mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-forge: require HIVE_FORGE_URL, give agent login shells the forge env

Browse source
This commit is contained in:
atlas 2026-11-03 00:38:47 +01:00 • committed by mara
commit 4440d8fb29
2 changed files with 171 additions and 87 deletions
Download patch file Download diff file Expand all files Collapse all files

41
hive-forge/src/client.rs
View file

@ -17,9 +17,6 @@ use reqwest::header::{
use serde::{Deserialize, Serialize};
use serde_json::Value;
/// Default Forgejo URL when `HIVE_FORGE_URL` is unset.
const DEFAULT_URL: &str = "http://localhost:3000";
/// Bound on reaching the forge.
const HTTP_CONNECT_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(5);
/// Whole-request budget for a small JSON call (an `/api/v1` GET, or the
@ -395,9 +392,22 @@ pub fn index(n: u64) -> Result<i64> {
i64::try_from(n).with_context(|| format!("number {n} out of range"))
}
/// The internal forge's base URL from the `HIVE_FORGE_URL` value, which has
/// no default: inside an agent container `localhost` is the agent itself.
fn forge_url(value: Option<String>) -> Result<String> {
match value {
Some(url) if !url.trim().is_empty() => Ok(url),
_ => bail!(
"hive-forge: HIVE_FORGE_URL is unset or empty — the forge URL comes from the \
hive config (services.hyperhive.swarm.forge.domain) and is set in every \
agent container; export it, or use -f/--forge <label> for a linked external forge"
),
}
}
/// Resolve the `(base_url, token)` pair the client authenticates with.
/// `None` (the default) resolves the internal forge exactly as before:
/// `HIVE_FORGE_URL` (default [`DEFAULT_URL`]) + `read_token()`.
/// `HIVE_FORGE_URL` (required, see [`forge_url`]) + `read_token()`.
/// `Some(label)` (from `-f/--forge <label>`) instead resolves an
/// external forge account linked in the swarm UI: the token comes from
/// `${HYPERHIVE_STATE_DIR}/forge-<label>-token` and the base URL from
@ -411,7 +421,7 @@ pub fn index(n: u64) -> Result<i64> {
/// nonsense/traversing path and surfacing a confusing file error later.
pub(crate) fn resolve_credentials(forge_label: Option<&str>) -> Result<(String, String)> {
let Some(label) = forge_label else {
let base = std::env::var("HIVE_FORGE_URL").unwrap_or_else(|_| DEFAULT_URL.to_owned());
let base = forge_url(std::env::var("HIVE_FORGE_URL").ok())?;
let token = read_token().context("read forge-token")?;
return Ok((base, token));
};
@ -595,7 +605,26 @@ fn check_status(resp: Response, op: &str) -> Result<Response> {
#[cfg(test)]
mod tests {
use super::{WebStatusError, disposition_filename, index, owner_repo_from_git_url, split_repo};
use super::{
WebStatusError, disposition_filename, forge_url, index, owner_repo_from_git_url, split_repo,
};
#[test]
fn forge_url_is_the_value_as_is() {
assert_eq!(
forge_url(Some("http://forge.t.local".to_owned())).unwrap(),
"http://forge.t.local"
);
}
#[test]
fn forge_url_unset_or_blank_names_the_variable() {
for v in [None, Some(String::new()), Some(" ".to_owned())] {
let err = forge_url(v).unwrap_err().to_string();
assert!(err.contains("HIVE_FORGE_URL is unset or empty"), "{err}");
assert!(err.contains("hive config"), "{err}");
}
}
#[test]
fn disposition_filename_reads_forgejos_real_header() {

2
hive-forge/src/main.rs
View file

@ -1,7 +1,7 @@
//! `hive-forge` — typed CLI wrapper around the in-cluster Forgejo's
//! REST API. Reads credentials from the environment:
//!
//! `HIVE_FORGE_URL` — base URL, e.g. `http://localhost:3000`
//! `HIVE_FORGE_URL` — base URL (required), e.g. `http://forge.example.org`
//! `HYPERHIVE_STATE_DIR` — state dir; `forge-token` lives here
//! `HIVE_FORGE_DEADLINE` — optional; whole seconds one invocation may run
//! before it exits with code 75 (default 900)