feat(worker): allow to add alias for worker creator

crates/nox-tests/tests/spells.rs

@@ -2031,3 +2031,52 @@ async fn get_worker_peer_id_opt() {
         panic!("expected result")
     }
 }
+
+#[tokio::test]
+async fn set_alias_by_worker_creator() {
+    let swarms = make_swarms(1).await;
+
+    let mut client = ConnectedClient::connect_to(swarms[0].multiaddr.clone())
+        .await
+        .wrap_err("connect client")
+        .unwrap();
+
+    let worker_id = create_worker(&mut client, None).await;
+
+    let tetraplets_service = create_service_worker(
+        &mut client,
+        "tetraplets",
+        load_module("tests/tetraplets/artifacts", "tetraplets").expect("load module"),
+        worker_id.clone(),
+    )
+    .await;
+
+    client.send_particle(
+        r#"(seq
+                    (seq
+                        (call relay ("op" "noop") []) 
+                        (call worker ("srv" "add_alias") ["alias" service])
+                    )
+                    (seq
+                        (call worker ("srv" "resolve_alias_opt") ["alias"] resolved)
+                        (call client ("return" "") [resolved.$.[0]!])
+                    )
+                )"#,
+        hashmap! {
+            "relay" => json!(client.node.to_string()),
+            "client" => json!(client.peer_id.to_string()),
+            "service" => json!(tetraplets_service.id),
+            "worker" => json!(worker_id),
+        },
+    );
+
+    if let [JValue::String(resolved)] = client
+        .receive_args()
+        .await
+        .wrap_err("receive")
+        .unwrap()
+        .as_slice()
+    {
+        assert_eq!(*resolved, tetraplets_service.id);
+    }
+}

crates/spell-service-api/Cargo.toml

@@ -8,6 +8,7 @@ edition = "2021"
 [dependencies]
 particle-services = { workspace = true }
 particle-execution = { workspace = true }
+key-manager = { workspace = true }
 
 fluence-libp2p = { workspace = true }
 fluence-spell-dtos = { workspace = true }

crates/spell-service-api/src/lib.rs

@@ -277,6 +277,7 @@ mod tests {
 
     use fluence_spell_dtos::trigger_config::TriggerConfig;
     use fluence_spell_dtos::value::*;
+    use key_manager::KeyManager;
     use maplit::hashmap;
     use serde_json::json;
     use std::time::Duration;
@@ -298,6 +299,14 @@ mod tests {
     ) -> (ParticleAppServices, ModuleRepository) {
         let startup_kp = Keypair::generate_ed25519();
         let vault_dir = base_dir.join("..").join("vault");
+        let keypairs_dir = base_dir.join("..").join("keypairs");
+
+        let key_manager = KeyManager::new(
+            keypairs_dir,
+            startup_kp.clone().into(),
+            management_pid,
+            to_peer_id(&startup_kp),
+        );
         let max_heap_size = server_config::default_module_max_heap_size();
         let config = ServicesConfig::new(
             local_pid,
@@ -321,7 +330,7 @@ mod tests {
             Default::default(),
         );
 
-        let pas = ParticleAppServices::new(config, repo.clone(), None, None);
+        let pas = ParticleAppServices::new(config, repo.clone(), None, None, key_manager);
         (pas, repo)
     }
 

particle-builtins/src/builtins.rs

@@ -130,6 +130,7 @@ where
             modules.clone(),
             Some(services_metrics),
             health_registry,
+            key_manager.clone(),
         );
 
         Self {

particle-services/Cargo.toml

@@ -18,6 +18,7 @@ particle-execution = { workspace = true }
 peer-metrics = { workspace = true }
 uuid-utils = { workspace = true }
 now-millis = { workspace = true }
+key-manager = { workspace = true }
 
 fluence-app-service = { workspace = true }
 

particle-services/src/app_services.rs

@@ -30,6 +30,7 @@ use serde_json::{json, Value as JValue};
 
 use fluence_libp2p::{peerid_serializer, PeerId};
 use health::HealthCheckRegistry;
+use key_manager::KeyManager;
 use now_millis::now_ms;
 use particle_args::{Args, JError};
 use particle_execution::{FunctionOutcome, ParticleParams, ParticleVault};
@@ -48,7 +49,7 @@ use crate::persistence::{
     load_persisted_services, persist_service, remove_persisted_service, PersistedService,
 };
 use crate::ServiceError::{
-    ForbiddenAlias, ForbiddenAliasRoot, ForbiddenAliasWorker, NoSuchService,
+    ForbiddenAlias, ForbiddenAliasRoot, ForbiddenAliasWorker, InternalError, NoSuchService,
 };
 
 type ServiceId = String;
@@ -164,17 +165,17 @@ pub struct VmDescriptor<'a> {
     owner_id: &'a str,
 }
 
