mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

responder checks the logs or metrics permission per surface

Browse source
This commit is contained in:
atlas 2026-11-01 17:40:09 +01:00
commit 3b1d118f25
1 changed files with 324 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

24
swarm-agent-verify/src/lib.rs
View file

@ -52,11 +52,17 @@ impl Store {
}
}
impl CredentialSource for Store {
/// Logs in per lookup, so no token is left to expire inside a long-lived
/// process.
async fn lookup(&self, agent: &str) -> anyhow::Result<Option<AgentCredential>> {
let path = queue::agent_queue_path(agent)?;
impl Store {
/// The object at `path`, `None` when nothing is stored there. Logs in per
/// read, so no token is left to expire inside a long-lived process.
///
/// # Errors
///
/// When the login or the read fails, or the object does not decode.
pub async fn read_optional<T: serde::de::DeserializeOwned>(
&self,
path: &str,
) -> anyhow::Result<Option<T>> {
let store = swarm_secret_client::SecretStore::connect(
&self.settings,
&self.cert_role,
@ -65,12 +71,18 @@ impl CredentialSource for Store {
.await
.context("logging in to the secret store")?;
store
.read_optional(&path)
.read_optional(path)
.await
.with_context(|| format!("reading {path}"))
}
}
impl CredentialSource for Store {
async fn lookup(&self, agent: &str) -> anyhow::Result<Option<AgentCredential>> {
self.read_optional(&queue::agent_queue_path(agent)?).await
}
}
/// Whether `token`'s secret is the one stored for the agent it names.
///
/// The lookup is bounded by `timeout`, after which this denies.