@synopackageland/cli 0.4.0 → 0.4.1

package/templates/native-go/backend/internal/helper/readonly_operations_linux.go

@@ -0,0 +1,168 @@
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"golang.org/x/sys/unix"
+	"io"
+	"path"
+)
+
+func authorizeReadOnly(ctx context.Context, o *readOnlyObject, w readOnlyWork, acl readOnlyACL) Code {
+	if code := nativeContextCode(ctx); code != "" {
+		return code
+	}
+	if acl == nil {
+		return ErrUnsupported
+	}
+	for _, fd := range []int{int(o.nodes[o.root].file.Fd()), int(o.data.Fd())} {
+		if code := nativeObservationCode(ctx, acl.Authorize(ctx, w.Action, fd)); code != "" {
+			return code
+		}
+	}
+	return o.check()
+}
+func readOnlyUnchanged(fd int, before unix.Stat_t) Code {
+	var after unix.Stat_t
+	if code := readOnlyInspect(fd, &after); code != "" {
+		return code
+	}
+	if !sameReadOnlyObject(before, after) || before.Size != after.Size || before.Mtim != after.Mtim || before.Ctim != after.Ctim {
+		return ErrStale
+	}
+	return ""
+}
+func readOnlyEntry(name string, st unix.Stat_t) (Entry, Code) {
+	var id [32]byte
+	if _, err := rand.Read(id[:]); err != nil {
+		return Entry{}, ErrUnavailable
+	}
+	kind := "regular"
+	size := uint64(st.Size)
+	if st.Mode&unix.S_IFMT == unix.S_IFDIR {
+		kind = "directory"
+		size = 0
+	}
+	return Entry{EntryID: hex.EncodeToString(id[:]), Name: name, Kind: kind, Bytes: size}, ""
+}
+func executeReadOnly(ctx context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork, acl readOnlyACL) (readOnlyResult, []byte) {
+	fail := func(c Code) (readOnlyResult, []byte) { return readOnlyResult{Code: c}, nil }
+	if c := nativeContextCode(ctx); c != "" {
+		return fail(c)
+	}
+	if c := w.validate(); c != "" {
+		return fail(c)
+	}
+	if acl == nil || w.Action == ActionReadStream {
+		return fail(ErrUnsupported)
+	}
+	timeout := MetadataTimeout
+	if w.Action == ActionRead {
+		timeout = BoundedTimeout
+	}
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	o, c := resolveReadOnly(ctx, pin, w)
+	if c != "" {
+		return fail(c)
+	}
+	defer o.Close()
+	if c = authorizeReadOnly(ctx, o, w, acl); c != "" {
+		return fail(c)
+	}
+	result := readOnlyResult{}
+	var data []byte
+	switch w.Action {
+	case ActionRead:
+		if o.before.Mode&unix.S_IFMT != unix.S_IFREG {
+			return fail(ErrDenied)
+		}
+		if o.before.Size < 0 || uint64(o.before.Size) > w.MaxBytes {
+			return fail(ErrLimit)
+		}
+		var err error
+		data, err = io.ReadAll(io.LimitReader(o.data, int64(w.MaxBytes)+1))
+		if err != nil {
+			return fail(readOnlyError(err))
+		}
+		if uint64(len(data)) > w.MaxBytes {
+			return fail(ErrLimit)
+		}
+		result.Bytes = uint64(len(data))
+	case ActionStat:
+		e, c := readOnlyEntry(path.Base(w.RootPath), o.before)
+		if len(w.Segments) > 0 {
+			e.Name = w.Segments[len(w.Segments)-1]
+		}
+		if c != "" {
+			return fail(c)
+		}
+		result.Entry = &e
+	case ActionList:
+		if o.before.Mode&unix.S_IFMT != unix.S_IFDIR {
+			return fail(ErrDenied)
+		}
+		// No unbound cursor or unbounded sort/scan. Oversized/changed directories
+		// refuse without metadata; pagination is a separate server-bound extension.
