vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

treefmt: apply prettier

Browse source 
Pure `nix fmt` output from the commit before this one — no hand edits.
203 files: 52 md, 42 tsx, 32 js, 32 css, 21 ts, 13 html, 8 json, 3 mjs.

Reproduce with `nix develop -c nix fmt` on the parent commit; the result
should be byte-identical to this tree.

None of the 13 `.prettierignore` entries appears here — verified by
intersecting the changed-file list against the ignore file, with a
control proving the intersection finds a match when one exists.
This commit is contained in:
atlas 2026-09-02 14:29:33 +02:00
commit 39b95c2ede
203 changed files with 10090 additions and 6085 deletions
Download patch file Download diff file Expand all files Collapse all files

12
swarm-nats-auth/README.md
View file

@ -1,7 +1,7 @@
# swarm-nats-auth
The auth-callout responder for the swarm's NATS queue — the half that lets
the server say *yes*.
the server say _yes_.
`nix/host-modules/swarm-nats.nix` configures `nats-server` with an
`auth_callout` block. **That block with no responder is the fail-closed
@ -22,7 +22,7 @@ being one change.
## The invariant that is easy to break
⛔ **`issuer_account` must be absent from the issued user token.** It is an
operator-mode field. The module renders *server-config* mode (`accounts
operator-mode field. The module renders _server-config_ mode (`accounts
{ AUTH, APP }`, no operator), where its mere presence makes the server refuse
the client — `Error non operator mode account "AUTH": attempted to use
issuer_account` — while the responder cheerfully reports `granted=true`. The
@ -30,7 +30,7 @@ account is named by the claims' `aud` instead.
`nats_jwt::Token::new_user` always sets it, so reaching for that constructor
reintroduces the bug. `nats-jwt` is a **dev-dependency**: it cannot express
`aud` on either token, and its role here is as the encoder's *test oracle*,
`aud` on either token, and its role here is as the encoder's _test oracle_,
not part of the path that runs.
## Rules the code follows
@ -40,7 +40,7 @@ not part of the path that runs.
turns every rejection into a timeout and hides an outage inside what looks
like ordinary denials.
- **Anything that is not an explicit `{"active": true}` denies** — including
an introspection call that could not be *made*. The failure modes of an HTTP
an introspection call that could not be _made_. The failure modes of an HTTP
call are exactly the conditions under which an attacker would most like this
to fall open.
- **Every credential is a path, never a value.** A value in nix config lands
@ -48,7 +48,7 @@ not part of the path that runs.
`/proc/<pid>/cmdline`, which is `0444`. Paths are not secrets, so passing
them as flags is fine.
- **The introspection timeout is pinned below the server's `authorization.
timeout`**, with a test asserting the relation — a responder that answers
timeout`**, with a test asserting the relation — a responder that answers
after the server gave up is indistinguishable from one that never answered.
## What the tests do and do not cover
@ -57,7 +57,7 @@ Unit tests cover the JWT framing, including byte-equality against `nats-jwt`
on the one shape that crate models. They are **not** sufficient on their own:
this crate's shape is decided by a server that parses what it emits, so the
change was also driven against a real `nats-server` — every refusal repeated
*with the responder live*, because a responder that says yes to everyone
_with the responder live_, because a responder that says yes to everyone
passes "a client can connect" perfectly. That harness lives outside this repo;
the PR that added this crate links it.