Method execute

atomic-cli/src/commands/identity/delegation.rs:171–229

(&self)

impl Push {
    async fn execute(&self) -> CliResult<()> {
        let store = IdentityStore::open_default().map_err(|e| {
            CliError::Internal(anyhow::anyhow!("Failed to open identity store: {e}"))
        })?;

        let documents = match &self.id {
            Some(id) => vec![(normalize_id(id)?, load_document(&store, id)?)],
            None => store
                .list_delegations()
                .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to list: {e}")))?,
        };

        if documents.is_empty() {
            print_hint("No certificates to push.");
            return Ok(());
        }

        let mut pushed = 0;
        for (id, raw) in documents {
            let Ok(value) = serde_json::from_str::<serde_json::Value>(&raw) else {
                print_warning(&format!("Skipping {id}: not valid JSON"));
                continue;
            };
            let Ok(delegation) = cert::verify_self_contained(&value) else {
                print_warning(&format!("Skipping {id}: does not verify"));
                continue;
            };
            if delegation.is_expired() {
                continue;
            }

            // The delegator must be on this machine — the server authenticates
            // the *human*, since only they may enroll on their own behalf.
            let Ok(delegator) = store.load_by_name(&delegation.delegator_name) else {
                print_warning(&format!(
                    "Skipping {id}: the delegating identity '{}' is not on this machine",
                    delegation.delegator_name
                ));
                continue;
            };

            let (client, url) =
                crate::commands::client::build_apex_client_as(&delegator, self.server.as_deref())
                    .await?;
            let request = PushDelegationRequest { certificate: value };
            match client.push_delegation(&request).await {
                Ok(_) => {
                    println!("  {} → {url}", delegation.id.to_urn());
                    pushed += 1;
                }
                Err(e) => print_warning(&format!("Failed to push {id}: {e}")),
            }
        }

        if pushed > 0 {
            print_success(&format!("Pushed {pushed} certificate(s)"));
        }
        Ok(())