Merge lp:~rogpeppe/juju-core/312-api-jobs into lp:~juju/juju-core/trunk

[Roger Peppe]

api: implement Machine.Jobs

https://codereview.appspot.com/9754043/

[Roger Peppe (rogpeppe)]

Reviewers: mp+165705_code.launchpad.net,

Message:
Please take a look.

Description:
api: implement Machine.Jobs

https://code.launchpad.net/~rogpeppe/juju-core/312-api-jobs/+merge/165705

Requires:
https://code.launchpad.net/~rogpeppe/juju-core/311-juju-bootstrap-state-change-password-1.5/+merge/165675

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/9754043/

Affected files:
   A [revision details]
   M state/api/machine.go
   M state/api/params/params.go
   M state/apiserver/machine_test.go
   M state/apiserver/utils.go
   M state/machine.go

Index: [revision details]
=== added file '[revision details]'
--- [revision details] 2012-01-01 00:00:00 +0000
+++ [revision details] 2012-01-01 00:00:00 +0000
@@ -0,0 +1,2 @@
+Old revision: <email address hidden>
+New revision: <email address hidden>

Index: state/machine.go
=== modified file 'state/machine.go'
--- state/machine.go 2013-05-21 16:40:29 +0000
+++ state/machine.go 2013-05-24 21:38:13 +0000
@@ -36,7 +36,7 @@
   JobServeAPI
  )

-var jobNames = []string{
+var jobNames = []params.MachineJob{
   JobHostUnits: "JobHostUnits",
   JobManageEnviron: "JobManageEnviron",
   JobServeAPI: "JobServeAPI",
@@ -47,7 +47,7 @@
   if j <= 0 || j >= len(jobNames) {
    return fmt.Sprintf("<unknown job %d>", j)
   }
- return jobNames[j]
+ return string(jobNames[j])
  }

  // machineDoc represents the internal state of a machine in MongoDB.

Index: state/api/machine.go
=== modified file 'state/api/machine.go'
--- state/api/machine.go 2013-05-24 19:03:39 +0000
+++ state/api/machine.go 2013-05-24 21:38:13 +0000
@@ -139,6 +139,11 @@
   return m.doc.Life
  }

+// Jobs returns the responsibilities that must be fulfilled by m's agent.
+func (m *Machine) Jobs() []params.MachineJob {
+ return m.doc.Jobs
+}
+
  // Series returns the operating system series running on the machine.
  func (m *Machine) Series() string {
   return m.doc.Series

Index: state/apiserver/machine_test.go
=== modified file 'state/apiserver/machine_test.go'
--- state/apiserver/machine_test.go 2013-05-24 19:03:39 +0000
+++ state/apiserver/machine_test.go 2013-05-24 21:38:13 +0000
@@ -212,6 +212,29 @@
   c.Assert(string(life), Equals, "dead")
  }

+func (s *suite) TestMachineJobs(c *C) {
+ stm, err := s.State.AddMachine(
+ "series",
+ state.JobHostUnits,
+ state.JobManageEnviron,
+ state.JobServeAPI,
+ )
+ c.Assert(err, IsNil)
+ setDefaultPassword(c, stm)
+
+ st := s.openAs(c, stm.Tag())
+ defer st.Close()
+
+ m, err := st.Machine(stm.Id())
+ c.Assert(err, IsNil)
+
+ c.Assert(m.Jobs(), DeepEquals, []params.MachineJob{
+ params.JobHostUnits,
+ params.JobManageEnviron,
+ params.JobServeAPI,
+ })
+}
+
  func (s *suite) TestMachineEnsureDead(c *C) {
   stm, err := s.State.AddMachine("series", state.JobHostUnits)
   c.Assert(err, IsNil)

Index: state/apiserver/utils.go
=== modified file 'state/apiserver/utils.go'
--- state/apiserver/utils.go 2013-05-24 19:11:19 +0000
+++ state/apiserver/utils.go 2013-05-24 21:38:13 +0000
@@ -44,10 +44,16 @@
    return nil
   }
   instId, _ := stm.InstanceId()
+ jobs := stm....

[Roger Peppe (rogpeppe)]

Please take a look.

https://codereview.appspot.com/9754043/

[Roger Peppe (rogpeppe)]

Please take a look.

https://codereview.appspot.com/9754043/

[William Reade (fwereade)]

NOT LGTM. Int jobs aren't great, but they're better than baking bad
names into the API forever, I think.

https://codereview.appspot.com/9754043/diff/13001/state/machine.go
File state/machine.go (right):

https://codereview.appspot.com/9754043/diff/13001/state/machine.go#newcode38
state/machine.go:38:
// jobNames MUST NEVER BE CHANGED.

...or maybe we could just use ints, as designed originally, and not
lumber the API with guaranteed-inaccurate names. (JobServeAPI is not
sensible; it conflates jobs with tasks.)

https://codereview.appspot.com/9754043/

[Roger Peppe (rogpeppe)]

Please take a look.

https://codereview.appspot.com/9754043/diff/13001/state/machine.go
File state/machine.go (right):

https://codereview.appspot.com/9754043/diff/13001/state/machine.go#newcode38
state/machine.go:38:
On 2013/05/27 20:23:20, fwereade wrote:
> // jobNames MUST NEVER BE CHANGED.

> ...or maybe we could just use ints, as designed originally, and not
lumber the
> API with guaranteed-inaccurate names. (JobServeAPI is not sensible; it
conflates
> jobs with tasks.)

renamed to JobManageState as agreed in discussion.

https://codereview.appspot.com/9754043/

[William Reade (fwereade)]

LGTM, thanks

https://codereview.appspot.com/9754043/

[Dimiter Naydenov (dimitern)]

Please do not commit this without refactoring it into a facade. We don't
have api/machine.go or apiserver/machine.go anymore.

https://codereview.appspot.com/9754043/

[lp:~rogpeppe/juju-core/312-api-jobs]

1242. By Roger Peppe on 2013-06-18

revert all jobs changes

1243. By Roger Peppe on 2013-06-18

merge 311-juju-bootstrap-state-change-password-1.5

1244. By Roger Peppe on 2013-06-18

merge 321-apiserver-machineagent-api

[William Reade (fwereade)]

superseded by https://code.launchpad.net/~rogpeppe/juju-core/312-alt-api-jobs/+merge/170135

Unmerged revisions

1244. By Roger Peppe on 2013-06-18

merge 321-apiserver-machineagent-api

1243. By Roger Peppe on 2013-06-18

merge 311-juju-bootstrap-state-change-password-1.5

1242. By Roger Peppe on 2013-06-18

revert all jobs changes

1241. By Roger Peppe on 2013-06-07

gofmt

1240. By Roger Peppe on 2013-06-07

all: rename JobServeAPI to JobManageState

1239. By Roger Peppe on 2013-06-07

Merged 311-juju-bootstrap-state-change-password-1.5 into 312-api-jobs.

1238. By Roger Peppe on 2013-05-24

api: implement Machine.Jobs

1237. By Roger Peppe on 2013-05-24

merge trunk

1236. By Roger Peppe on 2013-05-24

cmd/juju: revert bogus change

1235. By Roger Peppe on 2013-05-24

cmd/jujud: change password for machine agent

=== modified file 'cmd/jujud/bootstrap.go'
--- cmd/jujud/bootstrap.go	2013-06-18 12:56:33 +0000
+++ cmd/jujud/bootstrap.go	2013-06-18 12:56:33 +0000
@@ -114,7 +114,7 @@
 	// Upgrader, and it's a capability we'll always want to have
 	// available for the aforementioned use case.
 	jobs := []state.MachineJob{
-		state.JobManageEnviron, state.JobServeAPI, state.JobHostUnits,
+		state.JobManageEnviron, state.JobManageState, state.JobHostUnits,
 	}
 	m, err := st.InjectMachine(version.Current.Series, c.Constraints, instanceId, jobs...)
 	if err != nil {

