policy.rs 79.7%

322 of 404 lines run, 49 of 88 functions · run #342 on proposal/125 · run missed

//! Trust policy management and enforcement (spec §14.5).
//!
//! A repository with a policy verifies everything it receives: every change
//! must be authenticated by a key the policy authorizes for the bookmark,
//! every bookmark update must carry an attestation by such a key, and a new
//! policy must be signed by a threshold of the roots of the policy it replaces.

use super::*;
use crate::identity::SecretKey;
use crate::policy::{Policy, Require, Rule};
use crate::protocol::SignedPolicy;

/// One year, the default policy lifetime.
const POLICY_LIFETIME_MS: u64 = 365 * 24 * 60 * 60 * 1000;

/// A signed policy update: applied when it met the root threshold, else a
/// proposal carrying the signatures gathered so far (spec §14.5).
#[derive(Clone, Debug)]
pub struct PolicyUpdate {
    pub policy: Policy,
    pub sigs: Vec<Signature>,
    pub applied: bool,
}

impl PolicyUpdate {
    pub fn signed(&self) -> SignedPolicy {
        SignedPolicy {
            policy: self.policy.clone(),
            sigs: self.sigs.clone(),
        }
    }
}

impl Repo {
    /// The current policy and its signatures, if the repository has one.
    pub fn current_policy(&self) -> Result<Option<(ObjectRef, SignedPolicy)>> {
        let Some(r) = self.view()?.policy else {
            return Ok(None);
        };
        let policy = Policy::decode(&self.store.get_typed(&r, ObjectType::Policy)?)?;
        Ok(Some((
            r,
            SignedPolicy {
                policy,
                sigs: self.store.signatures(&r)?,
            },
        )))
    }

    /// Store a policy with its signatures and point the `policy` reference at it.
    pub(crate) fn set_policy(&self, sp: &SignedPolicy, command: &str) -> Result<ObjectRef> {
        let r = self.store.put(ObjectType::Policy, &sp.policy.encode())?;
        for sig in &sp.sigs {
            self.store.put_signature(&r, sig)?;
        }
        for id in &sp.policy.identities {
            self.store.put_identity(id)?;
        }
        let dir = self.oxy.join("policies");
        fs::create_dir_all(&dir)?;
        write_atomic(
            &dir.join(format!("{:020}", sp.policy.serial)),
            r.to_hex().as_bytes(),
        )?;
        let (op_ref, op) = self.head_op()?;
        if op.view.policy != Some(r) {
            let mut view = op.view.clone();
            view.policy = Some(r);
            self.record_op(&[op_ref], command, view)?;
        }
        Ok(r)
    }

    /// Every policy this repository has applied, ascending by serial, with
    /// its signatures. Policies applied before this index existed are
    /// missing from it, except the current one.
    pub fn policy_history(&self) -> Result<Vec<SignedPolicy>> {
        let mut out: BTreeMap<u64, SignedPolicy> = BTreeMap::new();
        if let Ok(rd) = fs::read_dir(self.oxy.join("policies")) {
            for e in rd.flatten() {
                let Ok(hex) = fs::read_to_string(e.path()) else {
                    continue;
                };
                let Some(r) = ObjectRef::from_hex(hex.trim()) else {
                    continue;
                };
                let Ok(bytes) = self.store.get_typed(&r, ObjectType::Policy) else {
                    continue;
                };
                let policy = Policy::decode(&bytes)?;
                out.insert(
                    policy.serial,
                    SignedPolicy {
                        policy,
                        sigs: self.store.signatures(&r)?,
                    },
                );
            }
        }
        if let Some((_, sp)) = self.current_policy()? {
            out.insert(sp.policy.serial, sp);
        }
        Ok(out.into_values().collect())
    }

    /// Verify and apply a chain of policies ending in `newest`, each
    /// against the one before it (spec §14.5). `chain` holds earlier
    /// policies in any order; only those after the current serial are used.
    pub(crate) fn adopt_policy_chain(
        &self,
        chain: &[SignedPolicy],
        newest: &SignedPolicy,
        command: &str,
    ) -> std::result::Result<(), String> {
        let mut current = self
            .current_policy()
            .map_err(|e| e.to_string())?
            .map(|(_, sp)| sp.policy);
        let mut steps: Vec<&SignedPolicy> = chain
            .iter()
            .filter(|sp| {
                current.as_ref().is_none_or(|c| sp.policy.serial > c.serial)
                    && sp.policy.serial < newest.policy.serial
            })
            .collect();
        steps.sort_by_key(|sp| sp.policy.serial);
        steps.push(newest);
        for sp in steps {
            self.check_policy(sp, current.as_ref())?;
            self.set_policy(
                sp,
                &format!("{command} (policy serial {})", sp.policy.serial),
            )
            .map_err(|e| e.to_string())?;
            current = Some(sp.policy.clone());
        }
        Ok(())
    }

