jschoubben
5d5ee69775
The holder of the seat mesh-enrolment (ADR 0587 §1, §2, §8) runs as a bundle on its own account, keeps the bucket enrolments with a time to live per key, and answers tokens: every open enrolment or one node's with stage, expiry, ask and revision, the bucket's fill, whether issuing is on and why, and for one node at live the token sealed by the vault and relayed, kept nowhere. Tests added: two (one table-style test of tokens, the manifest test); the repository is over its budget, paid by merging tests in the assigner's seat tests in 774/S59's commit. (issue 774, 774/S54) Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
89 lines
1.7 KiB
JSON
89 lines
1.7 KiB
JSON
{
|
|
"module": "mesh-enrolment",
|
|
"version": "1",
|
|
"runs-as": "mesh-enrolment",
|
|
"claims": [
|
|
{
|
|
"name": "mesh-enrolment",
|
|
"scope": "mesh",
|
|
"serves": [
|
|
"issue",
|
|
"redeem",
|
|
"confirm",
|
|
"revoke",
|
|
"tokens",
|
|
"again"
|
|
]
|
|
}
|
|
],
|
|
"consumes": [
|
|
"mesh-enrolment.node-enrolled",
|
|
"mesh-enrolment.enrolment-refused",
|
|
"mesh-enrolment.enrolment-revoked",
|
|
"mesh-enrolment.enrolment-expired"
|
|
],
|
|
"uses": [
|
|
"operator-channel"
|
|
],
|
|
"invokes": [
|
|
"seat:mesh-hand-acts.hand-act",
|
|
"seat:mesh-hand-acts.warranted",
|
|
"seat:mesh-placement.propose",
|
|
"seat:mesh-vault.enrolment-token",
|
|
"seat:mesh-vault.node-account",
|
|
"seat:mesh-vault.sign"
|
|
],
|
|
"reads": [
|
|
"mesh-controller.lease",
|
|
"mesh-delivery-assigner.placement",
|
|
"mesh-grants.user-list",
|
|
"node-engine.have"
|
|
],
|
|
"state": [
|
|
{
|
|
"name": "enrolments",
|
|
"key-ttl": true
|
|
},
|
|
{
|
|
"name": "asked",
|
|
"history": 5
|
|
}
|
|
],
|
|
"own-secrets": {
|
|
"broker": "${dir:state}/broker"
|
|
},
|
|
"secrets-owner": "mesh-enrolment",
|
|
"resources": [
|
|
{
|
|
"id": "account",
|
|
"type": "user",
|
|
"name": "mesh-enrolment",
|
|
"shell": "/usr/bin/nologin",
|
|
"home": "/var/lib/mesh-enrolment"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-enrolment",
|
|
"place": ".",
|
|
"unknown": "program"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-enrolment",
|
|
"binary": "mesh-enrolment",
|
|
"loads": [
|
|
"mesh-enrolment"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|