Trust policy: policy objects, init/grant/revoke, enforcement on push and fetch, propagation with downgrade protection (spec 0.6) 83e0677b07fe

//! The trust policy (spec §14.5): who may update which references, signed

//! by a threshold of root keys. A repository without a policy is unverified.

//!

//! Encoding: `{0: version, 1: repo, 2: serial, 3: {0: root keys, 1: threshold},

//! 4: [rule], 5: [identity bytes], 6: [revoked], 7: expires}`; a rule is

//! `{0: pattern, 1: keys, 2: threshold, 3: require, 4: allow_conflicts}` with

//! `require` 0 = signed, 1 = sealed, 2 = any.

use crate::cbor::{self, Value};

use crate::hash::{hash_object, KeyId, ObjectRef, ObjectType};

use crate::identity::{self, Domain, Identity, Signature};

use crate::objects::{array, bytes, check_version, field, map, oref, text, uint, ObjectError, FORMAT_VERSION};

use std::collections::BTreeMap;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]

pub enum Require {

    Signed,

    Sealed,

    Any,

}

impl Require {

    fn tag(self) -> u64 {

        match self {

            Require::Signed => 0,

            Require::Sealed => 1,

            Require::Any => 2,

        }

    }

    fn from_tag(t: u64) -> Result<Require, ObjectError> {

        Ok(match t {

            0 => Require::Signed,

            1 => Require::Sealed,

            2 => Require::Any,

            _ => return Err(ObjectError::Schema(format!("unknown require {t}"))),

        })

    }

    pub fn name(self) -> &'static str {

        match self {

            Require::Signed => "signed",

            Require::Sealed => "sealed",

            Require::Any => "any",

        }

    }

}

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct Rule {

    /// Glob over reference names; `*` matches any run of characters.

    pub pattern: String,

    pub keys: Vec<KeyId>,

    pub threshold: u32,

    pub require: Require,

    pub allow_conflicts: bool,

}

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct Policy {

    pub repo: [u8; 16],

    pub serial: u64,

    pub roots: Vec<KeyId>,

    pub root_threshold: u32,

    pub rules: Vec<Rule>,

    /// Embedded so verification needs no fetch.

    pub identities: Vec<Identity>,

    pub revoked: Vec<KeyId>,

    pub expires: u64,

}

/// `*` matches any run of characters (including `/`); everything else is literal.

pub fn glob_matches(pattern: &str, name: &str) -> bool {

    fn rec(p: &[u8], n: &[u8]) -> bool {

        match p.first() {

            None => n.is_empty(),

            Some(b'*') => (0..=n.len()).any(|i| rec(&p[1..], &n[i..])),

            Some(c) => n.first() == Some(c) && rec(&p[1..], &n[1..]),

        }

    }

    rec(pattern.as_bytes(), name.as_bytes())

}

impl Policy {

    fn keys_value(keys: &[KeyId]) -> Value {

        Value::Array(keys.iter().map(|k| Value::Bytes(k.0.to_vec())).collect())

    }

    fn keys_from(v: &Value, what: &str) -> Result<Vec<KeyId>, ObjectError> {

        let mut ks = array(v, what)?.iter().map(|k| oref(k, what)).collect::<Result<Vec<_>, _>>()?;

        ks.sort();

        ks.dedup();

        Ok(ks)

    }

    pub fn to_value(&self) -> Value {

        Value::map([

            (0, Value::Uint(FORMAT_VERSION)),

            (1, Value::Bytes(self.repo.to_vec())),

            (2, Value::Uint(self.serial)),

            (3, Value::map([(0, Self::keys_value(&self.roots)), (1, Value::Uint(self.root_threshold as u64))])),

            (

                4,

                Value::Array(

                    self.rules

                        .iter()

                        .map(|r| {

                            Value::map([

                                (0, Value::Text(r.pattern.clone())),

                                (1, Self::keys_value(&r.keys)),

                                (2, Value::Uint(r.threshold as u64)),

                                (3, Value::Uint(r.require.tag())),

                                (4, Value::Bool(r.allow_conflicts)),

                            ])

                        })

                        .collect(),

                ),

            ),

            (5, Value::Array(self.identities.iter().map(|i| Value::Bytes(i.encode())).collect())),

            (6, Self::keys_value(&self.revoked)),

            (7, Value::Uint(self.expires)),

        ])

    }

    pub fn encode(&self) -> Vec<u8> {

        cbor::encode(&self.to_value())

    }

    pub fn hash(&self) -> ObjectRef {

        hash_object(ObjectType::Policy, &self.encode())

    }

    pub fn decode(b: &[u8]) -> Result<Policy, ObjectError> {

        let v = cbor::decode(b)?;

        let m = map(&v, "policy")?;

        check_version(m)?;

        let roots = map(field(m, 3, "roots")?, "roots")?;

        let mut rules = Vec::new();

        for r in array(field(m, 4, "rules")?, "rules")? {

            let rm = map(r, "rule")?;

            rules.push(Rule {

                pattern: text(field(rm, 0, "pattern")?, "pattern")?.to_owned(),

                keys: Self::keys_from(field(rm, 1, "rule keys")?, "rule keys")?,

                threshold: uint(field(rm, 2, "threshold")?, "threshold")? as u32,

                require: Require::from_tag(uint(field(rm, 3, "require")?, "require")?)?,

                allow_conflicts: field(rm, 4, "allow_conflicts")?.as_bool().ok_or_else(|| ObjectError::Schema("allow_conflicts: expected bool".into()))?,

            });

        }

        let identities = array(field(m, 5, "identities")?, "identities")?