+		names, err := o.data.Readdirnames(MaxPageEntries + 1)
+		if err != nil && err != io.EOF {
+			return fail(readOnlyError(err))
+		}
+		if len(names) > MaxPageEntries {
+			return fail(ErrLimit)
+		}
+		entries := []Entry{}
+		for _, name := range names {
+			if c := nativeContextCode(ctx); c != "" {
+				return fail(c)
+			}
+			child := w
+			child.Action = ActionStat
+			child.Limit = 0
+			child.Segments = append(append([]string{}, w.Segments...), name)
+			if child.validate() != "" {
+				continue
+			}
+			object, code := resolveReadOnly(ctx, pin, child)
+			if code == ErrDenied {
+				continue
+			}
+			if code != "" {
+				return fail(code)
+			}
+			code = authorizeReadOnly(ctx, object, w, acl)
+			if code == "" {
+				var entry Entry
+				entry, code = readOnlyEntry(name, object.before)
+				if code == "" {
+					entries = append(entries, entry)
+				}
+			}
+			object.Close()
+			if code == ErrDenied {
+				continue
+			}
+			if code != "" {
+				return fail(code)
+			}
+			if len(entries) > int(w.Limit) {
+				return fail(ErrLimit)
+			}
+		}
+		result.List = &ListResult{Entries: entries}
+	}
+	if c := authorizeReadOnly(ctx, o, w, acl); c != "" {
+		return fail(c)
+	}
+	if c := readOnlyUnchanged(int(o.data.Fd()), o.before); c != "" {
+		return fail(c)
+	}
+	// Metadata travels only over the private seqpacket, bulk read bytes never JSON.
+	b, err := json.Marshal(result)
+	if err != nil || len(b) > MaxControlBytes-2048 {
+		return fail(ErrLimit)
+	}
+	return result, data
+}

package/templates/native-go/backend/internal/helper/readonly_resolver_linux.go

@@ -0,0 +1,241 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"golang.org/x/sys/unix"
+	"os"
+	"strings"
+)
+
+type pinnedReadOnlyRoot struct {
+	path string
+	file *os.File
+}
+
+func (r *pinnedReadOnlyRoot) readOnlyRootPath() string                        { return r.path }
+func (r *pinnedReadOnlyRoot) sameReadOnlyRoot(other readOnlyRootWitness) bool { return r == other }
+
+func (r *pinnedReadOnlyRoot) Close() error { return r.file.Close() }
+
+type readOnlyNode struct {
+	file  *os.File
+	name  string
+	stat  unix.Stat_t
+	mount uint64
+}
+type readOnlyObject struct {
+	nodes  []readOnlyNode
+	root   int
+	data   *os.File
+	before unix.Stat_t
+}
+
+func (o *readOnlyObject) Close() {
+	if o.data != nil {
+		o.data.Close()
+	}
+	for _, n := range o.nodes {
+		n.file.Close()
+	}
+}
+func readOnlyError(err error) Code {
+	if errors.Is(err, unix.EACCES) || errors.Is(err, unix.EPERM) {
+		return ErrDenied
+	}
+	if errors.Is(err, unix.ENOENT) || errors.Is(err, unix.ENOTDIR) || errors.Is(err, unix.ELOOP) {
+		return ErrStale
+	}
+	return ErrUnavailable
+}
+func readOnlyNodeAt(parent int, name string) (readOnlyNode, Code) {
+	fd, err := unix.Openat(parent, name, unix.O_PATH|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return readOnlyNode{}, readOnlyError(err)
+	}
+	n := readOnlyNode{file: os.NewFile(uintptr(fd), "readonly-object"), name: name}
+	code := readOnlyInspect(fd, &n.stat)
+	if code == "" {
+		n.mount, code = readOnlyMountID(fd)
+	}
+	if code != "" {
+		n.file.Close()
+		return readOnlyNode{}, code
+	}
+	// O_PATH alone does not require search permission. Resolve '.' under actor
+	// credentials to require execute/search on every directory, including root.
