jschoubben
288364f28d
ADR 0587 §4: the grants part composes enrol.<node> from a key at live and the vault's hash, granted only the seat's redeem and its own inbox; §5: when the key ends the user goes. The part reads mesh-enrolment.enrolments as its named reader and follows it by watch: a key reaching live composes the user, and its end (by the holder, or by the bus at its expiry) is a change of the key that takes it out, so no consume of the seat's ending events is added beside the watch (the subtask named one; the watch already hears every end, the bus's expiry included). From the lease write the user loses the controller's enrolment subject (§6) and the standing gap of the controller's tokens is dropped; before it the gap stands. Tested as a subtest of TestGrants, no new test function. Built against the group's mesh-sdk head 5000774 through a go.work outside the worktree; the pin is the lead's. (issue 774, 774/S52) Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
165 lines
3.3 KiB
JSON
165 lines
3.3 KiB
JSON
{
|
|
"module": "mesh-grants",
|
|
"version": "1",
|
|
"slug": "grants",
|
|
"claims": [
|
|
{
|
|
"name": "mesh-grants",
|
|
"scope": "mesh",
|
|
"serves": [
|
|
"lease-write",
|
|
"lease-hand-back"
|
|
]
|
|
}
|
|
],
|
|
"reads": [
|
|
"mesh-config.resolved",
|
|
"mesh-delivery-assigner.wants",
|
|
"mesh-delivery-builder.builds",
|
|
"mesh-delivery-indexer.manifests",
|
|
"mesh-delivery-indexer.modules",
|
|
"mesh-delivery-assigner.placement",
|
|
"node-engine.have",
|
|
"mesh-vault.bus-accounts",
|
|
"mesh-controller.lease",
|
|
"mesh-conditions.takeover",
|
|
"mesh-enrolment.enrolments"
|
|
],
|
|
"consumes": [
|
|
"mesh-conditions.condition-raised",
|
|
"mesh-conditions.condition-cleared",
|
|
"mesh-vault.account-issued",
|
|
"nats.bucket-expiry-set"
|
|
],
|
|
"uses": [
|
|
"operator-channel"
|
|
],
|
|
"invokes": [
|
|
"nats.nats_streams",
|
|
"nats.nats_user_can",
|
|
"nats.nats_users",
|
|
"seat:node-engine.root-free",
|
|
"seat:mesh-hand-acts.warranted",
|
|
"seat:node-service-manager.stop",
|
|
"seat:node-service-manager.start",
|
|
"seat:node-service-manager.status",
|
|
"nats.nats_bucket_expiry",
|
|
"nats.nats_consumer_remove",
|
|
"nats.nats_stream_remove",
|
|
"seat:mesh-hand-acts.hand-act",
|
|
"mesh-delivery-view.node_trusts",
|
|
"seat:mesh-config.compare",
|
|
"seat:mesh-wants.upgrade",
|
|
"mesh-vault.vault_status",
|
|
"seat:issue-tracker.get"
|
|
],
|
|
"emits": [
|
|
"asserted",
|
|
"grant-written",
|
|
"hashes-accepted",
|
|
"membership-changed",
|
|
"user-list-changed"
|
|
],
|
|
"tools": [
|
|
"grants_grants",
|
|
"grants_membership",
|
|
"grants_user_list",
|
|
"grants_compose_now",
|
|
"grants_assert",
|
|
"grants_take_over",
|
|
"grants_take_over_state",
|
|
"grants_hand_back",
|
|
"grants_accounts",
|
|
"grants_consumer_match",
|
|
"grants_accept_hashes",
|
|
"grants_lease_check",
|
|
"grants_removal_due"
|
|
],
|
|
"state": [
|
|
{
|
|
"name": "accounts",
|
|
"history": 5
|
|
},
|
|
{
|
|
"name": "assertions",
|
|
"history": 5
|
|
},
|
|
{
|
|
"name": "grants",
|
|
"history": 5
|
|
},
|
|
{
|
|
"name": "lease",
|
|
"key-ttl": true
|
|
},
|
|
{
|
|
"name": "memberships",
|
|
"history": 5
|
|
},
|
|
{
|
|
"name": "takeover",
|
|
"history": 20
|
|
},
|
|
{
|
|
"name": "user-list",
|
|
"history": 20
|
|
},
|
|
{
|
|
"name": "withheld",
|
|
"history": 5
|
|
}
|
|
],
|
|
"own-secrets": {
|
|
"broker": "${dir:state}/broker"
|
|
},
|
|
"secrets-owner": "mesh-grants",
|
|
"resources": [
|
|
{
|
|
"id": "account",
|
|
"type": "user",
|
|
"name": "mesh-grants",
|
|
"shell": "/usr/bin/nologin",
|
|
"home": "/var/lib/mesh-grants"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-grants",
|
|
"place": ".",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "grants",
|
|
"type": "process",
|
|
"name": "mesh-grants",
|
|
"artifact": "program",
|
|
"run": [
|
|
"./mesh-grants"
|
|
],
|
|
"env": {
|
|
"MESH_BROKER_FILE": "${dir:state}/broker"
|
|
},
|
|
"user": "mesh-grants",
|
|
"health": {
|
|
"kind": "unit"
|
|
}
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "program",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-grants",
|
|
"binary": "mesh-grants",
|
|
"loads": [
|
|
"mesh-grants"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|