map_err(StateFailure::storage)?;
     let transaction_id = request
         .transaction_id
         .clone()
-        .unwrap_or_else(|| format!("tx_{:x}", Sha256::digest(canonical)));
+        .unwrap_or_else(|| format!("tx_{:x}", Sha256::digest(&canonical)));
+    let payload_hash = format!("sha256:{:x}", Sha256::digest(&canonical));
     if db
         .has_applied_transaction(&transaction_id)
         .map_err(StateFailure::storage)?
     {
+        if db.applied_transaction_payload_hash(&transaction_id).map_err(StateFailure::storage)?.as_deref() != Some(payload_hash.as_str()) {
+            return Err(StateFailure::new("CONFLICT", "transaction ID was already committed with a different canonical payload"));
+        }
         let state = db.sequence().map_err(StateFailure::storage)?;
         let cursor = db
             .operation_versions()
@@ -2088,7 +2111,8 @@ pub fn execute_transaction(
             .unwrap_or_else(|| persisted.map(|row| Some(row.value.clone())).unwrap_or(None));
 
         // Per-operation record authorization
-        if let Some(policy) = &write_policy {
+        let write_policy = collection_write_policies.and_then(|policies| policies.get(&operation.collection)).or(uniform_write_policy);
+        if let Some(policy) = write_policy {
             let actor = if request.authorization.subject.is_empty()
                 || request.authorization.subject == ":"
             {
@@ -2279,8 +2303,9 @@ pub fn execute_transaction(
         }
     }
     let commit = db
-        .apply_atomic_transaction(
+        .apply_atomic_transaction_content_addressed(
             &transaction_id,
+            Some(&payload_hash),
             request.causal_parent,
             &preconditions,
             &mutations,
@@ -2760,6 +2785,17 @@ mod tests {
         assert_eq!(failure.actual, Some(Value::from(1)));
     }
     #[test]
+    fn explicit_transaction_id_is_bound_to_canonical_payload_across_restart() {
+        let path=std::env::temp_dir().join(format!("feltdb-content-id-{}-{}.log",std::process::id(),crate::now_ms()));
+        let schema=schema();
+        let request=TransactionRequest{transaction_id:Some("stable-client-id".into()),tenant_id:"tenant".into(),application_id:"app".into(),revision_id:"rev".into(),schema_version:1,state_namespace:None,causal_parent:None,authorization:auth(),preconditions:vec![],operations:vec![TransactionOperation{kind:TransactionOperationKind::Insert,collection:"incidents".into(),id:"content-bound".into(),value:serde_json::json!({"title":"Original"}),if_version:None}]};
+        {let db=crate::open(&path).unwrap();assert!(!execute_transaction(&db,&schema,&request,None).unwrap().duplicate);assert!(execute_transaction(&db,&schema,&request,None).unwrap().duplicate);}
+        let reopened=crate::open(&path).unwrap();assert!(execute_transaction(&reopened,&schema,&request,None).unwrap().duplicate);
+        let mut changed=request.clone();changed.operations[0].value=serde_json::json!({"title":"Changed"});
+        let failure=execute_transaction(&reopened,&schema,&changed,None).unwrap_err();assert_eq!(failure.code,"CONFLICT");assert!(failure.message.contains("different canonical payload"));
+        std::fs::remove_file(path).ok();
+    }
+    #[test]
     fn read_context_remains_a_stable_snapshot() {
         let db = db("snapshot-read");
         let schema = schema();

package/dist/server-source/crates/feltdb-server/src/auth.rs

@@ -50,6 +50,12 @@ pub struct ApiKeySummary {
     pub revoked: bool,
 }
 
+#[derive(Debug, Clone)]
+pub struct CreatedApiKey {
+    pub id: String,
+    pub secret: String,
+}
+
 #[derive(Debug, Clone)]
 pub struct Principal {
     pub key_id: String,
@@ -152,7 +158,7 @@ impl KeyStore {
         name: String,
         scopes: Vec<String>,
         namespaces: Vec<String>,
-    ) -> Result<String, String> {
+    ) -> Result<CreatedApiKey, String> {
         let secret: String = rand::thread_rng()
             .sample_iter(&Alphanumeric)
             .take(48)
@@ -173,7 +179,7 @@ impl KeyStore {
             .write()
             .map_err(|_| "API key store lock poisoned".to_string())?
             .push(ApiKeyRecord {
-                id,
+                id: id.clone(),
                 name,
                 hash,
                 scopes,
@@ -181,7 +187,7 @@ impl KeyStore {
                 revoked: false,
             });
         self.persist()?;
-        Ok(token)
+        Ok(CreatedApiKey { id, secret: token })
     }
 
