@coffre/vault 0.5.0 → 0.6.0

package/src/vault.ts

@@ -3,7 +3,6 @@ import { randomUUID, timingSafeEqual } from 'node:crypto';
 import {
   allows,
   assignableToEnvironment,
-  convertEveryProjectGrants,
   EVERYWHERE,
   givesService,
   grantKind,
@@ -15,6 +14,7 @@ import {
   mayManageAccess,
   normalScope,
   NOTHING,
+  ownsInstance,
   runsInstance,
   setsUpServices,
   type Holdings,
@@ -49,6 +49,7 @@ import {
   type AccessChange,
   type AccessFault,
   type AdmitInput,
+  type Admitted,
   type Checkpoint,
   type CheckpointKey,
   type EndReferencesInput,
@@ -77,7 +78,7 @@ import {
 } from '@coffre/core/vault';
 import type { Database, Queryable, Transaction } from '@coffre/db';
 import { isUniqueViolation, SNAPSHOT } from '@coffre/db/dialect';
-import { newestAccess, reportStands } from '@coffre/db/grants';
+import { everyProjectConversion, newestAccess, reportStands } from '@coffre/db/grants';
 import { appendEntries, LOOK_BACK, lockLogHead, newestAuthentic, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
 
 import { KeyAccounting } from './accounting.ts';
@@ -120,8 +121,6 @@ export type PreparedVault = {
   options: Required<VaultOptions>;
   /** How far the log is verified; `verifyChain` in log.ts. The furthest any call got to. */
   verified: Anchor;
-  /** Root admins known to have a member row; rows are never deleted. */
-  rooted: Set<string>;
   /** What member rows are sealed under now; rows.ts. */
   rowKey: Buffer;
   /** Each signing key's row key: those after the first vouch for rows only until `since`, when the rows are sealed again. */
@@ -136,7 +135,11 @@ export type PreparedVault = {
   kekChecked: boolean;
   /** Why not, once decided that they do not. */
   wrongKek: string | null;
-  /** Whether this process has replaced the grants on every project of 0.4 there were when it started (`#convert`). */
+  /**
+   * Whether this process has done what it does once, at its start
+   * (`#convert`): the grants on every project of 0.4 there were replaced,
+   * then everyone the deployment names made an Owner (`#declare`).
+   */
   converted: boolean;
 };
 
@@ -146,7 +149,6 @@ export async function prepareVault(config: ResolvedVaultConfig, options: VaultOp
     ...(await keysOf(config.signingKeys)),
     options: { keyBudgetMs: options.keyBudgetMs ?? KEY_BUDGET_MS, clockOffset: options.clockOffset ?? (() => 0) },
     verified: UNVERIFIED,
-    rooted: new Set(),
     reported: new Set(),
     since: null,
     superseded: null,
@@ -182,7 +184,7 @@ const PRINCIPAL = /^(user|token):[^\s:][^\s]*$/;
 const PERSON = /^user:/;
 const SERVICE = /^token:/;
 
-/** Who acts for the vault itself, as when it gives a root admin a member row. */
+/** Who acts for the vault itself, as when it makes an Owner its deployment names. */
 const VAULT_ACTOR = 'system:vault';
 
 // A KEK's check: a known value, the size of a data key, wrapped under it in
@@ -215,6 +217,14 @@ const DEFAULT_SETTINGS: Settings = { serviceAccounts: EVERYWHERE };
 /** The settings when the log has some, but none the vault wrote within reach: people set up no service accounts. */
 const CLOSED_SETTINGS: Settings = { serviceAccounts: { projects: { only: [] }, environments: 'all' } };
 
+/** Why a change to who is an Owner, scoped or not, is refused to anyone else: Owners make and unmake Owners. */
+const OWNERS_ONLY = 'only an Owner of the whole instance makes someone an Owner, or changes or removes one';
+
+/** Why nobody demotes or removes a person the deployment names (`owners`), themselves included. */
+function declaredOwner(principal: string): string {
+  return `the deployment names ${principal.slice('user:'.length)} an Owner (owners, in the vault's configuration): take them off that list and deploy first`;
+}
+
 /** Why a person's change to a service account is refused. */
 const NOT_THEIRS = 'a person gives a service account at most what they hold, where the instance lets them set one up, and only to one whose every grant they hold';
 
