estate/holger-fleet/src/order.rs
//! **The orders a Holger box pulls**, decoded and checked.
//!
//! The kinds are monetize's (`monetize_embed::fleet::kind` for the repair verbs,
//! `monetize_product::pull::order` for the product's). The signature is monetize-embed's
//! `monetize_embed::fleet::order_message` under the product's monetize key: an order that does not verify is
//! FORGED — never run, never acked, and it never moves the sequence (a forged high seq
//! must not silence the real ones). Everything else that is wrong with an order is a
//! REFUSAL, acked by name so the guardian learns why.
use monetize_embed::fleet::{kind, GrowGoAhead, SignedOrder};
use monetize_embed::signing::Snapshot;
use monetize_embed::VerifyingKey;
use monetize_estate_side::pump::Checked;
use monetize_product::pull::{order as pkind, AddPrincipal, GrowRoom, ProductOrder, PurgeTenant};
use monetize_product::EntitlementFact;
use serde::Deserialize;
/// Who this box is on the wire: the shared pump's own (P4a).
pub use monetize_estate_side::pump::Addressee;
/// A recharge, as ordered.
#[derive(Debug, Clone, PartialEq, Eq, Default, Deserialize)]
#[serde(default)]
pub struct Recharge {
/// The main to fill (its control plane, `host:port`).
pub main: String,
/// The twin it is filled from.
pub twin: String,
pub accept_lost: bool,
pub epoch: u64,
/// The old primary THIS box fences first; the recharge runs only when that fence held
/// ([`crate::exec`]).
pub fence: Option<String>,
/// The guardian's proof the old primary is fenced AT THE CLOUD.
pub fenced: Option<String>,
pub case: Option<String>,
}
/// A decoded order body.
#[derive(Debug, Clone, PartialEq)]
pub enum Order {
/// One repository's signed entitlement fact (in holger a tenant IS a repository).
Entitlement(EntitlementFact),
/// Monetize's books put back on a recharged main.
RestateEntitlements(Snapshot),
/// Delete a repository for non-payment (or ask how its purge stands).
PurgeTenant(PurgeTenant),
/// Room was sold past the set: queued, the operator told.
GrowRoom(GrowRoom),
/// A sold estate's paid data step.
GrowGoAhead(GrowGoAhead),
RechargeFromTwin(Recharge),
FencePrimary {
primary: String,
epoch: u64,
},
AdoptTwin {
twin: String,
principal: String,
},
/// A freshly laid box is TOLD it is the twin of `primary` (holger installs with no role).
BecomeTwin {
primary: String,
},
ReviewTwin,
/// A paid signup's account: in holger, a REPOSITORY on a plan (`username` names it; the
/// plan arrives as its entitlement fact). Idempotent per `signup`.
AddPrincipal(AddPrincipal),
/// A sold estate's resend sign-in link (Gunnar's S10): mint and mail it here.
SignInAgain(SignInAgain),
/// **Estate keys fed again** (monetize MAIL-RELAY + NIGHT-PUBREPO, 2026-10-28): each one
/// Holger takes again ([`refeed_key::KNOWN`]), kept beside the feed the box was laid with.
Refeed(Refeed),
/// **One of Holger's own kinds** ([`holger_kind::PRODUCT`], monetize MONETIZE-FIX): queued by
/// the operator on his site, pulled, run through the same hub the `/-/sync` doors use.
Product {
kind: String,
body: ProductOrder,
},
}
/// **The estate keys a `refeed` may carry that Holger takes again** (monetize-embed
/// `fleet::refeed`, named here: a lone clone's crates.io monetize-embed predates it).
pub mod refeed_key {
pub const SMTP_URL: &str = "secret.smtp_url";
pub const SMTP_FROM: &str = "secret.smtp_from";
pub const SMTP_CA: &str = "secret.smtp_ca";
pub const PUBLIC_REPOSITORIES: &str = "public_repositories";
/// **The site's public-site switch** (`on | off`; HOL-PUBSITE-FEED, Gunnar's GRS-PUBLIC):
/// the lay's own word (holger-estate-front `console::PUBLIC_SITE_FEED`, monetize-embed
/// `fleet::refeed::PUBLIC_SITE`). At lay it reaches the front; in a refeed it reaches main
/// and twin, which keep it as the console's generic setting ([`super::PUBLIC_SITE_SETTING`]).
