Policies grant subjects an issuer certifies (keyless step 4a) 3a6effc74835

    /// Who else may sign, by what an issuer certified (§14.7): a short-lived

    /// key whose certificate is the issuer's, for a subject the pattern

    /// matches, counts as one signer within the scope given.

    pub subjects: Vec<SubjectGrant>,

/// A rule's grant to the holders of certificates an issuer gives (§14.7):

/// `repo:andy/demo:bookmark:main`, `agent:claude@andy`, with `*` as in

/// reference patterns.

pub struct SubjectGrant {

    pub pattern: String,

    pub issuer: KeyId,

    pub scope: identity::Scope,

}

impl SubjectGrant {

    fn to_value(&self) -> Value {

        Value::map([

            (0, Value::Text(self.pattern.clone())),

            (1, Value::Bytes(self.issuer.0.to_vec())),

            (

                2,

                Value::Array(

                    self.scope

                        .names()

                        .into_iter()

                        .map(|n| Value::Text(n.to_string()))

                        .collect(),

                ),

            ),

        ])

    }

    fn from_value(v: &Value) -> Result<SubjectGrant, ObjectError> {

        let m = map(v, "subject")?;

        let mut scope = identity::Scope::NONE;

        for n in array(field(m, 2, "subject scope")?, "subject scope")? {

            let n = text(n, "subject scope")?;

            scope = scope

                | identity::Scope::named(n)

                    .ok_or_else(|| ObjectError::Schema(format!("subject: unknown scope {n:?}")))?;

        }

        Ok(SubjectGrant {

            pattern: text(field(m, 0, "subject pattern")?, "subject pattern")?.to_owned(),

            issuer: oref(field(m, 1, "subject issuer")?, "subject issuer")?,

            scope,

        })

    }

}

#[derive(Clone, Debug, PartialEq, Eq)]

                            let mut v = Value::map([

                            ]);

                            // Only when there are any, so a policy without

                            // them encodes, and hashes, as before.

                            if !r.subjects.is_empty() {

                                if let Value::Map(m) = &mut v {

                                    m.insert(

                                        5,

                                        Value::Array(

                                            r.subjects.iter().map(SubjectGrant::to_value).collect(),

                                        ),

                                    );

                                }

                            }

                            v

                subjects: match rm.get(&5) {

                    None => vec![],

                    Some(v) => array(v, "subjects")?

                        .iter()

                        .map(SubjectGrant::from_value)

                        .collect::<Result<_, _>>()?,

                },

            if r.threshold == 0 || r.threshold as usize > r.keys.len() + r.subjects.len() {

                    "rule {:?}: threshold must be between 1 and the number of keys and subjects",

    /// Whether the rule for `reference` lets a certificate from `issuer`

    /// for `subject` sign within `scope` (§14.7). The certificate itself,

    /// and the time it is checked at, are the caller's to verify.

    pub fn subject_grant(

        &self,

        reference: &str,

        issuer: &KeyId,

        subject: &str,

        scope: identity::Scope,

    ) -> bool {

        !self.is_revoked(issuer)

            && self.rule_for(reference).is_some_and(|r| {

                r.subjects.iter().any(|g| {

                    g.issuer == *issuer && g.scope.has(scope) && glob_matches(&g.pattern, subject)

                })

            })

    }

                subjects: vec![],

    }

    /// Subjects an issuer certifies (oxygenhub#241): kept through

    /// encoding, absent from a policy without them, and granted only for

    /// their issuer, pattern and scope, and not when the issuer is revoked.