@@ -270,7 +280,7 @@ const MESSAGES: Record<RefusalCode, string> = {
   deleted: 'this project or environment was deleted',
   ended: 'the reference read through was ended',
   not_allowed: 'not allowed to change this',
-  root_admin: 'root admins are set in the vault configuration',
+  last_owner: 'the last Owner of the whole instance stays one: make someone else an Owner first',
   invalid: 'not something the rules allow',
   log_broken: 'the vault log does not hold from the last checkpoint',
   wrong_kek: "this vault's key does not open the data it holds",
@@ -573,7 +583,8 @@ class VaultService implements Vault {
     // database; calls that race settle it alike, and a rotation they race
     // to write goes in once (`#rotate`).
     if (prepared.since === null && prepared.superseded === null) await this.#settle();
-    if (prepared.superseded === null && !prepared.converted) await this.#convert();
+    // A log with no entry of the vault's holds nothing to convert, and stays empty until someone acts.
+    if (prepared.superseded === null && prepared.since !== null && !prepared.converted) await this.#convert();
     return prepared.superseded;
   }
 
@@ -591,14 +602,18 @@ class VaultService implements Vault {
    * genuine row put back). `reportStands` is the rule, which `coffre
    * migrate` applies too, holding no key, to every entry in the vault's
    * name: it lists and marks a member so reported, forged or not.
-   * Removing them clears both.
+   * Removing them clears both. Then everyone the deployment names becomes
+   * an Owner (`#declare`): after, so that what their grants become is what
+   * `coffre migrate` says, by the same rule over the same rows
+   * (`everyProjectConversion`), which cannot tell who the configuration
+   * names. Until both finish, each call does again what is left, a few
+   * reads once nothing is.
    */
   async #convert(): Promise<void> {
     for (const principal of await store.everyProjectHolders(this.#db)) {
-      if (this.#isRootAdmin(principal)) continue;
       await this.#decideNow([principal], (d) => this.#replaceEveryProject(d, principal));
     }
-    this.#prepared.converted = true;
+    this.#prepared.converted = await this.#declare(this.#config.owners.map((email) => `user:${email}`));
   }
 
   async #replaceEveryProject(d: Decision, principal: string): Promise<void> {
@@ -611,15 +626,7 @@ class VaultService implements Vault {
     // The projects there are now, read under the log's head, which a deletion holds.
     await lockLogHead(d.tx);
     const before = roleOf(principal, row);
-    const conversion = convertEveryProjectGrants({
-      person: principal.startsWith('user:'),
-      role: before.role,
-      everyProject: everyProject.filter((grant) => live(grant, d.at)).map((grant) => ({ environmentSlug: grant.environmentSlug, role: grant.role as Role, expiresAt: grant.expiresAt })),
-      grants: subject.stored
-        .filter((grant) => grantKind(grant) !== null && live(grant, d.at))
-        .map((grant) => ({ projectId: grant.projectId, environmentId: grant.environmentId, role: grant.role as Role, expiresAt: grant.expiresAt })),
-      projects: await store.liveProjects(d.tx),
-    });
+    const conversion = everyProjectConversion(principal, before.role, subject.stored, d.at, await store.liveProjects(d.tx));
     const after = { role: conversion.role, scope: conversion.scope };
     const replacedBy = { role: after.role, scope: after.scope, grants: conversion.grants.length };
     d.grants.set(principal, [...subject.stored]);
@@ -934,7 +941,6 @@ class VaultService implements Vault {
   }
 
   async #refuseVersions(principal: string, code: 'bad_claim' | 'deleted', entries: NewEntry[]): Promise<Outcome<never>> {
-    if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
     return this.#decide([principal], async () => {
       throw new Refused(refusal(code, MESSAGES[code]), entries);
     });
@@ -995,7 +1001,6 @@ class VaultService implements Vault {
         throw new Refused(refusal('wrong_kek', wrongKek), secrets.map((secret) => entry(secret, 'deny', 'wrong_kek')));
       });
     }
-    if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
     const check = async (d: Decision) => {
       const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), call.input);
       // One read of the environments the decision is about, as the store has them, not as the app sent them:
@@ -1175,7 +1180,6 @@ class VaultService implements Vault {
         }),
       };
     };
-    if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
     return this.#decide([principal], async (d) => {
       const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
       // Both sides as the store has them: a grant on a slug matches there, and neither side may be deleted.
@@ -1250,7 +1254,6 @@ class VaultService implements Vault {
         ...traced(input),
       }),
     });
-    if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
     if (sealed.some((seal) => seal === null)) {
       return this.#decide([principal], async () => {
         throw new Refused(refusal('bad_claim', MESSAGES.bad_claim), vias.map((via, i) => entry(via, sealed[i]!, 'deny', 'bad_claim')));
@@ -1307,69 +1310,116 @@ class VaultService implements Vault {
     });
   }
 
-  // --- who holds what -----------------------------------------------------------
+  // --- Owners of the whole instance -------------------------------------------------
 
