msgctl 0.1.0a1__py3-none-any.whl

msg/plugins/schemas.py

@@ -0,0 +1,5 @@
+"""Compatibility exports; shared wire schemas are owned by msg.core.schemas."""
+from msg.core.schemas import (
+    STRING, IDENTIFIER, INTEGER, BOOLEAN, BYTES, REF, SCOPE, NETWORK_CONSTRAINTS,
+    GRANT, GRANTS, ISSUANCE, SIGNATURE, OUTPUT, obj,
+)

msg/plugins/sharing.py

@@ -0,0 +1,300 @@
+"""Revocable, direct-subject read grants for one resource at a time."""
+from __future__ import annotations
+
+from datetime import timedelta
+import hashlib
+import hmac
+
+from msg.constants import ROOT_SUBJECT
+from msg.core.codec import b64, canonical, loads, parse_time, unb64, wire
+from msg.core.errors import Failure, require
+from msg.core.models import HandlerOutput, ResourceRef
+from msg.plugins.common import check_access, new_id, registration, resolve
+from msg.security.sharing_policy import share_target_error
+from msg.plugins.schemas import IDENTIFIER, STRING, obj
+
+
+MAX_GRANT_TTL = timedelta(days=30)
+MAX_LINK_BYTES = 65536
+
+
+def _link_public(row):
+    return dict(zip(('id', 'resource_id', 'grantor', 'created_at', 'expires_at',
+                     'revoked_at'), row))
+
+
+def _links_enabled(tx):
+    require(tx.setting('share_links_enabled', False) is True, 'share_links_disabled')
+
+
+def _verifier(token):
+    try:
+        raw = unb64(token, limit=64)
+    except (Failure, ValueError):
+        raise Failure('share_link_unavailable') from None
+    require(32 <= len(raw) <= 64, 'share_link_unavailable')
+    return 'sha256:'+hashlib.sha256(b'share-link-v1\0'+raw).hexdigest()
+
+
+async def _owned_resource(app, ctx, request, tx, value, *, mutation, owner=True):
+    rid = await resolve(tx, value)
+    resource = await tx.resource(rid)
+    require(ctx.principal.subject is not None and ctx.principal.actor == ctx.principal.subject,
+            'share_subject_required')
+    require((not owner or resource.owner == ctx.principal.subject) and resource.state == 'active',
+            'permission_denied')
+    require(not app.registry.resource_type(resource.type, resource.type_version).container,
+            'share_container_forbidden')
+    if owner:
+        await check_access(app, ctx, request, tx, rid, 'manage' if mutation else 'read')
+    else:
+        await app.authorizer.require_base(ctx.principal,
+            f'{request.operation}@{request.contract_version}',rid,tx)
+    chain = (*await tx.ancestors(rid), resource)
+    error = share_target_error(app.registry, resource, chain, tx)
+    require(error is None, error or 'share_forbidden_resource')
+    return resource
+
+
+async def _revocable_resource(app, ctx, request, tx, value, *, owner=True):
+    """Return (resource, live); a dormant target must not block narrowing access.
+
+    Archived/moved targets make a grant dormant, not revoked: restoring the
+    target would revive it, so revocation stays available under the ceiling.
+    """
+    rid = await resolve(tx, value)
+    resource = await tx.resource(rid)
+    chain = (*await tx.ancestors(rid), resource)
+    if share_target_error(app.registry, resource, chain, tx) is None:
+        return await _owned_resource(app, ctx, request, tx, rid, mutation=True,
+                                     owner=owner), True
+    require(ctx.principal.subject is not None and ctx.principal.actor == ctx.principal.subject,
+            'share_subject_required')
+    require(not owner or resource.owner == ctx.principal.subject, 'permission_denied')
+    await app.authorizer.require_base(ctx.principal,
+        f'{request.operation}@{request.contract_version}', rid, tx)
+    return resource, False
+
+
+def _public(row):
+    return dict(zip(('id', 'resource_id', 'grantor', 'grantee', 'created_at', 'expires_at',
+                     'revoked_at'), row))
+
+
+def _public_v2(row, now):
+    result=dict(zip(('id','resource_id','grantor','grantee','grantee_kind','parent_id',
+                     'operations','constraints','allow_reshare','created_at','expires_at',
+                     'revoked_at'),row))
+    result['operations']=loads(result['operations'])
+    result['constraints']=loads(result['constraints'])
+    result['allow_reshare']=bool(result['allow_reshare'])
+    result['status']='revoked' if result['revoked_at'] else (
+        'expired' if parse_time(result['expires_at'])<=now else 'active')
+    return result
+
+
+_V2_COLUMNS='''id,resource_id,grantor,grantee,grantee_kind,parent_id,operations,
+    constraints,allow_reshare,created_at,expires_at,revoked_at'''
+
+
+def install(app):
+    op, finish = registration(app, 'sharing', ('identity',))
+
+    @op('sharing.grant', obj({'resource': IDENTIFIER, 'grantee': IDENTIFIER,
+                              'expires_at': STRING}, ('resource', 'grantee', 'expires_at')))
+    async def grant(ctx, request, tx):
+        a = request.arguments
+        resource = await _owned_resource(app, ctx, request, tx, a['resource'], mutation=True)
+        grantee = await resolve(tx, a['grantee'])
+        await tx.subject(grantee)
+        require(grantee not in {resource.owner, ROOT_SUBJECT}, 'invalid_share_grantee')
+        expires = parse_time(a['expires_at'])
+        require(ctx.now < expires <= ctx.now + MAX_GRANT_TTL, 'invalid_share_expiry')
+        tx.execute('''UPDATE share_grants SET revoked_at=?
