vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats-auth: open sealed callout requests and seal the replies

Browse source 
When nats-server has an auth_callout xkey it seals each request to that
key and names its own public xkey in the Nats-Server-Xkey header. The
responder now loads the callout xkey seed from the secret store before
it connects, opens a sealed request with it, and seals its reply (grant
or deny) back to the header's key. A request with no header is answered
in plaintext, as before.

A new `ensure-xkey` verb creates the pair when the store holds no seed:
the seed at swarm/services/swarm-nats/callout/xkey-seed, the public half
at swarm/public/swarm-nats/callout-xkey. Each write is a create-only
(cas=0) write, and a run whose create fails reads the stored value back,
so two concurrent runs end up with one key. The responder itself only
reads the seed and refuses to start without it.

swarm-secret-client gains SecretStore::create, the cas=0 write.
This commit is contained in:
atlas 2026-10-05 21:25:40 +02:00 • committed by mara
commit 1e0b10bb7d
6 changed files with 669 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

3
swarm-nats-auth/Cargo.toml
View file

@ -16,7 +16,8 @@ clap.workspace = true
data-encoding.workspace = true
# StreamExt::next on the subscription: async-nats returns a Stream.
futures-util.workspace = true
nkeys.workspace = true
# `xkeys` for the callout xkey: opening sealed requests and sealing replies.
nkeys = { workspace = true, features = ["xkeys"] }
reqwest.workspace = true
serde.workspace = true
serde_json.workspace = true