name the mint, not the publisher, as the writer of the client secrets

Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.

swarm-secret-client/src/builder.rs

@@ -66,7 +66,7 @@ pub fn client_secret_path(client_id: &str) -> Result<String, Error> {
 /// No `Debug`: `value` authenticates the builder at the queue.
 #[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ClientSecret {
-    /// The secret, under the field name the publisher writes.
+    /// The secret, under the field name authelia's mint writes.
     pub value: String,
 }
 

swarm-secret-client/src/ci_metrics.rs

@@ -41,7 +41,7 @@ pub fn client_secret_path(client_id: &str) -> Result<String, Error> {
 /// No `Debug`: `value` authenticates the poller at the collector.
 #[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ClientSecret {
-    /// The secret, under the field name the publisher writes.
+    /// The secret, under the field name authelia's mint writes.
     pub value: String,
 }
 

swarm-secret-client/src/queue.rs

@@ -119,8 +119,8 @@ pub struct AgentCredential {
 mod tests {
     use super::*;
 
-    /// Spelled out in full because `swarm-secret-publisher.nix` and
-    /// `swarm-bao.nix` write the same string by hand.
+    /// Spelled out in full because the path layout in `swarm-secret-publisher.nix`
+    /// and `swarm-bao.nix` is written out by hand there too.
     #[test]
     fn the_controller_client_lands_under_the_controller() {
         assert_eq!(
@@ -147,8 +147,9 @@ mod tests {
         assert!(reads(&own), "{own} should be readable under {granted:?}");
     }
 
-    /// Spelled out in full because `swarm-secret-publisher.nix` writes the
-    /// same string by hand.
+    /// Spelled out in full because the path layout in
+    /// `swarm-secret-publisher.nix`, where authelia's mint takes it from, is
+    /// written out by hand there too.
     #[test]
     fn a_hives_own_client_lands_under_its_own_principal_prefix() {
         assert_eq!(

swarm-secret-client/src/review_classifier.rs

@@ -74,7 +74,7 @@ pub fn client_secret_path(client_id: &str) -> Result<String, Error> {
 /// No `Debug`: `value` authenticates the classifier at the queue.
 #[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ClientSecret {
-    /// The secret, under the field name the publisher writes.
+    /// The secret, under the field name authelia's mint writes.
     pub value: String,
 }
 

swarm-secret-client/src/stored_secret.rs

@@ -1,8 +1,8 @@
 //! A client secret held in memory and read again from where it is kept when
 //! the `IdP` refuses it.
 //!
-//! The secret can change under a running process: the publisher in authelia's
-//! container re-publishes it when it is re-minted. A refusal asks for a re-read
+//! The secret can change under a running process: authelia's mint, in its
+//! container, writes a new one when it re-mints. A refusal asks for a re-read
 //! ([`StoredSecret::after_refusal`]); when the read lands a different secret,
 //! the caller tries once more with it. One re-read runs at a time, and a
 //! refusal while one is running waits for it rather than starting another.