-  #isRootAdmin(principal: string): boolean {
-    return principal.startsWith('user:') && this.#config.rootAdmins.includes(principal.slice('user:'.length));
+  /** Whether the deployment names `principal` an Owner of the whole instance (`owners`). */
+  #listed(principal: string): boolean {
+    return principal.startsWith('user:') && this.#config.owners.includes(principal.slice('user:'.length));
   }
 
   /**
-   * Give a root admin a member row the first time anyone asks about them:
-   * the app's sign-ins and sessions point at it, and their reads queue on
-   * it like anyone's. Logged, and made in a transaction of its own, under
-   * the log's lock: a decision that held the head and then waited for a
-   * member row would take the locks out of order. The row never makes
-   * anyone a root admin; the configuration does. Rows are never deleted, so
-   * one read finds it made already, as on every fresh isolate but the first,
-   * without queueing on the log's lock.
+   * An Owner of the whole instance other than `except`, as their row says
+   * and its check holds (`#integrity`), or null when there is none. A row
+   * changed around the vault owns nothing, and is reported. Read under the
+   * log's head, which every change to a member takes before it writes, the
+   * answer stands until the reader commits.
    */
-  async #rootRow(principal: string): Promise<void> {
-    if (this.#prepared.rooted.has(principal) || (await this.#settled()) !== null) return;
-    if ((await store.member(this.#db, principal)) !== undefined) {
-      this.#prepared.rooted.add(principal);
-      return;
+  async #anOwner(db: Queryable, reports: NewEntry[], except: string | null = null): Promise<string | null> {
+    for (const row of await store.instanceOwners(db)) {
+      if (row.principal === except) continue;
+      if ((await this.#integrity(db, row.principal, row, await store.grants(db, row.principal), reports)) === null) return row.principal;
     }
-    await this.#db.transaction(async (tx) => {
-      await lockLogHead(tx);
-      if ((await store.member(tx, principal)) !== undefined) return;
-      const appended = await this.#append(tx, [
-        {
-          actor: VAULT_ACTOR,
-          action: 'member.add',
-          decision: 'allow',
-          subjectPrincipal: principal,
-          metadata: JSON.stringify({ role: 'member', rootAdmin: true }),
-        },
-      ]);
-      const { occurredAt: at, seqStart } = appended;
-      const row = {
-        principal,
-        status: 'active' as const,
-        role: 'member' as const,
-        scope: EVERYWHERE,
-        generation: 0,
-        createdAt: at,
-        createdBy: VAULT_ACTOR,
-        statusChangedAt: at,
-        statusChangedBy: VAULT_ACTOR,
-        accessSeq: seqStart,
-      };
-      await store.insertMember(tx, { ...row, mac: memberMac(this.#prepared.rowKey, row, []) });
+    return null;
+  }
+
+  /**
+   * Make each of `principals`, people the deployment names (`owners`), an
+   * Owner of the whole instance, whoever else is one: asked about all of
+   * them at the start of each process (`#convert`), and at `access` about
+   * one who owns nothing, which is a new instance's first sign-in, before
+   * the vault has written to its log, and the way back for someone whose
+   * row was changed around the vault since. An unlocked read of each finds
+   * who is one already, the quick way out: a hint, never a report, and
+   * never `#record`, which would settle the vault, and so convert, again;
+   * one it cannot tell, a row changing under it as another process makes
+   * them an Owner, is due. Then one decision, under the others' rows, reads
+   * again (`#makeOwner`). One whose row the log never admitted stays as it is,
+   * and is asked about again at each of their requests. Whether it ran.
+   */
+  async #declare(principals: readonly string[]): Promise<boolean> {
+    const at = await this.#now(this.#db);
+    const due: string[] = [];
+    for (const principal of principals) {
+      const subject = await this.#standing(this.#db, principal, await store.member(this.#db, principal), at, []).catch((error: unknown) => {
+        if (error instanceof Retry) return null;
+        throw error;
+      });
+      if (!(subject?.status === 'active' && ownsInstance(subject.live))) due.push(principal);
+    }
+    if (due.length === 0) return true;
+    const decided = await this.#decideNow(due, async (d) => {
+      for (const principal of due) await this.#makeOwner(d, principal, 'owners');
     });
-    this.#prepared.rooted.add(principal);
+    return decided.ok;
   }
 
