vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

dashboard: POST /matrix-account-login + account-aware hive-priv matrix-token write (BE-2)

Browse source
This commit is contained in:
damocles 2026-06-16 10:49:01 +02:00 • committed by mara
commit 9c480daf0a
6 changed files with 228 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

14
hive-sh4re/src/priv_proto.rs
View file

@ -277,15 +277,23 @@ pub enum PrivRequest {
token: String,
},
/// Write `matrix-token` into `AGENT_STATE_ROOT/<agent_name>/state/matrix-token`.
/// Write a matrix access token into the agent's state dir. With
/// `account: None` it targets the hive-internal `matrix-token`; with
/// `account: Some(name)` it targets `matrix-token-<name>` for an extra
/// (external) account. hive-priv validates both `agent_name` and the
/// `account` suffix as plain identifiers before building the path, so a
/// crafted account name cannot traverse out of the state dir.
///
/// Same semantics as `WriteAgentForgeToken` — validates name, creates
/// dir, writes 0600, chowns to agent owner.
/// Same write semantics as `WriteAgentForgeToken` — validates names,
/// creates dir, writes 0600, chowns to agent owner.
WriteAgentMatrixToken {
/// Logical agent name (validated by `validate_agent_name`).
agent_name: String,
/// Token value. hive-priv appends a trailing newline before writing.
token: String,
/// Extra-account suffix. `None` → `matrix-token` (the hive account);
/// `Some(name)` → `matrix-token-<name>` (validated as a plain ident).
account: Option<String>,
},
/// Restart `hive-matrix-daemon.service` inside an agent container via