+            WHERE resource_id=? AND grantee=? AND revoked_at IS NULL AND expires_at<=?''',
+                   (wire(ctx.now), resource.id, grantee, wire(ctx.now)), write=True)
+        require(tx.one('''SELECT 1 FROM share_grants
+            WHERE resource_id=? AND grantee=? AND revoked_at IS NULL''',
+                       (resource.id, grantee)) is None, 'share_already_active')
+        gid = new_id('share')
+        tx.execute('''INSERT INTO share_grants
+            (id,resource_id,grantor,grantee,created_at,expires_at,revoked_at)
+            VALUES (?,?,?,?,?,?,NULL)''',
+            (gid, resource.id, resource.owner, grantee, wire(ctx.now), wire(expires)), write=True)
+        tx.set_setting('authorization_epoch',tx.setting('authorization_epoch',0)+1)
+        return HandlerOutput(data={'grant': _public((gid, resource.id, resource.owner,
+            grantee, wire(ctx.now), wire(expires), None))})
+
+    @op('sharing.revoke', obj({'grant_id': IDENTIFIER}, ('grant_id',)))
+    async def revoke(ctx, request, tx):
+        gid = request.arguments['grant_id']
+        row = tx.one('''SELECT id,resource_id,grantor,grantee,created_at,expires_at,revoked_at
+            FROM share_grants WHERE id=?''', (gid,))
+        require(row is not None, 'share_not_found')
+        resource, _ = await _revocable_resource(app, ctx, request, tx, row[1])
+        require(row[2] == resource.owner, 'permission_denied')
+        if row[6] is None:
+            tx.execute('UPDATE share_grants SET revoked_at=? WHERE id=?',
+                       (wire(ctx.now), gid), write=True)
+            tx.set_setting('authorization_epoch',tx.setting('authorization_epoch',0)+1)
+            row = (*row[:6], wire(ctx.now))
+        return HandlerOutput(data={'grant': _public(row)})
+
+    @op('sharing.list', obj({'resource': IDENTIFIER}, ('resource',)), effect='read')
+    async def list_grants(ctx, request, tx):
+        resource = await _owned_resource(app, ctx, request, tx,
+                                         request.arguments['resource'], mutation=False)
+        rows = tx.rows('''SELECT id,resource_id,grantor,grantee,created_at,expires_at,revoked_at
+            FROM share_grants WHERE resource_id=? AND grantor=? ORDER BY created_at,id''',
+                       (resource.id, resource.owner))
+        return HandlerOutput(data={'grants': [_public(row) for row in rows]})
+
+    @op('sharing.grant',obj({'resource':IDENTIFIER,'grantee':IDENTIFIER,
+        'grantee_kind':{'enum':['user','group']},'operations':{'type':'array',
+            'items':{'enum':['read']},'minItems':1,'uniqueItems':True},
+        'expires_at':STRING,'allow_reshare':{'type':'boolean'},
+        'constraints':obj(), 'source_grant_id':IDENTIFIER},
+        ('resource','grantee','grantee_kind','operations','expires_at')),version=2)
+    async def grant_v2(ctx,request,tx):
+        a=request.arguments
+        resource=await _owned_resource(app,ctx,request,tx,a['resource'],mutation=True,
+                                       owner=False)
+        require(tuple(a['operations'])==('read',) and dict(a.get('constraints',{}))=={},
+                'invalid_share_operations')
+        grantee=await resolve(tx,a['grantee'])
+        if a['grantee_kind']=='user':
+            await tx.subject(grantee)
+        else:
+            target=await tx.resource(grantee)
+            require(target.type=='organization' and target.state=='active',
+                    'invalid_share_grantee')
+        require(grantee not in {resource.owner,ROOT_SUBJECT},'invalid_share_grantee')
+        expires=parse_time(a['expires_at'])
+        require(ctx.now<expires<=ctx.now+MAX_GRANT_TTL,'invalid_share_expiry')
+        parent=a.get('source_grant_id')
+        if ctx.principal.subject==resource.owner:
+            require(parent is None,'share_source_not_needed')
+            await check_access(app,ctx,request,tx,resource.id,'manage')