+  /**
+   * Refuse a change that would leave `principal`, an Owner of the whole
+   * instance, no longer one, unless another is. Counted under the log's
+   * head: two changes at once, each demoting or removing a different
+   * Owner, lock different rows, and only the head puts one after the other.
+   */
+  async #keepAnOwner(d: Decision, actor: string, principal: string, refused: (code: RefusalCode, message?: string) => Refused): Promise<void> {
+    await lockLogHead(d.tx);
+    if ((await this.#anOwner(d.tx, d.reports, principal)) !== null) return;
+    throw refused('last_owner', actor === principal
+      ? "you're the last Owner of the whole instance: make someone else an Owner first"
+      : `${principal.slice('user:'.length)} is the last Owner of the whole instance: make someone else an Owner first`);
+  }
+
+  /**
+   * Make `principal`, a person, an Owner of the whole instance, as the
+   * vault, for `reason`: admitted, brought back, or given the role, the
+   * grants they hold kept. One whose row fails its check is started over
+   * first, as removing them would; one the log never admitted, whose row was
+   * written around the vault, is left as it is. Whether it made them one.
+   */
+  async #makeOwner(d: Decision, principal: string, reason: 'owners'): Promise<boolean> {
+    const row = d.members.get(principal);
+    const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+    if (subject.status === 'active' && ownsInstance(subject.live)) return false;
+    const tampered = subject.status === 'tampered';
+    if (tampered && (await this.#logged(d.tx, principal)) === undefined) return false;
+    const correlation = { operationId: randomUUID() };
+    const owner = { role: 'owner' as const, scope: EVERYWHERE };
+    d.grants.set(principal, [...subject.stored]);
+    d.touched.add(principal);
+    if (tampered) await this.#startOver(d, VAULT_ACTOR, principal, row, subject.fault!, correlation, (code, message) => new Refused(refusal(code, message ?? MESSAGES[code]), []));
+    if (row === undefined && !tampered) {
+      d.log.push(accessEntry(VAULT_ACTOR, 'member.add', principal, 'allow', correlation, { ...owner, reason }));
+      d.writes.push((at) => store.insertMember(d.tx, {
+        principal, status: 'active', ...owner, generation: 0, createdAt: at, createdBy: VAULT_ACTOR, statusChangedAt: at, statusChangedBy: VAULT_ACTOR, ...UNSEALED,
+      }));
+    } else if (tampered || row?.status === 'removed') {
+      // Coming back keeps the generation a removal, or the start over, moved on to.
+      d.log.push(accessEntry(VAULT_ACTOR, 'member.restore', principal, 'allow', correlation, { ...owner, reason }));
+      d.writes.push((at) => store.updateMember(d.tx, principal, { status: 'active', ...owner, statusChangedAt: at, statusChangedBy: VAULT_ACTOR }));
+    } else {
+      d.log.push(accessEntry(VAULT_ACTOR, 'member.role', principal, 'allow', correlation, { ...owner, previousRole: row!.role, previousScope: row!.scope, reason }));
+      d.writes.push(() => store.updateMember(d.tx, principal, owner));
+    }
+    return true;
+  }
+
+
+  // --- who holds what -----------------------------------------------------------
+
   /**
    * What `principal` holds, their row checked first (`#integrity`): a row
-   * that fails holds nothing, and is `tampered`. A root admin's come from the
-   * configuration, which no row can change.
+   * that fails holds nothing, and is `tampered`.
    */
   async #standing(db: Queryable, principal: string, row: Member | undefined, at: number, reports: NewEntry[]): Promise<Standing> {
     const none = NOTHING;
-    if (this.#isRootAdmin(principal)) {
-      const root: Holdings = { isRootAdmin: true, role: 'owner', scope: EVERYWHERE, grants: [] };
-      return { principal, status: 'active', live: root, all: root, fault: null, stored: [] };
-    }
     const grants = row === undefined ? [] : await store.grants(db, principal);
     const fault = await this.#integrity(db, principal, row, grants, reports);
     if (fault !== null) return { principal, status: 'tampered', live: none, all: none, fault, stored: grants };
@@ -1380,23 +1430,19 @@ class VaultService implements Vault {
     return {
       principal,
       status: 'active',
-      live: { isRootAdmin: false, role, scope, grants: held.filter((grant) => live(grant, at)) },
-      all: { isRootAdmin: false, role, scope, grants: held },
+      live: { role, scope, grants: held.filter((grant) => live(grant, at)) },
+      all: { role, scope, grants: held },
       fault,
       stored: grants,
     };
   }
 
