Cut 0 and the D0 authorization producer: the candidate keyed on the published manifests; the consent filed, decided and admitted at the door

dag/gunbc/auth/approval_request_client.dag

@@ -8,6 +8,7 @@ import extdeps.crypto.mac {
 import gunbc.auth.approval_status_wire {
   FiledApprovalStatus, StatusNotFiled, StatusPending, StatusApproved, StatusDenied, StatusUnreadable,
 }
+import gunbc.auth.approval_capability { utc_instant_before }
 import gunbc.auth.approval_decision_store {
   StoredApprovalRequest, request_revision_of, approval_mac_key_id,
 }
@@ -90,29 +91,27 @@ type ApprovalPollStanding
   | PollNotFiled
   | PollUnreadable { detail: NonEmptyStr }
 
+// THE BOUNDARY IS THE CAPABILITY'S: expires_at is the instant a request STOPS being decidable
+// (gunbc.auth.approval_capability admits only observed_at < expires_at), so equality is expired
+// here too -- a client that still called the operator's request pending at the very second the
+// broker can no longer redeem the capability would wait for a decision that cannot land.
+// THE FILED REQUEST'S OWN WINDOW GOVERNS A PENDING STANDING. A pending status carries the
+// expires_at the broker filed (the one the operator was shown); the caller's expires_at is the
+// window it would file under and governs only a request that is NOT filed. A rerun that computes
+// a fresh window may therefore not extend a pending filing past what was filed, and a decision is
+// a decision whenever it is read.
 fn approval_poll_standing(
   status: FiledApprovalStatus,
   observed_at: Timestamp,
   expires_at: Timestamp,
 ) -> ApprovalPollStanding {
-  if observed_at > expires_at {
-    match status {
-      StatusApproved { revision: r, decided_by: by, decided_at: at, execute_by: until } =>
-        PollApproved { revision: r, decided_by: by, decided_at: at, execute_by: until }
-      StatusDenied { revision: r, decided_by: by, decided_at: at, reason: why } =>
-        PollDenied { revision: r, decided_by: by, decided_at: at, reason: why }
-      StatusUnreadable { detail: d } => PollUnreadable { detail: d }
-      _ => PollExpired
-    }
-  } else {
-    match status {
-      StatusNotFiled => PollNotFiled
-      StatusPending { expires_at: _ } => PollStillPending
-      StatusApproved { revision: r, decided_by: by, decided_at: at, execute_by: until } =>
-        PollApproved { revision: r, decided_by: by, decided_at: at, execute_by: until }
-      StatusDenied { revision: r, decided_by: by, decided_at: at, reason: why } =>
-        PollDenied { revision: r, decided_by: by, decided_at: at, reason: why }
-      StatusUnreadable { detail: d } => PollUnreadable { detail: d }
-    }
+  match status {
+    StatusApproved { revision: r, decided_by: by, decided_at: at, execute_by: until } =>
+      PollApproved { revision: r, decided_by: by, decided_at: at, execute_by: until }
+    StatusDenied { revision: r, decided_by: by, decided_at: at, reason: why } =>
+      PollDenied { revision: r, decided_by: by, decided_at: at, reason: why }
+    StatusUnreadable { detail: d } => PollUnreadable { detail: d }
+    StatusPending { expires_at: filed } => if utc_instant_before(a: observed_at, b: filed) { PollStillPending } else { PollExpired }
+    StatusNotFiled => if utc_instant_before(a: observed_at, b: expires_at) { PollNotFiled } else { PollExpired }
   }
 }

