vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

stop writing and attaching per-agent and per-hive bao policies

Browse source
This commit is contained in:
atlas 2026-10-26 23:02:08 +01:00
commit 139007e656
1 changed files with 253 additions and 419 deletions
Download patch file Download diff file Expand all files Collapse all files

12
swarm-secret-client/src/queue.rs
View file

@ -27,8 +27,8 @@ use crate::{
/// Under the agent's own principal prefix, and that is the whole reason for
/// this spelling rather than a new top-level one: every agent's ACL document
/// already grants read on `swarm/agents/<agent>/*`
/// ([`crate::policy::render_agent`]), so a credential here needs no new grant,
/// no policy re-render, and no rewrite of any existing agent's document.
/// ([`crate::policy::render_shared_agent`]), so a credential here needs no new grant
/// and no policy rewrite.
///
/// # Errors
/// [`Error::PathSegment`] when `agent` contains anything but `[A-Za-z0-9_-]`,
@ -68,7 +68,7 @@ pub struct ControllerCredential {
/// identity hive-c0re publishes the hive's status to the swarm queue with.
///
/// Under the hive's own prefix, which the hive's policy reads
/// ([`crate::policy::render`]).
/// ([`crate::policy::render_shared_hives`]).
///
/// The nix half is `swarm-secret-publisher.nix`, which writes it.
///
@ -129,7 +129,7 @@ mod tests {
#[test]
fn no_hive_policy_reaches_the_controller_client() {
let doc = crate::policy::render("alpha").expect("a plain name is legal");
let doc = crate::policy::effective_hive("alpha");
// Every stanza is `path "secret/data/<prefix>*" { … }`.
let granted: Vec<&str> = doc
.lines()
@ -157,7 +157,7 @@ mod tests {
#[test]
fn a_hives_own_policy_reads_its_client_and_no_other_hives() {
let doc = crate::policy::render("alpha").expect("a plain name is legal");
let doc = crate::policy::effective_hive("alpha");
let granted: Vec<&str> = doc
.lines()
.filter_map(|l| l.strip_prefix("path \"secret/data/"))
@ -216,7 +216,7 @@ mod tests {
/// it belongs to.
#[test]
fn the_agents_existing_policy_already_covers_its_queue_path() {
let document = crate::policy::render_agent("atlas").expect("legal");
let document = crate::policy::effective_agent("atlas");
let path = agent_queue_path("atlas").expect("legal");
let stanza = path
.rsplit_once('/')