            .iter()

            .map(|i| Identity::decode(bytes(i, "identity")?))

            .collect::<Result<Vec<_>, _>>()?;

        let p = Policy {

            repo: bytes(field(m, 1, "repo")?, "repo")?.try_into().map_err(|_| ObjectError::Schema("repo: expected 16 bytes".into()))?,

            serial: uint(field(m, 2, "serial")?, "serial")?,

            roots: Self::keys_from(field(roots, 0, "root keys")?, "root keys")?,

            root_threshold: uint(field(roots, 1, "root threshold")?, "root threshold")? as u32,

            rules,

            identities,

            revoked: Self::keys_from(field(m, 6, "revoked")?, "revoked")?,

            expires: uint(field(m, 7, "expires")?, "expires")?,

        };

        if p.root_threshold == 0 || p.root_threshold as usize > p.roots.len() {

            return Err(ObjectError::Schema("root threshold must be between 1 and the number of root keys".into()));

        }

        for r in &p.rules {

            if r.threshold == 0 || r.threshold as usize > r.keys.len() {

                return Err(ObjectError::Schema(format!("rule {:?}: threshold must be between 1 and the number of keys", r.pattern)));

            }

        }

        Ok(p)

    }

    pub fn identity(&self, key: &KeyId) -> Option<&Identity> {

        self.identities.iter().find(|i| i.hash() == *key)

    }

    pub fn is_revoked(&self, key: &KeyId) -> bool {

        self.revoked.contains(key)

    }

    pub fn is_expired(&self, now_ms: u64) -> bool {

        now_ms > self.expires

    }

    /// The first rule whose pattern matches `reference`.

    pub fn rule_for(&self, reference: &str) -> Option<&Rule> {

        self.rules.iter().find(|r| glob_matches(&r.pattern, reference))

    }

    /// Whether `key` may update `reference`: listed in the matching rule and not revoked.

    pub fn authorizes(&self, key: &KeyId, reference: &str) -> bool {

        !self.is_revoked(key) && self.rule_for(reference).is_some_and(|r| r.keys.contains(key))

    }

    /// Verify that `sigs` over this policy's hash meet `trusted`'s root

    /// threshold (`trusted` is the previous policy, or this one when

    /// bootstrapping). Returns the signing root keys.

    pub fn verify_signatures(&self, sigs: &[Signature], trusted: &Policy) -> Result<Vec<KeyId>, String> {

        let target = self.hash();

        let mut signers = Vec::new();

        for sig in sigs {

            if !trusted.roots.contains(&sig.key) || trusted.is_revoked(&sig.key) {

                continue;

            }

            let Some(id) = trusted.identity(&sig.key).or_else(|| self.identity(&sig.key)) else { continue };

            if identity::verify(id, sig, Domain::Policy, &target).is_ok() && !signers.contains(&sig.key) {

                signers.push(sig.key);

            }

        }

        if (signers.len() as u32) < trusted.root_threshold {

            return Err(format!("policy needs {} root signature(s), has {}", trusted.root_threshold, signers.len()));

        }

        Ok(signers)

    }

    /// A single-root policy letting `root` do everything on every reference.

    pub fn single_root(repo: [u8; 16], root: Identity, expires: u64) -> Policy {

        let key = root.hash();

        Policy {

            repo,

            serial: 1,

            roots: vec![key],

            root_threshold: 1,

            rules: vec![Rule { pattern: "*".into(), keys: vec![key], threshold: 1, require: Require::Any, allow_conflicts: true }],

            identities: vec![root],

            revoked: vec![],

            expires,

        }

    }

    /// Identities keyed by KeyId.

    pub fn identity_map(&self) -> BTreeMap<KeyId, &Identity> {

        self.identities.iter().map(|i| (i.hash(), i)).collect()

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    use crate::identity::SecretKey;

    fn sk(n: u8) -> SecretKey {

        SecretKey { ed_seed: [n; 32], ml_seed: [n + 100; 32] }

    }

    #[test]

    fn globs() {

        assert!(glob_matches("*", "main"));

        assert!(glob_matches("release/*", "release/1.0"));

        assert!(!glob_matches("release/*", "main"));

        assert!(glob_matches("main", "main"));

        assert!(!glob_matches("main", "main2"));

        assert!(glob_matches("*-rc*", "1.0-rc2"));

        assert!(glob_matches("", ""));

