[#1177] Add authorization system with in-memory manifest, authorizer, and MongoDB persistence

src/atomdb/BUILD

@@ -13,6 +13,7 @@ cc_library(
         ":atomdbutils",
         ":protected_atomdb",
         "//atomdb/adapterdb:adapterdb_lib",
+        "//atomdb/auth:auth_lib",
         "//atomdb/inmemorydb:inmemorydb_lib",
         "//atomdb/morkdb:morkdb_lib",
         "//atomdb/redis_mongodb:redis_mongodb_lib",
@@ -89,6 +90,7 @@ cc_library(
     deps = [
         ":atomdb",
         ":atomdb_api_types",
+        "//atomdb/auth:auth_lib",
         "//commons:commons_lib",
         "//commons/atoms:atoms_lib",
     ],

src/atomdb/ProtectedAtomDB.cc

@@ -15,6 +15,9 @@ ProtectedAtomDB::ProtectedAtomDB(shared_ptr<AtomDB> backend) : backend(backend)
     if (this->backend == nullptr) {
         RAISE_ERROR("ProtectedAtomDB requires a non-null backend AtomDB");
     }
+
+    // TODO: initialize ManifestAuthorizer
+
     LOG_INFO("ProtectedAtomDB initialized");
 }
 

src/atomdb/ProtectedAtomDB.h

@@ -6,6 +6,7 @@
 #include <vector>
 
 #include "AtomDB.h"
+#include "ManifestAuthorizer.h"
 
 using namespace std;
 using namespace atoms;
@@ -163,6 +164,7 @@ class ProtectedAtomDB : public AtomDB {
 
    private:
     shared_ptr<AtomDB> backend;
+    shared_ptr<ManifestAuthorizer> auth;
 
     [[noreturn]] static void raise_public_key_required(const string& method_name);
 };

src/atomdb/auth/AuthorizationManager.cc

@@ -0,0 +1,37 @@
+
+#include "AuthorizationManager.h"
+
+using namespace std;
+using namespace atomdb;
+
+// --------------------------------------------------------------------------------
+// Constructor
+
+AuthorizationManager::AuthorizationManager(shared_ptr<AuthorizationPersistence> persistence)
+    : persistence(persistence) {
+    if (!this->persistence) {
+        RAISE_ERROR("Authorization persistence is required");
+    }
+}
+
+// --------------------------------------------------------------------------------
+// Public methods
+
+vector<atomdb_api_types::AccessPermissionEntry> atomdb::AuthorizationManager::list(
+    const string& public_key) {
+    return this->persistence->list(public_key);
+}
+
+void AuthorizationManager::authorize(const string& public_key,
+                                     const atomdb_api_types::AccessPermissionEntry& entry) {
+    this->persistence->save(public_key, entry);
+}
+
+void AuthorizationManager::revoke(const string& public_key,
+                                  const atomdb_api_types::AccessPermissionEntry& entry) {
+    this->persistence->remove(public_key, entry);
+}
+
+void AuthorizationManager::revoke_all(const string& public_key) {
+    this->persistence->remove_all(public_key);
+}

src/atomdb/auth/AuthorizationManager.h

@@ -0,0 +1,51 @@
+
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include "AtomDBAPITypes.h"
+#include "AuthorizationPersistence.h"
+
+using namespace std;
+using namespace atoms;
+
+namespace atomdb {
+
+/**
+ * @brief Manages authorization permissions through persistent storage.
+ */
+class AuthorizationManager {
+   public:
+    /**
+     * @param persistence Storage used to manage authorization permissions.
+     */
+    AuthorizationManager(shared_ptr<AuthorizationPersistence> persistence);
+
+    ~AuthorizationManager() = default;
+
+    /**
+     * @brief Lists all permissions granted to public_key.
+     */
+    vector<atomdb_api_types::AccessPermissionEntry> list(const string& public_key);
+
+    /**
+     * @brief Grants an authorization entry to public_key.
+     */
+    void authorize(const string& public_key, const atomdb_api_types::AccessPermissionEntry& entry);
+
+    /**
+     * @brief Revokes an authorization entry from public_key.
+     */
+    void revoke(const string& public_key, const atomdb_api_types::AccessPermissionEntry& entry);
+
+    /**
+     * @brief Revokes all authorization entries from public_key.
+     */
+    void revoke_all(const string& public_key);
+
+   private:
+    shared_ptr<AuthorizationPersistence> persistence;
+};
+
+}  // namespace atomdb

