create-feltdb 0.5.6 → 0.5.7

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.5.6';
+export const FELTDB_PACKAGE_VERSION = '0.5.7';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/Cargo.lock

@@ -513,6 +513,7 @@ dependencies = [
  "base64",
  "feltdb",
  "futures-core",
+ "hmac",
  "password-hash",
  "rand 0.8.7",
  "reqwest",
@@ -668,6 +669,15 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "http"
 version = "1.5.0"

package/dist/server-source/crates/feltdb-server/Cargo.toml

@@ -9,6 +9,7 @@ async-stream = "0.3"
 argon2 = "0.5"
 password-hash = "0.5"
 base64 = "0.22"
+hmac = "0.12"
 feltdb = { path = "../feltdb" }
 futures-core = "0.3"
 rand = "0.8"

package/dist/server-source/crates/feltdb-server/src/app_state.rs

@@ -1,5 +1,8 @@
-use std::sync::{atomic::AtomicU64, Arc};
 use std::path::PathBuf;
+use std::{
+    sync::{atomic::AtomicU64, Arc},
+    time::Instant,
+};
 
 use feltdb::{
     FeltDb,
@@ -33,6 +36,7 @@ use crate::{
 
 #[derive(Clone)]
 pub struct AppState {
+    pub started_at: Instant,
     pub db: FeltDb,
     pub namespace: Arc<str>,
     pub ids: Arc<AtomicU64>,

