further cleanups

Author: mschuwalow

golem-api-grpc/proto/golem/worker/public_oplog.proto

@@ -292,7 +292,6 @@ message QueuedCardEventCard {
 
 enum CardInstallFailure {
   CARD_INSTALL_FAILURE_UNSPECIFIED = 0;
-  CARD_INSTALL_FAILURE_CARD_REVOKED = 1;
   CARD_INSTALL_FAILURE_NOT_FOUND = 2;
   CARD_INSTALL_FAILURE_RECIPIENT_MISMATCH = 3;
   CARD_INSTALL_FAILURE_NOT_PERMITTED = 4;

golem-api-grpc/proto/golem/worker/raw_oplog.proto

@@ -334,7 +334,6 @@ message RawQueuedCardEventCard {
 
 enum RawCardInstallFailure {
   RAW_CARD_INSTALL_FAILURE_UNSPECIFIED = 0;
-  RAW_CARD_INSTALL_FAILURE_CARD_REVOKED = 1;
   RAW_CARD_INSTALL_FAILURE_NOT_FOUND = 2;
   RAW_CARD_INSTALL_FAILURE_RECIPIENT_MISMATCH = 3;
   RAW_CARD_INSTALL_FAILURE_NOT_PERMITTED = 4;

golem-common/src/base_model/card/algebra.rs

@@ -141,23 +141,7 @@ impl EffectiveSurface {
         &self,
         child_lower_positive: &[PermissionPattern],
         child_upper_positive: &[PermissionPattern],
-    ) -> Result<(), CardAlgebraError> {
-        self.validates_derivation_with_witness(child_lower_positive, child_upper_positive)
-            .map(|_| ())
-    }
-
-    pub fn validates_derivation_with_witness(
-        &self,
-        child_lower_positive: &[PermissionPattern],
-        child_upper_positive: &[PermissionPattern],
     ) -> Result<Vec<CardId>, CardAlgebraError> {
-        if self.source_card_ids.len() != self.lower.len()
-            || self.source_card_ids.len() != self.upper.len()
-        {
-            self.validates_derivation_legacy(child_lower_positive, child_upper_positive)?;
-            return Ok(self.source_card_ids.clone());
-        }
-
         let mut witness = Vec::new();
 
         for grant in child_lower_positive {
@@ -174,7 +158,7 @@ impl EffectiveSurface {
                     grant: Box::new(grant.clone()),
                 });
             };
-            push_unique(&mut witness, self.source_card_ids[parent_index]);
+            push_source_if_available(&mut witness, &self.source_card_ids, parent_index);
         }
 
         for grant in child_upper_positive {
@@ -186,38 +170,14 @@ impl EffectiveSurface {
                     });
                 }
                 if !surface.is_empty() {
-                    push_unique(&mut witness, self.source_card_ids[parent_index]);
+                    push_source_if_available(&mut witness, &self.source_card_ids, parent_index);
                 }
             }
         }
 
         Ok(witness)
     }
 
-    fn validates_derivation_legacy(
-        &self,
-        child_lower_positive: &[PermissionPattern],
-        child_upper_positive: &[PermissionPattern],
-    ) -> Result<(), CardAlgebraError> {
-        for grant in child_lower_positive {
-            if !self.allows_lower(&grant.to_target())? {
-                return Err(CardAlgebraError::DerivationNotSubsumed {
-                    grant: Box::new(grant.clone()),
-                });
-            }
-        }
-
-        for grant in child_upper_positive {
-            if !self.allows_upper(&grant.to_target())? {
-                return Err(CardAlgebraError::DerivationNotSubsumed {
-                    grant: Box::new(grant.clone()),
-                });
-            }
-        }
-
-        Ok(())
-    }
-
     fn allows_lower(&self, request: &PermissionTarget) -> Result<bool, CardAlgebraError> {
         for surface in &self.lower {
             if surface.allows(request)? {
@@ -239,6 +199,12 @@ impl EffectiveSurface {
     }
 }
 
+fn push_source_if_available(values: &mut Vec<CardId>, source_card_ids: &[CardId], index: usize) {
+    if let Some(card_id) = source_card_ids.get(index) {
+        push_unique(values, *card_id);
+    }
+}
+
 fn push_unique(values: &mut Vec<CardId>, value: CardId) {
     if !values.contains(&value) {
         values.push(value);

golem-common/src/base_model/card/tests.rs

@@ -327,7 +327,7 @@ fn derivation_witness_excludes_unrelated_parent() {
         EffectiveSurface::from_cards(&[needed_parent, unrelated_parent], &recipient).unwrap();
 
     let witness = surface
-        .validates_derivation_with_witness(std::slice::from_ref(&read_tmp), &[])
+        .validates_derivation(std::slice::from_ref(&read_tmp), &[])
         .unwrap();
 
     assert_eq!(witness, vec![needed_parent_id]);
@@ -357,7 +357,7 @@ fn derivation_witness_includes_multiple_needed_parents() {
         EffectiveSurface::from_cards(&[filesystem_parent, secret_parent], &recipient).unwrap();
 