pub const PUBLIC_SITE: &str = "console_public_site";
pub const KNOWN: [&str; 5] = [
SMTP_URL,
SMTP_FROM,
SMTP_CA,
PUBLIC_REPOSITORIES,
PUBLIC_SITE,
];
/// The keys a box keeps as its own generic settings ([`super::Refeed::settings`]), never
/// beside the feed ([`super::Refeed::kept_keys`]).
pub const AS_SETTINGS: [&str; 1] = [PUBLIC_SITE];
}
/// **The generic holger setting the console keeps its public-site switch under**
/// (holger-public-site `setting::NAME`; the stored position wins over the front's feed).
/// holger-server gives the name no meaning: a box keeps a refeed's switch under it as an
/// administrator's `/-/settings/console.public-site` write would, audited the same way.
pub const PUBLIC_SITE_SETTING: &str = "console.public-site";
/// Body of a `refeed` order (monetize-embed `fleet::Refeed`, named here): key → value, the lay's
/// feed words. **A `secret.` value is a secret**: the `Debug` names the keys only.
#[derive(Clone, PartialEq, Eq, Default, Deserialize, serde::Serialize)]
#[serde(default)]
pub struct Refeed {
pub keys: std::collections::BTreeMap<String, String>,
}
impl std::fmt::Debug for Refeed {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
f.debug_struct("Refeed")
.field("keys", &self.keys.keys().collect::<Vec<_>>())
.finish()
}
}
impl Refeed {
/// A key's value, trimmed; blank is unset.
pub fn get(&self, key: &str) -> Option<&str> {
self.keys
.get(key)
.map(|v| v.trim())
.filter(|v| !v.is_empty())
}
/// The public-site switch this refeed carries (`Some(true)` on, `Some(false)` off); `None`
/// when it carries none, or a word that is neither (the decode refuses that one by name).
pub fn public_site(&self) -> Option<bool> {
match self
.keys
.get(refeed_key::PUBLIC_SITE)
.map(|v| v.trim().to_ascii_lowercase())
.as_deref()
{
Some("on") => Some(true),
Some("off") => Some(false),
_ => None,
}
}
/// **The box's generic settings this refeed sets**, (name, value): the public-site switch
/// as [`PUBLIC_SITE_SETTING`] = `on | off`, the bytes an administrator's flip stores.
pub fn settings(&self) -> Vec<(&'static str, Vec<u8>)> {
self.public_site()
.map(|on| {
vec![(
PUBLIC_SITE_SETTING,
if on { b"on".to_vec() } else { b"off".to_vec() },
)]
})
.into_iter()
.flatten()
.collect()
}
/// The keys a box keeps beside its feed: every key but the ones kept as settings
/// ([`refeed_key::AS_SETTINGS`]).
pub fn kept_keys(&self) -> Refeed {
Refeed {
keys: self
.keys
.iter()
.filter(|(k, _)| !refeed_key::AS_SETTINGS.contains(&k.as_str()))
.map(|(k, v)| (k.clone(), v.clone()))
.collect(),
}
}
}
/// Body of a `sign_in_again` order (monetize-embed `fleet::SignInAgain`, named here: a lone
/// clone's crates.io monetize-embed predates it). Never a secret.
#[derive(Debug, Clone, PartialEq, Eq, Default, Deserialize)]
#[serde(default)]
pub struct SignInAgain {
/// The account whose first passkey the invite enrols (the order's account).
pub account: String,
/// The order's address: where the estate mails the link.
pub to: String,
/// The console's relying-party host the link points at (`<company>.<apex>`).
pub host: String,
/// How long the invite lives (0: the default).
pub ttl_secs: u64,
}
/// Holger's own order kinds beside monetize-embed's repair verbs (monetize
/// `products/holger/src/guardian.rs`).
pub mod holger_kind {
pub const BECOME_TWIN: &str = "become_twin";
// ── Holger's OWN order kinds the operator queues on his site (monetize MONETIZE-FIX
// 2026-11-01, `Facts::orders` in holger-monetize-guest): the ONE box never calls into the
// estate; main pulls these and runs them through the same hub its `/-/sync` doors use.