    /// Validate an incoming policy against the one we trust (`None` when
    /// bootstrapping: the policy then vouches for itself).
    pub fn check_policy(
        &self,
        sp: &SignedPolicy,
        trusted: Option<&Policy>,
    ) -> std::result::Result<(), String> {
        if sp.policy.repo != self.id().map_err(|e| e.to_string())? {
            return Err("policy is for a different repository".into());
        }
        if let Some(t) = trusted {
            if sp.policy.serial <= t.serial {
                return Err(format!(
                    "policy serial {} is not greater than the current {}",
                    sp.policy.serial, t.serial
                ));
            }
        }
        match trusted {
            Some(t) => sp.policy.verify_signatures(&sp.sigs, t)?,
            None => vec![sp.policy.verify_bootstrap(&sp.sigs)?],
        };
        Ok(())
    }

    /// Sign `policy` with the configured key and apply it if the current
    /// policy's root threshold is met; otherwise return it as a proposal.
    fn sign_policy(&self, policy: Policy, command: &str) -> Result<PolicyUpdate> {
        let Some((key, sk)) = self.secret_key()? else {
            return fail("no secret key: run `oxy identity create` first");
        };
        self.sign_policy_with(policy, &[(key, &sk)], command)
    }

    /// Sign with every listed key; the first must be a root of the current
    /// policy (the others may be roots of the new policy only, so that a
    /// fresh clone can bootstrap from it).
    pub(crate) fn sign_policy_with(
        &self,
        policy: Policy,
        signers: &[(KeyId, &SecretKey)],
        command: &str,
    ) -> Result<PolicyUpdate> {
        let trusted = self
            .current_policy()?
            .map(|(_, sp)| sp.policy)
            .unwrap_or_else(|| policy.clone());
        if !signers
            .first()
            .is_some_and(|(k, _)| trusted.roots.contains(k))
        {
            return fail("your key is not a root key of the current policy");
        }
        let target = policy.hash();
        let sigs = signers
            .iter()
            .map(|(k, sk)| sk.sign(Domain::Policy, k, &target))
            .collect();
        self.gather(SignedPolicy { policy, sigs }, &trusted, command)
    }

    /// Apply `sp` when its signatures meet `trusted`'s threshold.
    fn gather(&self, sp: SignedPolicy, trusted: &Policy, command: &str) -> Result<PolicyUpdate> {
        let applied = sp.policy.verify_signatures(&sp.sigs, trusted).is_ok();
        if applied {
            self.set_policy(&sp, command)?;
        }
        Ok(PolicyUpdate {
            policy: sp.policy,
            sigs: sp.sigs,
            applied,
        })
    }

    /// Add your signature to a proposal made by another root holder; the
    /// policy is applied once the current root threshold is met.
    pub fn policy_sign(&self, proposal: SignedPolicy) -> Result<PolicyUpdate> {
        let Some((key, sk)) = self.secret_key()? else {
            return fail("no secret key: run `oxy identity create` first");
        };
        let Some((_, current)) = self.current_policy()? else {
            return fail("this repository has no policy; run `oxy policy init` or fetch one");
        };
        if proposal.policy.repo != self.id()? {
            return fail("the proposal is for a different repository");
        }
        if proposal.policy.serial <= current.policy.serial {
            return fail(format!(
                "the proposal's serial {} is not greater than the current {}",
                proposal.policy.serial, current.policy.serial
            ));
        }
        if !current.policy.roots.contains(&key) {
            return fail("your key is not a root key of the current policy");
        }
        let mut sigs: Vec<Signature> = proposal.sigs.into_iter().filter(|s| s.key != key).collect();
        sigs.push(sk.sign(Domain::Policy, &key, &proposal.policy.hash()));
        self.gather(
            SignedPolicy {
                policy: proposal.policy,
                sigs,
            },
            &current.policy,
            "oxy policy sign",
        )
    }

    /// Create the initial policy with the configured identity as sole root.
    pub fn policy_init(&self) -> Result<PolicyUpdate> {
        if self.current_policy()?.is_some() {
            return fail("this repository already has a policy");
        }
        let Some((key, _)) = self.secret_key()? else {
            return fail("no secret key: run `oxy identity create` first");
        };
        let identity = self.identity(&key)?;
        let policy = Policy::single_root(
            self.id()?,
            identity,
            Hlc::now().wall_ms + POLICY_LIFETIME_MS,
        );
        self.sign_policy(policy, "oxy policy init")
    }

    /// Make `identity` a root key.
    pub fn policy_root_add(&self, identity: Identity) -> Result<PolicyUpdate> {
        let mut p = self.next_policy()?;
        let key = identity.hash();
        if p.roots.contains(&key) {
            return fail(format!("{} is already a root", key.short(12)));
        }
        p.roots.push(key);
        p.roots.sort();
        p.revoked.retain(|k| k != &key);
        if p.identity(&key).is_none() {
            p.identities.push(identity);
        }
        self.sign_policy(p, &format!("oxy policy root add {}", key.short(12)))
    }

