113 lines
3.5 KiB
Rust
113 lines
3.5 KiB
Rust
//! The credential this hive reads the forge with: its own read-only account,
|
|
//! whose token `swarm-controller` mints into the store at
|
|
//! `swarm/hives/<hive>/forge/token`.
|
|
|
|
use super::basic_auth_header;
|
|
|
|
/// A forge token and the account it belongs to.
|
|
///
|
|
/// No `Debug` derive: `value` is a live forge credential.
|
|
pub struct ReaderToken {
|
|
login: String,
|
|
value: String,
|
|
}
|
|
|
|
impl std::fmt::Debug for ReaderToken {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
f.debug_struct("ReaderToken")
|
|
.field("login", &self.login)
|
|
.field("value", &"<redacted>")
|
|
.finish()
|
|
}
|
|
}
|
|
|
|
impl ReaderToken {
|
|
/// The `http.extraHeader` value for git; see [`basic_auth_header`].
|
|
pub fn auth_header(&self) -> String {
|
|
basic_auth_header(&self.login, &self.value)
|
|
}
|
|
}
|
|
|
|
/// The token to read the forge with, or `None` when the store holds none for
|
|
/// this hive.
|
|
///
|
|
/// 🩸 Logs the store path, never a value.
|
|
pub async fn reader_token() -> Option<ReaderToken> {
|
|
let token = stored_reader_token().await;
|
|
if let Some(t) = &token {
|
|
tracing::debug!(login = %t.login, "forge: reading as this account");
|
|
}
|
|
token
|
|
}
|
|
|
|
/// This hive's token from the store, under the hive's own identity.
|
|
///
|
|
/// `None`, never an error, for every way it can come up empty — no hive name,
|
|
/// no `BAO_*` identity, an unreachable store, nothing at the path.
|
|
async fn stored_reader_token() -> Option<ReaderToken> {
|
|
let hive = std::env::var("HYPERHIVE_HIVE_NAME")
|
|
.ok()
|
|
.filter(|h| !h.is_empty())?;
|
|
let path = match swarm_secret_client::forge::hive_token_path(&hive) {
|
|
Ok(path) => path,
|
|
Err(e) => {
|
|
tracing::warn!(error = %e, "forge: this hive's name does not form a store path");
|
|
return None;
|
|
}
|
|
};
|
|
let store = match swarm_secret_client::SecretStore::from_env(&hive).await {
|
|
Ok(store) => store,
|
|
Err(e) => {
|
|
tracing::debug!(error = %e, "forge: no swarm secret store to read the hive token from");
|
|
return None;
|
|
}
|
|
};
|
|
match store
|
|
.read::<swarm_secret_client::forge::Credential>(&path)
|
|
.await
|
|
{
|
|
Ok(credential) if !credential.value.trim().is_empty() => Some(ReaderToken {
|
|
login: swarm_secret_client::forge::hive_login(&hive),
|
|
value: credential.value.trim().to_owned(),
|
|
}),
|
|
Ok(_) => {
|
|
tracing::warn!(%path, "forge: the stored hive token is empty");
|
|
None
|
|
}
|
|
Err(e) => {
|
|
tracing::debug!(%path, error = %e, "forge: no hive token in the store");
|
|
None
|
|
}
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
fn stored() -> ReaderToken {
|
|
ReaderToken {
|
|
login: "hive-alpha".to_owned(),
|
|
value: "from-the-store".to_owned(),
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn the_header_names_the_tokens_own_account() {
|
|
use base64::Engine as _;
|
|
let header = stored().auth_header();
|
|
let encoded = header
|
|
.strip_prefix("Authorization: Basic ")
|
|
.expect("a basic auth header");
|
|
let decoded = base64::engine::general_purpose::STANDARD
|
|
.decode(encoded)
|
|
.expect("base64");
|
|
assert_eq!(decoded, b"hive-alpha:from-the-store");
|
|
}
|
|
|
|
#[test]
|
|
fn debug_never_prints_the_value() {
|
|
let shown = format!("{:?}", stored());
|
|
assert!(!shown.contains("from-the-store"), "{shown}");
|
|
assert!(shown.contains("hive-alpha"), "{shown}");
|
|
}
|
|
}
|