Function from_environment

atomic-cli/src/commands/delegation.rs:190–243

A grant supplied through [`DELEGATION_ENV`], verified and checked to belong to this agent. Returns `Err` rather than `Ok(None)` when the variable is set but unusable. Falling back to the store there would be worse than failing: the operator asked for a specific grant, and silently using a different one is how you get an agent acting under a scope nobody intended.

(identity: &Identity)

/// asked for a specific grant, and silently using a different one is how you
/// get an agent acting under a scope nobody intended.
fn from_environment(identity: &Identity) -> CliResult<Option<ResolvedDelegation>> {
    let Ok(encoded) = std::env::var(DELEGATION_ENV) else {
        return Ok(None);
    };
    let encoded = encoded.trim();
    if encoded.is_empty() {
        return Ok(None);
    }

    let document = cert::decode_from_transport(encoded).map_err(|e| CliError::DelegationError {
        message: format!("{DELEGATION_ENV} is not a usable grant: {e}"),
    })?;

    let delegation =
        cert::verify_self_contained(&document).map_err(|e| CliError::DelegationError {
            message: format!("The grant in {DELEGATION_ENV} does not verify: {e}"),
        })?;

    if delegation.delegate != identity.id.to_did() {
        // Compare DIDs, and say so. Display names are not unique — two agents
        // called `alice+claude` on different machines are different keys, and
        // an error reading "issued to 'alice+claude', not 'alice+claude'" tells
        // the reader nothing.
        return Err(CliError::DelegationError {
            message: format!(
                "The grant in {DELEGATION_ENV} was issued to a different key.\n  \
                 Grant is for  {} ({})\n  \
                 Running as    {} ({})",
                delegation.delegate_name,
                delegation.delegate,
                identity.name,
                identity.id.to_did()
            ),
        });
    }

    if delegation.is_expired() {
        return Err(CliError::DelegationError {
            message: format!(
                "The grant in {DELEGATION_ENV} expired {}. Ask for a fresh one.",
                delegation
                    .expires
                    .map(|e| e.format("on %Y-%m-%d %H:%M UTC").to_string())
                    .unwrap_or_else(|| "some time ago".to_string())
            ),
        });
    }

    Ok(Some(ResolvedDelegation {
        delegation,
        document,
        status: DelegationStatus::Active,
    }))
}

/// Pre-flight a specific operation before paying for a network round trip.
///