   #access(principal: string, row: Member | undefined, held: readonly GrantRow[], at: number, tampered: boolean): Access {
-    if (this.#isRootAdmin(principal)) {
-      return { principal, status: 'active', generation: row?.generation ?? 0, isRootAdmin: true, role: 'owner', scope: EVERYWHERE, grants: [], since: null, by: null };
-    }
     const active = PRINCIPAL.test(principal) && !tampered && row?.status === 'active';
     return {
       principal,
       status: tampered ? 'tampered' : !PRINCIPAL.test(principal) ? 'unknown' : (row?.status ?? 'unknown'),
       generation: row?.generation ?? 0,
-      isRootAdmin: false,
       ...(active ? roleOf(principal, row) : { role: 'member', scope: EVERYWHERE }),
       grants: active ? held.filter((grant) => live(grant, at) && grantKind(grant) !== null).map(view) : [],
       since: row ? iso(row.statusChangedAt) : null,
@@ -1408,14 +1454,26 @@ class VaultService implements Vault {
    * What `principal` holds now. Read without locks, the fast way; a row that
    * seems to fail its check is read again in one snapshot before anyone is
    * called tampered, since a change committed between two of the reads
-   * looks like one.
+   * looks like one. A person the deployment names (`owners`) who owns
+   * nothing becomes an Owner of the whole instance first (`#declare`). A
+   * vault that holds no key the log's newest entries are under, given the
+   * wrong vault key, cannot tell a row it cannot check from one changed
+   * around it: it says so, an outage, rather than call the member tampered.
+   * A row it can check still answers, so a forged entry that stops it
+   * writing leaves the Owners able to sign in and find it.
    */
   async access(principal: string): Promise<Access> {
-    await this.#settled();
-    if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
+    const superseded = await this.#settled();
+    const access = await this.#read(principal, superseded);
+    if (superseded !== null || !this.#listed(principal) || (access.status === 'active' && ownsInstance(access))) return access;
+    return (await this.#declare([principal])) ? this.#read(principal, superseded) : access;
+  }
+
+  /** `access`, as the rows are now. */
+  async #read(principal: string, superseded: string | null): Promise<Access> {
     const read = async (db: Queryable, reports: NewEntry[]) => {
       const [row, held, at] = await Promise.all([store.member(db, principal), store.grants(db, principal), this.#now(db)]);
-      const fault = this.#isRootAdmin(principal) ? null : await this.#integrity(db, principal, row, held, reports);
+      const fault = await this.#integrity(db, principal, row, held, reports);
       return this.#access(principal, row, held, at, fault !== null);
     };
     const found: NewEntry[] = [];
@@ -1429,6 +1487,7 @@ class VaultService implements Vault {
     }
     const reports: NewEntry[] = [];
     const access = await this.#db.transaction((tx) => read(tx, reports), SNAPSHOT);
+    if (access.status === 'tampered' && superseded !== null) throw new Error(superseded);
     await this.#record(reports);
     return access;
   }
@@ -1448,7 +1507,6 @@ class VaultService implements Vault {
     const held = await store.grants(db);
     const newest = await store.newestAccessEntries(db);
     for (const row of rows) {
-      if (this.#isRootAdmin(row.principal)) continue;
       const grants = held.filter((grant) => grant.principal === row.principal);
       const entry = newest.get(row.principal);
       const holds = entry !== undefined && this.#authentic(entry) && this.#sealed(row, grants) && entry.seq === row.accessSeq;
@@ -1458,7 +1516,7 @@ class VaultService implements Vault {
 
   // --- changing access ----------------------------------------------------------
 
-  setAccess(input: SetAccessInput): Promise<Outcome<{ changes: AccessChange[] }>> {
+  setAccess(input: SetAccessInput): Promise<Outcome<{ changes: AccessChange[]; admitted?: Admitted }>> {
     const { actor, principal } = input;
     const changes = input.changes.map(({ projectId, environmentId, role, expiresAt }) => ({ projectId, environmentId, environmentSlug: null, role, expiresAt }));
     const action = changes.every((change) => change.role === null) ? 'access.revoke' : 'access.grant';
@@ -1474,7 +1532,6 @@ class VaultService implements Vault {
     return this.#decide([actor, principal], async (d) => {
       validateCorrelation(input);
       if (!PRINCIPAL.test(principal)) throw refused('invalid', `not a principal: ${principal}`);
-      if (this.#isRootAdmin(principal)) throw refused('root_admin');
       const places = new Set<string>();
       for (const change of changes) {
         if (grantKind(change) === null) {
@@ -1521,19 +1578,22 @@ class VaultService implements Vault {
       const manages = where.every((place) => mayManageAccess(acting.live, place));
       if (!manages && !(SERVICE.test(principal) && PERSON.test(actor))) throw refused('not_allowed');
       // Managing access never reads a value: nobody gives themselves a role, though they may give one up.
-      if (actor === principal && !acting.live.isRootAdmin && changes.some((change) => change.role !== null)) {
+      if (actor === principal && changes.some((change) => change.role !== null)) {
         throw refused('not_allowed', 'nobody grants themselves a role: ask another admin');
       }
 
