feat: add platform access foundation

crates/crank-core/src/access.rs

@@ -0,0 +1,84 @@
+use serde::{Deserialize, Serialize};
+
+use crate::ids::{InvitationId, PlatformApiKeyId, UserId, WorkspaceId};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UserStatus {
+    Active,
+    Disabled,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum MembershipRole {
+    Owner,
+    Admin,
+    Operator,
+    Viewer,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum InvitationStatus {
+    Pending,
+    Accepted,
+    Revoked,
+    Expired,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PlatformApiKeyStatus {
+    Active,
+    Revoked,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PlatformApiKeyScope {
+    Read,
+    Write,
+    Deploy,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct User {
+    pub id: UserId,
+    pub email: String,
+    pub display_name: String,
+    pub status: UserStatus,
+    pub created_at: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Membership {
+    pub workspace_id: WorkspaceId,
+    pub user_id: UserId,
+    pub role: MembershipRole,
+    pub created_at: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InvitationToken {
+    pub id: InvitationId,
+    pub workspace_id: WorkspaceId,
+    pub email: String,
+    pub role: MembershipRole,
+    pub status: InvitationStatus,
+    pub token_hash: String,
+    pub expires_at: String,
+    pub created_at: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PlatformApiKey {
+    pub id: PlatformApiKeyId,
+    pub workspace_id: WorkspaceId,
+    pub name: String,
+    pub prefix: String,
+    pub scopes: Vec<PlatformApiKeyScope>,
+    pub status: PlatformApiKeyStatus,
+    pub created_at: String,
+    pub last_used_at: Option<String>,
+}

crates/crank-core/src/ids.rs

@@ -43,3 +43,5 @@ define_id!(AuthProfileId);
 define_id!(WorkspaceId);
 define_id!(UserId);
 define_id!(AgentId);
+define_id!(InvitationId);
+define_id!(PlatformApiKeyId);

crates/crank-core/src/lib.rs

@@ -1,3 +1,4 @@
+pub mod access;
 pub mod agent;
 pub mod auth;
 pub mod ids;
@@ -5,13 +6,18 @@ pub mod operation;
 pub mod protocol;
 pub mod workspace;
 
+pub use access::{
+    InvitationStatus, InvitationToken, Membership, MembershipRole, PlatformApiKey,
+    PlatformApiKeyScope, PlatformApiKeyStatus, User, UserStatus,
+};
 pub use agent::{Agent, AgentOperationBinding, AgentStatus, AgentVersion};
 pub use auth::{
     ApiKeyHeaderAuthConfig, ApiKeyQueryAuthConfig, AuthConfig, AuthProfile, BasicAuthConfig,
     BearerAuthConfig, SecretRef,
 };
 pub use ids::{
-    AgentId, AuthProfileId, DescriptorId, OperationId, SampleId, ToolId, UserId, WorkspaceId,
+    AgentId, AuthProfileId, DescriptorId, InvitationId, OperationId, PlatformApiKeyId, SampleId,
+    ToolId, UserId, WorkspaceId,
 };
 pub use operation::{
     ConfigExport, ExecutionConfig, GeneratedDraft, GeneratedDraftStatus, GraphqlTarget,

crates/crank-registry/src/error.rs

@@ -10,6 +10,10 @@ pub enum RegistryError {
     WorkspaceNotFound { workspace_id: String },
     #[error("workspace with slug {slug} already exists")]
     WorkspaceSlugAlreadyExists { slug: String },
+    #[error("invitation {invitation_id} was not found")]
+    InvitationNotFound { invitation_id: String },
+    #[error("platform api key {key_id} was not found")]
+    PlatformApiKeyNotFound { key_id: String },
     #[error("agent {agent_id} was not found")]
     AgentNotFound { agent_id: String },
     #[error("published agent {workspace_slug}/{agent_slug} was not found")]

crates/crank-registry/src/lib.rs

@@ -5,12 +5,13 @@ mod postgres;
 