=== modified file 'cmd/jujud/bootstrap_test.go'
--- cmd/jujud/bootstrap_test.go	2013-06-18 12:56:33 +0000
+++ cmd/jujud/bootstrap_test.go	2013-06-18 12:56:33 +0000
@@ -166,7 +166,7 @@
 	m, err := st.Machine("0")
 	c.Assert(err, IsNil)
 	c.Assert(m.Jobs(), DeepEquals, []state.MachineJob{
-		state.JobManageEnviron, state.JobServeAPI, state.JobHostUnits,
+		state.JobManageEnviron, state.JobManageState, state.JobHostUnits,
 	})
 }
 

=== modified file 'cmd/jujud/machine.go'
--- cmd/jujud/machine.go	2013-06-11 13:52:19 +0000
+++ cmd/jujud/machine.go	2013-06-18 12:56:33 +0000
@@ -122,7 +122,7 @@
 			tasks = append(tasks,
 				provisioner.NewProvisioner(st, a.MachineId),
 				firewaller.NewFirewaller(st))
-		case state.JobServeAPI:
+		case state.JobManageState:
 			// Ignore because it's started independently.
 			continue
 		default:
@@ -173,7 +173,7 @@
 	m := entity.(*state.Machine)
 	runAPI := false
 	for _, job := range m.Jobs() {
-		if job == state.JobServeAPI {
+		if job == state.JobManageState {
 			runAPI = true
 			break
 		}

=== modified file 'cmd/jujud/machine_test.go'
--- cmd/jujud/machine_test.go	2013-06-18 12:56:33 +0000
+++ cmd/jujud/machine_test.go	2013-06-18 12:56:33 +0000
@@ -110,7 +110,7 @@
 }
 
 func (s *MachineSuite) TestWithDeadMachine(c *C) {
-	m, _, _ := s.primeAgent(c, state.JobHostUnits, state.JobServeAPI)
+	m, _, _ := s.primeAgent(c, state.JobHostUnits, state.JobManageState)
 	err := m.EnsureDead()
 	c.Assert(err, IsNil)
 	a := s.newAgent(c, m)
@@ -248,7 +248,7 @@
 }
 
 func (s *MachineSuite) TestUpgrade(c *C) {
-	m, conf, currentTools := s.primeAgent(c, state.JobServeAPI, state.JobManageEnviron, state.JobHostUnits)
+	m, conf, currentTools := s.primeAgent(c, state.JobManageState, state.JobManageEnviron, state.JobHostUnits)
 	addAPIInfo(conf, m)
 	err := conf.Write()
 	c.Assert(err, IsNil)
@@ -270,7 +270,7 @@
 }
 
 func (s *MachineSuite) TestServeAPI(c *C) {
-	stm, conf, _ := s.primeAgent(c, state.JobServeAPI)
+	stm, conf, _ := s.primeAgent(c, state.JobManageState)
 	addAPIInfo(conf, stm)
 	err := conf.Write()
 	c.Assert(err, IsNil)
@@ -320,7 +320,7 @@
 }}
 
 func (s *MachineSuite) TestServeAPIWithBadConf(c *C) {
-	m, conf, _ := s.primeAgent(c, state.JobServeAPI)
+	m, conf, _ := s.primeAgent(c, state.JobManageState)
 	addAPIInfo(conf, m)
 	for i, t := range serveAPIWithBadConfTests {
 		c.Logf("test %d: %q", i, t.err)

=== modified file 'environs/config/config_test.go'
--- environs/config/config_test.go	2013-06-18 12:56:33 +0000
+++ environs/config/config_test.go	2013-06-10 10:30:13 +0000
@@ -130,7 +130,7 @@
 			"name":    "my-name",
 			"ca-cert": invalidCACert,
 		},
-		err: `bad CA certificate/key in configuration: (asn1:|ASN\.1) syntax error:.*`,
+		err: "bad CA certificate/key in configuration: ASN.1 syntax error:.*",
 	}, {
 		about: "Invalid CA key",
 		attrs: attrs{

=== modified file 'environs/dummy/environs.go'
--- environs/dummy/environs.go	2013-06-18 12:56:33 +0000
+++ environs/dummy/environs.go	2013-06-18 12:56:33 +0000
@@ -456,9 +456,6 @@
 		return fmt.Errorf("environment is already bootstrapped")
 	}
 	if e.ecfg().stateServer() {
-		// TODO(rog) factor out relevant code from cmd/jujud/bootstrap.go
-		// so that we can call it here.
-
 		info := stateInfo()
 		st, err := state.Initialize(info, cfg, state.DefaultDialOpts())
 		if err != nil {

=== modified file 'juju/testing/repo.go'
--- juju/testing/repo.go	2013-05-09 21:51:05 +0000
+++ juju/testing/repo.go	2013-06-18 12:56:33 +0000
@@ -52,7 +52,6 @@
 	c.Assert(ch.URL(), DeepEquals, expectCurl)
 	s.AssertCharmUploaded(c, expectCurl)
 	units, err := svc.AllUnits()
-	c.Logf("Service units: %+v", units)
 	c.Assert(err, IsNil)
 	c.Assert(units, HasLen, unitCount)
 	s.AssertUnitMachines(c, units)

=== renamed file 'state/api/client.go' => 'state/api/apiclient.go'
=== renamed file 'state/api/apiclient.go' => 'state/api/client.go'
=== renamed file 'state/api/apierror.go' => 'state/api/error.go'
=== modified file 'state/api/params/params.go'
--- state/api/params/params.go	2013-06-18 12:56:33 +0000
+++ state/api/params/params.go	2013-06-18 12:56:33 +0000
@@ -28,6 +28,12 @@
 	return e.Message
 }
 
+// GoString implements fmt.GoStringer.  It means that a *Error shows its
+// contents correctly when printed with %#v.
+func (e Error) GoString() string {
+	return fmt.Sprintf("&params.Error{%q, %q}", e.Code, e.Message)
+}
+
 // ErrorResults holds the results of calling a bulk operation which
 // mutates multiple entites, like Machiner.SetStatus. The order and
 // number of elements matches the entities specified in the request.
@@ -87,6 +93,30 @@
 	Machines []MachineLifeResult
 }
 
+// MachineAgentGetMachinesResults holds the results of a
+// machineagent.API.GetMachines call.
+type MachineAgentGetMachinesResults struct {
+	Machines []MachineAgentGetMachinesResult
+}
+
+// MachineJob values define responsibilities that machines may be
+// expected to fulfil.
+type MachineJob string
+
+const (
+	JobHostUnits     MachineJob = "JobHostUnits"
+	JobManageEnviron MachineJob = "JobManageEnviron"
+	JobManageState   MachineJob = "JobManageState"
+)
+
+// MachineAgentGetMachinesResult holds the results of a
+// machineagent.API.GetMachines call for a single machine.
+type MachineAgentGetMachinesResult struct {
+	Life  Life
+	Jobs  []MachineJob
+	Error *Error
+}
+
 // ServiceDeploy holds the parameters for making the ServiceDeploy call.
 type ServiceDeploy struct {
 	ServiceName    string

=== removed file 'state/apiserver/admin.go'
--- state/apiserver/admin.go	2013-05-24 19:03:39 +0000
+++ state/apiserver/admin.go	1970-01-01 00:00:00 +0000
@@ -1,20 +0,0 @@
-// Copyright 2013 Canonical Ltd.
-// Licensed under the AGPLv3, see LICENCE file for details.
-
-package apiserver
-
-import "launchpad.net/juju-core/state/api/params"
-
-// srvAdmin is the only object that unlogged-in
-// clients can access. It holds any methods
-// that are needed to log in.
-type srvAdmin struct {
-	root *srvRoot
-}
-
-// Login logs in with the provided credentials.
-// All subsequent requests on the connection will
-// act as the authenticated user.
-func (a *srvAdmin) Login(c params.Creds) error {
-	return a.root.user.login(a.root.srv.state, c.AuthTag, c.Password)
-}

