msgctl 0.1.0a1__py3-none-any.whl

msg/market/policy.py

@@ -0,0 +1,147 @@
+"""Small, immutable policies. No expressions, callbacks or model discretion."""
+from __future__ import annotations
+
+from msg.core.codec import canonical, digest, loads
+from msg.core.errors import require
+from msg.core.query import QuerySession
+
+DEFAULT_POLICY = {
+    'id': 'dispute-v1', 'version': 1,
+    'funding_timeout_seconds': 900, 'delivery_timeout_seconds': 86400,
+    'case_timeout_seconds': 604800, 'decision_lifetime_seconds': 86400,
+    'panel_size': 3, 'quorum': 2, 'candidates': [],
+    'allow_appeal': False, 'appeal_seconds': 3600,
+    'selection': 'sha256-order-policy-round-subject-v1',
+    'member_invalidation': 'hold-no-replacement-v1',
+    'rules': 'objective-faults-v1',
+}
+
+
+def validate(policy):
+    require(isinstance(policy, dict) and set(policy) == set(DEFAULT_POLICY),
+            'arbitration_policy_invalid')
+    require(isinstance(policy['id'], str) and 1 <= len(policy['id']) <= 80 and
+            type(policy['version']) is int and policy['version'] == 1 and policy['rules'] == 'objective-faults-v1' and
+            policy['selection'] == DEFAULT_POLICY['selection'] and
+            policy['member_invalidation'] == DEFAULT_POLICY['member_invalidation'],
+            'arbitration_policy_invalid')
+    for name, maximum in (('funding_timeout_seconds', 86400),
+                          ('delivery_timeout_seconds', 2592000),
+                          ('case_timeout_seconds', 2592000),
+                          ('decision_lifetime_seconds', 604800),
+                          ('appeal_seconds', 86400)):
+        require(type(policy[name]) is int and 60 <= policy[name] <= maximum,
+                'arbitration_policy_invalid', name)
+    size, quorum, candidates = policy['panel_size'], policy['quorum'], policy['candidates']
+    require(type(size) is int and 1 <= size <= 9 and type(quorum) is int and
+            size // 2 < quorum <= size and type(policy['allow_appeal']) is bool and
+            isinstance(candidates, list) and len(candidates) <= 100 and
+            all(isinstance(s, str) and s.startswith('u_') and s != 'u_root'
+                for s in candidates) and len(candidates) == len(set(candidates)),
+            'arbitration_policy_invalid')
+    require(not policy['allow_appeal'] or
+            policy['decision_lifetime_seconds'] > policy['appeal_seconds'],
+            'arbitration_policy_invalid')
+    return policy
+
+
+def load_policy(tx: QuerySession, policy_id: str):
+    row = tx.one('SELECT body,digest FROM arbitration_policies WHERE id=?', (policy_id,))
+    if row:
+        policy = loads(row[0])
+        require(digest(policy) == row[1], 'arbitration_policy_corrupt')
+    else:
+        require(policy_id == DEFAULT_POLICY['id'], 'arbitration_policy_unknown')
+        policy = loads(canonical(DEFAULT_POLICY))
+    return validate(policy)
+
+
+def snapshot(tx, policy_id):
+    policy = load_policy(tx, policy_id)
+    # Freeze the grant epoch, not merely the subject: revoke+regrant cannot revive
+    # a vote or silently replace a member in an existing order.
+    epochs = {}
+    for candidate in policy['candidates']:
+        row = tx.one('SELECT epoch,active FROM arbitrator_roles WHERE subject=?', (candidate,))
+        if row and row[1]:
+            epochs[candidate] = row[0]
+    return {'policy': policy, 'policy_digest': digest(policy), 'candidate_epochs': epochs}
+
+
+def contract(tx, order_id):
+    row = tx.one('SELECT body,digest FROM order_contracts WHERE order_id=?', (order_id,))
+    require(row is not None, 'order_contract_required')
+    body = loads(row[0])
+    require(digest(body) == row[1] and body['order_id'] == order_id,
+            'order_contract_corrupt')
+    validate_projection(tx, body)
+    return body
+
+
+def delivery_snapshot(tx, order_id):
+    """Commit delivery identity and prepared bytes, excluding subsequent buyer ACK."""
+    from msg.plugins.delivery import _delivery
+    delivery = _delivery(tx, order_id)