    }

    #[test]

    fn round_trip_and_rules() {

        let root = sk(1).identity("Root", "r@x", 0);

        let dev = sk(2).identity("Dev", "d@x", 0);

        let mut p = Policy::single_root([9; 16], root.clone(), 10);

        p.rules.insert(0, Rule { pattern: "release/*".into(), keys: vec![root.hash()], threshold: 1, require: Require::Signed, allow_conflicts: false });

        p.rules[1].keys.push(dev.hash());

        p.identities.push(dev.clone());

        p.revoked.push(ObjectRef([7; 32]));

        let d = Policy::decode(&p.encode()).unwrap();

        assert_eq!(d.rules.len(), 2);

        assert_eq!(d.rules[0].require, Require::Signed);

        assert_eq!(d.identity(&dev.hash()), Some(&dev));

        assert!(d.authorizes(&dev.hash(), "main"));

        assert!(!d.authorizes(&dev.hash(), "release/1"));

        assert!(d.authorizes(&root.hash(), "release/1"));

        assert!(d.is_expired(11) && !d.is_expired(10));

        assert_eq!(d.hash(), p.hash());

        let mut bad = p.clone();

        bad.root_threshold = 5;

        assert!(Policy::decode(&bad.encode()).is_err());

    }

    #[test]

    fn signatures_need_root_threshold() {

        let r1 = sk(1);

        let r2 = sk(2);

        let i1 = r1.identity("a", "a", 0);

        let i2 = r2.identity("b", "b", 0);

        let mut p = Policy::single_root([1; 16], i1.clone(), 100);

        p.roots.push(i2.hash());

        p.roots.sort();

        p.root_threshold = 2;

        p.identities.push(i2.clone());

        let h = p.hash();

        let s1 = r1.sign(Domain::Policy, &i1.hash(), &h);

        let s2 = r2.sign(Domain::Policy, &i2.hash(), &h);

        assert!(p.verify_signatures(&[s1.clone()], &p).is_err());

        assert_eq!(p.verify_signatures(&[s1.clone(), s2.clone()], &p).unwrap().len(), 2);

        // Duplicates do not count twice; a non-root signer does not count.

        assert!(p.verify_signatures(&[s1.clone(), s1.clone()], &p).is_err());

        let stranger = sk(3);

        let si = stranger.identity("s", "s", 0);

        let s3 = stranger.sign(Domain::Policy, &si.hash(), &h);

        assert!(p.verify_signatures(&[s1.clone(), s3], &p).is_err());

        // A successor policy is verified against the previous roots.

        let mut next = p.clone();

        next.serial = 2;

        next.revoked.push(i2.hash());

        let nh = next.hash();

        let n1 = r1.sign(Domain::Policy, &i1.hash(), &nh);

        let n2 = r2.sign(Domain::Policy, &i2.hash(), &nh);

        assert_eq!(next.verify_signatures(&[n1, n2], &p).unwrap().len(), 2);

    }

}

//! Trust policy management and enforcement (spec §14.5).

//!

//! A repository with a policy verifies everything it receives: every change

//! must be authenticated by a key the policy authorizes for the bookmark,

//! every bookmark update must carry an attestation by such a key, and a new

//! policy must be signed by a threshold of the roots of the policy it replaces.

use super::*;

use crate::policy::{Policy, Require, Rule};

use crate::protocol::SignedPolicy;

/// One year, the default policy lifetime.

const POLICY_LIFETIME_MS: u64 = 365 * 24 * 60 * 60 * 1000;

impl Repo {

    /// The current policy and its signatures, if the repository has one.

    pub fn current_policy(&self) -> Result<Option<(ObjectRef, SignedPolicy)>> {

        let Some(r) = self.view()?.policy else { return Ok(None) };

        let policy = Policy::decode(&self.store.get_typed(&r, ObjectType::Policy)?)?;

        Ok(Some((r, SignedPolicy { policy, sigs: self.store.signatures(&r)? })))

    }

    /// Store a policy with its signatures and point the `policy` reference at it.

    pub(crate) fn set_policy(&self, sp: &SignedPolicy, command: &str) -> Result<ObjectRef> {

        let r = self.store.put(ObjectType::Policy, &sp.policy.encode())?;

        for sig in &sp.sigs {

            self.store.put_signature(&r, sig)?;

        }

        for id in &sp.policy.identities {

            self.store.put_identity(id)?;

        }

        let (op_ref, op) = self.head_op()?;

        if op.view.policy != Some(r) {

            let mut view = op.view.clone();

            view.policy = Some(r);

            self.record_op(&[op_ref], command, view)?;

        }

        Ok(r)

    }

    /// Validate an incoming policy against the one we trust (`None` when

    /// bootstrapping: the policy then vouches for itself).

    pub fn check_policy(&self, sp: &SignedPolicy, trusted: Option<&Policy>) -> std::result::Result<(), String> {

        if sp.policy.repo != self.id().map_err(|e| e.to_string())? {

            return Err("policy is for a different repository".into());

        }

        if let Some(t) = trusted {

            if sp.policy.serial <= t.serial {

                return Err(format!("policy serial {} is not greater than the current {}", sp.policy.serial, t.serial));

            }

        }

        sp.policy.verify_signatures(&sp.sigs, trusted.unwrap_or(&sp.policy))?;

        Ok(())

    }

    fn sign_policy(&self, policy: Policy) -> Result<SignedPolicy> {

        let Some((key, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        if !policy.roots.contains(&key) {

            return fail("your key is not a root key of this policy");