     pub fn list(&self) -> Result<Vec<ApiKeySummary>, String> {
@@ -255,13 +261,14 @@ mod tests {
                 .as_nanos()
         ));
         let store = KeyStore::load(&path).unwrap();
-        let token = store
+        let created = store
             .create(
                 "test".to_string(),
                 vec!["state:read".to_string()],
                 vec!["alpha".to_string()],
             )
             .unwrap();
+        let token = created.secret;
 
         let file = fs::read_to_string(&path).unwrap();
         assert!(!file.contains(&token));
@@ -271,8 +278,7 @@ mod tests {
             .permits("state:read"));
         assert!(store.authenticate(&token, "beta").is_none());
         assert!(store.authenticate("fdb_live_wrong", "alpha").is_none());
-        let id = store.list().unwrap().pop().unwrap().id;
-        assert!(store.revoke(&id).unwrap());
+        assert!(store.revoke(&created.id).unwrap());
         assert!(store.authenticate(&token, "alpha").is_none());
         assert!(!store.revoke("missing").unwrap());
         let _ = fs::remove_file(path);

package/dist/server-source/crates/feltdb-server/src/key_management.rs

@@ -45,11 +45,11 @@ pub async fn create_key(
         .unwrap_or_default()
         .as_secs();
 
-    let id = req.id.unwrap_or_else(|| format!("key-{}", timestamp));
-    let secret = state
+    let name = req.id.unwrap_or_else(|| format!("key-{}", timestamp));
+    let key = state
         .keys
         .create(
-            id.clone(),
+            name,
             req.scopes,
             vec![req.namespace],
         )
@@ -57,7 +57,10 @@ pub async fn create_key(
 
     Ok((
         StatusCode::CREATED,
-        Json(CreateKeyResponse { secret, id }),
+        Json(CreateKeyResponse {
+            secret: key.secret,
+            id: key.id,
+        }),
     ))
 }
 

package/dist/server-source/crates/feltdb-server/src/main.rs

@@ -44,7 +44,7 @@ use feltdb::{
     policy_evaluation::{Actor, PolicyContext, PolicyEvaluator, PolicySubject},
     state_contract::{
         begin_read, compare_schemas, execute_query as execute_state_query, execute_transaction,
-        schema_from_revision, validate_schema, AuthorizationContext, CanonicalQuery, QueryFilter,
+        execute_transaction_with_collection_policies, schema_from_revision, validate_schema, AuthorizationContext, CanonicalQuery, QueryFilter,
         StateSchema, TransactionOperation, TransactionOperationKind, TransactionRequest,
     },
     sync_contract::{
@@ -118,6 +118,8 @@ impl From<feltdb::FlowError> for ApiError {
 #[derive(Serialize)]
 struct HealthResponse<'a> {
     status: &'a str,
+    version: &'a str,
+    git_commit: &'a str,
     runtime: &'a str,
     storage: &'a str,
     fabric: &'a str,
@@ -4708,6 +4710,32 @@ async fn list_runtime_triggers(
     Ok(Json(json!(contract.triggers)))
 }
 
