A stale author.key can no longer fork the identity (closes #163) aded4110f0bd

## Unreleased

- **Fixed: a stale `author.key` can no longer fork your identity (#163).** A checkout that pinned `author.key` to a key a rotation made elsewhere had already succeeded built a second successor of it on `oxy identity delegate add`, splitting the identity in two. `rotate`, `renew` and `delegate add`/`remove` now refuse to start from a key that already has a successor in your home, naming the newest key and the `oxy config` that points at it; their report says which key they started from and which config named it; and `oxy identity show` warns when the configured key is not the newest, and names the key where an identity forks.

        // A key that already has a successor is not the identity's newest:

        // building another from it forks the identity into two branches

        // (oxygen#163), as a checkout whose stale `author.key` pin outlived

        // a rotation made elsewhere once did.

        if let Some(newer) = self.successors(&old)?.into_iter().next() {

            let newest = self.newest(&newer)?;

            let fix = if self.config.is_repo_set("author.key") {

                format!(

                    "This repository's config pins author.key to the older key: `oxy config author.key {}` here \

                     (or `oxy config --unset author.key` to follow the user config), then run it again.",

                    newest.to_hex()

                )

            } else {

                format!(

                    "The user config names the older key: `oxy config --user author.key {}`, then run it again.",

                    newest.to_hex()

                )

            };

            return fail(format!(

                "`{command}` would start from key {}, which is not your identity's newest ({} succeeds it, and {} is the newest). \

                 Another successor would fork the identity into two branches.\n{fix}",

                old.short(12),

                newer.short(12),

                newest.short(12),

            ));

        }

    }

    /// Keys in this home whose identity names `key` as `previous`: the

    /// successors already made from it. More than one means a fork.

    pub fn successors(&self, key: &KeyId) -> Result<Vec<KeyId>> {

        let mut found = Vec::new();

        let entries = match fs::read_dir(&self.keys_dir) {

            Ok(e) => e,

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(found),

            Err(e) => return Err(e.into()),

        };

        for entry in entries {

            let path = entry?.path();

            if path.extension().and_then(|e| e.to_str()) != Some("identity") {

                continue;

            }

            let Ok(bytes) = fs::read(&path) else { continue };

            let Ok(id) = Identity::decode(&bytes) else {

                continue;

            };

            if id.previous == Some(*key) {

                found.push(id.hash());

            }

        }

        found.sort();

        Ok(found)

    }

    /// The newest key of the line through `key` in this home: its

    /// successors followed to the end (the first, where there is a fork).

    pub fn newest(&self, key: &KeyId) -> Result<KeyId> {

        let mut cur = *key;

        for _ in 0..256 {

            match self.successors(&cur)?.into_iter().next() {

                Some(next) => cur = next,

                None => break,

            }

        }

        Ok(cur)

#[test]

fn a_stale_pinned_key_cannot_fork_the_identity() {

    // oxygen#163: a checkout pinned author.key to a key that a rotation made

    // elsewhere had already succeeded; delegating there built a second

    // successor of it, splitting the identity in two.

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let home = root.join("home");

    let mut a = Repo::init(&root.join("a")).unwrap().with_home(&home);

    let (first, _) = a

        .create_identity("Ada", "[email protected]", IdentityScope::User)

        .unwrap();

    let r = a.rotate_identity().unwrap();

    assert_eq!((r.old, a.config.author_key), (first, Some(r.new)));

    assert_eq!(a.successors(&first).unwrap(), vec![r.new]);

    assert_eq!(a.newest(&first).unwrap(), r.new);

    // Another checkout still pins the first key.

    let mut b = Repo::init(&root.join("b")).unwrap().with_home(&home);

    b.config.set("author.key", &first.to_hex()).unwrap();

    b.save_config().unwrap();

    let mut b = Repo::open(&root.join("b")).unwrap().with_home(&home);

    assert_eq!(b.config.author_key, Some(first));

    for e in [

        b.rotate_identity().unwrap_err().to_string(),

        b.renew_identity(None).unwrap_err().to_string(),

    ] {

        assert!(e.contains("fork") && e.contains(&r.new.short(12)), "{e}");

        assert!(

            e.contains(&format!("oxy config author.key {}", r.new.to_hex())),

            "{e}"

        );

    }

    assert_eq!(

        b.successors(&first).unwrap(),

        vec![r.new],

        "nothing was made"

    );

    // Pointed at the newest key, it rotates as usual.

    b.config.set("author.key", &r.new.to_hex()).unwrap();

    b.save_config().unwrap();

    let mut b = Repo::open(&root.join("b")).unwrap().with_home(&home);

    let r2 = b.rotate_identity().unwrap();

    assert_eq!(r2.old, r.new);

    assert_eq!(b.newest(&first).unwrap(), r2.new);

}

    // Which key it started from, and where that came from (oxygen#163).

    let from = if repo.config.is_repo_set("author.key") {

        "this repository's author.key"

    } else {

        "the user config's author.key"

    };

    println!(

        "{}",

        ui::kv(

            "old key",

            format!(

                "{} {}",

                ui::dim(r.old.to_hex()),

                ui::dim(format!("(from {from})"))

            )

        )

    );

                ))

            );

        }

    }

    // A key with a successor is stale, and a key with two is a fork: both

    // are how an identity splits without anyone noticing (oxygen#163).

    let next = repo.successors(&key)?;

    if let Some(n) = next.first() {

        println!(

            "  {} {}",

            ui::caution(),

            ui::warn(format!(

                "this key is not your identity's newest: {} succeeds it, {} is the newest. Rotating or delegating from it would fork the identity; point author.key at the newest",

                n.short(12),

                repo.newest(n)?.short(12)

            ))

        );

    }

    let mut cur = Some(key);

    for _ in 0..256 {

        let Some(k) = cur else { break };

        let after = repo.successors(&k)?;

        if after.len() > 1 {

            println!(

                "  {} {}",

                ui::caution(),

                ui::err(format!(

                    "the identity forks at {}: {} each succeed it. Keep one branch: revoke the others' keys (oxy identity revoke KEY) and point every home's author.key at the one you keep",

                    k.short(12),

                    after.iter().map(|a| a.short(12)).collect::<Vec<_>>().join(" and ")

            break;

        cur = repo.identity(&k).ok().and_then(|i| i.previous);