vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

name the mint, not the publisher, as the writer of the client secrets

Browse source 
Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.
This commit is contained in:
atlas 2026-10-30 04:32:22 +01:00 • committed by mara
commit 2fc63d844b
1 changed files with 52 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

10
swarm-nats-auth/src/oidc_secret.rs
View file

@ -2,8 +2,8 @@
//! with. Read from the secret store as the responder starts and held in
//! memory, never in a file, `argv` or the environment.
//!
//! The secret can change under a running responder: the publisher in authelia's
//! container re-publishes it when it is re-minted. So when the `IdP` refuses an
//! The secret can change under a running responder: authelia's mint, in its
//! container, writes a new one when it re-mints. So when the `IdP` refuses an
//! introspection as a credential (a 400 or 401), the secret is read from the
//! store again ([`StoredSecret::after_refusal`]) and, when it changed, the
//! introspection is tried once more. Both fit in the one request's
@ -36,9 +36,9 @@ pub fn path(client_id: &str) -> Result<String> {
Ok(format!("{prefix}/oidc/client"))
}
/// The secret at `path`, with surrounding whitespace trimmed: the publisher
/// stores the minted file as is, and a trailing newline is not part of the
/// secret. Errors name the path, never the value.
/// The secret at `path`, with surrounding whitespace trimmed: an earlier
/// release stored the minted file as is, and a trailing newline is not part of
/// the secret. Errors name the path, never the value.
///
/// # Errors
/// When the store cannot be read, or holds nothing or only whitespace there.