allow fine-grained access control in php

Signed-off-by: Robert Landers <landers.robert@gmail.com>

Author: withinboredom

cli/auth/resource.go

@@ -148,7 +148,7 @@ func (r *Resource) getOrCreatePermissions(id *ids.StateId, ctx context.Context,
 
 		glu := glue.NewGlue(ctx.Value("bootstrap").(string), glue.GetPermissions, make([]any, 0), result.Name())
 		env := map[string]string{"STATE_ID": id.String()}
-		_, headers, _, _ := glu.Execute(ctx, make(http.Header), logger, env, nil, id)
+		_, headers, _, _ := glu.Execute(ctx, make(http.Header), logger, env, nil, id, ids.SystemSource)
 		data := headers.Get("Permissions")
 		if err = json.Unmarshal([]byte(data), &perms); err != nil {
 			return perms, err

cli/auth/resourceManager.go

@@ -120,12 +120,19 @@ func (r *ResourceManager) ToAuthContext(ctx context.Context, resource *Resource)
 		}
 	}
 
+	fromIds := []string{}
+	for _, f := range resource.AllowedFromIds {
+		fromIds = append(fromIds, f.String())
+	}
+
 	c := map[string]interface{}{
 		"contextId": map[string]string{
 			"id": resource.id.String(),
 		},
-		"owners": owners,
-		"shares": shares,
+		"owners":    owners,
+		"shares":    shares,
+		"fromTypes": resource.AllowedFromTypes,
+		"fromIds":   fromIds,
 	}
 
 	return json.Marshal(c)

cli/glue/glue.go

@@ -73,7 +73,7 @@ func NewGlue(bootstrap string, function Method, input []any, payload string) *Gl
 	}
 }
 
-func FromApiRequest(ctx context.Context, r *http.Request, function Method, logger *zap.Logger, stream jetstream.JetStream, id *ids.StateId, headers http.Header) ([]*nats.Msg, string, error, *http.Header, bool) {
+func FromApiRequest(ctx context.Context, r *http.Request, function Method, logger *zap.Logger, stream jetstream.JetStream, id *ids.StateId, from *ids.StateId, headers http.Header) ([]*nats.Msg, string, error, *http.Header, bool) {
 	temp, err := os.CreateTemp("", "reqbody")
 	if err != nil {
 		return nil, "", err, nil, false
@@ -103,7 +103,7 @@ func FromApiRequest(ctx context.Context, r *http.Request, function Method, logge
 	remoteAddr := strings.Split(r.RemoteAddr, ":")[0]
 	env["REMOTE_ADDR"] = remoteAddr
 
-	msgs, responseHeaders, _, deleteAfter := glu.Execute(ctx, headers, logger, env, stream, id)
+	msgs, responseHeaders, _, deleteAfter := glu.Execute(ctx, headers, logger, env, stream, id, from)
 
 	for _, msg := range msgs {
 		msg.Header.Add("Remote-Addr", remoteAddr)
@@ -112,7 +112,7 @@ func FromApiRequest(ctx context.Context, r *http.Request, function Method, logge
 	return msgs, temp.Name(), nil, &responseHeaders, deleteAfter
 }
 
-func (g *Glue) Execute(ctx context.Context, headers http.Header, logger *zap.Logger, env map[string]string, stream jetstream.JetStream, id *ids.StateId) ([]*nats.Msg, http.Header, int, bool) {
+func (g *Glue) Execute(ctx context.Context, headers http.Header, logger *zap.Logger, env map[string]string, stream jetstream.JetStream, id *ids.StateId, from *ids.StateId) ([]*nats.Msg, http.Header, int, bool) {
 	var dir string
 	var ok bool
 	if dir, ok = GetLibraryDir("glue.php"); !ok {
@@ -126,6 +126,7 @@ func (g *Glue) Execute(ctx context.Context, headers http.Header, logger *zap.Log
 	headers.Add("DPHP_BOOTSTRAP", g.bootstrap)
 	headers.Add("DPHP_FUNCTION", string(g.function))
 	headers.Add("DPHP_PAYLOAD", g.payload)
+	headers.Add("DPHP_SOURCE", from.String())
 
