vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: re-read the forge token from the store when the forge rejects it

Browse source 
The controller read its forge token from the swarm secret store once, when
its client slot filled, and kept sending it until the daemon restarted. A
token the forge re-minted or revoked left every forge-backed path failing
with 401 until someone restarted the controller, and a restart drops the
runtime-only job graph.

Every forge request now goes through `forge::api::Api::call`. On a 401 it
asks a `StoredSecret` (the queue clients' debounced, single-flight re-read
with backoff) for a token to try instead, rebuilds the forgejo client with
it, and sends the request once more. A second 401, or a store still holding
the refused token, surfaces the error as before. Only 401 counts: unlike an
IdP, the forge answers 400 to a malformed request, and a re-read started by
one would put a real 401 that follows inside the backoff.

forgejo-api bakes the token into its own reqwest client's default headers
and takes no client or middleware from outside, so there is no single
request function to hook. Each `self.api.<endpoint>(..)` site becomes
`self.api.call(|api| api.<endpoint>(..).into_future())`; option structs a
site moved into the call are cloned, since the closure can run twice. The
`OnceLock<Arc<Client>>` slot and its `get()` callers are unchanged.

Refs #5017
This commit is contained in:
atlas 2026-10-13 21:38:35 +02:00 • committed by mara
commit 6ba29c4d33
11 changed files with 638 additions and 192 deletions
Download patch file Download diff file Expand all files Collapse all files

54
swarm-controller/src/forge/hive_token.rs
View file

@ -145,7 +145,7 @@ impl Client {
self.ensure_hive_user(hive, &login).await?;
let team = self.ensure_hives_team().await?;
self.api
.org_add_team_member(team, &login)
.call(|api| api.org_add_team_member(team, &login).into_future())
.await
.with_context(|| format!("adding {login} to {CONFIG_ORG}/{HIVES_TEAM}"))?;
@ -214,7 +214,7 @@ impl Client {
self.create_user(login, &hive_email(hive)).await?;
let user = self
.api
.user_get(login)
.call(|api| api.user_get(login).into_future())
.await
.with_context(|| format!("read forge user {login}"))?;
if !is_hive_account(hive, user.email.as_deref()) {
@ -226,7 +226,10 @@ impl Client {
);
}
self.api
.admin_edit_user(login, super::repo_creation_lockdown(login))
.call(|api| {
api.admin_edit_user(login, super::repo_creation_lockdown(login))
.into_future()
})
.await
.with_context(|| format!("disable repo creation for forge user {login}"))?;
Ok(())
@ -240,18 +243,21 @@ impl Client {
TeamSeen::Matches(id) => Ok(id),
TeamSeen::Drifted(id) => {
self.api
.org_edit_team(
id,
EditTeamOption {
can_create_org_repo: Some(false),
description: Some(HIVES_TEAM_DESCRIPTION.to_owned()),
includes_all_repositories: Some(true),
name: HIVES_TEAM.to_owned(),
permission: Some(EditTeamOptionPermission::Read),
units: Some(HIVES_TEAM_UNITS.map(str::to_owned).to_vec()),
units_map: None,
},
)
.call(|api| {
api.org_edit_team(
id,
EditTeamOption {
can_create_org_repo: Some(false),
description: Some(HIVES_TEAM_DESCRIPTION.to_owned()),
includes_all_repositories: Some(true),
name: HIVES_TEAM.to_owned(),
permission: Some(EditTeamOptionPermission::Read),
units: Some(HIVES_TEAM_UNITS.map(str::to_owned).to_vec()),
units_map: None,
},
)
.into_future()
})
.await
.with_context(|| {
format!("reconcile {CONFIG_ORG}/{HIVES_TEAM} team settings")
@ -274,7 +280,11 @@ impl Client {
units: Some(HIVES_TEAM_UNITS.map(str::to_owned).to_vec()),
units_map: None,
};
match self.api.org_create_team(CONFIG_ORG, team).await {
match self
.api
.call(|api| api.org_create_team(CONFIG_ORG, team.clone()).into_future())
.await
{
Ok(created) => {
tracing::info!("swarm forge: created {CONFIG_ORG}/{HIVES_TEAM} team");
created
@ -293,7 +303,11 @@ impl Client {
}
pub(super) async fn observe_hives_team(&self) -> TeamSeen {
match self.api.org_list_teams(CONFIG_ORG).await {
match self
.api
.call(|api| api.org_list_teams(CONFIG_ORG).into_future())
.await
{
Ok((_, teams)) => teams
.into_iter()
.find(|t| t.name.as_deref() == Some(HIVES_TEAM))
@ -342,7 +356,11 @@ impl Client {
};
let member = match team {
TeamSeen::Matches(id) | TeamSeen::Drifted(id) => {
match self.api.org_list_team_member(id, &login).await {
match self
.api
.call(|api| api.org_list_team_member(id, &login).into_future())
.await
{
Ok(_) => Some(true),
Err(e) if is_not_found(&e) => Some(false),
Err(e) => {