=== added file 'state/apiserver/apiserver.go'
--- state/apiserver/apiserver.go	1970-01-01 00:00:00 +0000
+++ state/apiserver/apiserver.go	2013-06-18 12:56:33 +0000
@@ -0,0 +1,750 @@
+// Copyright 2013 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package apiserver
+
+import (
+	"fmt"
+	"launchpad.net/juju-core/charm"
+	"launchpad.net/juju-core/juju"
+	"launchpad.net/juju-core/log"
+	"launchpad.net/juju-core/state"
+	"launchpad.net/juju-core/state/api"
+	"launchpad.net/juju-core/state/api/params"
+	"launchpad.net/juju-core/state/multiwatcher"
+	"launchpad.net/juju-core/state/presence"
+	"launchpad.net/juju-core/state/statecmd"
+	statewatcher "launchpad.net/juju-core/state/watcher"
+	"strconv"
+	"sync"
+)
+
+// srvRoot represents a single client's connection to the state.
+type srvRoot struct {
+	admin     *srvAdmin
+	client    *srvClient
+	srv       *Server
+	resources *resources
+
+	user authUser
+}
+
+// srvAdmin is the only object that unlogged-in
+// clients can access. It holds any methods
+// that are needed to log in.
+type srvAdmin struct {
+	root *srvRoot
+}
+
+// srvMachine serves API methods on a machine.
+type srvMachine struct {
+	root *srvRoot
+	m    *state.Machine
+}
+
+// srvUnit serves API methods on a unit.
+type srvUnit struct {
+	root *srvRoot
+	u    *state.Unit
+}
+
+// srvUser serves API methods on a state User.
+type srvUser struct {
+	root *srvRoot
+	u    *state.User
+}
+
+// srvClient serves client-specific API methods.
+type srvClient struct {
+	root *srvRoot
+}
+
+func newStateServer(srv *Server) *srvRoot {
+	r := &srvRoot{
+		srv:       srv,
+		resources: newResources(),
+	}
+	r.admin = &srvAdmin{
+		root: r,
+	}
+	r.client = &srvClient{
+		root: r,
+	}
+	return r
+}
+
+// Kill implements rpc.Killer.  It cleans up any resources that need
+// cleaning up to ensure that all outstanding requests return.
+func (r *srvRoot) Kill() {
+	r.resources.stopAll()
+}
+
+// Admin returns an object that provides API access
+// to methods that can be called even when not
+// authenticated.
+func (r *srvRoot) Admin(id string) (*srvAdmin, error) {
+	if id != "" {
+		// Safeguard id for possible future use.
+		return nil, errBadId
+	}
+	return r.admin, nil
+}
+
+// requireAgent checks whether the current client is an agent and hence
+// may access the agent APIs.  We filter out non-agents when calling one
+// of the accessor functions (Machine, Unit, etc) which avoids us making
+// the check in every single request method.
+func (r *srvRoot) requireAgent() error {
+	e := r.user.authenticator()
+	if e == nil {
+		return errNotLoggedIn
+	}
+	if !isAgent(e) {
+		return errPerm
+	}
+	return nil
+}
+
+// requireClient returns an error unless the current
+// client is a juju client user.
+func (r *srvRoot) requireClient() error {
+	e := r.user.authenticator()
+	if e == nil {
+		return errNotLoggedIn
+	}
+	if isAgent(e) {
+		return errPerm
+	}
+	return nil
+}
+
+// Machine returns an object that provides
+// API access to methods on a state.Machine.
+func (r *srvRoot) Machine(id string) (*srvMachine, error) {
+	if err := r.requireAgent(); err != nil {
+		return nil, err
+	}
+	m, err := r.srv.state.Machine(id)
+	if err != nil {
+		return nil, err
+	}
+	return &srvMachine{
+		root: r,
+		m:    m,
+	}, nil
+}
+
+// Unit returns an object that provides
+// API access to methods on a state.Unit.
+func (r *srvRoot) Unit(name string) (*srvUnit, error) {
+	if err := r.requireAgent(); err != nil {
+		return nil, err
+	}
+	u, err := r.srv.state.Unit(name)
+	if err != nil {
+		return nil, err
+	}
+	return &srvUnit{
+		root: r,
+		u:    u,
+	}, nil
+}
+
+// User returns an object that provides
+// API access to methods on a state.User.
+func (r *srvRoot) User(name string) (*srvUser, error) {
+	// Any user is allowed to access their own user object.
+	// We check at this level rather than at the operation
+	// level to stop malicious probing for current user names.
+	// When we provide support for user administration,
+	// this will need to be changed to allow access to
+	// the administrator.
+	e := r.user.authenticator()
+	if e == nil {
+		return nil, errNotLoggedIn
+	}
+	if e.Tag() != name {
+		return nil, errPerm
+	}
+	u, err := r.srv.state.User(name)
+	if err != nil {
+		return nil, err
+	}
+	return &srvUser{
+		root: r,
+		u:    u,
+	}, nil
+}
+
+// Pinger returns an object that provides API access to methods on a
+// presence.Pinger. Each client has its own current set of pingers,
+// stored in r.resources.
+func (r *srvRoot) Pinger(id string) (*srvResource, error) {
+	if err := r.requireAgent(); err != nil {
+		return nil, err
+	}
+	pinger := r.resources.get(id)
+	if pinger == nil {
+		return nil, errUnknownPinger
+	}
+	if _, ok := pinger.resource.(*presence.Pinger); !ok {
+		return nil, errUnknownPinger
+	}
+	return pinger, nil
+}
+
+// EntityWatcher returns an object that provides
+// API access to methods on a state.EntityWatcher.
+// Each client has its own current set of watchers, stored
+// in r.resources.
+func (r *srvRoot) EntityWatcher(id string) (srvEntityWatcher, error) {
+	if err := r.requireAgent(); err != nil {
+		return srvEntityWatcher{}, err
+	}
+	watcher := r.resources.get(id)
+	if watcher == nil {
+		return srvEntityWatcher{}, errUnknownWatcher
+	}
+	if _, ok := watcher.resource.(*state.EntityWatcher); !ok {
+		return srvEntityWatcher{}, errUnknownWatcher
+	}
+	return srvEntityWatcher{watcher}, nil
+}
+
+// AllWatcher returns an object that provides API access to methods on
+// a state/multiwatcher.Watcher, which watches any changes to the
+// state. Each client has its own current set of watchers, stored in
+// r.resources.
+func (r *srvRoot) AllWatcher(id string) (srvClientAllWatcher, error) {
+	if err := r.requireClient(); err != nil {
+		return srvClientAllWatcher{}, err
+	}
+	watcher := r.resources.get(id)
+	if watcher == nil {
+		return srvClientAllWatcher{}, errUnknownWatcher
+	}
+	if _, ok := watcher.resource.(*multiwatcher.Watcher); !ok {
+		return srvClientAllWatcher{}, errUnknownWatcher
+	}
+	return srvClientAllWatcher{watcher}, nil
+
+}
+
+// Client returns an object that provides access
+// to methods accessible to non-agent clients.
+func (r *srvRoot) Client(id string) (*srvClient, error) {
+	if err := r.requireClient(); err != nil {
+		return nil, err
+	}
+	if id != "" {
+		// Safeguard id for possible future use.
+		return nil, errBadId
+	}
+	return r.client, nil
+}
+
+type tagger interface {
+	Tag() string
+}
+
+// authOwner returns whether the authenticated user's tag matches the
+// given entity's tag.
+func (r *srvRoot) authOwner(entity tagger) bool {
+	authUser := r.user.authenticator()
+	return authUser.Tag() == entity.Tag()
+}
+
+// authEnvironManager returns whether the authenticated user is a
+// machine with running the ManageEnviron job.
+func (r *srvRoot) authEnvironManager() bool {
+	authUser := r.user.authenticator()
+	return isMachineWithJob(authUser, state.JobManageEnviron)
+}
+
+type srvEntityWatcher struct {
+	*srvResource
+}
+
+// Next returns when a change has occurred to the
