1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
use actionable::{Action, Identifier, ResourceName};
use serde::{Deserialize, Serialize};

use crate::{
    document::{DocumentId, KeyId},
    schema::{CollectionName, ViewName},
};

/// The base BonsaiDb resource namespace. All database objects have this as
/// their first name segment.
#[must_use]
pub fn bonsaidb_resource_name<'a>() -> ResourceName<'a> {
    ResourceName::named("bonsaidb")
}

/// Creates a resource name with the database `name`.
#[must_use]
pub fn database_resource_name<'a>(name: impl Into<Identifier<'a>>) -> ResourceName<'a> {
    bonsaidb_resource_name().and(name)
}

/// Creates a resource name for a `collection` within a `database`.
#[must_use]
pub fn collection_resource_name<'a>(
    database: impl Into<Identifier<'a>>,
    collection: &CollectionName,
) -> ResourceName<'a> {
    database_resource_name(database).and(collection.to_string())
}

/// Creates a resource name for a document `id` within `collection` within `database`.
#[must_use]
pub fn document_resource_name<'a>(
    database: impl Into<Identifier<'a>>,
    collection: &CollectionName,
    id: &'a DocumentId,
) -> ResourceName<'a> {
    collection_resource_name(database, collection)
        .and("document")
        .and(id)
}

/// Creaets a resource name for a `view` within `database`.
#[must_use]
pub fn view_resource_name<'a>(database: &'a str, view: &'a ViewName) -> ResourceName<'a> {
    database_resource_name(database)
        .and(view.collection.to_string())
        .and("view")
        .and(view.name.as_ref())
}

/// Creates a resource name for `PubSub` `topic` within `database`.
#[must_use]
pub fn pubsub_topic_resource_name<'a>(database: &'a str, topic: &'a [u8]) -> ResourceName<'a> {
    database_resource_name(database).and("pubsub").and(topic)
}

/// Creates a resource name for the key-value store in `database`.
#[must_use]
pub fn kv_resource_name(database: &str) -> ResourceName<'_> {
    database_resource_name(database).and("keyvalue")
}

/// Creates a resource name for `key` within `namespace` within the key-value store of `database`.
#[must_use]
pub fn keyvalue_key_resource_name<'a>(
    database: &'a str,
    namespace: Option<&'a str>,
    key: &'a str,
) -> ResourceName<'a> {
    kv_resource_name(database)
        .and(namespace.unwrap_or(""))
        .and(key)
}

/// Creates a resource name for encryption key `key_id`.
#[must_use]
pub fn encryption_key_resource_name(key_id: &KeyId) -> ResourceName<'_> {
    bonsaidb_resource_name()
        .and("vault")
        .and("key")
        .and(match key_id {
            KeyId::Master => "_master",
            KeyId::Id(id) => id.as_ref(),
            KeyId::None => unreachable!(),
        })
}

/// Creates a resource name for `user_id`.
#[must_use]
pub fn user_resource_name<'a>(user_id: u64) -> ResourceName<'a> {
    bonsaidb_resource_name().and("user").and(user_id)
}

/// Creates a resource name for `role_id`.
#[must_use]
pub fn role_resource_name<'a>(role_id: u64) -> ResourceName<'a> {
    bonsaidb_resource_name().and("role").and(role_id)
}

/// Actions that can be permitted within BonsaiDb.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum BonsaiAction {
    /// Actions that operate on a server
    Server(ServerAction),
    /// Actions that operate on a specific database.
    Database(DatabaseAction),
}

/// Actions that operate on a server.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum ServerAction {
    /// Permits connecting to the server. Upon negotiating authentication, the
    /// effective permissions of the connected party will be checked for
    /// permissions to `Connect`. If not allowed, the connection will be
    /// terminated.
    Connect,
    /// Permits [`StorageConnection::list_available_schemas`](crate::connection::StorageConnection::list_available_schemas).
    ListAvailableSchemas,
    /// Permits [`StorageConnection::list_databases`](crate::connection::StorageConnection::list_databases).
    ListDatabases,
    /// Permits [`StorageConnection::create_database`](crate::connection::StorageConnection::create_database).
    CreateDatabase,
    /// Permits [`StorageConnection::delete_database`](crate::connection::StorageConnection::delete_database).
    DeleteDatabase,
    /// Permits [`StorageConnection::create_user`](crate::connection::StorageConnection::create_user).
    CreateUser,
    /// Permits [`StorageConnection::delete_user`](crate::connection::StorageConnection::delete_user).
    DeleteUser,
    /// Permits [`StorageConnection::set_user_password`](crate::connection::StorageConnection::set_user_password).
    SetPassword,
    /// Permits the ability to log in with a password.
    Authenticate(AuthenticationMethod),
    /// Permits the ability to assume an identity without authenticating that
    /// they are the identity in question.
    AssumeIdentity,
    /// Permits [`StorageConnection::add_permission_group_to_user`](crate::connection::StorageConnection::add_permission_group_to_user) and [`StorageConnection::remove_permission_group_from_user`](crate::connection::StorageConnection::remove_permission_group_from_user).
    ModifyUserPermissionGroups,
    /// Permits .
    /// Permits [`StorageConnection::add_role_to_user`](crate::connection::StorageConnection::add_role_to_user) and [`StorageConnection::remove_role_from_user`](crate::connection::StorageConnection::remove_role_from_user).
    ModifyUserRoles,
}

/// Methods for user authentication.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum AuthenticationMethod {
    /// Authenticate the user using password hashing (Argon2).
    PasswordHash,
}

