mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add external gitlab accounts: stored in bao, linked per agent, allowed in squid, usable with glab

Browse source
This commit is contained in:
atlas 2026-11-02 16:11:25 +01:00
commit d6e983995d
1 changed files with 1322 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/module-eval/bao-grants.nix
View file

@ -2379,15 +2379,15 @@ let
&& !(lib.hasInfix "secret/metadata/*" s);
}
{
# `linked_accounts` names an agent's matrix accounts and forge labels by
# listing their two directories. bao checks a LIST against the directory
# `linked_accounts` names an agent's matrix accounts, forge labels and GitLab labels by
# listing their three directories. bao checks a LIST against the directory
# with a trailing slash, so each stanza names that slashed path and
# reaches that one directory: not the agent's other keys, not `agents/`
# itself, not anything below. Pinned as whole
# stanzas, and as the only metadata stanzas under `agents/` beside the
# queue revocation and the account deletes, so a widened path or an added
# capability fails.
name = "the controller may list each agent's matrix and forge accounts, and nothing else under agents";
name = "the controller may list each agent's matrix, forge and gitlab accounts, and nothing else under agents";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
@ -2395,11 +2395,12 @@ let
in
lib.hasInfix "path \"secret/metadata/swarm/agents/+/matrix/\" {\n capabilities = [\"list\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/forge/\" {\n capabilities = [\"list\"]\n}" s
&& stanzas == 7;
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/gitlab/\" {\n capabilities = [\"list\"]\n}" s
&& stanzas == 9;
}
{
# `linked_accounts` deletes one matrix account, forge account, GitHub
# token or backend environment through `delete_all_versions`, which
# `linked_accounts` deletes one matrix account, forge account, GitLab
# account, GitHub token or backend environment through `delete_all_versions`, which
# addresses its metadata path.
# A trailing `+` is one segment, so each stanza reaches the accounts
# directly in that directory and nothing deeper. Pinned as whole stanzas,
@ -2411,6 +2412,7 @@ let
in
lib.hasInfix "path \"secret/metadata/swarm/agents/+/matrix/+\" {\n capabilities = [\"delete\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/forge/+\" {\n capabilities = [\"delete\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/gitlab/+\" {\n capabilities = [\"delete\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/github-token\" {\n capabilities = [\"delete\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/backend-env\" {\n capabilities = [\"delete\"]\n}" s;
}