update credential API to include sessions

This change updates the credential API to include sessions as just another
credential type. It adds the ApiToken type and enables revocation of
credentials. Updates were also made to the Identity API which now includes a
list of new credentials added to an Identity.

This change also migrates off the hacky ENV configuration paradigm and includes
a new config.toml file specified by the SECD_CONFIG_PATH env var. No default is
currently provided.

Clippy updates and code cleanup.

1 files changed, 8 insertions, 13 deletions

diff --git a/crates/secd/src/client/spice/mod.rs b/crates/secd/src/client/spice/mod.rs
index d3ca30d..67965d7 100644
--- a/crates/secd/src/client/spice/mod.rs
+++ b/crates/secd/src/client/spice/mod.rs
@@ -3,6 +3,7 @@
 // favor of a light weight solution that leverages the Zanzibar API but disregards the
 // scaling part.
 
+#[allow(clippy::module_inception)]
 pub mod spice {
     tonic::include_proto!("authzed.api.v1");
 }
@@ -10,7 +11,7 @@ pub mod spice {
 use spice::permissions_service_client::PermissionsServiceClient;
 use spice::schema_service_client::SchemaServiceClient;
 use spice::WriteSchemaRequest;
-use std::env::var;
+use std::matches;
 use tonic::metadata::MetadataValue;
 use tonic::transport::Channel;
 use tonic::{Request, Status};
@@ -19,7 +20,6 @@ use crate::auth::z::{self, Subject};
 use crate::client::spice::spice::{
     relationship_update, ObjectReference, Relationship, RelationshipUpdate, SubjectReference,
 };
-use crate::{ENV_SPICE_SECRET, ENV_SPICE_SERVER};
 
 use self::spice::check_permission_response::Permissionship;
 use self::spice::{consistency, CheckPermissionRequest, Consistency, WriteRelationshipsRequest};
@@ -36,12 +36,7 @@ pub(crate) struct Spice {
 }
 
 impl Spice {
-    pub async fn new() -> Self {
-        let secret =
-            var(ENV_SPICE_SECRET).expect("initialization error: Failed to find SPICE_SECRET");
-        let server =
-            var(ENV_SPICE_SERVER).expect("initialization error: Failed to find SPICE_SERVER");
-
+    pub async fn new(secret: String, server: String) -> Self {
         let channel = Channel::from_shared(server)
             .expect("invalid SPICE_SERVER uri")
             .connect()
@@ -69,10 +64,10 @@ impl Spice {
 
         let response = client.check_permission(request).await?.into_inner();
 
-        Ok(match Permissionship::from_i32(response.permissionship) {
-            Some(Permissionship::HasPermission) => true,
-            _ => false,
-        })
+        Ok(matches!(
+            Permissionship::from_i32(response.permissionship),
+            Some(Permissionship::HasPermission)
+        ))
     }
 
     pub async fn write_relationship(&self, rs: &[z::Relationship]) -> Result<(), SpiceError> {
@@ -83,7 +78,7 @@ impl Spice {
 
         let request = tonic::Request::new(WriteRelationshipsRequest {
             updates: rs
-                .into_iter()
+                .iter()
                 .map(|t| RelationshipUpdate {
                     operation: (relationship_update::Operation::Touch as i32),
                     relationship: Some(Relationship {