vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: unrestricted_internet flag on the agent permissions record, unset reads as on, create writes false

Browse source
This commit is contained in:
atlas 2026-10-27 11:29:06 +01:00 • committed by mara
commit 8699857024
2 changed files with 381 additions and 107 deletions
Download patch file Download diff file Expand all files Collapse all files

5
swarm-controller-api/src/agents.rs
View file

@ -81,6 +81,10 @@ pub struct CreateAgentRequest {
#[serde(default, skip_serializing_if = "Option::is_none")]
#[cfg_attr(feature = "schema", schema(value_type = Option<Vec<String>>))]
pub permissions: Option<Vec<Permission>>,
/// Whether the agent's traffic leaves the host unfiltered. Left out, the
/// agent is created with `false`.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub unrestricted_internet: Option<bool>,
/// The archetype to build the agent from, one `GET /api/archetypes`
/// lists. The agent then gets no `agent-configs/<name>` repo: its hive
/// builds it from the archetype's module. Absent is a custom agent.
@ -116,6 +120,7 @@ mod tests {
limits: None,
inference: None,
permissions: None,
unrestricted_internet: None,
archetype: None,
agents_md: None,
};

17
swarm-controller-api/src/permissions.rs
View file

@ -5,7 +5,8 @@ use hive_types::Permission;
use serde::{Deserialize, Serialize};
/// One agent's permissions. A field left out is not set by the swarm, and the
/// compiled-in default applies; an empty list grants nothing.
/// compiled-in default applies; an empty list grants nothing. A
/// `PUT` that leaves out `unrestricted_internet` keeps the stored value.
#[derive(Debug, Default, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[cfg_attr(feature = "schema", derive(utoipa::ToSchema))]
#[serde(deny_unknown_fields)]
@ -18,6 +19,11 @@ pub struct Permissions {
schema(value_type = Option<Vec<String>>, example = json!(["messaging", "meta", "inbox", "execution"]))
)]
pub permissions: Option<Vec<Permission>>,
/// Whether the agent's traffic leaves the host unfiltered. Absent in a
/// `GET` means the swarm never set it, which counts as on. Absent in a
/// `PUT` keeps the stored value.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub unrestricted_internet: Option<bool>,
}
#[cfg(test)]
@ -32,12 +38,21 @@ mod tests {
(
Permissions {
permissions: Some(vec![]),
unrestricted_internet: None,
},
r#"{"permissions":[]}"#,
),
(
Permissions {
permissions: None,
unrestricted_internet: Some(false),
},
r#"{"unrestricted_internet":false}"#,
),
(
Permissions {
permissions: Some(vec![Permission::Messaging, Permission::ManageRootAgent]),
unrestricted_internet: None,
},
r#"{"permissions":["messaging","manage_root_agent"]}"#,
),