domainforge 0.13.0

package/domainforge-core/src/authority/compiler.rs

@@ -0,0 +1,309 @@
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+use super::error::AuthorityError;
+use super::policy::*;
+use super::types::*;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CompatibilityExpression {
+    pub expression: String,
+    pub location: Option<String>,
+}
+
+pub struct PolicyCompiler {
+    semantics_version: String,
+    compatibility_version: String,
+}
+
+impl PolicyCompiler {
+    pub fn new(semantics_version: String, compatibility_version: String) -> Self {
+        Self {
+            semantics_version,
+            compatibility_version,
+        }
+    }
+
+    pub fn compile(
+        &self,
+        raw_policies: Vec<RawPolicy>,
+    ) -> Result<Vec<AuthorityPolicy>, AuthorityError> {
+        let mut compiled = Vec::new();
+        for raw in raw_policies {
+            let policy = self.compile_one(raw)?;
+            compiled.push(policy);
+        }
+        Ok(compiled)
+    }
+
+    pub fn semantics_version(&self) -> &str {
+        &self.semantics_version
+    }
+
+    pub fn compatibility_version(&self) -> &str {
+        &self.compatibility_version
+    }
+
+    fn compile_one(&self, raw: RawPolicy) -> Result<AuthorityPolicy, AuthorityError> {
+        let applies_to = self.parse_structural_predicates(&raw.applies_to)?;
+        let when = if raw.when.is_empty() {
+            None
+        } else {
+            Some(self.parse_condition_predicates(&raw.when)?)
+        };
+        let requires_fact = self.parse_fact_requirements(&raw.requires_fact)?;
+
+        Ok(AuthorityPolicy {
+            policy_id: raw.policy_id,
+            modality: raw.modality,
+            priority: raw.priority,
+            applies_to,
+            when,
+            requires_fact,
+            semantics_version: self.semantics_version.clone(),
+            override_spec: raw.override_spec,
+            obligation_spec: raw.obligation_spec,
+            description: raw.description,
+            evidence_ref: raw.evidence_ref,
+        })
+    }
+
+    fn parse_structural_predicates(
+        &self,
+        raw: &HashMap<String, serde_json::Value>,
+    ) -> Result<StructuralPredicates, AuthorityError> {
+        for key in raw.keys() {
+            validate_fact_path(key)?;
+        }
+        Ok(StructuralPredicates {
+            predicates: raw.clone(),
+        })
+    }
+
+    fn parse_condition_predicates(
+        &self,
+        raw: &HashMap<String, serde_json::Value>,
+    ) -> Result<ConditionPredicates, AuthorityError> {
+        for key in raw.keys() {
+            validate_fact_path(key)?;
+        }
+        Ok(ConditionPredicates {
+            conditions: raw.clone(),
+        })
+    }
+
+    fn parse_fact_requirements(
+        &self,
+        raw: &[RawFactRequirement],
+    ) -> Result<Vec<FactRequirement>, AuthorityError> {
+        let mut requirements = Vec::new();
+        for req in raw {
+            validate_fact_path(&req.fact_path)?;
+            requirements.push(FactRequirement {
+                fact_path: req.fact_path.clone(),
+                allowed_source_classes: req.allowed_source_classes.clone(),
+                allowed_source_ids: req.allowed_source_ids.clone().unwrap_or_default(),
+                max_age: req
+                    .max_age
+                    .as_ref()
+                    .map(|s| parse_duration(s))
+                    .transpose()?,
+                evidence_ref_required: req.evidence_ref_required.unwrap_or(false),
+                signature_required: req.signature_required.unwrap_or(false),
+                minimum_confidence: req.minimum_confidence,
+                required_transform: req.required_transform.clone(),
+                derived_from_source: req.derived_from_source.clone(),
+            });
+        }
+        Ok(requirements)
+    }
+}
+