    #[test]

    fn a_rule_grants_certified_subjects() {

        use crate::identity::Scope;

        let root = sk(1).identity("Root", "r@x", 0);

        let hub = sk(3).identity("Hub", "h@x", 0);

        let mut p = Policy::single_root([9; 16], root.clone(), 10);

        let plain = p.encode();

        p.rules[0].subjects.push(SubjectGrant {

            pattern: "repo:andy/demo:bookmark:main".into(),

            issuer: hub.hash(),

            scope: Scope::REFS | Scope::CHANGES,

        });

        p.rules[0].subjects.push(SubjectGrant {

            pattern: "agent:*@andy".into(),

            issuer: hub.hash(),

            scope: Scope::CHANGES,

        });

        let back = Policy::decode(&p.encode()).unwrap();

        assert_eq!(back, p);

        let mut again = back.clone();

        again.rules[0].subjects.clear();

        assert_eq!(

            again.encode(),

            plain,

            "no subjects, the same bytes as before"

        );

        let main = "repo:andy/demo:bookmark:main";

        assert!(p.subject_grant("main", &hub.hash(), main, Scope::REFS));

        assert!(p.subject_grant("main", &hub.hash(), "agent:claude@andy", Scope::CHANGES));

        assert!(

            !p.subject_grant("main", &hub.hash(), "agent:claude@andy", Scope::REFS),

            "not its scope"

        );

        assert!(

            !p.subject_grant(

                "main",

                &hub.hash(),

                "repo:andy/demo:bookmark:dev",

                Scope::REFS

            ),

            "not its pattern"

        );

        assert!(

            !p.subject_grant("main", &root.hash(), main, Scope::REFS),

            "not its issuer"

        );

        p.revoked.push(hub.hash());

        assert!(

            !p.subject_grant("main", &hub.hash(), main, Scope::REFS),

            "a revoked issuer grants nothing"

        );

        // A rule of subjects alone is a rule.

        let mut only = Policy::single_root([9; 16], root, 10);

        only.rules[0].keys.clear();

        only.rules[0].subjects.push(SubjectGrant {

            pattern: "*".into(),

            issuer: hub.hash(),

            scope: Scope::REFS,

        });

        assert!(Policy::decode(&only.encode()).is_ok());

        only.rules[0].subjects.clear();

        assert!(Policy::decode(&only.encode()).is_err(), "nobody to sign");

                subjects: vec![],

                subjects: vec![],

    /// Let holders of certificates `issuer` gives, for subjects matching

    /// `subject`, sign within `scope` on `pattern` (default every

    /// bookmark; §14.7). The issuer's identity is embedded so verifiers need

    /// no fetch.

    pub fn policy_grant_subject(

        &self,

        subject: &str,

        issuer: Identity,

        scope: crate::identity::Scope,

        pattern: Option<&str>,

    ) -> Result<PolicyUpdate> {

        if subject.trim().is_empty() {

            return fail("a subject pattern is needed, such as repo:OWNER/NAME:bookmark:main");

        }

        let mut p = self.next_policy()?;

        let key = issuer.hash();

        let pattern = pattern.unwrap_or("*");

        let grant = crate::policy::SubjectGrant {

            pattern: subject.into(),

            issuer: key,

            scope,

        };

        match p.rules.iter_mut().find(|r| r.pattern == pattern) {

            Some(rule) => {

                rule.subjects

                    .retain(|g| !(g.pattern == grant.pattern && g.issuer == grant.issuer));

                rule.subjects.push(grant);

            }

            None => p.rules.push(Rule {

                pattern: pattern.into(),

                keys: vec![],

                threshold: 1,

                require: Require::Any,

                allow_conflicts: true,

                subjects: vec![grant],

            }),

        }

        if p.identity(&key).is_none() {

            p.identities.push(issuer);

        }

        self.sign_policy(p, &format!("oxy policy grant-subject {subject}"))

    }

                     require: "signed" | "sealed" | "any" /* default */, allow_conflicts: bool,

                     subjects [5]: [ { pattern: glob over subjects, issuer: KeyId, scope: [text] } ] /* only when any */ } ]

- A rule may also grant **subjects an issuer certifies** (§14.7): `oxy policy grant-subject SUBJECT --issuer IDENTITY --scope SCOPES` adds `{pattern, issuer, scope}` and embeds the issuer's identity. A signer is then authorized when it is a short-lived key whose certificate verifies with that issuer, names a subject the pattern matches, gives the scope needed (`changes` for changes, `refs` for reference attestations and tags) and covers a time the signer did not choose; it counts as one signer toward the threshold. A rule with subjects only has no keys, and its threshold counts keys and subjects together. A policy without subjects encodes as before (field 5 is left out), so its hash is unchanged.

