mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm ui: show when an agent's claude login was stored, and delete it

Browse source 
The agent's settings get a claude login row: when the swarm stored the
login, read by the minter from the leaf's metadata, or that none is, with a
delete that removes every version after a confirmation. New minter steps
(status, delete), controller routes (GET claude-login, DELETE
claude-login/stored) and a read and delete grant on the leaf's metadata,
pinned in the module-eval check.
This commit is contained in:
iris 2026-11-09 21:39:17 +01:00 • committed by mara
commit 7dd147adb4
1 changed files with 469 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/module-eval/bao-grants.nix
View file

@ -2098,9 +2098,10 @@ let
}
{
# The minter writes one leaf under every agent, create and update so a
# relogin replaces the last, and reads its own queue client secret. No
# read on the leaf, and nothing else under an agent.
name = "the claude login minter's grant is create and update on agents' claude-credentials, and its queue client secret";
# relogin replaces the last, reads and deletes the leaf's metadata (when it
# was written; every version removed), and reads its own queue client
# secret. No read on the leaf's data, and nothing else under an agent.
name = "the claude login minter's grant is create and update on agents' claude-credentials, read and delete on its metadata, and its queue client secret";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-claude-login-policy.script;
@ -2110,8 +2111,13 @@ let
"create"
"update"
]
&&
(grantFor grants "secret/metadata/swarm/agents/+/claude-credentials").caps == [
"read"
"delete"
]
&& (grantFor grants "secret/data/swarm/services/swarm-claude-login/oidc/client").caps == [ "read" ]
&& lib.length grants == 2
&& lib.length grants == 3
&& !(lib.hasInfix "secret/data/swarm/agents/*" s)
&& lib.hasInfix "auth/cert/certs/swarm-claude-login" s
&& lib.hasInfix "allowed_common_names=swarm-claude-login" s
@ -2147,7 +2153,7 @@ let
in
(grantFor grants "secret/data/swarm/services/swarm-notify-router/oidc/client").caps == [ "read" ]
&& lib.length grants == 1
&& lib.length minter == 2
&& lib.length minter == 3
&& lib.hasInfix "auth/cert/certs/swarm-notify-router" s
&& lib.hasInfix "allowed_common_names=swarm-notify-router" s
&& lib.hasInfix "token_policies=swarm-notify-router" s;