vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: make authelia's operators matrix homeserver admins

Browse source 
swarm-authelia-bridge gains ListOperators, the usernames in authelia's
operator group (`operatorGroup = "admins"`, passed in from
swarm-authelia.nix). Unlike the two agent verbs, which admit any active
token, it answers only the client named by
SWARM_AUTHELIA_BRIDGE_OPERATOR_READER_CLIENT_ID (swarm-controller's
queueClientId) and returns 403 to every other active token: authelia
issues machine tokens to every hive and its agents as well. The bridge's
introspection now models `client_id` to make that check, the same way
swarm-nats-auth's does.

swarm-controller runs a grant-only pass at start and every five minutes:
read the group, map each username to the account an SSO login lands on
(tuwunel lowercases `preferred_username`), skip anyone already joined to
`#admins:<server>` (tuwunel's definition of admin) or without a matrix
account, and send `!admin users make-user-admin <user>` there as @swarm
with the swarm appservice token. Nothing is ever revoked: tuwunel has no
command for it (#4799).

The admin-room calls (alias, joined members, profile, send) go into
swarm-matrix-client next to whoami, keeping its no-body-in-errors rule.

Closes #4585
This commit is contained in:
atlas 2026-10-04 15:21:41 +02:00 • committed by mara
commit 9e7fdb55ae
15 changed files with 787 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

28
swarm-authelia-bridge-sock/src/lib.rs
View file

@ -58,6 +58,13 @@ pub enum BridgeRequest {
/// are separate sets on purpose, and an agent in the roster that has
/// never reported is not the same as one that does not exist.
ListAgentIdentities,
/// The usernames in authelia's operator group — the subjects that reach
/// operator-only surfaces.
///
/// ⚠️ **Only `swarm-controller`'s client may ask.** Every other verb
/// admits any active token; this one names who holds operator rights, so
/// the bridge refuses it to every other caller with `403`.
ListOperators,
}
/// One roster entry.
@ -128,6 +135,14 @@ pub enum BridgeResponse {
/// means a consumer diffing two answers sees real changes only.
agents: Vec<AgentIdentity>,
},
/// The operator group's members, in answer to
/// [`BridgeRequest::ListOperators`].
Operators {
/// Authelia usernames, sorted. Plain strings rather than [`Ident`]:
/// these are humans, and the store admits `.`, `_` and uppercase in a
/// human's name.
operators: Vec<String>,
},
/// The request was rejected or the write failed. Carries a message
/// for the caller to log/propagate, not a typed error enum: the
/// failure modes here (bad username, authelia binary failed, disk
@ -175,6 +190,15 @@ mod tests {
serde_json::json!({"status": "agents", "agents": [{"name": "atlas"}]})
);
let operators = serde_json::to_value(BridgeResponse::Operators {
operators: vec!["mara".to_owned()],
})
.unwrap();
assert_eq!(
operators,
serde_json::json!({"status": "operators", "operators": ["mara"]})
);
let err = serde_json::to_value(BridgeResponse::Error {
message: "boom".to_owned(),
})
@ -205,6 +229,10 @@ mod tests {
let json = serde_json::to_string(&BridgeRequest::ListAgentIdentities).unwrap();
let back: BridgeRequest = serde_json::from_str(&json).unwrap();
assert!(matches!(back, BridgeRequest::ListAgentIdentities));
let json = serde_json::to_string(&BridgeRequest::ListOperators).unwrap();
let back: BridgeRequest = serde_json::from_str(&json).unwrap();
assert!(matches!(back, BridgeRequest::ListOperators));
}
/// An empty roster must be a roster, not an absence: `{"agents":[]}`