+        else:
+            require(parent is not None,'share_source_required')
+            source=tx.one('''SELECT resource_id,expires_at,operations,constraints
+                FROM share_grants_v2 WHERE id=?''',(parent,))
+            require(source is not None and source[0]==resource.id and
+                await app.authorizer.share_source_active(resource,parent,
+                    ctx.principal.subject,ctx.now,tx,reshare=True),'share_source_unavailable')
+            require(expires<=parse_time(source[1]) and
+                set(a['operations'])<=set(loads(source[2])) and
+                a.get('constraints',{})==loads(source[3]),'share_scope_exceeded')
+        gid=new_id('share')
+        tx.execute('''INSERT INTO share_grants_v2
+            (id,resource_id,grantor,grantee,grantee_kind,parent_id,operations,constraints,
+             allow_reshare,created_at,expires_at,revoked_at)
+            VALUES (?,?,?,?,?,?,?,?,?,?,?,NULL)''',
+            (gid,resource.id,ctx.principal.subject,grantee,a['grantee_kind'],parent,
+             canonical(a['operations']).decode(),canonical(a.get('constraints',{})).decode(),
+             int(a.get('allow_reshare',False)),wire(ctx.now),wire(expires)),write=True)
+        tx.set_setting('authorization_epoch',tx.setting('authorization_epoch',0)+1)
+        row=tx.one(f'SELECT {_V2_COLUMNS} FROM share_grants_v2 WHERE id=?',(gid,))
+        return HandlerOutput(data={'grant':_public_v2(row,ctx.now)})
+
+    @op('sharing.revoke',obj({'grant_id':IDENTIFIER},('grant_id',)),version=2)
+    async def revoke_v2(ctx,request,tx):
+        gid=request.arguments['grant_id']
+        row=tx.one(f'SELECT {_V2_COLUMNS} FROM share_grants_v2 WHERE id=?',(gid,))
+        require(row is not None,'share_not_found')
+        resource,live=await _revocable_resource(app,ctx,request,tx,row[1],owner=False)
+        require(ctx.principal.subject in {resource.owner,row[2]},'permission_denied')
+        if live and ctx.principal.subject==resource.owner:
+            await check_access(app,ctx,request,tx,resource.id,'manage')
+        if row[11] is None:
+            tx.execute('UPDATE share_grants_v2 SET revoked_at=? WHERE id=?',
+                       (wire(ctx.now),gid),write=True)
+            tx.set_setting('authorization_epoch',tx.setting('authorization_epoch',0)+1)
+            row=(*row[:11],wire(ctx.now))
+        return HandlerOutput(data={'grant':_public_v2(row,ctx.now)})
+
+    @op('sharing.list',obj({'resource':IDENTIFIER},('resource',)),effect='read',version=2)
+    async def list_v2(ctx,request,tx):
+        resource=await _owned_resource(app,ctx,request,tx,
+            request.arguments['resource'],mutation=False,owner=False)
+        rows=tx.rows(f'''SELECT {_V2_COLUMNS} FROM share_grants_v2
+            WHERE resource_id=? AND grantor=? ORDER BY created_at,id''',
+            (resource.id,ctx.principal.subject))
+        return HandlerOutput(data={'grants':[_public_v2(row,ctx.now) for row in rows]})
+
+    @op('sharing.link_create', obj({'resource': IDENTIFIER,
+        'verifier': {'type':'string','pattern':'^sha256:[0-9a-f]{64}$'},
+        'expires_at': STRING}, ('resource','verifier','expires_at')), signature=True)
+    async def link_create(ctx, request, tx):
+        _links_enabled(tx)
+        require(ctx.principal.method=='signature' and
+                ctx.principal.actor==ctx.principal.subject, 'share_subject_required')
+        a=request.arguments
+        resource=await _owned_resource(app,ctx,request,tx,a['resource'],mutation=True)
+        expires=parse_time(a['expires_at'])
+        require(ctx.now<expires<=ctx.now+MAX_GRANT_TTL,'invalid_share_expiry')
+        require(resource.revision is not None,'share_link_content_required')
+        revision=await tx.revision(ResourceRef(id=resource.id))
+        require(revision.content.size<=MAX_LINK_BYTES,'share_link_content_too_large')
