vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: re-read the forge token from the store when the forge rejects it

Browse source 
The controller read its forge token from the swarm secret store once, when
its client slot filled, and kept sending it until the daemon restarted. A
token the forge re-minted or revoked left every forge-backed path failing
with 401 until someone restarted the controller, and a restart drops the
runtime-only job graph.

Every forge request now goes through `forge::api::Api::call`. On a 401 it
asks a `StoredSecret` (the queue clients' debounced, single-flight re-read
with backoff) for a token to try instead, rebuilds the forgejo client with
it, and sends the request once more. A second 401, or a store still holding
the refused token, surfaces the error as before. Only 401 counts: unlike an
IdP, the forge answers 400 to a malformed request, and a re-read started by
one would put a real 401 that follows inside the backoff.

forgejo-api bakes the token into its own reqwest client's default headers
and takes no client or middleware from outside, so there is no single
request function to hook. Each `self.api.<endpoint>(..)` site becomes
`self.api.call(|api| api.<endpoint>(..).into_future())`; option structs a
site moved into the call are cloned, since the closure can run twice. The
`OnceLock<Arc<Client>>` slot and its `get()` callers are unchanged.

Refs #5017
This commit is contained in:
atlas 2026-10-13 21:38:35 +02:00 • committed by mara
commit 6ba29c4d33
1 changed files with 638 additions and 192 deletions
Download patch file Download diff file Expand all files Collapse all files

19
swarm-controller/src/forge/docs_grant.rs
View file

@ -61,7 +61,10 @@ impl Client {
pub async fn grant_docs_read(&self, agent: &str) -> Result<()> {
match self
.api
.repo_get_repo_permissions(SHARED_ORG, SHARED_DOCS_REPO, agent)
.call(|api| {
api.repo_get_repo_permissions(SHARED_ORG, SHARED_DOCS_REPO, agent)
.into_future()
})
.await
{
Ok(p) if holds_read(&p) => return Ok(()),
@ -86,7 +89,10 @@ impl Client {
async fn observe_grant(&self, agent: &str) -> Observed {
match self
.api
.repo_check_collaborator(SHARED_ORG, SHARED_DOCS_REPO, agent)
.call(|api| {
api.repo_check_collaborator(SHARED_ORG, SHARED_DOCS_REPO, agent)
.into_future()
})
.await
{
Ok(()) => Observed::Granted,
@ -102,7 +108,11 @@ impl Client {
/// say. A missing repo makes every collaborator check answer 404 too, so
/// it has to be told apart from "not a collaborator" before they run.
async fn docs_repo_exists(&self) -> Option<bool> {
match self.api.repo_get(SHARED_ORG, SHARED_DOCS_REPO).await {
match self
.api
.call(|api| api.repo_get(SHARED_ORG, SHARED_DOCS_REPO).into_future())
.await
{
Ok(_) => Some(true),
Err(e) if is_not_found(&e) => Some(false),
Err(e) => {
@ -206,7 +216,6 @@ mod tests {
use axum::extract::{Path, State};
use axum::http::{StatusCode, header::CONTENT_TYPE};
use forgejo_api::{Auth, Forgejo};
use super::*;
@ -255,7 +264,7 @@ mod tests {
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
let url = url::Url::parse(&format!("http://{}/", listener.local_addr().unwrap())).unwrap();
tokio::spawn(async move { axum::serve(listener, app).await });
let api = Forgejo::new(Auth::Token("stub-token"), url.clone()).unwrap();
let api = crate::forge::api::tests::fixed(url.clone(), "stub-token");
(Client { api, url }, docs)
}