docs(swarm-authelia-bridge-sock): the bridge reads and writes users.yml, there is no canonical json

The wire crate's module doc and its README both said the bridge "owns both
users.json (canonical) and rendering users.yml internally". That store was
removed — swarm-authelia-bridge/src/store.rs is explicit that users.yml *is*
the store — so both sentences described a file that does not exist, in the
one place a reader goes to learn what the API is for.

The paragraph's actual argument (per-operation rather than
wholesale-replace) is untouched; only the mechanism it cites was wrong.
This commit is contained in:
atlas 2026-08-19 21:08:42 +02:00
commit 78217bc10f
2 changed files with 5 additions and 6 deletions

View file

@ -18,6 +18,6 @@ client logic here, only the request/response shapes both sides import.
One operation today: idempotently ensure an agent exists as an authelia
subject. Deliberately **not** a wholesale-replace-the-file API — the bridge
owns both `users.json` (canonical) and rendering `users.yml` internally; a
reads `users.yml`, changes what the request named, and writes it back; a
caller only ever asks for one user to exist, never sends rendered YAML or a
file blob. See `swarm-authelia-bridge/README.md` for the helper itself.

View file

@ -20,11 +20,10 @@
//! the file it writes. Fully ordinary permissions, no capabilities, no root.
//!
//! **Per-operation, not wholesale-replace.** [`BridgeRequest::EnsureAgentIdentity`]
//! asks for one user to exist; the bridge owns both `users.json` (canonical)
//! and rendering `users.yml` internally. A caller never sends rendered YAML
//! or a file blob — that would invite a last-writer-wins race between
//! independent callers and duplicate the rendering logic on both sides of
//! the wire.
//! asks for one user to exist; the bridge reads `users.yml`, changes what the
//! request named, and writes it back. A caller never sends rendered YAML or a
//! file blob — that would invite a last-writer-wins race between independent
//! callers and duplicate the rendering logic on both sides of the wire.
use serde::{Deserialize, Serialize};