A module may hold several secrets from one provider, each a pair of its own
secrets: maps a requirement to several files under local names. Each local name is its own need, its own pair credential (the pair is keyed on it: migration 0027), its own file on the consumer, its own holder at the provider (the identity with the local name after it) and rotates apart from the others. The plain shape is unchanged and every existing row is the credential it was (novox/hq 04-ISSUES/069, ADR 0094).
This commit is contained in:
@@ -60,6 +60,9 @@ type Grant struct {
|
||||
// Values are what that module contributed — the name it wants, and anything else the
|
||||
// provision's own vocabulary defines.
|
||||
Values map[string]any
|
||||
// Local is the name the credential goes by inside the consumer where it keeps several for one
|
||||
// provision (ADR 0094); empty for the ordinary one. The provider sees it as a holder of its own.
|
||||
Local string
|
||||
// Slug is the consumer module's identity slug, if it declared one — carried on the grant so the
|
||||
// provider side derives the same login the consumer does, even across nodes where the consumer's
|
||||
// manifest is not in view (novox/hq ADR 0049). Empty means "use the module name".
|
||||
@@ -285,45 +288,48 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
|
||||
"id": AccessID(a.Path), "type": "access", "path": a.Path, "mode": a.At(),
|
||||
})
|
||||
}
|
||||
for _, to := range sortedKeys(m.Secrets) {
|
||||
var found *Needed
|
||||
for i, n := range r.Needs {
|
||||
// **This module's need, not the provision's** (novox/hq 04-ISSUES/022). Matching
|
||||
// on the name alone, every consumer of a provision took whichever credential
|
||||
// happened to be last in the list — so on a node with two of them, one module
|
||||
// would be given the other's password and fail to authenticate with a valid
|
||||
// credential belonging to somebody else.
|
||||
if n.Name == to && n.For == m.Module {
|
||||
found = &r.Needs[i]
|
||||
for _, to := range m.SecretRequirements() {
|
||||
for _, file := range m.SecretFiles(to) {
|
||||
var found *Needed
|
||||
for i, n := range r.Needs {
|
||||
// **This module's need, not the provision's** (novox/hq 04-ISSUES/022). Matching
|
||||
// on the name alone, every consumer of a provision took whichever credential
|
||||
// happened to be last in the list — so on a node with two of them, one module
|
||||
// would be given the other's password and fail to authenticate with a valid
|
||||
// credential belonging to somebody else. And this file's local name, where the
|
||||
// module keeps several (ADR 0094).
|
||||
if n.Name == to && n.For == m.Module && n.Local == file.Local {
|
||||
found = &r.Needs[i]
|
||||
}
|
||||
}
|
||||
if found != nil && found.ByRecord && found.Sealed == "" && !found.Manager {
|
||||
// Answered by a record whose key has not been supplied since this consumer was
|
||||
// put on it. **Refused, not skipped.** The mesh discarded the plaintext when the
|
||||
// key was accepted and cannot seal another, so a machine that resolved cleanly
|
||||
// would receive no file at all and fail at whatever tried to read it — which is
|
||||
// the outcome ADR 0024 exists to avoid, arrived at politely.
|
||||
//
|
||||
// The manager holder is the one exception (novox/hq ADR 0050): an empty refresh token
|
||||
// is a licence whose manager has not adopted one yet, a real waiting state rather than
|
||||
// a lost key. It falls through to the skip below — its bound facts (carrying the
|
||||
// manager's public key) are still delivered, which is what adoption needs to seal the
|
||||
// first refresh token.
|
||||
return nil, fmt.Errorf(
|
||||
"%s on this machine uses the licence %q and no key has been sealed to it. "+
|
||||
"The mesh cannot make one; supply it again with `licence key %s`",
|
||||
m.Module, found.From, found.From)
|
||||
}
|
||||
if found == nil || found.Sealed == "" {
|
||||
// Answered on this machine, or answered by a node the mesh could not seal to.
|
||||
// Nothing to write either way, and writing an empty credential file would be
|
||||
// worse than none: something would read it and fail authenticating.