 	provenance := ctx.Value(appcontext.CurrentUserKey)
 	if provenance != nil {

cli/ids/id.go

@@ -19,6 +19,11 @@ var ApiSource *StateId = &StateId{
 	Kind: "--api--",
 }
 
+var SystemSource *StateId = &StateId{
+	Id:   "--system--",
+	Kind: "--system--",
+}
+
 // subjects
 
 type Subject struct {

cli/lib/api.go

@@ -272,7 +272,7 @@ func Startup(ctx context.Context, js jetstream.JetStream, logger *zap.Logger, po
 			headers.Add("DPHP_AUTH_CONTEXT", string(ac))
 		}
 
-		msgs, stateFile, err, responseHeaders, deleteAfter := glue.FromApiRequest(ctx, request, function, logger, js, id, headers)
+		msgs, stateFile, err, responseHeaders, deleteAfter := glue.FromApiRequest(ctx, request, function, logger, js, id, ids.ApiSource, headers)
 		if err != nil {
 			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
 			logger.Error("Failed to glue", zap.Error(err))

cli/lib/consumer.go

@@ -336,7 +336,7 @@ func processMsg(ctx context.Context, logger *zap.Logger, msg jetstream.Msg, js j
 		headers.Add("DPHP_AUTH_CONTEXT", string(ac))
 	}
 
-	msgs, headers, _, deleteAfter := glu.Execute(ctx, headers, logger, env, js, id)
+	msgs, headers, _, deleteAfter := glu.Execute(ctx, headers, logger, env, js, id, sourceId)
 
 	// now update the stored state, if this fails due to optimistic concurrency, we immediately nak and fail
 	err = update()

src/Contexts/AuthContext.php

@@ -25,6 +25,12 @@
     #[SequenceField(arrayType: Share::class)]
     public array $shares;
 
+    #[SequenceField(arrayType: 'string')]
+    public array $fromTypes;
+
+    #[SequenceField(arrayType: StateId::class)]
+    public array $fromIds;
+
     public static function fromCurrentContext(): ?AuthContext
     {
         if (isset($_SERVER['HTTP_DPHP_AUTH_CONTEXT'])) {

src/Contexts/AuthContext/SecurityException.php

@@ -0,0 +1,5 @@
+<?php
+
+namespace Bottledcode\DurablePhp\Contexts\AuthContext;
+
+class SecurityException extends \RuntimeException {}

src/Contexts/AuthContext/functions.php

@@ -6,6 +6,7 @@
 use Bottledcode\DurablePhp\Contexts\AuthContext\Share\Role;
 use Bottledcode\DurablePhp\Contexts\AuthContext\Share\User;
 use Bottledcode\DurablePhp\Events\Shares\Operation;
+use Bottledcode\DurablePhp\State\Ids\StateId;
 use ReflectionClass;
 
 function Owner(string $subject): Owner
@@ -28,3 +29,6 @@ function User(string $subject, Operation ...$allowed): User
 
     return $ref->getMethod('fromArgs')->invoke(null, subject: $subject, allowed: $allowed);
 }
+
+define('ApiSource', StateId::fromString('--api--:--api--'));
+define('SystemSource', StateId::fromString('--system--:--system--'));

src/Glue/glue.php

@@ -70,6 +70,8 @@ class Glue
 
     public StateId $target;
 
+    public StateId $source;
+
     public $payloadHandle;
 
     public array $payload = [];
@@ -102,6 +104,7 @@ public function __construct(private DurableLogger $logger)
             );
             $this->provenance = null;
         }
+        $this->source = StateId::fromString($_SERVER['HTTP_DPHP_SOURCE']);
 
         if (! file_exists($_SERVER['HTTP_DPHP_PAYLOAD'])) {
             throw new LogicException('Unable to load payload');