+fn parse_duration(s: &str) -> Result<chrono::Duration, AuthorityError> {
+    let s = s.trim();
+    let seconds = if s.ends_with('s') {
+        s.trim_end_matches('s').parse::<i64>().ok()
+    } else if s.ends_with('m') {
+        s.trim_end_matches('m').parse::<i64>().ok().map(|v| v * 60)
+    } else if s.ends_with('h') {
+        s.trim_end_matches('h')
+            .parse::<i64>()
+            .ok()
+            .map(|v| v * 3600)
+    } else if s.ends_with('d') {
+        s.trim_end_matches('d')
+            .parse::<i64>()
+            .ok()
+            .map(|v| v * 86400)
+    } else {
+        s.parse::<i64>().ok().map(|v| v * 3600) // default hours
+    };
+    seconds
+        .map(chrono::Duration::seconds)
+        .ok_or_else(|| AuthorityError::invalid_environment(format!("Invalid duration: '{}'", s)))
+}
+
+pub struct CompatibilityLoweringAuditor {
+    version: String,
+}
+
+impl CompatibilityLoweringAuditor {
+    pub fn new(version: String) -> Result<Self, AuthorityError> {
+        if version.trim().is_empty() {
+            return Err(AuthorityError::invalid_environment(
+                "Compatibility lowering version is required",
+            ));
+        }
+
+        Ok(Self { version })
+    }
+
+    pub fn version(&self) -> &str {
+        &self.version
+    }
+
+    pub fn audit_expression(&self, expr: &str) -> Result<Option<LoweredPolicy>, AuthorityError> {
+        let expr_lc = expr.to_lowercase();
+
+        // Reject all structural OR as ambiguous (spec §14.1.7, §17.7)
+        if expr_lc.contains(" or ") {
+            return Err(AuthorityError::ambiguous_lowering(expr));
+        }
+
+        // Handle negated conditions: `not X = "Y"` lowers to when condition
+        // Reject negative structural predicates (spec §14.1.7)
+        if let Some(inner) = expr_lc.strip_prefix("not ") {
+            let inner_trimmed = inner.trim();
+            // Reject if the negated expression targets structural keys
+            if inner_trimmed.starts_with("resource.")
+                || inner_trimmed.starts_with("actor.")
+                || inner_trimmed.starts_with("action")
+            {
+                return Err(AuthorityError::ambiguous_lowering(expr));
+            }
+            // Lower `not fact.path = "value"` to when condition with negated comparison
+            if let Some(eq_pos) = inner_trimmed.find(" = ") {
+                let key = expr[4..][..eq_pos].trim().to_string();
+                let val = expr[4..][eq_pos + 3..].trim().trim_matches('"').to_string();
+                return Ok(Some(LoweredPolicy {
+                    original: expr.to_string(),
+                    lowered_applies_to: HashMap::new(),
+                    lowered_when: {
+                        let mut m = HashMap::new();
+                        m.insert(key, serde_json::json!({"__neq": val}));
+                        m
+                    },
+                }));
+            }
+            return Err(AuthorityError::ambiguous_lowering(expr));
+        }
+
+        if expr_lc.contains(" and ") {
+            // Split on case-insensitive " and " boundaries
+            let mut parts: Vec<&str> = Vec::new();
+            let mut last = 0;
+            let lc_bytes = expr_lc.as_bytes();
+            let pattern = b" and ";
+            let plen = pattern.len();
+            for i in 0..=lc_bytes.len().saturating_sub(plen) {
+                if &lc_bytes[i..i + plen] == pattern {
+                    parts.push(&expr[last..i]);
+                    last = i + plen;
+                }
+            }
+            parts.push(&expr[last..]);
+            let mut applies_to = HashMap::new();
+            let mut when = HashMap::new();
+            for part in parts {
+                let trimmed = part.trim();
+                let trimmed_lc = trimmed.to_lowercase();
+                if trimmed_lc.starts_with("resource.")
+                    || trimmed_lc.starts_with("actor.")
