mesh-catalog/checks/credentialform/main.go

// Package credentialform refuses an offer that does not say the form of its credential: an own secret, an issuer, or
// `form` pair or none (the lead, 2026-10-29). It reads every modules/*/module.json through mesh-sdk's
// CredentialFormProblems.
package credentialform

import (
	"encoding/json"
	"fmt"
	"os"
	"path/filepath"
	"sort"

	"git.novox.be/novox/mesh-sdk/go/catalogue"
)

// Problems is every offer of the manifests under root/modules that says no credential form, one line each.
func Problems(root string) ([]string, error) {
	files, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
	if err != nil {
		return nil, err
	}
	sort.Strings(files)
	var out []string
	reads := map[string]bool{}
	var binders []string
	for _, f := range files {
		raw, err := os.ReadFile(f)
		if err != nil {
			return nil, err
		}
		var m catalogue.Manifest
		if err := json.Unmarshal(raw, &m); err != nil {
			return nil, fmt.Errorf("%s: %w", f, err)
		}
		out = append(out, catalogue.CredentialFormProblems(m)...)
		var kept struct {
			Reads []string          `json:"reads"`
			State []json.RawMessage `json:"state"`
		}
		_ = json.Unmarshal(raw, &kept) // reads may hold objects in another module; only the provisioner's are read
		if m.Module == "mesh-provisioner" {
			for _, r := range kept.Reads {
				reads[r] = true
			}
		}
		if len(m.Provides) > 0 && keepsBound(kept.State) {
			binders = append(binders, m.Module)
		}
	}
	for _, module := range binders {
		if !reads[module+".bound"] {
			out = append(out, fmt.Sprintf("%s provides and keeps a `bound` state, and mesh-provisioner's manifest does not read %s.bound", module, module))
		}
	}
	return out, nil
}

// keepsBound says whether a manifest's `state` names `bound`, as a plain name or an object with a name.
func keepsBound(state []json.RawMessage) bool {
	for _, s := range state {
		var name string
		var obj struct {
			Name string `json:"name"`
		}
		if json.Unmarshal(s, &name) == nil && name == "bound" || json.Unmarshal(s, &obj) == nil && obj.Name == "bound" {
			return true
		}
	}
	return false
}