vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: no doc says the agent client is minted any more

Browse source
This commit is contained in:
atlas 2026-10-13 10:25:19 +02:00 • committed by mara
commit c00fd99112
3 changed files with 9 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/module-eval/name-guards.nix
View file

@ -226,7 +226,7 @@ let
}
{
# The substring guard has to work with the collector off too.
# `h1-agent` mints exactly the client id hive `h1`'s agents present.
# `h1-agent` would give the hive a client id the responder refuses.
name = "a hive name containing a composed-identifier word is refused, with the collector off";
ok = fragmentGuardFired hiveNameWithComposedWord;
}

2
nix/reserved-hive-fragments.nix
View file

@ -10,7 +10,7 @@
# auth-callout responder strips to decide which hive a connection is.
"hive"
# `hive-<name>-agent` — an id the queue's responder refuses. A hive named
# `foo-agent` would mint exactly that id for itself.
# `foo-agent` would get a client id the responder refuses.
"agent"
# Also an exact-match entry next door, for the collector's `<kind>/<owner>`
# components. Here because it is the word this swarm composes identifiers

17
swarm-nats-auth/src/policy.rs
View file

@ -444,16 +444,13 @@ impl Policy {
/// suffix stripped as well, so `hive-foo-agent` answers `foo`. Two more on
/// top:
///
/// - The agent client is minted per **hive**, so this answers *whose
/// agents*, never *which agent*. Two agents on one hive are
/// indistinguishable here — not a gap in the parsing but the identity
/// itself, which does not carry the agent.
/// - A hive genuinely named `foo-agent` mints `hive-foo-agent` and is
/// therefore **indistinguishable from hive `foo`'s agents** right here.
/// Unguardable from inside this responder, which has no roster (see
/// [`Self::hive_name`]) — `swarm-authelia.nix` asserts it at eval, where
/// the roster is known, so the deployment fails to build rather than
/// minting two principals with one id.
/// - The id carries the hive and never the agent, so this answers *whose
/// agents*, never *which agent*.
/// - A hive genuinely named `foo-agent` has the client id `hive-foo-agent`,
/// which this reads as hive `foo`'s agent client, an id the responder
/// refuses. Unguardable from inside this responder, which has no roster
/// (see [`Self::hive_name`]) — `swarm-authelia.nix` asserts it at eval,
/// where the roster is known, so the deployment fails to build.
fn agent_hive<'a>(&self, client_id: &'a str) -> Option<&'a str> {
client_id
.strip_prefix(&self.hive_prefix)?