feat: Introduce SecurityContext

crates/api-types/src/error_conv.rs

@@ -75,12 +75,18 @@ impl From<JsonRejection> for KeystoneApiError {
 impl From<AuthenticationError> for KeystoneApiError {
     fn from(value: AuthenticationError) -> Self {
         match value {
+            AuthenticationError::AuthPrincipalDiffers => {
+                KeystoneApiError::unauthorized(value, None::<String>)
+            }
             AuthenticationError::DomainDisabled(..) => {
                 KeystoneApiError::unauthorized(value, None::<String>)
             }
             AuthenticationError::ProjectDisabled(..) => {
                 KeystoneApiError::unauthorized(value, None::<String>)
             }
+            AuthenticationError::ScopeNotAllowed => {
+                KeystoneApiError::unauthorized(value, None::<String>)
+            }
             AuthenticationError::StructBuilder { source } => {
                 KeystoneApiError::InternalError(source.to_string())
             }
@@ -117,6 +123,9 @@ impl From<AuthenticationError> for KeystoneApiError {
             AuthenticationError::Unauthorized => {
                 KeystoneApiError::unauthorized(value, None::<String>)
             }
+            AuthenticationError::Validation { source } => {
+                KeystoneApiError::InternalError(source.to_string())
+            }
         }
     }
 }

crates/appcred-sql/src/application_credential/create.rs

@@ -122,7 +122,7 @@ pub async fn create(
     // Process access rules
     if let Some(access_rules) = rec.access_rules {
         builder.access_rules(
-            process_access_rules(&txn, access_rules.into_iter(), internal_id, rec.user_id)
+            process_access_rules(&txn, access_rules, internal_id, rec.user_id)
                 .await?
                 .into_iter()
                 .collect::<Vec<_>>(),

crates/appcred-sql/src/application_credential/list.rs

@@ -94,10 +94,7 @@ pub async fn list(
         })
         .collect::<Result<Vec<Vec<_>>, _>>()?;
     let mut results: Vec<ApplicationCredential> = Vec::new();
-    for (ref apc, (roles, rules)) in db_entities
-        .into_iter()
-        .zip(roles.into_iter().zip(rules.into_iter()))
-    {
+    for (ref apc, (roles, rules)) in db_entities.into_iter().zip(roles.into_iter().zip(rules)) {
         let mut builder: ApplicationCredentialBuilder = apc.try_into()?;
         builder.roles(roles);
         builder.access_rules(rules);

crates/cli-manage/src/storage/demote.rs

@@ -58,7 +58,7 @@ impl PerformAction for DemoteCommand {
 
                 client
                     .change_membership(pb::raft::ChangeMembershipRequest {
-                        members: Vec::from_iter(members.into_iter()),
+                        members: Vec::from_iter(members),
                         retain: true,
                     })
                     .await?;

crates/cli-manage/src/storage/promote.rs

@@ -59,7 +59,7 @@ impl PerformAction for PromoteCommand {
 
                 client
                     .change_membership(pb::raft::ChangeMembershipRequest {
-                        members: Vec::from_iter(members.into_iter()),
+                        members: Vec::from_iter(members),
                         retain: false,
                     })
                     .await?;

crates/cli-manage/src/storage/remove_peer.rs

@@ -60,7 +60,7 @@ impl PerformAction for RemovePeerCommand {
 
                 client
                     .change_membership(pb::raft::ChangeMembershipRequest {
-                        members: Vec::from_iter(members.into_iter()),
+                        members: Vec::from_iter(members),
                         retain: false,
                     })
                     .await?;

crates/config/src/lib.rs

@@ -347,8 +347,8 @@ impl ConfigManager {
         // Watch the main config
         watched_paths.insert(config_path.clone());
         if let Some(parent) = config_path.parent() {
-            // For K8 it is practical to add a directory watch since the CM is replaced as a whole
-            // without touching the individual file.
+            // For K8 it is practical to add a directory watch since the CM is replaced as a
+            // whole without touching the individual file.
             watched_paths.insert(parent.to_path_buf());
         }
 

crates/core-types/Cargo.toml

@@ -19,7 +19,7 @@ serde_json.workspace = true
 thiserror.workspace = true
 tracing.workspace = true
 url = { workspace = true, features = ["serde"] }
-uuid.workspace = true
+uuid = { workspace = true, features = ["v4", "v5"] }
 validator = { workspace = true, features = ["derive"] }
 
 [dev-dependencies]