diff --git a/checks/noplacement/assignments-readers b/checks/noplacement/assignments-readers new file mode 100644 index 00000000..6c9e81b1 --- /dev/null +++ b/checks/noplacement/assignments-readers @@ -0,0 +1,10 @@ +# The modules of this catalogue that still read the controller's assignments (mesh-controller.assignments), each with +# why. The check of this directory (noplacement) refuses any other module that reads them, and an entry here whose module no longer +# does: the list only shrinks, and it is empty before the controller's lease is written to a holder that is no +# controller (novox/hq ADR 0549 §3, §6; issue 774). +gitea the provisioner's plan of a module (go/provider) rides only in an assignment's value; its home after the lease is issue 774's provisioner-plan subtask +keycloak the provisioner's plan of a module (go/provider), as gitea +mesh-config unioned with the placement while both stand, as the assigner and the vault do (ADR 0549 §5); its reading placement alone is a step before the lease write +mesh-vault the provisioner's plan, which only an assignment's value carries; its home is issue 774's provisioner-plan subtask +postgres the provisioner's plan of a module (go/provider), as gitea +route-adapter the provisioner's plan of a module (go/provider), as gitea diff --git a/checks/noplacement/go.mod b/checks/noplacement/go.mod index a09ac5ec..782a236b 100644 --- a/checks/noplacement/go.mod +++ b/checks/noplacement/go.mod @@ -1,3 +1,7 @@ module git.novox.be/novox/mesh-catalog/checks/noplacement go 1.22 + +require git.novox.be/novox/mesh-catalog/checks/trunk v0.0.0 + +replace git.novox.be/novox/mesh-catalog/checks/trunk => ../trunk diff --git a/checks/noplacement/main.go b/checks/noplacement/main.go index 3de240c4..cd145e32 100644 --- a/checks/noplacement/main.go +++ b/checks/noplacement/main.go @@ -8,7 +8,13 @@ // 2. a `particulars` file at the root (the mesh's node names come from the checker's run, §16); // // 3. a manifest naming a state, stream, event or bucket of the indexer's placement (`mesh-delivery-indexer.placement…` -// or `mesh-delivery-indexer_placement…`) in any string value, such as `reads`. +// or `mesh-delivery-indexer_placement…`) in any string value, such as `reads`; +// +// 4. a manifest, other than mesh-controller's, that reads the controller's assignments (`mesh-controller.assignments`): +// every reader takes placement from the seat mesh-placement (novox/hq ADR 0549 §3, ADR 0567), and the lease write is +// refused while one still reads them (ADR 0549 §6; issue 774). The modules that still read them for what the +// placement does not carry are named in checks/noplacement/assignments-readers, each with why; that list only +// shrinks: an entry whose module no longer reads them is refused too. // // go run . // @@ -55,9 +61,74 @@ func Findings(root string) ([]string, error) { out = append(out, fmt.Sprintf("%s: names %q, which the indexer no longer keeps; placement is the seat mesh-placement's (novox/hq ADR 0567 §12)", module, s)) } } + readers, err := assignmentsReaders(root) + if err != nil { + return nil, err + } + out = append(out, readers...) + sort.Strings(out) return out, nil } +// AssignmentsRead is the controller's assignments as a manifest reads them, and Allowed the file, relative to the +// catalogue's root, that names the modules still reading them: ` ` per line, `#` a comment. +const ( + AssignmentsRead = "mesh-controller.assignments" + Allowed = "checks/noplacement/assignments-readers" +) + +// assignmentsReaders is every finding on the reads of the controller's assignments: a module other than the controller +// reading them that Allowed does not name, and a module Allowed names that no longer reads them (issue 774). +func assignmentsReaders(root string) ([]string, error) { + allowed := map[string]bool{} + raw, err := os.ReadFile(filepath.Join(root, Allowed)) + if err != nil && !os.IsNotExist(err) { + return nil, err + } + for _, line := range strings.Split(string(raw), "\n") { + if f := strings.Fields(line); len(f) > 0 && !strings.HasPrefix(f[0], "#") { + allowed[f[0]] = true + } + } + manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json")) + if err != nil { + return nil, err + } + var found []string + reads := map[string]bool{} + for _, path := range manifests { + raw, err := os.ReadFile(path) + if err != nil { + return nil, err + } + var m struct { + Module string `json:"module"` + Reads []string `json:"reads"` + } + if json.Unmarshal(raw, &m) != nil || m.Module == "mesh-controller" { + continue // a manifest that does not read is the manifest checks' to refuse + } + for _, r := range m.Reads { + if strings.TrimSpace(r) != AssignmentsRead { + continue + } + reads[m.Module] = true + if !allowed[m.Module] { + found = append(found, fmt.Sprintf("%s reads %s: read where modules run from mesh-delivery-assigner.placement, "+ + "the seat mesh-placement's (novox/hq ADR 0549 §3, ADR 0567); the lease write is refused while a module reads "+ + "the assignments (ADR 0549 §6)", m.Module, AssignmentsRead)) + } + } + } + for module := range allowed { + if !reads[module] { + found = append(found, fmt.Sprintf("%s names %s, which no longer reads %s: take it off the list, which only shrinks", + Allowed, module, AssignmentsRead)) + } + } + return found, nil +} + // named collects the strings of a decoded manifest that start with one of the Prefixes. func named(v any, into []string) []string { switch v := v.(type) { @@ -95,5 +166,5 @@ func main() { if len(found) > 0 { os.Exit(1) } - fmt.Println("no placement directory, and no manifest reads the indexer's placement") + fmt.Println("no placement directory, no manifest reads the indexer's placement, and only the modules listed read the controller's assignments") } diff --git a/checks/noplacement/main_test.go b/checks/noplacement/main_test.go index 0ffc320f..efa884dc 100644 --- a/checks/noplacement/main_test.go +++ b/checks/noplacement/main_test.go @@ -5,6 +5,8 @@ import ( "path/filepath" "strings" "testing" + + "git.novox.be/novox/mesh-catalog/checks/trunk" ) func TestFindingsRefuseWhatThePlacementPathLeft(t *testing.T) { @@ -13,12 +15,18 @@ func TestFindingsRefuseWhatThePlacementPathLeft(t *testing.T) { files map[string]string want string // empty: clean }{ - {"clean", map[string]string{"modules/a/module.json": `{"module":"a","reads":["mesh-controller.assignments"]}`}, ""}, + {"clean", map[string]string{"modules/a/module.json": `{"module":"a","reads":["mesh-delivery-assigner.placement"]}`}, ""}, {"a placement directory", map[string]string{"placement/ace.json": `{}`}, "placement: the repository holds no placement"}, {"a particulars file", map[string]string{"particulars": "ace\n"}, "particulars: the repository lists no node names"}, {"a read of the indexer's placement", map[string]string{"modules/a/module.json": `{"module":"a","reads":["mesh-delivery-indexer.placement"]}`}, `a: names "mesh-delivery-indexer.placement"`}, {"a read of its candidates", map[string]string{"modules/b/module.json": `{"module":"b","reads":["mesh-delivery-indexer.placement-candidates"]}`}, "placement-candidates"}, {"its event", map[string]string{"modules/c/module.json": `{"module":"c","on":[{"event":"mesh-delivery-indexer.placement-changed"}]}`}, "placement-changed"}, + // Issue 774 (ADR 0549 §3, §6): a reader of the controller's assignments is refused unless the list names it, the + // controller's own manifest is not judged, and a name on the list whose module no longer reads them is refused. + {"an unlisted reader of the assignments", map[string]string{"modules/r/module.json": `{"module":"r","reads":["mesh-controller.assignments"]}`}, "r reads mesh-controller.assignments"}, + {"a listed reader and the controller", map[string]string{"modules/l/module.json": `{"module":"l","reads":["mesh-controller.assignments"]}`, + "modules/mesh-controller/module.json": `{"module":"mesh-controller","reads":["mesh-controller.assignments"]}`, Allowed: "# why\nl its plan\n"}, ""}, + {"a listed module that reads them no more", map[string]string{Allowed: "gone no longer reads\n"}, "names gone, which no longer reads"}, {"the seat's own state is allowed", map[string]string{"modules/d/module.json": `{"module":"d","reads":["mesh-placement.placement"]}`}, ""}, } { t.Run(row.name, func(t *testing.T) { @@ -52,4 +60,29 @@ func TestTheCatalogueHoldsNoPlacementOfTheRepositoryPath(t *testing.T) { for _, f := range got { t.Error(f) } + // Issue 774 (ADR 0549 §3, §6; the comparison of novox/hq ADR 0529 clause 2): the list of modules still reading the + // controller's assignments gains none the trunk's copy at the merge base does not hold. Its first copy gains nothing. + path, ok := trunk.Copy(t, Allowed) + if !ok { + return + } + names := func(path string) map[string]bool { + raw, err := os.ReadFile(path) + if err != nil { + t.Fatal(err) + } + out := map[string]bool{} + for _, line := range strings.Split(string(raw), "\n") { + if f := strings.Fields(line); len(f) > 0 && !strings.HasPrefix(f[0], "#") { + out[f[0]] = true + } + } + return out + } + base := names(path) + for module := range names(filepath.Join("..", "..", Allowed)) { + if !base[module] { + t.Errorf("%s gains %s, which the trunk's copy does not hold: the list only shrinks", Allowed, module) + } + } } diff --git a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/approval.go b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/approval.go index 2a7ba773..bfbcfae4 100644 --- a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/approval.go +++ b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/approval.go @@ -330,7 +330,7 @@ func (h *Holder) endStaleAsks() { h.endStaleSettles() for _, d := range h.deliveries { r := d.Ready - if r == nil || r.Merged != nil || d.MergedAs != "" || r.Declined != nil || (r.AskID == "" && r.Approved == nil) || len(r.Heads) == 0 { + if r == nil || r.Merged != nil || d.MergedAs != "" || r.declined() || (r.AskID == "" && r.Approved == nil) || len(r.Heads) == 0 { continue } switch { @@ -418,6 +418,7 @@ func (h *Holder) approval(d *Delivery, now time.Time) (string, func()) { h.runOf(m, now) m.Ready.AskID, m.Ready.Ask, m.Ready.Heads, m.Ready.AskedAt, m.Ready.Asks = id, &ask, heads, now, max(m.Ready.Asks, r.Asks) m.Ready.AskedKey, m.Ready.Asking, m.Ready.AskCheck = id, asking, check.Key + m.Ready.Declined, m.Ready.AnsweredAsk = nil, "" // a new ask: an answer to an earlier one does not stand on it h.keep(m) taken = append(taken, m) reads = append(reads, readOf(m, m.Commit)) @@ -608,7 +609,7 @@ func (h *Holder) pendingAsks() []string { seen := map[string]bool{} var out []string for _, d := range h.deliveries { - if r := d.Ready; r != nil && r.AskID != "" && r.Approved == nil && r.Declined == nil && !seen[r.AskID] { + if r := d.Ready; r != nil && r.AskID != "" && r.Approved == nil && !r.declined() && !seen[r.AskID] { seen[r.AskID] = true out = append(out, r.AskID) } @@ -705,10 +706,10 @@ func (h *Holder) answered(key string, ans sdk.Answer) []func() { h.mergeAgainNow(d) // the operator chose: the merge is asked at once switch ans.Option { case OptionApprove: - r.Approved = &now + r.Approved, r.Declined, r.AnsweredAsk = &now, nil, key h.Logf("[mesh-delivery] %s: the operator approved its merge into main (%s)", d.ID, r.Warrant) case OptionDecline: - r.Declined = &now + r.Declined, r.AnsweredAsk = &now, key h.Logf("[mesh-delivery] %s: the operator declined its merge into main (%s)", d.ID, r.Warrant) said = append(said, h.sayOn(d, fmt.Sprintf("mesh-delivery: **not merged.** The merge of this pull request into main at %s was "+ "declined: %s. A new head asks the operator again.", d.Commit, r.Warrant))) diff --git a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/approval_test.go b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/approval_test.go index fde6b6e7..3057f3d8 100644 --- a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/approval_test.go +++ b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/approval_test.go @@ -405,3 +405,51 @@ func TestAnAnswerToAnEarlierAskingIsNotTakenAndTheMergeNamesTheAnsweredAsking(t t.Fatalf("the merge is announced %v; wanted the ask id of asking 2, %s", say, sdk.AskingID(key, 2)) } } + +// 2026-10-29 (hq#495): a group declined under one ask, a member pushed, and the group asked and approved again at the new +// heads: the member whose head did not move kept the earlier Decline beside the new Approve, and nothing was handed, with +// no word. An answer stands only for the ask it answers; whichever member is pushed, both merge on the new Approve. +func TestADeclineOfAnEarlierAskDoesNotHoldTheApproveOfTheNext(t *testing.T) { + const ctlHead, catHead, pushed = "c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1", "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2", "e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3" + for _, push := range []struct { + repo string + number int + trunk string + }{{"novox/mesh-catalog", 2, "t3t3t3t3t3t3"}, {"novox/mesh-controller", 1, "t1t1t1t1t1t1"}} { + t.Run(push.repo, func(t *testing.T) { + w := newWorld(t) + w.op.auto = false + heads := map[string]string{"novox/mesh-controller": ctlHead, "novox/mesh-catalog": catHead} + paths := map[string]string{"novox/mesh-controller": "internal/a.go", "novox/mesh-catalog": "modules/app/module.json"} + numbers := map[string]int{"novox/mesh-controller": 1, "novox/mesh-catalog": 2} + trunks := map[string]string{"novox/mesh-controller": "t1t1t1t1t1t1", "novox/mesh-catalog": "t3t3t3t3t3t3"} + round := func(check string) { + var open []OpenPull + for _, repo := range []string{"novox/mesh-controller", "novox/mesh-catalog"} { + w.h.PullUpdated(pr(repo, numbers[repo], heads[repo], "feat/x", paths[repo])) + w.h.Checked(judgedAt(repo, numbers[repo], heads[repo], "pass", trunks[repo])) + open = append(open, openPull(repo, numbers[repo], heads[repo])) + } + w.forge.open = open + w.h.SeeOpenPulls() + w.settleAll() + w.h.Checked(CheckedEvent{Group: "feat/x", ID: check, Verdict: "pass", Summary: "both compose"}) + w.settleAll() + } + round("check-1") + w.op.answer(w.op.open()[0], OptionDecline) + w.settleAll() + heads[push.repo] = pushed + round("check-2") + open := w.op.open() + if len(open) != 1 { + t.Fatalf("the group at its new heads is not asked once: %v", open) + } + w.op.answer(open[0], OptionApprove) + w.settleAll() + if len(w.forge.merges) != 2 { + t.Fatalf("approved at the new heads, yet merged %v; stalled %+v", w.forge.merges, w.h.Stalled()) + } + }) + } +} diff --git a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/events.go b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/events.go index b0fc97af..be95a0c7 100644 --- a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/events.go +++ b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/events.go @@ -96,7 +96,7 @@ func (h *Holder) withdrawForStatus(e ForgeStatusEvent) { done := map[string]bool{} for _, d := range h.deliveries { r := d.Ready - if !strings.EqualFold(d.Repository, repository) || r == nil || r.AskID == "" || r.Approved != nil || r.Declined != nil || done[r.AskID] { + if !strings.EqualFold(d.Repository, repository) || r == nil || r.AskID == "" || r.Approved != nil || r.declined() || done[r.AskID] { continue } head := d.Commit diff --git a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/group_merge.go b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/group_merge.go index 8b2fd6a2..b6e1897c 100644 --- a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/group_merge.go +++ b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/group_merge.go @@ -208,7 +208,7 @@ func (h *Holder) passes() []pass { for _, id := range ids { d := h.deliveries[id] r := d.Ready - if r == nil || r.Approved == nil || r.Declined != nil || r.AskID == "" || len(r.Heads) == 0 || seen[r.AskID] || + if r == nil || r.Approved == nil || r.declined() || r.AskID == "" || len(r.Heads) == 0 || seen[r.AskID] || d.Base != MergeBranch || h.allMerged(r.Heads) { continue } @@ -335,7 +335,7 @@ func (h *Holder) MergeAgain(id, why string) (string, error) { return "", fmt.Errorf("say why: the merge asked again is the operator's word, kept in the log") } c := h.covering(d) - if c == nil || c.Approved == nil || c.Declined != nil || c.Heads[d.ID] != d.Commit { + if c == nil || c.Approved == nil || c.declined() || c.Heads[d.ID] != d.Commit { return "", fmt.Errorf("%s is not approved at its head %s: nothing to ask again (a new head is asked on its own)", id, shortOf(d.Commit, 12)) } if d.MergedAs != "" || (d.Ready != nil && d.Ready.Merged != nil) { diff --git a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/holder.go b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/holder.go index 79af7cda..8ba98d5c 100644 --- a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/holder.go +++ b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/holder.go @@ -524,7 +524,7 @@ func (h *Holder) PullEdited(p PullEvent) { if after, _ := reviewWords(d); after == before { return } - if r := h.covering(d); r != nil && r.AskID != "" && r.Approved == nil && r.Declined == nil { + if r := h.covering(d); r != nil && r.AskID != "" && r.Approved == nil && !r.declined() { h.cancels = append(h.cancels, h.withdrawAsk(r.AskID, d.ID+"'s review record changed: "+shortOf(d.ReviewedAt, 12))) } } diff --git a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/merges.go b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/merges.go index ec1b6cec..d2634300 100644 --- a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/merges.go +++ b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/merges.go @@ -149,11 +149,10 @@ func (h *Holder) handTurn(g *Group, d *Delivery, now time.Time) func() { return nil } for _, m := range order { - mc := h.covering(m) - if m.Ready == nil || m.Ready.Declined != nil || mc == nil || mc.Approved == nil || mc.Heads[m.ID] != m.Commit || h.readyWaits(m) != "" { - return nil // the others are not approved at their heads yet: nothing is merged before they are + if h.notHandable(m) != "" { + return nil // the others are not approved at their heads yet: nothing is merged before they are (said by notHanded) } - reads = append(reads, readOf(m, mc.Heads[m.ID])) + reads = append(reads, readOf(m, h.covering(m).Heads[m.ID])) } } if c == nil || c.Approved == nil || c.Heads[d.ID] == "" { @@ -169,6 +168,66 @@ func (h *Holder) handTurn(g *Group, d *Delivery, now time.Time) func() { return func() { h.hand(gid, name, key, target, reads, approved) } } +// notHandable is why a group member cannot be handed in its group's pass, empty when it can: handTurn's own test, in words. +// Under the lock. +func (h *Holder) notHandable(m *Delivery) string { + mc := h.covering(m) + switch { + case m.Ready == nil: + return m.ID + " has no ready run (" + string(m.State) + ")" + case m.Ready.declined(): + return m.ID + " stands declined since " + m.Ready.Declined.UTC().Format(time.RFC3339) + case mc == nil || mc.Approved == nil: + return m.ID + " is not approved at its head " + shortOf(m.Commit, 12) + case mc.Heads[m.ID] != m.Commit: + return m.ID + "'s head " + shortOf(m.Commit, 12) + " is not the head approved" + } + if w := h.readyWaits(m); w != "" { + return m.ID + " waits: " + w + } + return "" +} + +// notHanded is why the approved merge of d, which waits for nothing, is not handed: its group's pass cannot start, and +// says which member holds it and why. Empty when nothing holds it, or when the pass is under way or its refusal is said +// already. Under the lock. +func (h *Holder) notHanded(g *Group, d *Delivery) string { + if g == nil { + return "" + } + order := h.unmergedLive(g) + if len(order) == 0 { + return "" + } + if first := order[0].Ready; first != nil && (first.merging || !first.LastTry.IsZero() || first.RefusedSince != nil) { + return "" // the pass is under way, or its refusal is said on its own line + } + for _, m := range order { + if why := h.notHandable(m); why != "" { + return fmt.Sprintf("its group %s is not handed to the forge bridge: %s", g.ID, why) + } + } + return "" +} + +// noteNotHanded keeps on d's run why its approved merge is not handed, said once in the log when it changes, and as a +// stalled line meanwhile (readyLines). Under the lock. +func (h *Holder) noteNotHanded(d *Delivery, why string, now time.Time) { + r := d.Ready + if r == nil || r.NotHanded == why { + return + } + r.NotHanded = why + if why == "" { + r.NotHandedSince = nil + } else { + at := now + r.NotHandedSince = &at + h.Logf("[mesh-delivery] %s is approved, waits for nothing, and is NOT handed to merge: %s", d.ID, why) + } + h.keep(d) +} + // hand reads a group's required statuses and, when all are a success, writes the target as the member being merged. func (h *Holder) hand(gid, name, key, target string, reads []memberRead, approved map[string]string) { if gid != "" && !h.groupMergeable(gid, target, reads) { diff --git a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/ready.go b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/ready.go index 94ffc5b8..3f16589d 100644 --- a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/ready.go +++ b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/ready.go @@ -120,11 +120,13 @@ type ReadyRun struct { // in new words, so it never keeps a claim the check no longer holds. AskCheck string `json:"ask_check,omitempty"` // Approved and Declined are when the operator chose, Warrant what the router's warrant says of who and how; Refused - // why an answer was not taken (it did not hold to the ask). - Approved *time.Time `json:"approved,omitempty"` - Declined *time.Time `json:"declined,omitempty"` - Warrant string `json:"warrant,omitempty"` - Refused string `json:"refused,omitempty"` + // why an answer was not taken (it did not hold to the ask). AnsweredAsk is the ask the answer answers: an answer stands + // only for its own ask, so a Decline of an earlier ask never stands beside the Approve of a later one (declined). + Approved *time.Time `json:"approved,omitempty"` + Declined *time.Time `json:"declined,omitempty"` + AnsweredAsk string `json:"answered_ask,omitempty"` + Warrant string `json:"warrant,omitempty"` + Refused string `json:"refused,omitempty"` // One check per delivery (novox/hq ADR 0548 §2, §4, turns.go): HeldSince is when the approved merge began to wait for the // check of other heads HeldFor names (its verdict key), running on a repository it goes into; HandNow the operator's word @@ -137,6 +139,25 @@ type ReadyRun struct { // (writes.go, issue 1945); CannotWriteSince since when. Said at once as a condition. CannotWrite string `json:"cannot_write,omitempty"` CannotWriteSince *time.Time `json:"cannot_write_since,omitempty"` + + // NotHanded is why an approved merge that waits for nothing is not handed to the forge bridge (a member of its group that + // cannot be handed, and why), NotHandedSince since when: said once in the log and as a stalled line, never silent. + NotHanded string `json:"not_handed,omitempty"` + NotHandedSince *time.Time `json:"not_handed_since,omitempty"` +} + +// declined is whether the operator's Decline stands for this run: it answered the ask the run holds now, or the run holds +// no ask any more. A Decline of an earlier ask, the run asked again since at other heads (a sibling's new head), does not +// stand (2026-10-29: hq#495 declined under one ask and approved under the next was never handed). A run kept before answers +// named their ask stands declined unless an Approve came after the Decline. +func (r *ReadyRun) declined() bool { + if r == nil || r.Declined == nil { + return false + } + if r.AnsweredAsk != "" { + return r.AskID == "" || r.AskID == r.AnsweredAsk + } + return r.Approved == nil || r.Declined.After(*r.Approved) } // MergeBranch is the one branch this owner merges into (novox/hq ADR 0398 §4): a merge into any other is its author's. @@ -197,7 +218,7 @@ func (h *Holder) readyAsks(now time.Time) []func() { asks = append(asks, a) } r := d.Ready - if r == nil || r.Merged != nil || r.Declined != nil { + if r == nil || r.Merged != nil || r.declined() { continue } if d.State == Rejected { @@ -276,9 +297,11 @@ func (h *Holder) readyAsks(now time.Time) []func() { asks = append(asks, approvalAsk) } if waits != "" || r.merging { + h.noteNotHanded(d, "", now) // what it waits for is said by its waits, or it is handed continue } if !r.LastTry.IsZero() { + h.noteNotHanded(d, "", now) continue // refused: asked again at the next event that decides whether it may merge (mergeAgainNow), with no timer } // A group is merged one member at a time, handed to the forge bridge, and the pass stops at the first refusal (ADR @@ -288,7 +311,10 @@ func (h *Holder) readyAsks(now time.Time) []func() { g = nil } if a := h.handTurn(g, d, now); a != nil { + h.noteNotHanded(d, "", now) asks = append(asks, a) + } else { + h.noteNotHanded(d, h.notHanded(g, d), now) // a merge never handed says why (2026-10-29: silent for an hour) } } asks = append(asks, h.turnWrites()...) // the merge turns, after the holds of this look (ADR 0548 §3) @@ -575,6 +601,11 @@ func (h *Holder) readyLines(now time.Time) []StalledLine { Bound: "0s", H2: "none: a new head, which asks the operator again — the operator's", Says: fmt.Sprintf("%s#%d at %s is not merged: the operator's answer %s", d.Repository, d.Number, shortOf(r.Head, 12), r.Refused)}) + case r.NotHanded != "" && r.NotHandedSince != nil && r.Approved != nil: + out = append(out, StalledLine{ID: d.ID, Number: d.Number, State: d.State, + For: now.Sub(*r.NotHandedSince).Round(time.Second).String(), Bound: "0s", + H2: "none: the member named is approved at its head and ready, or its group is asked anew by a new head — the operator's", + Says: fmt.Sprintf("%s#%d at %s is approved and %s", d.Repository, d.Number, shortOf(r.Head, 12), r.NotHanded)}) case h.answering(d, now): // The trunk moved and its check was asked again: the gate is answering it, so it is no stall yet (ADR 0505 // §4). `show` lists the refusal meanwhile. diff --git a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/turns.go b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/turns.go index 72b3ab85..48a68aac 100644 --- a/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/turns.go +++ b/modules/mesh-delivery-gate/cmd/mesh-delivery-gate/turns.go @@ -110,7 +110,7 @@ func (h *Holder) approvedMerges() []approvedMerge { for _, id := range ids { d := h.deliveries[id] r := d.Ready - if r == nil || r.Approved == nil || r.Declined != nil || r.AskID == "" || len(r.Heads) == 0 || seen[r.AskID] || + if r == nil || r.Approved == nil || r.declined() || r.AskID == "" || len(r.Heads) == 0 || seen[r.AskID] || d.State.Final() || d.State == Rejected || d.Base != MergeBranch || r.RefusedSince != nil || h.allMerged(r.Heads) { continue } @@ -382,7 +382,10 @@ type TurnLine struct { func (h *Holder) TurnsRead() map[string]any { h.mu.Lock() defer h.mu.Unlock() - want := h.wantedTurns() + want := map[string]sdk.Turn{} + if h.checkGates() { + want = h.wantedTurns() // as turnWrites: while the check gates no merge, no turn is written by design + } repos := make([]string, 0, len(want)) for repo := range want { repos = append(repos, repo) @@ -404,6 +407,9 @@ func (h *Holder) TurnsRead() map[string]any { lines = append(lines, l) } out := map[string]any{"turns": lines, "check-gates-merge": h.checkGates(), "bound": turnBound.String()} + if !h.checkGates() { + out["why-none"] = "the check gates no merge (check-gates-merge false): no merge waits for a check, so no turn is written" + } if h.Turns != nil { out["written"] = h.turnsLoaded var unwritten []string diff --git a/modules/mesh-vault/cmd/mesh-vault/accounts.go b/modules/mesh-vault/cmd/mesh-vault/accounts.go index e25aff28..c102337e 100644 --- a/modules/mesh-vault/cmd/mesh-vault/accounts.go +++ b/modules/mesh-vault/cmd/mesh-vault/accounts.go @@ -53,6 +53,8 @@ type AccountHash struct { Adopted bool `json:"adopted,omitempty"` From string `json:"from,omitempty"` Node string `json:"node,omitempty"` + // Rotating is a rotation under way over a second login (rotation.go, ADR 0561 §4): absent when none is. + Rotating *Rotating `json:"rotating,omitempty"` } // AccountStore is the vault's state of bus-account hashes: read and written by the vault's instances alone. @@ -61,6 +63,8 @@ type AccountStore interface { Put(a AccountHash) error // Users is every user with a key. Users() ([]string, error) + // Delete takes a user's key out: an account retired (retire.go). + Delete(user string) error } // busAccounts is AccountStore over the vault's own state through its runtime. @@ -80,6 +84,8 @@ func (busAccounts) Get(user string) (*AccountHash, error) { func (busAccounts) Users() ([]string, error) { return stdio.State(BusAccountsState).Keys() } +func (busAccounts) Delete(user string) error { return stdio.State(BusAccountsState).Delete(user) } + func (busAccounts) Put(a AccountHash) error { _, err := stdio.State(BusAccountsState).Put(a.User, a) return err @@ -181,6 +187,10 @@ func (v *Vault) HashAccount(secret string, force bool) (Hashed, error) { if err != nil { return Hashed{}, err } + if rec.Retired != nil { + v.hashes.paid(secret) + return Hashed{}, fmt.Errorf("%s is retired (%s): its hash is written again only when it is wanted again", secret, rec.Retired.Why) + } user, password, err := accountOf(secret, value) if err != nil { return Hashed{}, err @@ -259,7 +269,7 @@ func (v *Vault) HashHeld() (written []Hashed, failed map[string]string) { return nil, failed } for _, r := range records { - if !Covered(r.Name) { + if !Covered(r.Name) || r.Retired != nil { continue } h, err := v.HashAccount(r.Name, false) diff --git a/modules/mesh-vault/cmd/mesh-vault/adopt.go b/modules/mesh-vault/cmd/mesh-vault/adopt.go index 2e6e998b..5d005ca3 100644 --- a/modules/mesh-vault/cmd/mesh-vault/adopt.go +++ b/modules/mesh-vault/cmd/mesh-vault/adopt.go @@ -58,32 +58,6 @@ type adoptionKept struct { failed string // why the last look found nothing to adopt, or "" } -// busNode is the node the assignments name as holding the bus module: exactly one. -func (v *Vault) busNode() (string, error) { - if v.Assignments.Keys == nil { - return "", errors.New("the vault cannot read the assignments, so it cannot tell which node holds the bus") - } - keys, err := v.Assignments.Keys() - if err != nil { - return "", fmt.Errorf("the assignments' keys could not be read: %w", err) - } - var nodes []string - for _, k := range keys { - if node, module, ok := strings.Cut(k, "."); ok && module == BusModule { - nodes = append(nodes, node) - } - } - sort.Strings(nodes) - switch len(nodes) { - case 1: - return nodes[0], nil - case 0: - return "", fmt.Errorf("no node is assigned the bus module %s", BusModule) - } - return "", fmt.Errorf("%d nodes are assigned the bus module %s (%s): the vault adopts from one alone", len(nodes), - BusModule, strings.Join(nodes, ", ")) -} - // AdoptNow is the tool account_adopt: the bus node's have read now and adopted, though it says the same as before. func (v *Vault) AdoptNow(caller string) (Adoption, error) { if v.Haves == nil { @@ -143,6 +117,9 @@ func (v *Vault) adopt(node string, raw []byte, by string, force bool) (Adoption, if err != nil { return Adoption{}, fmt.Errorf("the have of %s on %s is not a have: %w", BusModule, node, err) } + if have.UserList != nil { + v.LoadedListHeard(have.UserList.Revision) + } if have.UserList == nil || have.UserList.Handed == nil { return Adoption{}, fmt.Errorf("the have of %s on %s hands no hashes yet (its node-engine hands them once it "+ "heard the vault's key in its answer to node-key, and writes the list)", BusModule, node) diff --git a/modules/mesh-vault/cmd/mesh-vault/intake.go b/modules/mesh-vault/cmd/mesh-vault/intake.go index b1eb1811..99a272a7 100644 --- a/modules/mesh-vault/cmd/mesh-vault/intake.go +++ b/modules/mesh-vault/cmd/mesh-vault/intake.go @@ -177,6 +177,16 @@ func (v *Vault) takeCall(verb, id string) (*callKey, error) { return c, nil } +// openedBy is the caller that opened a secret-ask's call still open, as the ask's record names it; "" for none. +func (v *Vault) openedBy(id string) string { + v.callsMu.Lock() + defer v.callsMu.Unlock() + if c, ok := v.pending[id]; ok && c.verb == "secret-ask" && c.ask != nil { + return c.ask.Caller + } + return "" +} + // open opens what was sealed to the call's key, and forgets the key. func (c *callKey) open(sealed string) ([]byte, error) { defer func() { c.private = [32]byte{} }() @@ -305,15 +315,33 @@ func (v *Vault) AcceptTake(caller, call, sealed string) (Changed, error) { type AskOf struct { Node, Module, Name, Desk string // AskedBy is who asked the controller, as the bus named its caller; the controller's word, taken from the - // controller alone. + // controller alone. A caller asking directly is named by the runtime's proof, never by this (ADR 0563 §8). AskedBy string } +// askedByFor is who asked a secret-ask as the bus says it (novox/hq ADR 0563 §8): for a call relayed by the controller, +// the caller the bus named to the controller, which it takes from the controller alone, as before; for a caller the +// manifest names, that caller as the runtime proved it. Any other caller is refused: no caller names itself. +func (v *Vault) askedByFor(caller string, a AskOf) (string, error) { + switch { + case caller == ControllerCaller: + return askedByName(a.AskedBy), nil + case v.AskCallers.Allows(caller): + return askedByName(caller), nil + } + if caller == "" { + caller = stdio.Unproven + } + return "", fmt.Errorf("secret-ask answers the controller and the callers the vault's manifest names, and %s is "+ + "neither; nobody was asked to type anything", caller) +} + // AskOpen records an ask for a module's own secret before any prompt opens, holding its bounds — one open ask // per secret, three an hour (ADR 0277 §24, §25) — and answers the key the desk's prompt seals what is typed to, // and who asked as the record says it, which the prompt names (§26). func (v *Vault) AskOpen(caller string, a AskOf) (Opened, error) { - if err := fromTheController(caller, "secret-ask"); err != nil { + askedBy, err := v.askedByFor(caller, a) + if err != nil { return Opened{}, err } secret, err := OwnSecret(a.Node, a.Module, a.Name) @@ -323,7 +351,6 @@ func (v *Vault) AskOpen(caller string, a AskOf) (Opened, error) { if !namePart.MatchString(a.Desk) { return Opened{}, fmt.Errorf("nobody was asked to type anything: the desk %q is not a machine's name", a.Desk) } - askedBy := askedByName(a.AskedBy) v.Store.asksMu.Lock() defer v.Store.asksMu.Unlock() now := v.Now().UTC() @@ -378,9 +405,13 @@ var askOutcomes = map[string]bool{"dismissed": true, "timed-out": true, "empty": // AskEnd ends an ask: with what the desk sealed to its key, which the vault opens and keeps as typed, or with // the outcome the desk answered instead. How it ended is recorded whatever happens. func (v *Vault) AskEnd(caller, call, sealed, outcome string) (Changed, error) { - if err := fromTheController(caller, "secret-ask"); err != nil { + if _, err := v.askedByFor(caller, AskOf{}); err != nil { return Changed{}, err } + // An ask is ended by the caller that opened it, and by no other. + if opener := v.openedBy(call); opener != "" && opener != caller { + return Changed{}, fmt.Errorf("the ask %s was opened by %s, and %s may not end it", call, opener, caller) + } if sealed == "" && !askOutcomes[outcome] { return Changed{}, fmt.Errorf("an ask ends with what was sealed to its key, or with one of dismissed, " + "timed-out, empty, refused or failed") @@ -527,8 +558,8 @@ type Asked struct { Unchanged bool `json:"unchanged,omitempty"` } -// AskAtDesk is `secret-ask` (ADR 0349 clause 9, ADR 0277 §22–§27): asked by the controller alone, which names who -// asked it. The ask is recorded and its bounds held before any prompt opens; the vault asks the desk's prompt +// AskAtDesk is `secret-ask` (ADR 0349 clause 9, ADR 0277 §22–§27): asked by the controller, which names who asked it, +// or by a caller the vault's manifest names, named by the runtime's proof (ADR 0563 §8). The ask is recorded and its bounds held before any prompt opens; the vault asks the desk's prompt // itself, in its own name, naming the asker as recorded and giving a key made for this one call; what is typed // comes back sealed to that key and opens here. How the prompt ended is the answer and the record's. func (v *Vault) AskAtDesk(caller string, a AskOf) (Asked, error) { diff --git a/modules/mesh-vault/cmd/mesh-vault/intake_test.go b/modules/mesh-vault/cmd/mesh-vault/intake_test.go index e795bad7..d9701db6 100644 --- a/modules/mesh-vault/cmd/mesh-vault/intake_test.go +++ b/modules/mesh-vault/cmd/mesh-vault/intake_test.go @@ -13,6 +13,7 @@ import ( "encoding/base64" "encoding/json" "errors" + stdio "git.novox.be/novox/mesh-sdk/go" "os" "path/filepath" "strings" @@ -173,6 +174,29 @@ func TestAnAskIsBoundedToOneOpenPerSecretAndThreeAnHour(t *testing.T) { if _, err := w.AskOpen(ControllerCaller, telegramAsk("g14.claude-code")); err != nil { t.Errorf("an ask left open past its time still held the secret: %v", err) } + // 774 (ADR 0563 §8): a caller the manifest names asks directly, is named by its proven caller and never by the + // asked_by it gives, and is held to the same bounds; one it does not name is refused. + t.Run("a named caller asks itself, within the bounds", func(t *testing.T) { + x := newVault(t, nil) + x.AskCallers = stdio.Callers{"node-tools"} + if _, err := x.AskOpen("ace.claude-code", telegramAsk("x")); err == nil || !strings.Contains(err.Error(), "ace.claude-code") { + t.Errorf("a caller the manifest does not name opened an ask: %v", err) + } + opened, err := x.AskOpen("g14.node-tools", telegramAsk("person.operator")) + if err != nil || opened.AskedBy != "g14.node-tools" { + t.Fatalf("a named caller's ask: %+v, %v", opened, err) + } + if _, err := x.AskEnd(ControllerCaller, opened.Call, "", "dismissed"); err == nil { + t.Error("another caller ended a named caller's ask") + } + if _, err := x.AskOpen("ace.node-tools", telegramAsk("")); err == nil || !strings.Contains(err.Error(), "still open (asked by g14.node-tools)") { + t.Errorf("a second ask while a named caller's is open: %v", err) + } + recorded, _ := x.Store.Asks(10) + if len(recorded) == 0 || recorded[0].AskedBy != "g14.node-tools" || recorded[0].Caller != "g14.node-tools" { + t.Errorf("recorded as %+v", recorded) + } + }) } // Only the controller reaches a desk's prompt, so only it opens and ends an ask; a value not sealed to the diff --git a/modules/mesh-vault/cmd/mesh-vault/issued_account_test.go b/modules/mesh-vault/cmd/mesh-vault/issued_account_test.go index 7625ec8b..41f600e5 100644 --- a/modules/mesh-vault/cmd/mesh-vault/issued_account_test.go +++ b/modules/mesh-vault/cmd/mesh-vault/issued_account_test.go @@ -48,6 +48,13 @@ func (f *fakeAccounts) Put(a AccountHash) error { return nil } +func (f *fakeAccounts) Delete(user string) error { + f.mu.Lock() + defer f.mu.Unlock() + delete(f.keys, user) + return nil +} + func (f *fakeAccounts) Users() ([]string, error) { f.mu.Lock() defer f.mu.Unlock() diff --git a/modules/mesh-vault/cmd/mesh-vault/lease.go b/modules/mesh-vault/cmd/mesh-vault/lease.go new file mode 100644 index 00000000..3a399d00 --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/lease.go @@ -0,0 +1,49 @@ +package main + +// The switch on the controller's lease (novox/hq ADR 0561 §3): minting is on only while the lease is handed to a holder +// that is no controller, and off for a controller's value, a key deleted or expired, or one that cannot be read. The +// write that hands it away turns it on and mints every wanted account the vault holds no value for; a lease handed back +// turns it off. No clock and no setting turns it. A key's age passing is heard by no watch, so the lease is read afresh +// before every mint (LeaseRead): a lease that expired since mints nothing. + +import "git.novox.be/novox/mesh-sdk/go/buscompose" + +// LeaseHeard is the watch of the controller's lease. When minting turns on or off, every wanted account is judged again: +// minted when on, held back with the new why when off. +func (v *Vault) LeaseHeard(raw []byte, found bool, readErr error) { + if !v.setLease(raw, found, readErr) { + return + } + on, why := v.mintingOn() + v.log("minting is %s: %s", map[bool]string{true: "ON", false: "off"}[on], why) + for _, user := range v.wantedUsers() { + if w, ok := v.wanted(user); ok { + if _, err := v.mintWanted(w, "the lease write"); err != nil { + v.log("%s is not minted: %v", user, err) + } + } + } +} + +// setLease records what the lease says, and answers whether minting turned on or off by it. +func (v *Vault) setLease(raw []byte, found bool, readErr error) bool { + on, why := buscompose.LeaseHandedAway(raw, found, readErr) + m := &v.minting + m.mu.Lock() + defer m.mu.Unlock() + flipped := on != m.on || m.why == "" + if flipped { + m.since = v.Now().UTC() + } + m.on, m.why = on, why + return flipped +} + +// leaseAfresh reads the lease again before a mint, where the vault can: a key that expired since is heard by no watch. +func (v *Vault) leaseAfresh() { + if v.LeaseRead == nil { + return + } + raw, found, err := v.LeaseRead() + v.setLease(raw, found, err) +} diff --git a/modules/mesh-vault/cmd/mesh-vault/main.go b/modules/mesh-vault/cmd/mesh-vault/main.go index 7370f0af..abd38dfb 100644 --- a/modules/mesh-vault/cmd/mesh-vault/main.go +++ b/modules/mesh-vault/cmd/mesh-vault/main.go @@ -53,8 +53,9 @@ func build() *Env { assigned = &WatchedAssignments{Fallback: readAssignment} env.Vault = &Vault{Store: store, Own: own, Askers: Declared{Read: assigned.Read, Confirm: readAssignment, Store: store}, Assignments: Mirror{Keys: assignmentKeys, Read: readAssignment}, Emit: emit, Ask: stdio.Ask, - Now: time.Now, Log: say, Accounts: busAccounts{}, Haves: readHave, - HaveKeys: func() ([]string, error) { return stdio.State(HaveRead).Keys() }} + Now: time.Now, Log: say, Accounts: busAccounts{}, Haves: readHave, LeaseRead: readLease, WantRead: readWant, + HaveKeys: func() ([]string, error) { return stdio.State(HaveRead).Keys() }, Placement: placement, Signers: busSigners{}, + AskCallers: askCallers(os.Getenv("MESH_VAULT_SECRET_ASK_CALLERS"))} return env } @@ -120,6 +121,74 @@ func watchHandings(env *Env) bool { return true } +// watchWants mints from the grants part's wanted accounts as they change (mint.go, ADR 0561 §2): a watch, never a poll. +// It answers whether the watch began; one that did not is begun again at the next minute pass. +func watchWants(env *Env) bool { + if env.Vault == nil { + return true + } + err := stdio.State(WantedRead).Watch("", func(c stdio.StateChange) error { + env.Vault.WantHeard(c.Key, c.Value, c.Op == "delete" || c.Op == "purge" || len(c.Value) == 0) + return nil + }) + if err != nil { + say("the grants part's wanted accounts are not watched, so nothing is minted; begun again at the next pass: %v", err) + return false + } + // The watch returns once every current key was handed: what has no key now is no longer wanted. + env.Vault.WantsRead() + return true +} + +// placement reads the seat mesh-placement's placement through the runtime under the vault's own account (its manifest reads it). +var placement = PlacementReader{ + Keys: func() ([]string, error) { return stdio.State(PlacementRead).Keys() }, + Read: func(key string) ([]byte, error) { + e, err := stdio.State(PlacementRead).Get(key) + if err != nil || e == nil { + return nil, err + } + return e.Value, nil + }, +} + +// readWant is one wanted account of the grants part, read afresh (issue-account). +func readWant(user string) ([]byte, bool, error) { + e, err := stdio.State(WantedRead).Get(user) + if err != nil || e == nil { + return nil, false, err + } + return e.Value, true, nil +} + +// readLease is the controller's lease key, read through the runtime under the vault's own account (its manifest reads it). +func readLease() ([]byte, bool, error) { + e, err := stdio.State(LeaseRead).Get(LeaseKey) + if err != nil || e == nil { + return nil, false, err + } + return e.Value, true, nil +} + +// watchLease turns minting on and off as the controller's lease is written (lease.go, ADR 0561 §3): a watch, never a +// poll; and the lease is read afresh before every mint. It answers whether the watch began. +func watchLease(env *Env) bool { + if env.Vault == nil { + return true + } + env.Vault.LeaseHeard(readLease()) + err := stdio.State(LeaseRead).Watch(LeaseKey, func(c stdio.StateChange) error { + deleted := c.Op == "delete" || c.Op == "purge" || len(c.Value) == 0 + env.Vault.LeaseHeard(c.Value, !deleted, nil) + return nil + }) + if err != nil { + say("the controller's lease is not watched, so minting stays as last read; begun again at the next pass: %v", err) + return false + } + return true +} + // adoptOperatorKey takes the operator key from the export the mesh writes to the vault's root (what // `operator key set` recorded; the controller keeps only a public half there), and seals again any // operator copy not yet sealed to the current key. Run every minute, so a failure partway is finished. It @@ -173,7 +242,11 @@ func main() { written, failed := env.Vault.HashHeld() say("hashed %d bus accounts at start; %d could not be, tried again every minute: %v", len(written), len(failed), failed) } + // The operator key first: nothing is kept without it, so a want heard before it would not be minted. + env.pass() watched, watching := watchHandings(env), watchAssignments() + lease := watchLease(env) + wants := watchWants(env) for { if !watched { watched = watchHandings(env) @@ -181,9 +254,23 @@ func main() { if !watching { watching = watchAssignments() } + if !lease { + lease = watchLease(env) + } + if !wants { + wants = watchWants(env) + } env.pass() if env.Vault != nil { + // The signing key and authority once the operator key is taken, and `signers` when it differs (ADR 0550 §2). + if err := env.Vault.SigningPass(); err != nil { + env.Vault.signingSaid(err) + } else { + env.Vault.signingSaid(nil) + } env.Vault.HashOwed() + env.Vault.MintOwed() + env.Vault.RetirePass() } env.pairPass() if env.Custody != nil { @@ -197,3 +284,15 @@ func main() { os.Exit(1) } } + +// askCallers are the callers the vault's manifest names for secret-ask besides the controller (novox/hq ADR 0563 §8): +// MESH_VAULT_SECRET_ASK_CALLERS, comma-separated, each a module (on any machine), . or person.. +func askCallers(list string) stdio.Callers { + var out stdio.Callers + for _, c := range strings.Split(list, ",") { + if c = strings.TrimSpace(c); c != "" { + out = append(out, c) + } + } + return out +} diff --git a/modules/mesh-vault/cmd/mesh-vault/mint.go b/modules/mesh-vault/cmd/mesh-vault/mint.go new file mode 100644 index 00000000..06bb80a7 --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/mint.go @@ -0,0 +1,376 @@ +package main + +// The vault