WIP: recheck a take's filesystem, follow only the module's branch, count users in an access change, hold the identity until its data is taken (hq ADR 0325 review)

internal/inventory/catalogue.go

@@ -970,6 +970,17 @@ func (i *Inventory) judgeSettings(ctx context.Context, nodeName, module string,
 		if aerr != nil {
 			return aerr
 		}
+		if !has {
+			follows, ferr := i.followsABranch(ctx, module)
+			if ferr != nil {
+				return ferr
+			}
+			if !follows {
+				return fmt.Errorf("refused: %s on %s cannot compose with the layer %q — %w; and %s follows no branch "+
+					"(it was registered by hand), so no build of it can be judged ahead of what is registered", module,
+					where, from, err, module)
+			}
+		}
 		if !has || catalogue.JudgeSettings(ahead, layers, adopted) != nil || catalogue.ComposesWith(m, layers, adopted) != nil {
 			return fmt.Errorf("refused: %s on %s cannot compose with the layer %q — %w; nor does the newest build of "+
 				"%s on the branch it follows declare it", module, where, from, err, module)
@@ -990,15 +1001,26 @@ func (i *Inventory) judgeSettings(ctx context.Context, nodeName, module string,
 	return nil
 }
 
+// followsABranch says a module's record names the branch it follows.
+func (i *Inventory) followsABranch(ctx context.Context, module string) (bool, error) {
+	var ref string
+	err := i.store.Pool().QueryRow(ctx, `select coalesce(ref, '') from module where name = $1`, module).Scan(&ref)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return false, nil
+	}
+	return ref != "", err
+}
+
 // NewestManifestOnBranch is the manifest of a module's newest successful build on the branch its record follows
 // (novox/hq issue 575): what the delivery under way brings, before it registers — or the registered one's own, when
-// nothing newer was built. False when no build of the module with a manifest is kept.
+// nothing newer was built. Only a build of that very branch: never one of another branch or of none. False when no
+// such build is kept, and for a module whose record follows no branch (registered by hand).
 func (i *Inventory) NewestManifestOnBranch(ctx context.Context, module string) (catalogue.Manifest, bool, error) {
 	var raw []byte
 	err := i.store.Pool().QueryRow(ctx,
 		`select b.manifest from build b join module m on m.name = b.module
 		  where b.module = $1 and b.failed = '' and b.manifest is not null and b.manifest::text <> 'null'
-		    and (coalesce(m.ref, '') = '' or b.ref = '' or b.ref = m.ref)
+		    and coalesce(m.ref, '') <> '' and b.ref = m.ref
 		  order by b.at desc limit 1`, module).Scan(&raw)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return catalogue.Manifest{}, false, nil

internal/inventory/identities_test.go

@@ -2,6 +2,7 @@ package inventory
 
 import (
 	"encoding/json"
+	"fmt"
 	"strings"
 	"testing"
 
@@ -168,3 +169,56 @@ func TestAPlacementIsJudgedAgainstTheBuildThatBringsTheAccess(t *testing.T) {
 		t.Fatal("a placement no build declares was taken")
 	}
 }
+
+// Review of e1c2b744: only a build of the branch the module's record follows judges a placement ahead of it — never one
+// from another branch, nor one with no branch, and a module registered with no branch is refused as before, saying so.
+func TestOnlyABuildOfTheFollowedBranchJudgesAPlacementAhead(t *testing.T) {
+	inv := fresh(t)
+	ctx := t.Context()
+	if _, err := inv.AddNode(ctx, "ace"); err != nil {
+		t.Fatal(err)
+	}
+	registered := catalogue.Manifest{Module: "importer", Version: "1",
+		Resources: []map[string]any{{"id": "server", "type": "container", "name": "importer", "image": "x"}}}
+	ahead := registered
+	ahead.Accesses = []catalogue.Access{{ID: "movies", Path: "/services/media/movies", Mode: catalogue.AccessReadWrite}}
+	raw, err := json.Marshal(ahead)
+	if err != nil {
+		t.Fatal(err)
+	}
+	placing := map[string]any{catalogue.AccessesSetting: map[string]any{"movies": "/storage/media/movies"}}
+	if err := inv.RegisterModule(ctx, registered, Source{Repository: "https://forge.invalid/media.git", Ref: "main",
+		BuiltFrom: "c0ffee"}); err != nil {
+		t.Fatal(err)
+	}
+	for i, ref := range []string{"feature", ""} {
+		b := aBuild(fmt.Sprintf("elsewhere%d", i), "importer", "")
+		b.Ref, b.Manifest = ref, raw
+		if err := inv.RecordBuild(ctx, b); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.JudgeSettings(ctx, "ace", "importer", placing); err == nil {
+		t.Fatal("a build of another branch, or of none, judged the placement")
+	}
+	// Registered by hand, with no branch: refused, saying why.
+	byHand := registered
+	byHand.Module = "byhand"
+	if err := inv.RegisterModule(ctx, byHand, Source{}); err != nil {
+		t.Fatal(err)
+	}
+	aheadByHand := ahead
+	aheadByHand.Module = "byhand"
+	if raw, err = json.Marshal(aheadByHand); err != nil {
+		t.Fatal(err)
+	}
+	b := aBuild("onmain", "byhand", "")
+	b.Ref, b.Manifest = "main", raw
+	if err := inv.RecordBuild(ctx, b); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.JudgeSettings(ctx, "ace", "byhand", placing); err == nil ||
+		!strings.Contains(err.Error(), "follows no branch") {
+		t.Fatalf("a module with no branch recorded: %v", err)
+	}
+}