refactor(#1474): extract remaining dispatch_shared + hive-priv arms, drop their too_many_lines allows

hive-priv/src/main.rs

@@ -155,13 +155,6 @@ async fn write_line_event(writer: &mut OwnedWriteHalf, stream: PrivStream, data:
 /// For streaming ops (`CreateContainer`/`UpdateContainer` with `stream: true`)
 /// output lines are forwarded to `writer` as `PrivEvent::Line` messages and
 /// the returned strings are empty.
-#[allow(
-    clippy::too_many_lines,
-    reason = "flat routing table over the privileged request variants — the \
-              logic-bearing arms (resource-limits / daemon-reload / \
-              restart-matrix / create+update) are extracted to helpers; the \
-              rest are one-line validate-then-delegate dispatches kept inline"
-)]
 async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String, String)> {
     match req {
         PrivRequest::StartContainer { ref name } => {
@@ -206,15 +199,7 @@ async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String,
             ref container,
             ref binds,
             ref isolation,
-        } => {
-            validate_container_system_name(container)?;
-            for bind in binds {
-                validate_bind_path(&bind.host_path)?;
-                validate_bind_path(&bind.container_path)?;
-            }
-            write_nspawn_flags(container, binds, isolation.as_ref())?;
-            Ok((String::new(), String::new()))
-        }
+        } => handle_write_nspawn_flags(container, binds, isolation.as_ref()),
 
         PrivRequest::WriteResourceLimits {
             ref container,
@@ -222,14 +207,7 @@ async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String,
             ref cpu_quota,
         } => write_resource_limits(container, memory_max, cpu_quota),
 
-        PrivRequest::RemoveServiceDropin { ref container } => {
-            validate_container_system_name(container)?;
-            let dir = format!("/run/systemd/system/container@{container}.service.d");
-            if Path::new(&dir).exists() {
-                std::fs::remove_dir_all(&dir).with_context(|| format!("remove {dir}"))?;
-            }
-            Ok((String::new(), String::new()))
-        }
+        PrivRequest::RemoveServiceDropin { ref container } => remove_service_dropin(container),
 
         PrivRequest::DaemonReload => daemon_reload().await,
 
@@ -239,25 +217,12 @@ async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String,
             ref agent_name,
             uid,
             gid,
-        } => {
-            validate_agent_name(agent_name)?;
-            let path = socket_dir_path(agent_name);
-            std::os::unix::fs::chown(&path, Some(uid), Some(gid))
-                .with_context(|| format!("chown {} to {uid}:{gid}", path.display()))?;
-            Ok((String::new(), String::new()))
-        }
+        } => chown_socket_dir(agent_name, uid, gid),
 
         PrivRequest::ChmodSocketDir {
             ref agent_name,
             mode,
-        } => {
-            use std::os::unix::fs::PermissionsExt as _;
-            validate_agent_name(agent_name)?;
-            let path = socket_dir_path(agent_name);
-            std::fs::set_permissions(&path, std::fs::Permissions::from_mode(mode))
-                .with_context(|| format!("chmod {:o} {}", mode, path.display()))?;
-            Ok((String::new(), String::new()))
-        }
+        } => chmod_socket_dir(agent_name, mode),
 
         PrivRequest::RunForgeAdmin { ref args } => {
             for arg in args {
@@ -307,6 +272,53 @@ async fn container_flake_action(
     }
 }
 
+/// `WriteNspawnFlags` — validate the container + every bind path, then
+/// write the container's nspawn flag overrides.
+fn handle_write_nspawn_flags(
+    container: &str,
+    binds: &[BindMount],
+    isolation: Option<&NetworkIsolation>,
+) -> Result<(String, String)> {
+    validate_container_system_name(container)?;
+    for bind in binds {
+        validate_bind_path(&bind.host_path)?;
+        validate_bind_path(&bind.container_path)?;
+    }
+    write_nspawn_flags(container, binds, isolation)?;
+    Ok((String::new(), String::new()))
+}
+
+/// `RemoveServiceDropin` — remove the container service's drop-in dir
+/// if present (idempotent).
+fn remove_service_dropin(container: &str) -> Result<(String, String)> {
+    validate_container_system_name(container)?;
+    let dir = format!("/run/systemd/system/container@{container}.service.d");
+    if Path::new(&dir).exists() {
+        std::fs::remove_dir_all(&dir).with_context(|| format!("remove {dir}"))?;
+    }
+    Ok((String::new(), String::new()))
+}
+
+/// `ChownSocketDir` — chown the agent's host socket dir to its
+/// container uid/gid.
+fn chown_socket_dir(agent_name: &str, uid: u32, gid: u32) -> Result<(String, String)> {
+    validate_agent_name(agent_name)?;
+    let path = socket_dir_path(agent_name);
+    std::os::unix::fs::chown(&path, Some(uid), Some(gid))
+        .with_context(|| format!("chown {} to {uid}:{gid}", path.display()))?;
+    Ok((String::new(), String::new()))
+}
+
+/// `ChmodSocketDir` — set the mode on the agent's host socket dir.
+fn chmod_socket_dir(agent_name: &str, mode: u32) -> Result<(String, String)> {
+    use std::os::unix::fs::PermissionsExt as _;
+    validate_agent_name(agent_name)?;
+    let path = socket_dir_path(agent_name);
+    std::fs::set_permissions(&path, std::fs::Permissions::from_mode(mode))
+        .with_context(|| format!("chmod {:o} {}", mode, path.display()))?;
+    Ok((String::new(), String::new()))
+}
+
 /// `WriteResourceLimits` — drop a systemd `MemoryMax`/`CPUQuota`
 /// override into the container service's drop-in dir.
 fn write_resource_limits(