mints every new bus account (novox/hq ADR 0561 §1 to §4, issue 774). +// +// The grants part says which accounts the mesh wants, in its state `accounts` that the vault alone reads (§2): one key +// per bus user, holding what the controller's credential carries beside the password. The vault watches it, and for a +// user it holds no value for and whose hash it did not adopt it makes a password, keeps the account whole (built by +// mesh-sdk's HeldCredential, byte for byte the controller's shape) as the module's own secret on that node +// (`own///|provisioner-broker>`), sealed, with the operator's copy; writes the +// bcrypt hash into `bus-accounts`; and says `account-issued`, then `secret-changed`. The node's engine asks `own` again +// on `secret-changed` and composes. +// +// **One issuer at every moment** (§3): minting is on only while the controller's lease is handed to a holder that is no +// controller (mesh-sdk LeaseHandedAway). Until then the controller mints, the vault keeps hashing what it is handed, and +// vault_status names every wanted account it holds back and why. **Nothing is minted anew** (§4): an account whose value +// the vault holds, or whose hash it adopted, is never minted; the node accounts and the controller's own are never wanted. +// **Never two values for one user** (§7): a user whose hash the vault already wrote from another of its secrets is held +// back, said, and never replaced but by a rotation. + +import ( + "crypto/rand" + "encoding/base64" + "encoding/json" + "errors" + "fmt" + "sort" + "strings" + "sync" + "time" + + "git.novox.be/novox/mesh-sdk/go/buscompose" +) + +// WantedRead is the grants part's state of wanted accounts, as the vault's manifest reads it. +const WantedRead = buscompose.GrantsAccounts + +// LeaseRead is the controller's lease, as the vault's manifest reads it, and LeaseKey its one key. +const ( + LeaseRead = buscompose.ControllerLease + LeaseKey = buscompose.ControllerLeaseKey +) + +// AccountIssuedEvent is what the vault says when it minted an account (mesh-sdk buscompose.AccountIssued). +const AccountIssuedEvent = buscompose.AccountIssuedEvent + +// minting is the switch and what the vault knows of the wanted accounts, kept in memory and read again from the bus at +// every start: the grants part's state and the lease are the record, never this. +type minting struct { + mu sync.Mutex + on bool + why string + since time.Time + // wants are the wanted accounts, by user, as last heard. + wants map[string]buscompose.WantedAccount + // heldBack are the wanted users the vault did not mint, with why (vault_status). + heldBack map[string]string + // owed are the wanted users whose mint failed, tried again at the pass (MintOwed). + owed map[string]bool + // minted are the accounts this vault minted since it started, by user (vault_status). + minted map[string]Minted + // loadedRevision is the highest revision of the user list the bus node said it loaded (rotation.go). + loadedRevision uint64 + // retiring is what the passes keep of the accounts no longer wanted (retire.go). + retiring retiring + // mintMu keeps one mint at a time: a want heard, the switch turning on, and issue-account. + mintMu sync.Mutex +} + +// Minted is what one mint did: the account and its secret, never its value or its hash. +type Minted struct { + User string `json:"user"` + Secret string `json:"secret"` + Generation int `json:"generation"` + At time.Time `json:"at"` + // Hashed says its hash is written; false leaves it owed, written at the next pass. + Hashed bool `json:"hashed"` +} + +// MintState is what vault_status says of minting. +type MintState struct { + On bool `json:"on"` + Why string `json:"why"` + Since time.Time `json:"since,omitzero"` + Wanted int `json:"wanted"` + HeldBack map[string]string `json:"held_back"` + Minted []Minted `json:"minted"` +} + +// MintState answers how minting stands. +func (v *Vault) MintState() MintState { + m := &v.minting + m.mu.Lock() + defer m.mu.Unlock() + out := MintState{On: m.on, Why: m.why, Since: m.since, Wanted: len(m.wants), HeldBack: map[string]string{}, Minted: []Minted{}} + if out.Why == "" { + out.Why = "the controller's lease has not been read yet, so nothing is minted" + } + for u, why := range m.heldBack { + out.HeldBack[u] = why + } + for _, x := range m.minted { + out.Minted = append(out.Minted, x) + } + sort.Slice(out.Minted, func(i, j int) bool { return out.Minted[i].User < out.Minted[j].User }) + return out +} + +// mintingOn says whether the vault mints now, and why. +func (v *Vault) mintingOn() (bool, string) { + v.minting.mu.Lock() + defer v.minting.mu.Unlock() + if v.minting.why == "" { + return false, "the controller's lease has not been read yet, so nothing is minted" + } + return v.minting.on, v.minting.why +} + +func (v *Vault) holdBack(user, why string) { + m := &v.minting + m.mu.Lock() + defer m.mu.Unlock() + if m.heldBack == nil { + m.heldBack = map[string]string{} + } + m.heldBack[user] = why +} + +func (v *Vault) noLongerHeld(user string) { + m := &v.minting + m.mu.Lock() + defer m.mu.Unlock() + delete(m.heldBack, user) +} + +// AccountSecret is the vault's name of the own secret a wanted account is held in. +func AccountSecret(w buscompose.WantedAccount) (string, error) { + return OwnSecret(w.Node, w.Module, w.OwnSecret()) +} + +// WantHeard is the watch of the grants part's wanted accounts: a key put is a want, minted when minting is on; a key +// deleted is a want gone (retire.go). +func (v *Vault) WantHeard(user string, raw []byte, deleted bool) { + if deleted { + v.wantGone(user) + return + } + w, err := buscompose.ReadWantedAccount(user, raw) + if err != nil { + v.log("the wanted account %s is not read, so nothing is minted for it: %v", user, err) + v.holdBack(user, "its wanted key is not readable: "+err.Error()) + return + } + v.minting.mu.Lock() + if v.minting.wants == nil { + v.minting.wants = map[string]buscompose.WantedAccount{} + } + v.minting.wants[user] = w + v.minting.mu.Unlock() + v.wantBack(user) + if _, err := v.mintWanted(w, "the grants part's want of "+user); err != nil { + v.log("%s is not minted: %v", user, err) + } +} + +// errHeldBack is a want the vault does not mint now, with why: not an error of the vault. +type errHeldBack struct{ why string } + +func (e errHeldBack) Error() string { return e.why } + +// mintWanted mints w when minting is on, the vault holds no value for it and adopted no hash of it; otherwise it says +// why not and, where that is a hold, keeps it for vault_status. +func (v *Vault) mintWanted(w buscompose.WantedAccount, by string) (Minted, error) { + m, err := v.mintOnce(w, by) + var held errHeldBack + v.owe(w.User, err != nil && !errors.As(err, &held) && w.Valid() == nil) + return m, err +} + +// mintOnce is one try of mintWanted. +func (v *Vault) mintOnce(w buscompose.WantedAccount, by string) (Minted, error) { + v.minting.mintMu.Lock() + defer v.minting.mintMu.Unlock() + if err := w.Valid(); err != nil { + v.holdBack(w.User, err.Error()) + return Minted{}, err + } + secret, err := AccountSecret(w) + if err != nil { + v.holdBack(w.User, err.Error()) + return Minted{}, err + } + if _, held, err := v.Store.Read(secret); err != nil { + return Minted{}, err + } else if held { + // Its value is held (the controller's, handed in, or one the vault minted): never minted anew (§4). + v.noLongerHeld(w.User) + return Minted{}, errHeldBack{secret + " is held already: an account the vault holds a value for is never minted anew (ADR 0561 §4)"} + } + if v.Accounts == nil { + v.holdBack(w.User, "the vault has no state of bus accounts to write the hash to") + return Minted{}, errors.New("the vault has no state of bus accounts to write the hash to") + } + was, err := v.Accounts.Get(w.User) + if err != nil { + v.holdBack(w.User, "its key in "+BusAccountsState+" cannot be read: "+err.Error()) + return Minted{}, err + } + if was != nil && was.Adopted { + // The hash the bus loaded is kept (§4): not minted, and not held back either. + v.noLongerHeld(w.User) + return Minted{}, errHeldBack{w.User + "'s hash was adopted from the list the bus loaded: it keeps it, and is never minted (ADR 0561 §4)"} + } + if was != nil && was.Of != "" && was.Of != secret { + why := fmt.Sprintf("%s holds the hash of %s for %s, not of %s: a user has one value, so nothing is minted until "+ + "a person sees why (ADR 0561 §7)", BusAccountsState, was.Of, w.User, secret) + v.holdBack(w.User, why) + return Minted{}, errHeldBack{why} + } + v.leaseAfresh() + if on, why := v.mintingOn(); !on { + v.holdBack(w.User, "held back: "+why) + return Minted{}, errHeldBack{why} + } + raw := make([]byte, 30) + if _, err := rand.Read(raw); err != nil { + return Minted{}, err + } + value, err := buscompose.HeldCredential(w, base64.RawURLEncoding.EncodeToString(raw)) + if err != nil { + v.holdBack(w.User, err.Error()) + return Minted{}, err + } + c, err := v.keepLocked(secret, string(value), "the vault", "", OriginMade, keepOptions{neverReplace: true, quiet: true}) + if err != nil { + v.holdBack(w.User, "its value could not be kept: "+err.Error()) + return Minted{}, err + } + out := Minted{User: w.User, Secret: secret, Generation: c.Generation, At: c.At} + // The hash first, then account-issued, then secret-changed: the grants part composes the user before the node asks. + if _, err := v.HashAccount(secret, false); err != nil { + v.hashes.owe(secret, err.Error()) + v.log("%s is minted and kept, and ITS HASH IS NOT WRITTEN, written at the next pass: %v", w.User, err) + } else { + out.Hashed = true + if v.Emit != nil { + e := buscompose.AccountIssued{User: w.User, Kind: w.Kind, Node: w.Node, Module: w.Module, Process: w.Process, + Generation: c.Generation, At: c.At} + body := map[string]any{} + b, _ := json.Marshal(e) + _ = json.Unmarshal(b, &body) + if err := v.Emit(AccountIssuedEvent, body); err != nil { + v.log("%s is minted and hashed, but %s could not be said: %v", w.User, AccountIssuedEvent, err) + } + } + } + v.announce(c) + v.minting.mu.Lock() + if v.minting.minted == nil { + v.minting.minted = map[string]Minted{} + } + v.minting.minted[w.User] = out + v.minting.mu.Unlock() + v.noLongerHeld(w.User) + v.log("minted the bus account %s as %s (generation %d), for %s", w.User, secret, c.Generation, by) + return out, nil +} + +// MintOwed tries again, at the vault's minute pass, every wanted account whose mint failed (its value could not be kept, +// its key read, its password made): a want heard is never lost to one refusal. A want held back is not owed: the switch +// or the want changing judges it again. +func (v *Vault) MintOwed() { + v.minting.mu.Lock() + var owed []string + for u := range v.minting.owed { + owed = append(owed, u) + } + v.minting.mu.Unlock() + sort.Strings(owed) + for _, u := range owed { + if w, ok := v.wanted(u); ok { + if _, err := v.mintWanted(w, "the pass, after a mint that failed"); err != nil { + v.log("%s is still not minted: %v", u, err) + } + } else { + v.owe(u, false) + } + } +} + +// owe marks user's mint as failed (tried again at the pass) or not. +func (v *Vault) owe(user string, owed bool) { + v.minting.mu.Lock() + defer v.minting.mu.Unlock() + if !owed { + delete(v.minting.owed, user) + return + } + if v.minting.owed == nil { + v.minting.owed = map[string]bool{} + } + v.minting.owed[user] = true +} + +// heldBackOrMinted is a mint's answer as a tool gives it. +func heldBackOrMinted(m Minted, err error) (any, error) { + var held errHeldBack + if errors.As(err, &held) { + return map[string]any{"minted": false, "why": held.why}, nil + } + if err != nil { + return nil, err + } + return map[string]any{"minted": true, "account": m}, nil +} + +// IssueAccount is the seat's verb issue-account (ADR 0561 §9): one wanted user minted now, its key read afresh from the +// grants part's state. The recovery when a want was not heard: it mints nothing a want would not, and is refused while +// minting is off, for a node's account and the controller's (never minted here, §4), and for a user nobody wants. +func (v *Vault) IssueAccount(caller, user string) (any, error) { + user = strings.TrimSpace(user) + if user == "" { + return nil, errors.New("issue-account names a bus user (`user`), e.g. ace.mesh-build-go") + } + if nodeOrController(user) { + return nil, fmt.Errorf("%s is never minted by the vault: a node's account and the controller's keep the hash they "+ + "have (ADR 0561 §4)", user) + } + v.leaseAfresh() + if on, why := v.mintingOn(); !on { + return nil, fmt.Errorf("not minted: %s", why) + } + raw, found, err := []byte(nil), false, error(nil) + if v.WantRead != nil { + raw, found, err = v.WantRead(user) + } else if w, ok := v.wanted(user); ok { + raw, err = json.Marshal(w) + found = err == nil + } + if err != nil { + return nil, fmt.Errorf("the wanted account %s could not be read: %w", user, err) + } + if !found { + return nil, fmt.Errorf("the grants part holds no wanted account %s: the vault mints only what placement composes "+ + "(grants_accounts lists them)", user) + } + w, err := buscompose.ReadWantedAccount(user, raw) + if err != nil { + return nil, err + } + v.log("issue-account %s, asked by %s", user, someoneOr("", caller)) + return heldBackOrMinted(v.mintWanted(w, "issue-account by "+someoneOr("", caller))) +} + +// wantedUsers is every wanted user heard, sorted. +func (v *Vault) wantedUsers() []string { + v.minting.mu.Lock() + defer v.minting.mu.Unlock() + out := make([]string, 0, len(v.minting.wants)) + for u := range v.minting.wants { + out = append(out, u) + } + sort.Strings(out) + return out +} + +func (v *Vault) wanted(user string) (buscompose.WantedAccount, bool) { + v.minting.mu.Lock() + defer v.minting.mu.Unlock() + w, ok := v.minting.wants[user] + return w, ok +} + +// nodeOrController says user is a node's account or the controller's: never minted here (ADR 0561 §4, §9). +func nodeOrController(user string) bool { + return user == ControllerCaller || strings.HasPrefix(user, "node.") +} diff --git a/modules/mesh-vault/cmd/mesh-vault/mint_integration_test.go b/modules/mesh-vault/cmd/mesh-vault/mint_integration_test.go new file mode 100644 index 00000000..81f503b1 --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/mint_integration_test.go @@ -0,0 +1,422 @@ +//go:build integration + +package main + +// The vault whole against a real bus (novox/hq ADR 0561 §1 to §4, issue 774's acceptance 12): the built binary, played +// over its real stdin and stdout as the node's tool runtime plays it (tools/call with the caller in _meta; mesh/state.* +// and mesh/publish answered from a real nats-server's key-value buckets and subjects), its store in a directory of its +// own. A want written to the grants part's state is minted only once the controller's lease is handed away: the hash is +// in bus-accounts, own answers the value sealed to the node, the value is the controller's shape and its hash's +// password, account-issued is said; an adopted user is never minted, and a lease handed back mints nothing. + +import ( + "bufio" + "context" + "crypto/rand" + "encoding/base64" + "encoding/json" + "errors" + "fmt" + "io" + "os" + "os/exec" + "path/filepath" + "strings" + "sync" + "testing" + "time" + + "github.com/nats-io/nats.go" + "github.com/nats-io/nats.go/jetstream" + "golang.org/x/crypto/bcrypt" + "golang.org/x/crypto/nacl/box" + + "git.novox.be/novox/mesh-sdk/go/buscompose" + "git.novox.be/novox/mesh-sdk/go/seal" + "git.novox.be/novox/mesh-sdk/go/testbus" +) + +// wire is one line between the runtime and the bundle (the SDK's stdio message). +type wire struct { + ID json.RawMessage `json:"id,omitempty"` + Method string `json:"method,omitempty"` + Params json.RawMessage `json:"params,omitempty"` + Result json.RawMessage `json:"result,omitempty"` + Error *struct { + Code int `json:"code"` + Message string `json:"message"` + } `json:"error,omitempty"` +} + +// player is the node's tool runtime as far as the vault needs it, over a real bus. +type player struct { + t *testing.T + ctx context.Context + nc *nats.Conn + js jetstream.JetStream + + mu sync.Mutex + in io.Writer + next int + pending map[string]chan wire + said []string +} + +// bucketOf is the bucket a state names: the vault's own by its local name, another's as `.`. +func bucketOf(state string) string { + if owner, name, ok := strings.Cut(state, "."); ok { + return owner + "_" + name + } + return "mesh-vault_" + state +} + +func (p *player) send(m map[string]any) { + raw, _ := json.Marshal(m) + p.mu.Lock() + defer p.mu.Unlock() + _, _ = p.in.Write(append(raw, '\n')) +} + +func (p *player) answer(id json.RawMessage, result any, err error) { + if err != nil { + p.send(map[string]any{"id": id, "error": map[string]any{"code": -32000, "message": err.Error()}}) + return + } + p.send(map[string]any{"id": id, "result": result}) +} + +func (p *player) kv(state string) (jetstream.KeyValue, error) { + return p.js.KeyValue(p.ctx, bucketOf(state)) +} + +// serve answers what the bundle asks, and hands the answers to what the test asked it. +func (p *player) serve(out io.Reader) { + scanner := bufio.NewScanner(out) + scanner.Buffer(make([]byte, 1<<20), 1<<24) + for scanner.Scan() { + var m wire + if json.Unmarshal(scanner.Bytes(), &m) != nil { + continue + } + if m.Method == "" { + var key string + _ = json.Unmarshal(m.ID, &key) + p.mu.Lock() + ch := p.pending[key] + delete(p.pending, key) + p.mu.Unlock() + if ch != nil { + ch <- m + } + continue + } + go p.handle(m) + } +} + +func (p *player) handle(m wire) { + var a struct { + State string `json:"state"` + Key string `json:"key"` + Value json.RawMessage `json:"value"` + Body json.RawMessage `json:"body"` + } + _ = json.Unmarshal(m.Params, &a) + switch m.Method { + case "mesh/state.get": + kv, err := p.kv(a.State) + if err != nil { + p.answer(m.ID, nil, err) + return + } + e, err := kv.Get(p.ctx, a.Key) + if errors.Is(err, jetstream.ErrKeyNotFound) { + p.answer(m.ID, nil, nil) + return + } + if err != nil { + p.answer(m.ID, nil, err) + return + } + p.answer(m.ID, map[string]any{"key": e.Key(), "value": json.RawMessage(e.Value()), "revision": e.Revision()}, nil) + case "mesh/state.put": + kv, err := p.kv(a.State) + if err == nil { + var rev uint64 + rev, err = kv.Put(p.ctx, a.Key, a.Value) + if err == nil { + p.answer(m.ID, map[string]any{"revision": rev}, nil) + return + } + } + p.answer(m.ID, nil, err) + case "mesh/state.keys": + kv, err := p.kv(a.State) + if err != nil { + p.answer(m.ID, nil, err) + return + } + keys, err := kv.Keys(p.ctx) + if errors.Is(err, jetstream.ErrNoKeysFound) { + keys, err = []string{}, nil + } + p.answer(m.ID, keys, err) + case "mesh/state.delete": + kv, err := p.kv(a.State) + if err == nil { + err = kv.Delete(p.ctx, a.Key) + } + p.answer(m.ID, map[string]any{}, err) + case "mesh/state.watch": + kv, err := p.kv(a.State) + if err != nil { + p.answer(m.ID, nil, err) + return + } + key := strings.ReplaceAll(a.Key, "**", ">") + if key == "" { + key = ">" + } + w, err := kv.Watch(p.ctx, key) + if err != nil { + p.answer(m.ID, nil, err) + return + } + var watch string + _ = json.Unmarshal(m.ID, &watch) + current := true + for e := range w.Updates() { + if e == nil { + current = false + p.answer(m.ID, map[string]any{}, nil) + continue + } + op := "put" + if e.Operation() != jetstream.KeyValuePut { + op = "delete" + } + change := map[string]any{"state": a.State, "key": e.Key(), "op": op, "revision": e.Revision(), "current": current} + if op == "put" { + change["value"] = json.RawMessage(e.Value()) + } + p.mu.Lock() + p.next++ + id := fmt.Sprintf("w-%d", p.next) + p.mu.Unlock() + p.send(map[string]any{"id": id, "method": "mesh/state", "params": map[string]any{"watch": watch, "change": change}}) + } + case "mesh/publish": + var e struct { + Key string `json:"key"` + Body json.RawMessage `json:"body"` + } + _ = json.Unmarshal(m.Params, &e) + p.mu.Lock() + p.said = append(p.said, e.Key+" "+string(e.Body)) + p.mu.Unlock() + p.answer(m.ID, map[string]any{}, p.nc.Publish("mesh.mod.mesh-vault.event."