ace-lab 0.5.2 → 0.7.0

data/lib/ace/lab/molecules/service_policy.rb

@@ -15,6 +15,7 @@ module Ace
         ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
 
         def initialize(document, proposal_resolver = nil)
+          @document = document
           @operations = document.fetch("operations", {})
           @authorizations = document.fetch("authorizations", {})
           @proposal_resolver = proposal_resolver
@@ -23,6 +24,10 @@ module Ace
           end
         end
 
+        # The trusted installation document as loaded; the ordinary producer
+        # binds its configuration digest to these exact bytes.
+        attr_reader :document
+
         def operation!(name, project:, service_id:)
           raise ArgumentError, "invalid operation name" unless name.to_s.match?(NAME)
           operation = @operations[name]
@@ -101,6 +106,72 @@ module Ace
           decision
         end
 
+        # ---- ordinary fixed merge admission policy (spec 8x3.t.xz9.4) ------
+        #
+        # The installed ordinary section is the separately configured
+        # ordinary receiver mapping and admission policy. It supplies
+        # identity and placement only: the caller selects no endpoint,
+        # credential or receiver. An absent project section or a disabled
+        # admission flag is rollback: new admission is unavailable while
+        # canonical records and read-only status stay preserved.
+        ORDINARY_SECTION_KEYS = %w[projects].freeze
+        ORDINARY_PROJECT_KEYS = %w[receiver_id socket_path receiver_uid principal admission].freeze
+        ORDINARY_AUTHORIZATION_KEYS = %w[operation project_id assignment_id attempt_id queue_entry
+          input_digest forge pr_url head_repository head_ref candidate_head base_repository
+          base_ref expected_base_head expires_at].freeze
+        # expires_at bounds the decision itself; it is never exact-matched
+        # against the request binding, which carries no expiry.
+        ORDINARY_BINDING_KEYS = ORDINARY_AUTHORIZATION_KEYS - %w[expires_at].freeze
+
+        def ordinary_receiver!(project)
+          section = @document["ordinary"]
+          return nil unless section.is_a?(Hash)
+          validate_ordinary_section!(section)
+          entry = section.fetch("projects")[project.to_s]
+          return nil unless entry.is_a?(Hash)
+          entry
+        end
+
+        # The ordinary admission decision: exact-match on every closed
+        # binding key, like authorize!, but over the ordinary request
+        # identity (forge/PR/repository/ref) instead of execution selectors.
+        def authorize_ordinary!(reference, binding)
+          raise ArgumentError, "invalid authorization reference" unless reference.to_s.match?(ID)
+          decision = @authorizations[reference]
+          raise SecurityError, "authorization reference is unresolved" unless decision.is_a?(Hash)
+          unless ORDINARY_AUTHORIZATION_KEYS.all? { |key| decision.key?(key) }
+            raise SecurityError, "authorization reference is not an ordinary merge decision"
+          end
+          unless ORDINARY_BINDING_KEYS.all? { |key| decision[key] == binding[key] }
+            raise SecurityError, "authorization does not match the exact ordinary merge request"
+          end
+          raise SecurityError, "authorization has expired" if parse_time(decision["expires_at"]) <= Time.now.utc
+          decision
+        end
+
+        def validate_ordinary_section!(section)
+          unless (section.keys - ORDINARY_SECTION_KEYS).empty? && section["projects"].is_a?(Hash)
+            raise Ace::Lab::InvalidConfigurationError, "ordinary section must map projects"
+          end
+          section.fetch("projects").each do |project, entry|
+            unless project.is_a?(String) && project.match?(ID) && entry.is_a?(Hash) &&
+                (entry.keys - ORDINARY_PROJECT_KEYS).empty?
+              raise Ace::Lab::InvalidConfigurationError, "ordinary project section is invalid"
+            end
+            unless entry["receiver_id"].is_a?(String) && entry["receiver_id"].match?(ID) &&
+                entry["socket_path"].is_a?(String) && entry["socket_path"].start_with?("/") &&
+                entry["receiver_uid"].is_a?(Integer) && entry["receiver_uid"] >= 0 &&
+                entry["principal"].is_a?(String) && !entry["principal"].empty?
+              raise Ace::Lab::InvalidConfigurationError, "ordinary receiver mapping is incomplete"
+            end
+            admission = entry.fetch("admission", "enabled")
+            unless %w[enabled disabled].include?(admission)
+              raise Ace::Lab::InvalidConfigurationError, "ordinary admission flag is invalid"
+            end
+          end
+          true
+        end
+
         # Inspection never renews effect permission or selects effect argv.
         def inspection!(name, project:, service_id:, executor_uid:)
           raise ArgumentError, "invalid inspection operation" unless name.is_a?(String) && name.match?(NAME)