🐛 fix(http): honor If-Match conditions

Management mutations accepted one numeric tag, treated weak tags as strong
matches, and reported repository mismatches as conflicts instead of failed
preconditions.

Parse the RFC field once and carry its typed condition into the write
transaction. This keeps existence checks, strong comparison, and mutation
atomic while preserving authorization concealment.

Author: gaborbernat

crates/peryx-driver/src/authz.rs

@@ -11,7 +11,7 @@
 
 use peryx_events::security::{AuthorizationDenial, authorization_denied};
 use peryx_identity::{GrantScope, Resource, Role, RoleGrant, Scope, UserId, grants_permit};
-use peryx_storage::meta::{CreateGrantOutcome, MetaError, MetaStore, RoleGrantPage};
+use peryx_storage::meta::{CreateGrantOutcome, MetaError, MetaStore, RoleGrantPage, VersionPrecondition};
 pub use peryx_storage::meta::{
     DeleteGrantOutcome, RoleGrantFilter, RoleGrantOrigin, RoleGrantQuery, RoleGrantQueryError, RoleGrantStoreError,
     StoredRoleGrant, role_grant_reach,
@@ -109,8 +109,12 @@ impl AuthorizationService {
 
     /// # Errors
     /// Returns a store error when the transaction cannot commit.
-    pub fn delete_managed_grant(&self, id: &str, expected_version: u64) -> Result<DeleteGrantOutcome, MetaError> {
-        self.store.delete_managed_grant(id, expected_version)
+    pub fn delete_managed_grant(
+        &self,
+        id: &str,
+        precondition: impl Into<VersionPrecondition>,
+    ) -> Result<DeleteGrantOutcome, MetaError> {
+        self.store.delete_managed_grant(id, precondition)
     }
 
     /// # Errors

crates/peryx-driver/src/http_services.rs

@@ -20,7 +20,7 @@ pub use peryx_storage::meta::{
     CreateRepositoryError, NewRepository, PolicyDecisionItem, PolicyDecisionPage, PolicyDecisionQuery,
     PolicyDecisionQueryError, PolicyInputGeneration, RepositoryFieldError, RepositoryId, RepositoryPage,
     RepositoryQuery, RepositoryQueryError, RepositoryRecord, RepositoryState, RepositoryStateError, RepositoryUpdate,
-    UpdateRepositoryError,
+    UpdateRepositoryError, VersionPrecondition,
 };
 
 pub trait RepositoryService: Send + Sync {
@@ -45,7 +45,7 @@ pub trait RepositoryService: Send + Sync {
     fn update(
         &self,
         id: &RepositoryId,
-        expected: u64,
+        precondition: VersionPrecondition,
         update: RepositoryUpdate,
         actor: &peryx_identity::UserId,
         now: i64,
@@ -57,7 +57,7 @@ pub trait RepositoryService: Send + Sync {
     fn set_enabled(
         &self,
         id: &RepositoryId,
-        expected: u64,
+        precondition: VersionPrecondition,
         enabled: bool,
         actor: &peryx_identity::UserId,
         now: i64,
@@ -282,23 +282,23 @@ impl RepositoryService for StoreServices {
     fn update(
         &self,
         id: &RepositoryId,
-        expected: u64,
+        precondition: VersionPrecondition,
         update: RepositoryUpdate,
         actor: &peryx_identity::UserId,
         now: i64,
     ) -> Result<RepositoryRecord, UpdateRepositoryError> {
-        self.meta.update_repository(id, expected, update, actor, now)
+        self.meta.update_repository(id, precondition, update, actor, now)
     }
 
     fn set_enabled(
         &self,
         id: &RepositoryId,
-        expected: u64,
+        precondition: VersionPrecondition,
         enabled: bool,
         actor: &peryx_identity::UserId,
         now: i64,
     ) -> Result<RepositoryRecord, RepositoryStateError> {
-        self.meta.set_repository_enabled(id, expected, enabled, actor, now)
+        self.meta.set_repository_enabled(id, precondition, enabled, actor, now)
     }
 }
 