     let witness = surface
-        .validates_derivation_with_witness(&[read_tmp, reveal_secret], &[])
+        .validates_derivation(&[read_tmp, reveal_secret], &[])
         .unwrap();
 
     assert_eq!(witness, vec![filesystem_parent_id, secret_parent_id]);

golem-common/src/base_model/mod.rs

@@ -913,7 +913,6 @@ impl From<QueuedCardEvent> for PublicQueuedCardEvent {
 #[cfg_attr(feature = "full", derive(desert_rust::BinaryCodec))]
 #[cfg_attr(feature = "full", desert(evolution()))]
 pub enum CardInstallFailure {
-    CardRevoked,
     NotFound,
     RecipientMismatch,
     NotPermitted,

golem-common/src/model/oplog/protobuf.rs

@@ -162,9 +162,6 @@ fn card_install_failure_from_proto(
         golem_api_grpc::proto::golem::worker::CardInstallFailure::Unspecified => {
             Err("Unspecified card install failure".to_string())
         }
-        golem_api_grpc::proto::golem::worker::CardInstallFailure::CardRevoked => {
-            Ok(CardInstallFailure::CardRevoked)
-        }
         golem_api_grpc::proto::golem::worker::CardInstallFailure::NotFound => {
             Ok(CardInstallFailure::NotFound)
         }
@@ -181,9 +178,6 @@ fn card_install_failure_to_proto(
     value: CardInstallFailure,
 ) -> golem_api_grpc::proto::golem::worker::CardInstallFailure {
     match value {
-        CardInstallFailure::CardRevoked => {
-            golem_api_grpc::proto::golem::worker::CardInstallFailure::CardRevoked
-        }
         CardInstallFailure::NotFound => {
             golem_api_grpc::proto::golem::worker::CardInstallFailure::NotFound
         }
@@ -203,9 +197,6 @@ fn raw_card_install_failure_from_proto(
         golem_api_grpc::proto::golem::worker::RawCardInstallFailure::Unspecified => {
             Err("Unspecified raw card install failure".to_string())
         }
-        golem_api_grpc::proto::golem::worker::RawCardInstallFailure::CardRevoked => {
-            Ok(CardInstallFailure::CardRevoked)
-        }
         golem_api_grpc::proto::golem::worker::RawCardInstallFailure::NotFound => {
             Ok(CardInstallFailure::NotFound)
         }
@@ -222,9 +213,6 @@ fn raw_card_install_failure_to_proto(
     value: CardInstallFailure,
 ) -> golem_api_grpc::proto::golem::worker::RawCardInstallFailure {
     match value {
-        CardInstallFailure::CardRevoked => {
-            golem_api_grpc::proto::golem::worker::RawCardInstallFailure::CardRevoked
-        }
         CardInstallFailure::NotFound => {
             golem_api_grpc::proto::golem::worker::RawCardInstallFailure::NotFound
         }

golem-registry-service/src/services/component/write.rs

@@ -925,7 +925,7 @@ fn prepare_agent_initial_card_for_minting(
             },
         )?;
     effective_surface
-        .validates_derivation_with_witness(&lower_positive, &upper_positive)
+        .validates_derivation(&lower_positive, &upper_positive)
         .map_err(|error| ComponentError::InvalidAgentInitialPermissionCard {
             agent_type: agent_type_name.clone(),
             message: format!("card derivation is not allowed by the creator's cards: {error:?}"),

golem-registry-service/src/services/permission_share.rs

@@ -595,6 +595,7 @@ fn validate_effective_surface_derivation(
 ) -> Result<(), PermissionShareError> {
     effective_surface
         .validates_derivation(&parsed.lower_positive, &parsed.upper_positive)
+        .map(|_| ())
         .map_err(derivation_error)
 }
 

golem-worker-executor/src/durable_host/golem/v1x.rs

@@ -106,7 +106,6 @@ fn card_install_failure_to_wit(
     failure: CardInstallFailure,
 ) -> golem_api_1_x::host::CardInstallError {
     match failure {
-        CardInstallFailure::CardRevoked => golem_api_1_x::host::CardInstallError::Revoked,
         CardInstallFailure::NotFound => golem_api_1_x::host::CardInstallError::NotFound,
         CardInstallFailure::RecipientMismatch | CardInstallFailure::NotPermitted => {
             golem_api_1_x::host::CardInstallError::NotPermitted
@@ -653,12 +652,11 @@ impl<Ctx: WorkerCtx> Host for DurableWorkerCtx<Ctx> {
                 let card = ctx
                     .state
                     .card_service
-                    .get_cards(vec![card_id])
+                    .check_cards(vec![card_id])
                     .await?
-                    .into_iter()
-                    .next();
-                let result = if let Some(card) = card {
-                    ctx.apply_card_install(None, card).await?
+                    .remove(&card_id);
+                let result = if let Some(crate::services::card::CardState::Live(card)) = card {
+                    ctx.apply_card_install(None, *card).await?
                 } else {
                     Err(CardInstallFailure::NotFound)
                 };