+        require(tx.one('SELECT 1 FROM share_links WHERE verifier=?',(a['verifier'],)) is None,
+                'share_link_verifier_in_use')
+        lid=new_id('link')
+        tx.execute('''INSERT INTO share_links
+            (id,resource_id,grantor,credential_id,verifier,created_at,expires_at,revoked_at)
+            VALUES (?,?,?,?,?,?,?,NULL)''',
+            (lid,resource.id,resource.owner,ctx.principal.credential_id,a['verifier'],
+             wire(ctx.now),wire(expires)),write=True)
+        tx.set_setting('authorization_epoch',tx.setting('authorization_epoch',0)+1)
+        return HandlerOutput(data={'link':_link_public((lid,resource.id,resource.owner,
+            wire(ctx.now),wire(expires),None)),
+            'endpoint':'/-/p/sharing.link_read',
+            'proof':'client-held token in JSON request body'})
+
+    @op('sharing.link_revoke',obj({'link_id':IDENTIFIER},('link_id',)),signature=True)
+    async def link_revoke(ctx,request,tx):
+        lid=request.arguments['link_id']
+        row=tx.one('''SELECT id,resource_id,grantor,created_at,expires_at,revoked_at
+            FROM share_links WHERE id=?''',(lid,))
+        require(row is not None,'share_link_unavailable')
+        resource=await _owned_resource(app,ctx,request,tx,row[1],mutation=True)
+        require(ctx.principal.method=='signature' and row[2]==resource.owner,
+                'permission_denied')
+        if row[5] is None:
+            tx.execute('UPDATE share_links SET revoked_at=? WHERE id=?',
+                       (wire(ctx.now),lid),write=True)
+            tx.set_setting('authorization_epoch',tx.setting('authorization_epoch',0)+1)
+            row=(*row[:5],wire(ctx.now))
+        return HandlerOutput(data={'link':_link_public(row)})
+
+    @op('sharing.link_list',obj({'resource':IDENTIFIER},('resource',)),effect='read')
+    async def link_list(ctx,request,tx):
+        resource=await _owned_resource(app,ctx,request,tx,
+                                       request.arguments['resource'],mutation=False)
+        rows=tx.rows('''SELECT id,resource_id,grantor,created_at,expires_at,revoked_at
+            FROM share_links WHERE resource_id=? AND grantor=? ORDER BY created_at,id''',
+            (resource.id,resource.owner))
+        return HandlerOutput(data={'links':[_link_public(row) for row in rows]})
+
+    @op('sharing.link_read',obj({'link_id':IDENTIFIER,'token':STRING},
+                                ('link_id','token')),effect='read')
+    async def link_read(ctx,request,tx):
+        # Never accept signed identity as an alternative to the bearer source.
+        require(ctx.principal.method=='anonymous','share_link_unavailable')
+        _links_enabled(tx)
+        a=request.arguments
+        verifier=_verifier(a['token'])
+        row=tx.one('''SELECT resource_id,grantor,credential_id,verifier,expires_at,revoked_at
+            FROM share_links WHERE id=?''',(a['link_id'],))
+        require(row is not None and hmac.compare_digest(row[3],verifier) and
+                row[5] is None and parse_time(row[4])>ctx.now,'share_link_unavailable')
+        resource=await tx.resource(row[0])
+        chain=(*await tx.ancestors(resource.id),resource)
+        require(await app.authorizer.share_link_read_allowed(row[1],row[2],resource,
+            chain,ctx.now,tx),'share_link_unavailable')
+        revision=await tx.revision(ResourceRef(id=resource.id))
+        require(revision.content.size<=MAX_LINK_BYTES,'share_link_unavailable')
+        body=await app.contents.read_bytes(revision.content,limit=MAX_LINK_BYTES)
+        return HandlerOutput(data={'id':resource.id,'revision':revision.id,
+            'media_type':revision.content.media_type,'data':b64(body)})
+
+    finish()

msg/plugins/store.py

@@ -0,0 +1,249 @@
+"""A catalog and immutable deposits; no purchase or escrow operations live here."""