+// entity being watched since the most recent call to Next
+// or the Watch call that created the EntityWatcher.
+func (w srvEntityWatcher) Next() error {
+	watcher := w.resource.(*state.EntityWatcher)
+	if _, ok := <-watcher.Changes(); ok {
+		return nil
+	}
+	err := watcher.Err()
+	if err == nil {
+		err = errStoppedWatcher
+	}
+	return err
+}
+
+func (c *srvClient) Status() (api.Status, error) {
+	ms, err := c.root.srv.state.AllMachines()
+	if err != nil {
+		return api.Status{}, err
+	}
+	status := api.Status{
+		Machines: make(map[string]api.MachineInfo),
+	}
+	for _, m := range ms {
+		instId, _ := m.InstanceId()
+		status.Machines[m.Id()] = api.MachineInfo{
+			InstanceId: string(instId),
+		}
+	}
+	return status, nil
+}
+
+func (c *srvClient) WatchAll() (params.AllWatcherId, error) {
+	w := c.root.srv.state.Watch()
+	return params.AllWatcherId{
+		AllWatcherId: c.root.resources.register(w).id,
+	}, nil
+}
+
+type srvClientAllWatcher struct {
+	*srvResource
+}
+
+func (aw srvClientAllWatcher) Next() (params.AllWatcherNextResults, error) {
+	deltas, err := aw.resource.(*multiwatcher.Watcher).Next()
+	return params.AllWatcherNextResults{
+		Deltas: deltas,
+	}, err
+}
+
+func (aw srvClientAllWatcher) Stop() error {
+	return aw.resource.(*multiwatcher.Watcher).Stop()
+}
+
+// ServiceSet implements the server side of Client.ServerSet.
+func (c *srvClient) ServiceSet(p params.ServiceSet) error {
+	svc, err := c.root.srv.state.Service(p.ServiceName)
+	if err != nil {
+		return err
+	}
+	return svc.SetConfig(p.Options)
+}
+
+// ServiceSetYAML implements the server side of Client.ServerSetYAML.
+func (c *srvClient) ServiceSetYAML(p params.ServiceSetYAML) error {
+	svc, err := c.root.srv.state.Service(p.ServiceName)
+	if err != nil {
+		return err
+	}
+	return svc.SetConfigYAML([]byte(p.Config))
+}
+
+// ServiceGet returns the configuration for a service.
+func (c *srvClient) ServiceGet(args params.ServiceGet) (params.ServiceGetResults, error) {
+	return statecmd.ServiceGet(c.root.srv.state, args)
+}
+
+// Resolved implements the server side of Client.Resolved.
+func (c *srvClient) Resolved(p params.Resolved) error {
+	unit, err := c.root.srv.state.Unit(p.UnitName)
+	if err != nil {
+		return err
+	}
+	return unit.Resolve(p.Retry)
+}
+
+// ServiceExpose changes the juju-managed firewall to expose any ports that
+// were also explicitly marked by units as open.
+func (c *srvClient) ServiceExpose(args params.ServiceExpose) error {
+	return statecmd.ServiceExpose(c.root.srv.state, args)
+}
+
+// ServiceUnexpose changes the juju-managed firewall to unexpose any ports that
+// were also explicitly marked by units as open.
+func (c *srvClient) ServiceUnexpose(args params.ServiceUnexpose) error {
+	return statecmd.ServiceUnexpose(c.root.srv.state, args)
+}
+
+var CharmStore charm.Repository = charm.Store
+
+// ServiceDeploy fetches the charm from the charm store and deploys it.  Local
+// charms are not supported.
+func (c *srvClient) ServiceDeploy(args params.ServiceDeploy) error {
+	state := c.root.srv.state
+	conf, err := state.EnvironConfig()
+	if err != nil {
+		return err
+	}
+	curl, err := charm.InferURL(args.CharmUrl, conf.DefaultSeries())
+	if err != nil {
+		return err
+	}
+	conn, err := juju.NewConnFromState(state)
+	if err != nil {
+		return err
+	}
+	if args.NumUnits == 0 {
+		args.NumUnits = 1
+	}
+	charm, err := conn.PutCharm(curl, CharmStore, false)
+	if err != nil {
+		return err
+	}
+	serviceName := args.ServiceName
+	if serviceName == "" {
+		serviceName = curl.Name
+	}
+	deployArgs := juju.DeployServiceParams{
+		Charm:       charm,
+		ServiceName: serviceName,
+		NumUnits:    args.NumUnits,
+		// BUG(lp:1162122): Config/ConfigYAML have no tests.
+		Config:      args.Config,
+		ConfigYAML:  args.ConfigYAML,
+		Constraints: args.Constraints,
+	}
+	_, err = conn.DeployService(deployArgs)
+	return err
+}
+
+// AddServiceUnits adds a given number of units to a service.
+func (c *srvClient) AddServiceUnits(args params.AddServiceUnits) (params.AddServiceUnitsResults, error) {
+	units, err := statecmd.AddServiceUnits(c.root.srv.state, args)
+	if err != nil {
+		return params.AddServiceUnitsResults{}, err
+	}
+	unitNames := make([]string, len(units))
+	for i, unit := range units {
+		unitNames[i] = unit.String()
+	}
+	return params.AddServiceUnitsResults{Units: unitNames}, nil
+}
+
+// DestroyServiceUnits removes a given set of service units.
+func (c *srvClient) DestroyServiceUnits(args params.DestroyServiceUnits) error {
+	return statecmd.DestroyServiceUnits(c.root.srv.state, args)
+}
+
+// ServiceDestroy destroys a given service.
+func (c *srvClient) ServiceDestroy(args params.ServiceDestroy) error {
+	return statecmd.ServiceDestroy(c.root.srv.state, args)
+}
+
+// GetServiceConstraints returns the constraints for a given service.
+func (c *srvClient) GetServiceConstraints(args params.GetServiceConstraints) (params.GetServiceConstraintsResults, error) {
+	return statecmd.GetServiceConstraints(c.root.srv.state, args)
+}
+
+// SetServiceConstraints sets the constraints for a given service.
+func (c *srvClient) SetServiceConstraints(args params.SetServiceConstraints) error {
+	return statecmd.SetServiceConstraints(c.root.srv.state, args)
+}
+
+// AddRelation adds a relation between the specified endpoints and returns the relation info.
+func (c *srvClient) AddRelation(args params.AddRelation) (params.AddRelationResults, error) {
+	return statecmd.AddRelation(c.root.srv.state, args)
+}
+
+// DestroyRelation removes the relation between the specified endpoints.
+func (c *srvClient) DestroyRelation(args params.DestroyRelation) error {
+	return statecmd.DestroyRelation(c.root.srv.state, args)
+}
+
+// CharmInfo returns information about the requested charm.
+func (c *srvClient) CharmInfo(args params.CharmInfo) (api.CharmInfo, error) {
+	curl, err := charm.ParseURL(args.CharmURL)
+	if err != nil {
+		return api.CharmInfo{}, err
+	}
+	charm, err := c.root.srv.state.Charm(curl)
+	if err != nil {
+		return api.CharmInfo{}, err
+	}
+	info := api.CharmInfo{
+		Revision: charm.Revision(),
+		URL:      curl.String(),
+		Config:   charm.Config(),
+		Meta:     charm.Meta(),
+	}
+	return info, nil
+}
+
+// EnvironmentInfo returns information about the current environment (default
+// series and type).
+func (c *srvClient) EnvironmentInfo() (api.EnvironmentInfo, error) {
+	conf, err := c.root.srv.state.EnvironConfig()
+	if err != nil {
+		return api.EnvironmentInfo{}, err
+	}
+	info := api.EnvironmentInfo{
+		DefaultSeries: conf.DefaultSeries(),
+		ProviderType:  conf.Type(),
+		Name:          conf.Name(),
+	}
+	return info, nil
+}
+
+// GetAnnotations returns annotations about a given entity.
+func (c *srvClient) GetAnnotations(args params.GetAnnotations) (params.GetAnnotationsResults, error) {
+	entity, err := c.root.srv.state.Annotator(args.Tag)
+	if err != nil {
+		return params.GetAnnotationsResults{}, err
+	}
+	ann, err := entity.Annotations()
+	if err != nil {
+		return params.GetAnnotationsResults{}, err
+	}
+	return params.GetAnnotationsResults{Annotations: ann}, nil