+                    || trimmed_lc.starts_with("action")
+                {
+                    if let Some((k, v)) = parse_equality(trimmed) {
+                        applies_to.insert(k, v);
+                    }
+                } else if let Some((k, v)) = parse_equality(trimmed) {
+                    when.insert(k, v);
+                }
+            }
+            return Ok(Some(LoweredPolicy {
+                original: expr.to_string(),
+                lowered_applies_to: applies_to,
+                lowered_when: when,
+            }));
+        }
+
+        if let Some((k, v)) = parse_equality(expr) {
+            let mut applies_to = HashMap::new();
+            applies_to.insert(k, v);
+            return Ok(Some(LoweredPolicy {
+                original: expr.to_string(),
+                lowered_applies_to: applies_to,
+                lowered_when: HashMap::new(),
+            }));
+        }
+
+        Ok(None)
+    }
+}
+
+fn parse_equality(s: &str) -> Option<(String, serde_json::Value)> {
+    let s = s.trim();
+    if let Some(eq_pos) = s.find(" = ") {
+        let key = s[..eq_pos].trim().to_string();
+        let val = s[eq_pos + 3..].trim().trim_matches('"').to_string();
+        Some((key, serde_json::Value::String(val)))
+    } else {
+        None
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct LoweredPolicy {
+    pub original: String,
+    pub lowered_applies_to: HashMap<String, serde_json::Value>,
+    pub lowered_when: HashMap<String, serde_json::Value>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RawPolicy {
+    pub policy_id: String,
+    pub modality: PolicyModality,
+    pub priority: i32,
+    #[serde(default)]
+    pub applies_to: HashMap<String, serde_json::Value>,
+    #[serde(default)]
+    pub when: HashMap<String, serde_json::Value>,
+    #[serde(default)]
+    pub requires_fact: Vec<RawFactRequirement>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub override_spec: Option<OverrideSpec>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub obligation_spec: Option<ObligationSpec>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub evidence_ref: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RawFactRequirement {
+    pub fact_path: String,
+    pub allowed_source_classes: Vec<SourceClass>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allowed_source_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_age: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub evidence_ref_required: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub signature_required: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub minimum_confidence: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub required_transform: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub derived_from_source: Option<Vec<SourceClass>>,
+}

package/domainforge-core/src/authority/environment.rs

@@ -0,0 +1,203 @@
+use serde::{Deserialize, Serialize};
+
+use super::compiler::{CompatibilityLoweringAuditor, PolicyCompiler};
+use super::error::{AuthorityError, AuthorityErrorCode};
+use super::fact_resolver::{FactResolver, FactSourceRegistry};
+use super::pack::AuthorityPack;
+use super::resolver::AuthorityResolver;
+use super::trace::{AuthorityTrace, AuthorityTraceEmitter, EvidenceSink};
+use super::transform::{DerivedFactEngine, FactTransformRegistry};
+use super::types::*;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthorityEnvironmentConfig {
+    pub resolver_semantics_version: String,
+    pub specificity_profile: SpecificityProfile,
+    pub unknown_handling: UnknownHandlingConfig,
+    pub fact_sources: Vec<FactSource>,
+    pub fact_transforms: Vec<FactTransform>,
+    pub authority_packs: Vec<serde_json::Value>,
+    pub strict_mode: bool,
+    pub compatibility_lowering_version: String,
+    pub resolver_version: String,
+}
+
+pub struct AuthorityEnvironment {
+    config: AuthorityEnvironmentConfig,
+    source_registry: FactSourceRegistry,
+    transform_registry: FactTransformRegistry,
+    loaded_packs: Vec<AuthorityPack>,
+    compiler: PolicyCompiler,
+    compatibility_auditor: CompatibilityLoweringAuditor,
+    resolver: AuthorityResolver,
+    trace_emitter: AuthorityTraceEmitter,
+    validated: bool,
+}
+
+impl AuthorityEnvironment {
+    pub fn new(config: AuthorityEnvironmentConfig) -> Result<Self, AuthorityError> {
+        let mut source_registry = FactSourceRegistry::new();
+        for source in &config.fact_sources {
+            source_registry.register(source.clone())?;
+        }
+
+        let mut transform_registry = FactTransformRegistry::new();
+        for transform in &config.fact_transforms {
+            transform_registry.register(transform.clone())?;
+        }
+
+        let mut loaded_packs = Vec::new();
+        for pack_value in &config.authority_packs {
+            let pack: AuthorityPack = serde_json::from_value(pack_value.clone()).map_err(|e| {
+                AuthorityError::new(
+                    AuthorityErrorCode::InvalidPolicyPack,
+                    format!("Failed to parse pack: {}", e),
+                )
+            })?;
+            pack.validate()?;