+from __future__ import annotations
+
+from msg.core.codec import canonical, digest, loads, parse_time, wire
+from msg.core.errors import Failure, require
+from msg.core.models import HandlerOutput, ResourceRef, ResourceTypeSpec
+from msg.plugins.common import (assert_generation, check_access, create_resource,
+                                new_id, operation_id, registration, resolve,
+                                revise_resource)
+from msg.plugins.schemas import IDENTIFIER, INTEGER, REF, STRING, obj
+
+
+KINDS = ('file', 'text', 'secret', 'bundle', 'entitlement', 'service')
+MODES = ('managed_instant', 'sealed_manual', 'service')
+STATES = ('draft', 'active', 'paused', 'closed')
+MAX_REFS = 32
+MAX_MANIFEST_BYTES = 65536
+
+
+def _subject(ctx):
+    subject = ctx.principal.subject
+    require(subject is not None and ctx.principal.actor == subject and
+            ctx.principal.method == 'signature', 'signature_required')
+    return subject
+
+
+async def _listing(app, ctx, request, tx, value, *, seller=False):
+    try:
+        rid = await resolve(tx, value)
+        resource = await tx.resource(rid)
+        require(resource.type == 'listing' and resource.parent == 't_store', 'listing_not_found')
+        await check_access(app, ctx, request, tx, rid, 'read')
+        if seller:
+            require(resource.owner == _subject(ctx), 'listing_not_found')
+        return resource
+    except Failure as exc:
+        if exc.code in {'not_found', 'permission_denied', 'credential_ceiling',
+                        'certificate_gate', 'ancestor_inactive'}:
+            raise Failure('listing_not_found') from None
+        raise
+
+
+async def _body(app, tx, resource, revision=None):
+    rev = await tx.revision(ResourceRef(id=resource.id, revision=revision))
+    body = loads(await app.contents.read_bytes(rev.content))
+    # Listings deposited before the sale/bounty split were all sale listings.
+    return {'mode': 'sale', **body}, rev
+
+
+def _public(resource, body):
+    # A package identifier is not a capability; package payloads are seller-only.
+    return {'listing_id': resource.id, 'listing_revision': resource.revision,
+            'seller': resource.owner, **body,
+            'terms_revision': resource.revision,
+            'terms_digest': digest(body['terms'])}
+
+
+def _validate(body, now):
+    require(body['mode'] == 'sale', 'listing_mode_unsupported')
+    require(body['currency_id'] == 'primary', 'unsupported_currency')
+    require(type(body['price_minor']) is int and 0 < body['price_minor'] <= 10**18,
+            'invalid_price')
+    require(type(body['quantity']) is int and 0 < body['quantity'] <= 10**9,
+            'invalid_quantity')
+    require(len(canonical(body)) <= MAX_MANIFEST_BYTES, 'listing_too_large')
+    if body['expires_at'] is not None and body['state'] != 'closed':
+        require(parse_time(body['expires_at']) > now, 'listing_expired')
+    if body['delivery_mode'] == 'service':
+        require(body['item_kind'] == 'service' and body['package_ref'] is None,
+                'invalid_delivery_mode')
+    else:
+        require(body['item_kind'] != 'service', 'invalid_delivery_mode')
+    if body['state'] == 'active' and body['delivery_mode'] == 'managed_instant':
+        require(body['package_ref'] is not None, 'package_required')
+
+
+async def _package_row(tx, package_id):
+    return tx.one('''SELECT id,listing_id,listing_revision,seller,revision,kind,manifest,
+        payload_refs,digest,total_size,delivery_mode,deposited_at FROM store_packages WHERE id=?''',
+        (package_id,))
+
+
+def _package_public(row):
+    return dict(zip(('id', 'listing_id', 'listing_revision', 'seller', 'revision',
+                     'kind', 'manifest', 'payload_refs', 'digest', 'total_size',
+                     'delivery_mode', 'deposited_at'),
+                    (*row[:6], loads(row[6]), loads(row[7]), *row[8:])))
+
+
+def install(app):
+    op, finish = registration(app, 'store', ('content',))
+    listing_fields = {
+        'name': {'type':'string','minLength':1,'maxLength':120},
+        'mode': {'enum': ['sale', 'bounty']},
+        'item_kind': {'enum': list(KINDS)},
+        'price_minor': INTEGER,
+        'currency_id': IDENTIFIER,
+        'quantity': INTEGER,
+        'delivery_mode': {'enum': list(MODES)},
+        'package_ref': {'type':['string','null']},
+        'escrow_policy': {'type':'string','minLength':1,'maxLength':80},
+        'dispute_policy': {'type':'string','minLength':1,'maxLength':80},
