derive per-agent egress entries from operator-linked accounts

swarm-controller/src/egress_allow.rs

@@ -30,8 +30,8 @@ use crate::schedules::{live, queue, read_or_default, refused, write_revision};
 const MAX_ATTEMPTS: usize = 5;
 
 /// Why an operator can neither add nor remove an entry the controller derived.
-const DERIVED_REFUSED: &str = "this entry is kept automatically from the agent's backend environment; \
-change or remove that variable instead";
+const DERIVED_REFUSED: &str = "this entry is kept automatically from the agent's backend environment or a linked \
+account; change or remove that variable, or unlink the account, instead";
 
 /// Set from the hive module's `baseAllowedDomains` default by
 /// `nix/host-modules/swarm-controller.nix`: the names, separated by spaces,
@@ -69,6 +69,7 @@ pub(crate) fn checked(req: &AllowedDomain, base: &[String]) -> Result<Entry, Str
         domain,
         agent,
         derived: false,
+        source: None,
     })
 }
 
@@ -551,6 +552,7 @@ mod tests {
                     domain: format!("host{i}.example.com"),
                     agent: None,
                     derived: false,
+                    source: None,
                 })
                 .collect(),
         };
@@ -558,6 +560,7 @@ mod tests {
             domain: "github.com".to_owned(),
             agent: None,
             derived: false,
+            source: None,
         };
         let why = added(full.clone(), &new).err().expect("a full list");
         assert!(why.contains("1000"), "{why}");