Approvals through an agent token say so (closes #229) 05f1a85a2842

    pub token: String,

    /// The personal access token's id, when one is used.

    pub token_id: Option<i64>,

}

impl Caller {

pub async fn caller(app: &Shared, headers: &HeaderMap) -> Result<Caller, ApiError> {

    let Some(t) = oxy_server::bearer_token(headers) else {

    };

    if app.config.auth.push_tokens.iter().any(|x| auth::mac_equal(x, t)) {

        let admin = db::accounts::accounts(&app.db).await?.into_iter().find(|a| a.is_admin);

            site: true,

            token: "site token".into(),

            token_id: None,

        });

    }

    let token = db::accounts::token_by_hash(&app.db, &auth::token_hash(t)).await?;

                site: false,

                token: tok.name.clone(),

                token_id: Some(tok.id),

            })

        }

        _ => Err(ApiError(StatusCode::UNAUTHORIZED, "unknown or expired token".into())),

    let me = c.require("repo:write")?.clone();

    let (_, row, _) = reach(app, &c, owner, name, Access::Read).await?;

    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;

    Ok(Json(serde_json::json!({ "number": number, "job": job, "decision": if approve { "approved" } else { "rejected" }, "said": said })))

}

    /// Who approved or rejected it, and when.

    pub approved_by: String,

    pub approved_ms: Option<i64>,

    /// The environment it deploys to, or empty (oxygenflow#59).

    pub environment: String,

    /// The approval attestation that released it, when sealed (#235).

             exit_code = NULL, error = '', receipt = '', receipt_hash = '', log_count = 0, also_read = '', receipt_attest = '',

             receipt_signer = '', receipt_note = '', runner_id = NULL, waiting = '', placed = '', peak_disk_mib = NULL,

             peak_memory_mib = NULL, approval = CASE WHEN approval = '' THEN '' ELSE 'waiting' END, approved_by = '',

        )

        .bind(id)

        .execute(&mut *tx)

/// Approve job `id` if it is still waiting for a person (oxygenflow#57);

/// whether it was.

    let r = sqlx::query(

         WHERE id = $4 AND status = 'queued' AND approval = 'waiting'",

    )

    .bind(who)

    .bind(now_ms())

    .bind(seal)

    .bind(id)

    .execute(pool)

    .await?;

    Ok(r.rows_affected() > 0)

}

/// Note who rejected job `id` (it is then finished as cancelled).

        .bind(who)

        .bind(now_ms())

        .bind(id)

        .execute(pool)

        .await?;

    Ok(())

    name: &str,

    who: &db::accounts::Account,

    approve: bool,

) -> Result<String, String> {

}

/// [`decide`], from a verified seal (`Some(approval ref)`) or without one;

/// a gate that takes a sealed approval is not approved without.

async fn decide_with(

    name: &str,

    who: &db::accounts::Account,

    approve: bool,

) -> Result<String, String> {

    let jobs = fdb::jobs(&app.db, run.id).await.map_err(|e| e.to_string())?;

    let Some(job) = jobs.into_iter().find(|j| j.name == name) else { return Err(format!("run #{} has no job {name}", run.number)) };

    let approval = may_decide(app, row, run, &job, who).await?;

    }

    let target = format!("{}/{}#{} {name}", row.owner, row.name, run.number);

    let sealed = seal.map(|r| format!(", sealed (approval {})", &r[..12.min(r.len())])).unwrap_or_default();

    let said = if approve {

            return Err(format!("{name} was decided on meanwhile"));

        }

    } else {

        let changed =

            fdb::finish(&app.db, job.id, fdb::Outcome { status: "cancelled", exit_code: None, error: &why, receipt: "", receipt_hash: "" })

                .await

                .map_err(|e| e.to_string())?;

        report_changed(app, run.id, changed).await.ok();

        why

    };

    let record = flow_core::api::Record { t: 0, stream: "flow".into(), text: said.clone() };

    let (rid, signers) = (sa.attest.repo, sa.sigs.iter().map(|s| s.key).collect::<Vec<_>>());

    let kept = app.repos.write(&repo_name, move |r, _| Ok(r.add_approval(&sa)?)).await.map_err(|e| e.to_string())?;

    crate::tlog::log(app, vec![crate::tlog::Pending { kind: "approval", repo: rid, repo_row: Some(row.id), object: kept, signers }]).await;

}

/// End the approvals that waited too long (oxygenflow#57): from when the

            by: a.by,

            others_only: a.others_only,

            state,

            when_ms: j.approved_ms.unwrap_or(0),

            may,

        });

        "reject" => false,

        _ => return Err(Error::bad(shell, "approve or reject")),

    };

        Ok(_) => Ok(Redirect::to(&format!("/{owner}/{name}/flow/{number}")).into_response()),

        Err(why) => Err(Error::bad(shell, why)),

    }

    };

    assert!(heard(oxygenhub::events::topic::repo(row.id)).contains(&"push".to_string()), "the push is on the repository's topic");

    sqlx::query("UPDATE flow_runs SET actor = 'andy' WHERE id = $1").bind(run.id).execute(&h.app.db).await.unwrap();

    assert!(early.contains("waits for plan first"), "{early}");

    let run = plan_passes(run.number).await;

    assert!(claim(&h.app).await.is_none(), "apply waits for a person, so no runner gets it");

    assert_eq!((told(carol.id).await, told(andy.id).await, told(bob.id).await), (1, 0, 0));

    let (_, page) = call(&h.app, "GET", &format!("/andy/gated/flow/{}", run.number), None, None).await;

    assert!(page.contains("waits for approval by someone with the <em>maintain</em> role, other than andy"), "the run page says so");

    assert!(own.contains("someone other than andy"), "{own}");

    assert!(no_role.contains("takes the maintain role"), "{no_role}");

    assert_eq!(told(carol.id).await, 1, "told once");

    let j = claim(&h.app).await.expect("approved, it runs");

    assert_eq!(j["job"]["name"], "apply");

    let list: serde_json::Value = serde_json::from_str(&list).unwrap();

    assert_eq!((list[0]["environment"].as_str(), list[0]["approved_by"].as_str()), (Some("prod"), Some("carol")));

    push();

    let run = plan_passes(2).await;

    let jobs = db::flow::jobs(&h.app.db, run.id).await.unwrap();

    let apply = jobs.iter().find(|j| j.name == "apply").unwrap();

    assert!(claim(&h.app).await.is_none());

    // Run 3: nobody decides in time.

    let run = db::flow::run(&h.app.db, row.id, run.number).await.unwrap().unwrap();

    // An environment's gate takes a sealed approval: pressing Approve is not enough.

    assert!(plain.contains(&format!("oxy seal --flow {}/andy/infra/flow/{} --job apply", h.base, run.number)), "{plain}");

    // What there is to sign.

    let (st, body) =