    /// Drop a root key; the remaining roots must still meet the threshold.
    pub fn policy_root_remove(&self, key: &KeyId) -> Result<PolicyUpdate> {
        let mut p = self.next_policy()?;
        if !p.roots.contains(key) {
            return fail(format!("{} is not a root", key.short(12)));
        }
        p.roots.retain(|k| k != key);
        if (p.roots.len() as u32) < p.root_threshold {
            return fail(format!(
                "removing it would leave {} root(s) for a threshold of {}",
                p.roots.len(),
                p.root_threshold
            ));
        }
        self.sign_policy(p, &format!("oxy policy root remove {}", key.short(12)))
    }

    /// Require `n` root signatures on future policy updates.
    pub fn policy_set_threshold(&self, n: u32) -> Result<PolicyUpdate> {
        let mut p = self.next_policy()?;
        if n == 0 || n as usize > p.roots.len() {
            return fail(format!(
                "the threshold must be between 1 and the number of roots ({})",
                p.roots.len()
            ));
        }
        p.root_threshold = n;
        self.sign_policy(p, &format!("oxy policy root threshold {n}"))
    }

    pub(crate) fn next_policy(&self) -> Result<Policy> {
        let Some((_, sp)) = self.current_policy()? else {
            return fail("this repository has no policy; run `oxy policy init`");
        };
        let mut p = sp.policy;
        p.serial += 1;
        p.expires = Hlc::now().wall_ms + POLICY_LIFETIME_MS;
        Ok(p)
    }

    /// Let `identity` update references matching `pattern` (default every reference).
    pub fn policy_grant(&self, identity: Identity, pattern: Option<&str>) -> Result<PolicyUpdate> {
        let mut p = self.next_policy()?;
        let key = identity.hash();
        let pattern = pattern.unwrap_or("*");
        p.revoked.retain(|k| k != &key);
        match p.rules.iter_mut().find(|r| r.pattern == pattern) {
            Some(rule) => {
                if !rule.keys.contains(&key) {
                    rule.keys.push(key);
                    rule.keys.sort();
                }
            }
            None => p.rules.push(Rule {
                pattern: pattern.into(),
                keys: vec![key],
                threshold: 1,
                require: Require::Any,
                allow_conflicts: true,
                subjects: vec![],
            }),
        }
        if p.identity(&key).is_none() {
            p.identities.push(identity);
        }
        self.sign_policy(p, &format!("oxy policy grant {}", key.short(12)))
    }

    /// Let holders of certificates `issuer` gives, for subjects matching
    /// `subject`, sign within `scope` on `pattern` (default every
    /// bookmark; §14.7). The issuer's identity is embedded so verifiers need
    /// no fetch.
    pub fn policy_grant_subject(
        &self,
        subject: &str,
        issuer: Identity,
        scope: crate::identity::Scope,
        pattern: Option<&str>,
    ) -> Result<PolicyUpdate> {
        if subject.trim().is_empty() {
            return fail("a subject pattern is needed, such as repo:OWNER/NAME:bookmark:main");
        }
        let mut p = self.next_policy()?;
        let key = issuer.hash();
        let pattern = pattern.unwrap_or("*");
        let grant = crate::policy::SubjectGrant {
            pattern: subject.into(),
            issuer: key,
            scope,
        };
        match p.rules.iter_mut().find(|r| r.pattern == pattern) {
            Some(rule) => {
                rule.subjects
                    .retain(|g| !(g.pattern == grant.pattern && g.issuer == grant.issuer));
                rule.subjects.push(grant);
            }
            None => p.rules.push(Rule {
                pattern: pattern.into(),
                keys: vec![],
                threshold: 1,
                require: Require::Any,
                allow_conflicts: true,
                subjects: vec![grant],
            }),
        }
        if p.identity(&key).is_none() {
            p.identities.push(issuer);
        }
        self.sign_policy(p, &format!("oxy policy grant-subject {subject}"))
    }

    /// Revoke `key`: it may no longer update anything, and existing rules
    /// drop it. A root key can be revoked by another root as long as the
    /// remaining roots still meet the threshold.
    pub fn policy_revoke(&self, key: &KeyId) -> Result<PolicyUpdate> {
        let mut p = self.next_policy()?;
        if p.roots.contains(key) {
            let own = self.secret_key()?.map(|(k, _)| k);
            if own == Some(*key) {
                return fail("a root cannot revoke itself; have another root revoke it, or remove it with `oxy policy root remove` first");
            }
            p.roots.retain(|k| k != key);
            if (p.roots.len() as u32) < p.root_threshold {
                return fail(format!(
                    "revoking it would leave {} root(s) for a threshold of {}",
                    p.roots.len(),
                    p.root_threshold
                ));
            }
        }
        for r in &mut p.rules {
            r.keys.retain(|k| k != key);
        }
        // A rule of certified subjects alone stays.
        p.rules
            .retain(|r| !r.keys.is_empty() || !r.subjects.is_empty());
        if !p.revoked.contains(key) {
            p.revoked.push(*key);
            p.revoked.sort();
        }
        self.sign_policy(p, &format!("oxy policy revoke {}", key.short(12)))
    }