+        'terms': {'type':'string','minLength':1,'maxLength':16384},
+        'expires_at': {'type':['string','null']},
+        'state': {'enum': list(STATES)},
+    }
+    creation_required = ('name', 'item_kind', 'price_minor', 'currency_id', 'quantity',
+                         'delivery_mode', 'escrow_policy', 'dispute_policy', 'terms')
+
+    create_fields = {key:value for key,value in listing_fields.items()
+                     if key not in {'state','package_ref'}}
+    @op('store.listing_create', obj(create_fields, creation_required), signature=True)
+    async def listing_create(ctx, request, tx):
+        seller = _subject(ctx)
+        await app.authorizer.require_base(ctx.principal, operation_id(request), seller, tx)
+        await check_access(app, ctx, request, tx, 't_store', 'create')
+        args = request.arguments
+        body = {key: args.get(key) for key in create_fields if key != 'name'}
+        body['mode'] = args.get('mode', 'sale')
+        body['package_ref'] = None
+        body['expires_at'] = args.get('expires_at')
+        body['state'] = 'draft'
+        _validate(body, ctx.now)
+        resource = await create_resource(app, ctx, request, tx, parent='t_store',
+            type='listing', name=args['name'], body=canonical(body),
+            media_type='application/json', mode=0o644)
+        require(resource.owner == seller, 'seller_mismatch')
+        return HandlerOutput(resources=(ResourceRef(id=resource.id, revision=resource.revision),),
+                             data={'listing': _public(resource, body),
+                                   'generation': resource.generation})
+
+    @op('store.listing_update', obj({'id':IDENTIFIER, 'price_minor':INTEGER,
+        'quantity':INTEGER, 'terms':listing_fields['terms'], 'state':listing_fields['state'],
+        'expires_at':listing_fields['expires_at'], 'package_ref':listing_fields['package_ref']},
+        ('id',)), signature=True)
+    async def listing_update(ctx, request, tx):
+        resource = await _listing(app, ctx, request, tx, request.arguments['id'], seller=True)
+        await check_access(app, ctx, request, tx, resource.id, 'write')
+        await assert_generation(request, resource)
+        old, _ = await _body(app, tx, resource)
+        require(old['mode'] == 'sale', 'listing_mode_unsupported')
+        updates = {key:value for key,value in request.arguments.items() if key != 'id'}
+        require(bool(updates), 'empty_listing_update')
+        body = {**old, **updates}
+        require(old['state'] != 'closed' or body['state'] == 'closed', 'listing_closed')
+        if body['package_ref'] is not None:
+            row = await _package_row(tx, body['package_ref'])
+            require(row is not None and row[1] == resource.id and row[3] == resource.owner and
+                    row[5] == body['item_kind'] and row[10] == body['delivery_mode'],
+                    'package_not_found')
+        _validate(body, ctx.now)
+        updated = await revise_resource(app, ctx, request, tx, resource, canonical(body),
+                                        'application/json')
+        return HandlerOutput(resources=(ResourceRef(id=updated.id, revision=updated.revision),),
+                             data={'listing': _public(updated, body),
+                                   'generation':updated.generation})
+
+    @op('store.listing_get', obj({'id':IDENTIFIER, 'revision':IDENTIFIER}, ('id',)),
+        effect='read')
+    async def listing_get(ctx, request, tx):
+        resource = await _listing(app, ctx, request, tx, request.arguments['id'])
+        revision = request.arguments.get('revision')
+        body, rev = await _body(app, tx, resource, revision)
+        result = _public(resource, body)
+        if body['mode'] == 'bounty':
+            from msg.plugins.bounty import projection
+            live = projection(tx,resource.id,ctx.now)
+            result['current_state'] = live['state']
+            result['pause_reason'] = live['pause_reason']
+            result['current_budget_minor'] = live['budget_minor']
+            result['escrow_balance_minor'] = live['escrow_balance_minor']
+            result['paid_claims'] = live['paid_claims']
+            if revision is None:
+                result['state'] = live['state']
+                result['budget_minor'] = live['budget_minor']
+        result['listing_revision'] = rev.id
+        result['terms_revision'] = rev.id
+        return HandlerOutput(resources=(ResourceRef(id=resource.id, revision=rev.id),),
