domainforge 0.13.0

package/domainforge-core/src/authority/fact_resolver.rs

@@ -0,0 +1,224 @@
+use chrono::Utc;
+use indexmap::IndexMap;
+use serde::{Deserialize, Serialize};
+
+use super::error::AuthorityError;
+use super::types::*;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct FactSourceRegistry {
+    pub sources: IndexMap<String, FactSource>,
+}
+
+impl FactSourceRegistry {
+    pub fn new() -> Self {
+        Self {
+            sources: IndexMap::new(),
+        }
+    }
+
+    pub fn register(&mut self, source: FactSource) -> Result<(), AuthorityError> {
+        if source.id.is_empty() {
+            return Err(AuthorityError::new(
+                super::error::AuthorityErrorCode::InvalidFactSourceError,
+                "Fact source id is required",
+            ));
+        }
+        self.sources.insert(source.id.clone(), source);
+        Ok(())
+    }
+
+    pub fn get(&self, id: &str) -> Option<&FactSource> {
+        self.sources.get(id)
+    }
+
+    pub fn validate(&self) -> Result<(), AuthorityError> {
+        for source in self.sources.values() {
+            if source.allowed_paths.is_empty() {
+                return Err(AuthorityError::new(
+                    super::error::AuthorityErrorCode::InvalidFactSourceError,
+                    format!("Source '{}' must declare allowed_paths", source.id),
+                ));
+            }
+        }
+        Ok(())
+    }
+}
+
+impl Default for FactSourceRegistry {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+pub struct FactResolver {
+    registry: FactSourceRegistry,
+}
+
+impl FactResolver {
+    pub fn new(registry: FactSourceRegistry) -> Self {
+        Self { registry }
+    }
+
+    pub fn wrap_context_as_caller_supplied(
+        &self,
+        context: &serde_json::Value,
+        observed_at: chrono::DateTime<Utc>,
+    ) -> Vec<FactEnvelope> {
+        let mut envelopes = Vec::new();
+        if let Some(obj) = context.as_object() {
+            Self::flatten_context(obj, "", observed_at, &mut envelopes);
+        }
+        envelopes
+    }
+
+    fn flatten_context(
+        obj: &serde_json::Map<String, serde_json::Value>,
+        prefix: &str,
+        observed_at: chrono::DateTime<Utc>,
+        envelopes: &mut Vec<FactEnvelope>,
+    ) {
+        for (key, value) in obj {
+            let path = if prefix.is_empty() {
+                key.clone()
+            } else {
+                format!("{}.{}", prefix, key)
+            };
+            match value {
+                serde_json::Value::Object(inner) => {
+                    Self::flatten_context(inner, &path, observed_at, envelopes);
+                }
+                _ => {
+                    envelopes.push(FactEnvelope {
+                        path,
+                        value: value.clone(),
+                        source_class: SourceClass::CallerSupplied,
+                        source_id: "caller".to_string(),
+                        observed_at,
+                        expires_at: None,
+                        evidence_ref: None,
+                        signature: None,
+                        confidence: None,
+                        lineage: None,
+                    });
+                }
+            }
+        }
+    }
+
+    pub fn resolve_trusted_facts(
+        &self,
+        raw_facts: &[FactEnvelope],
+        provided_trusted: &[FactEnvelope],
+        now: chrono::DateTime<Utc>,
+    ) -> (Vec<FactEnvelope>, Vec<FactTrustDecision>) {
+        let mut resolved = raw_facts.to_vec();
+        let mut trust_decisions = Vec::new();
+
+        for fact in provided_trusted {
+            let source_id = &fact.source_id;
+            let _source_class = &fact.source_class;
+            let is_registered = self.registry.sources.contains_key(source_id);
+
+            if !is_registered {
+                trust_decisions.push(FactTrustDecision {
+                    fact_path: fact.path.clone(),
+                    required_sources: vec![],
