Read a merge's warrant under the asker its announcement names, the teller or mesh-delivery (issue 1213)

cmd/mesh-controller/moved.go

@@ -13,6 +13,7 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -46,6 +47,28 @@ type deliveryMerge struct {
 	AskID   string            `json:"ask_id"`
 	Option  string            `json:"option"`
 	Heads   map[string]string `json:"heads"`
+	// Asker is the module that asked the ask, whose warrant is read from the router under that name (novox/hq ADR
+	// 0437 §6): empty is today's module, mesh-delivery.
+	Asker string `json:"asker,omitempty"`
+}
+
+// askerOf is the asker whose warrant the merge is read under: the one the announcement names, mesh-delivery when it
+// names none.
+func (d deliveryMerge) askerOf() string {
+	if d.Asker == "" {
+		return theDelivery
+	}
+	return d.Asker
+}
+
+// askerAccepted is whether the controller takes a warrant from this asker for a merge: the teller, and mesh-delivery
+// until the gate takes the seat over (novox/hq ADR 0437 §6). Any other registers no move.
+func askerAccepted(asker string) error {
+	if asker == theDelivery || asker == sdkdelivery.TellerModule {
+		return nil
+	}
+	return fmt.Errorf("the merge names the asker %q, and the controller takes a warrant only from %s and %s",
+		asker, sdkdelivery.TellerModule, theDelivery)
 }
 
 // parseDeliveryMerge reads an announcement, refusing one that names no pull request, head or ask.
@@ -81,6 +104,10 @@ func mergeAct(ask, option string, heads map[string]string) asks.Act {
 // proved by the channel it came through, of this very ask as it was published (digest), bound to the heads the
 // announcement names, and those heads hold the head merged. Answers why it holds, or why not.
 func movedOnApprove(d deliveryMerge, ask *asks.Ask, w *asks.Warrant) (string, error) {
+	asker := d.askerOf()
+	if err := askerAccepted(asker); err != nil {
+		return "", err
+	}
 	switch {
 	case ask == nil || w == nil:
 		return "", errors.New("the router holds no closed record of the ask the merge was made on")
@@ -89,7 +116,7 @@ func movedOnApprove(d deliveryMerge, ask *asks.Ask, w *asks.Warrant) (string, er
 	case d.Option != optionApprove:
 		return "", fmt.Errorf("the merge was made on the option %q, not an Approve", d.Option)
 	}
-	option, err := w.For(theDelivery, *ask)
+	option, err := w.For(asker, *ask)
 	if err != nil {
 		return "", err
 	}
@@ -188,9 +215,9 @@ var keptDeliveryMerge = func(ctx context.Context, owner, repo string, number int
 	return d, err == nil, err
 }
 
-// routerAskOf is the router's record of one of mesh-delivery's asks: the ask as published and its warrant. A
+// routerAskOf is the router's record of one of the delivery's asks, under its asker: the ask as published and its warrant. A
 // variable so a test can hand it one.
-var routerAskOf = func(ctx context.Context, inv catalogueReader, id string) (*asks.Ask, *asks.Warrant, error) {
+var routerAskOf = func(ctx context.Context, inv catalogueReader, asker, id string) (*asks.Ask, *asks.Warrant, error) {
 	serving := servingBus.Load()
 	if serving == nil {
 		return nil, nil, errors.New("only the serving controller reads the router's record")
@@ -202,7 +229,7 @@ var routerAskOf = func(ctx context.Context, inv catalogueReader, id string) (*as
 	if bucket == "" {
 		return nil, nil, errors.New("no module declares the operator channel's records")
 	}
-	_, ask, w, err := readRouterEntry(ctx, serving.Conn(), bucket, theDelivery, id)
+	_, ask, w, err := readRouterEntry(ctx, serving.Conn(), bucket, asker, id)
 	return ask, w, err
 }
 
@@ -283,7 +310,11 @@ func approvedAnnounced(ctx context.Context, inv catalogueReader, owner, name str
 	if !kept {
 		return "", fmt.Errorf("%w: %s/%s#%d at %.8s", errNotAnnounced, owner, name, k.Number, k.HeadSHA)
 	}
-	ask, w, err := routerAskOf(ctx, inv, d.AskID)
+	// The warrant is read under the asker the announcement names, and under none the controller does not take.
+	if err := askerAccepted(d.askerOf()); err != nil {
+		return "", fmt.Errorf("%w: %w", errWordNotAnApprove, err)
+	}
+	ask, w, err := routerAskOf(ctx, inv, d.askerOf(), d.AskID)
 	if err != nil {
 		return "", err
 	}