crates/peryx-driver/tests/http_services_contract.rs

@@ -5,7 +5,7 @@ use std::time::Duration;
 use peryx_core::Ecosystem;
 use peryx_driver::http_services::{
     HttpDomainServices, NewRepository, PolicyDecisionQuery, RepositoryQuery, RepositoryService, RepositoryState,
-    RepositoryStateError, RepositoryUpdate, StoreServices,
+    RepositoryStateError, RepositoryUpdate, StoreServices, VersionPrecondition,
 };
 use peryx_driver::retention::{RetentionExport, RetentionQuery};
 use peryx_driver::serving::RetentionDriver;
@@ -104,7 +104,7 @@ fn repository_service_owns_the_complete_store_lifecycle() {
     let updated = service
         .update(
             &created.id,
-            1,
+            VersionPrecondition::exact(1),
             RepositoryUpdate {
                 display_name: "Renamed".to_owned(),
                 definition: serde_json::json!({"visible": true}),
@@ -113,15 +113,17 @@ fn repository_service_owns_the_complete_store_lifecycle() {
             2,
         )
         .unwrap();
-    let disabled = service.set_enabled(&created.id, 2, false, &actor, 3).unwrap();
+    let disabled = service
+        .set_enabled(&created.id, VersionPrecondition::exact(2), false, &actor, 3)
+        .unwrap();
 
     assert_eq!(listed.repositories, vec![created.clone()]);
     assert_eq!(inspected, created);
     assert_eq!((updated.display_name.as_str(), updated.version), ("Renamed", 2));
     assert_eq!((disabled.state, disabled.version), (RepositoryState::Disabled, 3));
     assert!(matches!(
-        service.set_enabled(&disabled.id, 2, true, &actor, 4),
-        Err(RepositoryStateError::VersionConflict { current: 3 })
+        service.set_enabled(&disabled.id, VersionPrecondition::exact(2), true, &actor, 4),
+        Err(RepositoryStateError::PreconditionFailed { current: Some(3) })
     ));
 }
 

crates/peryx-driver/tests/unit/tests/authz_tests.rs

@@ -143,7 +143,7 @@ fn test_managed_grant_lifecycle_uses_versions() {
     assert_eq!(
         service.delete_managed_grant(&id, created.record.version + 1).unwrap(),
         DeleteGrantOutcome::PreconditionFailed {
-            current: created.record.version
+            current: Some(created.record.version)
         }
     );
     assert!(matches!(

crates/peryx-http/src/handlers/grants.rs

@@ -17,6 +17,8 @@ use peryx_identity::{GrantScope, Role, RoleGrant, UserId, can_manage_grants, par
 
 use crate::response_security::ProtectedCachePolicy;
 
+use super::IfMatchError;
+
 const MAX_BODY: usize = 4 * 1024;
 const DEFAULT_LIMIT: usize = 25;
 
@@ -154,37 +156,37 @@ pub async fn revoke_grant(State(state): State<Arc<AppState>>, headers: HeaderMap
         Ok(caller) => caller,
         Err(response) => return response,
     };
-    let expected = match headers.get(header::IF_MATCH) {
-        None => {
+    if !administers(&id, &grants) {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+    let precondition = match super::if_match(&headers) {
+        Ok(precondition) => precondition,
+        Err(IfMatchError::Missing) => {
             return problem(
                 StatusCode::PRECONDITION_REQUIRED,
                 "revocation requires an If-Match precondition",
             );
         }
-        Some(value) => match value.to_str().ok().and_then(parse_etag) {
-            Some(version) => version,
-            None => return problem(StatusCode::BAD_REQUEST, "invalid If-Match precondition"),
-        },
+        Err(IfMatchError::Malformed) => {
+            return problem(StatusCode::BAD_REQUEST, "invalid If-Match precondition");
+        }
     };
-    if !administers(&id, &grants) {
-        return StatusCode::NOT_FOUND.into_response();
-    }
-    match state.serving.authorization.delete_managed_grant(&id, expected) {
+    match state.serving.authorization.delete_managed_grant(&id, precondition) {
         Ok(DeleteGrantOutcome::Removed(stored)) => {
             record(&actor, RoleGrantChange::Revoke, &stored.grant, "allowed", "removed");
             StatusCode::NO_CONTENT.into_response()
         }
-        Ok(DeleteGrantOutcome::PreconditionFailed { current }) => (
-            StatusCode::PRECONDITION_FAILED,
-            [(header::ETAG, etag(current))],
-            axum::Json(serde_json::json!({"error": "grant version precondition failed"})),
-        )
-            .into_response(),
+        Ok(DeleteGrantOutcome::PreconditionFailed { current }) => {
+            let mut response = problem(StatusCode::PRECONDITION_FAILED, "grant version precondition failed");
+            if let Some(current) = current {
+                response.headers_mut().insert(header::ETAG, etag(current));
+            }
+            response
+        }
         Ok(DeleteGrantOutcome::ExternallyManaged { link_id }) => problem(
             StatusCode::CONFLICT,
             &format!("grant is managed by external identity link {link_id}"),
         ),
-        Ok(DeleteGrantOutcome::NotFound) => StatusCode::NOT_FOUND.into_response(),
         Err(_) => unavailable(),
     }
 }
@@ -268,10 +270,6 @@ fn reach_label(scope: &GrantScope) -> String {
     }
 }
 
