A rotation follows you everywhere; config --unset; delegate add takes several files 614f55e14eee

- **A rotation follows you everywhere (#69).** `delegate add`, `delegate remove`, `rotate` and `renew` record the successor key in the user config when it named the old key, and in the repository's own file when that pinned it, so every checkout moves together. `oxy identity show` warns when a repository pins a key other than the user config's; `oxy config --unset KEY` drops a key; `oxy identity delegate add` takes several identity files in one rotation and reminds you that agents configured with your `author.key` need the new one.

    /// Record a successor key everywhere the old one was named: the

    /// repository layer when it pins the old key, and the user file when

    /// it names the old key, so every checkout that followed the old key

    /// follows the new one (oxygen#69). A key named nowhere falls back to

    /// the scope that resolved it.

    fn record_successor(&mut self, id: &Identity, old: &KeyId, new_key: &KeyId) -> Result<()> {

        let names = |v: Option<&String>| v.and_then(|k| KeyId::from_hex(k)) == Some(*old);

        let repo_pins = names(self.config.repo_layer().get("author.key"));

        let user_entries = super::config::read_config_file(&self.user_config).unwrap_or_default();

        let user_names = names(user_entries.get("author.key"));

        if !repo_pins && !user_names {

            return self.set_author(id, new_key, self.author_scope());

        }

        if user_names {

            self.set_author(id, new_key, IdentityScope::User)?;

        }

        if repo_pins {

            self.set_author(id, new_key, IdentityScope::Repo)?;

        }

        Ok(())

    }

        self.record_successor(&new, &old, &new_key)?;

        scope: Scope,

        expires: Option<u64>,

    ) -> Result<Rotation> {

        self.delegate_add_many(vec![delegate], scope, expires)

    }

    /// As [`Repo::delegate_add`], for several delegates in one rotation.

    pub fn delegate_add_many(

        &mut self,

        new_delegates: Vec<Identity>,

        if new_delegates.is_empty() {

            return fail("name at least one identity file");

        let mut delegates = cur.delegates.clone();

        let mut added = Vec::new();

        for delegate in new_delegates {

            let dk = self.store.put_identity(&delegate)?;

            added.push(dk);

            if dk == old {

                return fail("an identity cannot delegate to itself");

            }

            if cur.delegate(&dk).is_some()

                || delegates

                    .iter()

                    .skip(cur.delegates.len())

                    .any(|d| d.key == dk)

            {

                return fail(format!(

                    "{} is already a delegate; remove it first to change its scope or expiry",

                    dk.short(12)

                ));

            }

            delegates.push(Delegate {

                key: dk,

                scope,

                expires,

            });

            &format!(

                "oxy identity delegate add {} --scope {scope}",

                added

                    .iter()

                    .map(|k| k.short(12))

                    .collect::<Vec<_>>()

                    .join(" ")

            ),

#[test]

fn a_rotation_is_recorded_wherever_the_old_key_was_named() {

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let home = root.join("home");

    // Ada's identity lives in the user file; repository `a` pins the same

    // key in its own file, repository `b` names none.

    let mut a = Repo::init(&root.join("a")).unwrap().with_home(&home);

    let (key, _) = a

        .create_identity("Ada", "[email protected]", IdentityScope::User)

        .unwrap();

    a.config.set("author.key", &key.to_hex()).unwrap();

    a.save_config().unwrap();

    let agent = SecretKey::generate().identity("Agent", "[email protected]", 1);

    let r = a

        .delegate_add(agent.clone(), crate::identity::Scope::CHANGES, None)

        .unwrap();

    assert_eq!(

        read_config_file(&home.join("config.toml")).unwrap()["author.key"],

        r.new.to_hex(),

        "the user file follows"

    );

    assert_eq!(

        read_config_file(&root.join("a/.oxy/config")).unwrap()["author.key"],

        r.new.to_hex(),

        "the pinning repository follows"

    );

    let b = Repo::init(&root.join("b")).unwrap().with_home(&home);

    assert_eq!(

        b.config.author_key,

        Some(r.new),

        "a checkout without a pin follows the user file"

    );

    // A repository-scoped identity leaves the user file alone.

    let other_home = root.join("home2");

    let mut c = Repo::init(&root.join("c")).unwrap().with_home(&other_home);

    let (ck, _) = c

        .create_identity("Cy", "[email protected]", IdentityScope::Repo)

