Policy · rule
policy.requirement_unsatisfiable
A role's requirement asks for a sign-in that no way in the app can give.
Area 9, Policy; not declinable; the next step is usually the human's.
Why Jadpo refuses it
A role counts only for someone whose sign-in meets its requirement. Here
StaffRole.admin needs a token from another provider
(SignInMethod.external_token), and authentication { } declares no
external_token:, so no one could ever sign in that way and no one
could ever hold the role.
Jadpo won't choose for you: which way in the admins must use, and so where their access is ended, is a policy decision.
What it looks like
main.jadpo:
application { connections: { google: { driver: Driver.oidc issuer: config.google_issuer client_id: config.google_client_id credential: config.google_client_secret } }}config { google_client_id: Text google_client_secret: Text { secret: true } google_issuer: Url site: Url}type Handle = Text { max_length: 40}entity User { id: Uuid handle: Handle { unique: true } policy: { create: [Access.system] read: [id] }}principal { user: { subject: User.handle }}type NotStaff = Failure { kind: FailureKind.not_found}action meet(first: FirstSignIn) fails NotStaff -> User.id { reject NotStaff {}}authentication { browser_session: { cookie: "desk_session" origin: config.site } sign_in: { providers: [google] } on_first_sign_in: meet}type StaffRole = Enum { admin front_desk}entity StaffMember { id: Uuid user_id: User.id { on_delete: OnDelete.cascade } role: StaffRole membership: { scope: MembershipScope.application member: user_id role: role requires: { StaffRole.admin: { sign_in: [SignInMethod.external_token] } StaffRole.front_desk: { sign_in: [SignInMethod.google] } } }}
error No one can hold StaffRole.admin: nothing the app signs people in with is signed in through external_token
--> main.jadpo:79:13
|79 | StaffRole.admin: { | ^^^^^^^^^^^^^^^ can never be met
- reason
- A role counts only for someone whose sign-in meets its requirement; the ways in the app declares that a requirement may name are
SignInMethod.google. - next
- Name a way in the app declares, or declare the one you mean in
authentication.jadpo(human) - rule
- policy.
requirement_ unsatisfiable - help
- https://jadpo.
dev/docs/errors/policy. requirement_ unsatisfiable
(human) at the end of the next: line tells your coding agent to stop
and ask you which fix you want, because the choice is yours to make: it
decides how admins must sign in to keep their role.
How to fix it
The question is which way in the admins really use.
If admins sign in through Google, the provider the app declares, name it:
requires: { StaffRole.admin: { sign_in: [SignInMethod.google] } ... }
The admin role now counts only for someone signed in through Google.
If admins sign in with another provider's token, keep the line and
declare external_token: in authentication { }, reading its issuer
and audience from settings:
authentication { ... external_token: { issuer: config.token_issuer audience: config.token_audience } ...}
The admin role now counts for a request that comes with that provider's
token for an admin
(external_token).
Related
Markdown for agents: /docs/errors/policy.requirement_unsatisfiable.md.Built from Jadpo main at e00e61f.