Function active_for

atomic-cli/src/commands/delegation.rs:100–181

The certificate to use for `identity` against `server`. Picks the most recently issued certificate that is active, unrevoked, and scoped to that server. Fails with a message naming the command that fixes it, because every reason this can fail is something the human who issued the delegation can put right.

(
    store: &IdentityStore,
    identity: &Identity,
    server: Option<&str>,
)

/// it, because every reason this can fail is something the human who issued the
/// delegation can put right.
pub fn active_for(
    store: &IdentityStore,
    identity: &Identity,
    server: Option<&str>,
) -> CliResult<ResolvedDelegation> {
    // A grant handed over out of band wins. It is the mechanism for machines
    // with no store to populate, and the freshest thing the caller has.
    if let Some(resolved) = from_environment(identity)? {
        return Ok(resolved);
    }

    let all = load_for_delegate(store, identity)?;

    if all.is_empty() {
        return Err(CliError::DelegationError {
            message: format!(
                "'{}' is an agent identity with no delegation certificate on this machine.\n  \
                 Issue one with:  atomic identity delegate {} --can read,record,push",
                identity.name, identity.name
            ),
        });
    }

    let resource = server
        .map(|s| ResourceRef::new().server(s))
        .unwrap_or_default();

    let usable = all.iter().find(|d| {
        d.is_usable()
            && d.delegation
                .scope
                .allows(DelegationPermission::Read, &resource)
    });

    if let Some(found) = usable {
        return Ok(found.clone());
    }

    // Nothing usable: say precisely why, using the freshest certificate as the
    // subject. Reporting "no delegation" when one is merely expired sends the
    // human looking for the wrong problem.
    let newest = &all[0];
    let message = match newest.status {
        DelegationStatus::Revoked => format!(
            "The delegation for '{}' has been revoked.\n  \
             Issue a new one with:  atomic identity delegate {} --can read,record,push",
            identity.name, identity.name
        ),
        DelegationStatus::Expired => format!(
            "The delegation for '{}' expired {}.\n  \
             Renew it with:  atomic identity agent renew {}",
            identity.name,
            newest
                .delegation
                .expires
                .map(|e| e.format("on %Y-%m-%d").to_string())
                .unwrap_or_else(|| "some time ago".to_string()),
            identity.name