create-feltdb 0.9.0 → 0.9.1

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.9.0';
+export const FELTDB_PACKAGE_VERSION = '0.9.1';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/crates/feltdb-server/src/main.rs

@@ -7513,17 +7513,29 @@ async fn get_state_version(
         json!({"application_id":target.application_id,"revision_id":contract.revision_id,"schema_version":contract.state.schema.schema_version,"state_version":state.db.sequence()?,"causal_cursor":state.db.operation_versions()?,"state_namespace":contract.environment.state_namespace}),
     ))
 }
+fn require_bound_tenant(headers: &HeaderMap, tenant: &str) -> Result<(), ApiError> {
+    let Some(bound) = headers.get("feltdb-tenant-id") else { return Ok(()); };
+    if bound.to_str().ok() == Some(tenant) { return Ok(()); }
+    Err(ApiError(StatusCode::FORBIDDEN, json!({
+        "code":"AUTHORITY_SCOPE_MISMATCH",
+        "message":"request tenant does not match the authenticated application authority",
+        "http_status":403
+    }).to_string()))
+}
+
 async fn execute_canonical_query(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
+    headers: HeaderMap,
     Json(input): Json<CanonicalQueryRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    let _ = application_scope(
+    let tenant = application_scope(
         &state,
         &principal.key_id,
         &input.application_id,
         "state:read",
     )?;
+    require_bound_tenant(&headers, &tenant)?;
     let contract = revision_contract(
         &state,
         &principal.key_id,
@@ -7718,6 +7730,7 @@ async fn execute_revision_recovery(
 async fn execute_canonical_transaction(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
+    headers: HeaderMap,
     Json(mut input): Json<CanonicalTransactionRequest>,
 ) -> Result<Json<Value>, ApiError> {
     let tenant = application_scope(
@@ -7726,6 +7739,7 @@ async fn execute_canonical_transaction(
         &input.application_id,
         "state:write",
     )?;
+    require_bound_tenant(&headers, &tenant)?;
     let contract = revision_contract(
         &state,
         &principal.key_id,
@@ -7733,6 +7747,13 @@ async fn execute_canonical_transaction(
         &input.revision_id,
         &input.environment,
     )?;
+    if !input.transaction.tenant_id.is_empty() && input.transaction.tenant_id != tenant {
+        return Err(ApiError(StatusCode::FORBIDDEN, json!({
+            "code":"AUTHORITY_SCOPE_MISMATCH",
+            "message":"transaction tenant does not match the bound authority",
+            "http_status":403
+        }).to_string()));
+    }
     input.transaction.tenant_id = tenant.clone();
     input.transaction.application_id = input.application_id.clone();
     input.transaction.revision_id = contract.revision_id.clone();
@@ -15002,8 +15023,8 @@ mod worker_identity_tests {
 
 #[cfg(test)]
 mod authority_gate_tests {
-    use super::{api_error_body, authorize_transaction_collections, state_authorization};
-    use axum::http::StatusCode;
+    use super::{api_error_body, authorize_transaction_collections, require_bound_tenant, state_authorization};
+    use axum::http::{HeaderMap, HeaderValue, StatusCode};
     use feltdb::{
         application::{
             manifest_hash, ApplicationManifest, ApplicationRevision, PolicyDefinition,
@@ -15111,6 +15132,17 @@ mod authority_gate_tests {
         assert!(!allowed);
     }
 
+    #[test]
+    fn bound_tenant_header_fails_closed_on_mismatch() {
+        let mut headers = HeaderMap::new();
+        headers.insert("feltdb-tenant-id", HeaderValue::from_static("tenant-a"));
+        assert!(require_bound_tenant(&headers, "tenant-a").is_ok());
+        let error = require_bound_tenant(&headers, "tenant-b").unwrap_err();
+        assert_eq!(error.0, StatusCode::FORBIDDEN);
+        let body: serde_json::Value = serde_json::from_str(&error.1).unwrap();
+        assert_eq!(body.get("code").and_then(serde_json::Value::as_str), Some("AUTHORITY_SCOPE_MISMATCH"));
+    }
+
     #[test]
     fn every_forbidden_error_uses_the_canonical_wire_contract() {
         for internal_message in [

package/package.json

@@ -2,7 +2,7 @@
   "name": "create-feltdb",
   "private": false,
   "description": "Create a new FeltDB application with one command",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "license": "MIT",
   "bin": {
     "create-feltdb": "bin/create-feltdb.js"