+e.Key, e.Body)) + default: + // mesh/ask and the rest: nothing answers on this bus, as a call with no responder. + p.answer(m.ID, nil, errors.New("nats: no responders available for request")) + } +} + +// call is a tools/call of the vault as caller, answered as the tool's JSON. +func (p *player) call(name, caller string, args map[string]any) (json.RawMessage, error) { + p.mu.Lock() + p.next++ + id := fmt.Sprintf("c-%d", p.next) + ch := make(chan wire, 1) + p.pending[id] = ch + p.mu.Unlock() + p.send(map[string]any{"id": id, "method": "tools/call", "params": map[string]any{"name": name, "arguments": args, + "_meta": map[string]any{"mesh/caller": caller}}}) + select { + case m := <-ch: + var r struct { + Content []struct { + Text string `json:"text"` + } `json:"content"` + IsError bool `json:"isError"` + } + if m.Error != nil { + return nil, errors.New(m.Error.Message) + } + if err := json.Unmarshal(m.Result, &r); err != nil || len(r.Content) != 1 { + return nil, fmt.Errorf("%s answered %s", name, m.Result) + } + if r.IsError { + return nil, errors.New(r.Content[0].Text) + } + return json.RawMessage(r.Content[0].Text), nil + case <-time.After(30 * time.Second): + return nil, fmt.Errorf("%s did not answer in 30s", name) + } +} + +func (p *player) put(t *testing.T, state, key string, v any) { + t.Helper() + kv, err := p.kv(state) + if err != nil { + t.Fatal(err) + } + raw, _ := json.Marshal(v) + if _, err := kv.Put(p.ctx, key, raw); err != nil { + t.Fatal(err) + } +} + +func (p *player) hashOf(t *testing.T, user string) *AccountHash { + t.Helper() + kv, err := p.kv(BusAccountsState) + if err != nil { + t.Fatal(err) + } + e, err := kv.Get(p.ctx, user) + if errors.Is(err, jetstream.ErrKeyNotFound) { + return nil + } + if err != nil { + t.Fatal(err) + } + var a AccountHash + if err := json.Unmarshal(e.Value(), &a); err != nil { + t.Fatal(err) + } + return &a +} + +func eventually(t *testing.T, what string, ok func() bool) { + t.Helper() + for end := time.Now().Add(30 * time.Second); time.Now().Before(end); time.Sleep(50 * time.Millisecond) { + if ok() { + return + } + } + t.Fatalf("never: %s", what) +} + +// 774/AC12. +func TestTheVaultWholeMintsOnTheBusOnlyFromTheLeaseWrite(t *testing.T) { + ctx, cancel := context.WithCancel(context.Background()) + t.Cleanup(cancel) + dir := t.TempDir() + bin := filepath.Join(dir, "mesh-vault") + build := exec.Command("go", "build", "-o", bin, ".") + build.Stderr = os.Stderr + if err := build.Run(); err != nil { + t.Fatalf("the vault does not build: %v", err) + } + nc, err := nats.Connect(testbus.URL(t)) + if err != nil { + t.Fatal(err) + } + t.Cleanup(nc.Close) + js, err := jetstream.New(nc) + if err != nil { + t.Fatal(err) + } + for _, b := range []string{"mesh-vault_bus-accounts", "mesh-grants_accounts", "mesh-controller_lease", + "mesh-controller_assignments", "node-engine_have", "mesh-delivery-assigner_placement"} { + if _, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: b, History: 2}); err != nil { + t.Fatal(err) + } + } + // The operator key, as the mesh exports it to the vault's root. + opPub, _, err := box.GenerateKey(rand.Reader) + if err != nil { + t.Fatal(err) + } + root := filepath.Join(dir, "root") + _ = os.MkdirAll(root, 0o700) + export, _ := json.Marshal(map[string]string{"operator-key": base64.StdEncoding.EncodeToString(opPub[:])}) + if err := os.WriteFile(filepath.Join(root, "export.json"), export, 0o600); err != nil { + t.Fatal(err) + } + cmd := exec.CommandContext(ctx, bin) + cmd.Env = append(os.Environ(), "MESH_VAULT_STORE="+filepath.Join(dir, "store"), "MESH_VAULT_STATE="+filepath.Join(dir, "state"), + "MESH_VAULT_ROOT="+root, "MESH_VAULT_LEDGER="+filepath.Join(dir, "ledger"), "MESH_RECEIVES="+filepath.Join(dir, "mesh.json"), + "MESH_NODE=novox", "MESH_MODULE=mesh-vault") + stdin, _ := cmd.StdinPipe() + stdout, _ := cmd.StdoutPipe() + cmd.Stderr = os.Stderr + if err := cmd.Start(); err != nil { + t.Fatal(err) + } + t.Cleanup(func() { _ = stdin.Close(); cancel(); _ = cmd.Wait() }) + p := &player{t: t, ctx: ctx, nc: nc, js: js, in: stdin, pending: map[string]chan wire{}} + go p.serve(stdout) + + status := func() MintState { + raw, err := p.call("vault_status", "person.jochen", nil) + if err != nil { + return MintState{} + } + var s struct { + Minting MintState `json:"minting"` + } + _ = json.Unmarshal(raw, &s) + return s.Minting + } + // The controller holds the lease: a want is held back, nothing is minted. + p.put(t, "mesh-controller.lease", LeaseKey, map[string]any{"instance": "novox/1/2026-10-27", "epoch": 57}) + x, y, z := aWant("mod-x"), aWant("mod-y"), aWant("mod-z") + p.put(t, "mesh-vault.bus-accounts", y.User, AccountHash{User: y.User, Hash: "$2a$04$adoptedadoptedadoptedadoptedadoptedadoptedadopte", Adopted: true}) + p.put(t, "mesh-grants.accounts", x.User, x) + p.put(t, "mesh-grants.accounts", y.User, y) + eventually(t, "the want held back under the controller's lease", func() bool { + return strings.Contains(status().HeldBack[x.User], "controller holds the lease") + }) + if p.hashOf(t, x.User) != nil { + t.Fatal("minted under the controller's lease") + } + // The write that hands the lease away mints it. + p.put(t, "mesh-controller.lease", LeaseKey, map[string]any{"handed-to": "the operator's hand-over"}) + eventually(t, "the account minted at the lease write", func() bool { return p.hashOf(t, x.User) != nil }) + nodePub, nodePriv := aSealingKey(t) + if _, err := p.call(Seat+".node-key", "node.ace", map[string]any{"key": nodePub}); err != nil { + t.Fatal(err) + } + raw, err := p.call(Seat+".own", "node.ace", map[string]any{}) + if err != nil { + t.Fatal(err) + } + var own OwnAnswer + if err := json.Unmarshal(raw, &own); err != nil { + t.Fatal(err) + } + if len(own.Own) != 1 || own.Own[0].Module != "mod-x" || own.Own[0].Name != "broker" || own.Own[0].Origin != OriginMade { + t.Fatalf("own answers %+v", own.Own) + } + value, err := seal.Open(own.Own[0].Sealed, nodePriv) + if err != nil { + t.Fatal(err) + } + var held struct{ Password string } + _ = json.Unmarshal([]byte(value), &held) + shape, _ := buscompose.HeldCredential(x, held.Password) + if value != string(shape) { + t.Errorf("the minted value %q is not the controller's shape %q", value, shape) + } + if h := p.hashOf(t, x.User); bcrypt.CompareHashAndPassword([]byte(h.Hash), []byte(held.Password)) != nil || h.Adopted || h.Generation != 1 { + t.Errorf("bus-accounts %s holds %+v, not the minted password's hash", x.User, h) + } + if h := p.hashOf(t, y.User); h == nil || !h.Adopted { + t.Errorf("the adopted %s was replaced: %+v", y.User, h) + } + p.mu.Lock() + said := strings.Join(p.said, "\n") + p.mu.Unlock() + if !strings.Contains(said, AccountIssuedEvent+` {"`) || !strings.Contains(said, `"user":"ace.mod-x"`) || strings.Contains(said, held.Password) { + t.Errorf("the vault said: %s", said) + } + // Handed back to a controller: a new want mints nothing. + p.put(t, "mesh-controller.lease", LeaseKey, map[string]any{"instance": "novox/2/2026-10-28", "epoch": 58}) + p.put(t, "mesh-grants.accounts", z.User, z) + eventually(t, "the new want held back once the lease is the controller's again", func() bool { + return strings.Contains(status().HeldBack[z.User], "controller holds the lease") + }) + if p.hashOf(t, z.User) != nil { + t.Error("minted after the lease was handed back") + } +} diff --git a/modules/mesh-vault/cmd/mesh-vault/mint_test.go b/modules/mesh-vault/cmd/mesh-vault/mint_test.go new file mode 100644 index 00000000..e36454e5 --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/mint_test.go @@ -0,0 +1,244 @@ +package main + +import ( + "encoding/json" + "strings" + "testing" + + "git.novox.be/novox/mesh-sdk/go/buscompose" + "git.novox.be/novox/mesh-sdk/go/seal" +) + +// aWant is a wanted account of a module on ace, as the grants part writes it. +func aWant(module string) buscompose.WantedAccount { + return buscompose.WantedAccount{User: "ace." + module, Kind: buscompose.KindModule, Node: "ace", Module: module, + URL: "nats://novox.mesh:4222", Fingerprint: "ab:cd", Claims: []buscompose.ClaimedSeat{{Seat: "s", Scope: "node"}}} +} + +func wantRaw(t *testing.T, w buscompose.WantedAccount) []byte { + t.Helper() + raw, err := json.Marshal(w) + if err != nil { + t.Fatal(err) + } + return raw +} + +// mintingVault is a vault with a state of bus accounts, ace's sealing key stated, ace's modules assigned, and minting +// turned on or off as on says. +func mintingVault(t *testing.T, on bool) (testVault, *fakeAccounts, string) { + t.Helper() + plans := assignments{"ace.mod-x": `{"node":"ace","module":"mod-x"}`, "ace.mod-y": `{"node":"ace","module":"mod-y"}`} + v := newVault(t, nil) + v.Askers = Declared{Read: plans.read, Store: v.Store} + accounts := &fakeAccounts{} + v.Accounts = accounts + pub, priv := aSealingKey(t) + if err := v.recordNodeKey("ace", pub, "node.ace"); err != nil { + t.Fatal(err) + } + if on { + v.LeaseHeard([]byte(`{"handed-to":"the operator's hand-over"}`), true, nil) + } else { + v.LeaseHeard([]byte(`{"instance":"novox/1/2026-10-27","epoch":57}`), true, nil) + } + return v, accounts, priv +} + +// 774/AC7 (novox/hq ADR 0561 §1, §2, §4): a want with no value, minting on, is minted once: kept whole in the controller's +// shape as the module's broker, its hash in bus-accounts, said account-issued before secret-changed, and answered by own +// sealed to the node; a value held or a hash adopted is never minted. +func TestTheVaultMintsAWantedAccountOnceAndNothingItHolds(t *testing.T) { + v, accounts, nodePriv := mintingVault(t, true) + w := aWant("mod-x") + before := len(v.bus.events) + v.WantHeard(w.User, wantRaw(t, w), false) + rec, held, err := v.Store.Read("own/ace/mod-x/broker") + if err != nil || !held || rec.Generation != 1 || rec.Origin != OriginMade { + t.Fatalf("the minted account is kept as %+v (held %v, %v)", rec, held, err) + } + value, err := seal.Open(rec.AtRest, v.Own.PrivateKey) + if err != nil { + t.Fatal(err) + } + var got struct{ Password string } + _ = json.Unmarshal([]byte(value), &got) + shape, _ := buscompose.HeldCredential(w, got.Password) + if len(got.Password) != 40 || value != string(shape) { + t.Errorf("the minted value is %q, not the controller's shape %q", value, shape) + } + if !accounts.hashOf(w.User, got.Password, 1) { + t.Errorf("%s's hash is not the minted password's: %+v", w.User, accounts.keys[w.User]) + } + var order []string + for _, e := range v.bus.events[before:] { + order = append(order, e["event"].(string)) + } + if strings.Join(order, ",") != AccountHashedEvent+","+AccountIssuedEvent+","+ChangedEvent { + t.Errorf("said %v, want the hash, account-issued, then secret-changed", order) + } + for _, raw := range v.bus.raw[before:] { + if strings.Contains(raw, got.Password) || strings.Contains(raw, "$2a$") { + t.Errorf("a value or a hash was said: %s", raw) + } + } + own, err := v.OwnOfNode("node.ace") + if err != nil || len(own.Own) != 1 { + t.Fatalf("own answered %+v, %v", own, err) + } + if opened, err := seal.Open(own.Own[0].Sealed, nodePriv); err != nil || opened != value { + t.Errorf("own's sealed value opens to %q, %v", opened, err) + } + + // Heard again, or for a value held, or for a hash adopted: nothing is minted, nothing is held back. + v.WantHeard(w.User, wantRaw(t, w), false) + if rec, _, _ := v.Store.Read("own/ace/mod-x/broker"); rec.Generation != 1 { + t.Errorf("a want heard again minted generation %d", rec.Generation) + } + accounts.keys["ace.mod-y"] = AccountHash{User: "ace.mod-y", Hash: "$2a$04$adopted", Adopted: true} + y := aWant("mod-y") + v.WantHeard(y.User, wantRaw(t, y), false) + if _, held, _ := v.Store.Read("own/ace/mod-y/broker"); held || accounts.keys["ace.mod-y"].Hash != "$2a$04$adopted" { + t.Errorf("an adopted user was minted") + } + if st := v.MintState(); len(st.HeldBack) != 0 || len(st.Minted) != 1 { + t.Errorf("vault_status says %+v: an adopted user is not held back, one account minted", st) + } +} + +// 774/AC8 (novox/hq ADR 0561 §3): while the controller holds the lease nothing is minted and vault_status says why and +// names each wanted account held back (never an adopted one); the write that hands the lease away mints them; a lease +// handed back, expired or unreadable turns minting off again, read afresh before every mint. +func TestNothingIsMintedUntilTheLeaseIsHandedAway(t *testing.T) { + v, accounts, _ := mintingVault(t, false) + accounts.keys = map[string]AccountHash{"ace.mod-y": {User: "ace.mod-y", Hash: "$2a$04$adopted", Adopted: true}} + for _, m := range []string{"mod-x", "mod-y"} { + w := aWant(m) + v.WantHeard(w.User, wantRaw(t, w), false) + } + st := v.MintState() + if st.On || !strings.Contains(st.Why, "controller holds the lease") || len(st.HeldBack) != 1 || + !strings.Contains(st.HeldBack["ace.mod-x"], "controller holds the lease") { + t.Fatalf("under the controller's lease vault_status says %+v", st) + } + if _, held, _ := v.Store.Read("own/ace/mod-x/broker"); held { + t.Fatal("minted while the controller holds the lease") + } + // Handed away: the wanted account is minted at that write, the adopted one is not. + lease := []byte(`{"handed-to":"the operator's hand-over"}`) + v.LeaseRead = func() ([]byte, bool, error) { return lease, true, nil } + v.LeaseHeard(lease, true, nil) + if _, held, _ := v.Store.Read("own/ace/mod-x/broker"); !held { + t.Fatalf("not minted at the lease write: %+v", v.MintState()) + } + if _, held, _ := v.Store.Read("own/ace/mod-y/broker"); held { + t.Error("an adopted account was minted at the lease write") + } + if st := v.MintState(); !st.On || len(st.HeldBack) != 0 { + t.Errorf("after the lease write vault_status says %+v", st) + } + // The key expired (no watch hears a key's age pass): read afresh before the next mint, nothing is minted. + v.LeaseRead = func() ([]byte, bool, error) { return nil, false, nil } + z := aWant("mod-z") + v.WantHeard(z.User, wantRaw(t, z), false) + if _, held, _ := v.Store.Read("own/ace/mod-z/broker"); held { + t.Error("minted after the lease's key expired") + } + if st := v.MintState(); st.On || !strings.Contains(st.HeldBack["ace.mod-z"], "no lease is written") { + t.Errorf("after the key expired vault_status says %+v", st) + } +} + +// 774/AC10 issue-account (novox/hq ADR 0561 §9): the verb mints one wanted user now, read afresh; it is refused while +// minting is off, for a node's account and the controller's, and for a user nobody wants; a user held already is said so. +func TestIssueAccountMintsOneWantedUserNowAndRefusesTheRest(t *testing.T) { + v, _, _ := mintingVault(t, false) + w := aWant("mod-x") + raw := wantRaw(t, w) + v.WantRead = func(user string) ([]byte, bool, error) { + if user == w.User { + return raw, true, nil + } + return nil, false, nil + } + for user, says := range map[string]string{ + "ace.mod-x": "controller holds the lease", + "node.ace": "never minted", + "controller": "never minted", + } { + if _, err := v.IssueAccount("person.jochen", user); err == nil || !strings.Contains(err.Error(), says) { + t.Errorf("%s: %v, want a refusal saying %q", user, err, says) + } + } + v.LeaseHeard([]byte(`{"handed-to":"the operator's hand-over"}`), true, nil) + if _, err := v.IssueAccount("person.jochen", "ace.nobody"); err == nil || !strings.Contains(err.Error(), "no wanted account") { + t.Errorf("a user nobody wants: %v", err) + } + got, err := v.IssueAccount("person.jochen", w.User) + if err != nil || got.(map[string]any)["minted"] != true { + t.Fatalf("issue-account: %v, %v", got, err) + } + if again, err := v.IssueAccount("person.jochen", w.User); err != nil || again.(map[string]any)["minted"] != false || + !strings.Contains(again.(map[string]any)["why"].(string), "held already") { + t.Errorf("issue-account again: %v, %v", again, err) + } +} + +// 774/AC10 the rotation's rule (novox/hq ADR 0561 §4): at most one rotation begins per revision of the loaded user list, +// over the second login `--b`, never of a node's account, the controller's or an adopted hash, and `rotate` of a +// covered account stays refused, so nothing rotates in place. +func TestOneRotationBeginsPerRevisionOfTheLoadedList(t *testing.T) { + v, accounts, _ := mintingVault(t, true) + for _, m := range []string{"mod-x", "mod-y"} { + w := aWant(m) + v.WantHeard(w.User, wantRaw(t, w), false) + } + if _, err := v.BeginRotation("ace.mod-x"); err == nil || !strings.Contains(err.Error(), "not known yet") { + t.Errorf("began with no loaded revision known: %v", err) + } + v.LoadedListHeard(570) + r, err := v.BeginRotation("ace.mod-x") + if err != nil || r.Login != "ace.mod-x--b" || r.Revision != 570 || r.Generation != 2 || accounts.keys["ace.mod-x"].Rotating == nil { + t.Fatalf("the first rotation: %+v, %v", r, err) + } + if _, err := v.BeginRotation("ace.mod-y"); err == nil || !strings.Contains(err.Error(), "one rotation begins per revision") { + t.Errorf("a second rotation in one revision: %v", err) + } + v.LoadedListHeard(571) + if _, err := v.BeginRotation("ace.mod-y"); err != nil { + t.Errorf("the next revision's rotation: %v", err) + } + if _, err := v.BeginRotation("ace.mod-x"); err == nil || !strings.Contains(err.Error(), "rotating already") { + t.Errorf("an account rotating began again: %v", err) + } + accounts.keys["node.ace"] = AccountHash{User: "node.ace", Hash: "$2a$04$n", Adopted: true} + for _, u := range []string{"node.ace", "controller"} { + if _, err := v.BeginRotation(u); err == nil { + t.Errorf("%s began a rotation", u) + } + } + if _, err := v.RotateFor(ControllerCaller, "own/ace/mod-x/broker", Narrow{}, "the test", "a rotation in place"); err == nil { + t.Error("a covered account rotated in place") + } +} + +// A mint that failed (here: no operator key yet, so nothing can be kept) is tried again at the pass, never lost. +func TestAFailedMintIsTriedAgainAtThePass(t *testing.T) { + v, accounts, _ := mintingVault(t, true) + key, _ := v.Store.OperatorKey() + if err := v.Store.setOperatorKey("", "the test", v.Now()); err != nil { + t.Fatal(err) + } + w := aWant("mod-x") + v.WantHeard(w.User, wantRaw(t, w), false) + if _, ok := accounts.keys[w.User]; ok { + t.Fatal("minted with no operator key") + } + if err := v.Store.setOperatorKey(key, "the test", v.Now()); err != nil { + t.Fatal(err) + } + v.MintOwed() + if _, ok := accounts.keys[w.User]; !ok { + t.Errorf("not minted at the pass after the failure: %+v", v.MintState()) + } +} diff --git a/modules/mesh-vault/cmd/mesh-vault/ownnode.go b/modules/mesh-vault/cmd/mesh-vault/ownnode.go index 2112ed68..7f602a99 100644 --- a/modules/mesh-vault/cmd/mesh-vault/ownnode.go +++ b/modules/mesh-vault/cmd/mesh-vault/ownnode.go @@ -84,22 +84,31 @@ func (v *Vault) credentialRefusal(node string, c CredentialAsked, plan *planRead if c.Consumer != node { return fmt.Sprintf("%s asks as a consumer on %s, and is not that machine", node, c.Consumer) } - // The consuming module stands on the machine: read, never assumed (an assignment that cannot be read refuses). + // The consuming module stands on the machine: read from the placement and the assignments, never assumed (one + // that cannot be read refuses). The assignments' mirror can be behind, so one it does not hold is confirmed directly. + placed, err := v.placedOn(node, c.ConsumerModule) + if err != nil { + return fmt.Sprintf(notYetPrefix+"where %s stands could not be read: %v", c.ConsumerModule, err) + } + if placed { + return "" + } raw, why, err := plan.read(c.ConsumerModule) - if why != "" { + if why != "" && v.Placement.Read == nil { return why } - if err != nil { - return fmt.Sprintf(notYetPrefix+"the assignment %s.%s could not be read: %v", node, c.ConsumerModule, err) - } - if raw == nil { - // Confirmed directly before refusing: the mirror may not hold a module assigned a moment ago. - if raw, err = plan.confirmed(c.ConsumerModule); err != nil { + if why == "" { + if err != nil { return fmt.Sprintf(notYetPrefix+"the assignment %s.%s could not be read: %v", node, c.ConsumerModule, err) } + if raw == nil { + if raw, err = plan.confirmed(c.ConsumerModule); err != nil { + return fmt.Sprintf(notYetPrefix+"the assignment %s.%s could not be read: %v", node, c.ConsumerModule, err) + } + } } if raw == nil { - return fmt.Sprintf("%s is not on %s: neither assigned there nor required by a module there", c.ConsumerModule, node) + return fmt.Sprintf("%s is not on %s: neither placed nor assigned there, nor required by a module there", c.ConsumerModule, node) } return "" case "provider": diff --git a/modules/mesh-vault/cmd/mesh-vault/placed.go b/modules/mesh-vault/cmd/mesh-vault/placed.go new file mode 100644 index 00000000..8e00f828 --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/placed.go @@ -0,0 +1,134 @@ +package main + +// Where modules stand, from the placement (novox/hq ADR 0549 §3, §5; ADR 0561; issue 774), the seat mesh-placement's +// state held by the assigner (ADR 0567). The controller's assignments mirror goes with its lease, so the vault reads which +// module stands on which node from the seat's placement first, and the assignments beside it while both stand: a module either names stands. The provisioner's plan, +// which only an assignment's value carries, is read from the assignments still: its home after the lease is a subtask of +// its own (issue 774). + +import ( + "errors" + "fmt" + "slices" + "sort" + "strings" + + "git.novox.be/novox/mesh-sdk/go/delivery" +) + +// PlacementRead is the seat mesh-placement's placement, as the vault's manifest reads it (mesh-sdk's contract). +const PlacementRead = delivery.PlacementRead + +// PlacementReader reads the seat's placement: every key, and one key's value (nil when there is none). +type PlacementReader struct { + Keys func() ([]string, error) + Read func(key string) ([]byte, error) +} + +// placements is every node's placement, by node; none when the vault reads no placement. +func (v *Vault) placements() (map[string]delivery.Placement, error) { + out := map[string]delivery.Placement{} + if v.Placement.Keys == nil || v.Placement.Read == nil { + return out, nil + } + keys, err := v.Placement.Keys() + if err != nil { + return nil, fmt.Errorf("the placement's keys could not be read: %w", err) + } + for _, k := range keys { + node, err := delivery.ParsePlacementKey(k) + if err != nil { + continue + } + raw, err := v.Placement.Read(k) + if err != nil { + return nil, fmt.Errorf("the placement of %s could not be read: %w", node, err) + } + if raw == nil { + continue + } + p, err := delivery.DecodePlacement(raw) + if err != nil || p.Node != node { + continue + } + out[node] = p + } + return out, nil +} + +// placedOn says module is placed on node by the catalogue. +func (v *Vault) placedOn(node, module string) (bool, error) { + if v.Placement.Read == nil { + return false, nil + } + key, err := delivery.PlacementKey(node) + if err != nil { + return false, err + } + raw, err := v.Placement.Read(key) + if err != nil || raw == nil { + return false, err + } + p, err := delivery.DecodePlacement(raw) + if err != nil { + return false, fmt.Errorf("the placement of %s is not readable: %w", node, err) + } + return slices.Contains(p.Assigned(), module), nil +} + +// standsOn says module stands on node: placed there, or assigned there while the assignments stand. A read that fails is +// an error, never "not there". +func (v *Vault) standsOn(node, module string) (bool, error) { + placed, err := v.placedOn(node, module) + if err != nil || placed { + return placed, err + } + d, ok := v.Askers.