Fall back to a parent's token when a stored one is refused; send the signer's identity with a bookmark move 68a924846379

            ..RemoteOptions::default()

pub(crate) fn warn_once(message: &str) {

    /// Other tokens for the same hub, tried in turn when `token` is

    /// refused (401, 403 or 404): those of enclosing checkouts, when

    /// `token` came from the credential store rather than from this

    /// remote's own configuration (oxygen#112).

    pub fallback_tokens: Vec<String>,

    /// The token in use, and those still to try when it is refused.

    token: Mutex<Option<String>>,

    fallbacks: Mutex<Vec<String>>,

            token: Mutex::new(options.token.clone()),

            fallbacks: Mutex::new(options.fallback_tokens.iter().rev().cloned().collect()),

    /// A request, tried again with the next fallback token while the

    /// hub refuses the one in use (oxygen#112).

        loop {

            let token = self.token.lock().unwrap_or_else(|p| p.into_inner()).clone();

            match self.call_once(post, endpoint, body, token.as_deref()) {

                Err(RepoError::Msg(m)) if token.is_some() && refused(&m) => {

                    let next = self

                        .fallbacks

                        .lock()

                        .unwrap_or_else(|p| p.into_inner())

                        .pop();

                    let Some(next) = next else {

                        return Err(RepoError::Msg(m));

                    };

                    crate::credentials::warn_once(&format!(

                        "{}: the stored token was refused; using the one an enclosing checkout has for this hub",

                        self.base

                    ));

                    *self.token.lock().unwrap_or_else(|p| p.into_inner()) = Some(next);

                }

                other => return other,

            }

        }

    }

    fn call_once(

        &self,

        post: bool,

        endpoint: &str,

        body: Option<&[u8]>,

        token: Option<&str>,

    ) -> Result<Vec<u8>> {

        if let Some(t) = token {

}

/// Whether a failed request's message says the hub refused its token:

/// HTTP 401, 403, or 404 (a hub hides a private repository from a token

/// that may not read it).

fn refused(message: &str) -> bool {

    [": HTTP 401", ": HTTP 403", ": HTTP 404"]

        .iter()

        .any(|c| message.contains(c))

    /// oxygenhub#129: a delegate that may move references makes a bookmark

    /// at its owner's change, signing no change of its own. The push

    /// carries its identity, so the host can check the move (it was

    /// refused as "unknown key" until the delegate had pushed a change).

    #[test]

    fn a_delegate_s_first_push_of_a_bookmark_carries_its_identity() {

        let dir = tempfile::tempdir().unwrap();

        let (host, mut user, _, _, _) = setup(dir.path(), true, false);

        let agent_home = dir.path().join("agent-home");

        let mut agent_repo = Repo::init(&dir.path().join("agent-work"))

            .unwrap()

            .with_home(agent_home.clone());

        let (agent, agent_id) = agent_repo

            .create_identity("agent", "agent@example", IdentityScope::User)

            .unwrap();

        user.delegate_add(agent_id, Scope::CHANGES | Scope::REFS, None)

            .unwrap();

        assert!(user.push("origin", false).unwrap().iter().all(|x| x.ok));

        let work = dir.path().join("work");

        let mut as_agent = Repo::open(&work).unwrap().with_home(agent_home);

        as_agent

            .set_user_config("author.signer", &agent.to_hex())

            .unwrap();

        assert!(

            host.store().get_identity(&agent).is_err(),

            "the host has never seen the agent"

        );

        let heads = as_agent.bookmark_heads().unwrap();

        as_agent.bookmark_create("feature", Some(&heads)).unwrap();

        let r = as_agent.push_bookmark("origin", "feature", false).unwrap();

        assert!(r.iter().all(|x| x.ok), "{r:?}");

        assert!(

            host.store().get_identity(&agent).is_ok(),

            "its identity came with the move"

        );

    }

            ..RemoteOptions::default()

    /// When the token is not this remote's own or the environment's, the

    /// other tokens enclosing checkouts hold for the hub are kept to try

    /// if it is refused: a stale stored login must not hide a parent's

    /// good token (oxygen#112).

        let explicit =

            options.token.is_some() || std::env::var("OXY_TOKEN").is_ok_and(|t| !t.is_empty());

        let enclosing = self.enclosing_credentials(url);

        if options.token.is_none() {

            options.token = enclosing.iter().find_map(|(t, _)| t.clone());

        }

        if options.ca.is_none() {

            options.ca = enclosing.iter().find_map(|(_, c)| c.clone());

