create-feltdb 0.8.7 → 0.9.0

package/dist/server-source/crates/feltdb-server/src/principals.rs

@@ -160,6 +160,43 @@ impl PrincipalStore {
             .cloned()
             .collect())
     }
+    /// One principal's own audit trail: grants, creations, and the
+    /// authorization decisions taken for it.
+    ///
+    /// The store has recorded these since it existed and nothing read them
+    /// back. A human governing an agent needs exactly this — what the agent was
+    /// allowed to do, when, and who allowed it — so it is readable under the
+    /// same application authorization as listing principals.
+    pub fn audit_for(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+        principal_id: Option<&str>,
+        limit: usize,
+    ) -> Result<Vec<PrincipalAuditEvent>, String> {
+        let tenant_id = Self::application_context(tenancy, application_id)?;
+        if !tenancy.authorize_application(actor, &tenant_id, application_id, "applications:read") {
+            return Err("forbidden".into());
+        }
+        let records = self
+            .records
+            .read()
+            .map_err(|_| "principal store lock poisoned")?;
+        let mut events: Vec<PrincipalAuditEvent> = records
+            .audit
+            .iter()
+            .filter(|event| event.application_id == application_id)
+            .filter(|event| principal_id.is_none_or(|id| event.principal_id == id))
+            .cloned()
+            .collect();
+        // Newest first: an operator reads the most recent decision, then
+        // works backwards.
+        events.reverse();
+        events.truncate(limit);
+        Ok(events)
+    }
+
     pub fn create(
         &self,
         actor: &str,

package/dist/server-source/crates/feltdb-wasm/src/lib.rs

@@ -302,7 +302,7 @@ impl JsDb {
                 serde_json::from_str(authorization).map_err(|e| e.to_string())?;
             let query: feltdb::state_contract::CanonicalQuery =
                 serde_json::from_str(query).map_err(|e| e.to_string())?;
-            let context = feltdb::state_contract::begin_read(
+            let context = feltdb::state_contract::begin_query_read(
                 &self.db,
                 &schema,
                 state_namespace,

package/package.json

@@ -2,7 +2,7 @@
   "name": "create-feltdb",
   "private": false,
   "description": "Create a new FeltDB application with one command",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "license": "MIT",
   "bin": {
     "create-feltdb": "bin/create-feltdb.js"