void_core/collab/manifest/

policy.rs

//! Write policy matching for contributor manifests.
//!
//! Determines if a signer is authorized to push to a given ref path
//! based on write policies and delegations.

use std::time::{SystemTime, UNIX_EPOCH};

use crate::support::pathspec::Pathspec;

use super::keys::SigningPubKey;
use super::types::Manifest;

// ============================================================================
// AuthResult — Result of an authorization check
// ============================================================================

/// Result of checking write authorization.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum AuthResult {
    /// Access allowed via direct policy.
    Allowed,
    /// Access allowed via delegation from another contributor.
    Delegated {
        /// The signing key of the delegator.
        from: SigningPubKey,
    },
    /// Access denied.
    Denied,
}

impl AuthResult {
    /// Returns true if access is allowed (directly or via delegation).
    pub fn is_allowed(&self) -> bool {
        matches!(self, AuthResult::Allowed | AuthResult::Delegated { .. })
    }
}

// ============================================================================
// Policy checking
// ============================================================================

/// Check if a signer has write access to a ref path.
///
/// Checks in order:
/// 1. Is the signer the repository owner? (always allowed)
/// 2. Does any write_policy pattern match and include the signer?
/// 3. Does any valid delegation grant access?
///
/// # Arguments
/// * `manifest` - The contributor manifest.
/// * `signer` - The signing key of the user attempting to push.
/// * `ref_path` - The ref path being pushed to (e.g., "refs/heads/main").
pub fn check_write_access(
    manifest: &Manifest,
    signer: &SigningPubKey,
    ref_path: &str,
) -> AuthResult {
    // Owner always has access — checks both the repo owner key directly
    // and the identity key via the owner delegation certificate
    if manifest.is_owner_or_identity(signer) {
        return AuthResult::Allowed;
    }

    // Check direct write policies
    for (pattern, allowed_signers) in &manifest.write_policy {
        if matches_ref_pattern(pattern, ref_path) && allowed_signers.contains(signer) {
            return AuthResult::Allowed;
        }
    }

    // Check delegations
    let now = current_timestamp();
    for delegation in &manifest.delegations {
        if &delegation.to != signer {
            continue;
        }

        if !delegation.is_valid_at(now) {
            continue;
        }

        if matches_ref_pattern(&delegation.scope, ref_path) {
            // Verify delegator has access to this scope
            let delegator_access = check_delegator_access(manifest, &delegation.from, ref_path);
            if delegator_access {
                return AuthResult::Delegated {
                    from: delegation.from.clone(),
                };
            }
        }
    }

    AuthResult::Denied
}

/// Check if a delegator has access to delegate for a given ref path.
///
/// A user can only delegate permissions they themselves have.
fn check_delegator_access(manifest: &Manifest, delegator: &SigningPubKey, ref_path: &str) -> bool {
    // Owner can delegate anything — checks both repo owner key and identity key
    if manifest.is_owner_or_identity(delegator) {
        return true;
    }

    // Check if delegator has direct access
    for (pattern, allowed_signers) in &manifest.write_policy {
        if matches_ref_pattern(pattern, ref_path) && allowed_signers.contains(delegator) {
            return true;
        }
    }

    false
}

/// Match a ref pattern against a ref path.
///
/// Uses glob-style matching via Pathspec.
fn matches_ref_pattern(pattern: &str, ref_path: &str) -> bool {
    // Exact match is always allowed
    if pattern == ref_path {
        return true;
    }

    // Use Pathspec for glob matching
    match Pathspec::new(&[pattern]) {
        Ok(ps) => ps.matches(ref_path),
        Err(_) => false,
    }
}

/// Get the default contributor namespace for a signing key.
///
/// Contributors get a personal namespace under `refs/heads/contrib/<key_prefix>/`
/// where they can push freely without explicit policy entries.
///
/// # Arguments
/// * `signer` - The signing key of the contributor.
///
/// # Returns
/// The ref pattern for the contributor's namespace.
pub fn default_contributor_namespace(signer: &SigningPubKey) -> String {
    let prefix = &signer.to_hex()[..16]; // First 8 bytes as hex
    format!("refs/heads/contrib/{}/", prefix)
}

/// Check if a signer has access to their default contributor namespace.
///
/// This is a convenience function that checks the standard namespace pattern.
pub fn check_contributor_namespace_access(
    _manifest: &Manifest,
    signer: &SigningPubKey,
    ref_path: &str,
) -> bool {
    let namespace = default_contributor_namespace(signer);

    // Check if the ref is under the contributor's namespace
    if ref_path.starts_with(&namespace) {
        // Contributors always have access to their own namespace
        // (unless explicitly denied, which we don't implement yet)
        return true;
    }

    false
}

/// Get current Unix timestamp.
fn current_timestamp() -> u64 {
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .map(|d| d.as_secs())
        .unwrap_or(0)
}

// ============================================================================
// Tests
// ============================================================================

#[cfg(test)]
mod tests {
    use super::*;
    use crate::collab::manifest::types::Delegation;

    fn test_signing_key(val: u8) -> SigningPubKey {
        SigningPubKey::from_bytes([val; 32])
    }

    fn test_manifest_with_policy() -> Manifest {
        let owner = test_signing_key(0xaa);
        let alice = test_signing_key(0xbb);

        let mut manifest = Manifest::new(owner, None);

