1 files changed, 140 insertions, 2 deletions

diff --git a/src/document/signatures.rs b/src/document/signatures.rs
index 5d50a33..e92cf9c 100644
--- a/src/document/signatures.rs
+++ b/src/document/signatures.rs
@@ -8,7 +8,9 @@
 //! it verifies up to). So not every change needs one: a change is signed when it
 //! touches protocol data (`_continuum`) or a path the swarm lists as signed
 //! (`_continuum/access/signed`, `listed`), or when its write asks for it (`Sign`); a
-//! change left unsigned is vouched for by the node's next signed one.
+//! change left unsigned is vouched for by the node's next signed one, which, as
+//! `--sign-every` says, is its latest change, signed a while after it if nothing signed
+//! it before (`SignEvery`), or every change at once.
 
 use std::collections::HashMap;
 
@@ -74,10 +76,86 @@ pub(crate) fn listed(doc: &Document) -> Vec<Vec<String>> {
         .collect()
 }
 
+/// Which of this node's changes it signs besides those `Sign` says (`--sign-every`).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum SignEvery {
+    /// Every change, as it is made (`all`, `true`).
+    Change,
+    /// No others (`none`, `false`): one left unsigned waits for the node's next signed
+    /// change.
+    Never,
+    /// Its latest change, if unsigned, this often: every change is vouched for within it.
+    Interval(std::time::Duration),
+}
+
+impl Default for SignEvery {
+    fn default() -> Self {
+        SignEvery::Interval(std::time::Duration::from_secs(1))
+    }
+}
+
+impl std::fmt::Display for SignEvery {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            SignEvery::Change => f.write_str("all"),
+            SignEvery::Never => f.write_str("none"),
+            SignEvery::Interval(every) => f.write_str(&crate::units::format_duration(*every)),
+        }
+    }
+}
+
+impl std::str::FromStr for SignEvery {
+    type Err = String;
+
+    /// `all` or `true`, `none` or `false`, or a duration (`units::parse_duration`; 0 is
+    /// `none`).
+    fn from_str(text: &str) -> Result<Self, String> {
+        match text.trim() {
+            "all" | "true" => Ok(SignEvery::Change),
+            "none" | "false" => Ok(SignEvery::Never),
+            other => match crate::units::parse_duration(other) {
+                Ok(every) if every.is_zero() => Ok(SignEvery::Never),
+                Ok(every) => Ok(SignEvery::Interval(every)),
+                Err(error) => Err(format!(
+                    "{other:?} is neither all, none nor a duration ({error})"
+                )),
+            },
+        }
+    }
+}
+
+impl serde::Serialize for SignEvery {
+    fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_str(&self.to_string())
+    }
+}
+
+impl<'de> serde::Deserialize<'de> for SignEvery {
+    fn deserialize<D: serde::Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        use serde::de::Error as _;
+        match serde_json::Value::deserialize(d)? {
+            serde_json::Value::Bool(all) => Ok(if all {
+                SignEvery::Change
+            } else {
+                SignEvery::Never
+            }),
+            serde_json::Value::String(text) => text.parse().map_err(D::Error::custom),
+            serde_json::Value::Number(number) => {
+                number.to_string().parse().map_err(D::Error::custom)
+            }
+            other => Err(D::Error::custom(format!(
+                "{other} is neither all, none nor a duration"
+            ))),
+        }
+    }
+}
+
 /// A document's signatures, by change.
 #[derive(Debug, Default)]
 pub(crate) struct Signatures {
     by_change: HashMap<ChangeHash, [u8; 64]>,
+    /// This node's latest change, if no signature vouches for it yet (`SignEvery`).
+    unsigned: Option<ChangeHash>,
 }
 
 impl Signatures {
@@ -85,9 +163,33 @@ impl Signatures {
         self.by_change.insert(hash, signature);
     }
 
-    /// Signs `hash` with `key` and keeps the signature.
+    /// Signs `hash`, this node's latest change, with `key` and keeps the signature: it
+    /// vouches for every change of the node's before it too.
     pub(crate) fn sign(&mut self, hash: ChangeHash, key: &crate::identity::NodeKey) {
         self.insert(hash, key.sign(&message(&hash)));
+        self.unsigned = None;
+    }
+
+    /// Whether this node's latest change waits for a signature (`sign_latest`).
+    pub(crate) fn pending(&self) -> bool {
+        self.unsigned.is_some()
+    }
+
+    /// `hash`, this node's latest change, is left unsigned for now.
+    pub(crate) fn left_unsigned(&mut self, hash: ChangeHash) {
+        self.unsigned = Some(hash);
+    }
+
+    /// Signs this node's latest change if no signature vouches for it yet; whether it
+    /// did.
+    pub(crate) fn sign_latest(&mut self, key: &crate::identity::NodeKey) -> bool {
+        match self.unsigned {
+            Some(hash) => {
+                self.sign(hash, key);
+                true
+            }
+            None => false,
+        }
     }
 }
 
@@ -150,6 +252,42 @@ mod tests {
         assert!(check(&named, &hash, &key.sign(&message(&hash))).is_none());
     }
 
+    /// `--sign-every`: `all`, `none`, a duration; 0 is `none`.
+    #[test]
+    fn sign_every_reads() {
+        use std::time::Duration;
+        let read = |text: &str| text.parse::<SignEvery>();
+        assert_eq!(read("all"), Ok(SignEvery::Change));
+        assert_eq!(read("true"), Ok(SignEvery::Change));
+        assert_eq!(read("none"), Ok(SignEvery::Never));
+        assert_eq!(read("0"), Ok(SignEvery::Never));
+        assert_eq!(
+            read("500ms"),
+            Ok(SignEvery::Interval(Duration::from_millis(500)))
+        );
+        assert!(read("sometimes").is_err());
+        let toml: SignEvery = serde_json::from_value(json!(false)).unwrap();
+        assert_eq!(toml, SignEvery::Never);
+        assert_eq!(SignEvery::default().to_string(), "1s");
+    }
+
+    /// The latest change left unsigned is signed later, once; a signature since covers it.
+    #[test]
+    fn the_latest_change_is_signed_later() {
+        let key = NodeKey::from_seed([1; 32]);
+        let mut signatures = Signatures::default();
+        assert!(!signatures.sign_latest(&key));
+        let a = ChangeHash([1; 32]);
+        let b = ChangeHash([2; 32]);
+        signatures.left_unsigned(a);
+        assert!(signatures.sign_latest(&key));
+        assert!(signatures.by_change.contains_key(&a));
+        assert!(!signatures.sign_latest(&key));
+        signatures.left_unsigned(a);
+        signatures.sign(b, &key);
+        assert!(!signatures.sign_latest(&key));
+    }
+
     /// Protocol data, listed paths (within or above them) and asked-for writes are
     /// signed; others aren't.
     #[test]