 pub use error::RegistryError;
 pub use model::{
-    AgentSummary, AgentVersionRecord, CreateAgentRequest, CreateVersionRequest,
-    CreateWorkspaceRequest, CreateYamlImportJobRequest, DescriptorKind, DescriptorMetadata,
-    OperationSampleMetadata, OperationSummary, OperationVersionRecord, PublishAgentRequest,
-    PublishRequest, PublishedAgentTool, RegistryOperation, SampleKind, SaveAgentBindingsRequest,
-    SaveAuthProfileRequest, SaveDescriptorMetadataRequest, SaveSampleMetadataRequest,
-    UpdateWorkspaceRequest, WorkspaceRecord, YamlImportJob, YamlImportJobCompletion,
-    YamlImportJobId, YamlImportJobStatus,
+    AgentSummary, AgentVersionRecord, CreateAgentRequest, CreateInvitationRequest,
+    CreatePlatformApiKeyRequest, CreateVersionRequest, CreateWorkspaceRequest,
+    CreateYamlImportJobRequest, DescriptorKind, DescriptorMetadata, InvitationRecord,
+    MembershipRecord, OperationSampleMetadata, OperationSummary, OperationVersionRecord,
+    PlatformApiKeyRecord, PublishAgentRequest, PublishRequest, PublishedAgentTool,
+    RegistryOperation, SampleKind, SaveAgentBindingsRequest, SaveAuthProfileRequest,
+    SaveDescriptorMetadataRequest, SaveSampleMetadataRequest, UpdateWorkspaceRequest,
+    WorkspaceRecord, YamlImportJob, YamlImportJobCompletion, YamlImportJobId, YamlImportJobStatus,
 };
 pub use postgres::PostgresRegistry;

crates/crank-registry/src/migrations.rs

@@ -15,6 +15,127 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
     .execute(pool)
     .await?;
 
+    query(
+        "create table if not exists users (
+            id text primary key,
+            email text not null unique,
+            display_name text not null,
+            status text not null,
+            created_at timestamptz not null
+        )",
+    )
+    .execute(pool)
+    .await?;
+
+    query(
+        "insert into users (
+            id,
+            email,
+            display_name,
+            status,
+            created_at
+        ) values (
+            'user_default_owner',
+            'owner@crank.local',
+            'Workspace Owner',
+            'active',
+            now()
+        )
+        on conflict (id) do nothing",
+    )
+    .execute(pool)
+    .await?;
+
+    query(
+        "create table if not exists memberships (
+            workspace_id text not null references workspaces(id) on delete cascade,
+            user_id text not null references users(id) on delete cascade,
+            role text not null,
+            created_at timestamptz not null,
+            primary key (workspace_id, user_id)
+        )",
+    )
+    .execute(pool)
+    .await?;
+
+    query(
+        "insert into workspaces (
+            id,
+            slug,
+            display_name,
+            status,
+            settings_json,
+            created_at,
+            updated_at
+        ) values (
+            'ws_default',
+            'default',
+            'Default Workspace',
+            'active',
+            '{}'::jsonb,
+            now(),
+            now()
+        )
+        on conflict (id) do nothing",
+    )
+    .execute(pool)
+    .await?;
+
+    query(
+        "insert into memberships (
+            workspace_id,
+            user_id,
+            role,
+            created_at
+        ) values (
+            'ws_default',
+            'user_default_owner',
+            'owner',
+            now()
+        )
+        on conflict (workspace_id, user_id) do nothing",
+    )
+    .execute(pool)
+    .await?;
+
+    query(
+        "create table if not exists invitation_tokens (
+            id text primary key,
+            workspace_id text not null references workspaces(id) on delete cascade,
+            email text not null,
+            role text not null,
+            status text not null,
+            token_hash text not null,
+            expires_at timestamptz not null,
+            created_at timestamptz not null
+        )",
+    )
+    .execute(pool)
+    .await?;
+
+    query(
+        "create table if not exists platform_api_keys (
+            id text primary key,
+            workspace_id text not null references workspaces(id) on delete cascade,
+            name text not null,
+            prefix text not null,
+            secret_hash text not null,
+            scopes_json jsonb not null,
+            status text not null,
+            created_at timestamptz not null,
+            last_used_at timestamptz null,
+            revoked_at timestamptz null
+        )",
+    )
+    .execute(pool)
+    .await?;
+
+    query(
+        "create unique index if not exists platform_api_keys_workspace_name_idx on platform_api_keys(workspace_id, name)",
+    )
+    .execute(pool)
+    .await?;
+
     query(
         "insert into workspaces (
             id,

crates/crank-registry/src/model.rs

@@ -1,7 +1,7 @@
 use crank_core::{
     Agent, AgentId, AgentOperationBinding, AgentStatus, AgentVersion, AuthProfile, DescriptorId,
-    ExportMode, Operation, OperationId, OperationStatus, Protocol, SampleId, Workspace,
-    WorkspaceId,
+    ExportMode, InvitationToken, MembershipRole, Operation, OperationId, OperationStatus,
+    PlatformApiKey, Protocol, SampleId, User, Workspace, WorkspaceId,
 };
 use crank_mapping::MappingSet;
 use crank_schema::Schema;
@@ -46,6 +46,24 @@ pub struct WorkspaceRecord {
     pub workspace: Workspace,
 }
 