/// `name*`, `key`, `via`, `wireguard_key`: `POST /-/sync/downstreams/enrol`'s form.
pub const DOWNSTREAM_ENROL: &str = "downstream_enrol";
/// `name*`, `door`, `hub_key`, `endpoint`: `POST /-/sync/downstreams/invite`.
pub const DOWNSTREAM_INVITE: &str = "downstream_invite";
/// `name*`: `POST /-/sync/downstreams/revoke`.
pub const DOWNSTREAM_REVOKE: &str = "downstream_revoke";
/// `GET /-/sync/downstreams`.
pub const DOWNSTREAM_LIST: &str = "downstream_list";
/// `GET /-/sync/board`.
pub const SYNC_BOARD: &str = "sync_board";
/// `GET /-/sync/key`.
pub const SYNC_KEY: &str = "sync_key";
/// `GET /-/estate.json`.
pub const ESTATE_BOARD: &str = "estate_board";
/// `path*`, `repository` (default `bundles`), file `bundle`: the file pulled from the ONE box
/// with `Fleet.Ask{fetch}` and written into the repository (as `PUT repo:/<repository>/<path>`).
pub const BUNDLE_PUT: &str = "bundle_put";
/// Every kind of Holger's own the operator may queue.
pub const PRODUCT: [&str; 8] = [
DOWNSTREAM_ENROL,
DOWNSTREAM_INVITE,
DOWNSTREAM_REVOKE,
DOWNSTREAM_LIST,
SYNC_BOARD,
SYNC_KEY,
ESTATE_BOARD,
BUNDLE_PUT,
];
/// monetize-product `pull::order::REFEED` (a core kind since MAIL-RELAY 2026-10-28), named
/// here: a lone clone's crates.io monetize-product predates it.
pub const REFEED: &str = "refeed";
}
#[derive(Deserialize, Default)]
#[serde(default)]
struct PrimaryBody {
primary: String,
}
/// What [`accept`] made of one wire order.
#[derive(Debug, Clone, PartialEq)]
pub enum Verdict {
/// Not monetize's: never run, never acked, the sequence does not move.
Forged(String),
/// Monetize's, but not for this box to run now: acked not-ok with these words.
Refused(String),
Run(Order),
}
#[derive(Deserialize)]
struct RestateBody {
snapshot: Snapshot,
}
#[derive(Deserialize, Default)]
#[serde(default)]
struct FenceBody {
primary: String,
epoch: u64,
}
#[derive(Deserialize, Default)]
#[serde(default)]
struct AdoptBody {
twin: String,
principal: String,
}
/// **The box's check**: the shared pump's ([`monetize_estate_side::pump::check`]: signed by
/// monetize, for this box, newer than the last order taken, inside its window), then a kind
/// Holger runs ([`decode`]).
pub fn accept(
o: &SignedOrder,
me: &Addressee,
key: &VerifyingKey,
last_seq: u64,
now_unix_ms: u64,
) -> Verdict {
match monetize_estate_side::pump::check(o, me, key, last_seq, now_unix_ms) {
Checked::Forged(why) => Verdict::Forged(why),
Checked::Refused(why) => Verdict::Refused(why),
Checked::Fresh => match decode(o.seq, &o.kind, &o.body) {
Ok(order) => Verdict::Run(order),
Err(why) => Verdict::Refused(why),
},
}
}
/// **The body of one kind**, or the refusal by name.