        }

        if policy.root_threshold > 1 {

            return fail(format!("this policy needs {} root signatures; multi-signer updates are not implemented yet", policy.root_threshold));

        }

        let sig = sk.sign(Domain::Policy, &key, &policy.hash());

        Ok(SignedPolicy { policy, sigs: vec![sig] })

    }

    /// Create the initial policy with the configured identity as sole root.

    pub fn policy_init(&self) -> Result<SignedPolicy> {

        if self.current_policy()?.is_some() {

            return fail("this repository already has a policy");

        }

        let Some((key, _)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let identity = self.identity(&key)?;

        let policy = Policy::single_root(self.id()?, identity, Hlc::now().wall_ms + POLICY_LIFETIME_MS);

        let sp = self.sign_policy(policy)?;

        self.set_policy(&sp, "oxy policy init")?;

        Ok(sp)

    }

    fn next_policy(&self) -> Result<Policy> {

        let Some((_, sp)) = self.current_policy()? else {

            return fail("this repository has no policy; run `oxy policy init`");

        };

        let mut p = sp.policy;

        p.serial += 1;

        p.expires = Hlc::now().wall_ms + POLICY_LIFETIME_MS;

        Ok(p)

    }

    /// Let `identity` update references matching `pattern` (default every reference).

    pub fn policy_grant(&self, identity: Identity, pattern: Option<&str>) -> Result<SignedPolicy> {

        let mut p = self.next_policy()?;

        let key = identity.hash();

        let pattern = pattern.unwrap_or("*");

        p.revoked.retain(|k| k != &key);

        match p.rules.iter_mut().find(|r| r.pattern == pattern) {

            Some(rule) => {

                if !rule.keys.contains(&key) {

                    rule.keys.push(key);

                    rule.keys.sort();

                }

            }

            None => p.rules.push(Rule { pattern: pattern.into(), keys: vec![key], threshold: 1, require: Require::Any, allow_conflicts: true }),

        }

        if p.identity(&key).is_none() {

            p.identities.push(identity);

        }

        let sp = self.sign_policy(p)?;

        self.set_policy(&sp, &format!("oxy policy grant {}", key.short(12)))?;

        Ok(sp)

    }

    /// Revoke `key`: it may no longer update anything, and existing rules drop it.

    pub fn policy_revoke(&self, key: &KeyId) -> Result<SignedPolicy> {

        let mut p = self.next_policy()?;

        if p.roots.contains(key) {

            return fail("cannot revoke a root key");

        }

        for r in &mut p.rules {

            r.keys.retain(|k| k != key);

        }

        p.rules.retain(|r| !r.keys.is_empty());

        if !p.revoked.contains(key) {

            p.revoked.push(*key);

            p.revoked.sort();

        }

        let sp = self.sign_policy(p)?;

        self.set_policy(&sp, &format!("oxy policy revoke {}", key.short(12)))?;

        Ok(sp)

    }

    /// Whether `change` may be part of `reference` under `policy`: it must be

    /// authenticated (by its author or a delegate) with a key the matching

    /// rule lists, using the authenticator kind the rule requires.

    pub fn change_allowed(&self, hash: &ChangeHash, policy: &Policy, reference: &str) -> std::result::Result<(), String> {

        let rule = policy.rule_for(reference).ok_or_else(|| format!("no policy rule matches {reference:?}"))?;

        match self.authenticate_change(hash).map_err(|e| e.to_string())? {

            SignatureStatus::Valid { key, sealed, .. } => {

                if policy.is_revoked(&key) {

                    return Err(format!("change {} is signed by revoked key {}", hash.short(12), key.short(12)));

                }

                if !rule.keys.contains(&key) {

                    return Err(format!("change {} is signed by {}, which may not update {reference:?}", hash.short(12), key.short(12)));

                }

                match (rule.require, sealed) {

                    (Require::Signed, true) => Err(format!("{reference:?} requires individually signed changes; {} is only sealed", hash.short(12))),

                    (Require::Sealed, false) => Err(format!("{reference:?} requires sealed changes; {} is individually signed", hash.short(12))),

                    _ => Ok(()),

                }

            }

            SignatureStatus::Unsigned => Err(format!("change {} is not signed or sealed", hash.short(12))),

            SignatureStatus::Invalid(e) => Err(format!("change {}: {e}", hash.short(12))),

        }

    }

    /// Check every change that `new` adds over `old` for `reference`.

    pub(crate) fn state_allowed(&self, old_heads: &[ChangeHash], new_heads: &[ChangeHash], policy: &Policy, reference: &str) -> std::result::Result<(), String> {

        let added = self.negotiate(old_heads, new_heads).map_err(|e| e.to_string())?;

        for h in &added {

            self.change_allowed(h, policy, reference)?;

        }

        if let Some(rule) = policy.rule_for(reference) {

            if !rule.allow_conflicts && !added.is_empty() {

                let st = self.load_state(new_heads).map_err(|e| e.to_string())?;

                if st.materialize().is_conflicted() {

                    return Err(format!("{reference:?} does not allow conflicted states"));

                }

            }

        }

        Ok(())

    }

}

    Policy,

            Domain::Policy => "policy",

pub mod policy;

    /// The `policy` reference (spec §10.1, §14.5): ObjectRef of the current policy.

    pub policy: Option<ObjectRef>,

            (3, self.policy.map(|p| Value::Bytes(p.0.to_vec())).unwrap_or(Value::Null)),

        if let Some(p) = m.get(&3) {

            view.policy = if p.is_null() { None } else { Some(oref(p, "policy")?) };

        }

        view.policy = Some(ObjectRef([6; 32]));

use crate::policy::Policy;

/// A policy together with the root signatures over its ObjectRef.

