jschoubben
5bed0cd831
Replaces A-60's grant of chunk subjects to the bundle's principal. Builds: design 47 G A-107, A-109, A-110 Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
88 lines
4.3 KiB
Go
88 lines
4.3 KiB
Go
package buscompose
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
)
|
|
|
|
// The bus account of one process of a module that declares bus (novox/hq ADR 0436 §1, §2, §3, §5).
|
|
//
|
|
// **Never the module's own account's grants, never the tool runner's.** A process's authority is read
|
|
// straight from its bus declaration — its emits, its queue's consumer, its state, whether it reads the
|
|
// records of its module's own asks, and the tools and seat verbs it calls — and nothing else: it holds no
|
|
// seat, serves no tool and hears no module stream; it answers a seat's verb only where its bus declares `serves` (design 47 G A-109). Modelled on
|
|
// provisionerGrants, the other kind of process account the mesh mints (ADR 0349 clauses 6 and 11).
|
|
|
|
// processGrants is one process's whole authority: to publish, and to subscribe.
|
|
func processGrants(p Principal) (pub, sub []string, err error) {
|
|
// 1. Its own events, under its module's own namespace — the same subjects the module's own principal
|
|
// would publish them on, had it declared them there instead (novox/hq ADR 0436 §1).
|
|
own := "mesh.mod." + p.Module
|
|
for _, e := range p.Emits {
|
|
pub = append(pub, own+".event."+e)
|
|
}
|
|
|
|
// 2. The one durable consumer of each work-queue stream its bus names (novox/hq ADR 0436 §1, §2, §6):
|
|
// asked about, pulled from and acknowledged, by the same name ConsumersOf composes the consumer under
|
|
// (QueueConsumer) — and no other stream's.
|
|
for _, q := range p.Queues {
|
|
consumer := p.Node + "_" + p.Module + "_" + q.Process
|
|
pub = append(pub,
|
|
"$JS.API.CONSUMER.INFO."+q.Stream+"."+consumer,
|
|
"$JS.API.CONSUMER.MSG.NEXT."+q.Stream+"."+consumer,
|
|
"$JS.ACK."+q.Stream+"."+consumer+".>")
|
|
}
|
|
|
|
// 3. Its module's own state, by the local names its bus names alone — never the whole of what the
|
|
// module keeps (novox/hq ADR 0436 §1), read and written as stateGrants gives any module's own bucket.
|
|
kept := stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State}
|
|
pub = append(pub, stateGrants(kept)...)
|
|
// And it hears each of them created, so one not on the bus at its start is bound when it appears (novox/hq issue
|
|
// 1790; process.AwaitBucket).
|
|
sub = append(sub, stateCreatedHeard(kept)...)
|
|
|
|
// 4. The router's records of its module's own asks (novox/hq ADR 0436 §1, ADR 0259 §3): the same
|
|
// direct-get subjects a module's own principal reads for the seats its Uses names that keep them —
|
|
// read here from the one list, so the two cannot disagree.
|
|
if p.Asks {
|
|
pub = append(pub, SeatTrafficOf(p.Module, nil, p.Uses, nil).Records...)
|
|
}
|
|
|
|
// 5. The tools and seat verbs it calls (novox/hq ADR 0152, ADR 0436 §1): the same derivation a
|
|
// module's own principal's invokes takes, so `callerNamed` (applied to every non-controller principal)
|
|
// adds the caller-named `call` variants for it exactly as it would for a module.
|
|
invoked, err := invokedSubjects(p.Invokes)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
pub = append(pub, invoked...)
|
|
|
|
// 5b. The seat verbs it answers (design 47 G A-107, A-109): its subscribe of each verb's call and tool subjects (and
|
|
// the chunk subjects, chunks.go).
|
|
for _, v := range p.AnswersSeat {
|
|
seat, verb, ok := strings.Cut(strings.TrimPrefix(v, "seat:"), ".")
|
|
if !strings.HasPrefix(v, "seat:") || !ok || seat == "" || verb == "" {
|
|
return nil, nil, fmt.Errorf("%q does not name a seat's verb: one serves seat:<seat>.<verb>", v)
|
|
}
|
|
sub = append(sub, "mesh.seat."+seat+".call."+verb+".*", "mesh.seat."+seat+".tool."+verb)
|
|
}
|
|
|
|
// 6. The bus module's process (busstate.go, ADR 0595 §4, §5): every module's bus state it keeps, by name; its own
|
|
// consumer of what its module consumes; its module's own stream's events; and its conditions through the seats its
|
|
// module uses (the operator channel's accept.condition in its module's name).
|
|
if p.KeepsBus {
|
|
pub = append(pub, busStateKeeperGrants(p.KeepsBusState)...)
|
|
// And its standing restore of the streams ADR 0436 §3 restricts, used on a `snapshot-restore` call alone (design 47 G §681, A-60).
|
|
pub = append(pub, restoreGrants(p.KeepsRestricted)...)
|
|
if c, ok := keeperConsumer(p); ok {
|
|
pub = append(pub, keeperConsumerGrants(c)...)
|
|
}
|
|
pub = append(pub, ownStreamGrants(p.Module, p.Streams)...)
|
|
pub = append(pub, p.SaysSeatEvents...)
|
|
tp, ts := seatTrafficGrants(SeatTrafficOf(p.Module, nil, p.Uses, nil))
|
|
pub, sub = append(pub, tp...), append(sub, ts...)
|
|
}
|
|
|
|
return pub, sub, nil
|
|
}
|