derive a missing client digest from the secret that exists

A client with a secret in the store or in a leftover file but no digest gets the digest of that secret instead of stopping the unit. The password reaches authelia's prompt through a pty, not argv. A lost mint race takes the winner's secret. Also name the mint, not the publisher, in the remaining rust docs.

swarm-secret-client/src/builder.rs

@@ -52,7 +52,7 @@ pub struct AtticPushToken {
 }
 
 /// The path holding the queue client secret of the builder's OIDC client
-/// `client_id`, where `swarm-secret-publisher.nix` puts every swarm service's.
+/// `client_id`, where authelia's mint puts every swarm service's.
 ///
 /// # Errors
 /// [`Error::PathSegment`] when `client_id` is not a single path segment.

swarm-secret-client/src/ci_metrics.rs

@@ -27,7 +27,7 @@ pub fn forge_token_path() -> Result<String, Error> {
 }
 
 /// The path holding the secret of the poller's OIDC client `client_id`, where
-/// `swarm-secret-publisher.nix` puts every swarm service's.
+/// authelia's mint puts every swarm service's.
 ///
 /// # Errors
 /// [`Error::PathSegment`] when `client_id` is not a single path segment.

swarm-secret-client/src/claude_login.rs

@@ -46,7 +46,7 @@ impl std::fmt::Debug for Credentials {
 }
 
 /// The path holding the queue client secret of the minter's OIDC client
-/// `client_id`, where `swarm-secret-publisher.nix` puts every swarm service's.
+/// `client_id`, where authelia's mint puts every swarm service's.
 ///
 /// # Errors
 /// [`Error::PathSegment`] when `client_id` is not a single path segment.

swarm-secret-client/src/queue.rs

@@ -44,8 +44,9 @@ pub fn agent_queue_path(agent: &str) -> Result<String, Error> {
 /// Under [`Kind::Controller`] because no hive's policy reads that kind, and
 /// this client may read every hive's status.
 ///
-/// The nix half is `swarm-secret-publisher.nix`, which writes it, and
-/// `swarm-bao.nix`'s `controllerPolicyText`, which grants the read.
+/// The nix half is `swarm-secret-publisher.nix`, which lists the path
+/// authelia's mint writes it at, and `swarm-bao.nix`'s `controllerPolicyText`,
+/// which grants the read.
 ///
 /// # Errors
 /// Never in practice: the name segment is a constant. The `Result` is
@@ -70,7 +71,8 @@ pub struct ControllerCredential {
 /// Under the hive's own prefix, which the hive's policy reads
 /// ([`crate::policy::render_shared_hives`]).
 ///
-/// The nix half is `swarm-secret-publisher.nix`, which writes it.
+/// The nix half is `swarm-secret-publisher.nix`, which lists the path authelia's
+/// mint writes it at.
 ///
 /// # Errors
 /// [`Error::PathSegment`] when `hive` contains anything but `[A-Za-z0-9_-]`.

swarm-secret-client/src/review_classifier.rs

@@ -60,7 +60,7 @@ pub fn forge_token_path() -> Result<String, Error> {
 }
 
 /// The path holding the queue client secret of the classifier's OIDC client
-/// `client_id`, where `swarm-secret-publisher.nix` puts every swarm service's.
+/// `client_id`, where authelia's mint puts every swarm service's.
 ///
 /// # Errors
 /// [`Error::PathSegment`] when `client_id` is not a single path segment.