    /// Whether `change` may be part of `reference` under `policy`: it must be
    /// authenticated (by its author or a delegate) with a key the matching
    /// rule lists, using the authenticator kind the rule requires. A rule key
    /// covers its rotation predecessors, and a delegate's signature counts
    /// for the author it acts for.
    pub fn change_allowed(
        &self,
        hash: &ChangeHash,
        policy: &Policy,
        reference: &str,
    ) -> std::result::Result<(), String> {
        let rule = policy
            .rule_for(reference)
            .ok_or_else(|| format!("no policy rule matches {reference:?}"))?;
        match self.authenticate_change(hash).map_err(|e| e.to_string())? {
            SignatureStatus::Valid { key, sealed, .. } => {
                if policy.is_revoked(&key) {
                    return Err(format!(
                        "change {} is signed by revoked key {}",
                        hash.short(12),
                        key.short(12)
                    ));
                }
                let author = self
                    .store
                    .get_change(hash)
                    .map(|c| c.author)
                    .map_err(|e| e.to_string())?;
                let principal = if author.is_zero() { key } else { author };
                // A change is checked when it is received: now is a time
                // its signer did not choose.
                let covered = rule
                    .keys
                    .iter()
                    .any(|k| policy.succeeds(k, &key) || policy.succeeds(k, &principal))
                    || self.certified_authorized(
                        policy,
                        &key,
                        reference,
                        crate::identity::Scope::CHANGES,
                        crate::objects::Hlc::now().wall_ms,
                    );
                if !covered {
                    return Err(format!(
                        "change {} is signed by {}, which may not update {reference:?}",
                        hash.short(12),
                        key.short(12)
                    ));
                }
                match (rule.require, sealed) {
                    (Require::Signed, true) => Err(format!(
                        "{reference:?} requires individually signed changes; {} is only sealed",
                        hash.short(12)
                    )),
                    (Require::Sealed, false) => Err(format!(
                        "{reference:?} requires sealed changes; {} is individually signed",
                        hash.short(12)
                    )),
                    _ => Ok(()),
                }
            }
            SignatureStatus::Unsigned => {
                Err(format!("change {} is not signed or sealed", hash.short(12)))
            }
            SignatureStatus::Invalid(e) => Err(format!("change {}: {e}", hash.short(12))),
        }
    }

