62 lines
2.6 KiB
Go
62 lines
2.6 KiB
Go
package buscompose
|
|
|
|
import (
|
|
"time"
|
|
|
|
"git.novox.be/novox/mesh-delivery/modules/mesh-grants/grantsstate"
|
|
)
|
|
|
|
// **The accounts the grants part wants, and the one shape a held account takes** (novox/hq ADR 0561 §1, §2; issue 774).
|
|
//
|
|
// The bus composer derives every user from placement, the manifests and the wants. For each account the mesh mints (a
|
|
// module's, a module's process's, a machine's provisioner client's), the grants part writes one key of its state
|
|
// `accounts`, keyed by the bus user, holding the account's fields that are not secret: what the controller's credential
|
|
// carries today beside the password. The vault watches that state, mints the user it holds no value for, and keeps the
|
|
// value as the module's own secret on that node, built by HeldCredential, which gives byte for byte the controller's
|
|
// shape, so a runtime reads it unchanged. The state is read by the vault alone (NamedReaders), as `bus-accounts` is read
|
|
// by the grants part alone.
|
|
//
|
|
// The node accounts, the controller's own, an enrolment user and a person are never wanted here: the vault mints none
|
|
// of them (ADR 0561 §4, §5).
|
|
|
|
// The layout of the state is the grants part's published package (grantsstate; ADR 0634 §1): the vault imports it from there, and
|
|
// this composer names it.
|
|
const (
|
|
AccountsState = grantsstate.AccountsState
|
|
GrantsAccounts = grantsstate.GrantsAccounts
|
|
LedgersSecret = grantsstate.LedgersSecret
|
|
)
|
|
|
|
type (
|
|
ClaimedSeat = grantsstate.ClaimedSeat
|
|
WantedAccount = grantsstate.WantedAccount
|
|
)
|
|
|
|
var (
|
|
ReadWantedAccount = grantsstate.ReadWantedAccount
|
|
HeldCredential = grantsstate.HeldCredential
|
|
)
|
|
|
|
// AccountsBucket is the bucket the state lives in.
|
|
var AccountsBucket = BucketName(GrantsModule, AccountsState)
|
|
|
|
// AccountsSubject is the subject of one wanted account's key: `$KV.mesh-grants_accounts.<user>`.
|
|
func AccountsSubject(user string) string { return "$KV." + AccountsBucket + "." + user }
|
|
|
|
// AccountIssuedEvent is what the vault says when it minted an account: AccountIssued, never a value or a hash.
|
|
const AccountIssuedEvent = "account-issued"
|
|
|
|
// AccountIssuedSubject is where it says it, as the runtime addresses mesh-vault's events.
|
|
const AccountIssuedSubject = "mesh.mod." + VaultSeat + ".event." + AccountIssuedEvent
|
|
|
|
// AccountIssued is the vault's account-issued: which account it minted, and its generation. Never a value or a hash.
|
|
type AccountIssued struct {
|
|
User string `json:"user"`
|
|
Kind Kind `json:"kind"`
|
|
Node string `json:"node"`
|
|
Module string `json:"module"`
|
|
Process string `json:"process,omitempty"`
|
|
Generation int `json:"generation"`
|
|
At time.Time `json:"at"`
|
|
}
|