vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller grants internal/docs read to agents; hives stop doing it

Browse source 
Agent creation gains a GrantDocsRead node (after CreateForgeUser) that adds
the agent as a read collaborator on internal/docs, and forge::docs_grant
runs a pass over the store's hive-agent-* roster at start and every five
minutes that queues the same job for any agent that is not one. The pass only
adds; an unreadable roster or forge read changes nothing.

hive-c0re drops shared_docs_access, its call in sync_agent, and the
SHARED_ORG / SHARED_DOCS_REPO constants only it used.
This commit is contained in:
atlas 2026-10-07 21:02:45 +02:00
commit 1ca758daa7
7 changed files with 643 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

29
hive-c0re/src/forge/repos.rs
View file

@ -1,7 +1,7 @@
//! Repo + org plumbing on the local Forgejo: the meta + shared-docs +
//! knowledge repos, meta mirroring (`push_meta`), collaborator grants,
//! pull-mirrors, and branch-protection rules. The typed API-client
//! constructor + org-name constants live in the module root (`super`).
//! Repo + org plumbing on the local Forgejo: the meta + knowledge repos,
//! meta mirroring (`push_meta`), collaborator grants, pull-mirrors, and
//! branch-protection rules. The typed API-client constructor + org-name
//! constants live in the module root (`super`).
use std::path::Path;
use std::sync::Mutex;
@ -16,8 +16,8 @@ use reqwest::StatusCode;
use crate::coordinator::Coordinator;
use super::{
CONFIG_ORG, SHARED_DOCS_REPO, SHARED_ORG, api, core_auth_header, core_token, forge_git_url,
forge_http_base, is_present, reader_token,
CONFIG_ORG, api, core_auth_header, core_token, forge_git_url, forge_http_base, is_present,
reader_token,
};
/// Creation options for an empty repo defaulting to `main`.
@ -144,23 +144,6 @@ pub async fn push_meta(dir: &Path) -> Result<()> {
Ok(())
}
/// Grant agent `name` read-only collaborator access to `internal/docs`.
/// Idempotent: re-adding an existing collaborator succeeds (Forgejo
/// answers 204 either way). Mirrors `meta_read_access` so agents can
/// clone the shared docs repo without authentication hassle.
pub async fn shared_docs_access(name: &str, core_token: &str) -> Result<()> {
add_collaborator(
SHARED_ORG,
SHARED_DOCS_REPO,
name,
AddCollaboratorOptionPermission::Read,
core_token,
)
.await?;
tracing::info!(%name, "forge: granted shared-docs read access");
Ok(())
}
/// Grant agent `name` read-only collaborator access to `core/meta` on
/// the forge so the agent can clone/fetch the meta flake. Idempotent:
/// re-adding an existing collaborator succeeds (Forgejo answers 204