e263681f1d
mara, reviewing the previous commit: "the field is specific to matrix, why add it to the general struct". She is right, and the answer is that there was no general struct — `Credential` had one consumer, the crate's only path builder was `matrix_account`, and `value` is pinned by `glue-matrix-bao-token.nix`, a matrix unit. It was matrix's throughout, wearing a general name; adding `homeserver` is what made that visible. `client` now moves whatever type a caller names and decodes nothing itself. That is forwarding rather than machinery: `vaultrs::kv2::read`/`set` are already generic over the payload. The matrix agreement moves to its own module holding both halves — where a credential lives (`account_path`, was `path::matrix_account`) and what the object at that path holds. `path` keeps only what every path obeys, so a second kind of swarm secret becomes a module beside `matrix` rather than another optional field on a struct it shares. argus raised the same collision from the other direction on #4092: two mutually-exclusive `Option`s modelling one concept is the failure mode this forecloses. `checked_segment` stays public in `path`: hive-priv builds an on-disk path from the same names and must accept the same charset. Behaviour is unchanged. The compatibility properties move with the struct — `Option` is what lets a pre-`homeserver` stored object decode, and `skip_serializing_if` is what keeps a token-only object free of `"homeserver":null` for that nix reader. Refs #3726
101 lines
3.6 KiB
Rust
101 lines
3.6 KiB
Rust
//! The rules every path into the store obeys, whatever kind of secret it
|
|
//! addresses.
|
|
//!
|
|
//! The controller writes and a hive reads, and neither is senior to the other,
|
|
//! so what they must agree on is stated once here rather than at each call
|
|
//! site. A *particular* kind of secret builds its path from these pieces in its
|
|
//! own module — [`crate::matrix`] is the one that exists.
|
|
|
|
use crate::Error;
|
|
|
|
/// The KV v2 mount every swarm secret lives under.
|
|
///
|
|
/// A literal because the store's existing reader already hardcodes the same
|
|
/// one (`secret/swarm/matrix/registration-token`); an option nobody sets would
|
|
/// be two ways to say one thing.
|
|
pub const MOUNT: &str = "secret";
|
|
|
|
/// The prefix under [`MOUNT`] owned by per-agent credentials.
|
|
pub const AGENT_PREFIX: &str = "swarm/agents";
|
|
|
|
/// A path segment that cannot change the path's shape.
|
|
///
|
|
/// The charset is deliberately narrower than what the store accepts: a `/`
|
|
/// turns one agent's segment into another agent's directory, and `..` walks
|
|
/// out of the prefix entirely. Both are names this crate receives from
|
|
/// elsewhere — an agent name from the topology, an account name from an
|
|
/// agent's own config — so neither is trusted to be well-formed here.
|
|
///
|
|
/// Public because the same name is also used to build a path **on disk**, and
|
|
/// that guard must accept exactly what this one does. Two copies of a charset
|
|
/// are two charsets: they agree until one is edited, and the day they diverge
|
|
/// is the day a name is legal in the store and not on the filesystem, or the
|
|
/// reverse.
|
|
///
|
|
/// # Errors
|
|
/// [`Error::PathSegment`] when `value` is empty or holds anything outside
|
|
/// `[A-Za-z0-9_-]`.
|
|
pub fn checked_segment(kind: &'static str, value: &str) -> Result<(), Error> {
|
|
if value.is_empty() {
|
|
return Err(Error::PathSegment {
|
|
kind,
|
|
value: value.to_owned(),
|
|
});
|
|
}
|
|
if !value
|
|
.bytes()
|
|
.all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_')
|
|
{
|
|
return Err(Error::PathSegment {
|
|
kind,
|
|
value: value.to_owned(),
|
|
});
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn a_segment_that_could_change_a_paths_shape_is_refused() {
|
|
// Each of these is a *different* way to reach outside the segment the
|
|
// caller meant, and the last two are the ones a charset check catches
|
|
// but a `contains("..")` check does not.
|
|
for bad in [
|
|
"../argus",
|
|
"atlas/../argus",
|
|
"atlas/matrix",
|
|
"a b",
|
|
"a.b",
|
|
"",
|
|
] {
|
|
assert!(
|
|
checked_segment("agent", bad).is_err(),
|
|
"segment {bad:?} must be refused"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn the_legal_charset_is_actually_reachable() {
|
|
// The control for the test above: if `checked_segment` rejected
|
|
// everything, the escape cases would pass for the wrong reason. The
|
|
// charset is the one `hive-priv` accepts for the same names on disk,
|
|
// so uppercase and underscore have to stay legal here.
|
|
assert!(checked_segment("agent", "a-b_C9").is_ok());
|
|
assert!(checked_segment("account", "d-e_F0").is_ok());
|
|
}
|
|
|
|
#[test]
|
|
fn the_rejected_segment_is_named_in_the_error() {
|
|
// The caller usually got the name from config and needs to see which
|
|
// of the two it was.
|
|
let e = checked_segment("account", "a b").expect_err("a space is not legal");
|
|
assert!(
|
|
matches!(e, Error::PathSegment { kind, ref value } if kind == "account" && value == "a b"),
|
|
"got {e:?}"
|
|
);
|
|
}
|
|
}
|