+fn state_policy_resource_matches(resource:&str,collection:&str)->bool{resource==collection||resource.strip_suffix('*').is_some_and(|prefix|!prefix.contains('*')&&collection.starts_with(prefix))}
+fn matching_state_policy<'a>(contract:&'a ApplicationRuntimeContract,collection:&str)->Option<&'a feltdb::application::PolicyDefinition>{contract.policies.definitions.iter().find(|p|p.resource==collection).or_else(||contract.policies.definitions.iter().find(|p|state_policy_resource_matches(&p.resource,collection)))}
+fn authorize_transaction_collections(
+    principal: &Principal,
+    contract: &ApplicationRuntimeContract,
+    tenant: &str,
+    collections: &[String],
+) -> (bool, BTreeMap<String, PolicySubject>) {
+    if tenant != contract.tenant_id || collections.is_empty() {
+        return (false, BTreeMap::new());
+    }
+    let mut write_policies = BTreeMap::new();
+    for collection in collections {
+        let decision = state_authorization(principal, contract, collection, "write");
+        if !decision.capabilities.contains("state:write") {
+            return (false, BTreeMap::new());
+        }
+        if let Some(subject) = matching_state_policy(contract, collection)
+            .and_then(|policy| policy.write.as_deref())
+            .and_then(PolicySubject::from_str)
+        {
+            write_policies.insert(collection.clone(), subject);
+        }
+    }
+    (true, write_policies)
+}
 fn state_authorization(
     principal: &Principal,
     contract: &ApplicationRuntimeContract,
@@ -4716,13 +4744,8 @@ fn state_authorization(
 ) -> AuthorizationContext {
     let subject = format!("{}:{}", principal.subject_type, principal.key_id);
 
-    // Look up policy for this collection
-    let policy_subject = contract
-        .policies
-        .definitions
-        .iter()
-        .find(|p| p.resource == collection)
-        .and_then(|p| {
+    let policy=matching_state_policy(contract,collection);
+    let policy_subject = policy.and_then(|p| {
             if operation == "read" {
                 p.read.as_ref().and_then(|s| PolicySubject::from_str(s))
             } else {
@@ -4756,14 +4779,15 @@ fn state_authorization(
                 BTreeSet::new()
             }
         }
-    } else {
-        // No policy found, use default capabilities
+    } else if policy.is_some_and(|p|p.capabilities.iter().any(|capability|capability==if operation=="read"{"state:read"}else{"state:write"})) {
         let capability = if operation == "read" {
             "state:read"
         } else {
             "state:write"
         };
         [capability.into()].into()
+    } else {
+        BTreeSet::new()
     };
 
