ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/authority/endcap_reviews.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        private
+
+        # Historical assignment lookup stays separate: revocation removes
+        # permission, never the original receipt or response.
+        def active_review_reservation(events, current)
+          reservation = events.reverse.find do |event|
+            event["type"] == "authority_mutation" &&
+              %w[request_review assign_review].include?(event.dig("payload", "operation")) &&
+              !event.dig("payload", "mutation_id").to_s.start_with?("review-delegate.") &&
+              event.dig("payload", "data", "head") == current.fetch("head") &&
+              event.dig("payload", "data", "candidate_generation") == current.fetch("candidate_generation")
+          end
+          return unless reservation
+          cancelled = events.any? do |event|
+            event["type"] == "authority_mutation" && event.dig("payload", "operation") == "cancel_review" &&
+              event.dig("payload", "data", "review_event_id") == reservation.fetch("digest")
+          end
+          reservation unless cancelled
+        end
+
+        def active_review_event(events, current)
+          reservation = active_review_reservation(events, current)
+          return unless reservation
+          return reservation if reservation.dig("payload", "operation") == "assign_review"
+          events.find do |event|
+            event["type"] == "authority_mutation" && event.dig("payload", "operation") == "assign_review" &&
+              event.dig("payload", "mutation_id") == "review-delegate.#{reservation.fetch('digest')}"
+          end
+        end
+
+        # Reserved spelling is not authorization. Reconstruct the immutable
+        # request through the original-launcher reader before historical replay,
+        # then separately check the active reservation for a fresh mutation.
+        def delegated_review_request!(journal, events, request, params, peer, role)
+          mutation = request.fetch("mutation_id")
+          return unless mutation.is_a?(String) && mutation.start_with?("review-delegate.")
+          digest = mutation.delete_prefix("review-delegate.")
+          original = events.find { |event| event["digest"] == digest && event["type"] == "authority_mutation" &&
+            event.dig("payload", "operation") == "request_review" }
+          raise AttemptErrors::UnauthorizedIdentity, "delegation requires a canonical request" unless original
+          accepted = journal.mutation_result(original.dig("payload", "mutation_id"))
+          selectors = params.slice("mapping_id", "assignment_id", "attempt_id").merge(
+            "mutation_id" => original.dig("payload", "mutation_id"), "request_event_id" => digest,
+            "journal_commit" => accepted.fetch("journal_commit"),
+            "original_binding_digest" => original.dig("payload", "data", "original_binding_digest"))
+          intent = @launch.launch_review_intent!(request: request.merge("operation" => "launch_review_intent",
+            "mutation_id" => nil, "params" => selectors), peer: peer, role: role)
+          unless Atoms::EvidenceDigest.digest(intent.dig(:data, "assignment_params")) == Atoms::EvidenceDigest.digest(params)
+            raise AttemptErrors::UnauthorizedIdentity, "delegation differs from exact canonical request"
+          end
+          original
+        end
+
+        def cancel_review(request, params, map, peer, role, transfer)
+          raise ArgumentError, "review cancellation forbids upload" unless transfer.nil?
