Add durable credential registry and secret lifecycle

crates/remora-credentials/src/authz.rs

@@ -0,0 +1,28 @@
+use remora_domain::OpaqueId;
+
+use crate::error::CredentialError;
+use crate::types::SourceCredential;
+
+/// Caller identity for credential registry authorization.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct CredentialCaller {
+    pub principal_id: OpaqueId,
+    pub administrator: bool,
+}
+
+/// Owner or administrator may manage a credential; peers see NotFound.
+#[must_use]
+pub fn may_manage(caller: &CredentialCaller, owner: &OpaqueId) -> bool {
+    caller.administrator || caller.principal_id == *owner
+}
+
+/// Map missing and unauthorized credentials to the same NotFound outcome.
+pub fn require_manage(
+    caller: &CredentialCaller,
+    credential: Option<&SourceCredential>,
+) -> Result<SourceCredential, CredentialError> {
+    match credential {
+        Some(record) if may_manage(caller, &record.owner) => Ok(record.clone()),
+        Some(_) | None => Err(CredentialError::NotFound),
+    }
+}