mesh-tools
7515320b72
How each pair credential a node takes stands (held with its sealed consumer copy, the next send makes it, only a person's to give and nobody gave, or refused in the controller's words), the credentials made for each provider's consumers, the own secrets with their origin and key and value, the vault's kept boxes, the bus's users, minted users and memberships, the mesh's authority and each machine's serving key and kept certificate, the repositories built, the current builds and the build of each commit a machine that reads them is sent. A credential no row holds is not made (planFor made it in every mode): the adapter returns it as would-make for perform (issue 1385). New reads in the inventory (OwnSecretRows, PairCredentialState, BusMinted) and the identity (KnownAuthority, KeptCertificate) write nothing.
48 lines
1.7 KiB
Go
48 lines
1.7 KiB
Go
package identity
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ed25519"
|
|
"encoding/base64"
|
|
"errors"
|
|
|
|
"github.com/jackc/pgx/v5"
|
|
)
|
|
|
|
// The reads of what Certify and EstablishAuthority would keep, without keeping anything (design 47 R4b, issue 1383): the
|
|
// controller's adapter from its stores to mesh-sdk's composition input fills the certificate and the authority it holds, and
|
|
// a machine whose certificate is not held yet is composed with a stand-in until the next send issues it.
|
|
|
|
// KnownAuthority is the mesh's public certificate when it has an authority, and false when none was established yet. It
|
|
// establishes nothing.
|
|
func (i *Identity) KnownAuthority(ctx context.Context) (string, bool, error) {
|
|
held, err := i.authority(ctx)
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return "", false, nil
|
|
}
|
|
if err != nil {
|
|
return "", false, err
|
|
}
|
|
return held.Certificate, true, nil
|
|
}
|
|
|
|
// KeptCertificate is the certificate Certify would answer without signing, for a node's internal name and serving key: the
|
|
// one kept for the key while it is for that name, binds that key and has life left. False when Certify would sign a fresh
|
|
// one. It writes nothing.
|
|
func (i *Identity) KeptCertificate(ctx context.Context, name, servingKey string) (string, bool, error) {
|
|
public, err := base64.StdEncoding.DecodeString(servingKey)
|
|
if err != nil || len(public) != ed25519.PublicKeySize {
|
|
return "", false, nil
|
|
}
|
|
var kept *string
|
|
err = i.store.Pool().QueryRow(ctx,
|
|
`select certificate from node_key where serving_key = $1 and revoked is null`, servingKey).Scan(&kept)
|
|
if err != nil && !errors.Is(err, pgx.ErrNoRows) {
|
|
return "", false, err
|
|
}
|
|
if kept != nil && stillStands(*kept, name, public) {
|
|
return *kept, true, nil
|
|
}
|
|
return "", false, nil
|
|
}
|