mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

the operator's bao works on a store host without a hive

Browse source
This commit is contained in:
atlas 2026-11-11 03:09:07 +01:00 • committed by mara
commit 32155f70aa
1 changed files with 169 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/module-eval/name-guards.nix
View file

@ -60,6 +60,7 @@ let
forwarderOidcCommonName = "fwctl";
forgePublisherCommonName = "fpctl";
granterCommonName = "grctl";
operatorCommonName = "opctl";
hiveLeafCommonNamePrefix = "hl";
};
swarm.hives = {
@ -71,6 +72,7 @@ let
fwctl.domain = "f.t.local";
fpctl.domain = "fp.t.local";
grctl.domain = "gr.t.local";
opctl.domain = "op.t.local";
other.domain = "other.t.local";
hl-other.domain = "hl.t.local";
};
@ -209,6 +211,12 @@ let
name = "a hive named after the bao granter's subject is refused too";
ok = equalityGuardRefuses hiveNamedAfterEverySubject "grctl";
}
{
# And the operator's leaf: no role accepts it, but a hive of that name
# has a reader role that does.
name = "a hive named after the operator leaf's subject is refused too";
ok = equalityGuardRefuses hiveNamedAfterEverySubject "opctl";
}
{
# 🩸 The per-hive half, and the one a prefix-only reservation would miss:
# the role is `<prefix>-<hive>`, so the reserved string has to be composed