+	if n.stat.Mode&unix.S_IFMT == unix.S_IFDIR {
+		probe, err := unix.Openat(fd, ".", unix.O_PATH|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+		if err != nil {
+			n.file.Close()
+			return readOnlyNode{}, readOnlyError(err)
+		}
+		unix.Close(probe)
+	}
+	return n, ""
+}
+func readOnlyInspect(fd int, st *unix.Stat_t) Code {
+	if err := unix.Fstat(fd, st); err != nil {
+		return readOnlyError(err)
+	}
+	switch st.Mode & unix.S_IFMT {
+	case unix.S_IFDIR:
+		return ""
+	case unix.S_IFREG:
+		if st.Nlink != 1 {
+			return ErrDenied
+		}
+		return ""
+	}
+	return ErrDenied // never open a FIFO, device, socket or symlink for data
+}
+func sameReadOnlyObject(a, b unix.Stat_t) bool {
+	return a.Dev == b.Dev && a.Ino == b.Ino && a.Mode&unix.S_IFMT == b.Mode&unix.S_IFMT
+}
+func (o *readOnlyObject) check() Code {
+	for i, n := range o.nodes {
+		var st unix.Stat_t
+		if code := readOnlyInspect(int(n.file.Fd()), &st); code != "" {
+			return code
+		}
+		if !sameReadOnlyObject(st, n.stat) {
+			return ErrStale
+		}
+		if i == 0 {
+			continue
+		}
+		current, code := readOnlyNodeAt(int(o.nodes[i-1].file.Fd()), n.name)
+		if code != "" {
+			return code
+		}
+		match := sameReadOnlyObject(current.stat, n.stat) && current.mount == n.mount
+		current.file.Close()
+		if !match {
+			return ErrStale
+		}
+	}
+	var current unix.Stat_t
+	if code := readOnlyInspect(int(o.data.Fd()), &current); code != "" {
+		return code
+	}
+	target := o.nodes[len(o.nodes)-1]
+	if !sameReadOnlyObject(current, target.stat) {
+		return ErrStale
+	}
+	return ""
+}
+
+// A pin is an O_PATH continuity witness, NOT a root-opened data/ACL capability.
+// It remains live for one approved epoch only; never reconstruct it from inode.
+func pinReadOnlyRoot(path string) (*pinnedReadOnlyRoot, Code) {
+	w := readOnlyWork{RootPath: path, Action: ActionStat, Segments: []string{}}
+	if code := w.validate(); code != "" {
+		return nil, code
+	}
+	slash, code := readOnlyNodeAt(unix.AT_FDCWD, "/")
+	if code != "" {
+		return nil, code
+	}
+	current := slash
+	for _, segment := range strings.Split(path[1:], "/") {
+		next, c := readOnlyNodeAt(int(current.file.Fd()), segment)
+		current.file.Close()
+		if c != "" {
+			return nil, c
+		}
+		current = next
+		if current.stat.Mode&unix.S_IFMT != unix.S_IFDIR {
+			current.file.Close()
+			return nil, ErrDenied
+		}
+	}
+	if code := readOnlyLocalMount(int(current.file.Fd())); code != "" {
+		current.file.Close()
+		return nil, code
+	}
+	return &pinnedReadOnlyRoot{path: path, file: current.file}, ""
+}
+
+// Always uses the 4.4-compatible walk; openat2 is not a dependency. All ancestry
+// FDs stay pinned. No realpath, Clean, pathname ACL-then-open or proc data alias.
+func resolveReadOnly(ctx context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork) (*readOnlyObject, Code) {
+	if code := nativeContextCode(ctx); code != "" {
+		return nil, code
+	}
+	if pin == nil || pin.file == nil || pin.path != w.RootPath {
+		return nil, ErrSuspended
+	}
+	flags, err := unix.FcntlInt(pin.file.Fd(), unix.F_GETFL, 0)
+	if err != nil || flags&unix.O_PATH == 0 {
+		return nil, ErrDenied
+	}
+	var expected unix.Stat_t
+	if unix.Fstat(int(pin.file.Fd()), &expected) != nil || expected.Mode&unix.S_IFMT != unix.S_IFDIR {
+		return nil, ErrSuspended
+	}
+	mount, code := readOnlyMountID(int(pin.file.Fd()))
+	if code != "" {
+		return nil, code
+	}
+	o := &readOnlyObject{}
+	ok := false
+	defer func() {
+		if !ok {
+			o.Close()
+		}
+	}()
+	slash, code := readOnlyNodeAt(unix.AT_FDCWD, "/")
+	if code != "" {
+		return nil, code
+	}
+	o.nodes = append(o.nodes, slash)
+	parts := strings.Split(w.RootPath[1:], "/")
+	o.root = len(parts)
+	parts = append(parts, w.Segments...)
