create-feltdb 0.8.0 → 0.8.2

package/dist/server-source/crates/feltdb-server/src/tenancy.rs

@@ -41,6 +41,41 @@ pub struct Application {
     pub active_revision: Option<String>,
     #[serde(default)]
     pub environment_revisions: std::collections::BTreeMap<String, String>,
+    #[serde(default)]
+    pub qualification: Option<QualificationMarker>,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct QualificationMarker {
+    pub purpose: String,
+    pub disposable: bool,
+    pub environment: String,
+    pub proof_run_id: String,
+    pub expires_at: u64,
+}
+impl QualificationMarker {
+    fn valid_for_creation(&self, timestamp: u64) -> bool {
+        self.purpose == "qualification"
+            && self.disposable
+            && self.environment == "qualification"
+            && !self.proof_run_id.trim().is_empty()
+            && self.expires_at > timestamp
+    }
+
+    fn authorize_destruction(&self, proof_run_id: &str, timestamp: u64) -> Result<(), String> {
+        if self.purpose != "qualification" || !self.disposable {
+            return Err("refusing destructive qualification: application is not marked disposable".into());
+        }
+        if self.environment != "qualification" {
+            return Err("refusing destructive qualification: environment is not qualification".into());
+        }
+        if self.proof_run_id.trim().is_empty() || proof_run_id.trim().is_empty() || self.proof_run_id != proof_run_id {
+            return Err("refusing destructive qualification: proof run does not match".into());
+        }
+        if self.expires_at <= timestamp {
+            return Err("refusing destructive qualification: disposable marker has expired".into());
+        }
+        Ok(())
+    }
 }
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TenantMembership {
@@ -609,7 +644,7 @@ impl TenancyStore {
             .find(|app| app.id == application_id)?
             .clone();
         drop(records);
-        self.authorize_application(user_id, &app.tenant_id, &app.id, "applications:read")
+        self.authorize_application(user_id, &app.tenant_id, &app.id, "application:read")
             .then_some(app)
     }
     pub fn application_tenant(&self, application_id: &str) -> Option<String> {
@@ -765,10 +800,25 @@ impl TenancyStore {
         actor: &str,
         tenant_id: &str,
         name: &str,
+    ) -> Result<Application, String> {
+        self.create_application_with_qualification(actor, tenant_id, name, None)
+    }
+
+    pub fn create_application_with_qualification(
+        &self,
+        actor: &str,
+        tenant_id: &str,
+        name: &str,
+        qualification: Option<QualificationMarker>,
     ) -> Result<Application, String> {
         if !self.authorize_tenant(actor, tenant_id, "applications:write") {
             return Err("forbidden".into());
         }
+        if let Some(marker) = qualification.as_ref() {
+            if !marker.valid_for_creation(now()) {
+                return Err("invalid disposable qualification marker".into());
+            }
+        }
         let mut records = self
             .records
             .write()
@@ -794,6 +844,7 @@ impl TenancyStore {
             status: application_status(),
             active_revision: None,
             environment_revisions: Default::default(),
+            qualification,
         };
         records.application_memberships.push(ApplicationMembership {
             application_id: application.id.clone(),
@@ -816,6 +867,22 @@ impl TenancyStore {
         Ok(application)
     }
 
+    pub fn delete_qualification_application(
+        &self,
+        actor: &str,
+        application_id: &str,
+        proof_run_id: &str,
+    ) -> Result<(), String> {
+        let application = self
+            .application_for(actor, application_id)
+            .ok_or_else(|| "application not found".to_string())?;
+        let marker = application.qualification.ok_or_else(|| {
+            "refusing destructive qualification: application is not marked disposable".to_string()
+        })?;
+        marker.authorize_destruction(proof_run_id, now())?;
+        self.delete_application(actor, application_id)
+    }
+
     pub fn delete_application(&self, actor: &str, application_id: &str) -> Result<(), String> {
         let tenant_id = self
             .application_tenant(application_id)
@@ -1238,6 +1305,73 @@ mod tests {
         assert!(!store.authorize_application("user_a", &tenant_a.id, &app_b.id, "state:read"));
     }
 