+}
+
+// SetAnnotations stores annotations about a given entity.
+func (c *srvClient) SetAnnotations(args params.SetAnnotations) error {
+	entity, err := c.root.srv.state.Annotator(args.Tag)
+	if err != nil {
+		return err
+	}
+	return entity.SetAnnotations(args.Pairs)
+}
+
+// Login logs in with the provided credentials.
+// All subsequent requests on the connection will
+// act as the authenticated user.
+func (a *srvAdmin) Login(c params.Creds) error {
+	return a.root.user.login(a.root.srv.state, c.AuthTag, c.Password)
+}
+
+// Get retrieves all the details of a machine.
+func (m *srvMachine) Get() (info params.Machine) {
+	instId, _ := m.m.InstanceId()
+	info.InstanceId = string(instId)
+	info.Life = params.Life(m.m.Life().String())
+	return
+}
+
+func (m *srvMachine) Watch() (params.EntityWatcherId, error) {
+	w := m.m.Watch()
+	if _, ok := <-w.Changes(); !ok {
+		return params.EntityWatcherId{}, statewatcher.MustErr(w)
+	}
+	return params.EntityWatcherId{
+		EntityWatcherId: m.root.resources.register(w).id,
+	}, nil
+}
+
+// SetAgentAlive signals that the agent for machine m is alive.
+func (m *srvMachine) SetAgentAlive() (params.PingerId, error) {
+	if !m.root.authOwner(m.m) {
+		return params.PingerId{}, errPerm
+	}
+	pinger, err := m.m.SetAgentAlive()
+	if err != nil {
+		return params.PingerId{}, err
+	}
+	return params.PingerId{
+		PingerId: m.root.resources.register(pinger).id,
+	}, nil
+}
+
+// EnsureDead sets the machine lifecycle to Dead if it is Alive or Dying.
+// It does nothing otherwise. See machine.EnsureDead().
+func (m *srvMachine) EnsureDead() error {
+	if !m.root.authOwner(m.m) {
+		return errPerm
+	}
+	return m.m.EnsureDead()
+}
+
+// SetStatus sets the status of the machine.
+func (m *srvMachine) SetStatus(status params.SetStatus) error {
+	if !m.root.authOwner(m.m) && !m.root.authEnvironManager() {
+		return errPerm
+	}
+	return m.m.SetStatus(status.Status, status.Info)
+}
+
+func setPassword(e state.TaggedAuthenticator, password string) error {
+	// Catch expected common case of mispelled
+	// or missing Password parameter.
+	if password == "" {
+		return fmt.Errorf("password is empty")
+	}
+	return e.SetPassword(password)
+}
+
+// SetPassword sets the machine's password.
+func (m *srvMachine) SetPassword(p params.Password) error {
+	if !m.root.authOwner(m.m) && !m.root.authEnvironManager() {
+		return errPerm
+	}
+	if err := setPassword(m.m, p.Password); err != nil {
+		return err
+	}
+	// Grant access to the mongo state if the machine requires it.
+	if isMachineWithJob(m.m, state.JobManageEnviron) ||
+		isMachineWithJob(m.m, state.JobServeAPI) {
+		return m.m.SetMongoPassword(p.Password)
+	}
+	return nil
+}
+
+// Get retrieves all the details of a unit.
+func (u *srvUnit) Get() (params.Unit, error) {
+	var ru params.Unit
+	ru.DeployerTag, _ = u.u.DeployerTag()
+	// TODO add other unit attributes
+	return ru, nil
+}
+
+// SetPassword sets the unit's password.
+func (u *srvUnit) SetPassword(p params.Password) error {
+	tag := u.root.user.authenticator().Tag()
+	// Allow:
+	// - the unit itself.
+	// - the machine responsible for unit, if unit is principal
+	// - the unit's principal unit, if unit is subordinate
+	allow := tag == u.u.Tag()
+	if !allow {
+		deployerTag, ok := u.u.DeployerTag()
+		allow = ok && tag == deployerTag
+	}
+	if !allow {
+		return errPerm
+	}
+	return setPassword(u.u, p.Password)
+}
+
+// SetPassword sets the user's password.
+func (u *srvUser) SetPassword(p params.Password) error {
+	return setPassword(u.u, p.Password)
+}
+
+// Get retrieves all details of a user.
+func (u *srvUser) Get() (params.User, error) {
+	return params.User{}, nil
+}
+
+// authUser holds login details. It's ok to call
+// its methods concurrently.
+type authUser struct {
+	mu     sync.Mutex
+	entity state.TaggedAuthenticator // logged-in entity (access only when mu is locked)
+}
+
+// login authenticates as entity with the given name,.
+func (u *authUser) login(st *state.State, tag, password string) error {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	entity, err := st.Authenticator(tag)
+	if err != nil && !state.IsNotFound(err) {
+		return err
+	}
+	// We return the same error when an entity
+	// does not exist as for a bad password, so that
+	// we don't allow unauthenticated users to find information
+	// about existing entities.
+	if err != nil || !entity.PasswordValid(password) {
+		return errBadCreds
+	}
+	u.entity = entity
+	return nil
+}
+
+// authenticator returns the currently logged-in authenticator entity, or nil
+// if not currently logged on.  The returned entity should not be modified
+// because it may be used concurrently.
+func (u *authUser) authenticator() state.TaggedAuthenticator {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return u.entity
+}
+
+// isMachineWithJob returns whether the given entity is a machine that
+// is configured to run the given job.
+func isMachineWithJob(e state.TaggedAuthenticator, j state.MachineJob) bool {
+	m, ok := e.(*state.Machine)
+	if !ok {
+		return false
+	}
+	for _, mj := range m.Jobs() {
+		if mj == j {
+			return true
+		}
+	}
+	return false
+}
+
+// isAgent returns whether the given entity is an agent.
+func isAgent(e state.TaggedAuthenticator) bool {
+	_, isUser := e.(*state.User)
+	return !isUser
+}
+
+// resource represents the interface provided by state watchers and pingers.
+type resource interface {
+	Stop() error
+}
+
+// resources holds all the resources for a connection.
+type resources struct {
+	mu    sync.Mutex
+	maxId uint64
+	rs    map[string]*srvResource
+}
+
+// srvResource holds the details of a resource. It also implements the
+// Stop RPC method for all resources.
+type srvResource struct {
+	rs       *resources
+	resource resource
+	id       string
+}
+
+// Stop stops the given resource. It causes any outstanding
+// Next calls to return a CodeStopped error.
+// Any subsequent Next calls will return a CodeNotFound
+// error because the resource will no longer exist.
+func (r *srvResource) Stop() error {
+	err := r.resource.Stop()
+	r.rs.mu.Lock()
+	defer r.rs.mu.Unlock()
+	delete(r.rs.rs, r.id)
+	return err
+}
+
+func newResources() *resources {
+	return &resources{
+		rs: make(map[string]*srvResource),
+	}
+}
+
+// get returns the srvResource registered with the given
+// id, or nil if there is no such resource.
+func (rs *resources) get(id string) *srvResource {
+	rs.mu.Lock()
+	defer rs.mu.Unlock()
+	return rs.rs[id]
+}
+
+// register records the given watcher and returns
+// a srvResource instance for it.
+func (rs *resources) register(r resource) *srvResource {
+	rs.mu.Lock()
+	defer rs.mu.Unlock()
+	rs.maxId++
+	sr := &srvResource{
+		rs:       rs,
+		id:       strconv.FormatUint(rs.maxId, 10),
+		resource: r,
+	}
+	rs.rs[sr.id] = sr
+	return sr
+}
+
+func (rs *resources) stopAll() {
+	rs.mu.Lock()
+	defer rs.mu.Unlock()
+	for _, r := range rs.rs {
+		if err := r.resource.Stop(); err != nil {
+			log.Errorf("state/api: error stopping %T resource: %v", r, err)
+		}
+	}
+	rs.rs = make(map[string]*srvResource)
+}