       const row = d.members.get(principal);
       const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
       if (subject.status === 'tampered') throw refused('tampered', TAMPERED_SUBJECT);
-      if (row?.status === 'removed') throw refused('removed');
-      if (row === undefined) throw refused('not_a_member');
+      // A service account admitted with its first grants, as `admit` would: all of it, or none.
+      const admitted = input.admit === true && row?.status !== 'active' ? await this.#admitWith(d, acting, principal, row, input) : undefined;
+      if (admitted === undefined && row?.status === 'removed') throw refused('removed');
+      if (admitted === undefined && row === undefined) throw refused('not_a_member');
       if (!manages) {
         // The setting as of the log's head, which a change to it takes too.
         const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
-        const account = await this.#account(d.tx, subject, row);
+        // One just admitted holds nothing yet, and is theirs.
+        const account = admitted !== undefined || row === undefined ? { grants: [], admittedBy: actor } : await this.#account(d.tx, subject, row);
         // Each place's new role they must hold, and what it held before: taking a grant away is changing it.
         const gives = changes.every((change, i) => {
           const before = subject.live.grants.find((grant) => placeKey({ ...grant, environmentSlug: null }) === placeKey(change));
@@ -1546,10 +1606,23 @@ class VaultService implements Vault {
       d.grants.set(principal, [...held]);
       const outcomes = changes.map((change) => this.#apply(d, actor, principal, held, change, input));
       if (d.writes.length > 0) d.touched.add(principal);
-      return { changes: outcomes };
+      return { changes: outcomes, ...(admitted === undefined ? {} : { admitted }) };
     });
   }
 
+  /**
+   * Admit a service account that `setAccess` gives its first grants, as
+   * `admit` would, its refusals logged as `member.add`'s: someone who does
+   * not run the instance sets one up as they would through `admit`.
+   */
+  async #admitWith(d: Decision, acting: Standing, principal: string, row: Member | undefined, input: SetAccessInput): Promise<Admitted> {
+    const refused = (code: RefusalCode, message = MESSAGES[code]) =>
+      new Refused(refusal(code, message), [accessEntry(acting.principal, 'member.add', principal, 'deny', input, { changes: input.changes }, code)]);
+    if (!SERVICE.test(principal)) throw refused('invalid', 'only a service account is admitted with its grants: a person, by an instance role');
+    if (!runsInstance(acting.live)) await this.#setsUp(d, acting, true, refused);
+    return this.#enlist(d, acting, principal, row, undefined, input, refused);
+  }
+
   /** One place's change, logged when it changes what is live. */
   #apply(
     d: Decision,
@@ -1601,7 +1674,7 @@ class VaultService implements Vault {
     return current === undefined ? 'created' : 'updated';
   }
 
-  admit(input: AdmitInput): Promise<Outcome<{ created: boolean; role: InstanceRole; scope: Scope; generation: number }>> {
+  admit(input: AdmitInput): Promise<Outcome<Admitted>> {
     const { actor, principal } = input;
     const asked = input.role === undefined ? {} : { role: input.role, scope: input.scope ?? EVERYWHERE };
     const refused = (code: RefusalCode, message = MESSAGES[code]) =>
@@ -1612,21 +1685,10 @@ class VaultService implements Vault {
       validateCorrelation(input);
       const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
       if (acting.status === 'tampered') throw refused('tampered');
-      if (!runsInstance(acting.live)) {
-        // A service account, with no grant yet, any person who could give it one sets up (`setsUpServices`).
-        const service = SERVICE.test(principal) && (input.role ?? 'member') === 'member' && input.scope === undefined;
-        const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
-        if (!service || !PERSON.test(actor) || !setsUpServices(acting.live, setting, placesOf(await store.liveProjects(d.tx)))) {
-          throw refused('not_allowed', 'only admins and owners of the whole instance may add people or set their roles, and a service account takes access somewhere the instance lets people set one up');
-        }
-        // One removed they bring back only if they removed it themselves, never one someone else took away.
-        const removed = d.members.get(principal);
-        if (removed?.status === 'removed' && removed.statusChangedBy !== actor) {
-          throw refused('not_allowed', `${shownMember(removed.statusChangedBy)} removed this service account: only they, or someone who runs the whole instance, may bring it back`);
-        }
-      }
+      // A service account, with no grant yet, any person who could give it one sets up (`setsUpServices`).
+      const service = SERVICE.test(principal) && (input.role ?? 'member') === 'member' && input.scope === undefined;
+      if (!runsInstance(acting.live)) await this.#setsUp(d, acting, service, refused);
       if (!PRINCIPAL.test(principal)) throw refused('invalid', `not a member: ${shownMember(principal)}`);
-      if (this.#isRootAdmin(principal)) throw refused('root_admin');
       if (input.role !== undefined && !isInstanceRole(input.role)) throw refused('invalid', `no such instance role: ${input.role}`);
       if (input.scope !== undefined && (input.role === undefined || !isScope(input.scope))) throw refused('invalid', 'a scope is a role\'s: { projects, environments }, each all, only or except');
       const wanted = input.role === undefined ? undefined : { role: input.role, scope: input.role === 'member' ? EVERYWHERE : normalScope(input.scope ?? EVERYWHERE) };
@@ -1638,39 +1700,22 @@ class VaultService implements Vault {
       if (subject.status === 'tampered') throw refused('tampered', TAMPERED_SUBJECT);
       d.touched.add(principal);
       d.grants.set(principal, [...subject.stored]);
-      const entry = (action: string, detail: Record<string, unknown>) =>
-        d.log.push(accessEntry(actor, action, principal, 'allow', input, detail));
 