pub fn decode(seq: u64, kind: &str, body: &str) -> Result<Order, String> {
let body = if body.trim().is_empty() { "{}" } else { body };
let bad =
|e: serde_json::Error| format!("order {seq} ({kind}) has a body that does not decode: {e}");
Ok(match kind {
pkind::ENTITLEMENT => Order::Entitlement(serde_json::from_str(body).map_err(bad)?),
kind::RESTATE_ENTITLEMENTS => Order::RestateEntitlements(serde_json::from_str::<RestateBody>(body).map_err(bad)?.snapshot),
pkind::PURGE_TENANT => {
let p: PurgeTenant = serde_json::from_str(body).map_err(bad)?;
if p.tenant.trim().is_empty() {
return Err(format!("order {seq} is a purge_tenant that names no repository"));
}
Order::PurgeTenant(p)
}
pkind::GROW_ROOM => {
let g: GrowRoom = serde_json::from_str(body).map_err(bad)?;
if g.need_bytes == 0 {
return Err(format!("order {seq} is a grow_room that wants nothing"));
}
Order::GrowRoom(g)
}
kind::GROW_GO_AHEAD => {
let g: GrowGoAhead = serde_json::from_str(body).map_err(bad)?;
if g.go_ahead.trim().is_empty() || g.data_gib == 0 {
return Err(format!("order {seq} is a grow_go_ahead without monetize's signed step or a size"));
}
Order::GrowGoAhead(g)
}
kind::RECHARGE_FROM_TWIN => {
let mut r: Recharge = serde_json::from_str(body).map_err(bad)?;
r.fence = r.fence.filter(|f| !f.trim().is_empty());
r.fenced = r.fenced.filter(|f| !f.trim().is_empty());
if r.main.trim().is_empty() || r.twin.trim().is_empty() {
return Err(format!("order {seq} is a recharge_from_twin that names no main or no twin"));
}
Order::RechargeFromTwin(r)
}
kind::FENCE_PRIMARY => {
let b: FenceBody = serde_json::from_str(body).map_err(bad)?;
Order::FencePrimary { primary: b.primary, epoch: b.epoch }
}
kind::ADOPT_TWIN => {
let b: AdoptBody = serde_json::from_str(body).map_err(bad)?;
if b.twin.trim().is_empty() {
return Err(format!("order {seq} is an adopt_twin that names no twin"));
}
Order::AdoptTwin { twin: b.twin, principal: b.principal }
}
holger_kind::BECOME_TWIN => {
let b: PrimaryBody = serde_json::from_str(body).map_err(bad)?;
if b.primary.trim().is_empty() {
return Err(format!("order {seq} is a {kind} that names no primary"));
}
Order::BecomeTwin { primary: b.primary }
}
kind::REVIEW_TWIN => Order::ReviewTwin,
pkind::ADD_PRINCIPAL => {
let a: AddPrincipal = serde_json::from_str(body).map_err(bad)?;
if a.username.trim().is_empty() || a.signup.trim().is_empty() {
return Err(format!("order {seq} is an add_principal that names no repository or no signup"));
}
Order::AddPrincipal(a)
}
pkind::ADD_USERS => return Err(format!("order {seq}: Holger has no seats to grant on an account (a Holger tenant is a repository), so add_users is refused")),
kind::SIGN_IN_AGAIN => {
let b: SignInAgain = serde_json::from_str(body).map_err(bad)?;
if let Err(why) = crate::sign_in::check(&b.account, &b.to, &b.host) {
return Err(format!("order {seq} is a sign_in_again this box cannot mail: {why}"));
}
Order::SignInAgain(b)
}
holger_kind::REFEED => {
// The body may carry the relay's token: its decode error is not echoed.
let r: Refeed = serde_json::from_str(body).map_err(|_| format!("order {seq} (refeed) has a body that does not decode as estate keys"))?;
if r.keys.is_empty() {
return Err(format!("order {seq} is a refeed that names no estate key"));
}
if let Some(k) = r.keys.keys().find(|k| !refeed_key::KNOWN.contains(&k.as_str())) {
return Err(format!("order {seq} is a refeed of the estate key {k:?}, which Holger does not take again (it takes {}): nothing was kept", refeed_key::KNOWN.join(", ")));
}
match (r.get(refeed_key::SMTP_URL), r.get(refeed_key::SMTP_FROM)) {
(Some(url), Some(_)) if !(url.starts_with("smtp://") || url.starts_with("smtps://")) => return Err(format!("order {seq} is a refeed whose {} is not smtp:// or smtps://", refeed_key::SMTP_URL)),
(Some(_), Some(_)) => {}
(None, None) if r.get(refeed_key::SMTP_CA).is_none() => {}
_ => return Err(format!("order {seq} is a refeed with half a mail relay ({} and {} go together)", refeed_key::SMTP_URL, refeed_key::SMTP_FROM)),
}
// The public-site switch is `on` or `off` (HOL-PUBSITE-FEED), never another word.
