Method run

atomic-cli/src/commands/identity/delegate.rs:127–244

(&self)

impl Command for Delegate {
    fn run(&self) -> CliResult<()> {
        let store = IdentityStore::open_default().map_err(|e| {
            CliError::Internal(anyhow::anyhow!("Failed to open identity store: {e}"))
        })?;

        let delegator = super::load_identity_or_default(&store, self.identity.as_deref())?;
        if delegator.identity_type.is_delegated() || delegator.identity_type.is_agent() {
            return Err(CliError::InvalidArgument {
                message: format!("'{}' is an agent and cannot delegate", delegator.name),
            });
        }

        // Resolve the delegate: either an identity in the local store, or the
        // subject of a countersigned request.
        let delegate = match (&self.request, &self.agent) {
            (Some(path), _) => self.delegate_from_request(path)?,
            (None, Some(name)) => store
                .load_by_name(name)
                .map_err(|_| CliError::IdentityNotFound(name.clone()))?,
            (None, None) => {
                return Err(CliError::InvalidArgument {
                    message: "name an agent identity, or pass --request <file> to countersign \
                              a request"
                        .to_string(),
                })
            }
        };

        let scope = self.build_scope()?;
        let expires = self
            .expires
            .as_deref()
            .map(parse_duration)
            .transpose()?
            .unwrap_or_else(|| chrono::Duration::days(DEFAULT_EXPIRY_DAYS));

        let mut terms = Delegation::new(&delegator, &delegate, scope).expires_in(expires);
        if let Some(agent_urn) = delegate
            .metadata
            .description
            .as_deref()
            .and_then(software_agent_from_description)
        {
            terms = terms.with_software_agent(agent_urn);
        }

        let keypair = store.load_keypair(&delegator.id, None).map_err(|e| {
            CliError::Internal(anyhow::anyhow!(
                "Failed to load the signing key for '{}': {e}",
                delegator.name
            ))
        })?;
        let certificate = cert::mint(&delegator, &keypair, &terms);
        let document = serde_json::to_string_pretty(&certificate).map_err(|e| {
            CliError::Internal(anyhow::anyhow!("Failed to encode certificate: {e}"))
        })?;

        // `--export` writes the wire form and nothing else, so the output is