+          unless params["review_event_id"].is_a?(String) && params["review_event_id"].match?(/\A[0-9a-f]{64}\z/)
+            raise ArgumentError, "review cancellation selector differs"
+          end
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            events = attempt_events(journal, params)
+            authenticate_review_cancellation!(events, params, map, peer, role)
+            result = journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: "cancel_review",
+              parameters_digest: Atoms::EvidenceDigest.digest(params), expected_generation: params.fetch("expected_generation"),
+              with_replay: true) do |current_events, _commit, _generation|
+              authenticate_review_cancellation!(current_events, params, map, peer, role)
+              current = exact_candidate!(candidate(current_events), params)
+              reservation = active_review_reservation(current_events, current)
+              unless reservation && reservation.fetch("digest") == params.fetch("review_event_id")
+                raise AttemptErrors::Conflict, "review reservation is no longer active"
+              end
+              {data: current.slice("head", "candidate_generation").merge(
+                "review_event_id" => reservation.fetch("digest"),
+                "review_id" => active_review_event(current_events, current)&.dig("payload", "data", "review_id"), "state" => "cancelled")}
+            end
+            review_event_reply(journal, result, request, params, "cancellation_event_id")
+          end
+        end
+
+        def review_event_reply(journal, result, request, params, field)
+          accepted = journal.read_events(params.fetch("assignment_id"), commit: result.fetch(:data).fetch("journal_commit")).find do |event|
+            event["attempt_id"] == params.fetch("attempt_id") && event["type"] == "authority_mutation" &&
+              event.dig("payload", "operation") == request.fetch("operation") &&
+              event.dig("payload", "mutation_id") == request.fetch("mutation_id")
+          end
+          raise AttemptErrors::EvidenceUnavailable, "accepted review event is unavailable" unless accepted
+          result.merge(data: result.fetch(:data).merge(field => accepted.fetch("digest")))
+        end
+
+        def authenticate_review_cancellation!(events, params, map, peer, role)
+          origin = active_origin(events, params)
+          @kernel.live!(peer)
+          original = events.find { |event| event["digest"] == params.fetch("review_event_id") }
+          unless original && original["type"] == "authority_mutation" &&
+              %w[request_review assign_review].include?(original.dig("payload", "operation")) &&
+              !original.dig("payload", "mutation_id").to_s.start_with?("review-delegate.") &&
+              original.dig("payload", "data", "head") == params.fetch("head") &&
+              original.dig("payload", "data", "candidate_generation") == params.fetch("candidate_generation")
+            raise AttemptErrors::UnauthorizedIdentity, "review cancellation requires the exact reservation root"
+          end
+          if role == :launcher
+            unless @kernel.same?(origin.fetch("launcher_identity"), peer)
+              raise AttemptErrors::UnauthorizedIdentity, "cancellation requires original launcher birth"
+            end
+            worker_or_launcher!(peer, role, map, origin, launcher_only: true)
+          elsif role == :reviewer && original.dig("payload", "operation") == "request_review"
+            project = @deployment.project(map.fetch("project_id"))
+            credentials = project.fetch("peer_credentials")[peer.fetch("uid").to_s]
+            principal = peer.slice("uid", "gid", "groups").merge("role" => "reviewer")
+            unless project.fetch("reviewer_uids").include?(peer.fetch("uid")) && peer.fetch("uid") != map.fetch("worker_uid") &&
+                credentials && peer.values_at("gid", "groups") == credentials.values_at("gid", "groups") &&
+                Atoms::EvidenceDigest.digest(principal) == Atoms::EvidenceDigest.digest(original.dig("payload", "data", "requester"))
+              raise AttemptErrors::UnauthorizedIdentity, "cancellation requires the original mapped requester"
+            end
+          else
+            raise AttemptErrors::UnauthorizedIdentity, "review reservation cancellation is unauthorized"
+          end
+          original
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/authority/endcap_service_settlement.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Authority
+      class Endcap
+        private
+
+        def authorize_service_settlement!(request, params, map, peer, role)
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            protected_journal!(journal)
+            service_settlement_record!(journal, params, map, peer, role)
+          end
+          true
+        end
+
+        def service_settlement_record!(journal, params, map, peer, role, record: nil)
+          record ||= journal.service_request(params.fetch("request_id"))
+          raise AttemptErrors::NotFound, "canonical service request is missing" unless record
+          service_executor!(peer, role, record)
+          receiver = service_receiver!(peer, role, map, record.fetch("service_id"))
+          credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(peer.fetch("uid").to_s)
+          unless peer["gid"] == credentials.fetch("gid") && peer["groups"] == credentials.fetch("groups") &&
+              receiver.fetch("executor_uid") == record.fetch("executor_uid") &&
+              %w[assignment_id attempt_id mapping_id].all? { |key| record[key] == params[key] } &&
+              record["project_id"] == map.fetch("project_id") && record["candidate_head"] == params.fetch("head") &&
+              record["candidate_generation"] == params.fetch("candidate_generation") &&
+              %w[issued dispatch_started].include?(record["dispatch_phase"])
+            raise AttemptErrors::UnauthorizedIdentity, "original service settlement identity differs"
+          end
+          # The normal protected binding validates original ticket/claim, even
+          # while effect policy, worker liveness or current candidate changed.