if let Some(v) = r.keys.get(refeed_key::PUBLIC_SITE) {
if r.public_site().is_none() {
return Err(format!("order {seq} is a refeed of {} = {:?}, which is neither `on` nor `off`: nothing was kept", refeed_key::PUBLIC_SITE, v.trim()));
}
}
// An empty list is "none public" (RA5-18: the ONE box feeds a cleared list as "").
if let Some(list) = r.keys.get(refeed_key::PUBLIC_REPOSITORIES).filter(|l| !l.trim().is_empty()) {
if let Some(bad) = list.split(',').map(str::trim).find(|n| n.is_empty() || !n.bytes().all(|c| c.is_ascii_alphanumeric() || matches!(c, b'-' | b'_' | b'.'))) {
return Err(format!("order {seq} is a refeed whose {} names {bad:?}: a repository is one plain word", refeed_key::PUBLIC_REPOSITORIES));
}
}
Order::Refeed(r)
}
k if holger_kind::PRODUCT.contains(&k) => {
// The params may carry an invite key: the decode error is not echoed.
let body: ProductOrder = serde_json::from_str(body).map_err(|_| format!("order {seq} ({k}) has a body that does not decode as a product order"))?;
if k == holger_kind::BUNDLE_PUT && body.fetch.is_none() {
return Err(format!("order {seq} is a {k} that carries no file"));
}
Order::Product { kind: k.to_string(), body }
}
other => return Err(format!("order {seq}: Holger does not know the order kind {other:?}")),
})
}
#[cfg(test)]
pub(crate) mod tests {
use super::*;
use ed25519_dalek::Signer as _;
use monetize_embed::fleet::order_message;
pub const MONETIZE_SEED: [u8; 32] = [7u8; 32];
pub fn me(role: &str) -> Addressee {
Addressee {
product: "holger".into(),
instance: "acme".into(),
role: role.into(),
}
}
pub fn monetize_key() -> VerifyingKey {
ed25519_dalek::SigningKey::from_bytes(&MONETIZE_SEED).verifying_key()
}
pub fn signed(seq: u64, role: &str, kind: &str, body: &str, signer: [u8; 32]) -> SignedOrder {
let mut o = SignedOrder {
seq,
product: "holger".into(),
instance: "acme".into(),
role: role.into(),
kind: kind.into(),
body: body.into(),
issued_unix_ms: 9_000,
not_after_unix_ms: 0,
signature: Vec::new(),
};
o.signature = ed25519_dalek::SigningKey::from_bytes(&signer)
.sign(&order_message(&o))
.to_bytes()
.to_vec();
o
}
#[test]
fn a_forged_order_is_forged_whatever_it_claims() {
let o = signed(9, "main", "review_twin", "{}", [9u8; 32]);
assert!(matches!(
accept(&o, &me("main"), &monetize_key(), 0, 10_000),
Verdict::Forged(_)
));
}
#[test]
fn an_order_for_the_twin_a_replay_and_an_expired_one_are_refused_by_name() {
let k = monetize_key();
let twin = signed(2, "twin", "review_twin", "{}", MONETIZE_SEED);
assert!(
matches!(accept(&twin, &me("main"), &k, 0, 10_000), Verdict::Refused(w) if w.contains("twin"))
);
let old = signed(2, "main", "review_twin", "{}", MONETIZE_SEED);
assert!(
matches!(accept(&old, &me("main"), &k, 2, 10_000), Verdict::Refused(w) if w.contains("replay"))
);
let mut late = signed(3, "main", "review_twin", "{}", MONETIZE_SEED);
late.not_after_unix_ms = 5_000;
late.signature = ed25519_dalek::SigningKey::from_bytes(&MONETIZE_SEED)
.sign(&order_message(&late))
.to_bytes()
.to_vec();
assert!(
matches!(accept(&late, &me("main"), &k, 0, 10_000), Verdict::Refused(w) if w.contains("expired"))
);
}
/// ★ **HOL-PUBSITE-FEED (Gunnar's GRS-PUBLIC): a `refeed` carries the site's public-site
/// switch** (`console_public_site = on | off`, the lay's own word), alone or beside the other
/// keys; a value that is neither `on` nor `off` is refused by name and nothing is kept.