+	for i, segment := range parts {
+		if code := nativeContextCode(ctx); code != "" {
+			return nil, code
+		}
+		parent := o.nodes[len(o.nodes)-1]
+		if parent.stat.Mode&unix.S_IFMT != unix.S_IFDIR {
+			return nil, ErrDenied
+		}
+		next, code := readOnlyNodeAt(int(parent.file.Fd()), segment)
+		if code != "" {
+			return nil, code
+		}
+		o.nodes = append(o.nodes, next)
+		if i+1 >= o.root && (next.mount != mount || next.stat.Dev != expected.Dev) {
+			return nil, ErrSuspended
+		}
+		if i+1 == o.root && !sameReadOnlyObject(next.stat, expected) {
+			return nil, ErrSuspended
+		}
+	}
+	if code := readOnlyLocalMount(int(o.nodes[o.root].file.Fd())); code != "" {
+		return nil, code
+	}
+	target := o.nodes[len(o.nodes)-1]
+	parent := o.nodes[len(o.nodes)-2]
+	// Type-probe precedes nonblocking data open; compare both captured objects.
+	fd, err := unix.Openat(int(parent.file.Fd()), target.name, unix.O_RDONLY|unix.O_NONBLOCK|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, readOnlyError(err)
+	}
+	o.data = os.NewFile(uintptr(fd), "readonly-data")
+	if code := readOnlyInspect(fd, &o.before); code != "" {
+		return nil, code
+	}
+	m, code := readOnlyMountID(fd)
+	if code != "" {
+		return nil, code
+	}
+	if !sameReadOnlyObject(o.before, target.stat) || m != mount {
+		return nil, ErrStale
+	}
+	if code := o.check(); code != "" {
+		return nil, code
+	}
+	ok = true
+	return o, ""
+}

package/templates/native-go/backend/internal/helper/readonly_test.go

@@ -0,0 +1,40 @@
+package helper
+
+import "testing"
+
+func TestReadOnlyWorkClosedActionsAndBounds(t *testing.T) {
+	for _, action := range []Action{ActionStat, ActionList, ActionRead} {
+		w := readOnlyWork{RootPath: "/fixture", Action: action, Segments: []string{"file"}}
+		if action == ActionList {
+			w.Limit = 10
+		}
+		if action == ActionRead {
+			w.MaxBytes = MaxBoundedBytes
+		}
+		if c := w.validate(); c != "" {
+			t.Fatal(action, c)
+		}
+		for _, name := range []string{"path", "traverse", "symlink-name", "limit", "action", "extra"} {
+			t.Run(string(action)+name, func(t *testing.T) {
+				bad := w
+				switch name {
+				case "path":
+					bad.RootPath = "relative"
+				case "traverse":
+					bad.Segments = []string{".."}
+				case "symlink-name":
+					bad.Segments = []string{"a/b"}
+				case "limit":
+					bad.MaxBytes = MaxBoundedBytes + 1
+				case "action":
+					bad.Action = ActionCreate
+				case "extra":
+					bad.Limit = MaxPageEntries + 1
+				}
+				if bad.validate() == "" {
+					t.Fatal("invalid work accepted")
+				}
+			})
+		}
+	}
+}

package/templates/native-go/backend/internal/helper/relaxed_identity.go

@@ -0,0 +1,252 @@
+package helper
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"slices"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+func validRelaxedIdentity(id RelaxedIdentity) bool {
+	return id.UID != 0 && id.Username != "" && len(id.Username) <= MaxSegmentBytes && utf8.ValidString(id.Username) && !strings.ContainsAny(id.Username, "\x00\r\n/\\")
+}
+func relaxedActorIdentity(a NativeActor) RelaxedIdentity {
+	return RelaxedIdentity{a.UID(), a.Username()}
+}
+func relaxedPrincipalIdentity(p Principal) RelaxedIdentity { return RelaxedIdentity{p.UID, p.Username} }
+func relaxedRelated(a, b RelaxedIdentity) bool             { return a.UID == b.UID || a.Username == b.Username }
+func (r *relaxedProvider) resolve(ctx context.Context, c SessionCarriers, now func() time.Time) (NativeActor, Code) {