(Declared) + if !ok || d.Read == nil { + if v.Placement.Read == nil { + return false, errors.New("the vault reads neither the placement nor the assignments") + } + return false, nil + } + raw, err := standing(d.Read)(node + "." + module) + return raw != nil, err +} + +// busNode is the node running the bus's module: from the placement, and from the assignments while no placement names +// one. The vault adopts from one node alone. +func (v *Vault) busNode() (string, error) { + placed, err := v.placements() + if err != nil { + return "", err + } + var nodes []string + for node, p := range placed { + if slices.Contains(p.Assigned(), BusModule) { + nodes = append(nodes, node) + } + } + from := "placed" + if len(nodes) == 0 && v.Assignments.Keys != nil { + from = "assigned" + keys, err := v.Assignments.Keys() + if err != nil { + return "", fmt.Errorf("the assignments' keys could not be read: %w", err) + } + for _, k := range keys { + if node, module, ok := strings.Cut(k, "."); ok && module == BusModule { + nodes = append(nodes, node) + } + } + } else if len(nodes) == 0 && len(placed) == 0 { + return "", errors.New("the vault reads neither the placement nor the assignments, so it cannot tell which node holds the bus") + } + sort.Strings(nodes) + switch len(nodes) { + case 1: + return nodes[0], nil + case 0: + return "", fmt.Errorf("no node is %s the bus module %s", from, BusModule) + } + return "", fmt.Errorf("%d nodes are %s the bus module %s (%s): the vault adopts from one alone", len(nodes), from, + BusModule, strings.Join(nodes, ", ")) +} diff --git a/modules/mesh-vault/cmd/mesh-vault/placed_test.go b/modules/mesh-vault/cmd/mesh-vault/placed_test.go new file mode 100644 index 00000000..dfae8948 --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/placed_test.go @@ -0,0 +1,66 @@ +package main + +import ( + "strings" + "testing" + + "git.novox.be/novox/mesh-sdk/go/delivery" +) + +// placementsOf is the seat mesh-placement's placement of each node, as the vault reads it. +func placementsOf(t *testing.T, nodes map[string][]string) PlacementReader { + t.Helper() + values := map[string][]byte{} + for node, modules := range nodes { + p := delivery.Placement{V: delivery.Version, Node: node} + for _, m := range modules { + p.Modules = append(p.Modules, delivery.PlacedModule{Module: m}) + } + raw, err := delivery.EncodePlacement(p) + if err != nil { + t.Fatal(err) + } + key, _ := delivery.PlacementKey(node) + values[key] = raw + } + return PlacementReader{ + Keys: func() ([]string, error) { + var out []string + for k := range values { + out = append(out, k) + } + return out, nil + }, + Read: func(key string) ([]byte, error) { return values[key], nil }, + } +} + +// 774/AC11 (novox/hq ADR 0561, ADR 0549 §3, §5): with no assignments to read, the vault tells from the seat's +// placement which node holds the bus and whether a consumer's module stands on its node; while both stand, a module +// either names stands. +func TestTheVaultReadsWhereModulesStandFromPlacement(t *testing.T) { + v := newVault(t, nil) + v.Placement = placementsOf(t, map[string][]string{"novox": {"nats", "web"}, "ace": {"shop"}}) + if node, err := v.busNode(); err != nil || node != "novox" { + t.Errorf("the bus node from placement: %q, %v", node, err) + } + asked := func(node, module string) CredentialAsked { + return CredentialAsked{Role: "consumer", Provision: "postgres", Consumer: node, ConsumerModule: module, Provider: "novox"} + } + if why := v.credentialRefusal("ace", asked("ace", "shop"), v.plansOf("ace")); why != "" { + t.Errorf("shop stands on ace by placement, refused: %s", why) + } + if why := v.credentialRefusal("ace", asked("ace", "web"), v.plansOf("ace")); !strings.Contains(why, "is not on ace") { + t.Errorf("web is not placed on ace, and is answered %q", why) + } + // While both stand, an assignment still names a module placement does not yet. + v.Askers = Declared{Read: assignments{"ace.web": `{"node":"ace","module":"web"}`}.read, Store: v.Store} + if why := v.credentialRefusal("ace", asked("ace", "web"), v.plansOf("ace")); why != "" { + t.Errorf("web assigned on ace, refused: %s", why) + } + // Two nodes placed with the bus: the vault adopts from neither. + v.Placement = placementsOf(t, map[string][]string{"novox": {"nats"}, "ace": {"nats"}}) + if _, err := v.busNode(); err == nil || !strings.Contains(err.Error(), "2 nodes") { + t.Errorf("two bus nodes: %v", err) + } +} diff --git a/modules/mesh-vault/cmd/mesh-vault/retire.go b/modules/mesh-vault/cmd/mesh-vault/retire.go new file mode 100644 index 00000000..ea694aa9 --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/retire.go @@ -0,0 +1,264 @@ +package main + +// A wanted account no longer wanted is retired within ADR 0230's bounds (novox/hq ADR 0561 §2, issue 774). +// +// The grants part deletes a wanted account's key when no input names its user any more. The vault then retires the +// account: it takes its hash out of `bus-accounts`, so the grants part's next list drops the user, and marks the value +// retired in its store, keeping it (a value is deleted only by a person, ADR 0230). As ADR 0230 §15 and §18 have it, the +// same set of accounts gone must stand for five passes and ten minutes first, and a set of more than three, or more than +// half of the accounts held, waits for a person, who retires them with `account_retire`. Wanted again, an account is +// re-enabled at once: the mark taken off and its hash written again. Nothing is retired while the controller holds the +// lease (it forgets the accounts it mints), or before the wanted accounts are read whole. + +import ( + "errors" + "fmt" + "sort" + "strings" + "time" +) + +// retiring is what the passes keep of the accounts no longer wanted, under minting.mu. +type retiring struct { + wantsRead bool + key string + passes int + first time.Time + waiting []string + why string + retired []string +} + +// RetireState is what vault_status says of retirement. +type RetireState struct { + Gone []string `json:"gone"` + Passes int `json:"passes"` + Since time.Time `json:"since,omitzero"` + Waiting []string `json:"waiting_for_a_person"` + Why string `json:"why"` + Retired []string `json:"retired"` +} + +// RetireState answers how retirement stands. +func (v *Vault) RetireState() RetireState { + m := &v.minting + m.mu.Lock() + defer m.mu.Unlock() + r := m.retiring + out := RetireState{Passes: r.passes, Since: r.first, Why: r.why, Waiting: append([]string{}, r.waiting...), + Retired: append([]string{}, r.retired...), Gone: []string{}} + if r.key != "" { + out.Gone = strings.Split(r.key, " ") + } + return out +} + +// WantsRead says the wanted accounts were read whole once (the watch handed every current key): only then is an account +// with no key known to be no longer wanted. +func (v *Vault) WantsRead() { + v.minting.mu.Lock() + defer v.minting.mu.Unlock() + v.minting.retiring.wantsRead = true +} + +// wantGone is a wanted account's key deleted: forgotten as wanted, its retirement left to the passes. +func (v *Vault) wantGone(user string) { + v.minting.mu.Lock() + defer v.minting.mu.Unlock() + delete(v.minting.wants, user) + delete(v.minting.heldBack, user) +} + +// wantBack is a wanted account's key written: a retired account of it is re-enabled at once. +func (v *Vault) wantBack(user string) { + w, ok := v.wanted(user) + if !ok { + return + } + secret, err := AccountSecret(w) + if err != nil { + return + } + rec, held, err := v.Store.Read(secret) + if err != nil || !held || rec.Retired == nil { + return + } + rec.Retired = nil + if err := v.Store.Write(rec); err != nil { + v.log("%s is wanted again and NOT RE-ENABLED: its mark could not be taken off: %v", user, err) + return + } + if _, err := v.HashAccount(secret, true); err != nil { + v.hashes.owe(secret, err.Error()) + v.log("%s is wanted again and its hash is not written yet, written at the next pass: %v", user, err) + } + v.minting.mu.Lock() + r := &v.minting.retiring + for i, u := range r.retired { + if u == user { + r.retired = append(r.retired[:i], r.retired[i+1:]...) + break + } + } + v.minting.mu.Unlock() + v.log("%s is wanted again: re-enabled, its hash written again", user) +} + +// goneAccounts are the users whose hash the vault wrote from a value it holds and that no wanted key names, sorted, and +// how many such hashes it holds in all. +func (v *Vault) goneAccounts() ([]string, int, error) { + users, err := v.Accounts.Users() + if err != nil { + return nil, 0, err + } + var gone []string + held := 0 + for _, u := range users { + a, err := v.Accounts.Get(u) + if err != nil { + return nil, 0, err + } + if a == nil || a.Adopted || a.Of == "" { + continue + } + held++ + if _, wanted := v.wanted(u); !wanted { + gone = append(gone, u) + } + } + sort.Strings(gone) + return gone, held, nil +} + +// RetirePass is one pass of retirement, at the vault's minute pass. +func (v *Vault) RetirePass() { + if v.Accounts == nil { + return + } + v.leaseAfresh() + on, leaseWhy := v.mintingOn() + m := &v.minting + m.mu.Lock() + read := m.retiring.wantsRead + m.mu.Unlock() + reset := func(why string) { + m.mu.Lock() + defer m.mu.Unlock() + m.retiring.key, m.retiring.passes, m.retiring.first, m.retiring.waiting, m.retiring.why = "", 0, time.Time{}, nil, why + } + switch { + case !read: + reset("the wanted accounts are not read whole yet, so none is known to be gone") + return + case !on: + reset("nothing is retired: " + leaseWhy) + return + } + gone, held, err := v.goneAccounts() + if err != nil { + reset("the accounts held could not be read: " + err.Error()) + return + } + if len(gone) == 0 { + reset("") + return + } + now := v.Now().UTC() + key := strings.Join(gone, " ") + m.mu.Lock() + r := &m.retiring + if r.key != key { + r.key, r.passes, r.first, r.waiting = key, 0, now, nil + } + r.passes++ + passes, since := r.passes, r.first + m.mu.Unlock() + setWhy := func(why string, waiting []string) { + m.mu.Lock() + defer m.mu.Unlock() + m.retiring.why, m.retiring.waiting = why, waiting + } + if passes < StablePasses || now.Sub(since) < StableFor { + setWhy(fmt.Sprintf("%d no longer wanted (%s): retired once the same set stands for %d passes and %s (ADR 0230)", + len(gone), key, StablePasses, StableFor), nil) + return + } + if len(gone) > RetireAtOnce || float64(len(gone)) > RetireFraction*float64(held) { + why := fmt.Sprintf("%d accounts are no longer wanted, more than %d or more than half of the %d held at once: they "+ + "wait for a person (account_retire), ADR 0230 §18", len(gone), RetireAtOnce, held) + setWhy(why, gone) + v.log("%s: %s", why, key) + return + } + for _, u := range gone { + if err := v.retireOne(u, "no longer wanted by the grants part", "the vault's pass"); err != nil { + v.log("%s is not retired: %v", u, err) + } + } + reset("") +} + +// retireOne marks the value of user's account retired and takes its hash out of bus-accounts. +func (v *Vault) retireOne(user, why, by string) error { + a, err := v.Accounts.Get(user) + if err != nil { + return err + } + if a == nil || a.Adopted || a.Of == "" { + return fmt.Errorf("the vault holds no account of %s it made or was handed: an adopted hash is never retired here", user) + } + rec, held, err := v.Store.Read(a.Of) + if err != nil { + return err + } + if held { + rec.Retired = &RetiredMark{At: v.Now().UTC().Format(time.RFC3339), Why: why + ", by " + by} + if err := v.Store.Write(rec); err != nil { + return fmt.Errorf("its value could not be marked retired: %w", err) + } + } + if err := v.Accounts.Delete(user); err != nil { + return fmt.Errorf("its hash could not be taken out of %s: %w", BusAccountsState, err) + } + v.minting.mu.Lock() + v.minting.retiring.retired = append(v.minting.retiring.retired, user) + v.minting.mu.Unlock() + v.log("retired the bus account %s (%s): its hash is out of %s and its value kept, marked; %s", user, a.Of, + BusAccountsState, why) + return nil +} + +// RetireAccounts is the tool account_retire: a person retires accounts no longer wanted, past ADR 0230's bound, with why. +func (v *Vault) RetireAccounts(caller string, users []string, why string) (any, error) { + if strings.TrimSpace(why) == "" { + return nil, errors.New("account_retire says why (`why`)") + } + if len(users) == 0 { + return nil, errors.New("account_retire names the accounts (`users`), as vault_status lists them waiting") + } + // As the passes: never while the controller holds the lease (it forgets the accounts it mints), nor before the wanted + // accounts are read whole (an account not read yet is not known to be gone). + v.leaseAfresh() + if on, why := v.mintingOn(); !on { + return nil, fmt.Errorf("nothing was retired: %s", why) + } + v.minting.mu.Lock() + read := v.minting.retiring.wantsRead + v.minting.mu.Unlock() + if !read { + return nil, errors.New("nothing was retired: the wanted accounts are not read whole yet, so none is known to be gone") + } + for _, u := range users { + if _, wanted := v.wanted(u); wanted { + return nil, fmt.Errorf("%s is still wanted by the grants part: only an account no longer wanted is retired; nothing was retired", u) + } + } + var done []string + for _, u := range users { + if err := v.retireOne(u, strings.TrimSpace(why), someoneOr("", caller)); err != nil { + return map[string]any{"retired": done}, fmt.Errorf("%s: %w", u, err) + } + done = append(done, u) + } + return map[string]any{"retired": done}, nil +} diff --git a/modules/mesh-vault/cmd/mesh-vault/retire_test.go b/modules/mesh-vault/cmd/mesh-vault/retire_test.go new file mode 100644 index 00000000..2c4fe6ae --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/retire_test.go @@ -0,0 +1,89 @@ +package main + +import ( + "strings" + "testing" + "time" +) + +// 774/AC9 (novox/hq ADR 0561 §2, ADR 0230 §15, §18): a wanted account whose key is deleted is retired (its hash taken +// out of bus-accounts, its value kept, marked) only once the same set has stood for five passes and ten minutes, and never +// more than three, or more than half of those held, at once: past that it waits for a person (account_retire). Wanted +// again, it is re-enabled at once; and a retired account is not hashed again at a start. +func TestAWantGoneRetiresItsAccountOnlyWithinTheBounds(t *testing.T) { + v, accounts, _ := mintingVault(t, true) + clock := time.Date(2026, 10, 28, 9, 0, 0, 0, time.UTC) + v.Now = func() time.Time { return clock } + modules := []string{"m1", "m2", "m3", "m4", "m5", "m6", "m7", "m8"} + for _, m := range modules { + w := aWant(m) + v.WantHeard(w.User, wantRaw(t, w), false) + } + v.WantsRead() + if len(accounts.keys) != 8 { + t.Fatalf("minted %d", len(accounts.keys)) + } + pass := func(n int, every time.Duration) { + for i := 0; i < n; i++ { + clock = clock.Add(every) + v.RetirePass() + } + } + v.WantHeard("ace.m1", nil, true) + pass(5, time.Second) + if _, ok := accounts.keys["ace.m1"]; !ok { + t.Fatal("retired after five passes in five seconds: ADR 0230 waits ten minutes too") + } + pass(1, 10*time.Minute) + if _, ok := accounts.keys["ace.m1"]; ok { + t.Fatalf("not retired after five passes and ten minutes: %+v", v.RetireState()) + } + if rec, held, _ := v.Store.Read("own/ace/m1/broker"); !held || rec.Retired == nil { + t.Fatalf("the retired account's value is %+v (held %v): kept, and marked", rec, held) + } + if written, _ := v.HashHeld(); len(written) != 0 { + t.Errorf("a start hashed a retired account again: %+v", written) + } + // Wanted again: re-enabled at once. + w := aWant("m1") + v.WantHeard(w.User, wantRaw(t, w), false) + if rec, _, _ := v.Store.Read("own/ace/m1/broker"); rec.Retired != nil || accounts.keys["ace.m1"].Hash == "" { + t.Fatalf("wanted again, ace.m1 is %+v with hash %v", rec.Retired, accounts.keys["ace.m1"]) + } + // Four gone at once is over the bound: it waits for a person, who retires them by hand. + for _, m := range modules[4:] { + v.WantHeard("ace."+m, nil, true) + } + pass(6, 3*time.Minute) + st := v.RetireState() + if len(accounts.keys) != 8 || len(st.Waiting) != 4 || !strings.Contains(st.Why, "more than 3") { + t.Fatalf("over the bound: %d keys, %+v", len(accounts.keys), st) + } + if _, err := v.RetireAccounts("person.jochen", []string{"ace.m5"}, ""); err == nil { + t.Error("retired by hand with no why") + } + if _, err := v.RetireAccounts("person.jochen", []string{"ace.m2"}, "test"); err == nil { + t.Error("retired by hand an account still wanted") + } + // Never while the controller holds the lease, nor before the wants are read whole. + held := v.LeaseRead + v.LeaseRead = func() ([]byte, bool, error) { return []byte(`{"instance":"novox/1","epoch":57}`), true, nil } + if _, err := v.RetireAccounts("person.jochen", []string{"ace.m5"}, "the modules left"); err == nil || !strings.Contains(err.Error(), "controller holds the lease") { + t.Errorf("retired by hand under the controller's lease: %v", err) + } + v.LeaseRead = held + v.LeaseHeard([]byte(`{"handed-to":"the operator's hand-over"}`), true, nil) + v.minting.mu.Lock() + v.minting.retiring.wantsRead = false + v.minting.mu.Unlock() + if _, err := v.RetireAccounts("person.jochen", []string{"ace.m5"}, "the modules left"); err == nil || !strings.Contains(err.Error(), "not read whole") { + t.Errorf("retired by hand before the wants were read: %v", err) + } + v.WantsRead() + if _, err := v.RetireAccounts("person.jochen", []string{"ace.m5", "ace.m6"}, "the modules left"); err != nil { + t.Fatal(err) + } + if _, ok := accounts.keys["ace.m5"]; ok || len(accounts.keys) != 6 { + t.Errorf("after a person's retirement %d keys remain", len(accounts.keys)) + } +} diff --git a/modules/mesh-vault/cmd/mesh-vault/rotation.go b/modules/mesh-vault/cmd/mesh-vault/rotation.go new file mode 100644 index 00000000..31244f97 --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/rotation.go @@ -0,0 +1,94 @@ +package main + +// The record of a bus account's rotation, and its one rule (novox/hq ADR 0561 §4; issue 774, the lead's decision of +// 2026-10-27). A module's, a process's or a provisioner client's account rotates over two credentials (ADR 0114 §10): +// a second login, `--b`, carrying the first login's permissions verbatim, which the bus composer composes only while +// the account's key in `bus-accounts` names it in `rotating`. The vault starts at most one rotation per revision of the +// user list the bus loaded. What composes and delivers the second login is a subtask of its own, before the lease write; +// until it is built nothing begins a rotation, and `rotate` of a covered account stays refused, so nothing rotates in +// place. + +import ( + "fmt" + "strings" + "time" +) + +// SecondLoginSuffix makes an account's second login: reserved, so no module or process may be named to end in it. +const SecondLoginSuffix = "--b" + +// Rotating is a rotation under way, as the account's key in bus-accounts says it: the second login, the generation of +// the value it carries, since when, and the revision of the loaded user list it began at. +type Rotating struct { + Login string `json:"login"` + Generation int `json:"generation"` + Since time.Time `json:"since"` + Revision uint64 `json:"revision"` +} + +// LoadedListHeard keeps the revision of the user list the bus node says it loaded (its have of the bus module). +func (v *Vault) LoadedListHeard(revision uint64) { + v.minting.mu.Lock() + defer v.minting.mu.Unlock() + if revision > v.minting.loadedRevision { + v.minting.loadedRevision = revision + } +} + +// BeginRotation records a rotation of user's account at the loaded list's revision, under the one rule: none for a +// node's account or the controller's, none while minting is off, none of an account the vault did not make or was not +// handed, none twice for one account, and none when another began at this revision. +func (v *Vault) BeginRotation(user string) (Rotating, error) { + if nodeOrController(user) { + return Rotating{}, fmt.Errorf("%s does not rotate here: a node's account and the controller's keep the hash they have (ADR 0561 §4)", user) + } + if on, why := v.mintingOn(); !on { + return Rotating{}, fmt.Errorf("no rotation begins: %s", why) + } + v.minting.mu.Lock() + revision := v.minting.loadedRevision + v.minting.mu.Unlock() + if revision == 0 { + return Rotating{}, fmt.Errorf("no rotation begins: the revision of the user list the bus loaded is not known yet") + } + users, err := v.Accounts.Users() + if err != nil { + return Rotating{}, err + } + var mine *AccountHash + began := "" + for _, u := range users { + a, err := v.Accounts.Get(u) + if err != nil { + return Rotating{}, err + } + if a == nil { + continue + } + if a.Rotating != nil && a.Rotating.Revision == revision { + began = u + } + if u == user { + mine = a + } + } + switch { + case mine == nil || mine.Adopted || mine.Of == "": + return Rotating{}, fmt.Errorf("the vault holds no account of %s it made or was handed, so it rotates none", user) + case mine.Rotating != nil: + return Rotating{}, fmt.Errorf("%s is rotating already, since %s (second login %s)", user, mine.Rotating.Since.Format(time.RFC3339), mine.Rotating.Login) + case strings.HasSuffix(user, SecondLoginSuffix): + return Rotating{}, fmt.Errorf("%s is a second login, which never rotates of its own", user) + case began != "": + return Rotating{}, fmt.Errorf("no rotation of %s begins: %s's began at the loaded list's revision %d, and one "+ + "rotation begins per revision (ADR 0561 §4)", user, began, revision) + } + r := Rotating{Login: user + SecondLoginSuffix, Generation: mine.Generation + 1, Since: v.Now().UTC(), Revision: revision} + next := *mine + next.Rotating = &r + if err := v.Accounts.Put(next); err != nil { + return Rotating{}, err + } + v.log("a rotation of %s begins at the loaded list's revision %d: second login %s", user, revision, r.Login) + return r, nil +} diff --git a/modules/mesh-vault/cmd/mesh-vault/signing.go b/modules/mesh-vault/cmd/mesh-vault/signing.go new file mode 100644 index 00000000..7e05eb14 --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/signing.go @@ -0,0 +1,463 @@ +package main + +// The vault signs (novox/hq ADR 0550 §2; issue 774, design 47's L3 item d). It makes an ed25519 signing key and an x509 +// authority once, keeps each as its own secret with its operator copy (ADR 0113 §22), publishes their public halves in its +// state `signers`, and signs with them on its verb `sign`: a node's certificate for that node's node-engine alone, built +// from bus state (the name from the node's placement, the serving key from its record), never from bytes the caller chose. +// Each signature is said as `signed` and kept in the record of hand-outs, never a key. The controller's key is never +// copied here. + +import ( + "crypto/ed25519" + "crypto/rand" + "crypto/x509" + "encoding/base64" + "encoding/json" + "encoding/pem" + "errors" + "fmt" + "strings" + "time" + + stdio "git.novox.be/novox/mesh-sdk/go" + "git.novox.be/novox/mesh-sdk/go/delivery" + "git.novox.be/novox/mesh-sdk/go/overlay" +) + +// The vault's own signing secrets: each an ed25519 seed in base64 (never PEM, which the vault takes as a private key +// someone sent it and refuses). +const ( + SigningKeySecret = "signing/key" + AuthorityKeySecret = "signing/authority-key" + // signedOutcome marks a signature in the record of hand-outs. + signedOutcome = "signed" +) + +// signingSecret says name is one of the vault's signing secrets, which no asker is ever handed. +func signingSecret(name string) bool { return name == SigningKeySecret || name == AuthorityKeySecret } + +// SignersStore is the vault's state `signers` (delivery.SignersBucket): a key's value, or nil; and a write. +type SignersStore interface { + Get(key string) ([]byte, error) + Put(key string, value []byte) error +} + +// busSigners is SignersStore over the vault's own state through its runtime. +type busSigners struct{} + +func (busSigners) Get(key string) ([]byte, error) { + e, err := stdio.State(delivery.SignersState).Get(key) + if err != nil || e == nil { + return nil, err + } + return e.Value, nil +} + +func (busSigners) Put(key string, value []byte) error { + _, err := stdio.State(delivery.SignersState).Put(key, json.RawMessage(value)) + return err +} + +// signingKeys are the vault's two keys, opened, and the authority's certificate. +type signingKeys struct { + key ed25519.PrivateKey + keyMade time.Time + authority ed25519.PrivateKey + authorityMade time.Time + certificate string + parsed *x509.Certificate +} + +// EnsureSigning makes the signing key and the authority once, when the store holds neither, and answers whether it made +// them. **Never made again over what is held** (as OwnKey refuses a new key beside secrets): one held without the other, +// or none held while `signers` already publishes a key, is a lost key, refused loudly with nothing made, because every +// node trusts what was published and a new key would be one nobody trusts. +func (v *Vault) EnsureSigning() (bool, error) { + _, keyHeld, err := v.Store.Read(SigningKeySecret) + if err != nil { + return false, err + } + _, authHeld, err := v.Store.Read(AuthorityKeySecret) + if err != nil { + return false, err + } + switch { + case keyHeld && authHeld: + return false, nil + case keyHeld != authHeld: + missing := AuthorityKeySecret + if authHeld { + missing = SigningKeySecret + } + return false, fmt.Errorf("THE VAULT'S %s IS MISSING BESIDE THE OTHER SIGNING SECRET: nothing is made, since a new one "+ + "would be trusted by no node; put it back from its operator copy (novox/hq ADR 0113 §21, ADR 0550 §2)", missing) + } + if v.Signers != nil { + if raw, err := v.Signers.Get(delivery.SignersKeyKey); err != nil { + return false, fmt.Errorf("the vault's state %s could not be read, so no signing key is made: %w", delivery.SignersRead, err) + } else if raw != nil { + return false, fmt.Errorf("THE VAULT'S SIGNING KEYS ARE MISSING WHILE %s PUBLISHES ONE: nothing is made, since every "+ + "node trusts the published key; put them back from their operator copies (novox/hq ADR 0113 §21)", delivery.SignersRead) + } + } + for _, name := range []string{SigningKeySecret, AuthorityKeySecret} { + _, priv, err := ed25519.GenerateKey(rand.Reader) + if err != nil { + return false, err + } + if _, err := v.keepWith(name, base64.StdEncoding.EncodeToString(priv.Seed()), "the vault", "", OriginMade, + keepOptions{neverReplace: true, quiet: true}); err != nil { + return false, fmt.Errorf("the vault's %s is not made: %w", name, err) + } + } + v.log("made the vault's signing key and authority, each kept with its operator copy (ADR 0550 §2)") + return true, nil +} + +// openSeed is a signing secret opened: its private key and when it was made. +func (v *Vault) openSeed(name string) (ed25519.PrivateKey, time.Time, error) { + r, held, err := v.Store.Read(name) + if err != nil { + return nil, time.Time{}, err + } + if !held { + return nil, time.Time{}, fmt.Errorf("the vault holds no %s yet: it is made once the operator key is taken", name) + } + value, err := openAtRest(r, v) + if err != nil { + return nil, time.Time{}, fmt.Errorf("%s does not open with the vault's key: %w", name, err) + } + seed, err := base64.StdEncoding.DecodeString(value) + if err != nil || len(seed) != ed25519.SeedSize { + return nil, time.Time{}, fmt.Errorf("%s is not an ed25519 seed", name) + } + return ed25519.NewKeyFromSeed(seed), r.MadeAt, nil +} + +// keys opens both signing secrets and derives the authority's certificate from its key and when it was made, so it is the +// same certificate at every start. +func (v *Vault) keys() (signingKeys, error) { + key, keyMade, err := v.openSeed(SigningKeySecret) + if err != nil { + return signingKeys{}, err + } + auth, authMade, err := v.openSeed(AuthorityKeySecret) + if err != nil { + return signingKeys{}, err + } + pub := auth.Public().