vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

swarm-secret-client: name the hive queue credential, and grant a hive its own kind

Browse source 
The agreement half of delivering the agent queue principal's client secret
through the store. No producer yet, so nothing writes this path — the unit
that does lands in the same PR, with the write grant it needs.

queue.rs is the sibling matrix.rs prescribes for a second kind of secret
rather than another field on a shared struct. Keyed per HIVE, not per agent:
the queue identity is minted once per hive at deploy time and says which hive
an agent belongs to, never which agent.

The client id rides with the secret for matrix.rs's stated reason — a
credential has to be reconstructable from the store alone, and deriving
`hive-<name>-agent` on the reading side is the split spelling the authelia
module warns denies every agent as a timeout.

policy.rs's render() takes the hive name now and emits a second, narrow
stanza for that hive's own path. The agent stanza is untouched: an agent's
path does not name its hive, so narrowing it still needs the enumeration
docs/trust-boundary/security.md rejects. A hive path does name its principal,
so scoping it costs nothing and drifts nowhere.

every_hive_gets_a_byte_identical_document is replaced rather than deleted.
Its surviving half is that the text is a function of the deploy-time name
alone, so a re-emission cannot drift; the new arms are that one hive's
document cannot reach another's path, and that a name which could close the
stanza is refused — live again now that a name reaches the document text.

Refs #3853
This commit is contained in:
atlas 2026-09-11 22:03:59 +02:00
commit 395ecbdf41
5 changed files with 196 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

9
swarm-secret-client/src/client.rs
View file

@ -305,7 +305,7 @@ mod tests {
let request = WriteAclPolicy {
name: "hive-pr1ma".to_owned(),
policy: crate::policy::render(),
policy: crate::policy::render("pr1ma").expect("a plain name is legal"),
};
assert_eq!(request.path(), "sys/policies/acl/hive-pr1ma");
}
@ -316,7 +316,7 @@ mod tests {
let request = WriteAclPolicy {
name: "hive-pr1ma".to_owned(),
policy: crate::policy::render(),
policy: crate::policy::render("pr1ma").expect("a plain name is legal"),
};
let body = request
.body()
@ -324,7 +324,10 @@ mod tests {
.expect("a policy write sends one");
let sent: serde_json::Value =
serde_json::from_slice(&body).expect("the body is the JSON the store parses");
assert_eq!(sent["policy"], crate::policy::render());
assert_eq!(
sent["policy"],
crate::policy::render("pr1ma").expect("legal")
);
assert!(
sent.get("name").is_none(),
"`name` addresses the policy in the path; sending it too would make \