+    return digest(None if delivery is None else {
+        key: value for key, value in delivery.items()
+        if key not in {'state', 'claimed_at', 'receipt'}})
+
+
+def validate_projection(tx, locked):
+    """A restored mutable projection cannot replace the immutable checkout facts."""
+    require(locked.get('version') == 3, 'order_contract_version')
+    listing = locked['listing']
+    expected = {name: locked[name] for name in (
+        'buyer', 'seller', 'listing_id', 'listing_revision', 'package_id',
+        'package_revision', 'package_digest', 'quantity', 'total_price_minor',
+        'escrow_subject', 'terms_digest', 'created_at')}
+    expected.update(unit_price_minor=listing['price_minor'],
+        currency_id=listing['currency_id'], escrow_policy=listing['escrow_policy'],
+        dispute_policy=listing['dispute_policy'])
+    mutable = ('state', 'receipt_refs', 'settled_at', 'payment_transaction_id',
+               'payment_intent_digest', 'funded_at', 'delivered_at')
+    columns = (*expected, *mutable)
+    row = tx.one('SELECT ' + ','.join(columns) + ' FROM store_orders WHERE id=?',
+                 (locked['order_id'],))
+    require(row is not None, 'order_contract_mismatch')
+    order = dict(zip(columns, row))
+    require(all(order[name] == value for name, value in expected.items()),
+            'order_contract_mismatch')
+    if order['payment_transaction_id'] is not None:
+        payment = tx.one('''SELECT debit_account,credit_account,amount_minor,currency_id,
+            reference,committed_at FROM money_ledger WHERE id=?''',
+            (order['payment_transaction_id'],))
+        require(payment == (locked['buyer'], locked['escrow_subject'],
+            locked['total_price_minor'], listing['currency_id'],
+            'order_fund:' + locked['order_id'], order['funded_at']), 'order_payment_mismatch')
+    fact = tx.one('SELECT body FROM order_settlements WHERE order_id=?', (locked['order_id'],))
+    if fact is None:
+        require(order['state'] not in {'settled', 'refunded'}, 'order_settlement_missing')
+        return
+    fact = loads(fact[0])
+    receipts = fact['receipts']
+    references = [order['payment_transaction_id']] + [r['body']['transaction_id'] for r in receipts]
+    require(fact['order_id'] == locked['order_id'] and
+            all(type(fact[name]) is int and fact[name] >= 0
+                for name in ('refund_minor', 'release_minor')), 'order_settlement_mismatch')
+    # Authentic ledger receipts alone are not enough: each one must be the
+    # exact escrow leg this fact claims, not e.g. the funding payment reused.
+    legs = [leg for leg in (
+        ('refund', locked['buyer'], fact['refund_minor'], 'order_refund:' + locked['order_id']),
+        ('transfer', locked['seller'], fact['release_minor'], 'order_release:' + locked['order_id']),
+    ) if leg[2]]
+    require([(r['body']['kind'], r['body']['from_subject'], r['body']['to_subject'],
+              r['body']['amount_minor'], r['body']['currency_id'], r['body']['reference'])
+             for r in receipts] ==
+            [(kind, locked['escrow_subject'], recipient, amount, listing['currency_id'], reference)
+             for kind, recipient, amount, reference in legs], 'order_settlement_mismatch')
+    require(fact['refund_minor'] + fact['release_minor'] == locked['total_price_minor'] and
+            order['state'] == ('refunded' if fact['release_minor'] == 0 else 'settled') and
+            order['settled_at'] == fact['at'] and loads(order['receipt_refs']) == references and
+            all(order[name] == value for name, value in fact['order_facts'].items()) and
+            delivery_snapshot(tx, locked['order_id']) == fact['delivery_snapshot'],
+            'order_settlement_mismatch')
+    for receipt in receipts:
+        row = tx.one('SELECT receipt FROM money_ledger WHERE id=?',
+                      (receipt['body']['transaction_id'],))
+        require(row is not None and loads(row[0]) == receipt, 'order_settlement_mismatch')