/// Actions that operate on a specific database.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum DatabaseAction {
    /// The ability to compact data to reclaim space.
    Compact,
    /// Actions that operate on a document.
    Document(DocumentAction),
    /// Actions that operate on a view.
    View(ViewAction),
    /// Actions that operate on transactions.
    Transaction(TransactionAction),
    /// Actions that operate on the `PubSub` system.
    PubSub(PubSubAction),
    /// Actions that operate on the key-value store.
    KeyValue(KeyValueAction),
}

/// Actions that operate on a document.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum DocumentAction {
    /// Allows document retrieval through
    /// [`Connection::get()`](crate::connection::LowLevelConnection::get) and
    /// [`Connection::get_multiple()`](crate::connection::LowLevelConnection::get_multiple).
    /// See [`document_resource_name()`] for the format of document resource
    /// names.
    Get,
    /// Allows listing documents through
    /// [`Connection::list()`](crate::connection::LowLevelConnection::list). See
    /// [`collection_resource_name()`] for the format of collection resource
    /// names.
    List,
    /// Allows listing documents through
    /// [`Connection::list_headers()`](crate::connection::LowLevelConnection::list_headers). See
    /// [`collection_resource_name()`] for the format of collection resource
    /// names.
    ListHeaders,
    /// Allows counting documents through
    /// [`Connection::count()`](crate::connection::LowLevelConnection::count). See
    /// [`collection_resource_name()`] for the format of collection resource
    /// names.
    Count,
    /// Allows inserting a document through
    /// [`Connection::apply_transaction()`](crate::connection::LowLevelConnection::apply_transaction).
    /// See [`collection_resource_name()`] for the format of collection resource
    /// names.
    Insert,
    /// Allows updating a document through
    /// [`Connection::apply_transaction()`](crate::connection::LowLevelConnection::apply_transaction).
    /// See [`document_resource_name()`] for the format of document resource
    /// names.
    Update,
    /// Allows overwriting a document by id with
    /// [`Connection::apply_transaction()`](crate::connection::LowLevelConnection::apply_transaction).
    /// No revision information will be checked. See
    /// [`document_resource_name()`] for the format of document resource names.
    Overwrite,
    /// Allows deleting a document through
    /// [`Connection::apply_transaction()`](crate::connection::LowLevelConnection::apply_transaction).
    /// See [`document_resource_name()`] for the format of document resource
    /// names.
    Delete,
}

/// Actions that operate on a view.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum ViewAction {
    /// Allows querying a view with
    /// [`Connection::query()`](crate::connection::LowLevelConnection::query). See
    /// [`view_resource_name`] for the format of view resource names.
    Query,
    /// Allows reducing a view with
    /// [`Connection::reduce()`](crate::connection::LowLevelConnection::reduce). See
    /// [`view_resource_name`] for the format of view resource names.
    Reduce,
    /// Allows deleting associated docs with
    /// [`Connection::delete_docs()`](crate::connection::LowLevelConnection::delete_docs).
    /// See [`view_resource_name`] for the format of view resource names.
    DeleteDocs,
}

/// Actions that operate on transactions.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum TransactionAction {
    /// Allows listing executed transactions with
    /// [`Connection::list_executed_transactions()`](crate::connection::Connection::list_executed_transactions).
    /// This action is checked against the database's resource name. See
    /// [`database_resource_name()`] for the format of database resource names.
    ListExecuted,
    /// Allows retrieving the last executed transaction id with
    /// [`Connection::last_transaction_id()`](crate::connection::Connection::last_transaction_id).
    /// This action is checked against the database's resource name. See
    /// [`database_resource_name()`] for the format of database resource names.
    GetLastId,
}

/// Actions that operate on the `PubSub` system.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum PubSubAction {
    /// Allows creating a subscriber with
    /// [`PubSub::create_subscriber()`](crate::pubsub::PubSub::create_subscriber).
    /// This action is checked against the database's resource name. See
    /// [`database_resource_name()`] for the format of database resource names.
    CreateSuscriber,
    /// Allows publishing a payload to a `PubSub` topic with
    /// [`PubSub::publish()`](crate::pubsub::PubSub::publish). See
    /// [`pubsub_topic_resource_name()`] for the format of `PubSub` topic
    /// resource names.
    Publish,
    /// Allows subscribing to a `PubSub` topic with
    /// [`PubSub::subscribe_to()`](crate::pubsub::Subscriber::subscribe_to). See
    /// [`pubsub_topic_resource_name()`] for the format of `PubSub` topic
    /// resource names.
    SubscribeTo,
    /// Allows unsubscribing from a `PubSub` topic with
    /// [`PubSub::unsubscribe_from()`](crate::pubsub::Subscriber::unsubscribe_from). See
    /// [`pubsub_topic_resource_name()`] for the format of `PubSub` topic
    /// resource names.
    UnsubscribeFrom,
}

/// Actions that operate on the key-value store.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum KeyValueAction {
    /// Allows executing a key-value store operation with
    /// [`KeyValue::execute_key_operation()`](crate::keyvalue::KeyValue::execute_key_operation).
    /// See [`keyvalue_key_resource_name()`] for the format of key resource names.
    ExecuteOperation,
}

/// Actions that use encryption keys.
#[derive(Action, Serialize, Deserialize, Clone, Copy, Debug)]
pub enum EncryptionKeyAction {
    /// Uses a key to encrypt data.
    Encrypt,
    /// Uses a key to decrypt data.
    Decrypt,
}