-#[derive(Debug, Clone)]
+#[derive(Derivative)]
+#[derivative(Debug, Clone)]
 pub struct ParticleAppServices {
     config: ServicesConfig,
     // TODO: move vault to Plumber or Actor
     pub vault: ParticleVault,
     services: Arc<RwLock<Services>>,
     modules: ModuleRepository,
     aliases: Arc<RwLock<Aliases>>,
-    // TODO: move these peer ids to key manager
-    management_peer_id: PeerId,
-    builtins_management_peer_id: PeerId,
+    #[derivative(Debug = "ignore")]
+    key_manager: KeyManager,
     pub metrics: Option<ServicesMetrics>,
     health: Option<PersistedServiceHealth>,
 }
@@ -258,10 +259,10 @@ impl ParticleAppServices {
         modules: ModuleRepository,
         metrics: Option<ServicesMetrics>,
         health_registry: Option<&mut HealthCheckRegistry>,
+        key_manager: KeyManager,
     ) -> Self {
         let vault = ParticleVault::new(config.particles_vault_dir.clone());
-        let management_peer_id = config.management_peer_id;
-        let builtins_management_peer_id = config.builtins_management_peer_id;
+
         let health = health_registry.map(|registry| {
             let persisted_services = PersistedServiceHealth::new();
             registry.register("persisted_services", persisted_services.clone());
@@ -273,8 +274,7 @@ impl ParticleAppServices {
             services: <_>::default(),
             modules,
             aliases: <_>::default(),
-            management_peer_id,
-            builtins_management_peer_id,
+            key_manager,
             metrics,
             health,
         };
@@ -401,8 +401,7 @@ impl ParticleAppServices {
             //      all services.
             if service.worker_id != init_peer_id
                 && service.owner_id != init_peer_id
-                && self.management_peer_id != init_peer_id
-                && self.builtins_management_peer_id != init_peer_id
+                && !self.key_manager.is_management(init_peer_id)
             {
                 return Err(Forbidden {
                     user: init_peer_id,
@@ -634,14 +633,18 @@ impl ParticleAppServices {
         service_id: String,
         init_peer_id: PeerId,
     ) -> Result<(), ServiceError> {
-        let is_management = init_peer_id == self.management_peer_id
-            || init_peer_id == self.builtins_management_peer_id;
-        let is_root_scope = worker_id == self.config.local_peer_id;
+        let is_management = self.key_manager.is_management(init_peer_id);
+        let is_root_scope = self.key_manager.is_host(worker_id);
         let is_worker = init_peer_id == worker_id;
+        let worker_creator = self
+            .key_manager
+            .get_worker_creator(worker_id)
+            .map_err(|e| InternalError(format!("{e:?}")))?; // worker creator is always set
+        let is_worker_creator = init_peer_id == worker_creator;
 
         if is_root_scope && !is_management {
             return Err(ForbiddenAliasRoot(init_peer_id));
-        } else if !is_worker && !is_management {
+        } else if !is_worker && !is_management && !is_worker_creator {
             return Err(ForbiddenAliasWorker(init_peer_id));
         }
 
@@ -1029,6 +1032,7 @@ mod tests {
 
     use config_utils::{modules_dir, to_peer_id};
     use fluence_libp2p::RandomPeerId;
+    use key_manager::KeyManager;
     use particle_modules::{AddBlueprint, ModuleRepository};
     use server_config::ServicesConfig;
     use service_modules::load_module;
@@ -1045,15 +1049,23 @@ mod tests {
     }
 
     fn create_pas(
-        local_pid: PeerId,
+        root_keypair: Keypair,
         management_pid: PeerId,
         base_dir: PathBuf,
     ) -> ParticleAppServices {
         let startup_kp = Keypair::generate_ed25519();
         let vault_dir = base_dir.join("..").join("vault");
+        let keypairs_dir = base_dir.join("..").join("keypairs");
         let max_heap_size = server_config::default_module_max_heap_size();
+        let key_manager = KeyManager::new(
+            keypairs_dir,
+            root_keypair.clone().into(),
+            management_pid,
+            to_peer_id(&startup_kp),
+        );
+
         let config = ServicesConfig::new(
-            local_pid,
+            PeerId::from(root_keypair.public()),
             base_dir,
             vault_dir,
             HashMap::new(),
@@ -1074,7 +1086,7 @@ mod tests {
             Default::default(),
         );
 