msg/market/rationale.py

@@ -0,0 +1,91 @@
+"""Pinned, case-private reasons are part of a signed arbitration allocation.
+
+This is a reference to an ordinary immutable File revision, not executable policy.
+The case grants parties/panel access to that one blob, never the author's folder.
+"""
+from __future__ import annotations
+
+from msg.core.codec import canonical, decode, digest, loads, parse_time, wire
+from msg.core.errors import Failure, require
+from msg.core.models import BlobRef, HandlerOutput, ResourceRef
+from msg.market.delivery import verify_blob
+from msg.plugins.common import check_access
+from msg.plugins.orders import _subject
+from msg.plugins.schemas import IDENTIFIER, obj
+
+PINNED_REF = obj({'id': IDENTIFIER, 'revision': IDENTIFIER}, ('id', 'revision'))
+MAX_REASON_BYTES = 65536
+
+
+def evidence_id(case, ref):
+    return 'rationale_' + digest({'case_id': case['id'], 'round': case['round'],
+                                  'ref': wire(ref)})[7:]
+
+
+def record(tx, case, proposal):
+    """Check immutable bindings without reinterpreting an old grant or policy."""
+    ref = proposal['rationale_ref']
+    row = tx.one('SELECT author,visibility,body FROM arbitration_evidence WHERE id=? AND case_id=?',
+                 (evidence_id(case, ref), case['id']))
+    require(row is not None, 'decision_rationale_missing')
+    body = loads(row[2])
+    require(row[0] in case['panels'][str(case['round'])] and row[1] == 'parties' and
+            body['kind'] == 'rationale' and body['round'] == case['round'] and
+            body['source'] == ref and body['blob']['digest'] == proposal['rationale_digest'],
+            'decision_rationale_mismatch')
+    return body
+
+
+async def verified(app, tx, case, proposal):
+    body = record(tx, case, proposal)
+    try:
+        await verify_blob(app, decode(BlobRef, body['blob']))
+    except Failure as exc:
+        if exc.code == 'package_missing':
+            raise Failure('decision_rationale_missing') from None
+        if exc.code == 'package_digest_mismatch':
+            raise Failure('decision_rationale_mismatch') from None
+        raise
+
+
+def install(app, op):
+    @op('orders.dispute_rationale', obj({'case_id': IDENTIFIER, 'ref': PINNED_REF},
+        ('case_id', 'ref')), signature=True)
+    async def deposit(ctx, request, tx):
+        from msg.market.arbitration import owned_case, panel_valid
+        actor = _subject(ctx)
+        case = await owned_case(tx, ctx, request.arguments['case_id'])
+        require(actor in case['panels'][str(case['round'])] and await panel_valid(tx, case),
+                'arbitrator_required')
+        require(case['state'] == 'open' and
+                ctx.now < parse_time(case['round_deadlines'][str(case['round'])]),
+                'case_evidence_closed')
+        ref = decode(ResourceRef, request.arguments['ref'])
+        resource = await tx.resource(ref.id)
+        require(resource.owner == actor and resource.type in {'file', 'attachment'} and
+                resource.state == 'active', 'rationale_not_owned')
+        await check_access(app, ctx, request, tx, ref.id, 'read')
+        blob = (await tx.revision(ref)).content
+        require(0 < blob.size <= MAX_REASON_BYTES and
+                blob.media_type in {'text/plain', 'text/markdown'}, 'rationale_text_required')
+        await verify_blob(app, blob)
+        raw = await app.contents.read_bytes(blob, limit=MAX_REASON_BYTES)
+        try:
+            require(bool(raw.decode('utf-8').strip()), 'rationale_text_required')
+        except UnicodeDecodeError:
+            raise Failure('rationale_text_required') from None
+        eid = evidence_id(case, wire(ref))
+        previous = tx.one('SELECT body FROM arbitration_evidence WHERE id=?', (eid,))
+        if previous is None:
+            require(tx.one('SELECT COUNT(*) FROM arbitration_evidence WHERE case_id=? AND author=?',
+                           (case['id'], actor))[0] < 64, 'case_evidence_limit')
+            await app.contents.pin(blob, eid)
+            body = {'kind': 'rationale', 'blob': wire(blob), 'source': wire(ref),
+                'round': case['round'], 'at': wire(ctx.now),
+                'author_request_digest': request.payload_digest}
+            tx.execute('INSERT INTO arbitration_evidence(id,case_id,author,visibility,body) '
+                       "VALUES (?,?,?,'parties',?)",
+                       (eid, case['id'], actor, canonical(body).decode()), write=True)
+        binding = {'rationale_ref': wire(ref), 'rationale_digest': blob.digest}
+        record(tx, case, binding)
+        return HandlerOutput(data={**binding, 'evidence_id': eid})

msg/market/references.py

@@ -0,0 +1,19 @@
+"""SQL-authoritative market content roots, shared by backup and collection.
+
+Order IDs, digests and pins never confer read access. Pins protect a blob before
+SQL commits; this inventory protects it after the originating file is purged.
+"""
+from msg.core.codec import loads
+
+
+def content_references(execute):
+    for table, column in (('store_packages', 'payload_refs'),
+                          ('store_deliveries', 'payload_refs')):
+        for (raw,) in execute(f'SELECT {column} FROM {table} ORDER BY id'):
+            for ref in loads(raw):
+                yield ref['blob']
+    # Legacy archives can be inspected before the new schema is installed.
+    exists = next(iter(execute("SELECT to_regclass('arbitration_evidence')")))[0]
+    if exists is not None:
+        for (raw,) in execute('SELECT body FROM arbitration_evidence ORDER BY id'):
+            yield loads(raw)['blob']

