560f727797
`write_policy` called `vaultrs::sys::policy::set`, which targets `sys/policy/<name>` — the deprecated alias the store gates as a path of its own. Every grant in this tree names `sys/policies/acl/hive-*`, so a correctly-scoped controller was refused with a 403 and no hive read policy has ever been written, on any deployment. The doc comment three lines above the call already named the modern path; the code is what moves to meet it. vaultrs has no endpoint for that path (`grep policies/acl` over 0.8.0: zero hits, against 8 for `sys/policy`), so this defines one over its own endpoint machinery — which keeps the client's token header and `/v1` prefix middleware rather than re-deriving them. The alternative was to widen the grant to cover the legacy path. This way needs no policy change at all: the deployed grant already permits the write, so no store is re-bootstrapped and nothing is entrenched on an alias upstream has deprecated. Two tests pin the path and the body shape. The reason this survived deployment is that nothing in the tree ever asserted either one. Closes #4177.
221 lines
7.9 KiB
TOML
221 lines
7.9 KiB
TOML
[workspace]
|
|
resolver = "3"
|
|
members = [
|
|
"hive-agent",
|
|
"hive-agent-mcp",
|
|
"hive-agent-sock",
|
|
"hive-core-agent-sock",
|
|
"hive-bash-mcp",
|
|
"hive-c0re",
|
|
"hive-screen-mcp",
|
|
"hive-forge",
|
|
"hive-forge-notify",
|
|
"hive-host-sock",
|
|
"hive-jobq",
|
|
"hive-jobq-metrics",
|
|
"hive-jobq-wire",
|
|
"hive-matrix-mcp",
|
|
"hive-metric",
|
|
"hive-priv",
|
|
"hive-priv-sock",
|
|
"hive-sh4re",
|
|
"hive-sock-client",
|
|
"hive-subagent-mcp",
|
|
"hive-types",
|
|
"hivectl",
|
|
"swarm-authelia-bridge",
|
|
"swarm-authelia-bridge-sock",
|
|
"swarm-controller",
|
|
"swarm-nats-auth",
|
|
"swarm-queue-client",
|
|
"swarm-secret-client",
|
|
"swarmctl",
|
|
]
|
|
|
|
[workspace.package]
|
|
edition = "2024"
|
|
version = "0.1.0"
|
|
|
|
[workspace.lints.clippy]
|
|
# Pedantic is a hard error (locally + in CI): we want pedantic lints
|
|
# gated, so a toolchain bump that adds a new one reds the build until the
|
|
# code is updated rather than sliding in unnoticed. Priority -1 keeps the
|
|
# specific allows below winning over the group.
|
|
pedantic = { level = "deny", priority = -1 }
|
|
# Tolerated stylistic pedantic lints (noisy, not actionable).
|
|
missing_errors_doc = "allow"
|
|
missing_panics_doc = "allow"
|
|
module_name_repetitions = "allow"
|
|
|
|
[workspace.lints.rustdoc]
