Add durable credential registry and secret lifecycle

crates/remora-credentials/tests/policy.rs

@@ -0,0 +1,74 @@
+use remora_credentials::{
+    CredentialCaller, SourceCredential, SourceCredentialKind, SourceCredentialStatus, may_manage,
+    require_manage,
+};
+use remora_domain::OpaqueId;
+use time::OffsetDateTime;
+
+fn principal(label: &str) -> OpaqueId {
+    OpaqueId::parse(format!("principal-{label}-aaaa")).unwrap()
+}
+
+fn credential(owner: OpaqueId) -> SourceCredential {
+    SourceCredential {
+        id: OpaqueId::parse("credid01-aaaaaaaa").unwrap(),
+        owner,
+        label: "probe".into(),
+        kind: SourceCredentialKind::BearerToken,
+        status: SourceCredentialStatus::Active,
+        active_version: None,
+        created_at: OffsetDateTime::now_utc(),
+        updated_at: OffsetDateTime::now_utc(),
+    }
+}
+
+#[test]
+fn owner_and_admin_may_manage_peers_may_not() {
+    let owner = principal("owner");
+    let peer = principal("peer0");
+    let admin = CredentialCaller {
+        principal_id: principal("admin"),
+        administrator: true,
+    };
+    let owner_caller = CredentialCaller {
+        principal_id: owner.clone(),
+        administrator: false,
+    };
+    let peer_caller = CredentialCaller {
+        principal_id: peer,
+        administrator: false,
+    };
+
+    assert!(may_manage(&owner_caller, &owner));
+    assert!(may_manage(&admin, &owner));
+    assert!(!may_manage(&peer_caller, &owner));
+}
+
+#[test]
+fn missing_and_unauthorized_are_indistinguishable() {
+    let owner = principal("owner");
+    let peer = CredentialCaller {
+        principal_id: principal("peer1"),
+        administrator: false,
+    };
+    let record = credential(owner);
+
+    let missing = require_manage(&peer, None);
+    let unauthorized = require_manage(&peer, Some(&record));
+    assert!(matches!(
+        missing,
+        Err(remora_credentials::CredentialError::NotFound)
+    ));
+    assert!(matches!(
+        unauthorized,
+        Err(remora_credentials::CredentialError::NotFound)
+    ));
+}
+
+#[test]
+fn split_vault_path_parses_fixture_shape() {
+    let (mount, prefix) =
+        remora_credentials::split_vault_path("secret/remora/lane-0").expect("path");
+    assert_eq!(mount, "secret");
+    assert_eq!(prefix, "remora/lane-0");
+}