+	if r == nil || r.authority == nil || now == nil || r.adapters.Sessions == nil || r.adapters.Accounts == nil || r.adapters.Groups == nil || r.adapters.App == nil {
+		return NativeActor{}, ErrUnavailable
+	}
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	if code := nativeContextCode(ctx); code != "" {
+		return NativeActor{}, code
+	}
+	if c.Cookie == "" {
+		return NativeActor{}, ErrDenied
+	}
+	if c.ClientAddress == "" {
+		return NativeActor{}, ErrUnavailable
+	}
+	s, code := r.adapters.Sessions.ValidateRelaxedSession(ctx, c)
+	if code = nativeObservationCode(ctx, code); code != "" {
+		return NativeActor{}, code
+	}
+	if !validRelaxedIdentity(RelaxedIdentity{UID: 1, Username: s.Username}) {
+		return NativeActor{}, ErrDenied
+	}
+	if !s.CSRFVerified || r.adapters.AppPrivilegeID == "" {
+		return NativeActor{}, ErrUnsupported
+	}
+	if !allReferences(s.SessionRef) {
+		return NativeActor{}, ErrUnavailable
+	}
+	if !nativeFresh(s.CheckedAt, now()) {
+		return NativeActor{}, ErrStale
+	}
+	a, code := r.adapters.Accounts.LookupRelaxedAccount(ctx, s.Username)
+	if code = nativeObservationCode(ctx, code); code != "" {
+		if code == ErrDenied {
+			if cleanup := r.invalidateName(ctx, s.Username); cleanup != "" {
+				return NativeActor{}, cleanup
+			}
+		}
+		return NativeActor{}, code
+	}
+	if !nativeFresh(a.CheckedAt, now()) {
+		return NativeActor{}, ErrStale
+	}
+	if a.Kind != "local" {
+		return NativeActor{}, ErrUnsupported
+	}
+	if a.StateKnown && !a.Exists {
+		if code = r.invalidateName(ctx, s.Username); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrDenied
+	}
+	if a.Identity.Username != s.Username {
+		if code = r.invalidateName(ctx, s.Username, a.Identity); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrSuspended
+	}
+	if !a.StateKnown || !a.ExpiryKnown || !a.PasswordKnown || !a.PrimaryGIDKnown {
+		return NativeActor{}, ErrUnavailable
+	}
+	if !a.Exists || !a.Enabled || a.Expired || !a.PasswordUsable {
+		if code = r.invalidateName(ctx, s.Username, a.Identity); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrDenied
+	}
+	if !validRelaxedIdentity(a.Identity) || a.PrimaryGID == 0 {
+		return NativeActor{}, ErrDenied
+	}
+	g, code := r.adapters.Groups.LookupRelaxedGroups(ctx, a)
+	if code = nativeObservationCode(ctx, code); code != "" {
+		return NativeActor{}, code
+	}
+	if !nativeFresh(g.CheckedAt, now()) {
+		return NativeActor{}, ErrStale
+	}
+	if g.Identity != a.Identity || g.PrimaryGID != a.PrimaryGID {
+		if code = r.invalidate(ctx, []RelaxedIdentity{a.Identity}); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrSuspended
+	}
+	if g.Groups == nil || len(g.Groups) > 1024 || !g.Complete || !g.AdminKnown {
+		return NativeActor{}, ErrUnavailable
+	}
+	app, code := r.adapters.App.ValidateRelaxedApp(ctx, c, s, a, r.adapters.AppPrivilegeID)
+	if code = nativeObservationCode(ctx, code); code != "" {
+		if code == ErrDenied {
+			if cleanup := r.invalidate(ctx, []RelaxedIdentity{a.Identity}); cleanup != "" {
+				return NativeActor{}, cleanup
+			}
+		}
+		return NativeActor{}, code
+	}
+	if !nativeFresh(app.CheckedAt, now()) {
+		return NativeActor{}, ErrStale
+	}
+	if app.Identity != a.Identity || app.ClientAddress != c.ClientAddress || app.AppID != r.adapters.AppPrivilegeID || app.SessionRef != s.SessionRef {
+		return NativeActor{}, ErrDenied
+	}
+	if !app.Allowed {
+		// Conservative grant revocation also stops this caller's foreign-shared work.
