vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller grants internal/docs read to agents; hives stop doing it

Browse source 
Agent creation gains a GrantDocsRead node (after CreateForgeUser) that adds
the agent as a read collaborator on internal/docs, and forge::docs_grant
runs a pass over the store's hive-agent-* roster at start and every five
minutes that queues the same job for any agent that is not one. The pass only
adds; an unreadable roster or forge read changes nothing.

hive-c0re drops shared_docs_access, its call in sync_agent, and the
SHARED_ORG / SHARED_DOCS_REPO constants only it used.
This commit is contained in:
atlas 2026-10-07 21:02:45 +02:00
commit 1ca758daa7
7 changed files with 643 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

21
swarm-controller/src/forge.rs
View file

@ -34,6 +34,7 @@ use utoipa::ToSchema;
use crate::webhook::DeliveryKind;
pub mod agent_token;
pub mod docs_grant;
pub mod hive_token;
pub mod legacy_tokens;
pub mod objects;
@ -233,11 +234,23 @@ impl Client {
}
/// Add `user` as a collaborator on `CONFIG_ORG/repo` at `permission`.
async fn add_collaborator(
&self,
repo: &str,
user: &str,
permission: AddCollaboratorOptionPermission,
) -> Result<()> {
self.add_collaborator_to(CONFIG_ORG, repo, user, permission)
.await
}
/// Add `user` as a collaborator on `owner/repo` at `permission`.
/// Idempotent: re-adding an existing collaborator just updates its
/// permission (forgejo answers 204 either way; a 201 from older
/// server versions is tolerated defensively).
async fn add_collaborator(
async fn add_collaborator_to(
&self,
owner: &str,
repo: &str,
user: &str,
permission: AddCollaboratorOptionPermission,
@ -245,7 +258,7 @@ impl Client {
let res = self
.api
.repo_add_collaborator(
CONFIG_ORG,
owner,
repo,
user,
AddCollaboratorOption {
@ -258,10 +271,10 @@ impl Client {
Err(ForgejoError::UnexpectedStatusCode(s)) if s == StatusCode::CREATED => {}
Err(e) => {
return Err(e)
.with_context(|| format!("add collaborator {user} to {CONFIG_ORG}/{repo}"));
.with_context(|| format!("add collaborator {user} to {owner}/{repo}"));
}
}
tracing::debug!(%repo, %user, ?permission, "swarm forge: collaborator set");
tracing::debug!(%owner, %repo, %user, ?permission, "swarm forge: collaborator set");
Ok(())
}