Certificates name the grant owner's newest identity (refs andymccall/oxygen#82) 27babfa16580

- **An agent follows its owner's newest identity (oxygen#82).** A keyless certificate's answer now carries `author_chain`: the grant owner's newest linked identity and its predecessors back to the grant's key, so an agent home with `author.for` authors as the owner's current identity, not one several rotations old.

- **The profile page's actions are one tidy group (#328).** Edit profile, Projects and Drops sat on two rows, touching each other and the panel below; they are now one evenly spaced block, Edit profile across the top and the two pages side by side.

    /// For an agent's certificate, the grant's owner's newest linked

    /// identity and its predecessors back to the grant's key (base64,

    /// newest first, the grant's key's own left out): a home with

    /// `author.for` authors as the first (oxygen#82). Empty when the

    /// grant's key is the newest.

    #[serde(skip_serializing_if = "Vec::is_empty")]

    pub author_chain: Vec<String>,

/// The newest identity linked to `account_id` whose `previous` chain

/// reaches `grantor`, with the chain down to (not including) it, newest

/// first (oxygen#82). Empty when none is newer.

pub async fn author_chain(app: &Shared, account_id: i64, grantor: oxy_core::hash::KeyId) -> Vec<Identity> {

    let linked = db::accounts::identities_of(&app.db, account_id).await.unwrap_or_default();

    let ids: std::collections::HashMap<oxy_core::hash::KeyId, Identity> =

        linked.iter().filter_map(|l| Identity::decode(&l.object).ok()).map(|i| (i.hash(), i)).collect();

    let mut best: Vec<Identity> = Vec::new();

    for head in ids.values() {

        let mut chain = vec![head.clone()];

        let mut cur = head;

        let reached = loop {

            match cur.previous {

                Some(p) if p == grantor => break true,

                Some(p) => match ids.get(&p) {

                    Some(prev) if chain.len() < 64 => {

                        chain.push(prev.clone());

                        cur = prev;

                    }

                    _ => break false,

                },

                None => break false,

            }

        };

        if reached && best.first().is_none_or(|b| head.created > b.created) {

            best = chain;

        }

    }

    best

}

    let grantor = match &cert.grant {

        Some(g) => db::accounts::identity_by_key(&app.db, &g.grant.grantor.to_hex()).await.ok().flatten(),

    };

    let grantor_account = grantor.as_ref().map(|l| l.account_id);

    let grantor_identity = grantor.map(|l| oxy_core::dsse::base64(&l.object));

    let author_chain = match (&cert.grant, &grantor_account) {

        (Some(g), Some(account)) => {

            author_chain(&app, *account, g.grant.grantor).await.iter().map(|i| oxy_core::dsse::base64(&i.encode())).collect()

        }

        _ => Vec::new(),

        author_chain,

    // oxygen#82: Andy rotates. A home with `author.for` follows his newest

    // identity, which the hub names with each certificate, and its changes

    // still verify by the grant his earlier key made.

    let rot = a.rotate_identity().unwrap();

    db::accounts::link_identity(&h.app.db, andy.id, &rot.new.to_hex(), "Andy", "[email protected]", &rot.identity.encode()).await.unwrap();

    assert!(a.push("origin", false).unwrap().iter().all(|r| r.ok));

    let (mut warm, dir) = agent();

    warm.set_user_config("author.for", "andy").unwrap();

    write(&dir, "warm.txt", "before the hub has said\n");

    warm.commit("Warm", &[]).unwrap();

    assert!(warm.push("origin", false).unwrap().iter().all(|r| r.ok));

    let followed = std::fs::read_to_string(agent_home.join("keys").join("author.for")).unwrap();

    assert_eq!(followed.trim(), rot.new.to_hex(), "the hub named Andy's newest identity");

    let (follower, dir) = agent();

    assert_eq!(follower.config.author_key, Some(rot.new));

    write(&dir, "follow.txt", "as Andy's newest identity\n");

    let followed = follower.commit("Followed", &[]).unwrap();

    assert!(follower.push("origin", false).unwrap().iter().all(|r| r.ok));

    assert_eq!(host.store().get_change_meta(&followed).unwrap().author, rot.new);

    assert!(

        matches!(host.authenticate_change(&followed).unwrap(), SignatureStatus::Valid { sealed: true, .. }),

        "{:?}",

        host.authenticate_change(&followed).unwrap()

    );