+                    observed_source: fact.source_class,
+                    trusted: false,
+                    reason: "unregistered_source".to_string(),
+                    evidence_ref: fact.evidence_ref.clone(),
+                });
+                continue;
+            }
+
+            let source = self.registry.get(source_id).unwrap();
+
+            // Verify source_class matches the registry entry's declared class
+            if fact.source_class != source.source_class {
+                trust_decisions.push(FactTrustDecision {
+                    fact_path: fact.path.clone(),
+                    required_sources: vec![source.source_class],
+                    observed_source: fact.source_class,
+                    trusted: false,
+                    reason: "source_class_mismatch".to_string(),
+                    evidence_ref: fact.evidence_ref.clone(),
+                });
+                continue;
+            }
+            let path_allowed = source.allowed_paths.iter().any(|allowed_path| {
+                fact.path == *allowed_path
+                    || if allowed_path.ends_with('.') {
+                        fact.path.starts_with(allowed_path)
+                    } else {
+                        fact.path.starts_with(&format!("{}.", allowed_path))
+                    }
+            });
+
+            if !path_allowed {
+                trust_decisions.push(FactTrustDecision {
+                    fact_path: fact.path.clone(),
+                    required_sources: vec![source.source_class],
+                    observed_source: fact.source_class,
+                    trusted: false,
+                    reason: "path_not_allowed".to_string(),
+                    evidence_ref: fact.evidence_ref.clone(),
+                });
+                continue;
+            }
+
+            if source.evidence_required && fact.evidence_ref.is_none() {
+                trust_decisions.push(FactTrustDecision {
+                    fact_path: fact.path.clone(),
+                    required_sources: vec![source.source_class],
+                    observed_source: fact.source_class,
+                    trusted: false,
+                    reason: "missing_evidence_ref".to_string(),
+                    evidence_ref: None,
+                });
+                continue;
+            }
+
+            if source.signature_required && fact.signature.is_none() {
+                trust_decisions.push(FactTrustDecision {
+                    fact_path: fact.path.clone(),
+                    required_sources: vec![source.source_class],
+                    observed_source: fact.source_class,
+                    trusted: false,
+                    reason: "missing_signature".to_string(),
+                    evidence_ref: fact.evidence_ref.clone(),
+                });
+                continue;
+            }
+
+            if !fact.is_fresh(now) {
+                trust_decisions.push(FactTrustDecision {
+                    fact_path: fact.path.clone(),
+                    required_sources: vec![source.source_class],
+                    observed_source: fact.source_class,
+                    trusted: false,
+                    reason: "stale_fact".to_string(),
+                    evidence_ref: fact.evidence_ref.clone(),
+                });
+                continue;
+            }
+
+            trust_decisions.push(FactTrustDecision {
+                fact_path: fact.path.clone(),
+                required_sources: vec![source.source_class],
+                observed_source: fact.source_class,
+                trusted: true,
+                reason: "trusted".to_string(),
+                evidence_ref: fact.evidence_ref.clone(),
+            });
+
+            if let Some(pos) = resolved.iter().position(|f| f.path == fact.path) {
+                resolved[pos] = fact.clone();
+            } else {
+                resolved.push(fact.clone());
+            }
+        }
+
+        (resolved, trust_decisions)
+    }
+}

