A renewed key approves as the account its predecessor is linked to (closes #236) 317d776c725b

/// An unlinked key's account, when its identity succeeds a linked key's

/// through `previous` links that each keep the key pair (a renewal or a

/// delegation, Oxygen spec §14.2), with the identities from it down to the

/// linked one, to link (oxygenhub#236). A step that changes the key pair

/// ends the search: that is a new key, linked by proving it.

async fn linked_through_chain(

    app: &Shared,

    repo: &RepoName,

    signer: &oxy_core::identity::Identity,

    links: &[(String, String)],

) -> Option<(String, Vec<oxy_core::identity::Identity>)> {

    let mut chain = vec![signer.clone()];

    let mut cur = signer.clone();

    for _ in 0..64 {

        let prev = cur.previous?;

        let hex = prev.to_hex();

        let found = match db::accounts::identity_by_key(&app.db, &hex).await.ok()? {

            Some(l) => oxy_core::identity::Identity::decode(&l.object).ok(),

            None => app.repos.read(repo, move |r, _| Ok(r.store().get_identity(&prev).ok())).await.ok().flatten(),

        };

        let id = found?;

        if id.hash() != prev || id.ed25519_pk != cur.ed25519_pk || id.mldsa65_pk != cur.mldsa65_pk {

            return None;

        }

        if let Some((_, u)) = links.iter().find(|(k, _)| *k == hex) {

            return Some((u.clone(), chain));

        }

        chain.push(id.clone());

        cur = id;

    }

    None

}

    let username = match links.iter().find(|(k, _)| *k == key) {

        Some((_, u)) => u.clone(),

        // A renewal or delegation of a linked key keeps its key pair: it is

        // the same person's, and linked now (oxygenhub#236).

        None => match linked_through_chain(app, &repo_name, &sa.signer, &links).await {

            Some((u, chain)) => {

                if let Ok(Some(acc)) = db::accounts::account_by_name(&app.db, &u).await {

                    for id in &chain {

                        let k = id.hash().to_hex();

                        if let Ok(None) = db::accounts::identity_by_key(&app.db, &k).await {

                            db::accounts::link_identity(&app.db, acc.id, &k, &id.name, &id.email, &id.encode()).await.ok();

                        }

                    }

                }

                u

            }

            None => {

                return Err(format!(

                    "key {} is not linked to an account here, nor a renewal of a key that is (link it under Settings › Keys; an agent's delegated key cannot approve)",

                    &key[..12]

                ))

            }

        },

    };

    let who = db::accounts::account_by_name(&app.db, &username).await.map_err(|e| e.to_string())?.ok_or("the key's account is gone")?;

    // A key that claims Carol's as its predecessor but has other keys: refused.

    let forged = oxy_core::identity::Identity { previous: Some(carol_id.hash()), ..agent_id.clone() };

    let (st, body) = seal(&statement, &agent, &forged).await;

    assert!(st == StatusCode::CONFLICT && body.contains("not linked"), "{st} {body}");

    // Carol's seal, by a renewal of her linked key never linked itself

    // (oxygenhub#236), releases it and links it; it is kept in the

    // repository; the token names her and it.

    let renewed = carol_id.successor(vec![], None, 2);

    let (st, body) = seal(&statement, &sk, &renewed).await;

    assert!(

        db::accounts::identity_by_key(&h.app.db, &renewed.hash().to_hex()).await.unwrap().is_some_and(|l| l.account_id == carol.id),

        "linked now"

    );