msg/market/targets.py

@@ -0,0 +1,157 @@
+"""Buyer-owned endpoint binding shared by checkout, delivery and SMTP worker."""
+from __future__ import annotations
+
+from dataclasses import replace
+
+from msg.core.codec import canonical, decode, digest, loads
+from msg.core.errors import Failure, require
+from msg.core.models import EffectJob
+from msg.market.delivery_targets import account_email, mail_enabled, pickup_url, validate_address
+from msg.market.policy import contract
+from msg.plugins.common import new_id
+
+
+def _email(tx, subject):
+    generation, settings = account_email(tx, subject)
+    if settings is None:
+        return None, None
+    endpoint = 'em_' + digest((subject, settings.address, settings.verified_at, generation))[7:39]
+    return settings, endpoint
+
+
+async def target_for(app, tx, buyer, email_address=None):
+    handle = (await tx.resource(buyer)).name
+    target = {'subject_id': buyer, 'channel': 'site', 'handle_snapshot': handle,
+              'email': {'state': 'disabled'}}
+    if email_address is None:
+        return target
+    validate_address(email_address)
+    email, endpoint = _email(tx, buyer)
+    verified = (email is not None and email.subject_id == buyer and
+                email.address == email_address and email.verified_at is not None)
+    target['email'] = {'state': 'pending' if mail_enabled(app) else 'disabled',
+        'subject_id': buyer, 'address_snapshot': email_address,
+        'endpoint_id': endpoint if verified else None}
+    # Verification is a separate, order-information-free external effect.
+    return target
+
+
+def save_target(tx, order, target):
+    tx.execute('UPDATE store_orders SET delivery_target=? WHERE id=?',
+               (canonical(target).decode(), order['id']), write=True)
+    order['delivery_target'] = target
+
+
+def validate_target(tx, order, *, email=False, encryption=False):
+    target = order['delivery_target']
+    require(target.get('subject_id') == order['buyer'] and target.get('channel') == 'site',
+            'delivery_recipient_mismatch')
+    if encryption:
+        locked = contract(tx, order['id']).get('recipient_key')
+        row = tx.one('SELECT subject,recipient,retired_at FROM encryption_subkeys WHERE key_id=?',
+                     (locked['key_id'],)) if locked else None
+        require(row is not None and row[0] == order['buyer'] and row[1] == locked['recipient']
+                and row[2] is None, 'delivery_recipient_mismatch')
+    if email:
+        chosen = target.get('email', {})
+        require(not chosen.get('notification_disabled'), 'delivery_recipient_mismatch')
+        endpoint_id = chosen.get('endpoint_id') or ''
+        if endpoint_id.startswith('dep_'):
+            row = tx.one('SELECT subject,address,active FROM delivery_email_endpoints WHERE id=?',
+                         (endpoint_id,))
+            require(row is not None and row[2] and
+                    row[0] == chosen.get('subject_id') == order['buyer'] and
+                    row[1] == chosen.get('address_snapshot'), 'delivery_recipient_mismatch')
+            validate_address(row[1])
+            return row[1]
+        current, endpoint = _email(tx, order['buyer'])
+        require(chosen.get('subject_id') == order['buyer'] and current is not None and
+                current.subject_id == order['buyer'] and current.verified_at is not None and
+                chosen.get('endpoint_id') == endpoint and
+                chosen.get('address_snapshot') == current.address,
+                'delivery_recipient_mismatch')
+        validate_address(current.address)
+        return current.address
+    return None
+
+
+async def enqueue_notification(app, tx, ctx, request, order):
+    chosen = order['delivery_target'].get('email', {})
+    if (not mail_enabled(app) or not chosen.get('endpoint_id') or
+            chosen.get('notification_disabled')):
+        return
+    try:
+        validate_target(tx, order, email=True)
+    except Failure as exc:
+        if exc.code != 'delivery_recipient_mismatch':
+            raise
+        save_target(tx, order, {**order['delivery_target'], 'email': {
+            **chosen, 'state': 'pending', 'error': exc.code}})
+        return
+    # Only the buyer can bind/queue the auxiliary channel, even when the seller
+    # uploads ciphertext later. Checkout's signed principal is persisted privately.
+    locked = contract(tx, order['id'])
+    from msg.core.models import Principal
+    principal = decode(Principal, locked['buyer_principal'])
+    dedupe = 'market-mail:'+order['id']+':'+chosen['endpoint_id']