+                             data={'listing':result})
+
+    @op('store.package_deposit', obj({'listing_id':IDENTIFIER,
+        'listing_revision':IDENTIFIER,
+        'manifest':{'type':'object'},
+        'payload_refs':{'type':'array','items':REF,'minItems':1,'maxItems':MAX_REFS}},
+        ('listing_id','listing_revision','manifest','payload_refs')), signature=True)
+    async def package_deposit(ctx, request, tx):
+        from msg.plugins.communication import direct_ancestor
+        resource = await _listing(app, ctx, request, tx, request.arguments['listing_id'], seller=True)
+        body, _ = await _body(app, tx, resource)
+        require(body['mode'] == 'sale', 'listing_mode_unsupported')
+        require(resource.revision == request.arguments['listing_revision'],
+                'listing_revision_conflict')
+        require(body['delivery_mode'] == 'managed_instant' and
+                body['item_kind'] in {'file','bundle','text'} and body['state'] != 'closed',
+                'package_mode_unsupported')
+        manifest = request.arguments['manifest']
+        require(len(canonical(manifest)) <= MAX_MANIFEST_BYTES, 'manifest_too_large')
+        refs=[]
+        blobs=[]
+        total=0
+        for ref in request.arguments['payload_refs']:
+            require(ref['revision'] is not None, 'payload_revision_required')
+            rid=await resolve(tx,ref['id'])
+            item=await tx.resource(rid)
+            require(item.owner == resource.owner and item.state == 'active' and
+                    item.type in {'file','attachment'}, 'payload_not_owned')
+            require(await direct_ancestor(tx, rid) is None, 'payload_private_conversation')
+            await check_access(app, ctx, request, tx, rid, 'read')
+            revision=await tx.revision(ResourceRef(id=rid,revision=ref['revision']))
+            if body['item_kind'] == 'text':
+                require(revision.content.media_type.startswith('text/'), 'text_payload_required')
+            blobs.append(revision.content)
+            total+=revision.content.size
+            require(total <= 1024**4, 'package_too_large')
+            refs.append({'id':rid,'revision':revision.id,'blob':wire(revision.content)})
+        require(len({(r['id'],r['revision']) for r in refs}) == len(refs),
+                'duplicate_payload_ref')
+        require(body['item_kind'] == 'bundle' or len(refs) == 1,
+                'file_package_single_payload')
+        package_id=new_id('pkg')
+        package_revision=new_id('pv')
+        snapshot={'seller':resource.owner,'listing_id':resource.id,
+                  'listing_revision':resource.revision,'revision':package_revision,
+                  'kind':body['item_kind'],'manifest':manifest,'payload_refs':refs,
+                  'total_size':total,'delivery_mode':'managed_instant'}
+        package_digest=digest(snapshot)
+        for blob in blobs:
+            tx.on_rollback(lambda blob=blob: app.contents.unpin(blob, package_revision))
+            await app.contents.pin(blob, package_revision)
+        tx.execute('''INSERT INTO store_packages
+            (id,listing_id,listing_revision,seller,revision,kind,manifest,payload_refs,
+             digest,total_size,delivery_mode,deposited_at)
+            VALUES (?,?,?,?,?,?,?,?,?,?,?,?)''',
+            (package_id,resource.id,resource.revision,resource.owner,package_revision,
+             body['item_kind'],canonical(manifest).decode(),canonical(refs).decode(),
+             package_digest,total,'managed_instant',wire(ctx.now)),write=True)
+        return HandlerOutput(resources=(ResourceRef(id=resource.id,revision=resource.revision),),
+                             data={'package':{'id':package_id,'revision':package_revision,
+                                              'digest':package_digest,'total_size':total}})
+
+    @op('store.package_get', obj({'id':IDENTIFIER}, ('id',)), effect='read')
+    async def package_get(ctx, request, tx):
+        row=await _package_row(tx,request.arguments['id'])
+        require(row is not None and row[3] == _subject(ctx), 'package_not_found')
+        await _listing(app, ctx, request, tx, row[1], seller=True)
+        return HandlerOutput(data={'package':_package_public(row)})
+
+    finish((ResourceTypeSpec(name='listing',version=1,container=False,
+        content_schema=None,operations=frozenset(),relations=frozenset()),))

msg/plugins/system.py

@@ -0,0 +1,75 @@
+"""Finite online administration: no paths, root keys, plugin code or shell commands."""
