void_crypto/

scoped_keyring.rs

//! Scoped access keys for limited read access.
//!
//! This module provides `ScopedKeyRing` and `ScopedAccessToken` for creating
//! scoped read keys that limit access to specific paths or branches.

use std::time::{SystemTime, UNIX_EPOCH};

use crate::kdf::{derive_scoped_key, ContentKey, SecretKey};
use crate::CryptoResult;

/// A token granting scoped read access to specific paths or branches.
#[derive(Debug, Clone)]
pub struct ScopedAccessToken {
    /// Scope pattern (e.g., "refs/heads/main" or "path:src/").
    pub scope: String,
    /// Derived key for this scope.
    pub derived_key: ContentKey,
    /// When the token was created (Unix timestamp in seconds).
    pub created_at: u64,
    /// Optional expiration time (Unix timestamp in seconds).
    pub expires_at: Option<u64>,
}

impl ScopedAccessToken {
    /// Create a new scoped access token.
    pub fn new(scope: String, derived_key: ContentKey, expires_at: Option<u64>) -> Self {
        let created_at = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .unwrap_or_default()
            .as_secs();

        Self {
            scope,
            derived_key,
            created_at,
            expires_at,
        }
    }

    /// Check if this token has expired.
    pub fn is_expired(&self) -> bool {
        if let Some(expires_at) = self.expires_at {
            let now = SystemTime::now()
                .duration_since(UNIX_EPOCH)
                .unwrap_or_default()
                .as_secs();
            now > expires_at
        } else {
            false
        }
    }

    /// Check if this token grants access to the given path.
    pub fn can_access(&self, path: &str) -> bool {
        if self.is_expired() {
            return false;
        }

        if self.scope == "*" {
            return true;
        }

        if let Some(path_pattern) = self.scope.strip_prefix("path:") {
            path.starts_with(path_pattern)
        } else if self.scope.starts_with("refs/") {
            true
        } else {
            path.starts_with(&self.scope)
        }
    }
}

/// A key ring holding scoped access tokens.
///
/// The root key is stored as a `SecretKey` so it is automatically zeroed
/// on drop, preventing lingering key material in freed memory.
pub struct ScopedKeyRing {
    root_key: SecretKey,
    tokens: Vec<ScopedAccessToken>,
}

impl std::fmt::Debug for ScopedKeyRing {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("ScopedKeyRing")
            .field("root_key", &"[REDACTED]")
            .field("tokens", &self.tokens)
            .finish()
    }
}

impl ScopedKeyRing {
    /// Create a new ScopedKeyRing from a root key.
    ///
    /// Takes ownership of the raw bytes and wraps them in a `SecretKey`
    /// that will be zeroed on drop.
    pub fn new(root_key: [u8; 32]) -> Self {
        Self {
            root_key: SecretKey::new(root_key),
            tokens: Vec::new(),
        }
    }

    fn push_token(&mut self, token: ScopedAccessToken) -> &ScopedAccessToken {
        self.tokens.push(token);
        self.tokens.last().unwrap()
    }

    /// Create a scoped access token for the given scope.
    pub fn create_token(
        &mut self,
        scope: &str,
        expires_at: Option<u64>,
    ) -> CryptoResult<&ScopedAccessToken> {
        let derived_key = ContentKey::new(derive_scoped_key(self.root_key.as_bytes(), scope)?);
        let token = ScopedAccessToken::new(scope.to_string(), derived_key, expires_at);
        Ok(self.push_token(token))
    }

    /// Get the derived key for a scope if a valid token exists.
    pub fn get_key_for_scope(&self, scope: &str) -> Option<&ContentKey> {
        self.tokens
            .iter()
            .find(|t| t.scope == scope && !t.is_expired())
            .map(|t| &t.derived_key)
    }

    /// Revoke all tokens for a scope.
    pub fn revoke_scope(&mut self, scope: &str) -> bool {
        let before = self.tokens.len();
        self.tokens.retain(|t| t.scope != scope);
        self.tokens.len() != before
    }

    /// Check if any valid token grants access to the given path.
    pub fn can_access(&self, path: &str) -> bool {
        self.tokens.iter().any(|t| t.can_access(path))
    }

    /// Get all valid (non-expired) tokens.
    pub fn valid_tokens(&self) -> Vec<&ScopedAccessToken> {
        self.tokens.iter().filter(|t| !t.is_expired()).collect()
    }

    /// Get the number of tokens (including expired ones).
    pub fn token_count(&self) -> usize {
        self.tokens.len()
    }

    /// Remove all expired tokens.
    pub fn prune_expired(&mut self) -> usize {
        let before = self.tokens.len();
        self.tokens.retain(|t| !t.is_expired());
        before - self.tokens.len()
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::generate_key;

    #[test]
    fn scoped_token_creation() {
        let root_key = generate_key();
        let mut keyring = ScopedKeyRing::new(root_key);

        let token = keyring.create_token("path:src/", None).unwrap();
        assert_eq!(token.scope, "path:src/");
        assert!(token.expires_at.is_none());
        assert!(!token.is_expired());
    }

    #[test]
    fn derive_scoped_key_deterministic() {
        let root_key = generate_key();
        let key1 = derive_scoped_key(&root_key, "path:src/").unwrap();
        let key2 = derive_scoped_key(&root_key, "path:src/").unwrap();
        assert_eq!(key1, key2);
    }

    #[test]
    fn different_scopes_different_keys() {
        let root_key = generate_key();
        let key1 = derive_scoped_key(&root_key, "path:src/").unwrap();
        let key2 = derive_scoped_key(&root_key, "path:test/").unwrap();
        assert_ne!(key1, key2);
    }

    #[test]
    fn keyring_can_access_checks_prefix() {
        let root_key = generate_key();
        let mut keyring = ScopedKeyRing::new(root_key);

        keyring.create_token("path:src/", None).unwrap();

        assert!(keyring.can_access("src/lib.rs"));
        assert!(keyring.can_access("src/utils/helper.rs"));
        assert!(!keyring.can_access("test/lib.rs"));
    }

    #[test]
    fn token_can_access_wildcard() {
        let token = ScopedAccessToken::new("*".to_string(), ContentKey::new([0u8; 32]), None);
        assert!(token.can_access("anything"));
        assert!(token.can_access("src/lib.rs"));
    }

    #[test]
    fn refs_scope_grants_full_path_access() {
        let token = ScopedAccessToken::new("refs/heads/main".to_string(), ContentKey::new([0u8; 32]), None);
        assert!(token.can_access("src/lib.rs"));
        assert!(token.can_access("test/integration.rs"));
    }

    #[test]
    fn expired_token_denies_access() {
        let past = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .unwrap()
            .as_secs()
            - 100;
        let token = ScopedAccessToken::new("*".to_string(), ContentKey::new([0u8; 32]), Some(past));
        assert!(!token.can_access("anything"));
        assert!(token.is_expired());
    }
}