The node's composer asks the vault for the pair credentials its composition reads, as consumer and provider, sealed to its key (issue 1126, ADR 0550 §5)

internal/selfcompose/selfcompose_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/compose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"github.com/novox/mesh-host/internal/agent"
@@ -89,7 +90,7 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	env := b.env()
 	// The vault's own: keeper's password sealed to n1's key, sealed again (other bytes) at every ask.
 	var asks, generation int
-	env.Own = func(context.Context) (json.RawMessage, error) {
+	env.Own = func(context.Context, map[string]any) (json.RawMessage, error) {
 		b.mu.Lock()
 		defer b.mu.Unlock()
 		asks++
@@ -208,4 +209,29 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	if u := next(t, out); u.Key != keeperKey {
 		t.Fatalf("a new generation handed %s, want keeper again", u.Key)
 	}
+
+	// The pair credentials asked (ADR 0550 §5): the keys go to the vault's own with their role, a consumer's comes back as
+	// a credential held, a provider's as the grant's copy, each sealed to n1's key, the value first had kept.
+	var sent map[string]any
+	pairEnv := b.env()
+	pairEnv.Own = func(_ context.Context, args map[string]any) (json.RawMessage, error) {
+		sent = args
+		return json.RawMessage(`{"node":"n1","key":"sk","credentials":[` +
+			`{"role":"consumer","provision":"pg","consumer":"n1","consumer_module":"web","provider":"n2","name":"pair/n2/pg/n1/web","generation":1,"sealed":{"c":1}},` +
+			`{"role":"provider","provision":"s3","consumer":"n3","consumer_module":"files","provider":"n1","name":"provision/n1/s3","generation":2,"sealed":{"p":1}}]}`), nil
+	}
+	pc := New(pairEnv)
+	consumer := []compose.CredentialKey{{Provision: "pg", Consumer: "n1", ConsumerModule: "web", Provider: "n2"}}
+	provider := []compose.CredentialKey{{Provision: "s3", Consumer: "n3", ConsumerModule: "files", Provider: "n1"}}
+	creds, issued, err := reader{c: pc}.Credentials(ctx, "n1", consumer, provider)
+	if err != nil || len(creds) != 1 || len(issued) != 1 {
+		t.Fatalf("credentials %+v issued %+v, %v", creds, issued, err)
+	}
+	if creds[0].State != compose.CredentialHeld || creds[0].Provider != "n2" || creds[0].Sealed != `{"c":1}` ||
+		issued[0].Consumer != "n3" || issued[0].ForProvider != `{"p":1}` {
+		t.Errorf("credentials %+v issued %+v", creds, issued)
+	}
+	if asked, _ := json.Marshal(sent["credentials"]); !strings.Contains(string(asked), `"role":"consumer"`) || !strings.Contains(string(asked), `"role":"provider"`) {
+		t.Errorf("the vault was asked %s", asked)
+	}
 }