vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats-auth: a review classifier hears try-outs and answers by reply only

Browse source 
swarm-queue-client gains review_classifier: the try-out subject, the
request and reply that travel on it, and the deadlines both ends share.
The controller's reader grant may publish the subject; a client named
with --review-classifier-client may subscribe to it and its inbox, and
answers under NATS allow_responses (resp in the user JWT) within the
run deadline. Every other client id is still denied.
This commit is contained in:
atlas 2026-10-12 03:03:52 +02:00 • committed by mara
commit 98c873965b
8 changed files with 354 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
swarm-nats-auth/src/main.rs
View file

@ -157,6 +157,11 @@ struct Args {
#[arg(long = "agent-token-publish-subject")]
agent_token_publish_subjects: Vec<String>,
/// Client ids that answer the review classifier's try-out requests.
/// Repeatable, empty by default, which denies such a client.
#[arg(long = "review-classifier-client")]
review_classifier_clients: Vec<String>,
/// Role on the secret store's `cert` auth mount this responder logs in
/// as to read the callout keys, its own OIDC client secret and agent
/// credentials. The store is found
@ -220,7 +225,8 @@ async fn serve(args: &Args) -> anyhow::Result<()> {
args.reader_clients.clone(),
args.hive_publish_subjects.clone(),
)?
.with_agent_token_subjects(args.agent_token_publish_subjects.clone())?;
.with_agent_token_subjects(args.agent_token_publish_subjects.clone())?
.with_review_classifiers(args.review_classifier_clients.clone());
let http = reqwest::Client::new();
let settings = swarm_secret_client::client::Settings::from_env()
.context("reading the secret store's address and this responder's identity")?;