-        ParticleAppServices::new(config, repo, None, None)
+        ParticleAppServices::new(config, repo, None, None, key_manager)
     }
 
     fn call_add_alias_raw(
@@ -1083,9 +1095,10 @@ mod tests {
         service_id: String,
     ) -> Result<(), ServiceError> {
         let base_dir = TempDir::new("test3").unwrap();
-        let local_pid = create_pid();
+        let root_keypair = Keypair::generate_ed25519();
+        let local_pid = PeerId::from(root_keypair.public());
         let management_pid = create_pid();
-        let pas = create_pas(local_pid, management_pid, base_dir.into_path());
+        let pas = create_pas(root_keypair, management_pid, base_dir.into_path());
 
         let client_pid;
         if as_manager {
@@ -1139,10 +1152,11 @@ mod tests {
 
     #[test]
     fn test_get_interface_cache() {
-        let local_pid = create_pid();
+        let root_keypair = Keypair::generate_ed25519();
+        let local_pid = PeerId::from(root_keypair.public());
         let management_pid = create_pid();
         let base_dir = TempDir::new("test").unwrap();
-        let pas = create_pas(local_pid, management_pid, base_dir.path().into());
+        let pas = create_pas(root_keypair, management_pid, base_dir.path().into());
 
         let module = load_module(
             "../crates/nox-tests/tests/tetraplets/artifacts",
@@ -1215,9 +1229,10 @@ mod tests {
     #[test]
     fn test_add_alias() {
         let base_dir = TempDir::new("test4").unwrap();
-        let local_pid = create_pid();
+        let root_keypair = Keypair::generate_ed25519();
+        let local_pid = PeerId::from(root_keypair.public());
         let management_pid = create_pid();
-        let pas = create_pas(local_pid, management_pid, base_dir.into_path());
+        let pas = create_pas(root_keypair, management_pid, base_dir.into_path());
 
         let module_name = "tetra".to_string();
         let m_hash = upload_tetra_service(&pas, module_name.clone());
@@ -1255,9 +1270,10 @@ mod tests {
     #[test]
     fn test_add_alias_repeated() {
         let base_dir = TempDir::new("test4").unwrap();
-        let local_pid = create_pid();
+        let root_keypair = Keypair::generate_ed25519();
+        let local_pid = PeerId::from(root_keypair.public());
         let management_pid = create_pid();
-        let pas = create_pas(local_pid, management_pid, base_dir.into_path());
+        let pas = create_pas(root_keypair, management_pid, base_dir.into_path());
 
         let module_name = "tetra".to_string();
         let m_hash = upload_tetra_service(&pas, module_name.clone());
@@ -1313,9 +1329,10 @@ mod tests {
     #[test]
     fn test_add_alias_twice() {
         let base_dir = TempDir::new("test4").unwrap();
-        let local_pid = create_pid();
+        let root_keypair = Keypair::generate_ed25519();
+        let local_pid = PeerId::from(root_keypair.public());
         let management_pid = create_pid();
-        let pas = create_pas(local_pid, management_pid, base_dir.into_path());
+        let pas = create_pas(root_keypair, management_pid, base_dir.into_path());
 
         let module_name = "tetra".to_string();
         let m_hash = upload_tetra_service(&pas, module_name.clone());
@@ -1363,9 +1380,10 @@ mod tests {
     #[test]
     fn test_persisted_service() {
         let base_dir = TempDir::new("test4").unwrap();
-        let local_pid = create_pid();
+        let root_keypair = Keypair::generate_ed25519();
+        let local_pid = PeerId::from(root_keypair.public());
         let management_pid = create_pid();
-        let pas = create_pas(local_pid, management_pid, base_dir.into_path());
+        let pas = create_pas(root_keypair, management_pid, base_dir.into_path());
 
         let module_name = "tetra".to_string();
         let alias = "alias".to_string();