package/dist/server-source/crates/feltdb-server/src/authenticated_principal.rs

@@ -0,0 +1,273 @@
+use serde::{Deserialize, Serialize};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Authenticated principal derived exclusively from verified credentials.
+/// Never derived from request body or untrusted sources.
+/// Available to authorization evaluation and included in request context.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthenticatedPrincipal {
+    /// ID of the service key used for authentication.
+    /// Preserved separately from actorId for auditing.
+    pub service_key_id: String,
+
+    /// ID of the actor (user, service, workload, etc.) performing the operation.
+    pub actor_id: String,
+
+    /// Tenant ID from authenticated credentials.
+    pub tenant_id: String,
+
+    /// Roles granted to this principal.
+    pub roles: Vec<String>,
+
+    /// Authentication method used.
+    pub auth_method: AuthMethod,
+
+    /// When this principal was authenticated.
+    pub authenticated_at: u64,
+
+    /// Provenance tracking for audit.
+    pub provenance: AuthenticationProvenance,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum AuthMethod {
+    ApiKey,
+    Session,
+    Delegation,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthenticationProvenance {
+    /// Source of the credential (e.g., "bearer_token", "session_cookie", "delegation_token").
+    pub credential_source: String,
+
+    /// Hash of the credential for audit purposes (never the credential itself).
+    pub credential_hash: Option<String>,
+
+    /// Additional context about the authentication.
+    pub context: String,
+}
+
+impl AuthenticatedPrincipal {
+    /// Creates a new AuthenticatedPrincipal from API key authentication.
+    pub fn from_api_key(
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+    ) -> Self {
+        Self {
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            auth_method: AuthMethod::ApiKey,
+            authenticated_at: now(),
+            provenance: AuthenticationProvenance {
+                credential_source: "bearer_token".into(),
+                credential_hash: None,
+                context: "API key authentication".into(),
+            },
+        }
+    }
+
+    /// Creates a new AuthenticatedPrincipal from session authentication.
+    pub fn from_session(
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+    ) -> Self {
+        Self {
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            auth_method: AuthMethod::Session,
+            authenticated_at: now(),
+            provenance: AuthenticationProvenance {
+                credential_source: "session_cookie".into(),
+                credential_hash: None,
+                context: "Session authentication".into(),
+            },
+        }
+    }
+
+    /// Creates a new AuthenticatedPrincipal from delegation token.
+    pub fn from_delegation(
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+        delegation_context: String,
+    ) -> Self {
+        Self {
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            auth_method: AuthMethod::Delegation,
+            authenticated_at: now(),
+            provenance: AuthenticationProvenance {
+                credential_source: "delegation_token".into(),
+                credential_hash: None,
+                context: delegation_context,
+            },
+        }
+    }
+
+    /// Checks if this principal has a specific role.
+    pub fn has_role(&self, role: &str) -> bool {
+        self.roles.iter().any(|r| r == role || r == "*")
+    }
+
+    /// Checks if actor_id matches expected value, rejecting mismatches.
+    pub fn verify_actor_id(&self, expected: &str) -> Result<(), String> {
+        if self.actor_id != expected {
+            Err(format!(
+                "actor_id mismatch: authenticated as {} but operation requested {}",
+                self.actor_id, expected
+            ))
+        } else {
+            Ok(())
+        }
+    }
+
+    /// Checks if tenant_id matches expected value, rejecting mismatches.
+    pub fn verify_tenant_id(&self, expected: &str) -> Result<(), String> {
+        if self.tenant_id != expected {
+            Err(format!(
+                "tenant_id mismatch: authenticated for {} but operation requested {}",
+                self.tenant_id, expected
+            ))
+        } else {
+            Ok(())
+        }
+    }
+}
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn authenticated_principal_preserves_separation() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec!["read".into(), "write".into()],
+        );
+
+        assert_eq!(principal.service_key_id, "key_abc123");
+        assert_eq!(principal.actor_id, "user_xyz");
+        assert_eq!(principal.tenant_id, "tenant_prod");
+        assert_eq!(principal.auth_method, AuthMethod::ApiKey);
+    }
+
+    #[test]
+    fn verify_actor_id_rejects_mismatches() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec![],
+        );
+
+        assert!(principal.verify_actor_id("user_xyz").is_ok());
+        assert!(principal.verify_actor_id("user_other").is_err());
+    }
+
+    #[test]
+    fn verify_tenant_id_rejects_mismatches() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec![],
+        );
+
+        assert!(principal.verify_tenant_id("tenant_prod").is_ok());
+        assert!(principal.verify_tenant_id("tenant_other").is_err());
+    }
+
+    #[test]
+    fn has_role_works_correctly() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec!["admin".into(), "viewer".into()],
+        );
+
+        assert!(principal.has_role("admin"));
+        assert!(principal.has_role("viewer"));
+        assert!(!principal.has_role("editor"));
+    }
+
+    #[test]
+    fn wildcard_role_matches_all() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec!["*".into()],
+        );
+
+        assert!(principal.has_role("any_role"));
+        assert!(principal.has_role("admin"));
+    }
+
+    #[test]
+    fn from_session_creates_correct_principal() {
+        let principal = AuthenticatedPrincipal::from_session(
+            "key_session".into(),
+            "user_abc".into(),
+            "tenant_staging".into(),
+            vec!["viewer".into()],
+        );
+
+        assert_eq!(principal.auth_method, AuthMethod::Session);
+        assert_eq!(principal.provenance.credential_source, "session_cookie");
+    }
+
+    #[test]
+    fn from_delegation_creates_correct_principal() {
+        let principal = AuthenticatedPrincipal::from_delegation(
+            "key_delegated".into(),
+            "service_xyz".into(),
+            "tenant_prod".into(),
+            vec!["execute".into()],
+            "delegated from sherpa".into(),
+        );
+
+        assert_eq!(principal.auth_method, AuthMethod::Delegation);
+        assert_eq!(principal.provenance.credential_source, "delegation_token");
+        assert_eq!(principal.provenance.context, "delegated from sherpa");
+    }
+
+    #[test]
+    fn multiple_calls_to_verify_preserve_state() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec![],
+        );
+
+        // Verify multiple times to ensure no state mutation
+        assert!(principal.verify_actor_id("user_xyz").is_ok());
+        assert!(principal.verify_actor_id("user_xyz").is_ok());
+        assert!(principal.verify_tenant_id("tenant_prod").is_ok());
+        assert!(principal.verify_tenant_id("tenant_prod").is_ok());
+    }
+}