derive per-agent egress entries from operator-linked accounts

swarm-controller/src/linked_accounts.rs

@@ -54,17 +54,17 @@ pub enum AccountKind {
 /// One account linked to an agent. Never carries the credential.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, ToSchema)]
 pub struct LinkedAccount {
-    kind: AccountKind,
+    pub(crate) kind: AccountKind,
     /// The matrix account name, the forge label, `github`, or `backend-env`.
     #[schema(example = "main")]
-    name: String,
+    pub(crate) name: String,
     /// The matrix homeserver, the forge base URL, or `github.com`. `None` for a
     /// matrix account stored without a homeserver.
     #[schema(example = "https://matrix.example.org")]
-    host: Option<String>,
+    pub(crate) host: Option<String>,
     /// The agent's own matrix account, which the swarm mints and an operator
     /// does not link.
-    reserved: bool,
+    pub(crate) reserved: bool,
 }
 
 /// The store calls a listing, a link or a delete makes, so a test can stand in
@@ -489,6 +489,8 @@ pub async fn delete_matrix_account(
         tracing::warn!(%hive, %agent, %account, error = ?e, "deleting the matrix account failed");
         e.problem()
     })?;
+    crate::link_egress::removed(&state, &agent, &crate::link_egress::matrix_source(&account))
+        .await?;
 
     tracing::info!(%hive, %agent, %account, revoked = query.revoke, "matrix account deleted");
     Ok(StatusCode::NO_CONTENT)
@@ -536,6 +538,7 @@ pub async fn delete_forge_account(
             tracing::warn!(%hive, %agent, %label, error = ?e, "deleting the forge account failed");
             e.problem()
         })?;
+    crate::link_egress::removed(&state, &agent, &crate::link_egress::forge_source(&label)).await?;
 
     tracing::info!(%hive, %agent, %label, "forge account deleted");
     Ok(StatusCode::NO_CONTENT)
@@ -578,6 +581,7 @@ pub async fn delete_github_account(
             tracing::warn!(%hive, %agent, error = ?e, "deleting the github token failed");
             e.problem()
         })?;
+    crate::link_egress::removed(&state, &agent, &crate::link_egress::github_source()).await?;
 
     tracing::info!(%hive, %agent, "github token deleted");
     Ok(StatusCode::NO_CONTENT)