Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

A Servarr app's API key, an indexer's key and a downloader's password are values the provider's
software holds; the pair path made a random value for every consumer of them, sealed it to both ends
and reported success, and the provider refused it. An offer may now say `"credential": {"issued-by":
"outside"}`: SecretFor never makes a value for it, the plan reads such a pair as given or not given
and sends the consumer no credential file until a person gives it, without refusing its machine;
remakeShared and SharedSecretFor never make a provider's own secret issued outside either.
`secret accept <provider's node> <provider module> <provision>` seals one value to every consumer that
binds the provision from that provider, the provider and the operator, under one generation; the
per-pair form is refused for such a provision, and rotate names the accept. A consumer may wait for a
provision's credential: the controller excuses the wait only when the store bears it out, and its
needs-operator condition names the one accept line.

Adds the replay of issue 164 (TestReplay164), written with only what the controller had before.

internal/catalogue/issued_credential_test.go

@@ -25,13 +25,13 @@ func TestAnOfferMaySayItsSoftwareIssuesTheCredential(t *testing.T) {
 	}
 
 	for want, raw := range map[string]string{
-		"the one issuer an offer may name": `{"module":"d","version":"1",
+		"the issuers an offer may name": `{"module":"d","version":"1",
 			"provides":[{"name":"d-api","credential":{"issued-by":"vendor","tool":"d_token"}}]}`,
 		"names no tool that answers it": `{"module":"d","version":"1",
 			"provides":[{"name":"d-api","credential":{"issued-by":"software"}}]}`,
 		"names its own secret": `{"module":"d","version":"1","own-secrets":{"token":{"path":"/p","taken":"at-start"}},
 			"provides":[{"name":"d-api","credential":{"issued-by":"software","tool":"d_token","own":"token"}}]}`,
-		"the one issuer an offer may name ": `{"module":"d","version":"1",
+		"the issuers an offer may name ": `{"module":"d","version":"1",
 			"provides":[{"name":"d-api","credential":{"tool":"d_token"}}]}`,
 	} {
 		want = strings.TrimSpace(want)

internal/catalogue/issued_outside_test.go

@@ -0,0 +1,46 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// A provision's credential may be one only a person outside the mesh can give (novox/hq ADR 0337 §1, issue 164):
+// the offer says `issued-by: outside` and names neither an own secret nor a tool, and the parser refuses it beside
+// either. An offer that says `software` keeps ADR 0305's shape.
+func TestAnOfferMaySayAPersonOutsideTheMeshIssuesItsCredential(t *testing.T) {
+	m, err := ParseManifest([]byte(`{"module":"tv","version":"1",
+		"provides":[{"name":"tv-api","scope":"mesh","credential":{"issued-by":"outside"}}],
+		"serves":{"tv-api":{"port":8989}}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !m.IssuedOutsideOf("tv-api") {
+		t.Fatal("the offer's credential issued outside was not read")
+	}
+	if m.IssuedOutsideOf("other") {
+		t.Fatal("a provision the module does not offer reads as issued outside")
+	}
+	if _, issued := m.IssuedCredentialOf("tv-api"); issued {
+		t.Fatal("a credential issued outside was read as issued by the software")
+	}
+	if _, shared := m.SharedCredentialOf("tv-api"); shared {
+		t.Fatal("a credential issued outside was read as an own secret shared")
+	}
+	if who, offered := OffersIssuedOutside(map[string]Manifest{"tv": m}, "tv-api"); !offered || who != "tv" {
+		t.Fatalf("the catalogue does not say tv offers tv-api issued outside: %q %v", who, offered)
+	}
+
+	for want, raw := range map[string]string{
+		"names its own secret": `{"module":"d","version":"1","own-secrets":{"key":{"path":"/p","taken":"at-start"}},
+			"provides":[{"name":"d-api","credential":{"issued-by":"outside","own":"key"}}]}`,
+		"names the tool": `{"module":"d","version":"1",
+			"provides":[{"name":"d-api","credential":{"issued-by":"outside","tool":"d_key"}}]}`,
+		"the issuers an offer may name": `{"module":"d","version":"1",
+			"provides":[{"name":"d-api","credential":{"issued-by":"a-person"}}]}`,
+	} {
+		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("expected a refusal saying %q, got %v", want, err)
+		}
+	}
+}

internal/catalogue/manifest.go

@@ -269,7 +269,8 @@ func KeepsConsumerData(catalogue map[string]Manifest, provision string) bool {
 func (o Offer) MachineReach() bool { return o.Reach == ReachMachine }
 
