jschoubben
ef41fa2e27
mesh/delivery merged: source.main moved to novox/mesh-host@6e461bd24aa5
mesh/check being carried to ef41fa2e2796 on 6e461bd24aa5 | from 7c483da93a03
compose.CompositionsHolding returns the modules the declaration leaves out for a claim that cannot be held or a refused credential; frombus composeEach holds each with those words, so the node-engine keeps what it handed of the module (no stop of a running module), the candidate answer and the check's sandbox name it refused, and the rest composes. CredentialsNeeded asks nothing for a held module. Resolve and checkClaims move to a test helper (production uses ResolveHolding and holdClaims); a pass refused anyway names a held module's reason among the others. Quick fix: Declared.Held read in the composer only. Thorough, chosen: the same held words reach every reader of the composition (selfcompose, ComposeSent, the candidate answer) through composeEach's one hold path. Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
70 lines
2.7 KiB
Go
70 lines
2.7 KiB
Go
package compose
|
|
|
|
import (
|
|
"fmt"
|
|
"sort"
|
|
)
|
|
|
|
// CredentialKey names one pair credential by the ends it joins: the provision, the consumer's node and module, the
|
|
// provider's node, and the local name where a module keeps several (Credential's and Issued's key).
|
|
type CredentialKey struct {
|
|
Provision string `json:"provision"`
|
|
Consumer string `json:"consumer"`
|
|
ConsumerModule string `json:"consumer_module"`
|
|
Provider string `json:"provider"`
|
|
Local string `json:"local,omitempty"`
|
|
}
|
|
|
|
// CredentialsNeeded is every pair credential node's composition reads (novox/hq ADR 0547 §2, ADR 0550 §5, issue 1126):
|
|
// as a consumer, each need of its resolution a provider's credential answers (a need answered by a record is a licence's,
|
|
// not a pair's); as a provider, each credential it must carry a grant for (rowsFor). A node that composes its own asks the
|
|
// vault for exactly these, sealed to its key, and composes with them; one it does not get is stood in for, which the
|
|
// node's own apply refuses (CompositionsApplied). A need whose provider offers it with no credential (form none) is
|
|
// in neither list: the vault mints nothing for it (issue 1126).
|
|
func CredentialsNeeded(in Input, node string) (asConsumer, asProvider []CredentialKey, err error) {
|
|
c := newComposer(in)
|
|
resolved, held, err := c.resolutionHolding(node)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
for _, n := range resolved.Needs {
|
|
if _, isHeld := held[n.For]; isHeld || n.ByRecord || n.From == "" || credentialless(n) {
|
|
continue
|
|
}
|
|
asConsumer = append(asConsumer, CredentialKey{Provision: n.Name, Consumer: node, ConsumerModule: n.For,
|
|
Provider: n.From, Local: n.Local})
|
|
}
|
|
rows, err := c.rowsFor(node)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("compose: the credentials %s provides: %w", node, err)
|
|
}
|
|
for _, r := range rows {
|
|
// A grant whose offer presents no credential (form none) has none to ask for (issue 1126).
|
|
if consumer, err := c.planFor(r.Consumer); err == nil && credentiallessRow(consumer.Plan, r, node) {
|
|
continue
|
|
}
|
|
asProvider = append(asProvider, CredentialKey{Provision: r.Provision, Consumer: r.Consumer,
|
|
ConsumerModule: r.ConsumerModule, Provider: node, Local: r.Local})
|
|
}
|
|
sortKeys(asConsumer)
|
|
sortKeys(asProvider)
|
|
return asConsumer, asProvider, nil
|
|
}
|
|
|
|
func sortKeys(ks []CredentialKey) {
|
|
sort.Slice(ks, func(i, j int) bool {
|
|
a, b := ks[i], ks[j]
|
|
switch {
|
|
case a.Provision != b.Provision:
|
|
return a.Provision < b.Provision
|
|
case a.Provider != b.Provider:
|
|
return a.Provider < b.Provider
|
|
case a.Consumer != b.Consumer:
|
|
return a.Consumer < b.Consumer
|
|
case a.ConsumerModule != b.ConsumerModule:
|
|
return a.ConsumerModule < b.ConsumerModule
|
|
}
|
|
return a.Local < b.Local
|
|
})
|
|
}
|