(ed25519.PublicKey) + tmpl := delivery.AuthorityTemplate(pub, authMade) + der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, pub, auth) + if err != nil { + return signingKeys{}, fmt.Errorf("the vault's authority certificate could not be made: %w", err) + } + parsed, err := x509.ParseCertificate(der) + if err != nil { + return signingKeys{}, err + } + return signingKeys{key: key, keyMade: keyMade, authority: auth, authorityMade: authMade, parsed: parsed, + certificate: string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}))}, nil +} + +// SignersValues are the two keys of `signers` as the vault holds them now. +func (v *Vault) SignersValues() (delivery.SignerKey, delivery.SignerAuthority, error) { + k, err := v.keys() + if err != nil { + return delivery.SignerKey{}, delivery.SignerAuthority{}, err + } + fp, err := delivery.AuthorityFingerprint(k.certificate) + if err != nil { + return delivery.SignerKey{}, delivery.SignerAuthority{}, err + } + return delivery.NewSignerKey(k.key.Public().(ed25519.PublicKey), k.keyMade), + delivery.SignerAuthority{Certificate: k.certificate, Fingerprint: fp, Made: k.authorityMade.UTC()}, nil +} + +// PublishSigners writes `signers` from the keys the vault holds, each key only when its value differs (or always with +// force, signers_reassert), and answers which keys it wrote. +func (v *Vault) PublishSigners(force bool) ([]string, error) { + if v.Signers == nil { + return nil, errors.New("the vault has no state " + delivery.SignersRead + " to write") + } + key, auth, err := v.SignersValues() + if err != nil { + return nil, err + } + var written []string + for name, value := range map[string]any{delivery.SignersKeyKey: key, delivery.SignersAuthorityKey: auth} { + raw, err := json.Marshal(value) + if err != nil { + return written, err + } + if !force { + held, err := v.Signers.Get(name) + if err != nil { + return written, fmt.Errorf("%s %s could not be read: %w", delivery.SignersRead, name, err) + } + if same(held, raw) { + continue + } + } + if err := v.Signers.Put(name, raw); err != nil { + return written, fmt.Errorf("%s %s could not be written: %w", delivery.SignersRead, name, err) + } + written = append(written, name) + } + if len(written) > 0 { + v.log("wrote %s %s (ADR 0550 §2)", delivery.SignersRead, strings.Join(written, " and ")) + } + return written, nil +} + +// same says two JSON values are the same value. +func same(a, b []byte) bool { + if a == nil || b == nil { + return false + } + var x, y any + if json.Unmarshal(a, &x) != nil || json.Unmarshal(b, &y) != nil { + return false + } + ra, _ := json.Marshal(x) + rb, _ := json.Marshal(y) + return string(ra) == string(rb) +} + +// SigningPass makes the keys once and publishes `signers` when it differs: each minute pass, after the operator key. +func (v *Vault) SigningPass() error { + if _, err := v.EnsureSigning(); err != nil { + return err + } + if v.Signers == nil { + return nil + } + _, err := v.PublishSigners(false) + return err +} + +// SignArgs are `sign`'s arguments: the kind, and the kind's fields. +type SignArgs struct { + Kind string + Node string + Reply string +} + +// Sign answers caller's `sign`. The caller is the one the runtime proved; who may ask which kind is the vault's rule, +// never an argument: a node certificate for a machine's node-engine alone, about its own machine; an enrolment for no +// caller until adoption's record names one (ADR 0561 §5); the authority for the vault itself, never asked. +func (v *Vault) Sign(caller string, a SignArgs) (delivery.SignAnswer, error) { + if caller == "" || caller == stdio.Unproven || !busUser.MatchString(caller) { + return delivery.SignAnswer{}, errors.New("the vault signs only for a caller the runtime proved") + } + switch a.Kind { + case delivery.KindNodeCertificate: + return v.signNodeCertificate(caller, a.Node) + case delivery.KindEnrolment: + return delivery.SignAnswer{}, fmt.Errorf("%s may not ask for an enrolment's signature: no caller is named for it until "+ + "adoption's record names the seat that adopts (novox/hq ADR 0561 §5)", caller) + case delivery.KindAuthority: + return delivery.SignAnswer{}, fmt.Errorf("the authority is the vault's own, signed for itself; %s may not ask it", caller) + } + return delivery.SignAnswer{}, fmt.Errorf("%q is not a kind the vault signs (%s)", a.Kind, strings.Join(delivery.SignKinds, ", ")) +} + +// signNodeCertificate signs the certificate of the calling machine's internal name for the serving key its record states. +func (v *Vault) signNodeCertificate(caller, asked string) (delivery.SignAnswer, error) { + node, ok := nodeEngineOf(caller) + if !ok { + return delivery.SignAnswer{}, fmt.Errorf("a node certificate is signed for a machine's node-engine alone, about its own "+ + "machine; %s is not a node-engine", caller) + } + if asked != "" && asked != node { + return delivery.SignAnswer{}, fmt.Errorf("%s asks for the certificate of %s, and is %s's node-engine: a machine asks for its own alone", caller, asked, node) + } + name, err := v.internalName(node) + if err != nil { + return delivery.SignAnswer{}, err + } + serving, err := v.servingKey(node) + if err != nil { + return delivery.SignAnswer{}, err + } + k, err := v.keys() + if err != nil { + return delivery.SignAnswer{}, err + } + der, err := x509.CreateCertificate(rand.Reader, delivery.NodeCertificateTemplate(name, serving, k.authorityMade), + k.parsed, serving, k.authority) + if err != nil { + return delivery.SignAnswer{}, fmt.Errorf("the certificate of %s could not be signed: %w", name, err) + } + fp, _ := delivery.AuthorityFingerprint(k.certificate) + answer := delivery.SignAnswer{Kind: delivery.KindNodeCertificate, Node: node, Authority: k.certificate, + Certificate: string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})), Signer: fp, Digest: delivery.DigestOf(der)} + if err := v.saySigned(caller, AuthorityKeySecret, answer); err != nil { + return delivery.SignAnswer{}, err + } + return answer, nil +} + +// internalName is node's name inside the mesh: only a node with an address on the private network in its placement has +// one (a certificate for a name nothing resolves is one nothing can check). +func (v *Vault) internalName(node string) (string, error) { + if v.Placement.Read == nil { + return "", errors.New("the vault reads no placement, so it cannot tell a node's internal name") + } + key, err := delivery.PlacementKey(node) + if err != nil { + return "", err + } + raw, err := v.Placement.Read(key) + if err != nil { + return "", fmt.Errorf(notYetPrefix+"the placement of %s could not be read: %w", node, err) + } + if raw == nil { + return "", fmt.Errorf("%s has no placement of the seat mesh-placement, so it has no name inside the mesh", node) + } + p, err := delivery.DecodePlacement(raw) + if err != nil { + return "", fmt.Errorf("the placement of %s is not readable: %w", node, err) + } + if p.Decided.Address == "" { + return "", fmt.Errorf("%s is not on the private network (its placement names no address), so it has no name inside the mesh to be certified for", node) + } + return overlay.InternalName(node), nil +} + +// servingKey is the serving key node's record states, `.node` of the have bucket, which that node alone writes. +func (v *Vault) servingKey(node string) (ed25519.PublicKey, error) { + if v.Haves == nil { + return nil, errors.New("the vault cannot read the have bucket (" + HaveRead + "), so it cannot read a node's record") + } + key, err := delivery.HaveNodeKey(node) + if err != nil { + return nil, err + } + raw, err := v.Haves(key) + if err != nil { + return nil, fmt.Errorf(notYetPrefix+"%s %s could not be read: %w", HaveRead, key, err) + } + if raw == nil { + return nil, fmt.Errorf("%s has written no record (%s %s), so it states no serving key", node, HaveRead, key) + } + h, err := delivery.DecodeHaveNode(raw) + if err != nil { + return nil, fmt.Errorf("the record of %s is not readable: %w", node, err) + } + if h.Record == nil || h.Record.ServingKey == "" { + return nil, fmt.Errorf("%s's record states no serving key, so there is no key to certify", node) + } + pub, err := base64.StdEncoding.DecodeString(h.Record.ServingKey) + if err != nil || len(pub) != ed25519.PublicKeySize { + return nil, fmt.Errorf("%s's serving key is not an ed25519 public key in base64", node) + } + return ed25519.PublicKey(pub), nil +} + +// saySigned keeps the signature in the record of hand-outs and says `signed`: who, which kind, which node, the digest and +// the signer's fingerprint. Never a key. A signature whose record cannot be written is not answered. +func (v *Vault) saySigned(caller, with string, a delivery.SignAnswer) error { + at := v.Now().UTC() + if err := v.recordHanding(Handing{To: caller, Name: with, Outcome: signedOutcome, + Why: a.Kind + " " + a.Node + " " + a.Digest}); err != nil { + return fmt.Errorf("the signature is not answered: its record could not be written: %w", err) + } + if v.Emit == nil { + return nil + } + raw, _ := json.Marshal(delivery.Signed{Caller: caller, Kind: a.Kind, Node: a.Node, Digest: a.Digest, Signer: a.Signer, At: at}) + var body map[string]any + _ = json.Unmarshal(raw, &body) + if err := v.Emit(delivery.SignedEvent, body); err != nil { + v.log("signed %s for %s, but %s could not be said: %v", a.Kind, caller, delivery.SignedEvent, err) + } + return nil +} + +// SignedRow is one signature as vault_signed lists it. +type SignedRow struct { + At time.Time `json:"at"` + Caller string `json:"caller"` + With string `json:"with"` + Kind string `json:"kind"` + Node string `json:"node,omitempty"` + Digest string `json:"digest"` +} + +// Signatures are the last signatures the vault made, newest first, at most limit. +func (v *Vault) Signatures(limit int) ([]SignedRow, error) { + all, err := v.Store.Handed(10000) + if err != nil { + return nil, err + } + out := []SignedRow{} + for _, h := range all { + if h.Outcome != signedOutcome || len(out) >= limit { + continue + } + f := strings.Fields(h.Why) + row := SignedRow{At: h.At, Caller: h.To, With: h.Name} + if len(f) == 3 { + row.Kind, row.Node, row.Digest = f[0], f[1], f[2] + } + out = append(out, row) + } + return out, nil +} + +// SigningState is what vault_status and vault_signers say of the signing secrets: whether each is held, its operator +// copy, and the fingerprints held against those published. +func (v *Vault) SigningState() map[string]any { + out := map[string]any{} + for _, name := range []string{SigningKeySecret, AuthorityKeySecret} { + r, held, err := v.Store.Read(name) + row := map[string]any{"held": held} + if err != nil { + row["error"] = err.Error() + } + if held { + row["generation"], row["made"], row["operator_copy"] = r.Generation, r.MadeAt, r.Operator.Sealed != "" + } + out[name] = row + } + key, auth, err := v.SignersValues() + if err != nil { + out["error"] = err.Error() + return out + } + out["key_fingerprint"], out["authority_fingerprint"] = key.Fingerprint, auth.Fingerprint + if v.Signers == nil { + return out + } + published := map[string]any{} + match := true + for name, want := range map[string]string{delivery.SignersKeyKey: key.Fingerprint, delivery.SignersAuthorityKey: auth.Fingerprint} { + raw, err := v.Signers.Get(name) + var got struct { + Fingerprint string `json:"fingerprint"` + } + if err != nil || raw == nil || json.Unmarshal(raw, &got) != nil { + published[name], match = nil, false + continue + } + published[name] = got.Fingerprint + match = match && got.Fingerprint == want + } + out["published"], out["published_matches"] = published, match + return out +} + +// signingSaid says why the signing pass did not finish, once, and again when it changes. +func (v *Vault) signingSaid(err error) { + line := "" + if err != nil { + line = err.Error() + } + v.mu.Lock() + changed := line != v.signingWhy + v.signingWhy = line + v.mu.Unlock() + if changed && line != "" { + v.log("the vault signs nothing yet: %s", line) + } +} diff --git a/modules/mesh-vault/cmd/mesh-vault/signing_test.go b/modules/mesh-vault/cmd/mesh-vault/signing_test.go new file mode 100644 index 00000000..68ef9f6d --- /dev/null +++ b/modules/mesh-vault/cmd/mesh-vault/signing_test.go @@ -0,0 +1,196 @@ +package main + +import ( + "crypto/ed25519" + "crypto/rand" + "encoding/base64" + "encoding/json" + "strings" + "testing" + + "git.novox.be/novox/mesh-sdk/go/delivery" + "git.novox.be/novox/mesh-sdk/go/overlay" + "git.novox.be/novox/mesh-sdk/go/seal" +) + +// signersState is the vault's state `signers` in memory, counting writes. +type signersState struct { + keys map[string][]byte + writes int +} + +func (s *signersState) Get(key string) ([]byte, error) { return s.keys[key], nil } +func (s *signersState) Put(key string, value []byte) error { + s.keys[key] = append([]byte(nil), value...) + s.writes++ + return nil +} + +// L3 s2 to s5 (novox/hq ADR 0550 §2): the vault makes its signing key and authority once, with their operator copies and +// no other holder; publishes their public halves only when they differ; signs a node's certificate for that node's +// node-engine alone, from its placement's name and its record's serving key; and no answer, event or record carries a +// key. +func TestTheVaultSigns(t *testing.T) { + v := newVault(t, nil) + state := &signersState{keys: map[string][]byte{}} + v.Signers = state + servingPub, _, _ := ed25519.GenerateKey(rand.Reader) + placements := map[string]delivery.Placement{ + "ace": {Node: "ace", Decided: delivery.NodeDecided{Address: "10.77.0.3"}}, + "g14": {Node: "g14", Decided: delivery.NodeDecided{Address: "10.77.0.4"}}, + "plain": {Node: "plain"}, + } + v.Placement = PlacementReader{Read: func(key string) ([]byte, error) { + node, err := delivery.ParsePlacementKey(key) + if err != nil { + return nil, err + } + p, ok := placements[node] + if !ok { + return nil, nil + } + return delivery.EncodePlacement(p) + }} + records := map[string]string{"ace": base64.StdEncoding.EncodeToString(servingPub), "plain": base64.StdEncoding.EncodeToString(servingPub)} + v.Haves = func(key string) ([]byte, error) { + node, _, _ := strings.Cut(key, ".") + serving, ok := records[node] + if !ok { + return nil, nil + } + return delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: node, ServingKey: serving}}) + } + + // s2: made once, kept with their operator copies; a second pass makes nothing new and writes nothing again (s5). + if err := v.SigningPass(); err != nil { + t.Fatal(err) + } + var seeds []string + for _, name := range []string{SigningKeySecret, AuthorityKeySecret} { + r, held, err := v.Store.Read(name) + if err != nil || !held || r.Generation != 1 { + t.Fatalf("%s: held %v at generation %d, %v", name, held, r.Generation, err) + } + value, _ := seal.Open(r.AtRest, v.Own.PrivateKey) + if got := openOperator(t, v.operatorPublic, v.operatorPrivate, r.Operator.Sealed); got != value { + t.Errorf("%s: the operator copy does not open to the value held", name) + } + seeds = append(seeds, value) + } + key1, auth1, err := v.SignersValues() + if err != nil { + t.Fatal(err) + } + writes := state.writes + if writes != 2 { + t.Errorf("signers written %d times at the first pass, want its two keys", writes) + } + if err := v.SigningPass(); err != nil { + t.Fatal(err) + } + key2, auth2, _ := v.SignersValues() + if key2 != key1 || auth2 != auth1 || state.writes != writes { + t.Errorf("a second pass changed the keys or wrote signers again (%d writes)", state.writes) + } + if _, err := delivery.DecodeSignerKey(state.keys[delivery.SignersKeyKey]); err != nil { + t.Errorf("signers' key: %v", err) + } + authority, err := delivery.DecodeSignerAuthority(state.keys[delivery.SignersAuthorityKey]) + if err != nil { + t.Fatalf("signers' authority: %v", err) + } + // No other holder: `get` hands neither, even to an asker a rule names for it. + asker, _ := seal.GenerateKeyPair() + v.Askers = AllowList{"node.ace": {SigningKeySecret, AuthorityKeySecret}} + for _, name := range []string{SigningKeySecret, AuthorityKeySecret} { + if _, err := v.Get("node.ace", name, asker.PublicKey); err == nil { + t.Errorf("get handed %s", name) + } + } + v.Askers = nil + if forced, err := v.PublishSigners(true); err != nil || len(forced) != 2 { + t.Errorf("signers_reassert wrote %v, %v", forced, err) + } + + // s3, s4: who may ask which kind, and the certificate built from bus state. + for _, row := range []struct { + name, caller, kind, node, refused string + }{ + {"a module is not a node-engine", "ace.mesh-grants", delivery.KindNodeCertificate, "", "not a node-engine"}, + {"another node's certificate", "node.g14", delivery.KindNodeCertificate, "ace", "its own alone"}, + {"a node not on the private network", "node.plain", delivery.KindNodeCertificate, "", "not on the private network"}, + {"a node that states no serving key", "node.g14", delivery.KindNodeCertificate, "", "no record"}, + {"an enrolment has no caller yet", "node.ace", delivery.KindEnrolment, "", "ADR 0561 §5"}, + {"the authority is the vault's own", "node.ace", delivery.KindAuthority, "", "the vault's own"}, + {"an unproven caller", "", delivery.KindNodeCertificate, "", "proved"}, + {"the node's own certificate", "node.ace", delivery.KindNodeCertificate, "ace", ""}, + } { + v.bus.raw = nil + got, err := v.Sign(row.caller, SignArgs{Kind: row.kind, Node: row.node}) + if row.refused != "" { + if err == nil || !strings.Contains(err.Error(), row.refused) { + t.Errorf("%s: %v, want refused saying %q", row.name, err, row.refused) + } + if len(v.bus.raw) != 0 { + t.Errorf("%s: refused, and said %v", row.name, v.bus.raw) + } + continue + } + if err != nil { + t.Fatalf("%s: %v", row.name, err) + } + if err := delivery.CheckNodeCertificate(got.Certificate, []string{authority.Certificate}, overlay.InternalName("ace"), + servingPub, authority.Made.Add(1)); err != nil { + t.Errorf("%s: the certificate does not check against signers' authority: %v", row.name, err) + } + if got.Signer != authority.Fingerprint || got.Digest == "" { + t.Errorf("%s: signer %s, digest %q", row.name, got.Signer, got.Digest) + } + // Said once as signed, kept in the record, and no key in any of it. + answer, _ := json.Marshal(got) + said := strings.Join(v.bus.raw, "\n") + if !strings.Contains(said, `"event":"signed"`) || !strings.Contains(said, got.Digest) { + t.Errorf("%s: signed not said: %s", row.name, said) + } + rows, _ := v.Signatures(10) + if len(rows) != 1 || rows[0].Caller != "node.ace" || rows[0].Kind != delivery.KindNodeCertificate || rows[0].Digest != got.Digest { + t.Errorf("%s: vault_signed lists %+v", row.name, rows) + } + status, _ := json.Marshal(v.SigningState()) + for _, seed := range seeds { + raw, _ := base64.StdEncoding.DecodeString(seed) + priv := ed25519.NewKeyFromSeed(raw) + for _, text := range []string{string(answer), said, string(status), string(state.keys[delivery.SignersKeyKey]), + string(state.keys[delivery.SignersAuthorityKey])} { + if strings.Contains(text, seed) || strings.Contains(text, base64.StdEncoding.EncodeToString(priv)) { + t.Errorf("%s: a signing key's private half is in what the vault says: %s", row.name, text) + } + } + } + } + // A serving key changed in the record is the one certified next, never the one before. + other, _, _ := ed25519.GenerateKey(rand.Reader) + records["ace"] = base64.StdEncoding.EncodeToString(other) + got, err := v.Sign("node.ace", SignArgs{Kind: delivery.KindNodeCertificate}) + if err != nil || delivery.CheckNodeCertificate(got.Certificate, []string{authority.Certificate}, overlay.InternalName("ace"), + servingPub, authority.Made.Add(1)) == nil { + t.Errorf("a certificate for a serving key the record no longer states: %v", err) + } + + // s2: one secret lost beside the other, or both lost while signers publishes a key, makes nothing. + lost := newVault(t, nil) + lost.Signers = &signersState{keys: map[string][]byte{delivery.SignersKeyKey: state.keys[delivery.SignersKeyKey]}} + if made, err := lost.EnsureSigning(); made || err == nil || !strings.Contains(err.Error(), "MISSING") { + t.Errorf("keys made while signers publishes one: %v, %v", made, err) + } + half := newVault(t, nil) + if _, err := half.Put(SigningKeySecret, seeds[0], "the test"); err != nil { + t.Fatal(err) + } + if made, err := half.EnsureSigning(); made || err == nil || !strings.Contains(err.Error(), "MISSING") { + t.Errorf("an authority made beside a held signing key: %v, %v", made, err) + } + if _, held, _ := half.Store.Read(AuthorityKeySecret); held { + t.Error("the authority was made all the same") + } +} diff --git a/modules/mesh-vault/cmd/mesh-vault/store.go b/modules/mesh-vault/cmd/mesh-vault/store.go index 430f2ea2..8ede49d2 100644 --- a/modules/mesh-vault/cmd/mesh-vault/store.go +++ b/modules/mesh-vault/cmd/mesh-vault/store.go @@ -52,6 +52,8 @@ type Record struct { // (move-in with replace_running, owntake.go): kept sealed as it was, so the replacement can be read and undone. Any later // change of the secret drops it. Previous *PreviousValue `json:"previous,omitempty"` + // Retired marks a bus account no longer wanted (retire.go, ADR 0561 §2): its value kept, its hash taken out. + Retired *RetiredMark `json:"retired,omitempty"` } // PreviousValue is a replaced value as the store kept it: its generation, both its seals, and who changed it when. diff --git a/modules/mesh-vault/cmd/mesh-vault/tools.go b/modules/mesh-vault/cmd/mesh-vault/tools.go index 62709e5b..b6fc006a 100644 --- a/modules/mesh-vault/cmd/mesh-vault/tools.go +++ b/modules/mesh-vault/cmd/mesh-vault/tools.go @@ -122,7 +122,8 @@ func definitions(env *Env) []toolDef { }}, {Name: Seat + ".secret-ask", Description: "Ask the operator for a module's own secret at a desk (ADR 0349 clause 9, ADR 0277 §22–§27), " + - "asked by the controller alone: node, module, name, desk and asked_by. The ask is recorded before any " + + "asked by the controller (naming asked_by) or by a caller the vault's manifest names, itself named by the " + + "bus (ADR 0563 §8): node, module, name and desk. The ask is recorded before any " + "prompt opens — one open ask per secret and three an hour — and the vault asks the desk's prompt itself, " + "in its own name, with a key made for the call; what is typed opens in the vault alone. Answers how the " + "prompt ended (given, dismissed, timed-out, empty, refused or failed) and who asked as recorded; never " + @@ -130,7 +131,7 @@ func definitions(env *Env) []toolDef { Input: map[string]any{"type": "object", "properties": map[string]any{ "node": str("the machine the secret is for"), "module": str("the module"), "name": str("the secret's name in the module"), "desk": str("the machine whose prompt asks"), - "asked_by": str("who asked the controller, as the bus named its caller")}}, + "asked_by": str("from the controller alone: who asked it, as the bus named its caller")}}, run: func(caller string, a map[string]any) (any, error) { v, err := env.ready() if err != nil { @@ -303,6 +304,20 @@ func definitions(env *Env) []toolDef { // clause 9, adopt.go): a public half, never the private one. return map[string]any{"recorded": true, "vault_key": v.Own.PublicKey}, nil }}, + {Name: Seat + ".issue-account", + Description: "Mint one bus account the grants part wants, now (novox/hq ADR 0561 §9): the recovery when the vault did not " + + "hear a want. Reads the wanted key afresh from mesh-grants.accounts and mints it as a want would: only while " + + "the controller's lease is handed away, never for a node's account or the controller's, never a user nobody " + + "wants, and never anew for one whose value the vault holds or whose hash it adopted (it says so). Answers " + + "whether it minted, the secret and generation, never the value or the hash.", + Input: map[string]any{"user": str("the bus user, e.g. ace.mesh-build-go")}, + run: func(caller string, a map[string]any) (any, error) { + v, err := env.ready() + if err != nil { + return nil, err + } + return v.IssueAccount(caller, arg(a, "user")) + }}, {Name: Seat + ".own", Description: "The own secrets of this machine's modules, each sealed to the machine's sealing key (novox/hq ADR 0547 §2, " + "ADR 0550 §5, issue 1126): from the node-engine of the machine alone, about its own machine (the bus proves which), " + @@ -476,6 +491,28 @@ func definitions(env *Env) []toolDef { } return env.Vault.HashUser(arg(a, "user"), caller) }}, + {Name: "account_retire", + Description: "Retire bus accounts the grants part no longer wants, by a person's act with why (novox/hq ADR 0561 §2, " + + "ADR 0230 §18): the vault takes each one's hash out of its state `bus-accounts`, so the grants part's next user " + + "list drops the user, and keeps its value marked retired. For the set vault_status lists as waiting for a " + + "person (more than three, or more than half, gone at once); refused for an account still wanted, an adopted " + + "hash, and with no why. Wanted again, an account is re-enabled at once.", + Input: map[string]any{"users": map[string]any{"type": "array", "items": str("a bus user")}, + "why": str("why they are retired")}, + run: func(caller string, a map[string]any) (any, error) { + if env.Vault == nil { + return nil, errors.New("the vault is not ready") + } + var users []string + if list, ok := a["users"].