    /// Check every change that `new` adds over `old` for `reference`.
    pub(crate) fn state_allowed(
        &self,
        old_heads: &[ChangeHash],
        new_heads: &[ChangeHash],
        policy: &Policy,
        reference: &str,
    ) -> std::result::Result<(), String> {
        let added = self
            .negotiate(old_heads, new_heads)
            .map_err(|e| e.to_string())?;
        for h in &added {
            self.change_allowed(h, policy, reference)?;
        }
        if let Some(rule) = policy.rule_for(reference) {
            if !rule.allow_conflicts && !added.is_empty() {
                let st = self.load_state(new_heads).map_err(|e| e.to_string())?;
                if st.materialize().is_conflicted() {
                    return Err(format!("{reference:?} does not allow conflicted states"));
                }
            }
        }
        Ok(())
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Trust policy management and enforcement (spec §14.5).
2		//!
3		//! A repository with a policy verifies everything it receives: every change
4		//! must be authenticated by a key the policy authorizes for the bookmark,
5		//! every bookmark update must carry an attestation by such a key, and a new
6		//! policy must be signed by a threshold of the roots of the policy it replaces.
7
8		use super::*;
9		use crate::identity::SecretKey;
10		use crate::policy::{Policy, Require, Rule};
11		use crate::protocol::SignedPolicy;
12
13		/// One year, the default policy lifetime.
14		const POLICY_LIFETIME_MS: u64 = 365 * 24 * 60 * 60 * 1000;
15
16		/// A signed policy update: applied when it met the root threshold, else a
17		/// proposal carrying the signatures gathered so far (spec §14.5).
18		#[derive(Clone, Debug)]
19		pub struct PolicyUpdate {
20		pub policy: Policy,
21		pub sigs: Vec<Signature>,
22		pub applied: bool,
23		}
24
25		impl PolicyUpdate {
26	3×	pub fn signed(&self) -> SignedPolicy {
27	3×	SignedPolicy {
28	3×	policy: self.policy.clone(),
29	3×	sigs: self.sigs.clone(),
30	3×	}
31	3×	}
32		}
33
34		impl Repo {
35		/// The current policy and its signatures, if the repository has one.
36	3684×	pub fn current_policy(&self) -> Result<Option<(ObjectRef, SignedPolicy)>> {
37	3684×	let Some(r) = self.view()?.policy else {
38	3273×	return Ok(None);
39		};
40	411×	let policy = Policy::decode(&self.store.get_typed(&r, ObjectType::Policy)?)?;
41		Ok(Some((
42	411×	r,
43		SignedPolicy {
44	411×	policy,
45	411×	sigs: self.store.signatures(&r)?,
46		},
47		)))
48	3684×	}
49
50		/// Store a policy with its signatures and point the `policy` reference at it.
51	82×	pub(crate) fn set_policy(&self, sp: &SignedPolicy, command: &str) -> Result<ObjectRef> {
52	82×	let r = self.store.put(ObjectType::Policy, &sp.policy.encode())?;
53	106×	for sig in &sp.sigs {
54	106×	self.store.put_signature(&r, sig)?;
55		}
56	175×	for id in &sp.policy.identities {
57	175×	self.store.put_identity(id)?;
58		}
59	82×	let dir = self.oxy.join("policies");
60	82×	fs::create_dir_all(&dir)?;
61	82×	write_atomic(
62	82×	&dir.join(format!("{:020}", sp.policy.serial)),
63	82×	r.to_hex().as_bytes(),
64	0×	)?;
65	82×	let (op_ref, op) = self.head_op()?;
66	82×	if op.view.policy != Some(r) {
67	82×	let mut view = op.view.clone();
68	82×	view.policy = Some(r);
69	82×	self.record_op(&[op_ref], command, view)?;
70	0×	}
71	82×	Ok(r)
72	82×	}
73
74		/// Every policy this repository has applied, ascending by serial, with
75		/// its signatures. Policies applied before this index existed are
76		/// missing from it, except the current one.
77	1048×	pub fn policy_history(&self) -> Result<Vec<SignedPolicy>> {
78	1048×	let mut out: BTreeMap<u64, SignedPolicy> = BTreeMap::new();
79	1048×	if let Ok(rd) = fs::read_dir(self.oxy.join("policies")) {
80	176×	for e in rd.flatten() {
81	176×	let Ok(hex) = fs::read_to_string(e.path()) else {
82	0×	continue;
83		};
84	176×	let Some(r) = ObjectRef::from_hex(hex.trim()) else {
85	0×	continue;
86		};
87	176×	let Ok(bytes) = self.store.get_typed(&r, ObjectType::Policy) else {
88	0×	continue;
89		};
90	176×	let policy = Policy::decode(&bytes)?;
91	176×	out.insert(
92	176×	policy.serial,
93		SignedPolicy {
94	176×	policy,
95	176×	sigs: self.store.signatures(&r)?,
96		},
97		);
98		}
99	966×	}
100	1048×	if let Some((_, sp)) = self.current_policy()? {
101	82×	out.insert(sp.policy.serial, sp);
102	966×	}
103	1048×	Ok(out.into_values().collect())
104	1048×	}
105
106		/// Verify and apply a chain of policies ending in `newest`, each
107		/// against the one before it (spec §14.5). `chain` holds earlier
108		/// policies in any order; only those after the current serial are used.
109	40×	pub(crate) fn adopt_policy_chain(
110	40×	&self,
111	40×	chain: &[SignedPolicy],
112	40×	newest: &SignedPolicy,
113	40×	command: &str,