+          ServiceEvidence.new(journal: journal).context(record)
+          record
+        rescue KeyError
+          raise AttemptErrors::EvidenceUnavailable, "original service settlement binding is incomplete"
+        end
+
+        def dispatch_service_settlement(request, params, map, peer, role, transfer)
+          authorize_service_settlement!(request, params, map, peer, role)
+          completion = request.fetch("operation") == "complete_no_effect"
+          admitted = completion && ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"),
+            artifact_field: "evidence", reference_key: "ref")
+          @launch.with_assignment(params: params, map: map) do |journal, _registration|
+            record = service_settlement_record!(journal, params, map, peer, role)
+            no_effect_completion_binding!(record, params, admitted) if completion
+            journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
+              mutation_id: request.fetch("mutation_id"), operation: request.fetch("operation"),
+              parameters_digest: Atoms::EvidenceDigest.digest(params),
+              expected_generation: completion ? nil : params.fetch("expected_generation"),
+              generation_mode: completion ? :recorded_completion : :expected, with_replay: true) do |events, commit, generation|
+              current = service_settlement_record!(journal, params, map, peer, role)
+              if completion
+                no_effect_completion_plan(journal, events, current, params, admitted)
+              else
+                service_challenge_plan(journal, events, current, params, map, generation, commit)
+              end
+            end
+          end
+        end
+
+        def service_challenge_projection(record)
+          record.slice("request_id", "state", "dispatch_ticket_id", "claim_binding", "dispatch_phase").merge(
+            "reconciliation_challenge" => %w[succeeded failed-settled].include?(record.fetch("state")) ? nil :
+              record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest"))
+        end
+
+        def service_challenge_plan(journal, events, record, params, map, generation, commit)
+          lineage = Molecules::ExecutionScopeLineage.new(events: events, project_id: map.fetch("project_id"),
+            assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"), mapping_id: params.fetch("mapping_id"))
+          unless lineage.sealed? && lineage.binding && record["reservation_generation"] == lineage.binding.fetch("reservation_generation")
+            raise AttemptErrors::Conflict, "original service generation is not sealed"
+          end
+          return {data: service_challenge_projection(record)} if %w[succeeded failed-settled].include?(record.fetch("state"))
+          unless %w[uncertain failed].include?(record.fetch("state"))
+            raise AttemptErrors::EvidenceUnavailable, "original protected request has no uncertainty outcome"
+          end
+          if record["challenge_event_digest"]
+            begin
+              ServiceEvidence.new(journal: journal).challenge!(record, pending: {commit: commit})
+              return {data: service_challenge_projection(record)}
+            rescue AttemptErrors::EvidenceUnavailable
+              # Only a positively authenticated later failure may supersede a
+              # challenge. Corrupt/missing old history never becomes freshness.
