vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

render squid's unrestricted-users list from each agent's flag

Browse source
This commit is contained in:
atlas 2026-10-28 14:14:30 +01:00 • committed by mara
commit 0b99f17bc3
1 changed files with 338 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

17
swarm-secret-client/src/proxy.rs
View file

@ -28,6 +28,14 @@ pub const SELFCHECK_LEAF: &str = "squid-selfcheck";
/// `nix/host-modules/hive-squid.nix` spells the same string.
pub const SELFCHECK_USER: &str = "selfcheck.squid";
/// The squid user the self-check logs in as to prove an unrestricted agent
/// reaches an unlisted name. It authenticates with the same secret as
/// [`SELFCHECK_USER`] ([`selfcheck_path`]), and is always on squid's
/// unrestricted list. It cannot be an agent's name for the same reason as
/// [`SELFCHECK_USER`]. `nix/host-modules/hive-squid.nix` spells the same
/// string.
pub const SELFCHECK_UNRESTRICTED_USER: &str = "selfcheck-unrestricted.squid";
/// The path holding the secret `agent` authenticates to the egress proxy with.
///
/// A flat leaf under the agent's prefix, like
@ -127,8 +135,13 @@ mod tests {
}
#[test]
fn the_selfcheck_user_is_not_a_legal_agent_name() {
assert!(crate::path::checked_segment("agent", SELFCHECK_USER).is_err());
fn the_selfcheck_users_are_not_legal_agent_names() {
for user in [SELFCHECK_USER, SELFCHECK_UNRESTRICTED_USER] {
assert!(
crate::path::checked_segment("agent", user).is_err(),
"{user}"
);
}
}
#[test]