        .unwrap();

    assert!(!other_home.join("config.toml").exists());

    let r2 = c.rotate_identity().unwrap();

    assert_ne!(r2.new, ck);

    assert_eq!(

        read_config_file(&root.join("c/.oxy/config")).unwrap()["author.key"],

        r2.new.to_hex()

    );

    assert!(

        !other_home.join("config.toml").exists(),

        "a repository-scoped identity stays repository-scoped"

    );

    // Several delegates in one rotation; a repeat is refused.

    let (d1, d2) = (

        SecretKey::generate().identity("D1", "d1@x", 1),

        SecretKey::generate().identity("D2", "d2@x", 1),

    );

    let r3 = c

        .delegate_add_many(vec![d1.clone(), d2], crate::identity::Scope::CHANGES, None)

        .unwrap();

    assert_eq!(r3.identity.delegates.len(), 2);

    assert!(c

        .delegate_add(d1, crate::identity::Scope::CHANGES, None)

        .is_err());

}

(several files at once are one rotation). This rotates your identity:

the new key is written to your user config, and to this repository's

file too if it pinned the old one, so other checkouts follow; put the

new KeyId in each agent's `author.key`, and re-link it on your hub.

`oxy identity show` warns if a repository still pins an older key

(`oxy config --unset author.key` there). Every commit the agent makes

    // A repository that pins one key while the user file names another is

    // how checkouts drift apart after a rotation (oxygen#69).

    if let Some(pinned) = repo

        .config

        .repo_layer()

        .get("author.key")

        .and_then(|k| oxy_core::hash::KeyId::from_hex(k))

    {

        let user_key = repo::read_config_file(&repo::default_user_config())

            .ok()

            .and_then(|m| {

                m.get("author.key")

                    .and_then(|k| oxy_core::hash::KeyId::from_hex(k))

            });

        if let Some(u) = user_key.filter(|u| *u != pinned) {

            let related = |from: oxy_core::hash::KeyId, to: oxy_core::hash::KeyId| {

                let mut cur = Some(from);

                for _ in 0..64 {

                    match cur {

                        Some(k) if k == to => return true,

                        Some(k) => cur = repo.identity(&k).ok().and_then(|i| i.previous),

                        None => break,

                    }

                }

                false

            };

            let how = if related(pinned, u) {

                "an older key of this identity"

            } else if related(u, pinned) {

                "a newer key of this identity"

            } else {

                "another key"

            };

            println!(

                "  {} {}",

                ui::caution(),

                ui::dim(format!(

                    "this repository pins author.key {}; your user config names {how}, {}. Other checkouts follow the user config: `oxy config --unset author.key` here, or `oxy config --user author.key {}`",

                    pinned.short(12),

                    u.short(12),

                    pinned.to_hex()

                ))

            );

        }

    }

pub fn config(key: &str, value: &str, user: bool, unset: bool) -> Result<i32> {

    // An empty value removes the key, which is what --unset says plainly.

    let value = if unset { "" } else { value };

    let said = if unset {

        format!("{} {key}", ui::done("Unset"))

    } else {

        format!("{} {key} = {value}", ui::done("Set"))

    };

        println!("{said} {}", ui::dim(format!("(in {})", path.display())));

        println!("{said} {}", ui::dim("(in this repository)"));

pub fn delegate_add(identity_files: &[PathBuf], scope: &str, expires: Option<&str>) -> Result<i32> {

    let ids = identity_files

        .iter()

        .map(|f| {

            Identity::decode(

                &std::fs::read(f).map_err(|e| anyhow::anyhow!("{}: {e}", f.display()))?,

            )

            .map_err(Into::into)

        })

        .collect::<Result<Vec<_>>>()?;

    let r = repo.delegate_add_many(ids, scope, expires)?;

    println!(

        "  {} {}",

        ui::note(),

        ui::dim("an agent configured with your author.key needs the new key: oxy config --user author.key NEW in its home")

    );

        /// The value to set (none with --unset)

        #[arg(required_unless_present = "unset")]

        value: Option<String>,

        /// Remove the key from this repository's file (or the user file with --user)

        #[arg(long)]

        unset: bool,

        /// The delegates' exported identity files: one rotation for all of them

        #[arg(required = true)]

        identity_file: Vec<PathBuf>,

        Cmd::Config {

            key,

            value,

            user,

            unset,

        } => identity::config(&key, value.as_deref().unwrap_or(""), user, unset),