|
||||
continue
|
||||
}
|
||||
first = append(first, ownedBy(m.SecretsOwner, map[string]any{
|
||||
"id": SecretID(SecretLocal(to, file.Local)), "type": "file", "path": file.Path,
|
||||
"sealed": found.Sealed,
|
||||
}))
|
||||
}
|
||||
if found != nil && found.ByRecord && found.Sealed == "" && !found.Manager {
|
||||
// Answered by a record whose key has not been supplied since this consumer was
|
||||
// put on it. **Refused, not skipped.** The mesh discarded the plaintext when the
|
||||
// key was accepted and cannot seal another, so a machine that resolved cleanly
|
||||
// would receive no file at all and fail at whatever tried to read it — which is
|
||||
// the outcome ADR 0024 exists to avoid, arrived at politely.
|
||||
//
|
||||
// The manager holder is the one exception (novox/hq ADR 0050): an empty refresh token
|
||||
// is a licence whose manager has not adopted one yet, a real waiting state rather than
|
||||
// a lost key. It falls through to the skip below — its bound facts (carrying the
|
||||
// manager's public key) are still delivered, which is what adoption needs to seal the
|
||||
// first refresh token.
|
||||
return nil, fmt.Errorf(
|
||||
"%s on this machine uses the licence %q and no key has been sealed to it. "+
|
||||
"The mesh cannot make one; supply it again with `licence key %s`",
|
||||
m.Module, found.From, found.From)
|
||||
}
|
||||
if found == nil || found.Sealed == "" {
|
||||
// Answered on this machine, or answered by a node the mesh could not seal to.
|
||||
// Nothing to write either way, and writing an empty credential file would be
|
||||
// worse than none: something would read it and fail authenticating.
|
||||
continue
|
||||
}
|
||||
first = append(first, ownedBy(m.SecretsOwner, map[string]any{
|
||||
"id": SecretID(to), "type": "file", "path": m.Secrets[to],
|
||||
"sealed": found.Sealed,
|
||||
}))
|
||||
}
|
||||
for _, to := range sortedKeys(m.Grants) {
|
||||
for _, g := range with.Grants {
|
||||
@@ -613,6 +619,15 @@ func grantPath(directory, consumer, module string) string {
|
||||
return strings.TrimRight(directory, "/") + "/" + consumer + "." + module + ".secret"
|
||||
}
|
||||
|
||||
// holderAs is a consumer's name at the provider with a local name after it, where it keeps several
|
||||
// credentials for one provision (ADR 0094); the name alone otherwise.
|
||||
func holderAs(as, local string) string {
|
||||
if local == "" {
|
||||
return as
|
||||
}
|
||||
return as + "_" + local
|
||||
}
|
||||
|
||||
// contributions collects what every module in this set contributes, by requirement.
|
||||
//
|
||||
// Ordered by contributing module, because the result becomes a file on a machine and a file whose
|
||||
@@ -649,8 +664,11 @@ func (r Resolution) contributions(settings SettingsBy, grants []Grant,
|
||||
}
|
||||
out[g.Provision] = append(out[g.Provision], Contribution{
|
||||
From: g.From, Node: g.Consumer, At: g.At, Values: g.Values,
|
||||
As: ConsumerIdentity(g.Consumer, IdentitySource(g.Slug, g.From)),
|
||||
Secret: grantPath(directories[g.Provision], g.Consumer, g.From),
|
||||
// One holder per local name: the identity the consumer is known by, and the local name
|
||||
// after it where the module keeps several (ADR 0094). Not a login any backend checks —
|
||||
// a secret is not a login — so the identity limit does not apply to the suffix.
|
||||
As: holderAs(ConsumerIdentity(g.Consumer, IdentitySource(g.Slug, g.From)), g.Local),
|
||||
Secret: grantPath(directories[g.Provision], g.Consumer, holderAs(g.From, g.Local)),
|
||||
})
|
||||
if granted[g.Provision] == nil {
|
||||
granted[g.Provision] = map[string]bool{}
|
||||
|
||||
Reference in New Issue
Block a user