=== added file 'state/apiserver/apiserver.test'
Binary files state/apiserver/apiserver.test	1970-01-01 00:00:00 +0000 and state/apiserver/apiserver.test	2013-06-18 12:56:33 +0000 differ
=== modified file 'state/apiserver/common/interfaces.go'
--- state/apiserver/common/interfaces.go	2013-06-06 17:09:49 +0000
+++ state/apiserver/common/interfaces.go	2013-06-18 12:56:33 +0000
@@ -25,7 +25,7 @@
 
 	// AuthOwner returns whether the authenticated entity is the same
 	// as the given entity.
-	AuthOwner(entity Tagger) bool
+	AuthOwner(tag string) bool
 
 	// AuthEnvironManager returns whether the authenticated entity is
 	// a machine running the environment manager job.

=== modified file 'state/apiserver/login_test.go'
--- state/apiserver/login_test.go	2013-06-06 17:55:14 +0000
+++ state/apiserver/login_test.go	2013-06-18 12:56:33 +0000
@@ -61,6 +61,10 @@
 	}
 	for i, t := range badLoginTests {
 		c.Logf("test %d; entity %q; password %q", i, t.tag, t.password)
+		// Note that Open does not log in if the tag and password
+		// are empty. This allows us to test operations on the connection
+		// before calling Login, which we could not do if Open
+		// always logged in.
 		info.Tag = ""
 		info.Password = ""
 		func() {
@@ -72,9 +76,6 @@
 			c.Assert(err, ErrorMatches, "not logged in")
 			c.Assert(api.ErrCode(err), Equals, api.CodeUnauthorized, Commentf("error %#v", err))
 
-			// TODO (dimitern) This a really awkward way of testing -
-			// calling Login again here to reauth on the same
-			// connection. Seems wrong.
 			err = st.Login(t.tag, t.password)
 			c.Assert(err, ErrorMatches, t.err)
 			c.Assert(api.ErrCode(err), Equals, t.code)

=== renamed directory 'state/apiserver/machiner' => 'state/apiserver/machine'
=== added file 'state/apiserver/machine/agent.go'
--- state/apiserver/machine/agent.go	1970-01-01 00:00:00 +0000
+++ state/apiserver/machine/agent.go	2013-06-18 12:56:33 +0000
@@ -0,0 +1,69 @@
+// Copyright 2013 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+// The machine package implements the API interfaces
+// used by the machine agent.
+package machine
+
+import (
+	"launchpad.net/juju-core/state"
+	"launchpad.net/juju-core/state/api/params"
+	"launchpad.net/juju-core/state/apiserver/common"
+)
+
+type AgentAPI struct {
+	st   *state.State
+	auth common.Authorizer
+}
+
+// NewAgentAPI returns an object implementing the machine agent API
+// for the given 
+func NewAgentAPI(st *state.State, auth common.Authorizer) (*AgentAPI, error) {
+	if !auth.IsLoggedIn() {
+		return nil, common.ErrNotLoggedIn
+	}
+	if !auth.AuthMachineAgent() {
+		return nil, common.ErrPerm
+	}
+	return &AgentAPI{
+		st:   st,
+		auth: auth,
+	}, nil
+}
+
+func (api *AgentAPI) GetMachines(args params.Machines) (params.MachineAgentGetMachinesResults, error) {
+	results := params.MachineAgentGetMachinesResults{
+		Machines: make([]params.MachineAgentGetMachinesResult, len(args.Ids)),
+	}
+	for i, id := range args.Ids {
+		result, err := api.getMachine(id)
+		result.Error = common.ServerError(err)
+		results.Machines[i] = result
+	}
+	return results, nil
+}
+
+func (api *AgentAPI) getMachine(id string) (result params.MachineAgentGetMachinesResult, err error) {
+	// Allow only for the owner agent.
+	// Note: having a bulk API call for this is utter madness, given that
+	// this check means we can only ever return a single object.
+	if !api.auth.AuthOwner(state.MachineTag(id)) {
+		err = common.ErrPerm
+		return
+	}
+	machine, err := api.st.Machine(id)
+	if err != nil {
+		return
+	}
+	result.Life = params.Life(machine.Life().String())
+	result.Jobs = stateJobsToAPIParamsJobs(machine.Jobs())
+	return
+}
+
+func stateJobsToAPIParamsJobs(jobs []state.MachineJob) []params.MachineJob {
+	pjobs := make([]params.MachineJob, len(jobs))
+	for i, job := range jobs {
+		pjobs[i] = params.MachineJob(job.String())
+	}
+	return pjobs
+}

=== added file 'state/apiserver/machine/agent_test.go'
--- state/apiserver/machine/agent_test.go	1970-01-01 00:00:00 +0000
+++ state/apiserver/machine/agent_test.go	2013-06-18 12:56:33 +0000
@@ -0,0 +1,91 @@
+package machine_test
+
+import (
+	. "launchpad.net/gocheck"
+	"launchpad.net/juju-core/state/api"
+	"launchpad.net/juju-core/state/api/params"
+	"launchpad.net/juju-core/state/apiserver/machine"
+)
+
+type agentSuite struct {
+	commonSuite
+	agent *machine.AgentAPI
+}
+
+var _ = Suite(&agentSuite{})
+
+func (s *agentSuite) SetUpTest(c *C) {
+	s.commonSuite.SetUpTest(c)
+
+	// Create a machiner API for machine 1.
+	api, err := machine.NewAgentAPI(
+		s.State,
+		s.authorizer,
+	)
+	c.Assert(err, IsNil)
+	s.agent = api
+}
+
+func (s *agentSuite) TestAgentFailsWithNonMachineAgentUser(c *C) {
+	auth := s.authorizer
+	auth.machineAgent = false
+	api, err := machine.NewAgentAPI(s.State, auth)
+	c.Assert(err, NotNil)
+	c.Assert(api, IsNil)
+	c.Assert(err, ErrorMatches, "permission denied")
+}
+
+func (s *agentSuite) TestAgentFailsWhenNotLoggedIn(c *C) {
+	auth := s.authorizer
+	auth.loggedIn = false
+	api, err := machine.NewAgentAPI(s.State, auth)
+	c.Assert(err, NotNil)
+	c.Assert(api, IsNil)
+	c.Assert(err, ErrorMatches, "not logged in")
+}
+
+func (s *agentSuite) TestGetMachines(c *C) {
+	err := s.machine1.Destroy()
+	c.Assert(err, IsNil)
+	results, err := s.agent.GetMachines(params.Machines{
+		Ids: []string{"1", "0", "42"},
+	})
+	c.Assert(err, IsNil)
+	c.Assert(results, DeepEquals, params.MachineAgentGetMachinesResults{
+		Machines: []params.MachineAgentGetMachinesResult{{
+			Life: "dying",
+			Jobs: []params.MachineJob{params.JobHostUnits},
+		}, {
+			Error: &params.Error{
+				Code:    api.CodeUnauthorized,
+				Message: "permission denied",
+			},
+		}, {
+			Error: &params.Error{
+				Code:    api.CodeUnauthorized,
+				Message: "permission denied",
+			},
+		}},
+	})
+}
+
+func (s *agentSuite) TestGetNotFoundMachine(c *C) {
+	err := s.machine1.Destroy()
+	c.Assert(err, IsNil)
+	err = s.machine1.EnsureDead()
+	c.Assert(err, IsNil)
+	err = s.machine1.Remove()
+	c.Assert(err, IsNil)
+	results, err := s.agent.GetMachines(params.Machines{
+		Ids: []string{"1"},
+	})
+	c.Assert(err, IsNil)
+	c.Assert(results, DeepEquals, params.MachineAgentGetMachinesResults{
+		Machines: []params.MachineAgentGetMachinesResult{{
+			Error: &params.Error{
+				Code:    api.CodeNotFound,
+				Message: "machine 1 not found",
+			},
+		}},
+	})
+}

=== added file 'state/apiserver/machine/common_test.go'
--- state/apiserver/machine/common_test.go	1970-01-01 00:00:00 +0000
+++ state/apiserver/machine/common_test.go	2013-06-18 12:56:33 +0000
@@ -0,0 +1,66 @@
+package machine_test
+
+import (
+	. "launchpad.net/gocheck"
+	"launchpad.net/juju-core/juju/testing"
+	"launchpad.net/juju-core/state"
+	coretesting "launchpad.net/juju-core/testing"
+	stdtesting "testing"
+)
+
+func Test(t *stdtesting.T) {
+	coretesting.MgoTestPackage(t)
+}
+
+type commonSuite struct {
+	testing.JujuConnSuite
+
+	authorizer fakeAuthorizer
+
+	machine0 *state.Machine
+	machine1 *state.Machine
+}
+
+func (s *commonSuite) SetUpTest(c *C) {
+	s.JujuConnSuite.SetUpTest(c)
+
+	var err error
+	s.machine0, err = s.State.AddMachine("series", state.JobManageEnviron, state.JobManageState)
+	c.Assert(err, IsNil)
+
+	s.machine1, err = s.State.AddMachine("series", state.JobHostUnits)
+	c.Assert(err, IsNil)
+
+	// Create a fakeAuthorizer so we can check permissions,
+	// set up assuming machine 1 has logged in.
+	s.authorizer = fakeAuthorizer{
+		tag:          state.MachineTag(s.machine1.Id()),
+		loggedIn:     true,
+		manager:      false,
+		machineAgent: true,
+	}
+}
+
+// fakeAuthorizer implements the common.Authorizer interface.
+type fakeAuthorizer struct {
+	tag          string
+	loggedIn     bool
+	manager      bool
+	machineAgent bool
+}
+
+func (fa fakeAuthorizer) IsLoggedIn() bool {
+	return fa.loggedIn
+}
+
+func (fa fakeAuthorizer) AuthOwner(tag string) bool {
+	return fa.tag == tag
+}
+
+func (fa fakeAuthorizer) AuthEnvironManager() bool {
+	return fa.manager
+}
+
+func (fa fakeAuthorizer) AuthMachineAgent() bool {
+	return fa.machineAgent
+}