+    if tx.one('SELECT 1 FROM jobs WHERE dedupe=?', (dedupe,)):
+        return
+    job = EffectJob(id=new_id('job'), event_id='delivery:'+order['id'], kind='market_mail',
+        dedupe_key=dedupe, principal=principal,
+        operation='orders.buy', arguments={'order_id': order['id'], 'endpoint_id': chosen['endpoint_id']},
+        state='pending', attempts=0, next_attempt_at=ctx.now, lease_until=None)
+    await tx.enqueue(job)
+    target = {**order['delivery_target'], 'email': {**chosen, 'state': 'queued'}}
+    save_target(tx, order, target)
+
+
+async def render_notification(app, tx, job):
+    from msg.plugins.delivery import _delivery
+    from msg.plugins.orders import _row
+    order = _row(tx, job.arguments['order_id'], job.principal.subject)
+    require(order['buyer'] == job.principal.subject and job.principal.actor == order['buyer'],
+            'delivery_recipient_mismatch')
+    delivery = _delivery(tx, order['id'])
+    require(order['state'] in {'delivered','accepted','settled'} and delivery is not None and
+            delivery['recipient_subject'] == order['buyer'], 'delivery_not_available')
+    require(order['delivery_target'].get('email', {}).get('endpoint_id') == job.arguments['endpoint_id'],
+            'delivery_recipient_mismatch')
+    locked = contract(tx, order['id'])
+    address = validate_target(tx, order, email=True,
+        encryption=locked['listing']['delivery_mode'] == 'sealed_manual')
+    # A stable site URL is not a capability. GET always requires fresh authentication.
+    link = pickup_url(app, order['id'])
+    body = {'order_id': order['id'], 'handle': locked['handle_snapshot'], 'pickup': link}
+    return replace(job, kind='mail', arguments={'recipient': address,
+        'recipient_subject': order['buyer'], 'subject': 'msg order notification',
+        'text': canonical(body).decode()})
+
+
+def notification_view(tx, order):
+    """Project current job facts; never persist SMTP state into the order."""
+    chosen = dict(order['delivery_target'].get('email', {'state': 'disabled'}))
+    if chosen.get('notification_disabled'):
+        return {**chosen, 'state': 'disabled'}
+    endpoint = chosen.get('endpoint_id')
+    if not endpoint:
+        return chosen
+    dedupe = 'market-mail:' + order['id'] + ':' + endpoint
+    row = tx.one('SELECT body FROM jobs WHERE dedupe=?', (dedupe,))
+    chosen.pop('last_result', None)
+    if row is None:
+        # Old cached state is not evidence that an external delivery completed.
+        return {**chosen, 'state': 'disabled' if chosen.get('state') == 'disabled' else 'pending'}
+    job = decode(EffectJob, loads(row[0]))
+    require(job.kind == 'market_mail' and job.dedupe_key == dedupe and
+            job.principal.actor == job.principal.subject == order['buyer'] and
+            job.arguments.get('order_id') == order['id'] and
+            job.arguments.get('endpoint_id') == endpoint,
+            'delivery_recipient_mismatch')
+    result = tx.setting('job_status:' + job.id, {})
+    code = result.get('code')
+    state = ('disabled' if code == 'mail_disabled' else
+             'smtp_accepted' if job.state == 'done' and code == 'sent' else
+             'delivered_unknown' if job.state in {'done', 'uncertain'} else
+             'failed' if job.state == 'failed' else
+             'pending' if code is not None else 'queued')
+    return {**chosen, 'state': state, **({'last_result': code} if code is not None else {})}

msg/plugins/__init__.py

@@ -0,0 +1,28 @@
+"""The installed plugin order has one owner for every runtime role."""
+import importlib
+
+from msg.core.errors import require
+
+
+BUILTINS = (
+    'identity', 'content', 'discussion', 'communication', 'discovery',
+    'achievements', 'recovery', 'sharing', 'money', 'offers', 'store',
+    'bounty', 'orders', 'delivery', 'transfer', 'extensions', 'system', 'batch',
+)
+
+
+def install_registry(context, plugins):
+    """Register installed code only; the context determines available capabilities.
+
+    The write Application supplies its own context. A read-only host supplies a
+    disposable registration context and a registry which discards callbacks.
+    No storage connection, runtime secret or business operation is needed here.
+    """
+    from msg.security.capabilities import install_capabilities
+    configured = set(plugins)
+    require(configured <= set(BUILTINS), 'unknown_plugin')
+    for name in BUILTINS:
+        if name in configured:
+            importlib.import_module('msg.plugins.' + name).install(context)
+    install_capabilities(context.registry)
+    context.registry.freeze()