liminal-server 0.24.9

use super::{
    Arc, ConnectionRuntime, ConnectionServices, InstalledParticipantService, PassVerifier,
};

impl ConnectionRuntime {
    pub(in crate::server::connection) fn services(&self) -> &dyn ConnectionServices {
        self.services.as_ref()
    }

    pub(in crate::server::connection) fn services_arc(&self) -> Arc<dyn ConnectionServices> {
        Arc::clone(&self.services)
    }

    /// Returns the complete participant service captured at supervisor startup.
    pub(in crate::server::connection) const fn participant_service(
        &self,
    ) -> Option<&InstalledParticipantService> {
        self.participant_service.as_ref()
    }

    /// Returns the configured connection auth token as opaque bytes, or `None` when
    /// no `[auth]` section was configured (open access).
    pub(in crate::server::connection) fn auth_token(&self) -> Option<&[u8]> {
        self.auth_token.as_deref()
    }

    pub(in crate::server::connection) const fn pass_verifier(&self) -> Option<&PassVerifier> {
        self.pass_verifier.as_ref()
    }

    /// Whether this exchange gates connections at all: a bearer, a pass
    /// verifier or a revocation authority. With none of them it is open mode
    /// (ACCESS-010 R2): every `Connect` is admitted as an open-access
    /// connection, whatever record it carries.
    pub(in crate::server::connection) fn gates_connections(&self) -> bool {
        self.auth_token.is_some() || self.pass_verifier.is_some() || self.revocation().is_some()
    }

    /// The installed Lys admitter with the network id subjects are placed
    /// under, or `None` while no deploy has installed one.
    pub(in crate::server::connection) fn lys_admitter(
        &self,
    ) -> Option<(&Arc<dyn crate::auth_lys::session::LysAdmitter>, &str)> {
        self.lys_admitter
            .get()
            .map(|(admitter, network)| (admitter, network.as_str()))
    }

    /// Installs the Lys admitter once; a second install is refused so one
    /// deploy cannot swap the authority another relied on.
    ///
    /// # Errors
    /// The admitter already installed.
    pub(in crate::server::connection) fn install_lys_admitter(
        &self,
        admitter: Arc<dyn crate::auth_lys::session::LysAdmitter>,
        network_id: String,
    ) -> Result<(), Arc<dyn crate::auth_lys::session::LysAdmitter>> {
        self.lys_admitter
            .set((admitter, network_id))
            .map_err(|(admitter, _)| admitter)
    }

    /// This liminal as a machine Lys knows, if `[auth.lys.machine]` named it.
    pub(in crate::server::connection) fn link_host(&self) -> Option<&Arc<crate::link::LinkHost>> {
        self.link_host.get()
    }

    pub(in crate::server::connection) fn service_bindings(
        &self,
    ) -> Option<&Arc<crate::services::production::ServiceBindings>> {
        self.service_bindings.get()
    }

    /// The services registry, if templates are configured (SRV-028).
    pub(in crate::server::connection) fn lifecycle(
        &self,
    ) -> Option<&Arc<crate::services::lifecycle::Lifecycle>> {
        self.lifecycle.get()
    }

    /// Installs a services registry on a test runtime, once.
    #[cfg(test)]
    pub(in crate::server::connection) fn install_lifecycle_for_tests(
        &self,
        lifecycle: Arc<crate::services::lifecycle::Lifecycle>,
    ) -> bool {
        self.lifecycle.set(lifecycle).is_ok()
    }

    pub(in crate::server::connection) fn install_service_bindings(
        &self,
        bindings: Arc<crate::services::production::ServiceBindings>,
    ) -> Result<(), Arc<crate::services::production::ServiceBindings>> {
        self.service_bindings.set(bindings)
    }

    /// The channel membership gate, if `[auth.lys.membership]` configured
    /// one (ACCESS-006 R1).
    pub(in crate::server::connection) fn membership_gate(
        &self,
    ) -> Option<&Arc<crate::auth_membership::MembershipGate>> {
        self.membership_gate.get()
    }

    /// Installs the membership gate once; a second install is refused so
    /// one deploy cannot swap the gate live bindings rely on.
    ///
    /// # Errors
    /// The gate already installed.
    pub(in crate::server::connection) fn install_membership_gate(
        &self,
        gate: Arc<crate::auth_membership::MembershipGate>,
    ) -> Result<(), Arc<crate::auth_membership::MembershipGate>> {
        self.membership_gate.set(gate)
    }

    /// Installs the link host once; a second install is refused.
    ///
    /// # Errors
    /// The host already installed.
    pub(in crate::server::connection) fn install_link_host(
        &self,
        host: Arc<crate::link::LinkHost>,
    ) -> Result<(), Arc<crate::link::LinkHost>> {
        self.link_host.set(host)
    }

    /// The grant-revocation authority, when a revocation policy is
    /// installed (ACCESS-005).
    pub(in crate::server::connection) fn revocation(
        &self,
    ) -> Option<&Arc<crate::auth_revocation::RevocationAuthority>> {
        self.revocation.get()
    }

    /// Installs the grant-revocation authority once; a second install is
    /// refused.
    ///
    /// # Errors
    /// The authority already installed.
    pub(in crate::server::connection) fn install_revocation(
        &self,
        authority: Arc<crate::auth_revocation::RevocationAuthority>,
    ) -> Result<(), Arc<crate::auth_revocation::RevocationAuthority>> {
        self.revocation.set(authority)
    }
}