//! The controller's own identity at the swarm's secret store.
//!
//! Two paths log in: writing an agent's credential, and writing the read
//! grant that lets a hive fetch one back. Both present the same certificate
//! under the same role, so the role is named here rather than at each caller.

use swarm_secret_client::{Error, SecretStore};

/// The cert-auth role the controller logs in under.
///
/// `nix/host-modules/swarm-bao.nix`'s `controllerPolicyName` creates the role,
/// names the policy after it, and `nix/module-eval.nix` pins the literal.
///
/// ⚠️ Not the certificate's CN. The role *matches on* the CN
/// (`allowed_common_names`), so the two are deliberately different strings.
pub const CERT_ROLE: &str = "swarm-controller";

/// Log in to the store with this deployment's certificate.
///
/// # Errors
/// Whatever [`SecretStore::from_env`] raises — an unset `BAO_*` variable, an
/// unreadable identity file, or a store that refuses the login.
pub async fn connect() -> Result<SecretStore, Error> {
    SecretStore::from_env(CERT_ROLE).await
}