store the forge webhook secret and grafana's secret key in bao, seeded from the existing files

swarm-secret-client/src/forge.rs

@@ -16,6 +16,9 @@
 //! `swarm-controller`'s own forge token ([`controller_token_path`]) is the
 //! fourth: the forge's `forgejo-swarm-controller-account`, in its container,
 //! mints it and writes it here, and the controller reads it as it starts.
+//!
+//! The webhook HMAC secret ([`controller_webhook_secret_path`]) is the one
+//! value here the controller mints itself.
 
 use serde::{Deserialize, Serialize};
 
@@ -81,6 +84,30 @@ pub fn controller_token_path() -> Result<String, Error> {
     Ok(format!("{prefix}/forge/token"))
 }
 
+/// The path holding the HMAC secret of the swarm-wide forge webhooks.
+///
+/// `swarm-controller` creates it, seeded from the file it kept before the store
+/// held it, and reads it as it starts; it registers the same value with the
+/// forge. The nix half is `swarm-bao.nix`'s `controllerWebhookSecretLeaf`.
+///
+/// # Errors
+/// Never in practice: the name segment is a constant. The `Result` is
+/// [`principal_prefix`]'s.
+pub fn controller_webhook_secret_path() -> Result<String, Error> {
+    let prefix = principal_prefix(Kind::Controller, crate::matrix::CONTROLLER)?;
+    Ok(format!("{prefix}/forge/webhook-secret"))
+}
+
+/// What [`controller_webhook_secret_path`] holds.
+///
+/// No `Debug` derive: `value` signs every delivery the controller accepts.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct WebhookSecret {
+    /// The hex secret itself. Named `value` like the other single-value
+    /// objects here, so `bao kv get -field=value` reads it.
+    pub value: String,
+}
+
 /// What [`controller_token_path`] holds. No token name beside the value, unlike
 /// [`Credential`]: the mint writes the token alone.
 ///
@@ -188,6 +215,15 @@ mod tests {
         );
     }
 
+    #[test]
+    fn the_webhook_secret_is_under_the_controller_prefix() {
+        // Spelled out: `swarm-bao.nix` grants exactly this string.
+        assert_eq!(
+            controller_webhook_secret_path().expect("a constant segment is legal"),
+            "swarm/controller/swarm-controller/forge/webhook-secret"
+        );
+    }
+
     #[test]
     fn no_hive_policy_reaches_the_controller_token() {
         let policy = crate::policy::effective_hive("alpha");