vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move agent_token from swarm-queue-client to swarm-agent-verify

Browse source 
per #5471, verifiers stop depending on the queue client. the module is
store-free and needs only thiserror, so swarm-agent-verify gains one
dependency and loses its swarm-queue-client edge. consumers import it
from swarm_agent_verify; swarm-logs and swarm-metrics, whose only use of
swarm-queue-client was this module, drop that dependency, as does
swarm-logs-auth.
This commit is contained in:
atlas 2026-10-18 12:18:35 +02:00 • committed by mara
commit 87b1f94ac6
18 changed files with 34 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

11
swarm-agent-verify/src/lib.rs
View file

@ -1,22 +1,27 @@
//! Checking an agent's own credential against the swarm secret store.
//!
//! The token is `swarm_queue_client::agent_token`'s spelling: a prefix, the
//! The token is [`agent_token`]'s spelling: a prefix, the
//! agent's name, and its secret. The name is only a claim. It becomes an
//! identity when the secret equals the one stored at
//! `swarm/agents/<agent>/queue`, and [`verify`] grants nothing on the name
//! alone: every path that does not reach that comparison, and every lookup
//! that fails, is a denial.
//!
//! [`agent_token`] also holds the spelling the agents, `swarm-logs` and
//! `swarm-metrics` format their token in.
//!
//! Two verifiers use this: the queue's auth callout (`swarm-nats-auth`) and
//! the log store's `auth_request` responder (`swarm-logs-auth`). Each reads
//! the store under its own certificate.
pub mod agent_token;
use std::future::Future;
use std::time::Duration;
use crate::agent_token::AgentToken;
use anyhow::Context;
use subtle::ConstantTimeEq;
use swarm_queue_client::agent_token::AgentToken;
use swarm_secret_client::client::{DEFAULT_CERT_MOUNT, Settings};
use swarm_secret_client::queue::{self, AgentCredential};
@ -118,7 +123,7 @@ pub async fn verify(
#[cfg(test)]
mod tests {
use super::*;
use swarm_queue_client::agent_token::parse_agent_token;
use crate::agent_token::parse_agent_token;
/// A store holding at most one credential, or failing outright.
enum Fake {