create-feltdb 0.5.6 → 0.6.0

package/dist/cli.js

@@ -307,7 +307,7 @@ Learn more: https://github.com/rkendel1/feltdb`);
         await createProject({
             projectName,
             autoYes: shouldAutoYes,
-            templatesDir: path.join(__dirname, '../templates'),
+            templatesDir: path.join(__dirname, '../template'),
             runtime: options.runtime,
             framework: options.framework,
             distributed: options.distributed,

package/dist/create.js

@@ -6,6 +6,7 @@ import path from 'path';
 import { randomBytes } from 'crypto';
 import { feltdbPackageRange } from './package-versions.js';
 import { generateDockerCompose, generateDockerfile, generateDockerIgnore, generateDotEnvLocal, generateFeltDBDockerfile, generateStudioDockerfile, } from './docker-compose-generator.js';
+import { initializeWorkspace, appendWorkspaceGitignore, } from './workspace-initialization.js';
 export async function createProject(options) {
     const { projectName, templatesDir } = options;
     const projectDir = path.resolve(process.cwd(), projectName);
@@ -1759,4 +1760,24 @@ If port 5173 is in use:
 MIT
 `;
     fs.writeFileSync(path.join(projectDir, 'README.md'), readme);
+    // Initialize Development Workspace
+    // This creates .feltdb/workspace.json which enables all FeltDB-aware tools
+    // (CLI, IDE, agents, browser extensions) to discover and connect to the
+    // same workspace without manual configuration.
+    const workspaceDiscovery = initializeWorkspace(projectDir, applicationName);
+    appendWorkspaceGitignore(projectDir);
+    // Copy .feltdb README from template
+    const templateReadmePath = path.join(templatesDir, 'dot-feltdb-README.md');
+    const targetReadmePath = path.join(projectDir, '.feltdb', 'README.md');
+    if (fs.existsSync(templateReadmePath)) {
+        fs.copyFileSync(templateReadmePath, targetReadmePath);
+    }
+    console.log(`\n✓ Development Workspace initialized`);
+    console.log(`  Workspace ID: ${workspaceDiscovery.workspaceId}`);
+    console.log(`  Location: ${path.join(projectName, '.feltdb/workspace.json')}`);
+    console.log(`\nNext steps:`);
+    console.log(`  cd ${projectName}`);
+    console.log(`  npm install`);
+    console.log(`  npm run dev`);
+    console.log(`\nYour Development Workspace is ready for use!`);
 }

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.5.6';
+export const FELTDB_PACKAGE_VERSION = '0.6.0';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/Cargo.lock

@@ -513,6 +513,7 @@ dependencies = [
  "base64",
  "feltdb",
  "futures-core",
+ "hmac",
  "password-hash",
  "rand 0.8.7",
  "reqwest",
@@ -668,6 +669,15 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "http"
 version = "1.5.0"

package/dist/server-source/crates/feltdb-server/Cargo.toml

@@ -9,6 +9,7 @@ async-stream = "0.3"
 argon2 = "0.5"
 password-hash = "0.5"
 base64 = "0.22"
+hmac = "0.12"
 feltdb = { path = "../feltdb" }
 futures-core = "0.3"
 rand = "0.8"

package/dist/server-source/crates/feltdb-server/src/app_state.rs

@@ -1,5 +1,8 @@
-use std::sync::{atomic::AtomicU64, Arc};
 use std::path::PathBuf;
+use std::{
+    sync::{atomic::AtomicU64, Arc},
+    time::Instant,
+};
 
 use feltdb::{
     FeltDb,
@@ -33,6 +36,7 @@ use crate::{
 
 #[derive(Clone)]
 pub struct AppState {
+    pub started_at: Instant,
     pub db: FeltDb,
     pub namespace: Arc<str>,
     pub ids: Arc<AtomicU64>,

