vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

swarm-controller: refuse a new agent name the forge would reject

Browse source 
Every agent becomes a Forgejo user of the same name, and nothing upstream
of `CreateForgeUser` knew what Forgejo refuses: `admin`, `api`, `foo-` or a
41-character name passed name validation and failed one node into
provisioning with Forgejo's 422.

`nix/reserved-names.nix` gains the 22 reserved usernames of Forgejo
v16.0.5 (`models/user/user.go:639-680`) that `[a-z0-9-]` can spell, and
the bare `-` (`models/repo/repo.go:67`). The dot and underscore entries are
left out, since our charset cannot produce them. The header's admission
rule grows a third class — a username the forge refuses — because that is
a failure behind the refusal.

The shape rules are not literals, so they live in
`hive_types::forge_username_violation`: no leading `-`, no `--`, no
trailing `-`, at most 40 characters. Beside `is_reserved_name`, not in
`Ident::parse`: an `Ident` is also a hive, label, account and subagent
name, and parsing runs on every read of an existing name.

`create_agent` used to WARN on a reserved name, deliberately: an operator
with agents already created under a colliding name would otherwise be
unable to re-run creation. That reason is kept, and narrowed to what it
protects. A name breaking either rule is now refused with a 400 naming the
rule when the name is NOT in the swarm roster, and still only warned
about when it is, so re-creating an existing agent keeps working. The
roster is read only for a rule-breaking name; when it cannot be read, a new
name and an existing one look alike, and this warns as before. The
hive-collision warning is unchanged.
This commit is contained in:
atlas 2026-09-24 14:30:31 +02:00 • committed by mara
commit 88e571a463
3 changed files with 327 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

37
nix/reserved-names.nix
View file

@ -22,9 +22,9 @@
# here forbids it for both. That is the point: two lists is how they drift.
#
# ⚠️ Every entry must be a value some component actually PRODUCES as a message
# `from`/`to`, or a component name the collector builds pipelines from — not a
# word that merely looked risky. A name in here that nothing emits is a refusal
# with no failure behind it.
# `from`/`to`, a component name the collector builds pipelines from, or a
# username the forge refuses — not a word that merely looked risky. A name in
# here that nothing emits or refuses is a refusal with no failure behind it.
#
# ⚠️ Matched by EQUALITY. Words forbidden *inside* a hive name live in
# `./reserved-hive-fragments.nix` — read its header before merging the two.
@ -59,6 +59,37 @@
# pushes into a pipeline that routes nowhere. Previously enforced only
# against hive names, in `swarm-otel.nix`'s own `reservedOwners`.
"swarm"
# ---- usernames the forge refuses -------------------------------------
# Every agent becomes a Forgejo user of the same name, and Forgejo answers
# these with a 422 one node into provisioning: `reservedUsernames` in
# Forgejo v16.0.5 `models/user/user.go:639-680`, and the bare `-` that
# `models/repo/repo.go:67` also refuses as a repo name. Forgejo's shape
# rules are not literals and live in `hive_types::forge_username_violation`.
# Its entries containing `.` or `_` are left out: `[a-z0-9-]` cannot spell them.
"-"
"admin"
"api"
"assets"
"attachments"
"avatar"
"avatars"
"captcha"
"explore"
"forgejo-actions"
"ghost"
"gitea-actions"
"issues"
"login"
"metrics"
"milestones"
"notifications"
"org"
"pulls"
"repo"
"repo-avatars"
"user"
"v2"
]
# Deliberately absent, and it is a load-bearing omission:
#