package/domainforge-core/src/authority/mod.rs

@@ -0,0 +1,25 @@
+pub mod compiler;
+pub mod environment;
+pub mod error;
+pub mod fact_resolver;
+pub mod pack;
+pub mod policy;
+pub mod resolver;
+pub mod trace;
+pub mod transform;
+pub mod types;
+
+pub use compiler::{
+    CompatibilityLoweringAuditor, LoweredPolicy, PolicyCompiler, RawFactRequirement, RawPolicy,
+};
+pub use environment::{AuthorityEnvironment, AuthorityEnvironmentConfig};
+pub use error::{AuthorityError, AuthorityErrorCode};
+pub use fact_resolver::{FactResolver, FactSourceRegistry};
+pub use pack::{compute_pack_hash, AuthorityPack};
+pub use policy::{
+    AuthorityPolicy, ConditionPredicates, ObligationSpec, OverrideSpec, StructuralPredicates,
+};
+pub use resolver::AuthorityResolver;
+pub use trace::{AuthorityTrace, AuthorityTraceEmitter, EvidenceSink};
+pub use transform::{DerivedFactEngine, FactTransformRegistry};
+pub use types::*;

package/domainforge-core/src/authority/pack.rs

@@ -0,0 +1,133 @@
+use serde::{Deserialize, Serialize};
+
+use super::error::AuthorityError;
+use super::policy::AuthorityPolicy;
+use super::types::*;
+
+#[derive(Serialize)]
+struct PackHashPayload<'a> {
+    id: &'a str,
+    version: &'a str,
+    semantics_version: &'a str,
+    required_specificity_profile: &'a str,
+    policies: &'a [AuthorityPolicy],
+}
+
+pub fn compute_pack_hash(
+    id: &str,
+    version: &str,
+    semantics_version: &str,
+    required_specificity_profile: &str,
+    policies: &[AuthorityPolicy],
+) -> Result<String, AuthorityError> {
+    let payload = PackHashPayload {
+        id,
+        version,
+        semantics_version,
+        required_specificity_profile,
+        policies,
+    };
+
+    let canonical = serde_json::to_string(&payload).map_err(|e| {
+        AuthorityError::new(
+            super::error::AuthorityErrorCode::InvalidPolicyPack,
+            format!(
+                "Failed to serialize pack '{}' for hash computation: {}",
+                id, e
+            ),
+        )
+    })?;
+    Ok(compute_deterministic_hash(&canonical))
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthorityPack {
+    pub id: String,
+    pub version: String,
+    pub semantics_version: String,
+    pub required_specificity_profile: String,
+    pub policies: Vec<AuthorityPolicy>,
+    pub hash: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub signature: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub owner: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub approved_by: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub evidence_ref: Option<String>,
+}
+
+impl AuthorityPack {
+    pub fn validate(&self) -> Result<(), AuthorityError> {
+        if self.id.is_empty() {
+            return Err(AuthorityError::new(
+                super::error::AuthorityErrorCode::InvalidPolicyPack,
+                "Pack id is required",
+            ));
+        }
+        if self.version.is_empty() {
+            return Err(AuthorityError::new(
+                super::error::AuthorityErrorCode::InvalidPolicyPack,
+                format!("Pack '{}' version is required", self.id),
+            ));
+        }
+
+        for policy in &self.policies {
+            policy.validate()?;
+        }
+
+        Ok(())
+    }
+
+    pub fn validate_hash(&self) -> Result<(), AuthorityError> {
+        if self.hash.is_empty() {
+            return Err(AuthorityError::new(
+                super::error::AuthorityErrorCode::InvalidPolicyPack,
+                format!("Pack '{}' hash is required", self.id),
+            ));
+        }
+
+        let payload = PackHashPayload {
+            id: &self.id,
+            version: &self.version,
+            semantics_version: &self.semantics_version,
+            required_specificity_profile: &self.required_specificity_profile,
+            policies: &self.policies,
+        };
+
+        let canonical = serde_json::to_string(&payload).map_err(|e| {
+            AuthorityError::new(
+                super::error::AuthorityErrorCode::InvalidPolicyPack,
+                format!(
+                    "Pack '{}' failed to serialize for hash validation: {}",
+                    self.id, e
+                ),
+            )
+        })?;
+        let computed = compute_deterministic_hash(&canonical);
+        if self.hash != computed {
+            return Err(AuthorityError::pack_hash_mismatch(&self.id));
+        }
+        Ok(())
+    }
+
+    pub fn validate_semantics_version(&self, supported: &str) -> Result<(), AuthorityError> {
+        if self.semantics_version != supported {
+            return Err(AuthorityError::new(
+                super::error::AuthorityErrorCode::InvalidPolicyPack,
+                format!(
+                    "Pack '{}' requires semantics '{}' but '{}' is supported",
+                    self.id, self.semantics_version, supported
+                ),
+            ));
+        }
+        Ok(())
+    }
+
+    pub fn identity_key(&self) -> String {
+        format!("{}@{}#{}", self.id, self.version, self.hash)
+    }
+}

