didbot_serve/

lookups.rs

//! Reading the records a write's policies declared they read, before the
//! write is judged.
//!
//! The gate is judged inside a synchronous section, so nothing under it can
//! await and nothing under it may reach the network. The read is therefore
//! split in two, in the order a write meets them:
//!
//! 1. [`Reader::prefetch`], from the route that accepted the write, while
//!    there is still a runtime. It works out which records the applicable
//!    policies want for this write and fills `didbot-lookup`'s cache with
//!    what it does not already hold, inside that crate's own deadlines.
//! 2. [`Reader::answers`], from `didbot-pds`'s write path, which is
//!    `didbot_pds::policy::WriteLookups`. It reads the same cache, does no
//!    I/O, and hands the answers to the gate as ordinary subject fields.
//!
//! Both halves work out what a write wants from the same code, so a record
//! the first half reads is the record the second half looks for.

use std::sync::{Arc, RwLock};

use didbot_lookup::{Answer, ForeignRecords, RecordRef, MAX_NAMED_ACCOUNTS};
use didbot_pds::policy::{LookupRefusal, OwnedFound, OwnedLookup, WriteLookups};
use didbot_pds::Registry;
use didbot_policy_records::records::{Accounts, Lookup};
use didbot_policy_records::Lookups;
use serde_json::Value;
use tracing::debug;

/// The lookups this deployment's policies declare, swapped each time the
/// policy set is rebuilt.
///
/// It starts holding the built-ins' lookups rather than none. A deployment
/// that has not polled its operator yet still enforces the floor, and a
/// floor rule whose records were never read would stand aside on every
/// write — which is a rule that is off, spelled as a rule that is on.
pub struct DeclaredLookups(RwLock<Arc<Lookups>>);

impl DeclaredLookups {
    /// The lookups of the policies compiled into this binary.
    #[must_use]
    pub fn new() -> Self {
        Self(RwLock::new(Arc::new(Lookups::of(
            &didbot_policy_records::builtin_policies(),
            &std::collections::HashMap::new(),
            &std::collections::HashMap::new(),
        ))))
    }

    /// Replaces them with the lookups of a newly built set.
    pub fn publish(&self, lookups: Lookups) {
        *self.0.write().unwrap_or_else(|p| p.into_inner()) = Arc::new(lookups);
    }

    /// The lookups in force right now.
    #[must_use]
    pub fn current(&self) -> Arc<Lookups> {
        self.0.read().unwrap_or_else(|p| p.into_inner()).clone()
    }
}

impl Default for DeclaredLookups {
    fn default() -> Self {
        Self::new()
    }
}

/// This deployment's two-phase read of the records its policies declare.
pub struct Reader {
    declared: Arc<DeclaredLookups>,
    foreign: Arc<ForeignRecords>,
    registry: Arc<dyn Registry>,
}

impl Reader {
    /// A reader over this deployment's declared lookups, its one foreign
    /// record reader, and its registry — which is what says an account is
    /// this deployment's own.
    #[must_use]
    pub fn new(
        declared: Arc<DeclaredLookups>,
        foreign: Arc<ForeignRecords>,
        registry: Arc<dyn Registry>,
    ) -> Self {
        Self {
            declared,
            foreign,
            registry,
        }
    }

    /// Every record this write's policies want, each once, or the refusal
    /// of a write naming more accounts than they can all be asked about.
    ///
    /// An account this deployment holds is not one of them. Its records are
    /// this server's own, the reader refuses to fetch them over the
    /// network, and spending a write's lookup budget on a refusal it can
    /// predict would leave less of it for the strangers the rule is about.
    fn wanted(&self, collection: &str, after: Option<&Value>) -> Result<Wanted, LookupRefusal> {
        let declared = self.declared.current();
        let for_write = declared.for_write(collection);
        if for_write.is_empty() {
            return Ok(Vec::new());
        }
        let named: Vec<String> = after
            .map(didbot_policy_records::named_accounts)
            .unwrap_or_default()
            .into_iter()
            .filter(|did| self.registry.account(did).is_none())
            .collect();
        let checked = MAX_NAMED_ACCOUNTS.min(self.foreign.limits().per_write / for_write.len());
        if named.len() > checked {
            return Err(LookupRefusal(format!(
                "this record names more than {checked} accounts, which is more than this server \
                 checks for a declared AI preference; name fewer"
            )));
        }
        let mut wanted = Vec::new();
        for lookup in for_write {
            let accounts: &[String] = match lookup.accounts {
                Accounts::Named => &named,
                // A word this build does not know names nobody, so it
                // reads nothing: see `Accounts`.
                Accounts::Other(_) => &[],
            };
            for account in accounts {
                let reference = match &lookup.rkey {
                    Some(rkey) => RecordRef::new(account, &lookup.collection, rkey),
                    None => RecordRef::collection(account, &lookup.collection),
                };
                wanted.push((lookup.clone(), account.clone(), reference));
            }
        }
        Ok(wanted)
    }

    /// Fills the cache with what this write's policies want and it does not
    /// already hold. Bounded by `didbot-lookup`'s own deadlines and by how
    /// many records one write may read. A write the write path will refuse
    /// for naming too many accounts reads nothing.
    pub async fn prefetch(&self, collection: &str, after: Option<&Value>) {
        let Ok(wanted) = self.wanted(collection, after) else {
            return;
        };
        if wanted.is_empty() {
            return;
        }
        let references: Vec<RecordRef> = wanted.into_iter().map(|(_, _, r)| r).collect();
        self.foreign.prefetch(&references).await;
    }
}

/// What one write wants read: the lookup, the account it is about, and the
/// record to read.
type Wanted = Vec<(Lookup, String, RecordRef)>;

impl WriteLookups for Reader {
    fn answers(
        &self,
        _account: &str,
        collection: &str,
        after: Option<&Value>,
    ) -> Result<Vec<OwnedLookup>, LookupRefusal> {
        let handles = after
            .map(didbot_policy_records::named_handles)
            .unwrap_or_default();
        Ok(self
            .wanted(collection, after)?
            .into_iter()
            .map(|(lookup, account, reference)| {
                let uri = reference.at_uri();
                let found = match self.foreign.read(&reference) {
                    Answer::Present(records) => OwnedFound::Records((*records).clone()),
                    Answer::Absent => OwnedFound::Nothing,
                    Answer::Unknown(unknown) => OwnedFound::Unknown(unknown.as_str().to_owned()),
                };
                debug!(
                    lookup = %lookup.name,
                    names = %account,
                    uri = %uri,
                    found = match &found {
                        OwnedFound::Records(_) => "records",
                        OwnedFound::Nothing => "nothing",
                        OwnedFound::Unknown(why) => why.as_str(),
                    },
                    "read what a policy declared it reads about an account this write names"
                );
                let handle = handles
                    .iter()
                    .find(|(did, _)| *did == account)
                    .map(|(_, handle)| handle.clone());
                OwnedLookup {
                    name: lookup.name.clone(),
                    account,
                    handle,
                    uri,
                    found,
                }
            })
            .collect())
    }
}