author.for: a keyless home follows its owner's newest identity (refs #82) 2452b4407ab7

- **A keyless agent follows its owner's newest identity (#82).** Every delegation rotates its owner's identity, so the `author.key` an agent's home was given goes stale, and its changes named an identity two rotations old (verifying only because a grant from before a rotation still counts). With `author.for = ACCOUNT` in the home, the hub sends the account's newest linked identity with each certificate, with its chain back to the grant's key; oxy keeps it in the home (`keys/author.for`), stores the chain beside the change so the grant checks, and authors as it from then on. A repository's own `author.key` pin still wins.

    /// `author.for` (oxygen#82): in a keyless agent's home, the account it

    /// acts for; the home then authors as that person's newest identity,

    /// which the hub names with each certificate, rather than a pinned

    /// `author.key` that goes stale with every rotation.

    pub author_for: Option<String>,

            author_for: None,

            "author.for" => self.author_for = (!value.is_empty()).then(|| value.to_string()),

        // author.for (oxygen#82): the identity the hub last named as the

        // person's newest, kept in the home; a repository's own

        // author.key pin still wins.

        if c.author_for.is_some() && !c.repo_layer.contains_key("author.key") {

            if let Some(k) = user_path

                .and_then(Path::parent)

                .and_then(|home| fs::read_to_string(home.join("keys").join(AUTHOR_FOR_FILE)).ok())

                .and_then(|s| KeyId::from_hex(s.trim()))

            {

                c.author_key = Some(k);

            }

        }

/// In a home's `keys/`: the key of the identity `author.for` follows,

/// as the hub last named it (oxygen#82).

pub const AUTHOR_FOR_FILE: &str = "author.for";

        if let (Some(owner), Some(g)) = (&self.config.author_for, &cert.cert.grant) {

            self.follow_author(owner, &cert.cert.subject, g.grant.grantor, &reply, &home)?;

        }

    }

}

impl Repo {

    /// `author.for` (oxygen#82): keep the identity the hub names as the

    /// grant's owner's newest (`author_chain`, newest first, each the

    /// successor of the next, the last the grant's key's), store the chain

    /// here so the grant checks against it, and note its key in the home,

    /// so this and the home's next commands author as it.

    fn follow_author(

        &self,

        owner: &str,

        subject: &str,

        grantor: KeyId,

        reply: &serde_json::Value,

        home: &Path,

    ) -> Result<()> {

        let granted_by = subject.rsplit_once('@').map(|(_, o)| o).unwrap_or(subject);

        if !granted_by.eq_ignore_ascii_case(owner) {

            return fail(format!(

                "author.for is {owner}, but this home's grant is from {granted_by}: set author.for to the account that granted it"

            ));

        }

        let chain: Vec<Identity> = reply["author_chain"]

            .as_array()

            .map(|a| {

                a.iter()

                    .filter_map(|v| v.as_str().and_then(crate::dsse::base64_decode))

                    .filter_map(|b| Identity::decode(&b).ok())

                    .collect()

            })

            .unwrap_or_default();

        let linked = chain.windows(2).all(|w| w[0].previous == Some(w[1].hash()))

            && chain.last().is_none_or(|l| l.previous == Some(grantor));

        if !linked {

            return fail(

                "the hub's author chain does not lead back to the grant's key".to_string(),

            );

        }

        let keys = home.join("keys");

        std::fs::create_dir_all(&keys)?;

        for id in &chain {

            self.store.put_identity(id)?;

            let path = keys.join(format!("{}.identity", id.hash().to_hex()));

            if !path.exists() {

                crate::durable::write_atomic(&path, &id.encode())?;

            }

        }

        let newest = chain.first().map(Identity::hash).unwrap_or(grantor);

        crate::durable::write_atomic(

            &keys.join(super::config::AUTHOR_FOR_FILE),

            format!("{}\n", newest.to_hex()).as_bytes(),

        )?;

        Ok(())

/// oxygen#82: a home with `author.for` authors as the identity its hub

/// last named (kept in `keys/author.for`), not its stale `author.key`; a

/// repository's own `author.key` pin still wins, and without `author.for`

/// the note is ignored.

#[test]

fn author_for_follows_the_key_the_hub_named() {

    let dir = tempfile::tempdir().unwrap();

    let home = dir.path().join("home");

    fs::create_dir_all(home.join("keys")).unwrap();

    let user = home.join("config.toml");

    let repo_cfg = dir.path().join("config");

    let (old, new, pin) = (

        KeyId::from_hex(&"a".repeat(64)).unwrap(),

        KeyId::from_hex(&"b".repeat(64)).unwrap(),

        KeyId::from_hex(&"c".repeat(64)).unwrap(),

    );

    fs::write(&user, format!("author.key = \"{}\"\n", old.to_hex())).unwrap();

    fs::write(

        home.join("keys").join(super::config::AUTHOR_FOR_FILE),

        format!("{}\n", new.to_hex()),

    )

    .unwrap();

    fs::write(&repo_cfg, "").unwrap();

    assert_eq!(

        Config::load(Some(&user), &repo_cfg).unwrap().author_key,

        Some(old),

        "no author.for: the note is ignored"

    );

    fs::write(

        &user,

        format!(

            "author.key = \"{}\"\nauthor.for = \"andymccall\"\n",

            old.to_hex()

        ),

    )

    .unwrap();

    assert_eq!(

        Config::load(Some(&user), &repo_cfg).unwrap().author_key,

        Some(new)

    );

    fs::write(&repo_cfg, format!("author.key = \"{}\"\n", pin.to_hex())).unwrap();

    assert_eq!(

        Config::load(Some(&user), &repo_cfg).unwrap().author_key,

        Some(pin),

        "a repository's pin wins"

    );

}

oxy config --user author.for    <YOUR ACCOUNT>   # follow your newest identity

agent revoke ID` stops one at once; there is no key to rotate. When you

rotate your own key (every delegation does), an agent with `author.for`

follows: the hub names your newest identity with each certificate, and

the agent authors as it from then on, rather than as the key you gave it.

A repository whose own config pins `author.key` keeps that pin.

| `author.for` | in a keyless agent's home, the account it acts for: it authors as that person's newest identity, as the hub names it (a repository's own `author.key` pin still wins) |

| `~/.config/oxy/config.toml` | User settings, the same keys as `.oxy/config`: `author.name`, `author.email`, `author.key`, `author.signer` (the key that signs and seals in place of `author.key`, which must list it as a delegate: an agent's own key; or `keyless`, for fresh keys the hub certifies under an agent's grant, §14.7, from the grant token `oxy auth grant` keeps; also `$OXY_SIGNER`), `keyless.hub` (the hub that certifies them; default the default remote's), `author.for` (in a keyless home, the account it acts for: it authors as that account's newest identity, which the hub sends with each certificate with its chain back to the grant's key and the home keeps in `keys/author.for`; a repository's own `author.key` wins), `core.sign`, and `remote.<name>.token`; also `auth.helper`. Overridden by `$OXY_HOME/config.toml` when `$OXY_HOME` is set. |