package/domainforge-core/src/authority/policy.rs

@@ -0,0 +1,224 @@
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+use super::error::AuthorityError;
+use super::types::*;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthorityPolicy {
+    pub policy_id: String,
+    pub modality: PolicyModality,
+    pub priority: i32,
+    pub applies_to: StructuralPredicates,
+    #[serde(default)]
+    pub when: Option<ConditionPredicates>,
+    #[serde(default)]
+    pub requires_fact: Vec<FactRequirement>,
+    pub semantics_version: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub override_spec: Option<OverrideSpec>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub obligation_spec: Option<ObligationSpec>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub evidence_ref: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct StructuralPredicates {
+    #[serde(flatten)]
+    pub predicates: HashMap<String, serde_json::Value>,
+}
+
+impl StructuralPredicates {
+    pub fn matches(&self, request: &AuthorityRequest) -> bool {
+        for (key, expected) in &self.predicates {
+            let actual = match key.as_str() {
+                "action" => serde_json::Value::String(request.operation.clone()),
+                "actor.id" => serde_json::Value::String(request.actor.id.clone()),
+                "actor.role" => request
+                    .actor
+                    .role
+                    .as_ref()
+                    .map(|r| serde_json::Value::String(r.clone()))
+                    .unwrap_or(serde_json::Value::Null),
+                "resource.id" => request
+                    .resource
+                    .id
+                    .as_ref()
+                    .map(|r| serde_json::Value::String(r.clone()))
+                    .unwrap_or(serde_json::Value::Null),
+                "resource.type" => request
+                    .resource
+                    .type_
+                    .as_ref()
+                    .map(|r| serde_json::Value::String(r.clone()))
+                    .unwrap_or(serde_json::Value::Null),
+                _ => request
+                    .metadata
+                    .get(key)
+                    .cloned()
+                    .unwrap_or(serde_json::Value::Null),
+            };
+            if *expected != actual {
+                return false;
+            }
+        }
+        true
+    }
+
+    pub fn specificity_score(&self, profile: &SpecificityProfile) -> SpecificityVector {
+        let mut dims = Vec::new();
+        for dim_name in &profile.dimensions {
+            let score = self
+                .predicates
+                .iter()
+                .filter(|(k, _)| *k == dim_name || k.starts_with(&format!("{}.", dim_name)))
+                .count() as u32;
+            dims.push((dim_name.clone(), score));
+        }
+        SpecificityVector::new(dims)
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ConditionPredicates {
+    #[serde(flatten)]
+    pub conditions: HashMap<String, serde_json::Value>,
+}
+
+impl ConditionPredicates {
+    pub fn evaluate(&self, facts: &[FactEnvelope]) -> Result<ThreeValuedResult, AuthorityError> {
+        if self.conditions.is_empty() {
+            return Ok(ThreeValuedResult::True);
+        }
+
+        let mut results = Vec::new();
+        for (path, expected) in &self.conditions {
+            let fact = facts.iter().find(|f| f.path == *path);
+            match fact {
+                Some(f) if f.value.is_null() => {
+                    results.push(ThreeValuedResult::Unknown);
+                }
+                Some(f) => {
+                    if let Some(obj) = expected.as_object() {
+                        if let Some(neq) = obj.get("__neq") {
+                            results.push(if &f.value != neq {
+                                ThreeValuedResult::True
+                            } else {
+                                ThreeValuedResult::False
+                            });
+                            continue;
+                        }
+                    }
+
+                    if &f.value == expected {
+                        results.push(ThreeValuedResult::True);
+                    } else {
+                        results.push(ThreeValuedResult::False);
+                    }
+                }
+                None => {
+                    results.push(ThreeValuedResult::Unknown);
+                }
+            }
+        }
+
+        let all_true = results.iter().all(|r| *r == ThreeValuedResult::True);
+        let any_false = results.contains(&ThreeValuedResult::False);
+        let any_unknown = results.contains(&ThreeValuedResult::Unknown);
+
+        if any_false {
+            Ok(ThreeValuedResult::False)
+        } else if any_unknown {
+            Ok(ThreeValuedResult::Unknown)
+        } else if all_true {
+            Ok(ThreeValuedResult::True)
+        } else {
+            Ok(ThreeValuedResult::Unknown)
+        }
+    }
+
+    pub fn condition_specificity_score(&self, profile: &SpecificityProfile) -> u32 {
+        let condition_dim = "condition";
+        if profile.dimensions.contains(&condition_dim.to_string()) {
+            self.conditions.len() as u32
+        } else {
+            0
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OverrideSpec {
+    pub permits: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ObligationSpec {
+    pub action: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deadline: Option<String>,
+}
+
+impl AuthorityPolicy {
+    pub fn validate(&self) -> Result<(), AuthorityError> {
+        if self.policy_id.is_empty() {
+            return Err(AuthorityError::new(
+                super::error::AuthorityErrorCode::PolicyParseError,
+                "policy_id is required",
+            ));
+        }
+        if self.modality == PolicyModality::Override && self.override_spec.is_none() {
+            return Err(AuthorityError::new(
+                super::error::AuthorityErrorCode::PolicyParseError,
+                format!(
+                    "Override policy '{}' must have override_spec",
+                    self.policy_id
+                ),
+            ));
+        }
+        Ok(())
+    }
+
+    pub fn is_candidate(&self, request: &AuthorityRequest) -> bool {
+        self.applies_to.matches(request)
+    }
+
+    pub fn evaluate_conditions(
+        &self,
+        facts: &[FactEnvelope],
+    ) -> Result<ThreeValuedResult, AuthorityError> {
+        match &self.when {
+            Some(cond) => cond.evaluate(facts),
+            None => Ok(ThreeValuedResult::True),
+        }
+    }
+
+    pub fn check_fact_requirements(
+        &self,
+        facts: &[FactEnvelope],
+        now: &chrono::DateTime<chrono::Utc>,
+    ) -> Vec<(FactRequirement, bool, Option<FactEnvelope>)> {
+        self.requires_fact
+            .iter()
+            .map(|req| {
+                let matched = facts.iter().find(|f| req.is_satisfied_by(f, now));
+                let satisfied = matched.is_some();
+                (req.clone(), satisfied, matched.cloned())
+            })
+            .collect()
+    }
+
+    pub fn compute_specificity(&self, profile: &SpecificityProfile) -> SpecificityVector {
+        let mut dims = self.applies_to.specificity_score(profile).dimensions;
+        if let Some(ref when) = self.when {
+            let cond_idx = dims.iter().position(|(d, _)| d == "condition");
+            if let Some(idx) = cond_idx {
+                dims[idx].1 += when.condition_specificity_score(profile);
+            }
+        }
+        SpecificityVector::new(dims)
+    }
+}