114	40×	) -> std::result::Result<(), String> {
115	40×	let mut current = self
116	40×	.current_policy()
117	40×	.map_err(\|e\| e.to_string())?
118	40×	.map(\|(_, sp)\| sp.policy);
119	40×	let mut steps: Vec<&SignedPolicy> = chain
120	40×	.iter()
121	40×	.filter(\|sp\| {
122	27×	current.as_ref().is_none_or(\|c\| sp.policy.serial > c.serial)
123	16×	&& sp.policy.serial < newest.policy.serial
124	27×	})
125	40×	.collect();
126	40×	steps.sort_by_key(\|sp\| sp.policy.serial);
127	40×	steps.push(newest);
128	56×	for sp in steps {
129	56×	self.check_policy(sp, current.as_ref())?;
130	54×	self.set_policy(
131	54×	sp,
132	54×	&format!("{command} (policy serial {})", sp.policy.serial),
133		)
134	54×	.map_err(\|e\| e.to_string())?;
135	54×	current = Some(sp.policy.clone());
136		}
137	38×	Ok(())
138	40×	}
139
140		/// Validate an incoming policy against the one we trust (`None` when
141		/// bootstrapping: the policy then vouches for itself).
142	56×	pub fn check_policy(
143	56×	&self,
144	56×	sp: &SignedPolicy,
145	56×	trusted: Option<&Policy>,
146	56×	) -> std::result::Result<(), String> {
147	56×	if sp.policy.repo != self.id().map_err(\|e\| e.to_string())? {
148	0×	return Err("policy is for a different repository".into());
149	56×	}
150	56×	if let Some(t) = trusted {
151	35×	if sp.policy.serial <= t.serial {
152	1×	return Err(format!(
153	1×	"policy serial {} is not greater than the current {}",
154	1×	sp.policy.serial, t.serial
155	1×	));
156	34×	}
157	21×	}
158	55×	match trusted {
159	34×	Some(t) => sp.policy.verify_signatures(&sp.sigs, t)?,
160	21×	None => vec![sp.policy.verify_bootstrap(&sp.sigs)?],
161		};
162	54×	Ok(())
163	56×	}
164
165		/// Sign `policy` with the configured key and apply it if the current
166		/// policy's root threshold is met; otherwise return it as a proposal.
167	20×	fn sign_policy(&self, policy: Policy, command: &str) -> Result<PolicyUpdate> {
168	20×	let Some((key, sk)) = self.secret_key()? else {
169	0×	return fail("no secret key: run `oxy identity create` first");
170		};
171	20×	self.sign_policy_with(policy, &[(key, &sk)], command)
172	20×	}
173
174		/// Sign with every listed key; the first must be a root of the current
175		/// policy (the others may be roots of the new policy only, so that a
176		/// fresh clone can bootstrap from it).
177	28×	pub(crate) fn sign_policy_with(
178	28×	&self,
179	28×	policy: Policy,
180	28×	signers: &[(KeyId, &SecretKey)],
181	28×	command: &str,
182	28×	) -> Result<PolicyUpdate> {
183	28×	let trusted = self
184	28×	.current_policy()?
185	28×	.map(\|(_, sp)\| sp.policy)
186	28×	.unwrap_or_else(\|\| policy.clone());
187	28×	if !signers
188	28×	.first()
189	28×	.is_some_and(\|(k, _)\| trusted.roots.contains(k))
190		{
191	0×	return fail("your key is not a root key of the current policy");
192	28×	}
193	28×	let target = policy.hash();
194	28×	let sigs = signers
195	28×	.iter()
196	36×	.map(\|(k, sk)\| sk.sign(Domain::Policy, k, &target))
197	28×	.collect();
198	28×	self.gather(SignedPolicy { policy, sigs }, &trusted, command)
199	28×	}
200
201		/// Apply `sp` when its signatures meet `trusted`'s threshold.
202	30×	fn gather(&self, sp: SignedPolicy, trusted: &Policy, command: &str) -> Result<PolicyUpdate> {
203	30×	let applied = sp.policy.verify_signatures(&sp.sigs, trusted).is_ok();
204	30×	if applied {
205	28×	self.set_policy(&sp, command)?;
206	2×	}
207	30×	Ok(PolicyUpdate {
208	30×	policy: sp.policy,
209	30×	sigs: sp.sigs,
210	30×	applied,
211	30×	})
212	30×	}
213
214		/// Add your signature to a proposal made by another root holder; the
215		/// policy is applied once the current root threshold is met.
216	3×	pub fn policy_sign(&self, proposal: SignedPolicy) -> Result<PolicyUpdate> {
217	3×	let Some((key, sk)) = self.secret_key()? else {
218	0×	return fail("no secret key: run `oxy identity create` first");
219		};
220	3×	let Some((_, current)) = self.current_policy()? else {
221	0×	return fail("this repository has no policy; run `oxy policy init` or fetch one");
222		};
223	3×	if proposal.policy.repo != self.id()? {
224	0×	return fail("the proposal is for a different repository");
225	3×	}
226	3×	if proposal.policy.serial <= current.policy.serial {
227	1×	return fail(format!(
228		"the proposal's serial {} is not greater than the current {}",
229		proposal.policy.serial, current.policy.serial
230		));
231	2×	}
232	2×	if !current.policy.roots.contains(&key) {
233	0×	return fail("your key is not a root key of the current policy");
234	2×	}
235	2×	let mut sigs: Vec<Signature> = proposal.sigs.into_iter().filter(\|s\| s.key != key).collect();
236	2×	sigs.push(sk.sign(Domain::Policy, &key, &proposal.policy.hash()));
237	2×	self.gather(
238	2×	SignedPolicy {
239	2×	policy: proposal.policy,
240	2×	sigs,
241	2×	},
242	2×	&current.policy,
243	2×	"oxy policy sign",