+		if code = r.invalidate(ctx, []RelaxedIdentity{a.Identity}); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrDenied
+	}
+	oldest := s.CheckedAt
+	for _, at := range []time.Time{a.CheckedAt, g.CheckedAt, app.CheckedAt} {
+		if at.Before(oldest) {
+			oldest = at
+		}
+	}
+	if !nativeFresh(oldest, now()) {
+		return NativeActor{}, ErrStale
+	}
+	principal, code := r.principal(ctx, a.Identity)
+	if code != "" {
+		return NativeActor{}, code
+	}
+	if !nativeFresh(oldest, now()) {
+		return NativeActor{}, ErrStale
+	}
+	groups := slices.Clone(g.Groups)
+	slices.Sort(groups)
+	groups = slices.Compact(groups)
+	return NativeActor{relaxed: r, account: LocalAccount{Principal: principal, Username: a.Identity.Username, Enabled: true, UID: a.Identity.UID, GID: a.PrimaryGID, Groups: groups, Admin: g.Admin, CheckedAt: oldest}, sessionRef: s.SessionRef, valid: true}, ""
+}
+func (r *relaxedProvider) principal(ctx context.Context, id RelaxedIdentity) (Principal, Code) {
+	a := r.authority
+	a.mu.Lock()
+	if r.blocked[id] {
+		a.mu.Unlock()
+		return Principal{}, ErrCleanupRequired
+	}
+	mismatches := map[RelaxedIdentity]bool{}
+	code := a.transaction(func(s *GrantStore) (bool, Code) {
+		for _, g := range s.Grants {
+			if g.State == GrantRevoked {
+				continue
+			}
+			for _, p := range []Principal{g.Owner, g.Issuer} {
+				if p.IdentityBasis != "uid-username" {
+					continue
+				}
+				before := relaxedPrincipalIdentity(p)
+				if before != id && relaxedRelated(before, id) {
+					mismatches[before] = true
+				}
+			}
+		}
+		return false, ""
+	})
+	if code != "" {
+		a.mu.Unlock()
+		return Principal{}, code
+	}
+	if len(mismatches) > 0 {
+		// Block the prospective identity too until every old grant has Q.
+		ids := make([]RelaxedIdentity, 0, len(mismatches))
+		for key := range mismatches {
+			ids = append(ids, key)
+		}
+		if code = r.invalidateLocked(ctx, ids, id); code != "" {
+			return Principal{}, code
+		}
+		return Principal{}, ErrSuspended
+	}
+	defer a.mu.Unlock()
+	if p, ok := r.principals[id]; ok {
+		return p, ""
+	}
+	if len(r.principals) >= MaxReplayEntries {
+		return Principal{}, ErrBusy
+	}
+	ref, code := randomGrantID()
+	if code != "" {
+		return Principal{}, code
+	}
+	// The digest is an index, never a session or birth proof. InstanceRef is a
+	// per-owner random generation rotated on observed invalidation/restart.
+	b, _ := json.Marshal(struct {
+		Basis    string
+		Identity RelaxedIdentity
+	}{"uid-username", id})
+	sum := sha256.Sum256(b)
+	p := Principal{Kind: "local", SubjectRef: hex.EncodeToString(sum[:]), InstanceRef: ref, IdentityBasis: "uid-username", UID: id.UID, Username: id.Username}
+	r.principals[id] = p
+	return p, ""
+}
+func (r *relaxedProvider) revalidate(ctx context.Context, c SessionCarriers, old NativeActor, now func() time.Time) (NativeActor, Code) {
+	if old.relaxed != r || old.managed != nil {
+		return NativeActor{}, ErrSuspended
+	}
+	current, code := r.resolve(ctx, c, now)
+	if code != "" {
+		return NativeActor{}, code
+	}
+	if relaxedActorIdentity(old) != relaxedActorIdentity(current) {
+		r.authority.mu.Lock()
+		if code = r.invalidateLocked(ctx, []RelaxedIdentity{relaxedActorIdentity(old)}, relaxedActorIdentity(current)); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrSuspended
+	}
+	if old.Principal() != current.Principal() {
+		return NativeActor{}, ErrSuspended
+	}
+	if old.GID() != current.GID() || old.Admin() != current.Admin() || old.SessionRef() != current.SessionRef() || !slices.Equal(old.Groups(), current.Groups()) {
+		return NativeActor{}, ErrStale
+	}
+	return current, ""
+}
+func (a *GrantAuthority) relaxedActorLocked(actor NativeActor) Code {
+	if actor.relaxed == nil {
+		if a.native != nil && a.native.relaxed != nil {
+			return ErrDenied
+		}
+		return ""
+	}
+	if a.native == nil || a.native.relaxed != actor.relaxed || actor.managed != nil {
+		return ErrDenied
+	}
+	r := actor.relaxed
+	id := relaxedActorIdentity(actor)
+	if r.blocked[id] || r.principals[id] != actor.Principal() {
+		return ErrSuspended
+	}
+	return ""
+}