([]any); ok { + for _, u := range list { + if s, ok := u.(string); ok { + users = append(users, strings.TrimSpace(s)) + } + } + } + return env.Vault.RetireAccounts(caller, users, arg(a, "why")) + }}, {Name: "secret_vault_export", Description: "Every secret the vault itself holds, as its copy sealed to the operator key, in the shape of " + "`secret export`: saved to a file, `nox secret recover vault mesh-vault --key " + @@ -537,6 +574,57 @@ func definitions(env *Env) []toolDef { } return map[string]any{"deleted": consumer, "freed_bytes": -1}, nil }}, + {Name: Seat + ".sign", + Description: "Sign with the vault's key or authority (novox/hq ADR 0550 §2). Kind node-certificate: the certificate " + + "of the calling machine's internal name for the serving key its record states, built from bus state alone and " + + "asked by that machine's node-engine only (the bus proves which); kind enrolment: no caller is named until " + + "adoption's record (ADR 0561 §5). Answers the certificate, the authority, the signer's fingerprint and the " + + "digest, and says signed. Never a key.", + Input: map[string]any{"kind": str("node-certificate or enrolment"), + "node": str("the machine, for a node certificate: the caller's own (left out, the caller's)"), + "reply": str("the enrolment reply's bytes in base64, for an enrolment")}, + run: func(caller string, a map[string]any) (any, error) { + v, err := env.ready() + if err != nil { + return nil, err + } + return v.Sign(caller, SignArgs{Kind: arg(a, "kind"), Node: arg(a, "node"), Reply: arg(a, "reply")}) + }}, + {Name: "vault_signers", + Description: "The vault's signing key and authority (novox/hq ADR 0550 §2): whether each is held with its operator " + + "copy, the fingerprints the vault holds, what its state signers publishes, and whether they match. Never a key.", + run: func(string, map[string]any) (any, error) { + v, err := env.ready() + if err != nil { + return nil, err + } + return v.SigningState(), nil + }}, + {Name: "vault_signed", + Description: "The last signatures the vault made, newest first: when, the caller the bus proved, the kind, the node " + + "and the digest of what was signed. Never a key.", + Input: map[string]any{"limit": map[string]any{"type": "number", "description": "how many (default 50)"}}, + run: func(_ string, a map[string]any) (any, error) { + v, err := env.ready() + if err != nil { + return nil, err + } + return v.Signatures(limitOf(a)) + }}, + {Name: "signers_reassert", + Description: "Write the vault's state signers again from the keys it holds, whether or not it differs (novox/hq " + + "ADR 0550 §2): the by-hand path for a state lost or doubted. Makes no key.", + run: func(string, map[string]any) (any, error) { + v, err := env.ready() + if err != nil { + return nil, err + } + written, err := v.PublishSigners(true) + if err != nil { + return nil, err + } + return map[string]any{"written": written}, nil + }}, {Name: "vault_health", Description: "The vault's runtime health, as the node-engine asks it (novox/hq ADR 0366): unhealthy once " + "re-sealing the operator copies has failed on three passes in a row, saying what failed and why; " + @@ -544,7 +632,9 @@ func definitions(env *Env) []toolDef { run: func(string, map[string]any) (any, error) { return env.health(), nil }}, {Name: "vault_status", Description: "What needs a person's eye in the vault: operator copies still sealed to an earlier key, the operator " + - "key the mesh's export holds if the vault refused it, and how often the record of hand-outs was rolled.", + "key the mesh's export holds if the vault refused it, how often the record of hand-outs was rolled, and " + + "minting (novox/hq ADR 0561 §3, §9): whether the vault mints bus accounts now and why (only while the " + + "controller's lease is handed away), every wanted account it holds back with why, and those it minted.", run: func(string, map[string]any) (any, error) { if env.Vault == nil { return map[string]any{"ready": false, "error": fmt.Sprint(env.Broken)}, nil @@ -556,7 +646,7 @@ func definitions(env *Env) []toolDef { key, _ := env.Vault.Store.OperatorKey() return map[string]any{"ready": true, "operator_key": key, "copies_on_an_earlier_key": left, "operator_key_refused": env.keyRefused(), "handed_rolled": env.Vault.Store.Rolled(), - "ok": left == 0 && env.keyRefused() == "" && key != ""}, nil + "minting": env.Vault.MintState(), "retiring": env.Vault.RetireState(), "signing": env.Vault.SigningState(), "ok": left == 0 && env.keyRefused() == "" && key != ""}, nil }}, } } diff --git a/modules/mesh-vault/cmd/mesh-vault/vault.go b/modules/mesh-vault/cmd/mesh-vault/vault.go index 1d93f4bb..7d4aeec0 100644 --- a/modules/mesh-vault/cmd/mesh-vault/vault.go +++ b/modules/mesh-vault/cmd/mesh-vault/vault.go @@ -40,8 +40,12 @@ type Vault struct { // account (ADR 0259 §8's runs-as, issue 723): the desks' secret prompt and each issuing provider's tool, which // the bus lets the vault's account alone call in its own name. Nil asks nobody. Ask func(key string, body any) (json.RawMessage, error) - Now func() time.Time - Log func(format string, args ...any) + // AskCallers are the callers besides the controller that may ask secret-ask themselves, as the vault's manifest names + // them (MESH_VAULT_SECRET_ASK_CALLERS; novox/hq ADR 0563 §8): each is named by the runtime's proof. Empty: the + // controller alone. + AskCallers stdio.Callers + Now func() time.Time + Log func(format string, args ...any) // Accounts is the vault's state of bus-account hashes (accounts.go, ADR 0547 clause 9): nil writes none. Accounts AccountStore // HashCost is the bcrypt cost of those hashes: zero is the controller's, bcrypt's default. @@ -58,6 +62,19 @@ type Vault struct { hashes hashing // adoption is the last adoption (adopt.go), under mu. adoption adoptionKept + // WantRead reads one wanted account afresh (issue-account): nil reads the wants as the watch handed them. + WantRead func(user string) ([]byte, bool, error) + // Placement reads the seat's placement (placed.go): where modules stand once the assignments are gone. + Placement PlacementReader + // LeaseRead reads the controller's lease afresh before a mint (lease.go): nil reads it only as the watch hands it. + LeaseRead func() ([]byte, bool, error) + // minting is the switch on the lease and what the vault knows of the wanted bus accounts (mint.go). + minting minting + // Signers is the vault's state `signers`, where it publishes its signing halves (signing.go, ADR 0550 §2): nil writes + // none. + Signers SignersStore + // signingWhy is why the last signing pass did not finish, under mu (signing.go). + signingWhy string // callsMu guards pending: the keys of the calls open now (intake.go), never written anywhere. callsMu sync.Mutex pending map[string]*callKey @@ -106,8 +123,10 @@ func (v *Vault) keep(name, value, by, via, origin string) (Changed, error) { // was first made, and where it was moved from. type keepOptions struct { neverReplace bool - madeAt time.Time - movedFrom *MovedFrom + // quiet keeps secret-changed for the caller to say once the rest is done (a minted account: mint.go). + quiet bool + madeAt time.Time + movedFrom *MovedFrom // replaceOnly, keepPrevious and refuse are what move-in with replace_running keeps (owntake.go): only a value held is replaced, // keeping its origin and the value it replaces, and refuse, under the store's lock, says why a held value is not. replaceOnly bool @@ -208,7 +227,9 @@ func (v *Vault) keepLocked(name, value, by, via, origin string, opt keepOptions) return Changed{}, err } c := Changed{Name: name, Generation: rec.Generation, At: now, By: by} - v.announce(c) + if !opt.quiet { + v.announce(c) + } return c, nil } @@ -283,6 +304,10 @@ func (v *Vault) Get(caller, name, publicKey string) (Answer, error) { if err := validName(name); err != nil { return Answer{}, err } + // The vault's signing secrets are handed to nobody: it signs with them itself (ADR 0550 §2). + if signingSecret(name) { + return Answer{}, fmt.Errorf("%s is the vault's own signing secret and is handed to nobody: ask the verb sign", name) + } // A value issued for one holder is that holder's alone, whatever else would allow it (issue 749). if why := notTheHolder(caller, name); why != "" { v.log("refused %s to %s: %s", name, caller, why) diff --git a/modules/mesh-vault/cmd/mesh-vault/vault_test.go b/modules/mesh-vault/cmd/mesh-vault/vault_test.go index 1a3b002c..0eeb517e 100644 --- a/modules/mesh-vault/cmd/mesh-vault/vault_test.go +++ b/modules/mesh-vault/cmd/mesh-vault/vault_test.go @@ -131,9 +131,11 @@ func filesUnder(t *testing.T, dir string) map[string]string { // The manifest declares one bucket, and no secret is in it: the vault's only place for a secret is its own store on its // own disk (ADR 0349 §7, ADR 0201 §13). The one bucket is bus-accounts, the bcrypt hashes of the bus accounts it holds -// (ADR 0547 clause 9), opened in accounts.go alone. It reads two buckets of others', and only reads them: the -// controller's assignments, for what each node's plan names (askers.go, design 57 V4), and the node-engines' haves, where -// the bus node hands the loaded list's hashes sealed to the vault (adopt.go, ADR 0547 clause 9), in main.go alone. +// (ADR 0547 clause 9), opened in accounts.go alone. It reads five buckets of others', and only reads them: the +// controller's assignments, for what each node's plan names (askers.go, design 57 V4), the node-engines' haves, where +// the bus node hands the loaded list's hashes sealed to the vault (adopt.go, ADR 0547 clause 9), the grants part's wanted +// accounts and the controller's lease (mint.go, lease.go, ADR 0561 §2, §3), and the seat's placement (placed.go), in +// main.go alone. func TestNoBucketHoldsASecret(t *testing.T) { raw, err := os.ReadFile("../../module.json") if err != nil { @@ -143,12 +145,13 @@ func TestNoBucketHoldsASecret(t *testing.T) { if err := json.Unmarshal(raw, &manifest); err != nil { t.Fatal(err) } - if s, _ := json.Marshal(manifest["state"]); string(s) != `[{"history":2,"name":"bus-accounts"}]` { - t.Errorf("the manifest declares buckets %s: a secret is in no bucket, sealed or not (ADR 0201 §13), and the one "+ - "bucket is the accounts' hashes (ADR 0547 clause 9)", s) + if s, _ := json.Marshal(manifest["state"]); string(s) != `[{"history":2,"name":"bus-accounts"},"signers"]` { + t.Errorf("the manifest declares buckets %s: a secret is in no bucket, sealed or not (ADR 0201 §13), and the "+ + "buckets are the accounts' hashes (ADR 0547 clause 9) and the signing keys' public halves (ADR 0550 §2)", s) } - if r, _ := json.Marshal(manifest["reads"]); string(r) != `["mesh-controller.assignments","node-engine.have"]` { - t.Errorf("the manifest reads %s: the vault reads the controller's assignments and the haves alone", r) + if r, _ := json.Marshal(manifest["reads"]); string(r) != `["mesh-controller.assignments","node-engine.have","mesh-grants.accounts","mesh-controller.lease","mesh-delivery-assigner.placement"]` { + t.Errorf("the manifest reads %s: the vault reads the controller's assignments, the haves and the grants part's "+ + "wanted accounts alone", r) } sources, _ := filepath.Glob("*.go") bucket := regexp.MustCompile(`stdio\.State\(|nats-io|jetstream|KeyValue`) @@ -166,14 +169,29 @@ func TestNoBucketHoldsASecret(t *testing.T) { code = []byte(strings.Replace(string(code), "stdio.State(BusAccountsState).Get(", "", 1)) code = []byte(strings.Replace(string(code), "stdio.State(BusAccountsState).Put(", "", 1)) code = []byte(strings.Replace(string(code), "stdio.State(BusAccountsState).Keys(", "", 1)) + code = []byte(strings.Replace(string(code), "stdio.State(BusAccountsState).Delete(", "", 1)) } - // The haves, in main.go alone: one read, one watch and their keys (own_drift), never a write; and one watch of - // the assignments, which the vault's rules read from memory once it caught up (issue 1126). + // The signing keys' public halves, in signing.go alone: one read and one write of its own bucket (ADR 0550 §2). + if f == "signing.go" { + code = []byte(strings.Replace(string(code), "stdio.State(delivery.SignersState).Get(", "", 1)) + code = []byte(strings.Replace(string(code), "stdio.State(delivery.SignersState).Put(", "", 1)) + } + // The haves, in main.go alone: one read, one watch and their keys (own_drift), never a write; one watch of the + // assignments, which the vault's rules read from memory once it caught up (issue 1126); and one watch of the wanted + // accounts, the grants part's, which hold no secret (ADR 0561 §2). if f == "main.go" { code = []byte(strings.Replace(string(code), "stdio.State(AssignmentsRead).Watch(", "", 1)) code = []byte(strings.Replace(string(code), "stdio.State(HaveRead).Get(", "", 1)) code = []byte(strings.Replace(string(code), "stdio.State(HaveRead).Watch(", "", 1)) code = []byte(strings.Replace(string(code), "stdio.State(HaveRead).Keys(", "", 1)) + code = []byte(strings.Replace(string(code), "stdio.State(WantedRead).Watch(", "", 1)) + code = []byte(strings.Replace(string(code), "stdio.State(WantedRead).Get(", "", 1)) + // And the controller's lease, one read and one watch (ADR 0561 §3). + code = []byte(strings.Replace(string(code), "stdio.State(LeaseRead).Get(", "", 1)) + code = []byte(strings.Replace(string(code), "stdio.State(LeaseRead).Watch(", "", 1)) + // And the seat's placement, where modules stand (placed.go): its keys and one key, read. + code = []byte(strings.Replace(string(code), "stdio.State(PlacementRead).Keys(", "", 1)) + code = []byte(strings.Replace(string(code), "stdio.State(PlacementRead).Get(", "", 1)) } if m := bucket.Find(code); m != nil { t.Errorf("%s opens a bucket (%s): the vault keeps every secret in its own store only", f, m) diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod index 34a8552a..1c3755ff 100644 --- a/modules/mesh-vault/go.mod +++ b/modules/mesh-vault/go.mod @@ -3,7 +3,7 @@ module mesh-vault go 1.26.0 require ( - git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388 + git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028205404-8eafc0c5ce3c github.com/nats-io/nats-server/v2 v2.11.17 github.com/nats-io/nats.go v1.54.0 golang.org/x/crypto v0.57.0 diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum index 6245202d..c82187fd 100644 --- a/modules/mesh-vault/go.sum +++ b/modules/mesh-vault/go.sum @@ -1,5 +1,5 @@ -git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388 h1:ycu/sNieTdLpD3bzhZOCXdzcoqXUOxPRmqWV019REpo= -git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028205404-8eafc0c5ce3c h1:hcqOCd5q3M0ZiEzB6MhwxT/AOKkm9gaskKqPcpkAAg8= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028205404-8eafc0c5ce3c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI= github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= diff --git a/modules/mesh-vault/module.json b/modules/mesh-vault/module.json index 7b2e866f..f96600b5 100644 --- a/modules/mesh-vault/module.json +++ b/modules/mesh-vault/module.json @@ -16,17 +16,23 @@ "rotated", "secret-changed", "account-hashed", - "own-replaced" + "own-replaced", + "account-issued", + "signed" ], "reads": [ "mesh-controller.assignments", - "node-engine.have" + "node-engine.have", + "mesh-grants.accounts", + "mesh-controller.lease", + "mesh-delivery-assigner.placement" ], "state": [ { "name": "bus-accounts", "history": 2 - } + }, + "signers" ], "receives": { "secret": "${dir:grants}/mesh.json" @@ -144,7 +150,8 @@ "MESH_VAULT_LEDGER": "${dir:ledger}", "MESH_VAULT_ROOT": "${dir:root}", "MESH_VAULT_STORE": "${dir:store}", - "MESH_VAULT_STATE": "${dir:state}" + "MESH_VAULT_STATE": "${dir:state}", + "MESH_VAULT_SECRET_ASK_CALLERS": "node-tools" } } ] @@ -157,6 +164,7 @@ "secret_own", "account_hash", "account_adopt", + "account_retire", "secret_asks", "secret_vault_export", "provisioner_retirement", @@ -166,7 +174,10 @@ "vault_status", "vault_health", "own_drift", - "own_take_switch" + "own_take_switch", + "vault_signers", + "vault_signed", + "signers_reassert" ], "claims": [ { @@ -181,7 +192,9 @@ "move-in", "node-key", "move-asks", - "own" + "own", + "issue-account", + "sign" ] } ] diff --git a/modules/messenger/cmd/messenger/answers.go b/modules/messenger/cmd/messenger/answers.go index d92bf1af..6a3fbb5a 100644 --- a/modules/messenger/cmd/messenger/answers.go +++ b/modules/messenger/cmd/messenger/answers.go @@ -133,7 +133,7 @@ func pruneGrants(grants map[string]Grant, kind string, now time.Time, keep int) // stands, closes the ask with a warrant for its asker (asks.go); Details are shown where they were asked. // Anything else is refused, and said there. The same answer is acted on once. func (h *Holder) Chosen(kind string, c asks.Choice) (string, error) { - // The controller's root-free word is asked before the work is taken (the confirmation review of 2026-10-09): + // The machines' engines' root-free word is asked before the work is taken (the confirmation review of 2026-10-09): // up to RootFreeWithin, which no ask, answer or link should wait behind. Asked fresh here, for this answer, // and judged with in it. root := h.rootWordFor(kind) diff --git a/modules/messenger/cmd/messenger/answers_test.go b/modules/messenger/cmd/messenger/answers_test.go index cdffa473..c1ff0d0f 100644 --- a/modules/messenger/cmd/messenger/answers_test.go +++ b/modules/messenger/cmd/messenger/answers_test.go @@ -600,6 +600,16 @@ func TestAnAskIsRefusedInWordsToItsAsker(t *testing.T) { if _, kept := store.asks["mesh-delivery.d-1"]; kept { t.Error("a refused ask was recorded") } + // A node's engine is an asker under node-engine- (novox/hq ADR 0563 §3, changing ADR 0259 §2): its ask is + // recorded under that name, with its own bound of open asks; a name that is no asker's is dropped. + submit(t, h, "node-engine-ace", heldAsk(c, "hand-over-1")) + submit(t, h, "node.ace", heldAsk(c, "hand-over-2")) + if rec, kept := store.asks["node-engine-ace.hand-over-1"]; !kept || rec.Asker != "node-engine-ace" { + t.Errorf("a node's engine's ask was not recorded under its name: %+v", rec) + } + if _, kept := store.asks["node.ace.hand-over-2"]; kept { + t.Error("an ask under a name that is no asker's was recorded") + } // No channel can carry anything: held with the reason (ADR 0397), never queued in silence. h2, _, _, c2, store2, w2 := newRouter(t) h2.Bench.Stand("telegram", Standing{Ready: false, Why: "no bot token", At: c2.now()}) diff --git a/modules/messenger/cmd/messenger/asks.go b/modules/messenger/cmd/messenger/asks.go index 08a53a95..b719e68f 100644 --- a/modules/messenger/cmd/messenger/asks.go +++ b/modules/messenger/cmd/messenger/asks.go @@ -242,8 +242,9 @@ func (h *Holder) carriers(level asks.Level) []string { return out } -// RootVerdict is the controller's word on one machine (its verb root-free, novox/hq ADR 0259 §8): free only -// when it measured, recently, that no agent can become root there without a person. +// RootVerdict is a machine's engine's word on that machine (the node seat node-engine's root-free, novox/hq ADR 0259 +// §8 as ADR 0563 §6 changes it): free only when it measured, recently, that no agent can become root there without a +// person. type RootVerdict struct { Machine string `json:"machine"` Free bool `json:"free"` @@ -251,51 +252,64 @@ type RootVerdict struct { Judged string `json:"judged,omitempty"` } -// RootFreeVerb is the controller's verb the router asks, as this module, which machines are root-free. -const RootFreeVerb = "seat:" + ControllerSeat + ".root-free" +// EngineSeat is the node seat each machine's engine holds, and RootFreeVerb its verb the router asks of a machine, as +// this module: `seat:node-engine.root-free@`, which that machine's engine alone answers (ADR 0563 §6). +const ( + EngineSeat = "node-engine" + RootFreeVerb = "seat:" + EngineSeat + ".root-free" +) -// RootFreeWithin is how long the router waits for the controller's word; RootFreeKept how long a word is -// used to render a message's buttons. An answer is always judged on a word asked then. +// RootFreeWithin is how long the router waits for the machines' words; RootFreeKept how long a word is used to render a +// message's buttons. An answer is always judged on a word asked then. const ( RootFreeWithin = 10 * time.Second RootFreeKept = 30 * time.Second ) -// askRootFree asks the controller about machines, failing on no answer in time. +// askRootFree asks each machine's own engine about that machine, at once, failing on no answer in time. A machine's +// word is the verdict its engine gives on it; a verdict an engine gives on another machine is not taken. func (h *Holder) askRootFree(machines []string) (map[string]RootVerdict, error) { if h.RootFree != nil { return h.RootFree(machines) } if h.Ask == nil { - return