A token is an account on the bus, and genesis can place the list

novox/hq 04-ISSUES/146. The composed user list names an enrolment user for
every machine with a live token and nothing minted a credential for it, so the
composer left it out as a user with no password — and every enrolment since the
mesh moved to this bus was refused before the mesh heard of it. The comment
above the issuing code already said the account is created before the token is
handed over; now it is. Recorded rather than minted, because the token's secret
is the password.

And 'broker accounts', which composes the same list the declaration carries and
writes it to standard output. For genesis, where no declaration can reach the
machine running the bus because that machine is not yet a node. It says what it
composed; whoever is raising the machine places it. A control plane that wrote
the file itself would have to learn where the bus keeps its configuration and
how to make it reload, which is the module's knowledge.

internal/inventory/busrecords_test.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
+	"golang.org/x/crypto/bcrypt"
 )
 
 // Reading the bus's user list out of the mesh's records, against a real store.
@@ -164,3 +165,63 @@ func granted(all []string, one string) bool {
 	}
 	return false
 }
+
+// **A token is an account on the bus, or it is a string nothing accepts** (novox/hq 04-ISSUES/146).
+//
+// The composed list names an enrolment user for every machine with a live token, and nothing minted
+// a credential for it — so the composer left it out as a user with no password, and every enrolment
+// since the mesh moved to this bus was refused by the server before the mesh heard of it. Nothing
+// caught it because nothing had enrolled since.
+//
+// The password cannot be minted, because it is the token's own secret: the machine will present
+// exactly that string. So this checks the two halves that make the account usable — that a row
+// exists under the name the composer asks for, and that the secret handed out is what that row
+// accepts.
+func TestIssuingATokenRecordsTheAccountItIsThePasswordOf(t *testing.T) {
+	inv, ctx := aMeshWith(t)
+	if _, err := inv.AddNode(ctx, "joiner"); err != nil {
+		t.Fatal(err)
+	}
+	issued, err := inv.IssueToken(ctx, "joiner", time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	name := broker.Principal{Kind: broker.KindEnrolment, Node: "joiner"}.Username()
+	users, err := inv.BusUsers(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	user, has := users[name]
+	if !has {
+		t.Fatalf("no bus account for %q; the composer would leave the enrolment out and the "+
+			"machine would be refused before the mesh heard of it: %v", name, users)
+	}
+	if user.Kind != BusEnrolment || user.Node != "joiner" {
+		t.Errorf("the account is %+v, not this node's enrolment", user)
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(issued.Secret)); err != nil {
+		t.Error("the account does not accept the secret the token carries, so presenting the " +
+			"token would be refused by the server")
+	}
+
+	// And the composition contains it, which is the thing the server reads.
+	records, err := inv.BusRecords(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	derived, err := broker.Users(records)
+	if err != nil {
+		t.Fatal(err)
+	}
+	hashes := map[string]string{}
+	for n, u := range users {
+		hashes[n] = u.PasswordHash
+	}
+	_, missing := broker.WithPasswords(derived, hashes)
+	for _, m := range missing {
+		if m == name {
+			t.Fatal("the enrolment user is composed without a password, which is a user nobody can be")
+		}
+	}
+}

internal/inventory/bususers.go

@@ -51,6 +51,40 @@ const (
 // reply, into a module's sealed environment — and the mesh keeps only the hash, so a credential is
 // never recoverable from the store. A caller that loses it must mint again, which is a rotation and
 // is meant to feel like one.
+// RecordBusPassword records a hash for a password the caller already holds.
+//
+// **For the one credential the mesh does not choose**: an enrolment token's secret is the password
+// of the user that presents it (novox/hq ADR 0004, design 25 §6), so the token cannot be given a
+// minted password — it already has one, and the machine will connect with exactly that string.
+// Everything else goes through Mint, which chooses and returns the plaintext once.
+func (i *Inventory) RecordBusPassword(ctx context.Context, u BusUser, password string) error {
+	if u.Username == "" || u.Kind == "" {
+		return errors.New("a bus user needs a username and a kind")
+	}
+	if password == "" {
+		return errors.New("a bus user needs a password")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return fmt.Errorf("cannot hash a bus password: %w", err)
+	}
+	return i.writeBusUser(ctx, u, string(hash))
+}
+
+// writeBusUser is the row, whoever chose the password.
+func (i *Inventory) writeBusUser(ctx context.Context, u BusUser, hash string) error {
+	if _, err := i.store.Pool().Exec(ctx,
+		`insert into bus_user (username, kind, node, module, password_hash)
+		 values ($1, $2, $3, $4, $5)
+		 on conflict (username) do update
+		   set kind = excluded.kind, node = excluded.node, module = excluded.module,
+		       password_hash = excluded.password_hash, minted_at = now()`,
+		u.Username, u.Kind, u.Node, u.Module, hash); err != nil {
+		return fmt.Errorf("cannot record the bus user %s: %w", u.Username, err)
+	}
+	return nil
+}
+
 func (i *Inventory) MintBusPassword(ctx context.Context, u BusUser) (string, error) {
 	if u.Username == "" || u.Kind == "" {
 		return "", errors.New("a bus user needs a username and a kind")
@@ -69,14 +103,8 @@ func (i *Inventory) MintBusPassword(ctx context.Context, u BusUser) (string, err
 		return "", fmt.Errorf("cannot hash a bus password: %w", err)
 	}
 
-	if _, err := i.store.Pool().Exec(ctx,
-		`insert into bus_user (username, kind, node, module, password_hash)
-		 values ($1, $2, $3, $4, $5)
-		 on conflict (username) do update
-		   set kind = excluded.kind, node = excluded.node, module = excluded.module,
-		       password_hash = excluded.password_hash, minted_at = now()`,
-		u.Username, u.Kind, u.Node, u.Module, string(hash)); err != nil {
-		return "", fmt.Errorf("cannot record the bus user %s: %w", u.Username, err)
+	if err := i.writeBusUser(ctx, u, string(hash)); err != nil {
+		return "", err
 	}
 	return password, nil
 }

internal/inventory/nodes.go

@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/jackc/pgx/v5"
+	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/store"
 )
 
@@ -263,6 +264,29 @@ func (i *Inventory) IssueToken(ctx context.Context, nodeName string, validFor ti
 		return Issued{}, err
 	}
 
+	// **And the account that secret is the password of** (novox/hq 04-ISSUES/146). The composed
+	// user list names an enrolment user for every node with a live token, and nothing minted a
+	// credential for it — so the composer left it out as a user with no password and every
+	// enrolment was refused by the server before the mesh heard of it.
+	//
+	// Recorded rather than minted: the token's secret IS the password, which is what lets a
+	// machine's first connection be authenticated by the thing it is enrolling with. It cannot be
+	// chosen here, because it has already been handed to whoever will present it.
+	//
+	// Outside the transaction on purpose. The token is what the mesh promised; a credential that
+	// the next composition rewrites anyway is not worth failing an issue over, and a token with no
+	// account is recoverable by issuing another, while an account with no token is a user nobody
+	// can be.
+	if err := i.RecordBusPassword(ctx, BusUser{
+		Username: broker.Principal{Kind: broker.KindEnrolment, Node: node.Name}.Username(),
+		Kind:     BusEnrolment,
+		Node:     node.Name,
+	}, secret); err != nil {
+		return Issued{}, fmt.Errorf(
+			"the token for %s was issued and the bus account it is the password of was not "+
+				"recorded, so this token cannot connect: %w", node.Name, err)
+	}
+
 	return Issued{Node: node, Secret: secret, Expires: expires}, nil
 }