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct SignedPolicy {

    pub policy: Policy,

    pub sigs: Vec<Signature>,

}

/// What `refs` returns: every bookmark plus the current policy, if any.

#[derive(Clone, Debug, Default)]

pub struct RefsResponse {

    pub refs: Vec<RemoteRef>,

    pub policy: Option<SignedPolicy>,

}

    fn refs(&self) -> Result<RefsResponse>;

    /// Push changes, bookmark updates, and optionally a newer policy. The

    /// policy is applied first; a result named `policy` reports it.

    fn push(&self, bundle: Bundle, updates: Vec<RefUpdate>, policy: Option<SignedPolicy>) -> Result<Vec<RefResult>>;

    fn refs(&self) -> Result<RefsResponse> {

    fn push(&self, bundle: Bundle, updates: Vec<RefUpdate>, policy: Option<SignedPolicy>) -> Result<Vec<RefResult>> {

        self.repo.receive_push(bundle, updates, policy)

    fn refs(&self) -> Result<RefsResponse> {

    fn push(&self, bundle: Bundle, updates: Vec<RefUpdate>, policy: Option<SignedPolicy>) -> Result<Vec<RefResult>> {

        wire::decode_push_response(&self.call(true, "push", Some(&wire::encode_push(&bundle, &updates, policy.as_ref())))?)

    fn opt_policy_value(sp: Option<&SignedPolicy>) -> Value {

        match sp {

            Some(sp) => Value::Array(vec![Value::Bytes(sp.policy.encode()), sigs_value(&sp.sigs)]),

            None => Value::Null,

        }

    }

    fn opt_policy_from(v: &Value) -> Result<Option<SignedPolicy>> {

        if v.is_null() {

            return Ok(None);

        }

        let a = o::array(v, "signed policy")?;

        if a.len() != 2 {

            return Err(schema("signed policy: expected [policy, sigs]"));

        }

        Ok(Some(SignedPolicy { policy: Policy::decode(o::bytes(&a[0], "policy")?)?, sigs: sigs_from(&a[1])? }))

    }

    pub fn encode_refs(id: [u8; 16], resp: &RefsResponse) -> Vec<u8> {

                    resp.refs

                        .iter()

            (2, opt_policy_value(resp.policy.as_ref())),

    pub fn decode_refs(bytes: &[u8]) -> Result<([u8; 16], RefsResponse)> {

        let policy = match m.get(&2) {

            Some(p) => opt_policy_from(p)?,

            None => None,

        };

        Ok((id, RefsResponse { refs, policy }))

    pub fn encode_push(bundle: &Bundle, updates: &[RefUpdate], policy: Option<&SignedPolicy>) -> Vec<u8> {

            (2, opt_policy_value(policy)),

    pub fn decode_push(bytes: &[u8]) -> Result<(Bundle, Vec<RefUpdate>, Option<SignedPolicy>)> {

        let policy = match m.get(&2) {

            Some(p) => opt_policy_from(p)?,

            None => None,

        };

        Ok((bundle, updates, policy))

        let policy = Policy::single_root([3; 16], id.clone(), 99);

        let psig = sk.sign(crate::identity::Domain::Policy, &key, &policy.hash());

        let resp = RefsResponse { refs, policy: Some(SignedPolicy { policy: policy.clone(), sigs: vec![psig.clone()] }) };

        let (id_back, back) = wire::decode_refs(&wire::encode_refs([3; 16], &resp)).unwrap();

        assert_eq!(back.refs.len(), 2);

        assert_eq!(back.refs[0].attestation.as_ref().unwrap().attest, att);

        assert_eq!(back.refs[1].last_serial, None);

        assert_eq!(back.policy.as_ref().unwrap().policy, policy);

        let sp = SignedPolicy { policy, sigs: vec![psig] };

        let (b2, ups, pol) = wire::decode_push(&wire::encode_push(&bundle, std::slice::from_ref(&up), Some(&sp))).unwrap();

        assert_eq!(pol, Some(sp));

//! Not yet implemented from the spec: packs, checkpoints, multiple

//! workspaces, multi-signer policy updates, and the `objects`/`checkpoint`

//! endpoints. A repository without a policy is unverified and accepts

//! unsigned pushes; with one, everything received is checked (spec §14.5). Changes are signed individually when `core.sign` is

use crate::protocol::{open_remote, Bundle, RefResult, RefUpdate, RefsResponse, RemoteOptions, RemoteRef, SignedAttest, SignedPolicy};

mod policy;

pub use sync::{FetchReport, PullReport};

/// What a fetch brought in.