+            pack.validate_semantics_version(&config.resolver_semantics_version)?;
+            loaded_packs.push(pack);
+        }
+
+        let compiler = PolicyCompiler::new(
+            config.resolver_semantics_version.clone(),
+            config.compatibility_lowering_version.clone(),
+        );
+        let compatibility_auditor =
+            CompatibilityLoweringAuditor::new(config.compatibility_lowering_version.clone())?;
+        let resolver = AuthorityResolver::new(
+            config.unknown_handling.clone(),
+            config.specificity_profile.clone(),
+            config.strict_mode,
+            config.resolver_semantics_version.clone(),
+            config.compatibility_lowering_version.clone(),
+        );
+        let trace_emitter = AuthorityTraceEmitter::new(
+            config.resolver_version.clone(),
+            config.resolver_semantics_version.clone(),
+            config.compatibility_lowering_version.clone(),
+            EvidenceSink::Memory,
+        );
+
+        Ok(Self {
+            config,
+            source_registry,
+            transform_registry,
+            loaded_packs,
+            compiler,
+            compatibility_auditor,
+            resolver,
+            trace_emitter,
+            validated: false,
+        })
+    }
+
+    pub fn validate(&mut self) -> Result<(), AuthorityError> {
+        self.source_registry.validate()?;
+        self.transform_registry.validate()?;
+
+        if self.compiler.semantics_version() != self.config.resolver_semantics_version {
+            return Err(AuthorityError::invalid_environment(format!(
+                "Compiler semantics version '{}' does not match resolver semantics version '{}'",
+                self.compiler.semantics_version(),
+                self.config.resolver_semantics_version
+            )));
+        }
+        if self.compiler.compatibility_version() != self.config.compatibility_lowering_version {
+            return Err(AuthorityError::invalid_environment(format!(
+                "Compiler compatibility version '{}' does not match configured compatibility lowering version '{}'",
+                self.compiler.compatibility_version(),
+                self.config.compatibility_lowering_version
+            )));
+        }
+        if self.compatibility_auditor.version() != self.config.compatibility_lowering_version {
+            return Err(AuthorityError::invalid_environment(format!(
+                "Compatibility auditor version '{}' does not match configured compatibility lowering version '{}'",
+                self.compatibility_auditor.version(),
+                self.config.compatibility_lowering_version
+            )));
+        }
+        self.resolver.validate_versions(
+            &self.config.resolver_semantics_version,
+            &self.config.compatibility_lowering_version,
+        )?;
+
+        for pack in &self.loaded_packs {
+            if pack.required_specificity_profile != self.config.specificity_profile.id
+                && self.config.strict_mode
+            {
+                return Err(AuthorityError::conflicting_specificity_profile(
+                    &pack.id,
+                    &self.config.specificity_profile.id,
+                ));
+            }
+        }
+
+        self.config.unknown_handling.validate()?;
+        self.validated = true;
+        Ok(())
+    }
+
+    pub fn evaluate(
+        &self,
+        request: &AuthorityRequest,
+        provided_facts: &[FactEnvelope],
+    ) -> Result<(AuthorityTrace, AuthorityDecision), AuthorityError> {
+        if !self.validated {
+            return Err(AuthorityError::invalid_environment(
+                "Environment not validated. Call validate() first.",
+            ));
+        }
+
+        request.validate()?;
+
+        let fact_resolver = FactResolver::new(self.source_registry.clone());
+        let now = chrono::Utc::now();
+        let raw_facts = fact_resolver.wrap_context_as_caller_supplied(&request.context, now);
+        let (all_facts, trust_decisions) =
+            fact_resolver.resolve_trusted_facts(&raw_facts, provided_facts, now);
+
+        let transform_keys: Vec<String> = self
+            .config
+            .fact_transforms
+            .iter()
+            .map(|t| format!("{}@{}", t.id, t.version))
+            .collect();
+        let derived_engine = DerivedFactEngine::new(self.transform_registry.clone());
+        let (derived_facts, derived_lineages) =
+            derived_engine.compute_derived_facts(&all_facts, &transform_keys)?;
+
+        let mut all_resolved_facts = all_facts;
+        all_resolved_facts.extend(derived_facts);
+
+        let resolver_output = self.resolver.resolve(
+            request,
+            &self.loaded_packs,
+            &all_resolved_facts,
+            &trust_decisions,
+            &derived_lineages,
+        )?;
+
+        let compat_decisions = vec![];
+
+        self.trace_emitter.emit(
+            request,
+            &self.loaded_packs,
+            &all_resolved_facts,
+            &trust_decisions,
+            &derived_lineages,
+            &resolver_output,
+            &self.config.specificity_profile,