package/dist/server-source/crates/feltdb-server/src/authenticated_principal.rs

@@ -0,0 +1,273 @@
+use serde::{Deserialize, Serialize};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Authenticated principal derived exclusively from verified credentials.
+/// Never derived from request body or untrusted sources.
+/// Available to authorization evaluation and included in request context.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthenticatedPrincipal {
+    /// ID of the service key used for authentication.
+    /// Preserved separately from actorId for auditing.
+    pub service_key_id: String,
+
+    /// ID of the actor (user, service, workload, etc.) performing the operation.
+    pub actor_id: String,
+
+    /// Tenant ID from authenticated credentials.
+    pub tenant_id: String,
+
+    /// Roles granted to this principal.
+    pub roles: Vec<String>,
+
+    /// Authentication method used.
+    pub auth_method: AuthMethod,
+
+    /// When this principal was authenticated.
+    pub authenticated_at: u64,
+
+    /// Provenance tracking for audit.
+    pub provenance: AuthenticationProvenance,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum AuthMethod {
+    ApiKey,
+    Session,
+    Delegation,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthenticationProvenance {
+    /// Source of the credential (e.g., "bearer_token", "session_cookie", "delegation_token").
+    pub credential_source: String,
+
+    /// Hash of the credential for audit purposes (never the credential itself).
+    pub credential_hash: Option<String>,
+
+    /// Additional context about the authentication.
+    pub context: String,
+}
+
+impl AuthenticatedPrincipal {
+    /// Creates a new AuthenticatedPrincipal from API key authentication.
+    pub fn from_api_key(
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+    ) -> Self {
+        Self {
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            auth_method: AuthMethod::ApiKey,
+            authenticated_at: now(),
+            provenance: AuthenticationProvenance {
+                credential_source: "bearer_token".into(),
+                credential_hash: None,
+                context: "API key authentication".into(),
+            },
+        }
+    }
+
+    /// Creates a new AuthenticatedPrincipal from session authentication.
+    pub fn from_session(
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+    ) -> Self {
+        Self {
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            auth_method: AuthMethod::Session,
+            authenticated_at: now(),
+            provenance: AuthenticationProvenance {
+                credential_source: "session_cookie".into(),
+                credential_hash: None,
+                context: "Session authentication".into(),
+            },
+        }
+    }
+
+    /// Creates a new AuthenticatedPrincipal from delegation token.
+    pub fn from_delegation(
+        service_key_id: String,
+        actor_id: String,
+        tenant_id: String,
+        roles: Vec<String>,
+        delegation_context: String,
+    ) -> Self {
+        Self {
+            service_key_id,
+            actor_id,
+            tenant_id,
+            roles,
+            auth_method: AuthMethod::Delegation,
+            authenticated_at: now(),
+            provenance: AuthenticationProvenance {
+                credential_source: "delegation_token".into(),
+                credential_hash: None,
+                context: delegation_context,
+            },
+        }
+    }
+
+    /// Checks if this principal has a specific role.
+    pub fn has_role(&self, role: &str) -> bool {
+        self.roles.iter().any(|r| r == role || r == "*")
+    }
+
+    /// Checks if actor_id matches expected value, rejecting mismatches.
+    pub fn verify_actor_id(&self, expected: &str) -> Result<(), String> {
+        if self.actor_id != expected {
+            Err(format!(
+                "actor_id mismatch: authenticated as {} but operation requested {}",
+                self.actor_id, expected
+            ))
+        } else {
+            Ok(())
+        }
+    }
+
+    /// Checks if tenant_id matches expected value, rejecting mismatches.
+    pub fn verify_tenant_id(&self, expected: &str) -> Result<(), String> {
+        if self.tenant_id != expected {
+            Err(format!(
+                "tenant_id mismatch: authenticated for {} but operation requested {}",
+                self.tenant_id, expected
+            ))
+        } else {
+            Ok(())
+        }
+    }
+}
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn authenticated_principal_preserves_separation() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec!["read".into(), "write".into()],
+        );
+
+        assert_eq!(principal.service_key_id, "key_abc123");
+        assert_eq!(principal.actor_id, "user_xyz");
+        assert_eq!(principal.tenant_id, "tenant_prod");
+        assert_eq!(principal.auth_method, AuthMethod::ApiKey);
+    }
+
+    #[test]
+    fn verify_actor_id_rejects_mismatches() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec![],
+        );
+
+        assert!(principal.verify_actor_id("user_xyz").is_ok());
+        assert!(principal.verify_actor_id("user_other").is_err());
+    }
+
+    #[test]
+    fn verify_tenant_id_rejects_mismatches() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec![],
+        );
+
+        assert!(principal.verify_tenant_id("tenant_prod").is_ok());
+        assert!(principal.verify_tenant_id("tenant_other").is_err());
+    }
+
+    #[test]
+    fn has_role_works_correctly() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec!["admin".into(), "viewer".into()],
+        );
+
+        assert!(principal.has_role("admin"));
+        assert!(principal.has_role("viewer"));
+        assert!(!principal.has_role("editor"));
+    }
+
+    #[test]
+    fn wildcard_role_matches_all() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec!["*".into()],
+        );
+
+        assert!(principal.has_role("any_role"));
+        assert!(principal.has_role("admin"));
+    }
+
+    #[test]
+    fn from_session_creates_correct_principal() {
+        let principal = AuthenticatedPrincipal::from_session(
+            "key_session".into(),
+            "user_abc".into(),
+            "tenant_staging".into(),
+            vec!["viewer".into()],
+        );
+
+        assert_eq!(principal.auth_method, AuthMethod::Session);
+        assert_eq!(principal.provenance.credential_source, "session_cookie");
+    }
+
+    #[test]
+    fn from_delegation_creates_correct_principal() {
+        let principal = AuthenticatedPrincipal::from_delegation(
+            "key_delegated".into(),
+            "service_xyz".into(),
+            "tenant_prod".into(),
+            vec!["execute".into()],
+            "delegated from sherpa".into(),
+        );
+
+        assert_eq!(principal.auth_method, AuthMethod::Delegation);
+        assert_eq!(principal.provenance.credential_source, "delegation_token");
+        assert_eq!(principal.provenance.context, "delegated from sherpa");
+    }
+
+    #[test]
+    fn multiple_calls_to_verify_preserve_state() {
+        let principal = AuthenticatedPrincipal::from_api_key(
+            "key_abc123".into(),
+            "user_xyz".into(),
+            "tenant_prod".into(),
+            vec![],
+        );
+
+        // Verify multiple times to ensure no state mutation
+        assert!(principal.verify_actor_id("user_xyz").is_ok());
+        assert!(principal.verify_actor_id("user_xyz").is_ok());
+        assert!(principal.verify_tenant_id("tenant_prod").is_ok());
+        assert!(principal.verify_tenant_id("tenant_prod").is_ok());
+    }
+}