     AuthorizationContext {
@@ -5091,27 +5115,21 @@ async fn execute_canonical_transaction(
     input.transaction.revision_id = contract.revision_id.clone();
     input.transaction.schema_version = contract.state.schema.schema_version;
     input.transaction.state_namespace = Some(contract.environment.state_namespace.clone());
-    // For transactions with operations, use the first operation's collection for policy evaluation
-    // Multi-collection transactions will still be checked at the operation level in execute_transaction
-    let collection = input
-        .transaction
-        .operations
-        .first()
-        .map(|op| op.collection.clone())
-        .unwrap_or_default();
-    input.transaction.authorization =
-        state_authorization(&principal, &contract, &collection, "write");
-    let write_policy = contract
-        .policies
-        .definitions
-        .iter()
-        .find(|p| p.resource == collection)
-        .and_then(|p| p.write.as_ref().and_then(|s| PolicySubject::from_str(s)));
-    let result = execute_transaction(
+    let collections = input.transaction.operations.iter()
+        .map(|operation| operation.collection.clone())
+        .collect::<Vec<_>>();
+    let (authorized, write_policies) = authorize_transaction_collections(
+        &principal,
+        &contract,
+        &tenant,
+        &collections,
+    );
+    input.transaction.authorization=state_authorization_legacy(&principal,&tenant,&input.application_id,&contract.revision_id,if authorized{"state:write"}else{"state:denied"});
+    let result = execute_transaction_with_collection_policies(
         &state.db,
         &contract.state.schema,
         &input.transaction,
-        write_policy,
+        &write_policies,
     )
     .map_err(state_contract_error)?;
     audit(
@@ -6556,6 +6574,8 @@ async fn health(State(state): State<AppState>) -> Json<HealthResponse<'static>>
         } else {
             "degraded"
         },
+        version: env!("CARGO_PKG_VERSION"),
+        git_commit: option_env!("FELTDB_GIT_COMMIT").unwrap_or("unknown"),
         runtime: "self-hosted",
         storage: "durable",
         fabric: "healthy",
@@ -6659,12 +6679,15 @@ fn manage_keys() -> Result<bool, Box<dyn std::error::Error>> {
                     .map(str::to_string)
                     .collect()
             };
-            let token = store.create(
+            let key = store.create(
                 name,
                 values("--scope", "state:read,state:write,events:read"),
                 values("--namespace", "default"),
             )?;
-            println!("API key created. This secret will not be shown again:\n{token}");
+            println!(
+                "API key created (id: {}). This secret will not be shown again:\n{}",
+                key.id, key.secret
+            );
         }
         "list" => println!("{}", serde_json::to_string_pretty(&store.list()?)?),
         "revoke" => {
@@ -9088,3 +9111,92 @@ async fn shutdown_signal() {
     let terminate = std::future::pending::<()>();
     tokio::select! { _ = ctrl_c => {}, _ = terminate => {} }
 }
+
+#[cfg(test)]
+mod authority_gate_tests {
+    use super::{authorize_transaction_collections, state_authorization};
+    use feltdb::{
+        application::{manifest_hash, ApplicationManifest, ApplicationRevision, PolicyDefinition, RevisionStatus},
+        application_runtime::{resolve_runtime, ApplicationRuntimeContract, RuntimeInventory},
+    };
+    use feltdb_server::auth::Principal;
+
+    fn contract(policies: Vec<PolicyDefinition>) -> ApplicationRuntimeContract {
+        let mut manifest = ApplicationManifest::empty("tenant", "app", "Authority test");
+        manifest.policies = policies;
+        let revision = ApplicationRevision {
+            revision_id: "apprev://tenant/app/test".into(),
+            application_id: "app".into(),
+            tenant_id: "tenant".into(),
+            revision_number: 1,
+            parent_revision_id: None,
+            manifest_hash: manifest_hash(&manifest).unwrap(),
+            manifest,
+            created_by: "test".into(),
+            created_at: 1,
+            status: RevisionStatus::Committed,
+        };
+        resolve_runtime(&revision, "production", &RuntimeInventory::default()).unwrap()
+    }
+
+    fn principal() -> Principal {
+        Principal {
+            key_id: "key-1".into(),
+            scopes: vec!["state:read".into(), "state:write".into()],
+            subject_type: "api_key".into(),
+            identity_id: None,
+            session_id: None,
+        }
+    }
+
+    fn allow(resource: &str) -> PolicyDefinition {
+        PolicyDefinition {
+            name: resource.into(),
+            resource: resource.into(),
+            read: None,
+            write: None,
+            capabilities: vec!["state:read".into(), "state:write".into()],
+        }
+    }
+
+    #[test]
+    fn no_matching_policy_denies() {
+        let contract = contract(vec![]);
+        assert!(state_authorization(&principal(), &contract, "secrets", "read").capabilities.is_empty());
+        let (allowed, _) = authorize_transaction_collections(
+            &principal(), &contract, "tenant", &["secrets".into()],
+        );
+        assert!(!allowed);
+    }
+
+    #[test]
+    fn terminal_wildcard_policy_allows_matching_collection() {
+        let contract = contract(vec![allow("buzz_*")]);
+        let (allowed, _) = authorize_transaction_collections(
+            &principal(), &contract, "tenant", &["buzz_rooms".into()],
+        );
+        assert!(allowed);
+    }
+
+    #[test]
+    fn multi_collection_transaction_authorizes_every_operation() {
+        let contract = contract(vec![allow("alpha"), allow("beta")]);
+        let (all_allowed, _) = authorize_transaction_collections(
+            &principal(), &contract, "tenant", &["alpha".into(), "beta".into()],
+        );
+        let (mixed_allowed, _) = authorize_transaction_collections(
+            &principal(), &contract, "tenant", &["alpha".into(), "secrets".into()],
+        );
+        assert!(all_allowed);
+        assert!(!mixed_allowed);
+    }
+
+    #[test]
+    fn cross_tenant_transaction_denies() {
+        let contract = contract(vec![allow("alpha")]);
+        let (allowed, _) = authorize_transaction_collections(
+            &principal(), &contract, "other-tenant", &["alpha".into()],
+        );
+        assert!(!allowed);
+    }
+}

package/package.json

@@ -2,7 +2,7 @@
   "name": "create-feltdb",
   "private": false,
   "description": "Create a new FeltDB application with one command",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "license": "MIT",
   "bin": {
     "create-feltdb": "bin/create-feltdb.js"