vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: refuse new agents named hive-<anything>

Browse source 
`hive-<hive>` is each hive's read-only forge account, and an agent's forge
account takes the agent's name, so an agent called `hive-<x>` would claim
hive `<x>`'s account. `hive_types::reserved_agent_prefix_violation` names
the rule, and `broken_name_rules` applies it, so both creation paths that
go through it (`POST /api/agents` and placing an undeclared agent on a
hive) refuse such a name for a new agent. An agent already in the roster
keeps its name with a warning, as for every other naming rule.

The email check between hive and agent accounts stays as the second
guard, for agents created before this rule.

Refs #4851
This commit is contained in:
atlas 2026-10-07 21:05:21 +02:00
commit 4e7142ae53
5 changed files with 78 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

6
swarm-secret-client/src/forge.rs
View file

@ -40,9 +40,9 @@ pub fn agent_token_path(agent: &str) -> Result<String, Error> {
/// basic-auth header that token travels in.
///
/// The `hive-` prefix keeps the account reading as a hive's rather than an
/// agent's, as [`crate::matrix::hive_localpart`] does on the homeserver. It
/// does not make the name unique: an agent may be called `hive-<x>` too, and
/// `swarm-controller` tells the two apart by the account's email.
/// agent's, as [`crate::matrix::hive_localpart`] does on the homeserver.
/// `swarm-controller` refuses a new agent named with this prefix, and tells an
/// older one apart from the hive's account by the account's email.
#[must_use]
pub fn hive_login(hive: &str) -> String {
format!("hive-{hive}")