244		)
245	3×	}
246
247		/// Create the initial policy with the configured identity as sole root.
248	11×	pub fn policy_init(&self) -> Result<PolicyUpdate> {
249	11×	if self.current_policy()?.is_some() {
250	0×	return fail("this repository already has a policy");
251	11×	}
252	11×	let Some((key, _)) = self.secret_key()? else {
253	0×	return fail("no secret key: run `oxy identity create` first");
254		};
255	11×	let identity = self.identity(&key)?;
256	11×	let policy = Policy::single_root(
257	11×	self.id()?,
258	11×	identity,
259	11×	Hlc::now().wall_ms + POLICY_LIFETIME_MS,
260		);
261	11×	self.sign_policy(policy, "oxy policy init")
262	11×	}
263
264		/// Make `identity` a root key.
265	2×	pub fn policy_root_add(&self, identity: Identity) -> Result<PolicyUpdate> {
266	2×	let mut p = self.next_policy()?;
267	2×	let key = identity.hash();
268	2×	if p.roots.contains(&key) {
269	1×	return fail(format!("{} is already a root", key.short(12)));
270	1×	}
271	1×	p.roots.push(key);
272	1×	p.roots.sort();
273	1×	p.revoked.retain(\|k\| k != &key);
274	1×	if p.identity(&key).is_none() {
275	1×	p.identities.push(identity);
276	1×	}
277	1×	self.sign_policy(p, &format!("oxy policy root add {}", key.short(12)))
278	2×	}
279
280		/// Drop a root key; the remaining roots must still meet the threshold.
281	0×	pub fn policy_root_remove(&self, key: &KeyId) -> Result<PolicyUpdate> {
282	0×	let mut p = self.next_policy()?;
283	0×	if !p.roots.contains(key) {
284	0×	return fail(format!("{} is not a root", key.short(12)));
285	0×	}
286	0×	p.roots.retain(\|k\| k != key);
287	0×	if (p.roots.len() as u32) < p.root_threshold {
288	0×	return fail(format!(
289		"removing it would leave {} root(s) for a threshold of {}",
290	0×	p.roots.len(),
291		p.root_threshold
292		));
293	0×	}
294	0×	self.sign_policy(p, &format!("oxy policy root remove {}", key.short(12)))
295	0×	}
296
297		/// Require `n` root signatures on future policy updates.
298	2×	pub fn policy_set_threshold(&self, n: u32) -> Result<PolicyUpdate> {
299	2×	let mut p = self.next_policy()?;
300	2×	if n == 0 \|\| n as usize > p.roots.len() {
301	1×	return fail(format!(
302		"the threshold must be between 1 and the number of roots ({})",
303	1×	p.roots.len()
304		));
305	1×	}
306	1×	p.root_threshold = n;
307	1×	self.sign_policy(p, &format!("oxy policy root threshold {n}"))
308	2×	}
309
310	21×	pub(crate) fn next_policy(&self) -> Result<Policy> {
311	21×	let Some((_, sp)) = self.current_policy()? else {
312	0×	return fail("this repository has no policy; run `oxy policy init`");
313		};
314	21×	let mut p = sp.policy;
315	21×	p.serial += 1;
316	21×	p.expires = Hlc::now().wall_ms + POLICY_LIFETIME_MS;
317	21×	Ok(p)
318	21×	}
319
320		/// Let `identity` update references matching `pattern` (default every reference).
321	2×	pub fn policy_grant(&self, identity: Identity, pattern: Option<&str>) -> Result<PolicyUpdate> {
322	2×	let mut p = self.next_policy()?;
323	2×	let key = identity.hash();
324	2×	let pattern = pattern.unwrap_or("*");
325	2×	p.revoked.retain(\|k\| k != &key);
326	2×	match p.rules.iter_mut().find(\|r\| r.pattern == pattern) {
327	2×	Some(rule) => {
328	2×	if !rule.keys.contains(&key) {
329	2×	rule.keys.push(key);
330	2×	rule.keys.sort();
331	2×	}
332		}
333	0×	None => p.rules.push(Rule {
334	0×	pattern: pattern.into(),
335	0×	keys: vec![key],
336	0×	threshold: 1,
337	0×	require: Require::Any,
338	0×	allow_conflicts: true,
339	0×	subjects: vec![],
340	0×	}),
341		}
342	2×	if p.identity(&key).is_none() {
343	2×	p.identities.push(identity);
344	2×	}
345	2×	self.sign_policy(p, &format!("oxy policy grant {}", key.short(12)))
346	2×	}
347
348		/// Let holders of certificates `issuer` gives, for subjects matching
349		/// `subject`, sign within `scope` on `pattern` (default every
350		/// bookmark; §14.7). The issuer's identity is embedded so verifiers need
351		/// no fetch.
352	3×	pub fn policy_grant_subject(
353	3×	&self,
354	3×	subject: &str,
355	3×	issuer: Identity,
356	3×	scope: crate::identity::Scope,
357	3×	pattern: Option<&str>,
358	3×	) -> Result<PolicyUpdate> {
359	3×	if subject.trim().is_empty() {
360	0×	return fail("a subject pattern is needed, such as repo:OWNER/NAME:bookmark:main");
361	3×	}
362	3×	let mut p = self.next_policy()?;
363	3×	let key = issuer.hash();
364	3×	let pattern = pattern.unwrap_or("*");
365	3×	let grant = crate::policy::SubjectGrant {
366	3×	pattern: subject.into(),
367	3×	issuer: key,
368	3×	scope,
369	3×	};
370	3×	match p.rules.iter_mut().find(\|r\| r.pattern == pattern) {
371	3×	Some(rule) => {
372	3×	rule.subjects
373	3×	.retain(\|g\| !(g.pattern == grant.pattern && g.issuer == grant.issuer));
374	3×	rule.subjects.push(grant);
375		}
376	0×	None => p.rules.push(Rule {
377	0×	pattern: pattern.into(),
378	0×	keys: vec![],
379	0×	threshold: 1,