#[derive(Debug, Clone, PartialEq, Eq, Default)]

pub struct FetchReport {

    /// Bookmark name, its heads, and how many changes were new.

    pub refs: Vec<(String, Vec<ChangeHash>, usize)>,

    /// The remote has never presented a policy, so nothing was verified

    /// against one (spec §14.5: warn loudly).

    pub unverified: bool,

}

    pub fn remote_refs(&self) -> Result<RefsResponse> {

        Ok(RefsResponse { refs: out, policy: self.current_policy()?.map(|(_, sp)| sp) })

    /// Accept a push (spec §16.4). Without a trust policy every repository

    /// attestations that are present must still be valid. With a policy,

    /// every change and update is checked against it. A newer policy in the

    /// push is applied first when it is signed by the current roots.

    pub fn receive_push(&self, bundle: Bundle, updates: Vec<RefUpdate>, policy: Option<SignedPolicy>) -> Result<Vec<RefResult>> {

        let mut results = Vec::new();

        if let Some(sp) = policy {

            let current = self.current_policy()?.map(|(_, c)| c.policy);

            match self.check_policy(&sp, current.as_ref()) {

                Ok(()) => {

                    self.set_policy(&sp, &format!("push received: policy serial {}", sp.policy.serial))?;

                    results.push(RefResult { name: "policy".into(), ok: true, reason: format!("serial {}", sp.policy.serial) });

                }

                Err(e) => {

                    results.push(RefResult { name: "policy".into(), ok: false, reason: e });

                    for u in updates {

                        results.push(RefResult { name: u.name, ok: false, reason: "policy update was rejected".into() });

                    }

                    return Ok(results);

                }

            }

        }

        let policy = self.current_policy()?.map(|(_, sp)| sp.policy);

        if let Err(e) = self.import_bundle(&bundle, policy.is_some()) {

            for u in updates {

                results.push(RefResult { name: u.name, ok: false, reason: e.to_string() });

            }

            return Ok(results);

        }

            let outcome = self.apply_update(&mut view, &u, policy.as_ref());

    fn apply_update(&self, view: &mut View, u: &RefUpdate, policy: Option<&crate::policy::Policy>) -> std::result::Result<(), String> {

        if u.name == "policy" {

            return Err("the policy reference is updated by sending a policy, not a bookmark update".into());

        }

        if let Some(p) = policy {

            let Some(sa) = &u.attestation else {

                return Err(format!("{:?} requires a signed reference attestation under this repository's policy", u.name));

            };

            let signer = sa.sigs.first().map(|s| s.key).ok_or("attestation carries no signature")?;

            if !p.authorizes(&signer, &u.name) {

                return Err(format!("key {} may not update {:?} under this repository's policy", signer.short(12), u.name));

            }

            let old_heads = self.store.get_state(&current).map_err(|e| e.to_string())?.heads;

            self.state_allowed(&old_heads, &new_state.heads, p, &u.name)?;

        }

    fn policy_serial_path(&self, remote: &str) -> PathBuf {

        self.oxy.join("remotes").join(remote).join("policy.serial")

    }

    /// The highest policy serial `remote` has ever presented.

    fn remote_policy_serial(&self, remote: &str) -> Option<u64> {

        fs::read_to_string(self.policy_serial_path(remote)).ok().and_then(|s| s.trim().parse().ok())

    }

    fn record_policy_serial(&self, remote: &str, serial: u64) -> Result<()> {

        let p = self.policy_serial_path(remote);

        fs::create_dir_all(p.parent().unwrap())?;

        write_atomic(&p, serial.to_string().as_bytes())

    }

    pub fn fetch(&self, remote_name: &str) -> Result<FetchReport> {

        let resp = remote.refs()?;

        // Trust policy (spec §14.5). Adopt the remote's policy when it is newer

        // and signed by roots we trust, or on first contact. A remote that

        // once presented a policy may never present none or an older one:

        // that is a downgrade. A remote that never presented one is

        // unverified, and this fetch is checked only as far as possible.

        let local_policy = self.current_policy()?.map(|(_, sp)| sp.policy);

        let seen = self.remote_policy_serial(remote_name);

        let mut unverified = false;

        match &resp.policy {

            Some(sp) => {

                if seen.is_some_and(|s| sp.policy.serial < s) {

                    return fail(format!("{remote_name} presents policy serial {} but presented {} before: refusing the downgrade", sp.policy.serial, seen.unwrap()));

                }

                match &local_policy {

                    Some(l) if sp.policy.serial < l.serial => {}

                    Some(l) if sp.policy.serial == l.serial => {

                        if sp.policy.hash() != l.hash() {

                            return fail(format!("{remote_name} presents a different policy with the same serial {}", l.serial));

                        }

                    }

                    local => {

                        self.check_policy(sp, local.as_ref()).map_err(|e| RepoError::Msg(format!("policy from {remote_name}: {e}")))?;

                        self.set_policy(sp, &format!("oxy fetch {remote_name} (policy serial {})", sp.policy.serial))?;

                    }

                }

                self.record_policy_serial(remote_name, sp.policy.serial)?;