nil, errors.New("this router cannot ask the controller") + return nil, errors.New("this router cannot ask a machine's engine") } type answer struct { - raw json.RawMessage - err error + machine string + raw json.RawMessage + err error } - done := make(chan answer, 1) - go func() { - raw, err := h.Ask(RootFreeVerb, map[string]any{"machines": machines}) - done <- answer{raw, err} - }() - var a answer - select { - case a = <-done: - case <-time.After(RootFreeWithin): - return nil, fmt.Errorf("the controller did not answer within %s", RootFreeWithin) - } - if a.err != nil { - return nil, a.err - } - var body struct { - Machines []RootVerdict `json:"machines"` - } - if err := json.Unmarshal(a.raw, &body); err != nil { - return nil, fmt.Errorf("the controller's answer could not be read: %v", err) + done := make(chan answer, len(machines)) + for _, m := range machines { + go func(m string) { + raw, err := h.Ask(RootFreeVerb+"@"+m, map[string]any{}) + done <- answer{m, raw, err} + }(m) } out := map[string]RootVerdict{} - for _, v := range body.Machines { - out[v.Machine] = v + deadline := time.After(RootFreeWithin) + for range machines { + var a answer + select { + case a = <-done: + case <-deadline: + return nil, fmt.Errorf("a machine's engine did not answer within %s", RootFreeWithin) + } + if a.err != nil { + return nil, fmt.Errorf("%s's engine: %w", a.machine, a.err) + } + var body struct { + Machines []RootVerdict `json:"machines"` + } + if err := json.Unmarshal(a.raw, &body); err != nil { + return nil, fmt.Errorf("%s's engine's answer could not be read: %v", a.machine, err) + } + for _, v := range body.Machines { + if v.Machine == a.machine { + out[v.Machine] = v + } + } } return out, nil } @@ -329,7 +343,7 @@ func (h *Holder) rootFree(k KindInfo, cached bool) string { case cached: // Read inside the work, which never waits on the controller: no recent word is no pass. warmRootFree // asks outside it. - return "the controller's word on whether an agent can become root there is not recent" + return "the machines' engines' word on whether an agent can become root there is not recent" default: got, err := h.askRootFree(machines) if err != nil { @@ -351,7 +365,7 @@ func (h *Holder) rootFree(k KindInfo, cached bool) string { v, said := verdicts[m] switch { case !said: - return "the controller said nothing of whether an agent can become root on " + m + return "its engine said nothing of whether an agent can become root on " + m case !v.Free: why := v.Why if why == "" { @@ -364,7 +378,7 @@ func (h *Holder) rootFree(k KindInfo, cached bool) string { return "" } -// warmRootFree asks the controller's root-free word for every kind that proves its sender, outside the work, +// warmRootFree asks the machines' engines' root-free word for every kind that proves its sender, outside the work, // so what is rendered and offered inside it reads a recent word. // force asks even a recent word again: taking an ask, whose refusal its asker keeps until something changes. func (h *Holder) warmRootFree(force bool) { @@ -390,7 +404,7 @@ func (h *Holder) warmRootFree(force bool) { } } -// rootWordFor asks the controller's root-free word for a kind fresh, before the work is taken, and answers +// rootWordFor asks the machines' engines' root-free word for a kind fresh, before the work is taken, and answers // what judging an answer of that kind then reads: the word for that very kind's placement, or why there is none. // A kind that does not prove its sender is asked nothing: its answers never approve. func (h *Holder) rootWordFor(kind string) func(KindInfo) string { @@ -453,7 +467,7 @@ func (h *Holder) TakeAsk(verb, asker string, body json.RawMessage) error { if verb == ConditionVerb { // Before the work lock: Condition takes it, and decides as for the controller's conditions. if !asks.UsableID(strings.ReplaceAll(asker, "-", "_")) { - h.Logf("[messenger] a condition from %q was taken and dropped: not a module's name", asker) + h.Logf("[messenger] a condition from %q was taken and dropped: not an asker's name (a module's, or a node's engine's)", asker) return nil } h.takeCondition(asker, body) @@ -466,7 +480,7 @@ func (h *Holder) TakeAsk(verb, asker string, body json.RawMessage) error { h.init() h.mu.Unlock() if !asks.UsableID(strings.ReplaceAll(asker, "-", "_")) { - h.Logf("[messenger] an ask from %q was taken and dropped: not a module's name", asker) + h.Logf("[messenger] an ask from %q was taken and dropped: not an asker's name (a module's, or a node's engine's)", asker) return nil } if verb == "cancel" { diff --git a/modules/messenger/cmd/messenger/bus_test.go b/modules/messenger/cmd/messenger/bus_test.go index 9c67bda6..c42fb278 100644 --- a/modules/messenger/cmd/messenger/bus_test.go +++ b/modules/messenger/cmd/messenger/bus_test.go @@ -256,16 +256,8 @@ func (r *busRuntime) runtime(id json.RawMessage, method string, params json.RawM case "mesh/seat.publish": return map[string]any{}, r.nc.Publish(p.Subject, p.Body) case "mesh/ask": - if p.Key == RootFreeVerb { - var a struct { - Machines []string `json:"machines"` - } - _ = json.Unmarshal(p.Body, &a) - var out []RootVerdict - for _, m := range a.Machines { - out = append(out, RootVerdict{Machine: m, Free: true}) - } - return map[string]any{"machines": out}, nil + if m, ok := strings.CutPrefix(p.Key, RootFreeVerb+"@"); ok { + return map[string]any{"machines": []RootVerdict{{Machine: m, Free: true}}}, nil } return nil, fmt.Errorf("the test runtime answers nothing for %s", p.Key) } diff --git a/modules/messenger/cmd/messenger/holder.go b/modules/messenger/cmd/messenger/holder.go index 120daa75..b3dff885 100644 --- a/modules/messenger/cmd/messenger/holder.go +++ b/modules/messenger/cmd/messenger/holder.go @@ -315,7 +315,8 @@ type Holder struct { Emit func(event string, body any) error // Ask calls a seat verb through the mesh, as this module: the answers the operator chooses. Ask Asker - // RootFree asks the controller's verb root-free about machines; nil asks it through Ask (askRootFree). + // RootFree asks each machine's engine's root-free (the node seat node-engine's, ADR 0563 §6); nil asks it through Ask + // (askRootFree). RootFree func(machines []string) (map[string]RootVerdict, error) // Zone is the operator's time zone, which every time in a message is said in; nil is this machine's. Zone func() *time.Location diff --git a/modules/messenger/cmd/messenger/manifest_test.go b/modules/messenger/cmd/messenger/manifest_test.go index 2281501b..9fe112a0 100644 --- a/modules/messenger/cmd/messenger/manifest_test.go +++ b/modules/messenger/cmd/messenger/manifest_test.go @@ -87,7 +87,7 @@ func TestItDeclaresTheSeatsOfAnAskAndHoldsTheOperatorChannel(t *testing.T) { // // It performs nothing: the verbs it calls read the open conditions, whether root is free, and which issues // track which conditions. if !reflect.DeepEqual(m.Emits, []string{"refused"}) || !reflect.DeepEqual(m.Invokes, []string{"seat:" + ControllerSeat + ".conditions", - "seat:" + ControllerSeat + ".root-free", TrackingVerb}) { + "seat:" + EngineSeat + ".root-free", TrackingVerb}) { t.Fatalf("emits %v invokes %v", m.Emits, m.Invokes) } var state []string diff --git a/modules/messenger/cmd/messenger/review_test.go b/modules/messenger/cmd/messenger/review_test.go index 3409c3a6..9c042edc 100644 --- a/modules/messenger/cmd/messenger/review_test.go +++ b/modules/messenger/cmd/messenger/review_test.go @@ -8,6 +8,7 @@ import ( "os" "path/filepath" "regexp" + "sort" "strings" "sync" "testing" @@ -66,26 +67,37 @@ func TestApprovalNeedsTheControllersWordThatRootIsFree(t *testing.T) { } } -// H3: the word is asked of the controller's verb, as this module, and read from its answer. -func TestTheRootWordIsAskedOfTheControllersVerb(t *testing.T) { +// H3, as ADR 0563 §6 changes it: the word on each machine is asked of that machine's own engine, the node seat +// node-engine's root-free there, as this module, and read from its answer; a machine's word is that machine's alone. +func TestTheRootWordIsAskedOfEachMachinesEngine(t *testing.T) { h, _, _, _, _, _ := newRouter(t) h.RootFree = nil var asked []string h.Ask = func(key string, body any) (json.RawMessage, error) { asked = append(asked, key) - raw, _ := json.Marshal(body) - if !strings.Contains(string(raw), `"machines":["anchor"]`) { - t.Errorf("asked about %s", raw) + machine := strings.TrimPrefix(key, "seat:node-engine.root-free@") + if machine == "elsewhere" { + machine = "anchor" // an engine that answers for another machine is not believed } - return json.RawMessage(`{"machines":[{"machine":"anchor","free":true,"why":"judged","judged":"2026-10-09T10:00:00Z"}]}`), nil + return json.RawMessage(`{"machines":[{"machine":"` + machine + `","free":true,"why":"judged","judged":"2026-10-09T10:00:00Z"}]}`), nil } info, _ := h.Bench.Kind("telegram") if why := h.rootFree(info, false); why != "" { t.Fatalf("free not read: %s", why) } - if len(asked) != 1 || asked[0] != "seat:mesh-controller.root-free" { + if len(asked) != 1 || asked[0] != "seat:node-engine.root-free@anchor" { t.Errorf("asked %v", asked) } + asked = nil + h.Node = "elsewhere" + if why := h.rootFree(info, false); !strings.Contains(why, "said nothing of whether an agent can become root on elsewhere") { + t.Errorf("one machine's word was taken for another's: %q", why) + } + sort.Strings(asked) + if len(asked) != 2 || asked[0] != "seat:node-engine.root-free@anchor" || asked[1] != "seat:node-engine.root-free@elsewhere" { + t.Errorf("the router's machine and the channel's were asked as %v", asked) + } + h.Node = "anchor" h.Ask = func(string, any) (json.RawMessage, error) { return json.RawMessage(`not json`), nil } if why := h.rootFree(info, false); !strings.Contains(why, "could not be read") { t.Errorf("an unreadable answer was a pass: %q", why) diff --git a/modules/messenger/module.json b/modules/messenger/module.json index 4aceaebe..26ec11a3 100644 --- a/modules/messenger/module.json +++ b/modules/messenger/module.json @@ -90,7 +90,7 @@ ], "invokes": [ "seat:mesh-controller.conditions", - "seat:mesh-controller.root-free", + "seat:node-engine.root-free", "seat:issue-tracker.tracking" ], "state": [ diff --git a/modules/nats/cmd/mesh-nats-snapshot/certificate.go b/modules/nats/cmd/mesh-nats-snapshot/certificate.go new file mode 100644 index 00000000..7d03bc9e --- /dev/null +++ b/modules/nats/cmd/mesh-nats-snapshot/certificate.go @@ -0,0 +1,174 @@ +package main + +import ( + "crypto/rand" + "crypto/rsa" + "crypto/x509" + "crypto/x509/pkix" + "encoding/pem" + "errors" + "fmt" + "math/big" + "net" + "os" + "path/filepath" + "time" +) + +// The bus's own certificate, made by the mesh rather than borrowed from an image. Moved here from mesh-controller's +// `broker certificate` with the same output (design 47's L3 s11): the command belongs to the bus module, and the +// controller's binary is retired after its lease is handed away (ADR 0547 §11). Nothing changes at the lease write: the +// certificate in /var/lib/mesh-broker-tls stays, and every pin stays valid. +// +// **The foundation asked a third-party image for a tool it never said must be there** (novox/hq +// 04-ISSUES/146). The bootstrap made this certificate by running `openssl` inside the broker's +// image, which worked while the broker was one that happened to carry it and stopped the day the +// bus changed: the new one has a shell and no openssl, so the step exited 127 and no mesh could be +// raised. Substituting another image the bundle names does not help — none of them carry it +// either. +// +// So the program that needs a certificate makes one. It is the mesh's own binary, already on the +// machine at this point in the bootstrap (the schema step ran it), and it needs nothing from the +// image it writes into but a mounted directory. +// +// **Self-signed, and that is the design** — a host pins this server's exact certificate and +// authenticates with a password (novox/hq ADR 0004). There is no authority above it to ask, and at +// this moment in a bootstrap there is no mesh to ask one of. +// +// Idempotent, because the step is applied again on every reconcile and a second certificate would +// be one the hosts that pinned the first no longer believe. + +// busCertificateNames is what the bus is reached by: the container name on a mesh network, and the +// loopback address the machine's own foundation dials. +var busCertificateNames = []string{"mesh-broker"} + +const busCertificateLife = 10 * 365 * 24 * time.Hour + +// busCertificate makes the bus's certificate in a directory, or says whether one is there. +// +// mesh-nats-snapshot certificate --into /tls make it if it is not there +// mesh-nats-snapshot certificate --check --into /tls exit non-zero unless a usable pair is +func busCertificate(args []string) error { + into, check := "", false + for i := 0; i < len(args); i++ { + switch args[i] { + case "--check": + check = true + case "--into": + if i+1 >= len(args) { + return errors.New("--into needs a directory") + } + into = args[i+1] + i++ + default: + return fmt.Errorf("certificate [--check] --into : %q", args[i]) + } + } + if into == "" { + return errors.New("certificate [--check] --into ") + } + crt, key := filepath.Join(into, "tls.crt"), filepath.Join(into, "tls.key") + + if usable, err := busCertificateUsable(crt, key); err != nil { + return err + } else if usable { + fmt.Printf("the bus already has a certificate at %s, and it was left alone\n", crt) + return nil + } + if check { + // Said as a failure, because that is what the caller asked: a bootstrap's verify runs + // this and a false answer is what makes the step run. + return fmt.Errorf("no usable certificate and key at %s", into) + } + return writeBusCertificate(crt, key) +} + +// busCertificateUsable says whether a certificate and its key are both there and parse. +// +// Both, and parsed rather than stat'ed: a half-written pair is the state a bootstrap interrupted +// between the two files leaves behind, and a step that treated it as done would hand the server a +// certificate with no key and report success. +func busCertificateUsable(crt, key string) (bool, error) { + certPEM, err := os.ReadFile(crt) + if errors.Is(err, os.ErrNotExist) { + return false, nil + } + if err != nil { + return false, err + } + keyPEM, err := os.ReadFile(key) + if errors.Is(err, os.ErrNotExist) { + return false, nil + } + if err != nil { + return false, err + } + if _, err := tlsPairParses(certPEM, keyPEM); err != nil { + return false, nil + } + return true, nil +} + +func tlsPairParses(certPEM, keyPEM []byte) (*x509.Certificate, error) { + block, _ := pem.Decode(certPEM) + if block == nil || block.Type != "CERTIFICATE" { + return nil, errors.New("not a certificate") + } + certificate, err := x509.ParseCertificate(block.Bytes) + if err != nil { + return nil, err + } + keyBlock, _ := pem.Decode(keyPEM) + if keyBlock == nil { + return nil, errors.New("not a key") + } + if _, err := x509.ParsePKCS8PrivateKey(keyBlock.Bytes); err != nil { + if _, err := x509.ParsePKCS1PrivateKey(keyBlock.Bytes); err != nil { + return nil, err + } + } + return certificate, nil +} + +func writeBusCertificate(crt, key string) error { + private, err := rsa.GenerateKey(rand.Reader, 2048) + if err != nil { + return err + } + serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128)) + if err != nil { + return err + } + template := &x509.Certificate{ + SerialNumber: serial, + Subject: pkix.Name{CommonName: busCertificateNames[0]}, + DNSNames: busCertificateNames, + IPAddresses: []net.IP{net.ParseIP("127.0.0.1")}, + NotBefore: time.Now().Add(-time.Hour), + NotAfter: time.Now().Add(busCertificateLife), + KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment, + ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, + BasicConstraintsValid: true, + } + der, err := x509.CreateCertificate(rand.Reader, template, template, &private.PublicKey, private) + if err != nil { + return err + } + pkcs8, err := x509.MarshalPKCS8PrivateKey(private) + if err != nil { + return err + } + + // **The key first, and only then the certificate**, so the pair a reader finds is never a + // certificate whose key has not been written yet — the one order in which an interruption + // leaves something that looks finished (novox/hq 04-ISSUES/014, a key present and unusable). + if err := os.WriteFile(key, pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: pkcs8}), 0o600); err != nil { + return err + } + if err := os.WriteFile(crt, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o644); err != nil { + return err + } + fmt.Printf("made the bus a certificate for %v, valid until %s\n %s\n %s\n", + busCertificateNames, template.NotAfter.Format(time.RFC3339), crt, key) + return nil +} diff --git a/modules/nats/cmd/mesh-nats-snapshot/certificate_test.go b/modules/nats/cmd/mesh-nats-snapshot/certificate_test.go new file mode 100644 index 00000000..e03df592 --- /dev/null +++ b/modules/nats/cmd/mesh-nats-snapshot/certificate_test.go @@ -0,0 +1,138 @@ +package main + +import ( + "crypto/tls" + "crypto/x509" + "os" + "path/filepath" + "strings" + "testing" +) + +// L3 s11 (design 47): the bus's certificate command, moved from mesh-controller with the same output, made once, and +// its check false without a usable pair. Its cases, as the controller's tests had them, are rows of one test. +func TestTheBusCertificate(t *testing.T) { + for _, row := range []struct { + name string + run func(*testing.T) + }{ + {"it loads as a server loads it", loadsAsAServersWould}, + {"it is made once", isMadeOnce}, + {"the check is false until there is a pair", checkIsFalseUntilAPair}, + {"a certificate without its key is not usable", withoutItsKeyIsNotUsable}, + {"where to write is required", whereToWriteIsRequired}, + } { + t.Run(row.name, row.run) + } +} + +// novox/hq 04-ISSUES/146. The bootstrap could not make the bus a certificate: it asked an image for +// `openssl` and the image it asks has none. What replaces it is this command, so what is checked is +// what the bootstrap needs from it — a pair a TLS server can actually load, made once and only once. + +func loadsAsAServersWould(t *testing.T) { + into := t.TempDir() + if err := busCertificate([]string{"--into", into}); err != nil { + t.Fatalf("the bus could not be given a certificate: %v", err) + } + + // The check a cheaper test would not make. The key was present and valid and the server could + // not start, once, because nothing loaded the pair the way a server loads it + // (novox/hq 04-ISSUES/014). + pair, err := tls.LoadX509KeyPair(filepath.Join(into, "tls.crt"), filepath.Join(into, "tls.key")) + if err != nil { + t.Fatalf("a TLS server cannot load what was written: %v", err) + } + leaf := pair.Leaf + if leaf == nil { + if leaf, err = x509.ParseCertificate(pair.Certificate[0]); err != nil { + t.Fatal(err) + } + } + if err := leaf.VerifyHostname("mesh-broker"); err != nil { + t.Errorf("the certificate is not for the name the bus is reached by: %v", err) + } + if len(leaf.IPAddresses) == 0 || leaf.IPAddresses[0].String() != "127.0.0.1" { + t.Errorf("the certificate does not cover the loopback address the foundation dials: %v", leaf.IPAddresses) + } + + // The key is not readable by anything else on the machine; the certificate is public and is. + key, err := os.Stat(filepath.Join(into, "tls.key")) + if err != nil { + t.Fatal(err) + } + if key.Mode().Perm() != 0o600 { + t.Errorf("the key is %v", key.Mode().Perm()) + } + crt, err := os.Stat(filepath.Join(into, "tls.crt")) + if err != nil { + t.Fatal(err) + } + if crt.Mode().Perm() != 0o644 { + t.Errorf("the certificate is %v, which the server runs as another user cannot read", crt.Mode().Perm()) + } +} + +// **Made once.** The step is applied again on every reconcile, and a second certificate is one the +// hosts that pinned the first no longer believe (novox/hq ADR 0004). +func isMadeOnce(t *testing.T) { + into := t.TempDir() + if err := busCertificate([]string{"--into", into}); err != nil { + t.Fatal(err) + } + first, err := os.ReadFile(filepath.Join(into, "tls.crt")) + if err != nil { + t.Fatal(err) + } + if err := busCertificate([]string{"--into", into}); err != nil { + t.Fatal(err) + } + again, err := os.ReadFile(filepath.Join(into, "tls.crt")) + if err != nil { + t.Fatal(err) + } + if string(first) != string(again) { + t.Fatal("running it twice replaced the certificate every host had pinned") + } +} + +// The verify half: false before, true after, which is what makes the bootstrap run the step at all. +func checkIsFalseUntilAPair(t *testing.T) { + into := t.TempDir() + if err := busCertificate([]string{"--check", "--into", into}); err == nil { + t.Fatal("an empty directory reported a usable certificate") + } + if err := busCertificate([]string{"--into", into}); err != nil { + t.Fatal(err) + } + if err := busCertificate([]string{"--check", "--into", into}); err != nil { + t.Fatalf("the certificate it just made does not satisfy its own check: %v", err) + } +} + +// A half-written pair is not a pair. An interrupted bootstrap leaves exactly this, and a step that +// called it done would hand the server a certificate with no key and report success. +func withoutItsKeyIsNotUsable(t *testing.T) { + into := t.TempDir() + if err := busCertificate([]string{"--into", into}); err != nil { + t.Fatal(err) + } + if err := os.Remove(filepath.Join(into, "tls.key")); err != nil { + t.Fatal(err) + } + if err := busCertificate([]string{"--check", "--into", into}); err == nil { + t.Fatal("a certificate with no key passed the check") + } + if err := busCertificate([]string{"--into", into}); err != nil { + t.Fatal(err) + } + if _, err := tls.LoadX509KeyPair(filepath.Join(into, "tls.crt"), filepath.Join(into, "tls.key")); err != nil { + t.Fatalf("it did not replace the unusable pair: %v", err) + } +} + +func whereToWriteIsRequired(t *testing.T) { + if err := busCertificate(nil); err == nil || !strings.Contains(err.Error(), "--into") { + t.Fatalf("it did not ask where to write: %v", err) + } +} diff --git a/modules/nats/cmd/mesh-nats-snapshot/main.go b/modules/nats/cmd/mesh-nats-snapshot/main.go index f71e49d8..a3232c77 100644 --- a/modules/nats/cmd/mesh-nats-snapshot/main.go +++ b/modules/nats/cmd/mesh-nats-snapshot/main.go @@ -17,6 +17,7 @@ // mesh-nats-snapshot verify [--from FILE] // mesh-nats-snapshot restore --into DIR [--account MESH] [--from FILE] // mesh-nats-snapshot restore --server URL --credential FILE [--from FILE] +// mesh-nats-snapshot certificate [--check] --into DIR // // **Read-only on the live bus.** A snapshot neither pauses nor reconfigures a stream; the server // keeps accepting writes while it streams the copy out. The credential it uses is the bus's own @@ -47,6 +48,8 @@ func main() { err = runVerify(os.Args[2:]) case "restore": err = runRestore(os.Args[2:]) + case "certificate": + err = busCertificate(os.Args[2:]) case "-h", "--help", "help": usage() return @@ -67,6 +70,7 @@ func usage() { verify [--from bus.tar] every archive against the manifest restore --into DIR [--account MESH] [--from bus.tar] into a new store directory, by a server of its own restore --server URL --credential FILE [--from bus.tar] into a running server that holds none of them + certificate [--check] --into DIR the bus's self-signed certificate, made once The credential is the JSON the mesh seals to the bus's own module: url, fingerprint, user, password. `)