380	0×	require: Require::Any,
381	0×	allow_conflicts: true,
382	0×	subjects: vec![grant],
383	0×	}),
384		}
385	3×	if p.identity(&key).is_none() {
386	3×	p.identities.push(issuer);
387	3×	}
388	3×	self.sign_policy(p, &format!("oxy policy grant-subject {subject}"))
389	3×	}
390
391		/// Revoke `key`: it may no longer update anything, and existing rules
392		/// drop it. A root key can be revoked by another root as long as the
393		/// remaining roots still meet the threshold.
394	4×	pub fn policy_revoke(&self, key: &KeyId) -> Result<PolicyUpdate> {
395	4×	let mut p = self.next_policy()?;
396	4×	if p.roots.contains(key) {
397	2×	let own = self.secret_key()?.map(\|(k, _)\| k);
398	2×	if own == Some(*key) {
399	1×	return fail("a root cannot revoke itself; have another root revoke it, or remove it with `oxy policy root remove` first");
400	1×	}
401	2×	p.roots.retain(\|k\| k != key);
402	1×	if (p.roots.len() as u32) < p.root_threshold {
403	1×	return fail(format!(
404		"revoking it would leave {} root(s) for a threshold of {}",
405	1×	p.roots.len(),
406		p.root_threshold
407		));
408	0×	}
409	2×	}
410	2×	for r in &mut p.rules {
411	4×	r.keys.retain(\|k\| k != key);
412		}
413		// A rule of certified subjects alone stays.
414	2×	p.rules
415	2×	.retain(\|r\| !r.keys.is_empty() \|\| !r.subjects.is_empty());
416	2×	if !p.revoked.contains(key) {
417	2×	p.revoked.push(*key);
418	2×	p.revoked.sort();
419	2×	}
420	2×	self.sign_policy(p, &format!("oxy policy revoke {}", key.short(12)))
421	4×	}
422
423		/// Whether `change` may be part of `reference` under `policy`: it must be
424		/// authenticated (by its author or a delegate) with a key the matching
425		/// rule lists, using the authenticator kind the rule requires. A rule key
426		/// covers its rotation predecessors, and a delegate's signature counts
427		/// for the author it acts for.
428	21×	pub fn change_allowed(
429	21×	&self,
430	21×	hash: &ChangeHash,
431	21×	policy: &Policy,
432	21×	reference: &str,
433	21×	) -> std::result::Result<(), String> {
434	21×	let rule = policy
435	21×	.rule_for(reference)
436	21×	.ok_or_else(\|\| format!("no policy rule matches {reference:?}"))?;
437	21×	match self.authenticate_change(hash).map_err(\|e\| e.to_string())? {
438	21×	SignatureStatus::Valid { key, sealed, .. } => {
439	21×	if policy.is_revoked(&key) {
440	0×	return Err(format!(
441	0×	"change {} is signed by revoked key {}",
442	0×	hash.short(12),
443	0×	key.short(12)
444	0×	));
445	21×	}
446	21×	let author = self
447	21×	.store
448	21×	.get_change(hash)
449	21×	.map(\|c\| c.author)
450	21×	.map_err(\|e\| e.to_string())?;
451	21×	let principal = if author.is_zero() { key } else { author };
452		// A change is checked when it is received: now is a time
453		// its signer did not choose.
454	21×	let covered = rule
455	21×	.keys
456	21×	.iter()
457	21×	.any(\|k\| policy.succeeds(k, &key) \|\| policy.succeeds(k, &principal))
458	1×	\|\| self.certified_authorized(
459	1×	policy,
460	1×	&key,
461	1×	reference,
462		crate::identity::Scope::CHANGES,
463	1×	crate::objects::Hlc::now().wall_ms,
464		);
465	21×	if !covered {
466	0×	return Err(format!(
467	0×	"change {} is signed by {}, which may not update {reference:?}",
468	0×	hash.short(12),
469	0×	key.short(12)
470	0×	));
471	21×	}
472	21×	match (rule.require, sealed) {
473	0×	(Require::Signed, true) => Err(format!(
474	0×	"{reference:?} requires individually signed changes; {} is only sealed",
475	0×	hash.short(12)
476	0×	)),
477	0×	(Require::Sealed, false) => Err(format!(
478	0×	"{reference:?} requires sealed changes; {} is individually signed",
479	0×	hash.short(12)
480	0×	)),
481	21×	_ => Ok(()),
482		}
483		}
484		SignatureStatus::Unsigned => {
485	0×	Err(format!("change {} is not signed or sealed", hash.short(12)))
486		}
487	0×	SignatureStatus::Invalid(e) => Err(format!("change {}: {e}", hash.short(12))),
488		}
489	21×	}
490
491		/// Check every change that `new` adds over `old` for `reference`.
492	30×	pub(crate) fn state_allowed(
493	30×	&self,
494	30×	old_heads: &[ChangeHash],
495	30×	new_heads: &[ChangeHash],
496	30×	policy: &Policy,
497	30×	reference: &str,
498	30×	) -> std::result::Result<(), String> {
499	30×	let added = self
500	30×	.negotiate(old_heads, new_heads)
501	30×	.map_err(\|e\| e.to_string())?;
502	30×	for h in &added {
503	20×	self.change_allowed(h, policy, reference)?;
504		}
505	30×	if let Some(rule) = policy.rule_for(reference) {
506	30×	if !rule.allow_conflicts && !added.is_empty() {
507	0×	let st = self.load_state(new_heads).map_err(\|e\| e.to_string())?;
508	0×	if st.materialize().is_conflicted() {
509	0×	return Err(format!("{reference:?} does not allow conflicted states"));
510	0×	}
511	30×	}
512	0×	}
513	30×	Ok(())
514	30×	}
515		}

Coverage / crates/oxy-core/src/repo/policy.rs 79.7%

Keyboard