jschoubben
09791f5a82
The operator asked to remove the controller by finishing its hand-over; no tool said who holds the lease, which manifests still read, invoke or consume mesh-controller, or whether the lease write's check (ADR 0571 §13) would pass. grants_lease_check answers all three from bus state on the grants part, which already reads the lease, every manifest at the indexer's trunk and the bus's streams: the holder and what follows from it, every dependency with the record on the named keep list that keeps it, the controller's streams and buckets someone consumes, and the check run dry at the write (the three kept to it alone) and before its delivery, with reasons. Quick fix: the judgement and the keep list in the grants part, as here. Thorough fix: the keep list and the dependency derivation in mesh-sdk, shared by this tool and the §13 manifest tests in mesh-catalog, mesh-delivery and mesh-tools. Chosen quick: the tests do not exist yet and an sdk move needs a group; the move is named for the lead.
141 lines
2.8 KiB
JSON
141 lines
2.8 KiB
JSON
{
|
|
"module": "mesh-grants",
|
|
"version": "1",
|
|
"slug": "grants",
|
|
"reads": [
|
|
"mesh-config.resolved",
|
|
"mesh-controller.assignments",
|
|
"mesh-controller.grants",
|
|
"mesh-delivery-assigner.wants",
|
|
"mesh-delivery-builder.builds",
|
|
"mesh-delivery-indexer.manifests",
|
|
"mesh-delivery-indexer.modules",
|
|
"mesh-delivery-assigner.placement",
|
|
"node-engine.have",
|
|
"mesh-vault.bus-accounts",
|
|
"mesh-controller.lease",
|
|
"mesh-conditions.takeover"
|
|
],
|
|
"consumes": [
|
|
"mesh-controller.condition-raised",
|
|
"mesh-controller.condition-cleared",
|
|
"mesh-conditions.condition-raised",
|
|
"mesh-conditions.condition-cleared",
|
|
"mesh-vault.account-issued"
|
|
],
|
|
"uses": [
|
|
"operator-channel"
|
|
],
|
|
"invokes": [
|
|
"nats.nats_streams",
|
|
"nats.nats_user_can",
|
|
"nats.nats_users",
|
|
"seat:mesh-controller.root-free",
|
|
"seat:mesh-hand-acts.warranted",
|
|
"seat:mesh-controller.warranted"
|
|
],
|
|
"emits": [
|
|
"asserted",
|
|
"grant-written",
|
|
"hashes-accepted",
|
|
"membership-changed",
|
|
"user-list-changed"
|
|
],
|
|
"tools": [
|
|
"grants_grants",
|
|
"grants_membership",
|
|
"grants_user_list",
|
|
"grants_compose_now",
|
|
"grants_assert",
|
|
"grants_take_over",
|
|
"grants_take_over_state",
|
|
"grants_hand_back",
|
|
"grants_accounts",
|
|
"grants_consumer_match",
|
|
"grants_accept_hashes",
|
|
"grants_lease_check"
|
|
],
|
|
"state": [
|
|
{
|
|
"name": "accounts",
|
|
"history": 5
|
|
},
|
|
{
|
|
"name": "assertions",
|
|
"history": 5
|
|
},
|
|
{
|
|
"name": "grants",
|
|
"history": 5
|
|
},
|
|
{
|
|
"name": "memberships",
|
|
"history": 5
|
|
},
|
|
{
|
|
"name": "takeover",
|
|
"history": 20
|
|
},
|
|
{
|
|
"name": "user-list",
|
|
"history": 20
|
|
},
|
|
{
|
|
"name": "withheld",
|
|
"history": 5
|
|
}
|
|
],
|
|
"own-secrets": {
|
|
"broker": "${dir:state}/broker"
|
|
},
|
|
"secrets-owner": "mesh-grants",
|
|
"resources": [
|
|
{
|
|
"id": "account",
|
|
"type": "user",
|
|
"name": "mesh-grants",
|
|
"shell": "/usr/bin/nologin",
|
|
"home": "/var/lib/mesh-grants"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-grants",
|
|
"place": ".",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "grants",
|
|
"type": "process",
|
|
"name": "mesh-grants",
|
|
"artifact": "program",
|
|
"run": [
|
|
"./mesh-grants"
|
|
],
|
|
"env": {
|
|
"MESH_BROKER_FILE": "${dir:state}/broker"
|
|
},
|
|
"user": "mesh-grants",
|
|
"health": {
|
|
"kind": "unit"
|
|
}
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "program",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-grants",
|
|
"binary": "mesh-grants",
|
|
"loads": [
|
|
"mesh-grants"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|