            }

            None => {

                if seen.is_some() {

                    return fail(format!("{remote_name} presented a policy before but has none now: refusing the downgrade"));

                }

                unverified = true;

            }

        }

        let policy = if unverified { None } else { self.current_policy()?.map(|(_, sp)| sp.policy) };

        for r in resp.refs {

            // Changes are not individually re-verified here: the bookmark's

            // attestation (checked below) binds its whole state, and the

            // receiver of the push verified the added changes at that time.

            if let Some(p) = &policy {

                let Some(sa) = &r.attestation else {

                    return fail(format!("{remote_name}/{} has no attestation, which its policy requires", r.name));

                };

                let signer = sa.sigs.first().map(|s| s.key).ok_or_else(|| RepoError::Msg("attestation carries no signature".into()))?;

                if !p.authorizes(&signer, &r.name) {

                    return fail(format!("{remote_name}/{}: attested by {}, which the policy does not authorize", r.name, signer.short(12)));

                }

            }

        Ok(FetchReport { refs: report, unverified })

        let resp = remote.refs()?;

        let local_policy = self.current_policy()?.map(|(_, sp)| sp);

        let policy_to_send = match (&local_policy, &resp.policy) {

            (Some(l), Some(r)) if l.policy.serial > r.policy.serial => Some(l.clone()),

            (Some(l), None) => Some(l.clone()),

            (Some(l), Some(r)) if l.policy.serial < r.policy.serial => {

                return fail(format!("{remote_name} has a newer policy (serial {}); fetch first", r.policy.serial));

            }

            _ => None,

        };

        let remote_has_policy = resp.policy.is_some() || policy_to_send.is_some();

        if remote_has_policy && self.secret_key()?.is_none() {

            return fail(format!("{remote_name} enforces a trust policy; pushing needs an identity (`oxy identity create`)"));

        }

        let refs = resp.refs;

        // A push that carries a policy re-attests the bookmark even when its

        // state is unchanged, so the current attestation is always by a key

        // the current policy authorizes (a revoked key's attestation would

        // otherwise be refused by every later fetch).

        if new_state == remote_state && policy_to_send.is_none() {

        let sent_serial = policy_to_send.as_ref().map(|p| p.policy.serial);

        let results = remote.push(bundle, vec![RefUpdate { name: bookmark.clone(), old_state: remote_state, new_state, force, attestation }], policy_to_send)?;

        if let (Some(serial), true) = (sent_serial, results.iter().any(|r| r.ok && r.name == "policy")) {

            self.record_policy_serial(remote_name, serial)?;

        }

        if results.iter().any(|r| r.ok && r.name == bookmark) {

use crate::protocol::SignedPolicy;

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: s1, new_state: ghost, force: false, attestation: None }], None).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: empty, new_state: s1, force: false, attestation: None }], None).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: s1, new_state: empty, force: false, attestation: None }], None).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: s1, new_state: empty, force: true, attestation: None }], None).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: empty, new_state: s1, force: false, attestation: Some(sa.clone()) }], None).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: empty, new_state: s1, force: false, attestation: Some(sa2) }], None).unwrap();

#[test]

fn trust_policy_governs_pushes_and_fetches() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let origin = Repo::init(&root.join("origin")).unwrap();

    let url = root.join("origin").to_string_lossy().to_string();

    // A is the root. Before the policy, an unsigned push from B is fine.

    let mut a = Repo::clone(&url, &root.join("a")).unwrap().with_home(root.join("home-a"));

    let (key_a, _) = a.create_identity("Ada", "[email protected]", IdentityScope::User).unwrap();

    let mut b = Repo::clone(&url, &root.join("b")).unwrap().with_home(root.join("home-b"));

    write(&root.join("b"), "b.txt", b"b\n");

    b.commit("unsigned before policy", &[]).unwrap();

    assert!(b.push("origin", false).unwrap()[0].ok);

    // A creates the policy and pushes it; origin now enforces it.

    write(&root.join("a"), "a.txt", b"a\n");

    a.commit("a", &[]).unwrap();

    let sp = a.policy_init().unwrap();

    assert_eq!(sp.policy.serial, 1);

    a.pull("origin").unwrap();

    let results = a.push("origin", false).unwrap();

    assert!(results.iter().all(|r| r.ok), "{results:?}");

    assert_eq!(origin.current_policy().unwrap().unwrap().1.policy.serial, 1);

    // B pulls the policy. Without an identity B cannot push at all.

    b.pull("origin").unwrap();

    assert!(b.current_policy().unwrap().is_some(), "the policy arrived with the fetch");

    assert!(b.push("origin", false).is_err());

    // With an identity the policy does not list, the push is rejected by origin.

    let (key_b, id_b) = b.create_identity("Bob", "[email protected]", IdentityScope::User).unwrap();

    write(&root.join("b"), "b.txt", b"b2\n");

    let h_b2 = b.commit("b2 as Bob", &[]).unwrap();

    assert_eq!(b.store().get_change(&h_b2).unwrap().author, key_b);

    let r = b.push("origin", false).unwrap();

    assert!(!r[0].ok && r[0].reason.contains("may not update"), "{:?}", r);