=== added file 'state/apiserver/machine/machine.test'
Binary files state/apiserver/machine/machine.test	1970-01-01 00:00:00 +0000 and state/apiserver/machine/machine.test	2013-06-18 12:56:33 +0000 differ
=== modified file 'state/apiserver/machine/machiner.go'
--- state/apiserver/machiner/machiner.go	2013-06-06 17:09:49 +0000
+++ state/apiserver/machine/machiner.go	2013-06-18 12:56:33 +0000
@@ -1,7 +1,7 @@
 // Copyright 2013 Canonical Ltd.
 // Licensed under the AGPLv3, see LICENCE file for details.
 
-package machiner
+package machine
 
 import (
 	"launchpad.net/juju-core/state"
@@ -10,24 +10,24 @@
 )
 
 // Machiner implements the API used by the machiner worker.
-type Machiner struct {
+type MachinerAPI struct {
 	st   *state.State
 	auth common.Authorizer
 }
 
-// New creates a new instance of the Machiner facade.
-func New(st *state.State, authorizer common.Authorizer) (*Machiner, error) {
+// NewMachinerAPI creates a new instance of the Machiner API.
+func NewMachinerAPI(st *state.State, authorizer common.Authorizer) (*MachinerAPI, error) {
 	if !authorizer.IsLoggedIn() {
 		return nil, common.ErrNotLoggedIn
 	}
 	if !authorizer.AuthMachineAgent() {
 		return nil, common.ErrPerm
 	}
-	return &Machiner{st, authorizer}, nil
+	return &MachinerAPI{st, authorizer}, nil
 }
 
 // SetStatus sets the status of each given machine.
-func (m *Machiner) SetStatus(args params.MachinesSetStatus) (params.ErrorResults, error) {
+func (m *MachinerAPI) SetStatus(args params.MachinesSetStatus) (params.ErrorResults, error) {
 	result := params.ErrorResults{
 		Errors: make([]*params.Error, len(args.Machines)),
 	}
@@ -38,7 +38,7 @@
 		machine, err := m.st.Machine(arg.Id)
 		if err == nil {
 			// Allow only for the owner agent.
-			if !m.auth.AuthOwner(machine) {
+			if !m.auth.AuthOwner(machine.Tag()) {
 				err = common.ErrPerm
 			} else {
 				err = machine.SetStatus(arg.Status, arg.Info)
@@ -50,12 +50,12 @@
 }
 
 // Watch starts an EntityWatcher for each given machine.
-//func (m *Machiner) Watch(args params.Machines) (params.MachinerWatchResults, error) {
+//func (m *MachinerAPI) Watch(args params.Machines) (params.MachinerWatchResults, error) {
 // TODO (dimitern) implement this once the watchers can handle bulk ops
 //}
 
 // Life returns the lifecycle state of each given machine.
-func (m *Machiner) Life(args params.Machines) (params.MachinesLifeResults, error) {
+func (m *MachinerAPI) Life(args params.Machines) (params.MachinesLifeResults, error) {
 	result := params.MachinesLifeResults{
 		Machines: make([]params.MachineLifeResult, len(args.Ids)),
 	}
@@ -66,7 +66,7 @@
 		machine, err := m.st.Machine(id)
 		if err == nil {
 			// Allow only for the owner agent.
-			if !m.auth.AuthOwner(machine) {
+			if !m.auth.AuthOwner(machine.Tag()) {
 				err = common.ErrPerm
 			} else {
 				result.Machines[i].Life = params.Life(machine.Life().String())
@@ -79,7 +79,7 @@
 
 // EnsureDead changes the lifecycle of each given machine to Dead if
 // it's Alive or Dying. It does nothing otherwise.
-func (m *Machiner) EnsureDead(args params.Machines) (params.ErrorResults, error) {
+func (m *MachinerAPI) EnsureDead(args params.Machines) (params.ErrorResults, error) {
 	result := params.ErrorResults{
 		Errors: make([]*params.Error, len(args.Ids)),
 	}
@@ -90,7 +90,7 @@
 		machine, err := m.st.Machine(id)
 		if err == nil {
 			// Allow only for the owner agent.
-			if !m.auth.AuthOwner(machine) {
+			if !m.auth.AuthOwner(machine.Tag()) {
 				err = common.ErrPerm
 			} else {
 				err = machine.EnsureDead()

=== modified file 'state/apiserver/machine/machiner_test.go'
--- state/apiserver/machiner/machiner_test.go	2013-06-06 17:09:49 +0000
+++ state/apiserver/machine/machiner_test.go	2013-06-18 12:56:33 +0000
@@ -1,85 +1,33 @@
 // Copyright 2013 Canonical Ltd.
 // Licensed under the AGPLv3, see LICENCE file for details.
 
-package machiner_test
+package machine_test
 
 import (
 	. "launchpad.net/gocheck"
-	"launchpad.net/juju-core/juju/testing"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api"
 	"launchpad.net/juju-core/state/api/params"
-	"launchpad.net/juju-core/state/apiserver/common"
-	"launchpad.net/juju-core/state/apiserver/machiner"
-	coretesting "launchpad.net/juju-core/testing"
-	stdtesting "testing"
+	"launchpad.net/juju-core/state/apiserver/machine"
 )
 
-func Test(t *stdtesting.T) {
-	coretesting.MgoTestPackage(t)
-}
-
 type machinerSuite struct {
-	testing.JujuConnSuite
-
-	authorizer *fakeAuthorizer
-	machiner   *machiner.Machiner
-
-	machine0 *state.Machine
-	machine1 *state.Machine
+	commonSuite
+	machiner *machine.MachinerAPI
 }
 
 var _ = Suite(&machinerSuite{})
 
-// fakeAuthorizer implements the common.Authorizer interface.
-type fakeAuthorizer struct {
-	tag          string
-	loggedIn     bool
-	manager      bool
-	machineAgent bool
-}
-
-func (fa *fakeAuthorizer) IsLoggedIn() bool {
-	return fa.loggedIn
-}
-
-func (fa *fakeAuthorizer) AuthOwner(entity common.Tagger) bool {
-	return entity.Tag() == fa.tag
-}
-
-func (fa *fakeAuthorizer) AuthEnvironManager() bool {
-	return fa.manager
-}
-
-func (fa *fakeAuthorizer) AuthMachineAgent() bool {
-	return fa.machineAgent
-}
-
 func (s *machinerSuite) SetUpTest(c *C) {
-	s.JujuConnSuite.SetUpTest(c)
-
-	// Create a machine so that we can login as its agent
-	var err error
-	s.machine0, err = s.State.AddMachine("series", state.JobManageEnviron)
-	c.Assert(err, IsNil)
-	// Add another normal machine
-	s.machine1, err = s.State.AddMachine("series", state.JobHostUnits)
-	c.Assert(err, IsNil)
-
-	// Create a fakeAuthorizer so we can check permissions.
-	s.authorizer = &fakeAuthorizer{
-		tag:          state.MachineTag(s.machine1.Id()),
-		loggedIn:     true,
-		manager:      false,
-		machineAgent: true,
-	}
+	s.commonSuite.SetUpTest(c)
 
