ic_backup/policy/membership/
mod.rs

1//! Pure admission of a current provider result; no IO, scheduling or authority mutation.
2
3use crate::model::{
4    artifacts::ArtifactChecksumRecord,
5    inventory::InventoryRecord,
6    membership::{MembershipObservation, MembershipObservationRequest},
7};
8use thiserror::Error;
9
10/// Read-only matching observation; not a dispatch permit, continuity proof or fresh permission.
11#[derive(Clone, Debug)]
12pub struct MembershipView<'a> {
13    request: ArtifactChecksumRecord,
14    inventory: &'a InventoryRecord,
15    selected_targets: &'a [String],
16    revision: Option<&'a ArtifactChecksumRecord>,
17    evidence: &'a ArtifactChecksumRecord,
18    remote_observations: u32,
19}
20
21impl MembershipView<'_> {
22    /// Read the exact original challenge/boundary-bound request digest.
23    #[must_use]
24    pub const fn request(&self) -> &ArtifactChecksumRecord {
25        &self.request
26    }
27    /// Read the complete matching current inventory supplied by the provider.
28    #[must_use]
29    pub const fn inventory(&self) -> &InventoryRecord {
30        self.inventory
31    }
32    /// Read original exact selection in canonical order, without dispatch order.
33    #[must_use]
34    pub const fn selected_targets(&self) -> &[String] {
35        self.selected_targets
36    }
37    /// Read optional current revision; matching revisions alone prove no continuity.
38    #[must_use]
39    pub const fn revision(&self) -> Option<&ArtifactChecksumRecord> {
40        self.revision
41    }
42    /// Read the provider-owned opaque evidence identifier, not a signature or permission.
43    #[must_use]
44    pub const fn evidence(&self) -> &ArtifactChecksumRecord {
45        self.evidence
46    }
47    /// Read reported calls; this does not reserve, refund or replenish any allowance.
48    #[must_use]
49    pub const fn remote_observations(&self) -> u32 {
50        self.remote_observations
51    }
52}
53
54/// Validate exact current request/context/full inventory and descriptive call bound.
55///
56/// The caller qualifies provider authenticity, freshness and coherent custody.
57/// This policy calls no provider, serializes no records, changes no plan/journal
58/// and makes no application consistency, lifecycle or permission claim.
59/// # Errors
60/// Rejects another request, context, inventory or excessive reported observations.
61pub fn validate<'a>(
62    request: &'a MembershipObservationRequest<'_>,
63    observation: &'a MembershipObservation,
64) -> Result<MembershipView<'a>, MembershipError> {
65    let digest = request.digest();
66    if observation.request != digest {
67        return Err(MembershipError::RequestMismatch);
68    }
69    let binding = request.binding();
70    if let Some(field) = super::observed_context::first_mismatch(binding, &observation.context) {
71        return Err(MembershipError::ContextMismatch(field));
72    }
73    if observation.inventory != *request.inventory() {
74        return Err(MembershipError::InventoryMismatch);
75    }
76    if observation.remote_observations > request.max_remote_observations() {
77        return Err(MembershipError::ObservationLimitExceeded {
78            limit: request.max_remote_observations(),
79            reported: observation.remote_observations,
80        });
81    }
82    Ok(MembershipView {
83        request: digest,
84        inventory: &observation.inventory,
85        selected_targets: request.selected_targets(),
86        revision: observation.revision.as_ref(),
87        evidence: &observation.evidence,
88        remote_observations: observation.remote_observations,
89    })
90}
91
92/// Typed mismatch; no rejected result admits an effect or changes original authority.
93#[derive(Debug, Eq, Error, PartialEq)]
94pub enum MembershipError {
95    /// Original intent, operation, challenge, boundary or descriptive ceiling changed.
96    #[error("membership request identity mismatch")]
97    RequestMismatch,
98    /// Actually observed canonical context differs from the original declaration.
99    #[error("membership observed {0} mismatch")]
100    ContextMismatch(&'static str),
101    /// Full current inventory differs, including unselected relationships/metadata.
102    #[error("membership inventory mismatch")]
103    InventoryMismatch,
104    /// Provider reports more remote observations than the descriptive request permits.
105    #[error("membership reports {reported} observations above ceiling {limit}")]
106    ObservationLimitExceeded {
107        /// Original descriptive ceiling; not a journal spending allowance.
108        limit: u32,
109        /// Actual provider-reported remote observations.
110        reported: u32,
111    },
112}
113
114#[cfg(test)]
115mod tests;
ic_backup/policy/membership/mod.rs

ic_backup/policy/membership/
mod.rs
