Approval gates in the pipeline: approval { by; others-only; expires } e20897216221

    // Approval as [by, others-only, expires seconds]; absent without one.

    if let Some(a) = &j.approval {

        fields.push((11, Value::Array(vec![text(&a.by), Value::Bool(a.others_only), Value::Uint(a.expires_s)])));

    }

    arch_ok, egress_allows, egress_pattern_ok, Approval, Identity, Input, Job, Mount, MountSource, Network, Output, OutputKind, Pipeline,

    Problem, Problems, Runtime, Sandbox, Secret, EGRESS_LABEL, PIPELINE_PATH,

    /// Wait for a person before running (oxygenflow#57): `approval { by

    /// "maintain"; others-only #true; expires "24h" }`.

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub approval: Option<Approval>,

}

/// Who must approve a job before it runs, and for how long it waits

/// (oxygenflow#57).

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]

pub struct Approval {

    /// The least role that approves: `write`, `maintain` (the default) or `admin`.

    pub by: String,

    /// Not the person whose push started the run.

    #[serde(default, skip_serializing_if = "std::ops::Not::not")]

    pub others_only: bool,

    /// How long it waits once the jobs it depends on are done, in seconds.

    pub expires_s: u64,

/// The longest a job waits for approval: 30 days.

const MAX_APPROVAL_S: u64 = 30 * 24 * 3600;

        }

    }

}

/// `approval { by "maintain"; others-only #true; expires "24h" }`, each

/// optional: `maintain`, anyone with the role, 24 hours.

fn parse_approval(ctx: &mut Ctx, node: &KdlNode) -> Option<Approval> {

    if !node.entries().is_empty() {

        ctx.err(node.span(), "`approval` takes a block: approval { by \"maintain\"; others-only #true; expires \"24h\" }");

    }

    let mut a = Approval { by: "maintain".into(), others_only: false, expires_s: 24 * 3600 };

    let Some(children) = node.children() else { return Some(a) };

    for c in children.nodes() {

        ctx.no_children(c);

        match c.name().value() {

            "by" => match ctx.one_string(c).as_deref() {

                Some(r @ ("write" | "maintain" | "admin")) => a.by = r.to_string(),

                Some(r) => ctx.err(c.span(), format!("approval by {r:?}: expected \"write\", \"maintain\" or \"admin\"")),

                None => {}

            },

            "others-only" => match c.entries() {

                [e] if e.name().is_none() => match e.value() {

                    KdlValue::Bool(b) => a.others_only = *b,

                    _ => ctx.err(c.span(), "`others-only` takes #true or #false"),

                },

                _ => ctx.err(c.span(), "`others-only` takes #true or #false"),

            },

            "expires" => {

                let Some(t) = ctx.one_string(c) else { continue };

                match parse_duration(&t) {

                    Some(secs) if (60..=MAX_APPROVAL_S).contains(&secs) => a.expires_s = secs,

                    Some(_) => ctx.err(c.span(), format!("expires {t:?} must be from 1m to 720h")),

                    None => ctx.err(c.span(), format!("expires {t:?}: expected hours, minutes and seconds, as \"24h\"")),

                }

            }

            other => ctx.err(c.span(), format!("unknown approval setting `{other}`; approval takes `by`, `others-only` and `expires`")),

    Some(a)

        approval: None,

            "approval" => job.approval = parse_approval(ctx, c),

#[test]

fn a_job_can_wait_for_approval() {

    let job = |approval: &str| doc(&format!("job \"apply\" {{\n    sandbox \"alpine\"\n{approval}    exec \"apply\"\n}}\n"));

    let p = Pipeline::parse(&job("    approval { by \"maintain\"; others-only #true; expires \"2h\"; }\n")).unwrap();

    assert_eq!(p.jobs["apply"].approval, Some(crate::Approval { by: "maintain".into(), others_only: true, expires_s: 7200 }));

    let plain = Pipeline::parse(&job("    approval\n")).unwrap();

    assert_eq!(

        plain.jobs["apply"].approval,

        Some(crate::Approval { by: "maintain".into(), others_only: false, expires_s: 86400 }),

        "defaults"

    );

    assert_eq!(Pipeline::parse(&job("")).unwrap().jobs["apply"].approval, None);

    assert_ne!(p.hash(), plain.hash(), "the approval is part of the job");

    let has = |a: &str, want: &str| {

        let ps = problems(&job(a));

        assert!(ps.iter().any(|(_, m)| m.contains(want)), "{a}: {ps:?}");

    };

    has("    approval { by \"read\"; }\n", "expected \"write\", \"maintain\" or \"admin\"");

    has("    approval { others-only \"yes\"; }\n", "#true or #false");

    has("    approval { expires \"800h\"; }\n", "from 1m to 720h");

    has("    approval { when \"later\"; }\n", "unknown approval setting");

}

            approval: None,

### 5.3.2 Approval gates (oxygenflow#57)

A job can wait for a person:

```kdl

job "apply" {

    depends-on "plan"

    approval {

        by "maintain"        // the least role: "write", "maintain" (default) or "admin"

        others-only #true    // not the person whose push started the run

        expires "24h"        // from when the jobs it depends on are done; up to 720h

    }

}

```

The hub hands such a job to no runner until someone with that role on the

repository approves it, on the run page or through the API; others-only

leaves out whoever pushed. Approving or rejecting is recorded on the job

(who, when) and in the audit log. A rejected or expired job ends as

cancelled and the jobs after it are skipped; a newer push to the

bookmark cancels the run as before, so a stale plan is never applied. The

approval is part of the job's hash (field 11).