vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

read the cache facts on the hive and let hives read the closure bucket

Browse source 
hive-c0re reads its cache facts from the store every five minutes and writes /run/hyperhive/attic/{netrc,substituter,public-key}, each 0600. it accepts only an https url, so the pull token never travels in clear. hives get a read grant on the agent-closures bucket, and swarm-queue-client a reader for it. part 2 of 3: nothing uses the files or the reader until the probe lands.
This commit is contained in:
atlas 2026-10-27 17:32:20 +01:00 • committed by mara
commit a55d55e494
1 changed files with 425 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

39
swarm-nats-auth/src/policy.rs
View file

@ -617,6 +617,13 @@ impl Policy {
"$JS.API.DIRECT.GET.{}.>",
swarm_queue_client::agent_archetype::STREAM
));
// The latest closure the swarm built for each agent
// (`swarm_wire::agent_closures`), read the same way and every key for
// the same reason.
subjects.push(format!(
"$JS.API.DIRECT.GET.{}.>",
swarm_wire::agent_closures::STREAM
));
// The one-shot import of the grants this hive's meta repo held, sent
// as a request on this hive's own subject: the controller takes the
// hive from the subject, so one hive cannot import for another.
@ -980,6 +987,38 @@ mod tests {
)));
}
/// A hive reads any agent's closure record and can change none, and the
/// grant reaches no other bucket.
#[test]
fn a_hive_may_read_every_agents_closure_and_write_none() {
use swarm_wire::agent_closures::{STREAM, key_subject};
let p = policy()
.permissions("hive-alpha")
.expect("a hive is admitted");
let may = |subject: &str| p.publish.iter().any(|g| covers(g, subject));
for agent in ["atlas", "iris"] {
let read = format!("$JS.API.DIRECT.GET.{STREAM}.{}", key_subject(agent));
assert!(may(&read), "cannot read {agent}");
}
// A neighbouring bucket stays closed.
assert!(!may(&swarm_wire::agent_schedules::direct_get_subject(
"atlas"
)));
for forbidden in [
key_subject("atlas"),
format!("$JS.API.STREAM.CREATE.{STREAM}"),
format!("$JS.API.STREAM.UPDATE.{STREAM}"),
format!("$JS.API.STREAM.DELETE.{STREAM}"),
format!("$JS.API.STREAM.PURGE.{STREAM}"),
format!("$JS.API.STREAM.MSG.DELETE.{STREAM}"),
format!("$JS.API.CONSUMER.CREATE.{STREAM}"),
] {
assert!(!may(&forbidden), "hive alpha may publish {forbidden}");
}
}
/// A hive reads any agent's permissions and can change none of them; an
/// agent, with the template `swarm-nats.nix` passes, reads its own key and
/// no other, and writes none.