jschoubben
e703e9b0e2
Since 13:25 the vault, the assigner, the watchman, the grants part and the artifact store's tools were refused mesh-controller.lease, and the vault mesh-grants.accounts, though the composer names them those states' readers (ADR 0547 clause 9): the controller splits reads with its own copy of the reader-less ReadsAnnounced, which knows no named readers, and Users only moved reads from granted to refused, never back. Quick fix: the controller calls ReadsAnnouncedBy with the module. Thorough fix, chosen because the kind was met on four owners and the judgement had two copies: Users judges every read again for its reader against the announcements in Records (withAnnouncedReads), whatever split the caller made, and the reader-less ReadsAnnounced is removed so no caller can judge without the reader. A rule over manifests was not added: ADR 0495 clauses 1 and 5 keep readability out of the manifest and replaced the merge gate's reads check by each module's announcement test. gitea.bound and disk-load.readings stay refused: their owners announce them not readable, which their own code fixes.
104 lines
4.5 KiB
Go
104 lines
4.5 KiB
Go
package buscompose
|
|
|
|
import (
|
|
"slices"
|
|
"sort"
|
|
"strings"
|
|
|
|
"git.novox.be/novox/mesh-sdk/go/announce"
|
|
)
|
|
|
|
// Who may read a module's state is what the module announced (novox/hq ADR 0495 clauses 2 and 3, ADR 0513 §3; issue
|
|
// 1790). A module says on the bus which states it keeps and which others may read (announce.Subject); the controller
|
|
// keeps the last word of each (announce.KeptBucket) and grants a reader's `reads: <owner>.<name>` only when the owner
|
|
// announced that state readable. An owner that has announced nothing yet is read as before, from the reader's `reads`
|
|
// (the transition, until every module announces), and is named as not yet announced.
|
|
|
|
// StatesAnnouncedBucket is the controller's bucket of the last announcement of each module (announce.KeptBucket).
|
|
const StatesAnnouncedBucket = announce.KeptBucket
|
|
|
|
// controllerReadable are the controller's states others may read: the record mirrors (the packages each node declares
|
|
// among them, which the pacman module reads, ADR 0507 §5), the chain's buckets, and the grants issued and the
|
|
// compositions' digests, which the assigner reads (ADR 0528 clause 2, ADR 0539 clause 6).
|
|
var controllerReadable = []string{MirrorAssignments, MirrorDeclaredConfig, MirrorPredefined, ChainBuilds, ChainRollouts,
|
|
MirrorDeclaredPackages, ControllerGrants, ControllerComposed}
|
|
|
|
// ControllerAnnouncement is what the controller announces it keeps (ADR 0495 clause 2): every bucket of its own by its local
|
|
// name, the ones others may read marked readable. It announces itself, as any module does from its code.
|
|
func ControllerAnnouncement(node string) announce.States {
|
|
s := announce.States{Module: ControllerSeat, Node: node}
|
|
readable := map[string]bool{}
|
|
for _, n := range controllerReadable {
|
|
readable[n] = true
|
|
}
|
|
for _, bucket := range ControllerBuckets() {
|
|
local, mine := strings.CutPrefix(bucket, ControllerSeat+"_")
|
|
if !mine {
|
|
continue
|
|
}
|
|
s.States = append(s.States, announce.State{Name: local, Readable: readable[local]})
|
|
}
|
|
sort.Slice(s.States, func(i, j int) bool { return s.States[i].Name < s.States[j].Name })
|
|
return s
|
|
}
|
|
|
|
// ReadsAnnouncedBy splits one reader module's `reads` (`<owner>.<name>`) by what each owner announced: granted when the
|
|
// owner announced the state readable (by this reader, where it named its readers: announce.State.Readers), when the
|
|
// composer names the reader among the state's readers (NamedReaders, ADR 0547 clause 9), or when the owner announced
|
|
// nothing yet (the transition); refused otherwise, and a read named for other modules is refused. There is no judgement
|
|
// without the reader (issue 774): one made without it refused every named reader, and Users judges again for the
|
|
// reader whatever split it is given (withAnnouncedReads). An empty reader is judged by the readable mark alone.
|
|
func ReadsAnnouncedBy(reader string, reads []string, announced map[string]announce.States) (granted, refused []string) {
|
|
for _, r := range reads {
|
|
owner, name, ok := strings.Cut(r, ".")
|
|
s, said := announced[owner]
|
|
switch {
|
|
case reader != "" && !ReaderMay(reader, r):
|
|
refused = append(refused, r)
|
|
case reader != "" && namedReader(reader, r):
|
|
// A state the composer names its readers for is theirs whatever its owner announced (ADR 0561 §3: the
|
|
// controller's lease, which its announcement marks readable by nobody).
|
|
granted = append(granted, r)
|
|
case reader != "" && ok && said && s.Keeps(name):
|
|
if s.ReadableBy(name, reader) {
|
|
granted = append(granted, r)
|
|
} else {
|
|
refused = append(refused, r)
|
|
}
|
|
case !ok || !said || s.Readable(name):
|
|
granted = append(granted, r)
|
|
default:
|
|
refused = append(refused, r)
|
|
}
|
|
}
|
|
return granted, refused
|
|
}
|
|
|
|
// NotAnnounced are the owners some module reads the state of and that have announced nothing yet, sorted: read from the
|
|
// readers' `reads` as before, until they announce.
|
|
func NotAnnounced(r Records) []string {
|
|
seen := map[string]bool{}
|
|
var out []string
|
|
for _, ds := range r.Assigned {
|
|
for _, d := range ds {
|
|
for _, read := range append(append([]string(nil), d.Reads...), d.ReadsRefused...) {
|
|
owner, _, ok := strings.Cut(read, ".")
|
|
if !ok || seen[owner] {
|
|
continue
|
|
}
|
|
if _, said := r.Announced[owner]; !said {
|
|
seen[owner] = true
|
|
out = append(out, owner)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
sort.Strings(out)
|
|
return out
|
|
}
|
|
|
|
// namedReader says the composer names module among the readers of read (NamedReaders).
|
|
func namedReader(module, read string) bool {
|
|
return slices.Contains(NamedReaders[strings.TrimSpace(read)], module)
|
|
}
|