#[test]
fn a_refeed_carries_the_public_site_switch_and_a_switch_that_is_neither_on_nor_off_is_refused()
{
for (body, want) in [
(r#"{"keys":{"console_public_site":"on"}}"#, true),
(r#"{"keys":{"console_public_site":" OFF "}}"#, false),
(
r#"{"keys":{"console_public_site":"on","public_repositories":"crates"}}"#,
true,
),
] {
let o = signed(7, "main", "refeed", body, MONETIZE_SEED);
match accept(&o, &me("main"), &monetize_key(), 0, 10_000) {
Verdict::Run(Order::Refeed(r)) => {
assert_eq!(r.public_site(), Some(want), "{body}");
assert_eq!(
r.settings(),
vec![(
PUBLIC_SITE_SETTING,
if want {
b"on".to_vec()
} else {
b"off".to_vec()
}
)],
"{body}: the switch is the console's generic setting"
);
assert!(
!r.kept_keys().keys.contains_key(refeed_key::PUBLIC_SITE),
"{body}: the switch is no key kept beside the feed"
);
}
other => panic!("{body}: {other:?}"),
}
}
let o = signed(
8,
"main",
"refeed",
r#"{"keys":{"console_public_site":"maybe"}}"#,
MONETIZE_SEED,
);
match accept(&o, &me("main"), &monetize_key(), 0, 10_000) {
Verdict::Refused(w) => assert!(
w.contains("refeed") && w.contains("console_public_site") && w.contains("maybe"),
"{w}"
),
other => panic!("{other:?}"),
}
}
/// ★ **MAIL-RELAY + NIGHT-PUBREPO: a `refeed` is run with the keys it carries**, each taken
/// by name: the relay and the public repositories. A key Holger does not take again, half a
/// relay, a relay that is not `smtp://`/`smtps://`, a repository that is not one plain word,
/// and no key at all are refused by name, never echoing the token; Debug names keys only.
#[test]
fn a_refeed_is_run_with_the_keys_it_carries_and_a_key_holger_does_not_take_is_refused_by_name()
{
let body = r#"{"keys":{"secret.smtp_url":"smtps://holger%40holger.rs:t0kenVALUE@relay.mock.invalid:465","secret.smtp_from":"Holger <holger@mock.invalid>","public_repositories":"crates,npm"}}"#;
let o = signed(4, "main", "refeed", body, MONETIZE_SEED);
match accept(&o, &me("main"), &monetize_key(), 0, 10_000) {
Verdict::Run(Order::Refeed(r)) => {
assert_eq!(
(
r.get(refeed_key::SMTP_FROM),
r.get(refeed_key::PUBLIC_REPOSITORIES)
),
(Some("Holger <holger@mock.invalid>"), Some("crates,npm"))
);
assert!(!format!("{r:?}").contains("t0kenVALUE"), "{r:?}");
}
other => panic!("{other:?}"),
}
let o = signed(
5,
"main",
"refeed",
r#"{"keys":{"public_repositories":"crates"}}"#,
MONETIZE_SEED,
);
assert!(
matches!(
accept(&o, &me("main"), &monetize_key(), 0, 10_000),
Verdict::Run(Order::Refeed(_))
),
"the public list alone"
);
// RA5-18: a cleared list ("": none public, monetize 523a41ac) is a list, never refused.