       if (row === undefined || row.status === 'removed') {
-        // Coming back is a fresh start: a member, unless given a role again.
-        const { role, scope } = wanted ?? { role: 'member' as const, scope: EVERYWHERE };
-        entry(row === undefined ? 'member.add' : 'member.restore', { role, scope });
-        d.writes.push(async (at) => {
-          if (row === undefined) {
-            await store.insertMember(d.tx, {
-              principal,
-              status: 'active',
-              role,
-              scope,
-              generation: 0,
-              createdAt: at,
-              createdBy: actor,
-              statusChangedAt: at,
-              statusChangedBy: actor,
-              ...UNSEALED,
-            });
-          } else {
-            await store.updateMember(d.tx, principal, { status: 'active', role, scope, statusChangedAt: at, statusChangedBy: actor });
-          }
-        });
-        // A removal moved the generation on already; coming back keeps it.
-        return { created: true, role, scope, generation: row?.generation ?? 0 };
+        // Added or brought back, as anything but an Owner of the whole instance, one the deployment names would be a listed Member.
+        if (this.#listed(principal) && !(wanted !== undefined && ownsInstance(wanted))) throw refused('not_allowed', declaredOwner(principal));
+        return this.#enlist(d, acting, principal, row, wanted, input, refused);
       }
       const changed = wanted !== undefined && JSON.stringify(standing(wanted)) !== JSON.stringify(standing(row));
-      // Nobody sets their own role: running the instance never lets anyone widen what they hold themselves.
-      if (changed && actor === principal) throw refused('not_allowed', 'nobody changes their own instance role: ask another admin');
+      // One the deployment names stays an Owner of the whole instance, whoever asks: the list says where to change that.
+      if (changed && this.#listed(principal) && !ownsInstance(wanted)) throw refused('not_allowed', declaredOwner(principal));
+      // Read under both rows' locks: neither the actor's role nor the subject's changes before this commits.
+      if (changed && (wanted.role === 'owner' || subject.live.role === 'owner') && !ownsInstance(acting.live)) throw refused('not_allowed', OWNERS_ONLY);
+      // Nobody sets their own role, but an Owner of the whole instance, who holds all there is: running the instance never lets anyone widen what they hold themselves.
+      if (changed && actor === principal && !ownsInstance(acting.live)) throw refused('not_allowed', 'nobody changes their own instance role: ask another admin');
+      if (changed && ownsInstance(subject.live) && !ownsInstance(wanted)) await this.#keepAnOwner(d, actor, principal, refused);
       if (changed) {
-        entry('member.role', { role: wanted.role, scope: wanted.scope, previousRole: row.role, previousScope: row.scope });
+        d.log.push(accessEntry(actor, 'member.role', principal, 'allow', input, { role: wanted.role, scope: wanted.scope, previousRole: row.role, previousScope: row.scope }));
         d.writes.push(() => store.updateMember(d.tx, principal, { role: wanted.role, scope: wanted.scope }));
         return { created: false, ...wanted, generation: row.generation };
       }
@@ -1678,6 +1723,63 @@ class VaultService implements Vault {
     });
   }
 
