62 lines
2 KiB
Rust
62 lines
2 KiB
Rust
//! The log and metric read grants: where swarm-controller mirrors an agent's
|
|
//! `logs` and `metrics` permissions in the store, and what the object holds.
|
|
//!
|
|
//! The permissions themselves live in the queue's `agent-permissions` bucket.
|
|
//! The store gateways' `swarm-logs-auth` has no queue access, so it reads this
|
|
//! mirror instead. A leaf that is absent or unreadable is no grant.
|
|
//!
|
|
//! Under the agent's own prefix, so the agent can read its own grant and no
|
|
//! agent can write it: the shared agent policy grants `create` on one other
|
|
//! leaf only.
|
|
|
|
use serde::{Deserialize, Serialize};
|
|
|
|
use crate::{
|
|
Error,
|
|
path::{Kind, principal_prefix},
|
|
};
|
|
|
|
const LEAF: &str = "observability";
|
|
|
|
/// The path holding `agent`'s [`Grant`].
|
|
///
|
|
/// # Errors
|
|
/// [`Error::PathSegment`] when `agent` contains anything but `[A-Za-z0-9_-]`,
|
|
/// which is what keeps one agent's name from addressing another agent's grant.
|
|
pub fn grant_path(agent: &str) -> Result<String, Error> {
|
|
let prefix = principal_prefix(Kind::Agent, agent)?;
|
|
Ok(format!("{prefix}/{LEAF}"))
|
|
}
|
|
|
|
/// What a [`grant_path`] holds: which stores the agent may read.
|
|
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
|
|
pub struct Grant {
|
|
/// The agent holds the `logs` permission.
|
|
#[serde(default)]
|
|
pub logs: bool,
|
|
/// The agent holds the `metrics` permission.
|
|
#[serde(default)]
|
|
pub metrics: bool,
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn the_path_is_under_the_agents_own_prefix() {
|
|
assert_eq!(
|
|
grant_path("atlas").unwrap(),
|
|
"swarm/agents/atlas/observability"
|
|
);
|
|
assert!(grant_path("../argus").is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn a_field_left_out_is_not_granted() {
|
|
let grant: Grant = serde_json::from_str("{}").unwrap();
|
|
assert_eq!(grant, Grant::default());
|
|
let grant: Grant = serde_json::from_str(r#"{"logs":true}"#).unwrap();
|
|
assert_eq!((grant.logs, grant.metrics), (true, false));
|
|
}
|
|
}
|