 	// Create a machiner API for machine 1.
-	s.machiner, err = machiner.New(
+	machiner, err := machine.NewMachinerAPI(
 		s.State,
 		s.authorizer,
 	)
 	c.Assert(err, IsNil)
+	s.machiner = machiner
 }
 
 func (s *machinerSuite) assertError(c *C, err *params.Error, code, messageRegexp string) {
@@ -91,7 +39,7 @@
 func (s *machinerSuite) TestMachinerFailsWithNonMachineAgentUser(c *C) {
 	anAuthorizer := s.authorizer
 	anAuthorizer.machineAgent = false
-	aMachiner, err := machiner.New(s.State, anAuthorizer)
+	aMachiner, err := machine.NewMachinerAPI(s.State, anAuthorizer)
 	c.Assert(err, NotNil)
 	c.Assert(aMachiner, IsNil)
 	c.Assert(err, ErrorMatches, "permission denied")
@@ -100,7 +48,7 @@
 func (s *machinerSuite) TestMachinerFailsWhenNotLoggedIn(c *C) {
 	anAuthorizer := s.authorizer
 	anAuthorizer.loggedIn = false
-	aMachiner, err := machiner.New(s.State, anAuthorizer)
+	aMachiner, err := machine.NewMachinerAPI(s.State, anAuthorizer)
 	c.Assert(err, NotNil)
 	c.Assert(aMachiner, IsNil)
 	c.Assert(err, ErrorMatches, "not logged in")

=== removed file 'state/apiserver/resource.go'
--- state/apiserver/resource.go	2013-05-24 19:03:39 +0000
+++ state/apiserver/resource.go	1970-01-01 00:00:00 +0000
@@ -1,82 +0,0 @@
-// Copyright 2013 Canonical Ltd.
-// Licensed under the AGPLv3, see LICENCE file for details.
-
-package apiserver
-
-import (
-	"launchpad.net/juju-core/log"
-	"strconv"
-	"sync"
-)
-
-// resource represents the interface provided by state watchers and pingers.
-type resource interface {
-	Stop() error
-}
-
-// resources holds all the resources for a connection.
-type resources struct {
-	mu    sync.Mutex
-	maxId uint64
-	rs    map[string]*srvResource
-}
-
-// srvResource holds the details of a resource. It also implements the
-// Stop RPC method for all resources.
-type srvResource struct {
-	rs       *resources
-	resource resource
-	id       string
-}
-
-// Stop stops the given resource. It causes any outstanding
-// Next calls to return a CodeStopped error.
-// Any subsequent Next calls will return a CodeNotFound
-// error because the resource will no longer exist.
-func (r *srvResource) Stop() error {
-	err := r.resource.Stop()
-	r.rs.mu.Lock()
-	defer r.rs.mu.Unlock()
-	delete(r.rs.rs, r.id)
-	return err
-}
-
-func newResources() *resources {
-	return &resources{
-		rs: make(map[string]*srvResource),
-	}
-}
-
-// get returns the srvResource registered with the given
-// id, or nil if there is no such resource.
-func (rs *resources) get(id string) *srvResource {
-	rs.mu.Lock()
-	defer rs.mu.Unlock()
-	return rs.rs[id]
-}
-
-// register records the given watcher and returns
-// a srvResource instance for it.
-func (rs *resources) register(r resource) *srvResource {
-	rs.mu.Lock()
-	defer rs.mu.Unlock()
-	rs.maxId++
-	sr := &srvResource{
-		rs:       rs,
-		id:       strconv.FormatUint(rs.maxId, 10),
-		resource: r,
-	}
-	rs.rs[sr.id] = sr
-	return sr
-}
-
-func (rs *resources) stopAll() {
-	rs.mu.Lock()
-	defer rs.mu.Unlock()
-	for _, r := range rs.rs {
-		if err := r.resource.Stop(); err != nil {
-			log.Errorf("state/api: error stopping %T resource: %v", r, err)
-		}
-	}
-	rs.rs = make(map[string]*srvResource)
-}

=== modified file 'state/apiserver/root.go'
--- state/apiserver/root.go	2013-06-06 17:09:49 +0000
+++ state/apiserver/root.go	2013-06-18 12:56:33 +0000
@@ -6,7 +6,7 @@
 import (
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/apiserver/common"
-	"launchpad.net/juju-core/state/apiserver/machiner"
+	"launchpad.net/juju-core/state/apiserver/machine"
 	"launchpad.net/juju-core/state/multiwatcher"
 )
 
@@ -83,15 +83,24 @@
 	return nil
 }
 
-// Machiner returns an object that provides access to the Machiner API
-// facade. The id argument is reserved for future use and currently
-// needs to be empty.
-func (r *srvRoot) Machiner(id string) (*machiner.Machiner, error) {
-	if id != "" {
-		// Safeguard id for possible future use.
-		return nil, common.ErrBadId
-	}
-	return machiner.New(r.srv.state, r)
+// Machiner returns an object that provides access to the Machiner API.
+// The id argument is reserved for future use and must currently
+// be empty.
+func (r *srvRoot) Machiner(id string) (*machine.MachinerAPI, error) {
+	if id != "" {
+		return nil, common.ErrBadId
+	}
+	return machine.NewMachinerAPI(r.srv.state, r)
+}
+
+// MachineAgent returns an object that provides access to the machine
+// agent API.  The id argument is reserved for future use and must currently
+// be empty.
+func (r *srvRoot) MachineAgent(id string) (*machine.AgentAPI, error) {
+	if id != "" {
+		return nil, common.ErrBadId
+	}
+	return machine.NewAgentAPI(r.srv.state, r)
 }
 
 // User returns an object that provides
@@ -237,10 +246,10 @@
 }
 
 // AuthOwner returns whether the authenticated user's tag matches the
-// given entity's tag.
-func (r *srvRoot) AuthOwner(entity common.Tagger) bool {
+// given entity tag.
+func (r *srvRoot) AuthOwner(tag string) bool {
 	authUser := r.user.authenticator()
-	return authUser.Tag() == entity.Tag()
+	return authUser.Tag() == tag
 }
 
 // AuthEnvironManager returns whether the authenticated user is a

=== renamed file 'state/apiserver/apiserver.go' => 'state/apiserver/server.go'
=== added directory 'state/apiserver/testing'
=== modified file 'state/machine.go'
--- state/machine.go	2013-06-18 12:56:33 +0000
+++ state/machine.go	2013-06-18 12:56:33 +0000
@@ -32,13 +32,13 @@
 	_ MachineJob = iota
 	JobHostUnits
 	JobManageEnviron
-	JobServeAPI
+	JobManageState
 )
 
-var jobNames = []string{
-	JobHostUnits:     "JobHostUnits",
-	JobManageEnviron: "JobManageEnviron",
-	JobServeAPI:      "JobServeAPI",
+var jobNames = []params.MachineJob{
+	JobHostUnits:     params.JobHostUnits,
+	JobManageEnviron: params.JobManageEnviron,
+	JobManageState:   params.JobManageState,
 }
 
 func (job MachineJob) String() string {
@@ -46,7 +46,7 @@
 	if j <= 0 || j >= len(jobNames) {
 		return fmt.Sprintf("<unknown job %d>", j)
 	}
-	return jobNames[j]
+	return string(jobNames[j])
 }
 
 // machineDoc represents the internal state of a machine in MongoDB.

=== modified file 'state/state_test.go'
--- state/state_test.go	2013-06-18 12:56:33 +0000
+++ state/state_test.go	2013-06-18 12:56:33 +0000
@@ -117,7 +117,7 @@
 }{
 	{state.JobHostUnits, "JobHostUnits"},
 	{state.JobManageEnviron, "JobManageEnviron"},
-	{state.JobServeAPI, "JobServeAPI"},
+	{state.JobManageState, "JobManageState"},
 	{0, "<unknown job 0>"},
 	{5, "<unknown job 5>"},
 }
@@ -155,7 +155,7 @@
 	allJobs := []state.MachineJob{
 		state.JobHostUnits,
 		state.JobManageEnviron,
-		state.JobServeAPI,
+		state.JobManageState,
 	}
 	m1, err := s.State.AddMachine("blahblah", allJobs...)
 	c.Assert(err, IsNil)