+    #[test]
+    fn destructive_qualification_requires_an_unexpired_matching_marker() {
+        let valid_marker = QualificationMarker {
+            purpose: "qualification".into(), disposable: true, environment: "qualification".into(), proof_run_id: "proof-1".into(), expires_at: now() + 300,
+        };
+        assert!(valid_marker.authorize_destruction("", now()).unwrap_err().contains("does not match"));
+        assert!(valid_marker.authorize_destruction("proof-other", now()).unwrap_err().contains("does not match"));
+        let mut wrong_environment = valid_marker.clone();
+        wrong_environment.environment = "production".into();
+        assert!(wrong_environment.authorize_destruction("proof-1", now()).unwrap_err().contains("environment"));
+        let mut not_disposable = valid_marker.clone();
+        not_disposable.disposable = false;
+        assert!(not_disposable.authorize_destruction("proof-1", now()).unwrap_err().contains("not marked disposable"));
+        let mut expired = valid_marker.clone();
+        expired.expires_at = now().saturating_sub(1);
+        assert!(expired.authorize_destruction("proof-1", now()).unwrap_err().contains("expired"));
+        assert!(valid_marker.authorize_destruction("proof-1", now()).is_ok());
+
+        let store = store("qualification-guard");
+        let tenant = store.create_tenant("owner", "Qualification").unwrap();
+        let normal = store
+            .create_application("owner", &tenant.id, "Normal")
+            .unwrap();
+        assert!(store
+            .delete_qualification_application("owner", &normal.id, "proof-1")
+            .unwrap_err()
+            .contains("not marked disposable"));
+        assert!(store
+            .create_application_with_qualification(
+                "owner",
+                &tenant.id,
+                "Expired",
+                Some(QualificationMarker {
+                    purpose: "qualification".into(),
+                    disposable: true,
+                    environment: "qualification".into(),
+                    proof_run_id: "proof-expired".into(),
+                    expires_at: now().saturating_sub(1),
+                }),
+            )
+            .unwrap_err()
+            .contains("invalid disposable"));
+
+        let proof = store
+            .create_application_with_qualification(
+                "owner",
+                &tenant.id,
+                "Proof",
+                Some(QualificationMarker {
+                    purpose: "qualification".into(),
+                    disposable: true,
+                    environment: "qualification".into(),
+                    proof_run_id: "proof-1".into(),
+                    expires_at: now() + 300,
+                }),
+            )
+            .unwrap();
+        assert!(store
+            .delete_qualification_application("owner", &proof.id, "proof-other")
+            .unwrap_err()
+            .contains("does not match"));
+        store
+            .delete_qualification_application("owner", &proof.id, "proof-1")
+            .unwrap();
+        assert!(store.application_for("owner", &proof.id).is_none());
+    }
+
     #[test]
     fn invitation_acceptance_and_revocation_change_authorization() {
         let store = store("invitation");
@@ -1322,7 +1456,14 @@ mod tests {
             .unwrap();
 
         assert!(store.authorize_application("key_runtime", &tenant.id, &app.id, "state:read"));
+        assert_eq!(
+            store
+                .application_for("key_runtime", &app.id)
+                .map(|application| application.id),
+            Some(app.id.clone())
+        );
         assert!(!store.authorize_application("key_runtime", &tenant.id, &app.id, "state:write"));
+        assert!(store.application_for("key_runtime", &other.id).is_none());
         assert!(!store.authorize_application("key_runtime", &tenant.id, &other.id, "state:read"));
     }
 }

package/dist/template/default-project/src/context/AuthContext.tsx

@@ -17,7 +17,15 @@ export function AuthProvider({ children }: { children: ReactNode }) {
   const loading = sessionRecords.loading || userRecords.loading || membershipRecords.loading || organizationRecords.loading;
   const establish = (next: Session) => { sessionStorage.setItem(SESSION_KEY, next.id); setSessionId(next.id); };
   const value = useMemo<AuthValue>(() => ({ loading, authenticated: Boolean(session && user && membership && organization), session, user, membership, organization,
-    signUp: async input => { await db.auth.signUp({ email: input.email, password: input.password, display_name: input.name }); establish(await createAccount(input)); },
+    signUp: async input => {
+      try {
+        await db.auth.signUp({ email: input.email, password: input.password, display_name: input.name });
+      } catch (error) {
+        if ((error as { code?: string }).code !== 'CONFLICT') throw error;
+        await db.auth.signIn({ email: input.email, password: input.password });
+      }
+      establish(await createAccount(input));
+    },
     signIn: async (email, password) => { await db.auth.signIn({ email, password }); establish(await createSession(email)); },
     signOut: async () => { if (session) await sessions.delete(session.id); await db.auth.signOut(); sessionStorage.removeItem(SESSION_KEY); setSessionId(null); },
   }), [loading, session, user, membership, organization]);

package/dist/template/default-project/src/pages/SignUp.tsx

@@ -3,6 +3,6 @@ import { useAuth } from '../context/AuthContext';
 
 export function SignUp() {
   const { signUp } = useAuth(); const [error, setError] = useState(''); const [busy, setBusy] = useState(false);
-  async function submit(event: FormEvent<HTMLFormElement>) { event.preventDefault(); setBusy(true); setError(''); const form = new FormData(event.currentTarget); try { await signUp({ name: String(form.get('name')), email: String(form.get('email')), password: String(form.get('password')), organization: String(form.get('organization')) }); } catch { setError('We could not create your account. Check the details and try again.'); setBusy(false); } }
+  async function submit(event: FormEvent<HTMLFormElement>) { event.preventDefault(); setBusy(true); setError(''); const form = new FormData(event.currentTarget); try { await signUp({ name: String(form.get('name')), email: String(form.get('email')), password: String(form.get('password')), organization: String(form.get('organization')) }); } catch (error) { setError(error instanceof Error ? error.message : 'We could not create your account. Check the details and try again.'); setBusy(false); } }
   return <><span className="eyebrow">Create your workspace</span><h2>Start with durable state.</h2><p className="muted">Your actor, account, and organization are established at the FeltDB boundary.</p><form onSubmit={submit}><label>Name<input name="name" autoComplete="name" required placeholder="Ada Lovelace" /></label><label>Work email<input name="email" type="email" autoComplete="email" required placeholder="ada@example.com" /></label><label>Password<input name="password" type="password" autoComplete="new-password" minLength={8} required /></label><label>Organization<input name="organization" required placeholder="Analytical Engines" /></label>{error && <p className="error">{error}</p>}<button disabled={busy}>{busy ? 'Creating…' : 'Create account'}</button></form><p className="switch">Already have an account? <a href="?view=signin">Sign in</a></p></>;
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "create-feltdb",
   "private": false,
   "description": "Create a new FeltDB application with one command",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "license": "MIT",
   "bin": {
     "create-feltdb": "bin/create-feltdb.js"