        }

        if !explicit {

            for t in enclosing.into_iter().filter_map(|(t, _)| t) {

                if options.token.as_ref() != Some(&t) && !options.fallback_tokens.contains(&t) {

                    options.fallback_tokens.push(t);

                }

            }

    }

    /// The tokens and CAs of remotes on `url`'s hub in enclosing

    /// checkouts, nearest first.

    fn enclosing_credentials(&self, url: &str) -> Vec<(Option<String>, Option<PathBuf>)> {

        let mut out = Vec::new();

            return out;

                out.push((

                    cfg.get(&format!("remote.{name}.token")).cloned(),

                    cfg.get(&format!("remote.{name}.ca")).map(PathBuf::from),

                ));

        out

        // Whoever signed the move, and whom a delegate acts for, travel with

        // it: a receiver that has never seen a change by this delegate could

        // not otherwise check its signature (oxygenhub#129).

        if attestation.is_some() {

            for k in [self.signing_key(), self.config.author_key]

                .into_iter()

                .flatten()

            {

                if let Ok(id) = self.identity(&k) {

                    let body = id.encode();

                    if !bundle

                        .objects

                        .iter()

                        .any(|(t, b)| *t == ObjectType::Identity && *b == body)

                    {

                        bundle.objects.push((ObjectType::Identity, body));

                    }

                }

            }

        }

/// oxygen#112: a subrepo checkout whose stored login for the hub is stale

/// pushes with the token its parent checkout holds for the same hub, once

/// the stale one is refused; a token the subrepo sets itself is never

/// swapped for another.

#[test]

fn a_refused_stored_token_falls_back_to_the_parents() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let served = root.join("served");

    Repo::init(&served.join("parent")).unwrap();

    Repo::init(&served.join("child")).unwrap();

    let base = start(&served, vec!["good".into()]);

    let work = root.join("work");

    let mut parent = Repo::clone(&format!("{base}/parent"), &work).unwrap();

    parent.config.set("remote.origin.token", "good").unwrap();

    parent.save_config().unwrap();

    // The subrepo's own home holds a stale login for this hub.

    let home = root.join("home");

    oxy_core::credentials::Credentials::at(&home)

        .save(&base, "stale", Some("andy"), None)

        .unwrap();

    let nested = work.join("deps").join("child");

    let mut child = Repo::clone(&format!("{base}/child"), &nested)

        .unwrap()

        .with_home(&home);

    let options = child.options_for_url(&format!("{base}/child"));

    assert_eq!(

        options.token.as_deref(),

        Some("stale"),

        "the stored login comes first"

    );

    assert_eq!(

        options.fallback_tokens,

        vec!["good".to_string()],

        "the parent's, to fall back on"

    );

    write(&nested, "c.txt", b"child\n");

    child.commit("child work", &[]).unwrap();

    let pushed = child.push("origin", false).unwrap();

    assert!(pushed[0].ok, "{}", pushed[0].reason);

    assert_eq!(

        Repo::open(&served.join("child"))

            .unwrap()

            .bookmark_heads()

            .unwrap()

            .len(),

        1

    );

    // Its own token, if wrong, stays wrong: what a checkout sets is its choice.

    child.config.set("remote.origin.token", "wrong").unwrap();

    child.save_config().unwrap();

    write(&nested, "d.txt", b"more\n");

    child.commit("more", &[]).unwrap();

    let err = child.push("origin", false).err().unwrap().to_string();

    assert!(err.contains("401"), "{err}");

}

enclosing checkout (so a subrepo uses its parent's). When the token came

from the store or an enclosing checkout and the hub refuses it (a stale login,

or another account's), oxy tries the other tokens enclosing checkouts hold for

that hub before giving up, and says so once; a remote's own token and

`$OXY_TOKEN` are never swapped for another. oxy sends a token over

| `Bundle` | `{0: [[change bytes, [Signature]]], 1: [signed attestation], 2: [[type name, object bytes]], 3: [signed policy]}`; changes in dependency order; objects are chunks, blobs, identities, and states only, and include the text blobs of every change in the bundle and their chunks, so a bundle can be read on its own; a push that moves a bookmark also carries the identity that signed the move and, for a delegate, the identity it acts for, so a receiver that has seen no change by that key can check it (oxygenhub#129); key 3 (optional) holds the policies between the receiver's serial and the one sent with a push, ascending |

        ..RemoteOptions::default()

            ..RemoteOptions::default()

                ..RemoteOptions::default()