vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: the builder's forge calls re-read the token on refusal too

Browse source 
#5177 added five forge requests under the controller's token that went
straight to the forgejo client: the commit status in
`Client::create_commit_status`, and in `forge/builder_account.rs` the
hives-team add, the user read, the repo-creation lockdown and the team
membership read. Each now goes through `Api::call`, so a 401 re-reads
the token from the store and sends the request once more, like the
other controller forge calls.

The read-back of the builder's newly minted token in
`ensure_builder_forge_token` stays a direct client: it sends the
builder's own token, not the controller's, the same as the read-backs
in `agent_token`, `classifier_account` and `hive_token`.
This commit is contained in:
atlas 2026-10-14 05:13:45 +02:00 • committed by mara
commit 531cc6bf91
2 changed files with 21 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

21
swarm-controller/src/forge.rs
View file

@ -1214,18 +1214,17 @@ impl Client {
state: CommitStatusState, state: CommitStatusState,
description: &str, description: &str,
) -> Result<()> { ) -> Result<()> {
let status = CreateStatusOption {
context: Some(context.to_owned()),
description: Some(status_description(description)),
state: Some(state),
target_url: None,
};
self.api self.api
.repo_create_status( .call(|api| {
owner, api.repo_create_status(owner, repo, sha, status.clone())
repo, .into_future()
sha, })
CreateStatusOption {
context: Some(context.to_owned()),
description: Some(status_description(description)),
state: Some(state),
target_url: None,
},
)
.await .await
.with_context(|| format!("set the {context} status on {sha} of {owner}/{repo}"))?; .with_context(|| format!("set the {context} status on {sha} of {owner}/{repo}"))?;
Ok(()) Ok(())

15
swarm-controller/src/forge/builder_account.rs
View file

@ -70,7 +70,7 @@ impl Client {
self.ensure_builder_user().await?; self.ensure_builder_user().await?;
let team = self.ensure_hives_team().await?; let team = self.ensure_hives_team().await?;
self.api self.api
.org_add_team_member(team, LOGIN) .call(|api| api.org_add_team_member(team, LOGIN).into_future())
.await .await
.with_context(|| format!("adding {LOGIN} to the hives team"))?; .with_context(|| format!("adding {LOGIN} to the hives team"))?;
@ -133,7 +133,7 @@ impl Client {
self.create_user(LOGIN, EMAIL).await?; self.create_user(LOGIN, EMAIL).await?;
let user = self let user = self
.api .api
.user_get(LOGIN) .call(|api| api.user_get(LOGIN).into_future())
.await .await
.with_context(|| format!("read forge user {LOGIN}"))?; .with_context(|| format!("read forge user {LOGIN}"))?;
if user.email.as_deref() != Some(EMAIL) { if user.email.as_deref() != Some(EMAIL) {
@ -144,7 +144,10 @@ impl Client {
); );
} }
self.api self.api
.admin_edit_user(LOGIN, super::repo_creation_lockdown(LOGIN)) .call(|api| {
api.admin_edit_user(LOGIN, super::repo_creation_lockdown(LOGIN))
.into_future()
})
.await .await
.with_context(|| format!("disable repo creation for forge user {LOGIN}"))?; .with_context(|| format!("disable repo creation for forge user {LOGIN}"))?;
Ok(()) Ok(())
@ -179,7 +182,11 @@ impl Client {
}; };
let member = match self.observe_hives_team().await { let member = match self.observe_hives_team().await {
TeamSeen::Matches(id) | TeamSeen::Drifted(id) => { TeamSeen::Matches(id) | TeamSeen::Drifted(id) => {
match self.api.org_list_team_member(id, LOGIN).await { match self
.api
.call(|api| api.org_list_team_member(id, LOGIN).into_future())
.await
{
Ok(_) => Some(true), Ok(_) => Some(true),
Err(e) if is_not_found(&e) => Some(false), Err(e) if is_not_found(&e) => Some(false),
Err(e) => { Err(e) => {