feat(swarm-authelia-bridge): mark agent identities with a group, and answer for the set

The users database holds humans and agents in one namespace and nothing in
it said which was which, so a roster read had no predicate to read with.

Marks positively, at creation. The alternative — everyone who is not an
operator — fails in the direction that matters: an account created without
a group is an operator who cannot log in, a mistake the swarm UI docs
already warn about, and it would have rendered as an agent. The group is a
constant for the same reason the operator group it mirrors is one.

An identity that predates the marker gains it when agent creation runs
again, which is already the agreed migration for those; AlreadyExists
therefore reports that the subject was there, not that nothing was written.

ListAgentIdentities reads through this process because the store is owned
by a uid swarm-controller does not have — the same reason the write goes
through here — and answers with names alone, never the digests it sits next
to.

swarm-authelia-bridge/src/store.rs

@@ -95,6 +95,51 @@ pub fn reject_reserved_name(name: &str) -> Result<()> {
     Ok(())
 }
 
+/// The group that marks a subject as an agent.
+///
+/// One file holds humans and agents, and nothing else in it says which is
+/// which — so the roster needs a predicate, and a positive mark is the only
+/// one that fails safe. The alternative, *"everyone who is not an
+/// operator"*, misfiles a **human**: an account created without a group is
+/// an operator who cannot log in, a documented mistake, and it would read as
+/// an agent.
+///
+/// A constant rather than an option, for the reason `swarm-authelia.nix`
+/// already gives about the operator group it mirrors: a configurable name is
+/// one more way for the rule and the account to disagree silently.
+pub const AGENT_GROUP: &str = "agents";
+
+/// Add the agent marker to an existing subject if it is missing; reports
+/// whether anything changed, so the caller knows whether a write is owed.
+///
+/// Exists because an identity created before the marker did is otherwise
+/// invisible to the roster forever. The agreed migration for those is *"run
+/// agent creation again with the same name"*, and this is what makes that
+/// heal rather than no-op.
+pub fn mark_as_agent(store: &mut UserStore, name: &str) -> bool {
+    let Some(user) = store.users.get_mut(name) else {
+        return false;
+    };
+    if user.groups.iter().any(|g| g == AGENT_GROUP) {
+        return false;
+    }
+    user.groups.push(AGENT_GROUP.to_owned());
+    true
+}
+
+/// The agent names in the store, sorted.
+///
+/// Sorted because [`UserStore::users`] is a `BTreeMap`, so this is free and
+/// a consumer diffing two answers sees real changes rather than reordering.
+pub fn agent_names(store: &UserStore) -> Vec<String> {
+    store
+        .users
+        .iter()
+        .filter(|(_, user)| user.groups.iter().any(|g| g == AGENT_GROUP))
+        .map(|(name, _)| name.clone())
+        .collect()
+}
+
 /// Same conservative charset `swarmctl::users::validate_username` already
 /// enforces — usernames are YAML map keys, log lines, and access-control
 /// subjects, so keeping them to plain ASCII means nothing downstream ever
@@ -288,6 +333,23 @@ mod tests {
         }
     }
 
+    fn agent(password: &str) -> User {
+        User {
+            groups: vec![AGENT_GROUP.to_owned()],
+            ..user(password)
+        }
+    }
+
+    /// The group an operator carries — a literal here rather than a shared
+    /// constant, because this binary does not read the operator group and a
+    /// test that imported one would imply it did.
+    fn operator(password: &str) -> User {
+        User {
+            groups: vec!["admins".to_owned()],
+            ..user(password)
+        }
+    }
+
     /// The document `swarm-authelia`'s first-boot unit writes must load as
     /// an empty store with no special case — otherwise a fresh hive's very
     /// first `EnsureAgentIdentity` fails on a file we wrote ourselves.
@@ -383,6 +445,62 @@ some_future_top_level_key: 7
         );
     }
 
+    /// The roster's whole job: one file holds humans and agents, and only
+    /// the marker separates them. Asserted with an operator present, because
+    /// a filter that returned everyone would pass a fixture of agents alone.
+    #[test]
+    fn the_roster_is_the_marked_subjects_and_not_the_file() {
+        let mut store = UserStore::default();
+        store.users.insert("atlas".to_owned(), agent("$argon2id$a"));
+        store
+            .users
+            .insert("mara".to_owned(), operator("$argon2id$b"));
+        // An account with no group at all: the documented mistake of adding
+        // an operator without `--group`. It must NOT read as an agent.
+        store
+            .users
+            .insert("ungrouped".to_owned(), user("$argon2id$c"));
+
+        assert_eq!(agent_names(&store), ["atlas"]);
+    }
+
+    /// An identity that predates the marker is invisible to the roster until
+    /// agent creation runs again — which is the agreed migration, so it has
+    /// to actually change something.
+    #[test]
+    fn marking_an_existing_identity_is_a_change_once_and_never_again() {
+        let mut store = UserStore::default();
+        store.users.insert("atlas".to_owned(), user("$argon2id$a"));
+        assert!(agent_names(&store).is_empty(), "fixture starts unmarked");
+
+        assert!(mark_as_agent(&mut store, "atlas"), "the first mark writes");
+        assert_eq!(agent_names(&store), ["atlas"]);
+        assert!(
+            !mark_as_agent(&mut store, "atlas"),
+            "a second call must report no change — otherwise every ensure \
+             rewrites the file and wakes authelia's watcher"
+        );
+
+        assert!(
+            !mark_as_agent(&mut store, "nobody"),
+            "marking a subject that does not exist creates nothing"
+        );
+        assert!(!store.users.contains_key("nobody"));
+    }
+
+    /// The marker is a group like any other, so it must survive the
+    /// round-trip that every write goes through — a marker that renders but
+    /// does not re-parse would make the roster empty after one restart.
+    #[test]
+    fn the_marker_survives_a_round_trip() {
+        let mut store = UserStore::default();
+        store.users.insert("atlas".to_owned(), agent("$argon2id$a"));
+
+        let out = render_yaml(&store).expect("renders");
+        let back: UserStore = serde_norway::from_str(&out).expect("reparses");
+        assert_eq!(agent_names(&back), ["atlas"]);
+    }
+
     #[test]
     fn usernames_outside_the_conservative_set_are_refused() {
         for bad in ["", "-leading", "has space", "quote\"d", "sla/sh"] {