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct MembershipRecord {
+    pub workspace_id: WorkspaceId,
+    pub user: User,
+    pub role: MembershipRole,
+    pub created_at: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct InvitationRecord {
+    pub invitation: InvitationToken,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct PlatformApiKeyRecord {
+    pub api_key: PlatformApiKey,
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct AgentSummary {
     pub id: AgentId,
@@ -248,6 +266,17 @@ pub struct PublishAgentRequest<'a> {
     pub published_by: Option<&'a str>,
 }
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CreateInvitationRequest<'a> {
+    pub invitation: &'a InvitationToken,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct CreatePlatformApiKeyRequest<'a> {
+    pub api_key: &'a PlatformApiKey,
+    pub secret_hash: &'a str,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct SaveSampleMetadataRequest<'a> {
     pub sample: &'a OperationSampleMetadata,

crates/crank-registry/src/postgres.rs

@@ -1,6 +1,7 @@
 use crank_core::{
-    AgentId, AgentOperationBinding, AgentStatus, AgentVersion, AuthProfile, OperationId,
-    OperationStatus, Workspace, WorkspaceId,
+    AgentId, AgentOperationBinding, AgentStatus, AgentVersion, AuthProfile, InvitationId,
+    InvitationToken, OperationId, OperationStatus, PlatformApiKey, PlatformApiKeyId,
+    PlatformApiKeyStatus, User, UserId, Workspace, WorkspaceId,
 };
 use serde::{Serialize, de::DeserializeOwned};
 use serde_json::Value;
@@ -14,13 +15,14 @@ use crate::{
     error::RegistryError,
     migrations,
     model::{
-        AgentSummary, AgentVersionRecord, CreateAgentRequest, CreateVersionRequest,
-        CreateWorkspaceRequest, CreateYamlImportJobRequest, DescriptorMetadata,
-        OperationSampleMetadata, OperationSummary, OperationVersionRecord, PublishAgentRequest,
-        PublishRequest, PublishedAgentTool, RegistryOperation, SaveAgentBindingsRequest,
-        SaveAuthProfileRequest, SaveDescriptorMetadataRequest, SaveSampleMetadataRequest,
-        UpdateWorkspaceRequest, WorkspaceRecord, YamlImportJob, YamlImportJobCompletion,
-        YamlImportJobId, YamlImportJobStatus,
+        AgentSummary, AgentVersionRecord, CreateAgentRequest, CreateInvitationRequest,
+        CreatePlatformApiKeyRequest, CreateVersionRequest, CreateWorkspaceRequest,
+        CreateYamlImportJobRequest, DescriptorMetadata, InvitationRecord, MembershipRecord,
+        OperationSampleMetadata, OperationSummary, OperationVersionRecord, PlatformApiKeyRecord,
+        PublishAgentRequest, PublishRequest, PublishedAgentTool, RegistryOperation,
+        SaveAgentBindingsRequest, SaveAuthProfileRequest, SaveDescriptorMetadataRequest,
+        SaveSampleMetadataRequest, UpdateWorkspaceRequest, WorkspaceRecord, YamlImportJob,
+        YamlImportJobCompletion, YamlImportJobId, YamlImportJobStatus,
     },
 };
 
@@ -62,6 +64,231 @@ impl PostgresRegistry {
         rows.iter().map(map_workspace_record).collect()
     }
 