golem-worker-executor/src/durable_host/mod.rs

@@ -51,7 +51,7 @@ use crate::model::{
 use crate::services::agent_types::AgentTypesService;
 use crate::services::agent_webhooks::AgentWebhooksService;
 use crate::services::blob_store::BlobStoreService;
-use crate::services::card::CardService;
+use crate::services::card::{CardService, CardState};
 use crate::services::component::ComponentService;
 use crate::services::environment_state::EnvironmentStateService;
 use crate::services::file_loader::{FileLoader, FileUseToken};
@@ -722,20 +722,40 @@ impl<Ctx: WorkerCtx> DurableWorkerCtx<Ctx> {
         card: StoredCard,
     ) -> Result<Result<(), CardInstallFailure>, WorkerExecutorError> {
         let card_id = card.card_id();
-        let revoked_or_missing = self
+        let mut candidate_wallet_card_ids = self
+            .state
+            .agent_wallet_cards
+            .keys()
+            .copied()
+            .collect::<Vec<_>>();
+        if !candidate_wallet_card_ids.contains(&card_id) {
+            candidate_wallet_card_ids.push(card_id);
+        }
+        self.state
+            .card_service
+            .set_card_interest(self.owned_agent_id.clone(), &candidate_wallet_card_ids)
+            .await;
+
+        let card_state = self
             .state
             .card_service
             .check_cards(vec![card_id])
             .await?
-            .contains(&card_id);
-        let status = self.public_state.worker().get_last_known_status().await;
+            .remove(&card_id);
 
-        if revoked_or_missing {
-            let reason = if status.revoked_cards.contains(&card_id) {
-                CardInstallFailure::CardRevoked
-            } else {
-                CardInstallFailure::NotFound
-            };
+        if !matches!(card_state, Some(CardState::Live(_))) {
+            let wallet_card_ids = self
+                .state
+                .agent_wallet_cards
+                .keys()
+                .copied()
+                .collect::<Vec<_>>();
+            self.state
+                .card_service
+                .set_card_interest(self.owned_agent_id.clone(), &wallet_card_ids)
+                .await;
+
+            let reason = CardInstallFailure::NotFound;
 
             if let Some(queued_event_index) = queued_event_index {
                 self.public_state
@@ -759,8 +779,9 @@ impl<Ctx: WorkerCtx> DurableWorkerCtx<Ctx> {
                 .collect::<Vec<_>>();
             self.state
                 .card_service
-                .register_agent_cards(self.owned_agent_id.clone(), &wallet_card_ids)
+                .set_card_interest(self.owned_agent_id.clone(), &wallet_card_ids)
                 .await;
+
             self.public_state
                 .worker()
                 .add_and_commit_oplog(OplogEntry::card_installed(queued_event_index, card))
@@ -784,7 +805,17 @@ impl<Ctx: WorkerCtx> DurableWorkerCtx<Ctx> {
         if is_live {
             self.state
                 .card_service
-                .remove_revoked_agent_cards(&self.owned_agent_id, &[card_id])
+                .record_revoked_cards(&[card_id])
+                .await;
+            let wallet_card_ids = self
+                .state
+                .agent_wallet_cards
+                .keys()
+                .copied()
+                .collect::<Vec<_>>();
+            self.state
+                .card_service
+                .set_card_interest(self.owned_agent_id.clone(), &wallet_card_ids)
                 .await;
 
             self.public_state
@@ -2605,20 +2636,22 @@ impl<Ctx: WorkerCtx> DurableWorkerCtx<Ctx> {
             .collect::<Vec<_>>();
         self.state
             .card_service
-            .register_agent_cards(self.owned_agent_id.clone(), &wallet_card_ids)
+            .set_card_interest(self.owned_agent_id.clone(), &wallet_card_ids)
             .await;
 
         if wallet_card_ids.is_empty() {
             return Ok(());
         }
 
-        let revoked_card_ids = self.state.card_service.check_cards(wallet_card_ids).await?;
+        let card_states = self.state.card_service.check_cards(wallet_card_ids).await?;
 
-        for card_id in revoked_card_ids {
-            self.public_state
-                .worker()
-                .queue_card_revocation(card_id)
-                .await;
+        for (card_id, state) in card_states {
+            if state == CardState::Revoked {
+                self.public_state
+                    .worker()
+                    .queue_card_revocation(card_id)
+                    .await;
+            }
         }
 
         Ok(())
@@ -2722,6 +2755,16 @@ impl<Ctx: WorkerCtx> DurableWorkerCtx<Ctx> {
             self.state.cached_agent_config_retry_policies = None;
             self.state.agent_effective_surface = agent_effective_surface;
             self.state.agent_wallet_cards = initial_wallet_cards;
+            let wallet_card_ids = self
+                .state
+                .agent_wallet_cards
+                .keys()
+                .copied()
+                .collect::<Vec<_>>();
+            self.state
+                .card_service
+                .set_card_interest(self.owned_agent_id.clone(), &wallet_card_ids)
+                .await;
         };
 
         self.state.component_metadata = new_metadata;