dag/gunbc/machine_intake/mtcollins1_boot_authorization.dag

@@ -1,27 +1,13 @@
 module gunbc.machine_intake_mtcollins1_boot_authorization
 
-import std.types { Bool, List, NonEmptyStr, String, Timestamp }
+import std.types { Bool, List, NonEmptyStr, String }
 import std.content_hash { ContentHash, content_hash_of_value }
 import std.effect_grant { NamespacePosition, ServiceOpTree, Write }
 import std.scoped_authorization {
   AuthorizedAction,
   AttemptIdentity,
   AuthorizationScope,
   AuthorizationRequest,
-  ScopedAuthorization,
-  AuthorizationGranted,
-  AuthorizationDenied,
-  authorize,
-  AuthorizationPermitted,
-  AuthorizationRefused,
-}
-import gunbc.auth.approval_decision_store {
-  grant_from_approved_decision, GrantDerived, GrantForAnotherIntent,
-  request_revision_of,
-}
-import gunbc.auth.approval_request_client {
-  ApprovalPollStanding, PollApproved, PollDenied, PollExpired, PollStillPending,
-  PollNotFiled, PollUnreadable,
 }
 import gunbc.machine_intake_mtcollins1_boot_artifact { mtcollins1_diskless_image_name, mtcollins1_boot_export_dir }
 import gunbc.machine_intake_mtcollins1_boot_image_fetch { mtcollins1_boot_image_sha256 }
@@ -199,54 +185,9 @@ fn mtcollins1_boot_authorization_request(
   }
 }
 
-type MtCollins1BootGate
-  = BootGateAdmitted { authorization: ScopedAuthorization<MtCollins1BootSubject> }
-  | BootGatePending { escalation_id: NonEmptyStr }
-  | BootGateDenied { reason: NonEmptyStr }
-  | BootGateExpired
-  | BootGateNotFiled { escalation_id: NonEmptyStr }
-  | BootGateIntentMismatch { requested_revision: NonEmptyStr, decided_revision: NonEmptyStr }
-  | BootGateStoreUnreadable { detail: NonEmptyStr }
-  | BootGateAuthorizeRefused { detail: NonEmptyStr }
-
-fn mtcollins1_boot_gate_from_poll(
-  poll: ApprovalPollStanding,
-  request: AuthorizationRequest<MtCollins1BootSubject>,
-  observed_at: Timestamp,
-) -> MtCollins1BootGate {
-  match poll {
-    PollStillPending => BootGatePending { escalation_id: request.escalation_id }
-    PollNotFiled => BootGateNotFiled { escalation_id: request.escalation_id }
-    PollExpired => BootGateExpired
-    PollUnreadable { detail: d } => BootGateStoreUnreadable { detail: d }
-    PollDenied { revision: r, decided_by: _, decided_at: _, reason: why } =>
-      if r != request_revision_of(request: request) {
-        BootGateIntentMismatch {
-          requested_revision: request_revision_of(request: request),
-          decided_revision: r,
-        }
-      } else {
-        BootGateDenied { reason: why }
-      }
-    PollApproved { revision: r, decided_by: by, decided_at: at, execute_by: until } =>
-      match grant_from_approved_decision(
-        request: request,
-        revision: r,
-        decided_by: by,
-        decided_at: at,
-        execute_by: until,
-      ) {
-        GrantForAnotherIntent { requested_revision: a, decided_revision: b } =>
-          BootGateIntentMismatch { requested_revision: a, decided_revision: b }
-        GrantDerived { authorization: auth } =>
-          match authorize(authorization: auth, request: request, observed_at: observed_at) {
-            AuthorizationPermitted { grant: _ } => BootGateAdmitted { authorization: auth }
-            AuthorizationRefused { cause: _ } =>
-              BootGateAuthorizeRefused { detail: "scoped authorization refused the HTTP grant for this request" as NonEmptyStr }
-          }
-        _ =>
-          BootGateStoreUnreadable { detail: "approved GET standing did not yield a grant" as NonEmptyStr }
-      }
-  }
-}
+// THE GATE IS THE SHARED ONE. The operator's decision over this subject is read through
+// gunbc.auth.approval_gate, generic over the subject: ApprovalGate<MtCollins1BootSubject> and
+// approval_gate_from_poll, admitted live at the observed instant. Nothing about the gate is a fact
+// about Mt. Collins, so nothing about it is declared here.
+