feat(platform): add managed data product history plane

services/external-data-plane/src/reader-binding.mjs

@@ -4,7 +4,15 @@ const IDENTIFIER = /^[a-z][a-z0-9._:-]{2,127}$/;
 const TOKEN_PREFIX = "ndc_edprb_";
 const SECRET_LIKE_KEY = /(token|secret|password|authorization|access[_-]?token|refresh[_-]?token|api[_-]?key)/i;
 const REQUEST_KEYS = new Set(["source", "allowedDataProductIds", "expiresAt"]);
+const MANAGED_REQUEST_KEYS = new Set([
+  "source",
+  "allowedDataProductIds",
+  "expiresAt",
+  "generation",
+  "capabilityDigest",
+]);
 const SOURCE_KEYS = new Set(["tenantId", "connectionId", "providerId"]);
+const SHA256_DIGEST = /^[a-f0-9]{64}$/;
 
 export function createReaderToken() {
   return `${TOKEN_PREFIX}${randomBytes(32).toString("base64url")}`;
@@ -35,8 +43,61 @@ export function normalizeReaderBindingRequest(value, { now = new Date(), maxTtlD
   return Object.freeze({ tenantId, connectionId, providerId, allowedDataProductIds, expiresAt: expiresAt.toISOString() });
 }
 
+export function normalizeManagedReaderBindingRequest(value) {
+  if (!isPlainObject(value) || !isPlainObject(value.source)) {
+    throw readerError("managed_reader_binding_request_invalid");
+  }
+  if (containsSecretLikeKey(value)) {
+    throw readerError("managed_reader_binding_secret_material_forbidden");
+  }
+  if (!hasOnlyKeys(value, MANAGED_REQUEST_KEYS) || !hasOnlyKeys(value.source, SOURCE_KEYS)) {
+    throw readerError("managed_reader_binding_request_fields_invalid");
+  }
+  const tenantId = identifier(value.source.tenantId);
+  const connectionId = identifier(value.source.connectionId);
+  const providerId = identifier(value.source.providerId);
+  const allowedDataProductIds = uniqueIdentifiers(value.allowedDataProductIds);
+  if (!tenantId || !connectionId || !providerId || !allowedDataProductIds.length) {
+    throw readerError("managed_reader_binding_scope_invalid");
+  }
+  if (value.expiresAt !== null) {
+    throw readerError("managed_reader_binding_must_be_durable");
+  }
+  const generation = Number(value.generation);
+  if (!Number.isSafeInteger(generation) || generation < 1 || generation > 2_147_483_647) {
+    throw readerError("managed_reader_binding_generation_invalid");
+  }
+  const capabilityDigest = String(value.capabilityDigest || "").toLowerCase();
+  if (!SHA256_DIGEST.test(capabilityDigest)) {
+    throw readerError("managed_reader_binding_capability_digest_invalid");
+  }
+  return Object.freeze({
+    tenantId,
+    connectionId,
+    providerId,
+    allowedDataProductIds: Object.freeze([...allowedDataProductIds].sort()),
+    expiresAt: null,
+    generation,
+    capabilityDigest,
+  });
+}
+
+export function readerBindingRequestHash(policy) {
+  const canonical = JSON.stringify({
+    tenantId: policy.tenantId,
+    connectionId: policy.connectionId,
+    providerId: policy.providerId,
+    allowedDataProductIds: [...policy.allowedDataProductIds].sort(),
+    expiresAt: null,
+    generation: policy.generation,
+    capabilityDigest: policy.capabilityDigest,
+  });
+  return createHash("sha256").update(canonical, "utf8").digest("hex");
+}
+
 export function assertReaderProduct(binding, dataProductId, now = new Date()) {
-  if (!isPlainObject(binding) || binding.active !== true || new Date(binding.expiresAt) <= now) {
+  const expired = binding?.expiresAt !== null && new Date(binding?.expiresAt) <= now;
+  if (!isPlainObject(binding) || binding.active !== true || expired) {
     throw readerError("reader_binding_inactive", 401);
   }
   const normalized = identifier(dataProductId);
@@ -49,12 +110,14 @@ export function assertReaderProduct(binding, dataProductId, now = new Date()) {
 export function safeReaderBinding(binding) {
   return {
     id: binding.id,
+    ...(binding.bindingKey ? { bindingKey: binding.bindingKey } : {}),
+    ...(Number.isInteger(Number(binding.generation)) ? { generation: Number(binding.generation) } : {}),
     tenantId: binding.tenantId,
     connectionId: binding.connectionId,
     providerId: binding.providerId,
     allowedDataProductIds: uniqueIdentifiers(binding.allowedDataProductIds),
     active: binding.active === true,
-    expiresAt: new Date(binding.expiresAt).toISOString(),
+    expiresAt: binding.expiresAt === null ? null : new Date(binding.expiresAt).toISOString(),
     createdAt: binding.createdAt ? new Date(binding.createdAt).toISOString() : undefined,
     rotatedAt: binding.rotatedAt ? new Date(binding.rotatedAt).toISOString() : undefined,
     revokedAt: binding.revokedAt ? new Date(binding.revokedAt).toISOString() : undefined,