+    pub async fn list_memberships(
+        &self,
+        workspace_id: &WorkspaceId,
+    ) -> Result<Vec<MembershipRecord>, RegistryError> {
+        let rows = sqlx::query(
+            "select
+                m.workspace_id,
+                m.user_id,
+                m.role,
+                to_char(m.created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at,
+                u.email,
+                u.display_name,
+                u.status,
+                to_char(u.created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as user_created_at
+             from memberships m
+             join users u on u.id = m.user_id
+             where m.workspace_id = $1
+             order by u.email asc",
+        )
+        .bind(workspace_id.as_str())
+        .fetch_all(&self.pool)
+        .await?;
+
+        rows.iter().map(map_membership_record).collect()
+    }
+
+    pub async fn list_invitations(
+        &self,
+        workspace_id: &WorkspaceId,
+    ) -> Result<Vec<InvitationRecord>, RegistryError> {
+        let rows = sqlx::query(
+            "select
+                id,
+                workspace_id,
+                email,
+                role,
+                status,
+                token_hash,
+                to_char(expires_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as expires_at,
+                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at
+             from invitation_tokens
+             where workspace_id = $1
+             order by created_at desc",
+        )
+        .bind(workspace_id.as_str())
+        .fetch_all(&self.pool)
+        .await?;
+
+        rows.iter().map(map_invitation_record).collect()
+    }
+
+    pub async fn create_invitation(
+        &self,
+        request: CreateInvitationRequest<'_>,
+    ) -> Result<(), RegistryError> {
+        sqlx::query(
+            "insert into invitation_tokens (
+                id,
+                workspace_id,
+                email,
+                role,
+                status,
+                token_hash,
+                expires_at,
+                created_at
+             ) values (
+                $1, $2, $3, $4, $5, $6, $7::timestamptz, $8::timestamptz
+             )",
+        )
+        .bind(request.invitation.id.as_str())
+        .bind(request.invitation.workspace_id.as_str())
+        .bind(&request.invitation.email)
+        .bind(serialize_enum_text(&request.invitation.role, "role")?)
+        .bind(serialize_enum_text(&request.invitation.status, "status")?)
+        .bind(&request.invitation.token_hash)
+        .bind(&request.invitation.expires_at)
+        .bind(&request.invitation.created_at)
+        .execute(&self.pool)
+        .await?;
+
+        Ok(())
+    }
+
+    pub async fn delete_invitation(
+        &self,
+        workspace_id: &WorkspaceId,
+        invitation_id: &InvitationId,
+    ) -> Result<(), RegistryError> {
+        let result =
+            sqlx::query("delete from invitation_tokens where workspace_id = $1 and id = $2")
+                .bind(workspace_id.as_str())
+                .bind(invitation_id.as_str())
+                .execute(&self.pool)
+                .await?;
+
+        if result.rows_affected() == 0 {
+            return Err(RegistryError::InvitationNotFound {
+                invitation_id: invitation_id.as_str().to_owned(),
+            });
+        }
+
+        Ok(())
+    }
+
+    pub async fn list_platform_api_keys(
+        &self,
+        workspace_id: &WorkspaceId,
+    ) -> Result<Vec<PlatformApiKeyRecord>, RegistryError> {
+        let rows = sqlx::query(
+            "select
+                id,
+                workspace_id,
+                name,
+                prefix,
+                scopes_json,
+                status,
+                to_char(created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at,
+                to_char(last_used_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as last_used_at
+             from platform_api_keys
+             where workspace_id = $1
+             order by created_at desc",
+        )
+        .bind(workspace_id.as_str())
+        .fetch_all(&self.pool)
+        .await?;
+
+        rows.iter().map(map_platform_api_key_record).collect()
+    }
+
+    pub async fn create_platform_api_key(
+        &self,
+        request: CreatePlatformApiKeyRequest<'_>,
+    ) -> Result<(), RegistryError> {
+        let result = sqlx::query(
+            "insert into platform_api_keys (
+                id,
+                workspace_id,
+                name,
+                prefix,
+                secret_hash,
+                scopes_json,
+                status,
+                created_at,
+                last_used_at,
+                revoked_at
+             ) values (
+                $1, $2, $3, $4, $5, $6, $7, $8::timestamptz, $9::timestamptz, $10::timestamptz
+             )",
+        )
+        .bind(request.api_key.id.as_str())
+        .bind(request.api_key.workspace_id.as_str())
+        .bind(&request.api_key.name)
+        .bind(&request.api_key.prefix)
+        .bind(request.secret_hash)
+        .bind(Json(serialize_json_value(&request.api_key.scopes)?))
+        .bind(serialize_enum_text(&request.api_key.status, "status")?)
+        .bind(&request.api_key.created_at)
+        .bind(request.api_key.last_used_at.as_deref())
+        .bind(Option::<&str>::None)
+        .execute(&self.pool)
+        .await;
+
+        match result {
+            Ok(_) => Ok(()),
+            Err(sqlx::Error::Database(error))
+                if error.constraint() == Some("platform_api_keys_workspace_name_idx") =>
+            {
+                Err(RegistryError::Storage(sqlx::Error::Database(error)))
+            }
+            Err(error) => Err(RegistryError::Storage(error)),
+        }
+    }
+
+    pub async fn revoke_platform_api_key(
+        &self,
+        workspace_id: &WorkspaceId,
+        key_id: &PlatformApiKeyId,
+        revoked_at: &str,
+    ) -> Result<(), RegistryError> {
+        let result = sqlx::query(
+            "update platform_api_keys
+                set status = $1,
+                    revoked_at = $2::timestamptz
+              where workspace_id = $3 and id = $4",
+        )
+        .bind(serialize_enum_text(
+            &PlatformApiKeyStatus::Revoked,
+            "status",
+        )?)
+        .bind(revoked_at)
+        .bind(workspace_id.as_str())
+        .bind(key_id.as_str())
+        .execute(&self.pool)
+        .await?;
+
+        if result.rows_affected() == 0 {
+            return Err(RegistryError::PlatformApiKeyNotFound {
+                key_id: key_id.as_str().to_owned(),
+            });
+        }
+
+        Ok(())
+    }
+
+    pub async fn delete_platform_api_key(
+        &self,
+        workspace_id: &WorkspaceId,
+        key_id: &PlatformApiKeyId,
+    ) -> Result<(), RegistryError> {
+        let result =
+            sqlx::query("delete from platform_api_keys where workspace_id = $1 and id = $2")
+                .bind(workspace_id.as_str())
+                .bind(key_id.as_str())
+                .execute(&self.pool)
+                .await?;
+
+        if result.rows_affected() == 0 {
+            return Err(RegistryError::PlatformApiKeyNotFound {
+                key_id: key_id.as_str().to_owned(),
+            });
+        }
+
+        Ok(())
+    }
+
     pub async fn get_workspace(
         &self,
         workspace_id: &WorkspaceId,
@@ -1417,6 +1644,51 @@ fn map_workspace_record(row: &PgRow) -> Result<WorkspaceRecord, RegistryError> {
     })
 }
 
