jschoubben
53e8f5bdd8
Design 25 §7's first item, which existed as a permission model and as nothing a person could actually be given. There is a record now, and three commands. Their authority is a list of tools and nothing else. Not a module: they hold no seat, nothing is addressed to them, nothing is delivered to them, and they have no consumer to acknowledge. What they have is permission to ask — which is why there is no scope and no node in the record. Stating what somebody may call replaces what was there rather than adding to it: a list that could only grow is a permission nobody can take back. Forgetting somebody takes their credential with them, because a person's row gone with their bus user left behind is a credential that still works and that nothing derives — the worst of both, since it keeps working and nobody can explain why. The credential is printed once and the mesh keeps only a hash, the same contract a token has. And it starts working at the next composition rather than immediately, because the bus's users are a file — said out loud in both the issue and the revoke messages, since "revoked" that still works for another minute is worth knowing about. Four properties held by test, each a way of being wrong that would not announce itself: a person may publish exactly the tool subjects they were given and nothing on control, nodes or events; they cannot answer a request; changing the list removes what is no longer named; and forgetting them revokes them.
20 lines
1.2 KiB
SQL
20 lines
1.2 KiB
SQL
-- A person who may call the mesh's tools from a workstation.
|
|
--
|
|
-- novox/hq design 25 §7. Everything else that reaches the bus is a machine or a module running on
|
|
-- one; this is the exception the mesh has always had informally — somebody at a terminal — and never
|
|
-- recorded. Until now "the operator" meant whoever held the keys, which is a role and not a record,
|
|
-- so nothing could say who may call what.
|
|
--
|
|
-- **The authority is a list of tools and nothing else.** A person is not a module: they hold no seat,
|
|
-- nothing is addressed to them, nothing is delivered to them, and they have no consumer to
|
|
-- acknowledge. What they have is permission to ask. That is why there is no scope column and no node
|
|
-- column — a person is not on a machine.
|
|
create table person (
|
|
name text primary key,
|
|
-- The tools this person may invoke, each `<module>.<tool>`, or the single entry `*` for an
|
|
-- administrator. Stored as given: the permission is derived from it at every composition, so a
|
|
-- normalised form here would be a second opinion about authority (novox/hq ADR 0043).
|
|
invokes text[] not null default '{}',
|
|
created timestamptz not null default now()
|
|
);
|