vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress: a github link also derives raw, codeload and objects hosts

Browse source
This commit is contained in:
atlas 2026-10-30 16:55:52 +01:00 • committed by mara
commit 1e572d59a9
2 changed files with 22 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/networking/network.md
View file

@ -368,8 +368,9 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
like any other.
Linking a GitHub token, an external matrix account or an external forge
account adds a derived entry for that agent per host it reaches, and
deleting the account removes it: `github.com` and `api.github.com` for
GitHub, and the host of the matrix account's `homeserver` or the forge
deleting the account removes it: `github.com`, `api.github.com`,
`raw.githubusercontent.com`, `codeload.github.com` and
`objects.githubusercontent.com` for GitHub, and the host of the matrix account's `homeserver` or the forge
account's `url`. Each entry's `source` (`link:github`,
`link:matrix:<account>`, `link:forge:<label>`) keeps it apart from the
environment's, which a save of the environment leaves alone; an entry

22
swarm-controller/src/link_egress.rs
View file

@ -34,8 +34,15 @@ use crate::linked_accounts::{AccountKind, AccountStore, linked_accounts};
use crate::routes::{AppState, error_problem, wanted_error_status};
use crate::schedules::queue;
/// What the GitHub token is used against: `gh`'s API and git over HTTPS.
const GITHUB_HOSTS: [&str; 2] = ["github.com", "api.github.com"];
/// What the GitHub token is used against: `gh`'s API, git over HTTPS, and the
/// raw file, archive and release-asset downloads.
const GITHUB_HOSTS: [&str; 5] = [
"github.com",
"api.github.com",
"raw.githubusercontent.com",
"codeload.github.com",
"objects.githubusercontent.com",
];
/// An account the operator links to an agent.
pub(crate) enum Link<'a> {
@ -325,6 +332,13 @@ mod tests {
[
entry("github.com", "atlas", Some("link:github")),
entry("api.github.com", "atlas", Some("link:github")),
entry("raw.githubusercontent.com", "atlas", Some("link:github")),
entry("codeload.github.com", "atlas", Some("link:github")),
entry(
"objects.githubusercontent.com",
"atlas",
Some("link:github")
),
]
);
// A port, a path, a trailing slash and a scheme-less value all reduce
@ -521,7 +535,7 @@ mod tests {
crate::linked_accounts::delete_backend_env(State(state.clone()), path("atlas"))
.await
.expect("deleted");
assert_eq!(list_of(&client).await.len(), 4);
assert_eq!(list_of(&client).await.len(), 2 + GITHUB_HOSTS.len());
crate::linked_accounts::delete_github_account(State(state.clone()), path("atlas"))
.await
@ -564,6 +578,8 @@ mod tests {
);
modify(&client, |mut list| {
list.entries.extend([
// A link from before the host list grew: the pass adds the rest.
entry("github.com", "atlas", Some("link:github")),
// An orphan: iris has no leaf for it.
entry("github.com", "iris", Some("link:github")),
// An orphan on a live agent whose forge leaf is gone.