+from __future__ import annotations
+from msg.constants import ROOT_SPACE
+from msg.core.codec import canonical, digest, wire
+from msg.core.errors import require
+from msg.core.models import AuditEvent, Event, EffectJob, HandlerOutput, ResourceRef
+from msg.plugins.common import new_id, registration, operation_id
+from msg.plugins.communication import event_id
+from msg.plugins.schemas import obj, BOOLEAN, STRING
+
+
+MAINTENANCE_ACTIONS_V1 = ('cleanup_expired', 'rebuild_search', 'collect_garbage')
+MAINTENANCE_ACTIONS = (*MAINTENANCE_ACTIONS_V1, 'deliver_due_todos')
+RUNTIME_SCHEMA = obj({'accept_writes':BOOLEAN, 'status_message':{'type':'string','maxLength':300},
+    'cleanup_enabled':BOOLEAN})
+
+
+def install(app):
+    op, finish = registration(app, 'system', ('identity','content'))
+
+    async def authorized(ctx, request, tx, capability):
+        require(await app.authorizer.has(ctx.principal, capability, operation_id(request), ROOT_SPACE, tx),
+                'capability_required')
+
+    @op('system.inspect', obj(), effect='read', signature=True)
+    async def inspect(ctx, request, tx):
+        await authorized(ctx, request, tx, 'system.inspect')
+        # Deliberately omits environment, credentials, filesystem paths and keys.
+        return HandlerOutput(data={'schema_version':tx.one('SELECT version FROM schema_version')[0],
+            'resources':tx.one('SELECT COUNT(*) FROM resources')[0],
+            'pending_jobs':tx.one("SELECT COUNT(*) FROM jobs WHERE state='pending'")[0],
+            'uncertain_jobs':tx.one("SELECT COUNT(*) FROM jobs WHERE state='uncertain'")[0],
+            'runtime':tx.setting('runtime_config',{'accept_writes':True,'cleanup_enabled':True})})
+
+    @op('system.config', obj({'values':RUNTIME_SCHEMA},('values',)), signature=True)
+    async def configure(ctx, request, tx):
+        await authorized(ctx, request, tx, 'system.config')
+        before = tx.setting('runtime_config', {'accept_writes':True,'cleanup_enabled':True})
+        after = {**before, **request.arguments['values']}
+        tx.set_setting('runtime_config', after)
+        event = Event(id=new_id('audit'), type='system.config', time=ctx.now, request_id=request.request_id,
+            actor=ctx.principal.actor, subject=ctx.principal.subject, resources=(ResourceRef(id=ROOT_SPACE),), data={})
+        await tx.append_audit(AuditEvent(event=event, authority=tuple(ResourceRef(id=c) for c in ctx.principal.certificates),
+            before_digest=digest(before), after_digest=digest(after), previous_digest=None, entry_digest='', result='configured'))
+        return HandlerOutput(data={'runtime':after})
+
+    @op('system.share_links_set',obj({'enabled':BOOLEAN},('enabled',)),signature=True)
+    async def share_links_set(ctx,request,tx):
+        await authorized(ctx,request,tx,'system.config')
+        before=bool(tx.setting('share_links_enabled',False))
+        after=request.arguments['enabled']
+        tx.set_setting('share_links_enabled',after)
+        event=Event(id=new_id('audit'),type='system.share_links_set',time=ctx.now,
+            request_id=request.request_id,actor=ctx.principal.actor,subject=ctx.principal.subject,
+            resources=(ResourceRef(id=ROOT_SPACE),),data={'enabled':after})
+        await tx.append_audit(AuditEvent(event=event,
+            authority=tuple(ResourceRef(id=cid) for cid in ctx.principal.certificates),
+            before_digest=digest({'enabled':before}),after_digest=digest({'enabled':after}),
+            previous_digest=None,entry_digest='',result='configured'))
+        return HandlerOutput(data={'enabled':after})
+
+    @op('system.maintenance', obj({'action':{'enum':list(MAINTENANCE_ACTIONS_V1)}},('action',)),
+        effect='external', signature=True)
+    @op('system.maintenance', obj({'action':{'enum':list(MAINTENANCE_ACTIONS)}},('action',)),
+        effect='external', signature=True, version=2)
+    async def maintenance(ctx, request, tx):
+        await authorized(ctx, request, tx, 'system.maintenance')
+        eid = event_id(request, ctx.principal.subject)
+        job = EffectJob(id=new_id('job'), event_id=eid, kind='maintenance', dedupe_key='maintenance:'+eid,
+            principal=ctx.principal, operation=request.operation,
+            arguments={'action':request.arguments['action'],'request_id':request.request_id},
+            state='pending', attempts=0, next_attempt_at=ctx.now, lease_until=None)
+        await tx.enqueue(job)
+        return HandlerOutput(data={'job_id':job.id,'state':'pending'})
+    finish()