src/atomdb/auth/AuthorizationManifest.cc

@@ -0,0 +1,77 @@
+#include "AuthorizationManifest.h"
+
+#include <algorithm>
+
+#define LOG_LEVEL INFO_LEVEL
+#include "Logger.h"
+#include "Utils.h"
+
+using namespace std;
+using namespace atomdb;
+
+// --------------------------------------------------------------------------------
+// Public methods
+
+void AuthorizationManifest::set(const atomdb_api_types::AccessPermissionDocument& document) {
+    this->documents.insert_or_assign(document.access_key, document);
+}
+
+void AuthorizationManifest::add(const string& public_key,
+                                const atomdb_api_types::AccessPermissionEntry& entry) {
+    auto document = this->get_document(public_key);
+
+    if (document == nullptr) {
+        this->documents.emplace(public_key,
+                                atomdb_api_types::AccessPermissionDocument(public_key, false, {entry}));
+        return;
+    }
+
+    vector<atomdb_api_types::AccessPermissionEntry>& entries = document->entries;
+
+    for (auto& existing : entries) {
+        if (existing.schema.handle() == entry.schema.handle()) {
+            existing = entry;
+            return;
+        }
+    }
+
+    entries.push_back(entry);
+}
+
+void AuthorizationManifest::remove(const string& public_key,
+                                   const atomdb_api_types::AccessPermissionEntry& entry) {
+    auto document = this->get_document(public_key);
+
+    if (document == nullptr) return;
+
+    vector<atomdb_api_types::AccessPermissionEntry>& entries = document->entries;
+
+    for (auto it = entries.begin(); it != entries.end(); ++it) {
+        if (it->schema.handle() == entry.schema.handle()) {
+            entries.erase(it);
+            return;
+        }
+    }
+}
+
+void AuthorizationManifest::remove_all(const string& public_key) { this->documents.erase(public_key); }
+
+bool AuthorizationManifest::is_registered(const string& public_key) const {
+    return this->documents.find(public_key) != this->documents.end();
+}
+
+bool AuthorizationManifest::full_access(const string& public_key) {
+    auto document = this->get_document(public_key);
+    if (document == nullptr) return false;
+    return document->full_access;
+}
+
+atomdb_api_types::AccessPermissionDocument* AuthorizationManifest::get_document(
+    const string& public_key) {
+    auto it = this->documents.find(public_key);
+
+    if (it == this->documents.end()) {
+        return nullptr;
+    }
+    return &it->second;
+}

src/atomdb/auth/AuthorizationManifest.h

@@ -0,0 +1,69 @@
+#pragma once
+
+#include <map>
+#include <string>
+#include <vector>
+
+#include "AtomDBAPITypes.h"
+
+using namespace std;
+
+namespace atomdb {
+
+/**
+ * @brief In-memory representation of the authorization state.
+ *
+ * Stores the authorization documents used by the authorization checks.
+ * The manifest is independent of the underlying persistence mechanism.
+ */
+class AuthorizationManifest {
+   public:
+    AuthorizationManifest() = default;
+    ~AuthorizationManifest() = default;
+
+    /**
+     * @brief Replaces or inserts the authorization document.
+     */
+    void set(const atomdb_api_types::AccessPermissionDocument& document);
+
+    /**
+     * @brief Adds an authorization entry for public_key.
+     *
+     * Creates the authorization document if public_key is not registered.
+     */
+    void add(const string& public_key, const atomdb_api_types::AccessPermissionEntry& entry);
+
+    /**
+     * @brief Removes an authorization entry from public_key.
+     *
+     * Does nothing if public_key or the specified entry is not present.
+     */
+    void remove(const string& public_key, const atomdb_api_types::AccessPermissionEntry& entry);
+
+    /**
+     * @brief Removes all authorization entries for public_key.
+     *
+     * Does nothing if public_key is not registered.
+     */
+    void remove_all(const string& public_key);
+
+    /**
+     * @brief Returns whether public_key has an authorization document.
+     */
+    bool is_registered(const string& public_key) const;
+
+    /**
+     * @brief Returns whether public_key has full access.
+     */
+    bool full_access(const string& public_key);
+
+    /**
+     * @brief Returns a document from public_key.
+     */
+    atomdb_api_types::AccessPermissionDocument* get_document(const string& public_key);
+
+   private:
+    map<string, atomdb_api_types::AccessPermissionDocument> documents;
+};
+
+}  // namespace atomdb

src/atomdb/auth/AuthorizationPersistence.h

@@ -0,0 +1,40 @@
+#pragma once
+
+#include <string>
+
+#include "AtomDBAPITypes.h"
+
+using namespace std;
+
+namespace atomdb {
+
+/**
+ * @brief Persistence interface for authorization data.
+ */
+class AuthorizationPersistence {
+   public:
+    virtual ~AuthorizationPersistence() = default;
+
+    /**
+     * @brief Lists all authorization entries for public_key.
+     */
+    virtual vector<atomdb_api_types::AccessPermissionEntry> list(const string& public_key) = 0;
+
+    /**
+     * @brief Persists an authorization entry for public_key.
+     */
+    virtual void save(const string& public_key,
+                      const atomdb_api_types::AccessPermissionEntry& entry) = 0;
+
+    /**
+     * @brief Removes an authorization entry from public_key.
+     */
+    virtual void remove(const string& public_key,
+                        const atomdb_api_types::AccessPermissionEntry& entry) = 0;
+
+    /**
+     * @brief Removes all authorization entries for public_key.
+     */
+    virtual void remove_all(const string& public_key) = 0;
+};
+}  // namespace atomdb