 // OfferCredential names which of the provider's own secrets a provision's consumers receive — or, with
-// IssuedBy, that the provider's software issues the provision's one credential itself (novox/hq ADR 0305,
+// IssuedBy "outside", that only a person can give the provision's credential (novox/hq ADR 0337, issue 164) — or,
+// with IssuedBy "software", that the provider's software issues the provision's one credential itself (novox/hq ADR 0305,
 // issue 526): a media server's sign-in token from its vendor, which the mesh can neither make nor rotate.
 // Tool is then the provider's own tool that answers that value, sealed to a key made for the controller's
 // one call, and to the controller alone.
@@ -293,6 +294,34 @@ func (m Manifest) IssuedCredentialOf(provision string) (string, bool) {
 	return "", false
 }
 
+// IssuedOutsideOf is whether this module's offer of a provision says only a person outside the mesh can give its
+// credential (novox/hq ADR 0337): the mesh never makes a value for it, and a consumer holds one only once a person
+// gave it with `secret accept`.
+func (m Manifest) IssuedOutsideOf(provision string) bool {
+	for _, o := range m.Provides {
+		if o.Name == provision && o.Credential != nil && o.Credential.IssuedBy == IssuedOutside {
+			return true
+		}
+	}
+	return false
+}
+
+// OffersIssuedOutside is whether any module of a catalogue offers the provision with a credential issued outside
+// the mesh (novox/hq ADR 0337), and the first such module by name.
+func OffersIssuedOutside(shelf map[string]Manifest, provision string) (string, bool) {
+	var names []string
+	for name, m := range shelf {
+		if m.IssuedOutsideOf(provision) {
+			names = append(names, name)
+		}
+	}
+	if len(names) == 0 {
+		return "", false
+	}
+	sort.Strings(names)
+	return names[0], true
+}
+
 // SharedCredentialOf is the own secret an offer of this module names as the provision's credential,
 // and whether it names one.
 func (m Manifest) SharedCredentialOf(provision string) (string, bool) {
@@ -1647,14 +1676,28 @@ func ParseManifest(raw []byte) (Manifest, error) {
 						"makes is %d", m.Module, p, id.Max, shortest))
 			}
 		}
-		if c := offer.Credential; c != nil && (c.IssuedBy != "" || c.Tool != "") {
+		if c := offer.Credential; c != nil && c.IssuedBy == IssuedOutside {
+			// Only a person can give it (novox/hq ADR 0337 §1, issue 164): the software holds a value the mesh can
+			// neither make nor fetch, so the offer names nothing that would answer it — no own secret, no tool.
+			switch {
+			case c.Own != "":
+				problems = append(problems, fmt.Sprintf(
+					"%s provides %q with a credential issued outside the mesh and names its own secret %q too; a "+
+						"person gives the value with `secret accept`, so the offer names no own secret (ADR 0337)",
+					m.Module, p, c.Own))
+			case c.Tool != "":
+				problems = append(problems, fmt.Sprintf(
+					"%s provides %q with a credential issued outside the mesh and names the tool %q; only a "+
+						"person gives it, so the offer names no tool (ADR 0337)", m.Module, p, c.Tool))
+			}
+		} else if c := offer.Credential; c != nil && (c.IssuedBy != "" || c.Tool != "") {
 			// The software issues it (novox/hq ADR 0305): named by the tool that answers it, never by an own
 			// secret, which would be a second copy for the mesh to keep in step with the software's.
 			switch {
 			case c.IssuedBy != IssuedBySoftware:
 				problems = append(problems, fmt.Sprintf(
-					"%s provides %q with a credential issued by %q; the one issuer an offer may name is %q (ADR 0305)",
-					m.Module, p, c.IssuedBy, IssuedBySoftware))
+					"%s provides %q with a credential issued by %q; the issuers an offer may name are %q and %q "+
+						"(ADR 0305, ADR 0337)", m.Module, p, c.IssuedBy, IssuedBySoftware, IssuedOutside))
 			case c.Own != "":
 				problems = append(problems, fmt.Sprintf(
 					"%s provides %q with a credential its software issues and names its own secret %q too; the "+