+            &self.config.unknown_handling,
+            &compat_decisions,
+        )
+    }
+
+    pub fn packs(&self) -> &[AuthorityPack] {
+        &self.loaded_packs
+    }
+
+    pub fn config(&self) -> &AuthorityEnvironmentConfig {
+        &self.config
+    }
+}

package/domainforge-core/src/authority/error.rs

@@ -0,0 +1,164 @@
+use serde::{Deserialize, Serialize};
+use std::fmt;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub enum AuthorityErrorCode {
+    InvalidAuthorityEnvironment,
+    InvalidPolicyPack,
+    FactTrustViolation,
+    SourceUnavailable,
+    InvalidTransform,
+    SpecificityConflict,
+    AmbiguousCompatibilityLowering,
+    TracePersistenceFailure,
+    MissingConfigError,
+    ParseError,
+    SchemaError,
+    UnsupportedKindError,
+    MissingCredentialError,
+    PolicyParseError,
+    PolicyEvaluationError,
+    InvalidReloadError,
+    ConflictingSpecificityProfileError,
+    InvalidFactSourceError,
+    InvalidTransformError,
+    ResolverSemanticsHashMismatch,
+    PackHashMismatch,
+    InvalidRequest,
+    ConflictResolutionError,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthorityError {
+    pub code: AuthorityErrorCode,
+    pub message: String,
+    pub recoverable: bool,
+    pub recoverability_hint: Option<String>,
+    pub context: serde_json::Value,
+}
+
+impl AuthorityError {
+    pub fn new(code: AuthorityErrorCode, message: impl Into<String>) -> Self {
+        Self {
+            code,
+            message: message.into(),
+            recoverable: false,
+            recoverability_hint: None,
+            context: serde_json::json!({}),
+        }
+    }
+
+    pub fn recoverable(mut self) -> Self {
+        self.recoverable = true;
+        self
+    }
+
+    pub fn with_hint(mut self, hint: impl Into<String>) -> Self {
+        self.recoverability_hint = Some(hint.into());
+        self
+    }
+
+    pub fn with_context(mut self, ctx: serde_json::Value) -> Self {
+        self.context = ctx;
+        self
+    }
+
+    pub fn missing_config(field: &str) -> Self {
+        Self::new(
+            AuthorityErrorCode::MissingConfigError,
+            format!("Missing required config: {}", field),
+        )
+    }
+
+    pub fn invalid_environment(msg: impl Into<String>) -> Self {
+        Self::new(AuthorityErrorCode::InvalidAuthorityEnvironment, msg)
+    }
+
+    pub fn fact_trust_violation(fact_path: &str, reason: &str) -> Self {
+        Self::new(
+            AuthorityErrorCode::FactTrustViolation,
+            format!("Fact trust violation for '{}': {}", fact_path, reason),
+        )
+    }
+
+    pub fn source_unavailable(source_id: &str, reason: &str) -> Self {
+        Self::new(
+            AuthorityErrorCode::SourceUnavailable,
+            format!("Fact source '{}' unavailable: {}", source_id, reason),
+        )
+        .recoverable()
+        .with_hint(format!("Check upstream {} availability", source_id))
+    }
+
+    pub fn invalid_transform(id: &str, reason: &str) -> Self {
+        Self::new(
+            AuthorityErrorCode::InvalidTransform,
+            format!("Transform '{}' invalid: {}", id, reason),
+        )
+    }
+
+    pub fn specificity_conflict(policy_a: &str, policy_b: &str) -> Self {
+        Self::new(
+            AuthorityErrorCode::SpecificityConflict,
+            format!(
+                "Incomparable specificity between '{}' and '{}'",
+                policy_a, policy_b
+            ),
+        )
+    }
+
+    pub fn ambiguous_lowering(expr: &str) -> Self {
+        Self::new(
+            AuthorityErrorCode::AmbiguousCompatibilityLowering,
+            format!(
+                "Ambiguous compatibility expression cannot be safely lowered: {}",
+                expr
+            ),
+        )
+    }
+
+    pub fn trace_persistence_failure(reason: &str) -> Self {
+        Self::new(
+            AuthorityErrorCode::TracePersistenceFailure,
+            format!("Trace persistence failed: {}", reason),
+        )
+        .recoverable()
+        .with_hint("Check evidence sink availability and retry")
+    }
+
+    pub fn conflicting_specificity_profile(pack_a: &str, pack_b: &str) -> Self {
+        Self::new(
+            AuthorityErrorCode::ConflictingSpecificityProfileError,
+            format!(
+                "Packs '{}' and '{}' require incompatible specificity profiles",
+                pack_a, pack_b
+            ),
+        )
+    }
+
+    pub fn pack_hash_mismatch(pack_id: &str) -> Self {
+        Self::new(
+            AuthorityErrorCode::PackHashMismatch,
+            format!("Pack '{}' hash mismatch", pack_id),
+        )
+    }
+
+    pub fn semantics_hash_mismatch() -> Self {
+        Self::new(
+            AuthorityErrorCode::ResolverSemanticsHashMismatch,
+            "Resolver semantics hash mismatch",
+        )
+    }
+
+    pub fn invalid_request(msg: impl Into<String>) -> Self {
+        Self::new(AuthorityErrorCode::InvalidRequest, msg)
+    }
+}
+
+impl fmt::Display for AuthorityError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "[{:?}] {}", self.code, self.message)
+    }
+}
+
+impl std::error::Error for AuthorityError {}