+fn map_membership_record(row: &PgRow) -> Result<MembershipRecord, RegistryError> {
+    Ok(MembershipRecord {
+        workspace_id: WorkspaceId::new(row.try_get::<String, _>("workspace_id")?),
+        user: User {
+            id: UserId::new(row.try_get::<String, _>("user_id")?),
+            email: row.try_get("email")?,
+            display_name: row.try_get("display_name")?,
+            status: deserialize_enum_text(&row.try_get::<String, _>("status")?, "status")?,
+            created_at: row.try_get("user_created_at")?,
+        },
+        role: deserialize_enum_text(&row.try_get::<String, _>("role")?, "role")?,
+        created_at: row.try_get("created_at")?,
+    })
+}
+
+fn map_invitation_record(row: &PgRow) -> Result<InvitationRecord, RegistryError> {
+    Ok(InvitationRecord {
+        invitation: InvitationToken {
+            id: InvitationId::new(row.try_get::<String, _>("id")?),
+            workspace_id: WorkspaceId::new(row.try_get::<String, _>("workspace_id")?),
+            email: row.try_get("email")?,
+            role: deserialize_enum_text(&row.try_get::<String, _>("role")?, "role")?,
+            status: deserialize_enum_text(&row.try_get::<String, _>("status")?, "status")?,
+            token_hash: row.try_get("token_hash")?,
+            expires_at: row.try_get("expires_at")?,
+            created_at: row.try_get("created_at")?,
+        },
+    })
+}
+
+fn map_platform_api_key_record(row: &PgRow) -> Result<PlatformApiKeyRecord, RegistryError> {
+    Ok(PlatformApiKeyRecord {
+        api_key: PlatformApiKey {
+            id: PlatformApiKeyId::new(row.try_get::<String, _>("id")?),
+            workspace_id: WorkspaceId::new(row.try_get::<String, _>("workspace_id")?),
+            name: row.try_get("name")?,
+            prefix: row.try_get("prefix")?,
+            scopes: deserialize_json_value(row.try_get::<Json<Value>, _>("scopes_json")?.0)?,
+            status: deserialize_enum_text(&row.try_get::<String, _>("status")?, "status")?,
+            created_at: row.try_get("created_at")?,
+            last_used_at: row.try_get("last_used_at")?,
+        },
+    })
+}
+
 fn map_agent_summary(row: &PgRow) -> Result<AgentSummary, RegistryError> {
     Ok(AgentSummary {
         id: AgentId::new(row.try_get::<String, _>("id")?),