                            (

                                "subjects",

                                json::arr(rule.subjects.iter().map(|g| {

                                    json::obj([

                                        ("subject", json::s(&g.pattern)),

                                        ("issuer", ident(&g.issuer)),

                                        ("scope", json::s(&g.scope.to_string())),

                                    ])

                                })),

                            ),

        for g in &rule.subjects {

            println!(

                "      {}  {} {}",

                ui::author(&g.pattern),

                ui::dim(format!(

                    "certified by {} ({}),",

                    name(&g.issuer),

                    g.issuer.short(12)

                )),

                ui::dim(format!("scope {}", g.scope))

            );

        }

    );

    report_update(&u, out)?;

    Ok(0)

}

pub fn policy_grant_subject(

    subject: &str,

    issuer_file: &Path,

    scope: &str,

    pattern: Option<&str>,

    out: Option<PathBuf>,

) -> Result<i32> {

    let repo = open()?;

    let issuer = Identity::decode(&std::fs::read(issuer_file)?)

        .map_err(|e| anyhow::anyhow!("{}: not an identity file: {e}", issuer_file.display()))?;

    let scope = oxy_core::identity::Scope::parse(scope).map_err(|e| anyhow::anyhow!(e))?;

    let key = issuer.hash();

    let u = repo.policy_grant_subject(subject, issuer.clone(), scope, pattern)?;

    println!(

        "{} {} certified by {} ({}) on {}, scope {}",

        ui::done("Granted"),

        ui::author(subject),

        issuer.name,

        key.short(12),

        ui::bookmark(pattern.unwrap_or("*")),

        scope

    /// Allow holders of an issuer's certificates for SUBJECT to sign (keyless)

    GrantSubject {

        /// Who: `repo:OWNER/NAME:bookmark:main`, `agent:NAME@ACCOUNT`; `*` matches any run of characters

        subject: String,

        /// The issuer's identity file, e.g. a hub's /.well-known/oxyhub-key

        #[arg(long)]

        issuer: PathBuf,

        /// What its keys may sign: changes, refs, seal

        #[arg(long, default_value = "changes,refs")]

        scope: String,

        /// Reference pattern the grant applies to (default: every bookmark)

        #[arg(long)]

        pattern: Option<String>,

        /// Where to write the proposal when more root signatures are needed

        #[arg(long)]

        out: Option<PathBuf>,

    },

            PolicyCmd::GrantSubject {

                subject,

                issuer,

                scope,

                pattern,

                out,

            } => identity::policy_grant_subject(&subject, &issuer, &scope, pattern.as_deref(), out),

    // Keyless (oxygenhub#241): a hub's certified subject may sign too.

    let hub =

        oxy_core::identity::SecretKey::generate().identity("oxygenhub.io", "[email protected]", 1);

    let hub_file = r.join("hub.identity");

    std::fs::write(&hub_file, hub.encode()).unwrap();

    let grant = [

        "policy",

        "grant-subject",

        "repo:ada/demo:bookmark:main",

        "--issuer",

        hub_file.to_str().unwrap(),

        "--scope",

        "refs",

    ];

    assert_eq!(oxy(r, &home, &grant).0, 0);

    let policy = json(r, &home, &["policy", "show", "--json"]);

    let subjects = &policy["rules"][0]["subjects"][0];

    assert_eq!(

        (

            subjects["subject"].as_str(),

            subjects["issuer"]["name"].as_str(),

            subjects["scope"].as_str()

        ),

        (

            Some("repo:ada/demo:bookmark:main"),

            Some("oxygenhub.io"),

            Some("refs")

        )

    );

    std::fs::remove_file(&hub_file).unwrap();