+  /**
+   * Whether `acting`, who does not run the instance, may admit `principal`:
+   * only a service account (`service`: one asked for with no role), as a
+   * person who could give it a grant somewhere (`setsUpServices`), and one
+   * removed only if they removed it themselves, never one someone else
+   * took away.
+   */
+  async #setsUp(d: Decision, acting: Standing, service: boolean, refused: (code: RefusalCode, message?: string) => Refused): Promise<void> {
+    const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
+    if (!service || !PERSON.test(acting.principal) || !setsUpServices(acting.live, setting, placesOf(await store.liveProjects(d.tx)))) {
+      throw refused('not_allowed', 'only admins and owners of the whole instance may add people or set their roles, and a service account takes access somewhere the instance lets people set one up');
+    }
+  }
+
+  /**
+   * Admit `principal`, who has no row or a removed one: a fresh start, as a
+   * member unless given a role (`wanted`), at the generation a removal
+   * moved on. The caller has checked who may, and locked the row.
+   */
+  #enlist(
+    d: Decision,
+    acting: Standing,
+    principal: string,
+    row: Member | undefined,
+    wanted: { role: InstanceRole; scope: Scope } | undefined,
+    correlation: Correlation,
+    refused: (code: RefusalCode, message?: string) => Refused,
+  ): Admitted {
+    const actor = acting.principal;
+    if (row?.status === 'removed' && row.statusChangedBy !== actor && !runsInstance(acting.live)) {
+      throw refused('not_allowed', `${shownMember(row.statusChangedBy)} removed this service account: only they, or someone who runs the whole instance, may bring it back`);
+    }
+    if (wanted?.role === 'owner' && !ownsInstance(acting.live)) throw refused('not_allowed', OWNERS_ONLY);
+    const { role, scope } = wanted ?? { role: 'member' as const, scope: EVERYWHERE };
+    d.log.push(accessEntry(actor, row === undefined ? 'member.add' : 'member.restore', principal, 'allow', correlation, { role, scope }));
+    d.writes.push(async (at) => {
+      if (row === undefined) {
+        await store.insertMember(d.tx, {
+          principal,
+          status: 'active',
+          role,
+          scope,
+          generation: 0,
+          createdAt: at,
+          createdBy: actor,
+          statusChangedAt: at,
+          statusChangedBy: actor,
+          ...UNSEALED,
+        });
+      } else {
+        await store.updateMember(d.tx, principal, { status: 'active', role, scope, statusChangedAt: at, statusChangedBy: actor });
+      }
+    });
+    // A removal moved the generation on already; coming back keeps it.
+    return { created: true, role, scope, generation: row?.generation ?? 0 };
+  }
+
   remove(input: RemoveInput): Promise<Outcome<{ revoked: Grant[]; generation: number }>> {
     const { actor, principal } = input;
     const refused = (code: RefusalCode, message = MESSAGES[code]) =>
@@ -1685,13 +1787,13 @@ class VaultService implements Vault {
     return this.#decide([actor, principal], async (d) => {
       validateCorrelation(input);
       if (!PRINCIPAL.test(principal)) throw refused('invalid', `not a member: ${shownMember(principal)}`);
-      if (this.#isRootAdmin(principal)) throw refused('root_admin');
       const row = d.members.get(principal);
       const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
       if (acting.status === 'tampered') throw refused('tampered');
       const holder = acting.live;
       const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
       const held = subject.stored;
+      if (this.#listed(principal)) throw refused('not_allowed', declaredOwner(principal));
       if (subject.status === 'tampered') {
         if (!runsInstance(holder)) throw refused('not_allowed', 'only admins and owners of the whole instance may remove a member whose record failed its check');
         return this.#startOver(d, actor, principal, row, subject.fault!, input, refused);
@@ -1703,6 +1805,8 @@ class VaultService implements Vault {
         if (!theirs) throw refused('not_allowed', 'only admins and owners of the whole instance may remove members, and a service account whoever manages it');
       }
       if (row?.status !== 'active') throw refused(row === undefined ? 'not_a_member' : 'removed');
+      if (subject.live.role === 'owner' && !ownsInstance(holder)) throw refused('not_allowed', OWNERS_ONLY);
+      if (ownsInstance(subject.live)) await this.#keepAnOwner(d, actor, principal, refused);
 
       const revoked = held.filter((grant) => live(grant, d.at));
       for (const grant of revoked) {
@@ -2048,14 +2152,16 @@ class VaultService implements Vault {
     });
   }
 
-  async about(): Promise<{ checkpointKeys: Record<string, CheckpointKey>; rootAdmins: string[] }> {
+  async about(): Promise<{ checkpointKeys: Record<string, CheckpointKey>; owners: string[]; rootAdmins: [] }> {
     await this.#settled();
     const { signers, since } = this.#prepared;
     // A key it replaced vouches only for prefixes before its first entry under the current one: none, before it has one.
     const until = Number(since ?? 0n);
     return {
       checkpointKeys: Object.fromEntries(signers.map(({ keyId, publicKey }, i) => [keyId, { publicKey, until: i === 0 ? null : until }])),
-      rootAdmins: this.#config.rootAdmins.map((email) => `user:${email}`),
+      owners: [...this.#config.owners],
+      // For an app of 0.5 while it runs beside this vault: there are none, and its lists and checks need the field.
+      rootAdmins: [],
     };
   }