vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

stop writing and attaching per-agent and per-hive bao policies

Browse source
This commit is contained in:
atlas 2026-10-26 23:02:08 +01:00
commit 139007e656
1 changed files with 253 additions and 419 deletions
Download patch file Download diff file Expand all files Collapse all files

25
swarm-secret-client/src/forge.rs
View file

@ -28,7 +28,7 @@ use crate::{
///
/// A flat leaf under the agent's prefix, like its controller-minted siblings
/// [`crate::queue::agent_queue_path`] and [`crate::mtls::identity_path`], so
/// the agent's own read stanza ([`crate::policy::render_agent`])
/// the agent's own read stanza ([`crate::policy::render_shared_agent`])
/// already covers it.
///
/// # Errors
@ -190,7 +190,7 @@ mod tests {
#[test]
fn no_hive_policy_reaches_the_controller_token() {
let policy = crate::policy::render("alpha").expect("legal");
let policy = crate::policy::effective_hive("alpha");
let covers = |path: &str| {
policy.lines().any(|line| {
line.strip_prefix("path \"")
@ -232,7 +232,7 @@ mod tests {
#[test]
fn the_agents_own_grants_list_its_accounts_and_read_each() {
let policy = crate::policy::render_agent("atlas").expect("legal");
let policy = crate::policy::effective_agent("atlas");
let covers = |path: &str| {
policy.lines().any(|line| {
line.strip_prefix("path \"")
@ -309,7 +309,7 @@ mod tests {
// policy is rendered elsewhere. If the path ever moved out from under
// it, the agent's fetch would 403 at boot, naming neither.
let path = agent_token_path("atlas").expect("legal");
let policy = crate::policy::render_agent("atlas").expect("legal");
let policy = crate::policy::effective_agent("atlas");
let covered = policy.lines().any(|line| {
line.strip_prefix("path \"")
.and_then(|rest| rest.split_once("\" {"))
@ -324,7 +324,7 @@ mod tests {
// Control for the test above: the prefix match must actually be
// discriminating, or it proves nothing.
let path = agent_token_path("atlas").expect("legal");
let policy = crate::policy::render_agent("argus").expect("legal");
let policy = crate::policy::effective_agent("argus");
let covered = policy.lines().any(|line| {
line.strip_prefix("path \"")
.and_then(|rest| rest.split_once("\" {"))
@ -357,15 +357,12 @@ mod tests {
#[test]
fn a_hive_reaches_its_own_forge_token_and_no_other_hives() {
let covered_by = |hive: &str, path: &str| {
crate::policy::render(hive)
.expect("legal")
.lines()
.any(|line| {
line.strip_prefix("path \"")
.and_then(|rest| rest.split_once("\" {"))
.and_then(|(p, _)| p.strip_suffix('*'))
.is_some_and(|prefix| format!("secret/data/{path}").starts_with(prefix))
})
crate::policy::effective_hive(hive).lines().any(|line| {
line.strip_prefix("path \"")
.and_then(|rest| rest.split_once("\" {"))
.and_then(|(p, _)| p.strip_suffix('*'))
.is_some_and(|prefix| format!("secret/data/{path}").starts_with(prefix))
})
};
let alpha = hive_token_path("alpha").expect("legal");
assert!(covered_by("alpha", &alpha), "alpha cannot read {alpha}");