Write grants.<module>.<fp> once the bus's user list carrying a module's manifest at that fingerprint is sent, so the assigner's sixth rule reads that its credential exists (issue 1394, subtask C9b; ADR 0528 clause 2, ADR 0429 §6)

2026-10-23 15:39:40 +02:00
parent 548681cc4e
commit c43883910d
4 changed files with 355 additions and 0 deletions
@@ -0,0 +1,168 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The grants issued (novox/hq ADR 0528 clause 2, ADR 0429 §6 rule 6, issue 1394): what the assigner's sixth rule reads,
+// that a module's bus credential for a fingerprint exists. A module's permissions on the bus are what the bus's user list
+// composes from its registered manifest (inv.BusRecords), and a module's manifest is registered at a fingerprint when the
+// controller takes it in from the builder's key; so once the list is sent to the machine that runs the bus, the
+// credential of every module it carried is issued at the fingerprint of the build it is registered at. The controller
+// writes `<module>.<fingerprint hex>` then, naming the accounts it composed for the module, never removed. A module one
+// of whose accounts has no password yet (the list leaves it out) has no grant until a later send carries it.
+
+// grantsFrom is the grant of every module whose accounts all have a password in hashes, at the fingerprint current names
+// for it; a module whose current build names no fingerprint of the new form has none. principals are the bus's users
+// as broker.Users composes them.
+func grantsFrom(principals []broker.Principal, hashes map[string]string, current map[string]string) map[string]sdkdelivery.ControllerGrant {
+	accounts, missing := map[string][]string{}, map[string]bool{}
+	for _, p := range principals {
+		if p.Module == "" || (p.Kind != broker.KindModule && p.Kind != broker.KindProcess) {
+			continue
+		}
+		if hashes[p.Username()] == "" {
+			missing[p.Module] = true
+			continue
+		}
+		accounts[p.Module] = append(accounts[p.Module], p.Username())
+	}
+	out := map[string]sdkdelivery.ControllerGrant{}
+	for module, fp := range current {
+		if missing[module] || !strings.HasPrefix(fp, sdkdelivery.SourcePrefix2) {
+			continue
+		}
+		key, err := sdkdelivery.ControllerGrantKey(module, fp)
+		if err != nil {
+			continue
+		}
+		names := accounts[module]
+		sort.Strings(names)
+		out[key] = sdkdelivery.ControllerGrant{Accounts: names}
+	}
+	return out
+}
+
+// currentFingerprints is, by module, the fingerprint of the build each registered module is registered at: its
+// manifest's commit (built_from), that commit's newest successful build, and the fingerprint that build names.
+func currentFingerprints(ctx context.Context, inv *inventory.Inventory) (map[string]string, error) {
+	builds, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]string{}
+	for module, b := range builds {
+		if b.Commit == "" {
+			continue
+		}
+		id, err := inv.BuildOf(ctx, module, b.Commit)
+		if err != nil || id == "" {
+			continue
+		}
+		build, found, err := inv.BuildByID(ctx, id)
+		if err != nil || !found {
+			continue
+		}
+		out[module] = build.SourceFingerprint
+	}
+	return out, nil
+}
+
+// grantsKV is what writing the grants needs of their bucket.
+type grantsKV interface {
+	Get(ctx context.Context, key string) (jetstream.KeyValueEntry, error)
+	Create(ctx context.Context, key string, value []byte, opts ...jetstream.KVCreateOpt) (uint64, error)
+	Update(ctx context.Context, key string, value []byte, revision uint64) (uint64, error)
+}
+
+// keepGrants writes every grant the list just sent issued that the bucket does not hold as it is: a create for a new one,
+// a compare-and-set for one whose accounts changed. It answers how many it wrote.
+func keepGrants(ctx context.Context, kv grantsKV, grants map[string]sdkdelivery.ControllerGrant) (int, error) {
+	keys := make([]string, 0, len(grants))
+	for k := range grants {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	wrote := 0
+	var errs []error
+	for _, key := range keys {
+		value, err := sdkdelivery.EncodeControllerGrant(grants[key])
+		if err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", key, err))
+			continue
+		}
+		e, err := kv.Get(ctx, key)
+		switch {
+		case errors.Is(err, jetstream.ErrKeyNotFound):
+			_, err = kv.Create(ctx, key, value)
+		case err != nil:
+		default:
+			if before, derr := sdkdelivery.DecodeControllerGrant(e.Value()); derr == nil && sdkdelivery.SameControllerGrant(before, withVersion(grants[key])) {
+				continue
+			}
+			_, err = kv.Update(ctx, key, value, e.Revision())
+		}
+		if err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", key, err))
+			continue
+		}
+		wrote++
+	}
+	return wrote, errors.Join(errs...)
+}
+
+func withVersion(g sdkdelivery.ControllerGrant) sdkdelivery.ControllerGrant {
+	g.V = sdkdelivery.Version
+	return g
+}
+
+// grantsIssued writes the grants the bus's user list just sent to its machine issued (ADR 0528 clause 2). Said, never
+// fatal: a grant not written now is written at the next send of the list, and the assigner's wants wait for it.
+func grantsIssued(ctx context.Context, inv *inventory.Inventory, js jetstream.JetStream, indent string) {
+	kv, err := js.KeyValue(ctx, broker.GrantsBucket)
+	if err != nil {
+		fmt.Printf("%sthe grants issued are not written: the bucket %s: %v\n", indent, broker.GrantsBucket, err)
+		return
+	}
+	records, err := inv.BusRecords(ctx)
+	if err != nil {
+		fmt.Printf("%sthe grants issued are not written: %v\n", indent, err)
+		return
+	}
+	principals, err := broker.Users(records)
+	if err != nil {
+		fmt.Printf("%sthe grants issued are not written: %v\n", indent, err)
+		return
+	}
+	kept, err := inv.BusUsers(ctx)
+	if err != nil {
+		fmt.Printf("%sthe grants issued are not written: %v\n", indent, err)
+		return
+	}
+	hashes := make(map[string]string, len(kept))
+	for name, u := range kept {
+		hashes[name] = u.PasswordHash
+	}
+	current, err := currentFingerprints(ctx, inv)
+	if err != nil {
+		fmt.Printf("%sthe grants issued are not written: %v\n", indent, err)
+		return
+	}
+	wrote, err := keepGrants(ctx, kv, grantsFrom(principals, hashes, current))
+	if wrote > 0 {
+		fmt.Printf("%s%d grant(s) issued written for the assigner\n", indent, wrote)
+	}
+	if err != nil {
+		fmt.Printf("%ssome grants issued are not written: %v\n", indent, err)
+	}
+}