let o = signed(
5,
"main",
"refeed",
r#"{"keys":{"public_repositories":""}}"#,
MONETIZE_SEED,
);
match accept(&o, &me("main"), &monetize_key(), 0, 10_000) {
Verdict::Run(Order::Refeed(r)) => assert_eq!(
r.keys
.get(refeed_key::PUBLIC_REPOSITORIES)
.map(String::as_str),
Some(""),
"none public"
),
other => panic!("a cleared public list is refused: {other:?}"),
}
for (bad, word) in [
(r#"{"keys":{}}"#, "names no estate key"),
(
r#"{"keys":{"console_admin_token":"t0kenVALUE"}}"#,
"console_admin_token",
),
(
r#"{"keys":{"secret.smtp_url":"smtps://u:t0kenVALUE@r.mock.invalid"}}"#,
"half a mail relay",
),
(
r#"{"keys":{"secret.smtp_url":"http://u:t0kenVALUE@r.mock.invalid","secret.smtp_from":"h@mock.invalid"}}"#,
"not smtp://",
),
(
r#"{"keys":{"public_repositories":"crates,../x"}}"#,
"one plain word",
),
(r#"{"keys":7}"#, "does not decode"),
] {
let o = signed(6, "main", "refeed", bad, MONETIZE_SEED);
match accept(&o, &me("main"), &monetize_key(), 0, 10_000) {
Verdict::Refused(w) => assert!(
w.contains("refeed") && w.contains(word) && !w.contains("t0kenVALUE"),
"{bad}: {w}"
),
other => panic!("{bad}: {other:?}"),
}
}
}
#[test]
fn holgers_missing_concepts_are_refused_by_name() {
let o = signed(
1,
"main",
"add_principal",
r#"{"username":"crates","kind":"org","signup":"s-1"}"#,
MONETIZE_SEED,
);
assert!(
matches!(accept(&o, &me("main"), &monetize_key(), 0, 10_000), Verdict::Run(Order::AddPrincipal(a)) if a.username == "crates" && a.signup == "s-1"),
"a signup is a repository on a plan"
);
let o = signed(
2,
"main",
"add_principal",
r#"{"username":"","signup":"s-1"}"#,
MONETIZE_SEED,
);
assert!(
matches!(accept(&o, &me("main"), &monetize_key(), 0, 10_000), Verdict::Refused(w) if w.contains("names no repository"))
);
for (kind, word) in [("add_users", "add_users"), ("make_coffee", "make_coffee")] {
let o = signed(
1,
"main",
kind,
r#"{"username":"a","signup":"s"}"#,
MONETIZE_SEED,
);
match accept(&o, &me("main"), &monetize_key(), 0, 10_000) {
Verdict::Refused(w) => assert!(w.contains(word), "{w}"),
other => panic!("{kind}: {other:?}"),
}
}
}
/// ★ **A sold estate's resend sign-in link is run here** (A16, Gunnar's S10): monetize's
/// signed `sign_in_again` names whose passkey, which address and which console host — never
/// a secret; a body a link or a mail header cannot carry is refused by name.
#[test]
fn a_sign_in_again_is_run_and_a_body_a_link_cannot_carry_is_refused() {
let body = r#"{"account":"acme","to":"buyer@mock.invalid","host":"acme.holger.mock.invalid","ttl_secs":86400}"#;
let o = signed(5, "main", "sign_in_again", body, MONETIZE_SEED);
match accept(&o, &me("main"), &monetize_key(), 0, 10_000) {
Verdict::Run(Order::SignInAgain(s)) => assert_eq!(
(
s.account.as_str(),
s.to.as_str(),
s.host.as_str(),
s.ttl_secs
),
(
"acme",
"buyer@mock.invalid",
"acme.holger.mock.invalid",
86_400
)
),
other => panic!("{other:?}"),
}
for bad in [
r#"{"account":"a&user=x","to":"b@mock.invalid","host":"h.mock.invalid"}"#,
r#"{"account":"a","to":"b@mock.invalid\r\nBcc: x@mock.invalid","host":"h.mock.invalid"}"#,
r#"{"account":"a","to":"b@mock.invalid","host":""}"#,
] {
let o = signed(6, "main", "sign_in_again", bad, MONETIZE_SEED);
assert!(
matches!(accept(&o, &me("main"), &monetize_key(), 0, 10_000), Verdict::Refused(w) if w.contains("sign_in_again")),
"{bad}"
);
}
}
}