-fn parse_etag(value: &str) -> Option<u64> {
-    value.trim().trim_matches('"').parse().ok()
-}
-
 fn etag(version: u64) -> HeaderValue {
     HeaderValue::from_str(&format!("\"{version}\"")).expect("a version etag is a valid header value")
 }

crates/peryx-http/src/handlers/mod.rs

@@ -1,5 +1,7 @@
 //! Longest-prefix routing dispatches repository traffic without encoding ecosystem paths here.
 
+use std::collections::BTreeSet;
+
 mod acl;
 mod analytics;
 mod discover;
@@ -22,6 +24,7 @@ mod usage;
 use axum::http::{HeaderMap, StatusCode, header};
 use axum::response::{IntoResponse, Response};
 use mediatype::{MediaType, names};
+use peryx_driver::http_services::VersionPrecondition;
 use peryx_driver::state::{AppState, Index};
 use peryx_identity::{Action, Denial};
 
@@ -77,6 +80,96 @@ fn is_json(headers: &HeaderMap) -> bool {
         .is_some_and(|media_type| media_type.ty == names::APPLICATION && media_type.subty == names::JSON)
 }
 
+#[derive(Clone, Copy)]
+enum IfMatchError {
+    Missing,
+    Malformed,
+}
+
+fn if_match(headers: &HeaderMap) -> Result<VersionPrecondition, IfMatchError> {
+    let fields = headers.get_all(header::IF_MATCH);
+    let mut values = fields.iter();
+    let first = values.next().ok_or(IfMatchError::Missing)?;
+    let mut wildcard_count = 0;
+    let mut saw_tag = false;
+    let mut versions = BTreeSet::new();
+    for value in std::iter::once(first).chain(values) {
+        parse_if_match_field(value.as_bytes(), &mut wildcard_count, &mut saw_tag, &mut versions)?;
+    }
+    if wildcard_count > 1 || wildcard_count == 1 && saw_tag {
+        return Err(IfMatchError::Malformed);
+    }
+    Ok(if wildcard_count == 1 {
+        VersionPrecondition::Exists
+    } else {
+        VersionPrecondition::Versions(versions)
+    })
+}
+
+// Commas are valid inside opaque tags: https://www.rfc-editor.org/rfc/rfc9110.html#section-8.8.3
+fn parse_if_match_field(
+    field: &[u8],
+    wildcard_count: &mut usize,
+    saw_tag: &mut bool,
+    versions: &mut BTreeSet<u64>,
+) -> Result<(), IfMatchError> {
+    let mut index = 0;
+    while index < field.len() {
+        while field.get(index).is_some_and(|byte| matches!(byte, b' ' | b'\t')) {
+            index += 1;
+        }
+        if index == field.len() {
+            break;
+        }
+        if field[index] == b',' {
+            index += 1;
+            continue;
+        }
+        if field[index] == b'*' {
+            *wildcard_count += 1;
+        } else {
+            let weak = field[index..].starts_with(b"W/");
+            if weak {
+                index += 2;
+            }
+            if field.get(index) != Some(&b'"') {
+                return Err(IfMatchError::Malformed);
+            }
+            index += 1;
+            let start = index;
+            while field.get(index).is_some_and(|byte| *byte != b'"') {
+                if !matches!(field[index], b'!' | b'#'..=b'~' | b'\x80'..=b'\xff') {
+                    return Err(IfMatchError::Malformed);
+                }
+                index += 1;
+            }
+            if field.get(index) != Some(&b'"') {
+                return Err(IfMatchError::Malformed);
+            }
+            *saw_tag = true;
+            if !weak
+                && let Ok(value) = std::str::from_utf8(&field[start..index])
+                && let Ok(version) = value.parse::<u64>()
+                && version.to_string() == value
+            {
+                versions.insert(version);
+            }
+        }
+        index += 1;
+        while field.get(index).is_some_and(|byte| matches!(byte, b' ' | b'\t')) {
+            index += 1;
+        }
+        if index == field.len() {
+            break;
+        }
+        if field[index] != b',' {
+            return Err(IfMatchError::Malformed);
+        }
+        index += 1;
+    }
+    Ok(())
+}
+
 /// HTTP handlers distinguish an authenticated denial from a missing or invalid credential.
 enum EcosystemCredentialDenied {
     Forbidden,