vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

make squid's allowed domains editable at runtime in the swarm ui

Browse source
This commit is contained in:
atlas 2026-10-28 20:39:22 +01:00 • committed by mara
commit c9abc2a42b
1 changed files with 2307 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

29
swarm-nats-auth/src/policy.rs
View file

@ -610,6 +610,9 @@ impl Policy {
"$JS.API.DIRECT.GET.{}.>",
swarm_wire::agent_permissions::STREAM
));
// The egress allow-list (`swarm_wire::egress_allow`): one key, read with
// one direct get, so exactly that subject and no other key of the bucket.
subjects.push(swarm_wire::egress_allow::direct_get_subject());
// The archetype an agent was created from
// (`swarm_queue_client::agent_archetype`), read the same way and every
// key for the same reason.
@ -955,6 +958,32 @@ mod tests {
}
}
/// A hive reads the swarm's egress allow-list and can change none of it,
/// and no other key of its bucket.
#[test]
fn a_hive_may_read_the_egress_allow_list_and_write_none() {
use swarm_wire::egress_allow::{STREAM, direct_get_subject, key_subject};
let p = policy()
.permissions("hive-alpha")
.expect("a hive is admitted");
let may = |subject: &str| p.publish.iter().any(|g| covers(g, subject));
assert!(may(&direct_get_subject()), "cannot read the list");
for forbidden in [
key_subject(),
format!("$JS.API.STREAM.CREATE.{STREAM}"),
format!("$JS.API.STREAM.UPDATE.{STREAM}"),
format!("$JS.API.STREAM.DELETE.{STREAM}"),
format!("$JS.API.STREAM.PURGE.{STREAM}"),
format!("$JS.API.CONSUMER.CREATE.{STREAM}"),
// Another key of the same bucket.
format!("$JS.API.DIRECT.GET.{STREAM}.$KV.egress-allow.other"),
] {
assert!(!may(&forbidden), "hive alpha may publish {forbidden}");
}
}
/// A hive reads any agent's archetype and can change none of them, and the
/// grant reaches no other bucket.
#[test]