        // Alice can push to main
        manifest
            .write_policy
            .insert("refs/heads/main".to_string(), vec![alice.clone()]);

        // Alice can push to any feature branch
        manifest
            .write_policy
            .insert("refs/heads/feature/*".to_string(), vec![alice]);

        manifest
    }

    #[test]
    fn owner_always_allowed() {
        let owner = test_signing_key(0xaa);
        let manifest = Manifest::new(owner, None);

        let result = check_write_access(&manifest, &owner, "refs/heads/main");
        assert_eq!(result, AuthResult::Allowed);

        let result = check_write_access(&manifest, &owner, "refs/heads/anything");
        assert_eq!(result, AuthResult::Allowed);
    }

    #[test]
    fn non_contributor_denied() {
        let manifest = test_manifest_with_policy();
        let stranger = test_signing_key(0xcc);

        let result = check_write_access(&manifest, &stranger, "refs/heads/main");
        assert_eq!(result, AuthResult::Denied);
    }

    #[test]
    fn direct_policy_match() {
        let manifest = test_manifest_with_policy();
        let alice = test_signing_key(0xbb);

        // Exact match
        let result = check_write_access(&manifest, &alice, "refs/heads/main");
        assert_eq!(result, AuthResult::Allowed);
    }

    #[test]
    fn glob_policy_match() {
        let manifest = test_manifest_with_policy();
        let alice = test_signing_key(0xbb);

        // Glob match
        let result = check_write_access(&manifest, &alice, "refs/heads/feature/new-thing");
        assert_eq!(result, AuthResult::Allowed);

        // Should not match non-feature branches
        let result = check_write_access(&manifest, &alice, "refs/heads/develop");
        assert_eq!(result, AuthResult::Denied);
    }

    #[test]
    fn delegation_grants_access() {
        let owner = test_signing_key(0xaa);
        let bob = test_signing_key(0xcc);

        let mut manifest = Manifest::new(owner, None);

        // Owner delegates main branch access to Bob
        manifest.delegations.push(Delegation {
            from: owner.clone(),
            to: bob.clone(),
            scope: "refs/heads/main".to_string(),
            granted_at: 0,
            expires_at: None, // No expiry
            signature: vec![0; 64],
        });

        let result = check_write_access(&manifest, &bob, "refs/heads/main");
        assert!(matches!(result, AuthResult::Delegated { .. }));

        // Bob still can't push to other branches
        let result = check_write_access(&manifest, &bob, "refs/heads/develop");
        assert_eq!(result, AuthResult::Denied);
    }

    #[test]
    fn expired_delegation_denied() {
        let owner = test_signing_key(0xaa);
        let bob = test_signing_key(0xcc);

        let mut manifest = Manifest::new(owner, None);

        // Expired delegation
        manifest.delegations.push(Delegation {
            from: owner,
            to: bob.clone(),
            scope: "refs/heads/main".to_string(),
            granted_at: 0,
            expires_at: Some(1), // Expired long ago
            signature: vec![0; 64],
        });

        let result = check_write_access(&manifest, &bob, "refs/heads/main");
        assert_eq!(result, AuthResult::Denied);
    }

    #[test]
    fn matches_ref_pattern_exact() {
        assert!(matches_ref_pattern("refs/heads/main", "refs/heads/main"));
        assert!(!matches_ref_pattern("refs/heads/main", "refs/heads/develop"));
    }

    #[test]
    fn matches_ref_pattern_glob() {
        assert!(matches_ref_pattern(
            "refs/heads/feature/*",
            "refs/heads/feature/foo"
        ));
        assert!(matches_ref_pattern(
            "refs/heads/feature/*",
            "refs/heads/feature/bar"
        ));
        assert!(!matches_ref_pattern(
            "refs/heads/feature/*",
            "refs/heads/main"
        ));
    }

    #[test]
    fn matches_ref_pattern_recursive_glob() {
        assert!(matches_ref_pattern(
            "refs/heads/**",
            "refs/heads/feature/deep/nested"
        ));
    }

    #[test]
    fn default_contributor_namespace_format() {
        let signer = test_signing_key(0xab);
        let ns = default_contributor_namespace(&signer);

        assert!(ns.starts_with("refs/heads/contrib/"));
        assert!(ns.ends_with("/"));
        assert!(ns.contains("abababab")); // First 8 bytes repeated
    }

    #[test]
    fn contributor_namespace_access() {
        let signer = test_signing_key(0xab);
        let manifest = Manifest::new(test_signing_key(0xaa), None);

        let ns = default_contributor_namespace(&signer);
        let ref_in_ns = format!("{}feature/test", ns);

        assert!(check_contributor_namespace_access(
            &manifest,
            &signer,
            &ref_in_ns
        ));
        assert!(!check_contributor_namespace_access(
            &manifest,
            &signer,
            "refs/heads/main"
        ));
    }

    #[test]
    fn auth_result_is_allowed() {
        assert!(AuthResult::Allowed.is_allowed());
        assert!(AuthResult::Delegated {
            from: test_signing_key(0xaa)
        }
        .is_allowed());
        assert!(!AuthResult::Denied.is_allowed());
    }
}