+              old = ServiceEvidence.new(journal: journal).challenge!(record, pending: {commit: commit}, current: false)
+              raise unless events.drop_while { |event| event["digest"] != old.fetch("digest") }.drop(1).any? do |event|
+                %w[service_claim service_transition].include?(event["type"]) && event.dig("payload", "request_id") == record.fetch("request_id") &&
+                  %w[uncertain failed].include?(event.dig("payload", "state"))
+              end
+            end
+          end
+          failure = events.reverse.find { |event| %w[service_claim service_transition].include?(event["type"]) &&
+            event.dig("payload", "request_id") == record.fetch("request_id") && %w[uncertain failed].include?(event.dig("payload", "state")) }
+          raise AttemptErrors::EvidenceUnavailable, "canonical service failure is missing" unless failure
+          failure_prefix = events.take_while { |event| event["digest"] != failure.fetch("digest") }
+          payload = record.slice("request_id", "input_digest", "claim_binding", "dispatch_ticket_id").merge(
+            "version" => 1, "no_effect_challenge" => SecureRandom.hex(16), "challenge_generation" => generation + 1,
+            "failure_event_digest" => failure.fetch("digest"), "failure_generation" => journal.authority_generation(failure_prefix) + 1)
+          recorded_at = Time.now.utc
+          challenge = Models::EvidenceEvent.build(type: "service_no_effect_challenge", attempt_id: params.fetch("attempt_id"),
+            payload: payload, previous_digest: events.last&.fetch("digest"), recorded_at: recorded_at)
+          replacement = record.merge(payload.slice("no_effect_challenge", "challenge_generation"), "challenge_event_digest" => challenge.fetch("digest"))
+          {events: [{type: "service_no_effect_challenge", payload: payload, recorded_at: recorded_at}],
+            data: service_challenge_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
+              expected: record, replacement: replacement, event_type: "service_challenge"}]}
+        end
+
+        def no_effect_completion_binding!(record, params, admitted)
+          selector = params.fetch("reconciliation_challenge")
+          unless selector.is_a?(Hash) && selector.keys.sort == %w[no_effect_challenge challenge_generation challenge_event_digest].sort &&
+              selector["no_effect_challenge"].is_a?(String) && selector["no_effect_challenge"].match?(/\A[0-9a-f]{32}\z/) &&
+              selector["challenge_generation"].is_a?(Integer) && selector["challenge_generation"].positive? &&
+              selector["challenge_event_digest"].is_a?(String) && selector["challenge_event_digest"].match?(/\A[0-9a-f]{64}\z/)
+            raise ArgumentError, "no-effect challenge selector is malformed"
+          end
+          unless selector.all? { |key, value| record[key] == value } && record["claim_binding"] == params.fetch("claim_binding")
+            raise AttemptErrors::Conflict, "no-effect challenge or claim differs"
+          end
+          receipt = admitted.fetch(:receipt)
+          unless receipt.keys.sort == Molecules::EvidenceJournal::TERMINAL_RECEIPT_FIELDS.sort && receipt["outcome"] == "failed" &&
+              Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS.all? { |field| receipt[field] == record[field] }
+            raise AttemptErrors::ReceiptRejected, "no-effect receipt original binding differs"
+          end
+          digest = Atoms::EvidenceDigest.digest("challenge" => selector, "receipt_sha256" => admitted.fetch(:receipt_sha256),
+            "artifacts" => admitted.fetch(:artifacts).map { |bytes| Digest::SHA256.hexdigest(bytes) })
+          if record["state"] == "succeeded" || record["no_effect_completion_digest"] && record["no_effect_completion_digest"] != digest
+            raise AttemptErrors::Conflict, "no-effect completion contradicts retained outcome"
+          end
+          digest
+        end
+
+        def no_effect_completion_plan(journal, events, record, params, admitted)
+          digest = no_effect_completion_binding!(record, params, admitted)
+          return {data: service_projection(record)} if record["no_effect_completion_digest"]
+          owner = ServiceEvidence.new(journal: journal)
+          challenge = owner.challenge!(record)
+          if record["operation"] == "prune-preserved-workspace"
+            owner.cleanup_inspection_inputs!(admitted.fetch(:artifacts), record, challenge)
+          else
+            admitted.fetch(:artifacts).each { |bytes| owner.inspection!(bytes, record, challenge) }
+          end
+          plan = Molecules::CanonicalEvidence.new(journal: journal).import_plan(**owner.context(record, no_effect: true),
+            artifacts: admitted.fetch(:artifacts), admitted_after_event_digest: challenge.fetch("digest"))
+          receipt = admitted.fetch(:receipt).merge("evidence" => plan.fetch(:references))
+          replacement = record.merge("state" => "failed-settled", "receipt" => receipt, "no_effect_completion_digest" => digest)
+          plan.merge(data: service_projection(replacement), service_updates: [{request_id: record.fetch("request_id"),
+            expected: record, replacement: replacement, event_type: "service_transition"}])
+        end
+      end
+    end
+  end
+end