vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(swarm): move swarm-nats-auth's deps to the workspace

Browse source 
Per mara on the PR: all deps go into workspace level so versions stay
consistent. async-nats, data-encoding, nkeys and nats-jwt are new
[workspace.dependencies] entries; sha2 and futures-util now come from
there.

The crate had asked for sha2 0.10 while the workspace standard is 0.11,
and for the futures facade where the workspace carries futures-util. Both
resolved without adding a Cargo.lock entry - each was already in the tree
via something else - so the drift was invisible in the lock and would only
have surfaced as two versions of a hashing crate in one binary.
This commit is contained in:
atlas 2026-08-14 23:06:47 +02:00 • committed by mara
commit 9b35be2a24
4 changed files with 29 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

34
swarm-nats-auth/Cargo.toml
View file

@ -10,37 +10,21 @@ path = "src/main.rs"
[dependencies]
anyhow.workspace = true
async-nats.workspace = true
clap.workspace = true
# base64url for decoding the inbound request JWT.
data-encoding.workspace = true
# StreamExt::next on the subscription: async-nats returns a Stream.
futures-util.workspace = true
nkeys.workspace = true
reqwest.workspace = true
serde.workspace = true
serde_json.workspace = true
# The jti digest: base32hex(sha256(claims)) over every JWT this crate signs.
sha2.workspace = true
tokio.workspace = true
tracing.workspace = true
tracing-subscriber.workspace = true
# The NATS protocol client. `default-features = false` because the default set
# is broad - jetstream, kv, object-store, websockets, service - and a callout
# responder speaks none of them. What is named here is the whole requirement:
# the server generation we actually deploy, nkey auth, and a TLS backend.
# (Checked what dropping the defaults costs, the way `internal-logs` was once
# lost that way: nothing in the unused set is a diagnostic.)
async-nats = { version = "0.50", default-features = false, features = [
"server_2_14",
"nkeys",
"ring",
] }
# base64url for decoding the inbound request JWT. Already in the tree via
# nkeys; named directly because this crate uses it directly.
data-encoding = "2"
# StreamExt::next on the subscription. async-nats returns a Stream, not an
# iterator, and futures is already in the tree.
futures = "0.3"
# nkey seed handling + signing. The primitives (ed25519-dalek, data-encoding)
# are already in the tree, but the nkey *format* - ed25519 + base32 + CRC16 -
# is not, and hand-rolling a key format on an auth path is how you get a
# CRC bug nobody reviews.
nkeys = "0.4"
# The jti digest: base32hex(sha256(claims)) over every JWT this crate signs.
sha2 = "0.10"
[dev-dependencies]
# A TEST ORACLE, not part of the production path. Neither JWT this crate emits
@ -51,7 +35,7 @@ sha2 = "0.10"
# is checked *against*: `respond::tests::hand_built_matches_the_reference`
# builds a user token both ways and requires byte equality, on the one shape
# nats-jwt does model.
nats-jwt = "0.3"
nats-jwt.workspace = true
[lints]
workspace = true

2
swarm-nats-auth/src/main.rs
View file

@ -25,7 +25,7 @@ use std::path::PathBuf;
use anyhow::Context;
use clap::Parser;
use futures::StreamExt;
use futures_util::StreamExt;
mod introspect;
mod request;