novox/mesh-controller
18
0
Fork 0
Code Issues Pull Requests 3 Releases Wiki Activity

Review round 1: mesh-mail's real shape has no broker, rollout mint issues its processes, the acceptance test connects with the minted account (issue 1181)

Browse Source 
mayIssue no longer requires a module's own broker secret when one of its
processes declares bus: mesh-mail's real manifest has none, its tools
served by the tool runner. rollout mint gained a KindProcess case, so a
process's account rotates the same way every other bus account does. The
release's acceptance test now composes its principals the real way
(inventory.ProcessesOf -> broker.Users -> broker.ComposeAccounts), mints
through the store as module issue does, and sets each connection's own
inbox prefix so replies are not refused; it moved from internal/broker
(which cannot import inventory) to cmd/mesh-controller. Added an
integration test proving the mint, accept and vault hand-off, and that
issuing again rotates the password.
This commit is contained in:
jochen
2026-10-19 03:18:08 +02:00
parent f6a48ac5ef
commit 65632e7999
6 changed files with 442 additions and 210 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/mesh-controller/modules.go
+19 -2
View File
@@ -926,14 +926,19 @@ func brokerReachableAt(ctx context.Context, inv *inventory.Inventory, known brok
// A module that runs its machine's provisioner client and declares no broker is issued the client's account
// alone (issue 917): the client speaks on the bus only as itself.
func mayIssue(m catalogue.Manifest) error {
if _, reads := m.OwnSecrets["broker"]; !reads && !runsTheProvisionerClient(m) {
processes := m.ProcessBuses()
// A module whose own tools run in the machine's tool runner — mesh-mail's real shape — declares no
// `broker` of its own at all (novox/hq ADR 0436 §2): its process's account is a different account,
// delivered as its own secret below, so a process with a bus is reason enough to pass this check on
// its own, before the module's own `broker` is asked for.
if _, reads := m.OwnSecrets["broker"]; !reads && !runsTheProvisionerClient(m) && len(processes) == 0 {
return fmt.Errorf("%s declares no own secret named broker, so there is nowhere to deliver "+
"an account; a module that speaks on the bus declares \"own-secrets\": {\"broker\": <path>}", m.Module)
}
// And every process with a bus declaration (novox/hq ADR 0436 §2): its own account is delivered as the
// module's own secret broker-<process id>, never the module's `broker`, so a process with a bus and no
// such secret has nowhere to read an account either.
for id := range m.ProcessBuses() {
for id := range processes {
name := processSecretName(id)
if _, reads := m.OwnSecrets[name]; !reads {
return fmt.Errorf("%s's process %s declares bus, and declares no own secret named %s, so there "+
@@ -948,6 +953,18 @@ func mayIssue(m catalogue.Manifest) error {
// broker-<process id>, never the module's own `broker`.
func processSecretName(processID string) string { return "broker-" + processID }
// processPrincipalFor is the one process of m's bus declarations named processID, as `rollout mint` finds it
// again from a KindProcess principal's bare id (novox/hq ADR 0436 §1, §2): false when the manifest no longer
// declares it.
func processPrincipalFor(m catalogue.Manifest, processID string) (broker.ProcessPrincipal, bool) {
for _, pr := range inventory.ProcessesOf(m) {
if pr.Process == processID {
return pr, true
}
}
return broker.ProcessPrincipal{}, false
}
// issueOnTheNewBus gives an assigned module its credential on the bus being built.
//
// **Three things differ from a management call, and each is the point of the move.** The credential