jschoubben
9bed7d6398
Every grant to call a tool is granted again under the call kind, with the credential's own bus user as the last token, and every grant to answer one is granted for calls naming any caller: the caller of a tool call becomes a fact the bus enforces, as ADR 0259 section 3 made the asker of an ask. A kind of its own because every existing tool grant is a wildcard that would match any caller appended. The old tool grants stay for one release so nothing loses its way to a tool (hq issue 464); the controller's own grants move with that issue, since they are also the installer's first user list.
118 lines
4.8 KiB
Go
118 lines
4.8 KiB
Go
package broker
|
|
|
|
import (
|
|
"regexp"
|
|
"strings"
|
|
)
|
|
|
|
// A tool call names its caller (novox/hq issue 365, by ADR 0259 §3's precedent for asks).
|
|
//
|
|
// mesh.mod.<module>.call.<tool>[.<node>].<caller>
|
|
// mesh.seat.<seat>.call.<verb>[.<node>].<caller>
|
|
//
|
|
// The last token is the bus user that published the call, and each user is granted these subjects with its own
|
|
// name there and no other — the caller is a fact the server enforces, and the tool runtime hands it to the
|
|
// module from the subject a call arrived on (mesh-tools node-tools internal/bus caller.go holds the same shape).
|
|
//
|
|
// **A kind of its own, `call`, not the `tool` subject with a token appended.** Every grant to call a tool is a
|
|
// wildcard over the `tool` kind — `.tool.<t>.*` for the instance on any machine, `mesh.mod.*.tool.>` for every
|
|
// tool — and either would match a `tool` subject with any caller appended, so a caller could name another.
|
|
// Under `call` nothing is granted but the caller-named subjects. No stream's filter covers it: a tool call is
|
|
// never persisted (design 25 §3).
|
|
//
|
|
// **Derived from the `tool` grants, in one place** (callerNamed): wherever a principal may call or answer a
|
|
// tool, it may call it in its own name, or answer it naming any caller — so no kind of principal is left
|
|
// unable to call in its own name, and a new grant to call is one in both shapes by construction.
|
|
//
|
|
// The `tool` grants stay beside these for one release, so every caller and every runtime moves without a gap:
|
|
// their retirement is hq issue 464.
|
|
const CallKind = "call"
|
|
|
|
var userName = regexp.MustCompile(`^[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]+)*$`)
|
|
|
|
// CallerToken is a bus user's name as the last token of a call it publishes: each dot written `~`, which no part
|
|
// of a user's name may hold (safeSubject), so the token names that user and no other. "" for a name that is not
|
|
// a user's.
|
|
func CallerToken(user string) string {
|
|
if !userName.MatchString(user) {
|
|
return ""
|
|
}
|
|
return strings.ReplaceAll(user, ".", "~")
|
|
}
|
|
|
|
// toolGrant splits a grant on the `tool` kind — `mesh.mod.<m>.tool.<rest>` or `mesh.seat.<s>.tool.<rest>`, any
|
|
// part possibly a wildcard — at the kind; ok is false for any other subject.
|
|
func toolGrant(subject string) (head, rest string, ok bool) {
|
|
parts := strings.SplitN(subject, ".", 5)
|
|
if len(parts) != 5 || parts[0] != "mesh" || (parts[1] != "mod" && parts[1] != "seat") || parts[3] != "tool" ||
|
|
parts[2] == "" || parts[4] == "" {
|
|
return "", "", false
|
|
}
|
|
return parts[0] + "." + parts[1] + "." + parts[2], parts[4], true
|
|
}
|
|
|
|
// CalledSubject is where a call to a tool subject goes naming its caller; "" when the subject is not a tool's
|
|
// or the user is not a bus user.
|
|
func CalledSubject(subject, user string) string {
|
|
head, rest, ok := toolGrant(subject)
|
|
token := CallerToken(user)
|
|
if !ok || token == "" || strings.ContainsAny(rest, "*>") {
|
|
return ""
|
|
}
|
|
return head + "." + CallKind + "." + rest + "." + token
|
|
}
|
|
|
|
// CalledPattern is what a holder answering a tool subject also subscribes, to hear the calls that name their
|
|
// caller: the same address under the `call` kind, any caller last. "" for a subject that is not a tool's.
|
|
func CalledPattern(subject string) string {
|
|
head, rest, ok := toolGrant(subject)
|
|
if !ok || strings.ContainsAny(rest, "*>") {
|
|
return ""
|
|
}
|
|
return head + "." + CallKind + "." + rest + ".*"
|
|
}
|
|
|
|
// calledPublish is a grant to call on the `tool` kind, as the same grant in the caller's own name: its last
|
|
// token the caller's, and nothing that reaches past it. A `>` is every tail a call carries — the tool alone or
|
|
// the tool and the machine — so it becomes both, each ending in the caller.
|
|
func calledPublish(grant, token string) []string {
|
|
head, rest, ok := toolGrant(grant)
|
|
if !ok || token == "" {
|
|
return nil
|
|
}
|
|
base := head + "." + CallKind + "."
|
|
switch {
|
|
case rest == ">":
|
|
return []string{base + "*." + token, base + "*.*." + token}
|
|
case strings.HasSuffix(rest, ".>"):
|
|
return []string{base + strings.TrimSuffix(rest, ">") + "*." + token}
|
|
}
|
|
return []string{base + rest + "." + token}
|
|
}
|
|
|
|
// calledSubscribe is a grant to answer on the `tool` kind, as the same grant for the calls naming any caller.
|
|
func calledSubscribe(grant string) []string {
|
|
head, rest, ok := toolGrant(grant)
|
|
if !ok {
|
|
return nil
|
|
}
|
|
base := head + "." + CallKind + "."
|
|
if strings.HasSuffix(rest, ">") {
|
|
return []string{base + rest}
|
|
}
|
|
return []string{base + rest + ".*"}
|
|
}
|
|
|
|
// callerNamed adds, beside a principal's grants on the `tool` kind, the same grants under `call`: to publish in
|
|
// its own name, to subscribe naming anybody.
|
|
func callerNamed(user string, pub, sub []string) ([]string, []string) {
|
|
token := CallerToken(user)
|
|
for _, g := range pub {
|
|
pub = append(pub, calledPublish(g, token)...)
|
|
}
|
|
for _, g := range sub {
|
|
sub = append(sub, calledSubscribe(g)...)
|
|
}
|
|
return unique(pub), unique(sub)
|
|
}
|