    // A grants B (identity handed over as a file) and publishes the policy.

    let sp = a.policy_grant(id_b.clone(), None).unwrap();

    assert_eq!(sp.policy.serial, 2);

    let r = a.push("origin", false).unwrap();

    assert!(r.iter().any(|x| x.name == "policy" && x.ok), "{r:?}");

    // B must fetch the new policy before pushing.

    assert!(b.push("origin", false).unwrap_or_else(|e| vec![RefResult { name: "main".into(), ok: false, reason: e.to_string() }]).iter().all(|x| !x.ok));

    b.pull("origin").unwrap();

    assert_eq!(b.current_policy().unwrap().unwrap().1.policy.serial, 2);

    let r = b.push("origin", false).unwrap();

    assert!(r[0].ok, "{:?}", r);

    // Origin verified B's change under the policy.

    let heads = origin.bookmark_heads().unwrap();

    for h in &heads {

        let c = origin.store().get_change(h).unwrap();

        if c.author == key_b {

            origin.change_allowed(h, &origin.current_policy().unwrap().unwrap().1.policy, "main").unwrap();

        }

    }

    // A policy signed by a non-root (B) is refused, as is a replayed serial.

    let mut forged = b.current_policy().unwrap().unwrap().1.policy.clone();

    forged.serial = 3;

    forged.roots = vec![key_b];

    let fh = forged.hash();

    let (_, sk_b) = b.secret_key().unwrap().unwrap();

    let forged = SignedPolicy { policy: forged, sigs: vec![sk_b.sign(Domain::Policy, &key_b, &fh)] };

    let r = origin.receive_push(Bundle::default(), vec![], Some(forged)).unwrap();

    assert!(!r[0].ok && r[0].reason.contains("root"), "{:?}", r);

    let stale = a.current_policy().unwrap().unwrap().1;

    let mut old = stale.clone();

    old.policy.serial = 1;

    let r = origin.receive_push(Bundle::default(), vec![], Some(old)).unwrap();

    assert!(!r[0].ok && r[0].reason.contains("serial"), "{:?}", r);

    // A revokes B; after B pulls the policy, B's pushes are refused again.

    a.pull("origin").unwrap();

    a.policy_revoke(&key_b).unwrap();

    let r = a.push("origin", false).unwrap();

    assert!(r.iter().any(|x| x.name == "policy" && x.ok), "{r:?}");

    b.pull("origin").unwrap();

    write(&root.join("b"), "b.txt", b"b3\n");

    b.commit("b3", &[]).unwrap();

    let r = b.push("origin", false).unwrap();

    assert!(!r[0].ok, "{:?}", r);

    // A clone by a third party receives and verifies everything.

    let c = Repo::clone(&url, &root.join("c")).unwrap().with_home(root.join("home-c"));

    assert_eq!(c.current_policy().unwrap().unwrap().1.policy.serial, 3);

    assert!(c.current_policy().unwrap().unwrap().1.policy.roots.contains(&key_a));

    assert!(!c.snapshot("status").unwrap().changed);

}

        let (bundle, updates, policy) = wire::decode_push(&body)?;

        Ok(ok(wire::encode_push_response(&r.receive_push(bundle, updates, policy)?)))

| **Status** | Draft 0.6 |

domain  = "change" | "attest" | "policy"

- A repository without a `policy` reference is **unverified**; every command that talks to a remote MUST print a one-line warning until one is created. `oxy policy init` creates one with the author's key as the sole root; `oxy policy grant` and `oxy policy revoke` produce successors.

- **Propagation.** The `refs` response carries the current signed policy and a push MAY carry a newer one, applied before any bookmark update. A receiver accepts a policy only if it is for the same repository, its serial exceeds the current one, and it is signed by the current policy's root threshold; the first policy a repository ever sees vouches for itself.

- **Downgrade protection.** A client records the highest policy serial each remote has presented. A remote that later presents none, or a lower serial, is refused. A remote that has never presented a policy is unverified: the client fetches with a warning and cannot verify what it received. Policy signatures use the domain `policy` (§14.3).

- **Existing history.** A policy governs changes added after it. The receiver of a push checks the changes the new state adds beyond the state it already had, so history that predates the policy is not re-verified. A fetching client verifies the bookmark's attestation, which binds the whole state through its head hashes, and does not re-verify individual changes; it therefore trusts what an authorized attester vouched for, which is the point of the policy.

| Signed policy | `[policy bytes, [Signature]]` |

| `refs` response | `{0: [{0: name, 1: state ref, 2: [heads], 3: signed attestation or null, 4: last serial or null}], 1: repo id, 2: signed policy or null}`; the attestation is present only when it describes the current state |

| `push` request | `{0: Bundle, 1: [{0: name, 1: old state, 2: new state, 3: force, 4: signed attestation or null}], 2: signed policy or null}`; response `{0: [{0: name, 1: ok, 2: reason}]}`, where a result named `policy` reports the policy update |

*Changelog.* Draft 0.6 (2026-09-26): trust policy propagation over the wire, the `policy` signing domain, per-remote downgrade protection, the bootstrap rule for unverified remotes, and the rule that policies govern only changes added after them.