|
|
# Doc-link rot has no other discoverer: clippy does not read intra-doc
|
|
# links, `cargo test` does not, and nothing else builds docs. A `[`Foo`]`
|
|
# pointing at a renamed, moved or deleted item renders as plain text and
|
|
# misleads the next reader — worse than no link, since it names something
|
|
# and so sends them looking.
|
|
#
|
|
# Here rather than in `RUSTDOCFLAGS` on the CI check, so a plain local
|
|
# `cargo doc` fails the same way CI does. A gate you only meet in CI is a
|
|
# gate you meet too late.
|
|
broken_intra_doc_links = "deny"
|
|
private_intra_doc_links = "deny"
|
|
invalid_html_tags = "deny"
|
|
redundant_explicit_links = "deny"
|
|
bare_urls = "deny"
|
|
unescaped_backticks = "deny"
|
|
|
|
[workspace.dependencies]
|
|
anyhow = "1"
|
|
libc = "0.2"
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
base64 = "0.22"
|
|
bcrypt = "0.19"
|
|
chrono = { version = "0.4", default-features = false, features = [
|
|
"clock",
|
|
"serde",
|
|
"std",
|
|
] }
|
|
clap = { version = "4", features = ["derive"] }
|
|
clap_complete = "4"
|
|
enumflags2 = { version = "0.7.12", features = ["serde"] }
|
|
indicatif = "0.18"
|
|
hive-sh4re = { path = "hive-sh4re" }
|
|
hive-agent-sock = { path = "hive-agent-sock" }
|
|
hive-jobq = { path = "hive-jobq" }
|
|
hive-jobq-metrics = { path = "hive-jobq-metrics" }
|
|
hive-jobq-wire = { path = "hive-jobq-wire" }
|
|
hive-core-agent-sock = { path = "hive-core-agent-sock" }
|
|
hive-claude = "0.1.1"
|
|
hive-host-sock = { path = "hive-host-sock" }
|
|
hive-priv-sock = { path = "hive-priv-sock" }
|
|
hive-sock-client = { path = "hive-sock-client" }
|
|
hive-types = { path = "hive-types" }
|
|
swarm-authelia-bridge-sock = { path = "swarm-authelia-bridge-sock" }
|
|
swarm-queue-client = { path = "swarm-queue-client" }
|
|
swarm-secret-client = { path = "swarm-secret-client" }
|
|
thiserror = "2"
|
|
vaultrs = "0.8"
|
|
# vaultrs's transport crates. Direct dependencies because one endpoint is
|
|
# defined here rather than by it; both versions must stay the ones vaultrs
|
|
# resolves, since its `exec_with_empty` takes *its* `Endpoint` trait.
|
|
rustify = "0.7"
|
|
rustify_derive = "0.5"
|
|
tower-http = { version = "0.7", features = ["fs"] }
|
|
uuid = { version = "1", features = ["v4"] }
|
|
rmcp = { version = "2", default-features = false, features = [
|
|
"server",
|
|
"macros",
|
|
"transport-io",
|
|
"transport-streamable-http-server",
|
|
] }
|
|
rusqlite = { version = "0.37" }
|
|
schemars = "1.0"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
similar = "2"
|
|
tokio = { version = "1", features = [
|
|
"fs",
|
|
"io-util",
|
|
"macros",
|
|
"net",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
"sync",
|
|
"time",
|
|
] }
|
|
tokio-stream = { version = "0.1", features = ["sync"] }
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
reqwest = { version = "0.13", default-features = false, features = [
|
|
# RFC 7662 introspection posts an urlencoded body; without this,
|
|
# `.form()` does not exist and the alternative is percent-encoding a
|
|
# credential by hand.
|
|
"form",
|
|
"json",
|
|
"rustls",
|
|
] }
|
|
hyper = { version = "1", features = ["client", "http1"] }
|
|
hyper-util = { version = "0.1", features = ["tokio"] }
|
|
# OTEL SDK, shared by every crate that pushes metrics (hive-c0re, hive-metric,
|
|
# swarm-controller). The blocking OTLP client is deliberate everywhere it's
|
|
# used: the metrics SDK's `PeriodicReader` drives its export from a
|
|
# background thread with no Tokio reactor, where the async client panics.
|
|
# `default-features = false` on the OTLP crate drops its own diagnostics
|
|
# ("internal-logs") unless a member opts back in — hive-c0re does, via
|
|
# `{ workspace = true, features = ["internal-logs"] }`.
|
|
opentelemetry = "0.32"
|
|
opentelemetry_sdk = { version = "0.32", features = ["metrics"] }
|
|
opentelemetry-otlp = { version = "0.32", default-features = false, features = [
|
|
"metrics",
|
|
"http-json",
|
|
"reqwest-blocking-client",
|
|
"reqwest-rustls",
|
|
] }
|
|
# The trait an OTLP exporter's HTTP transport is built on
|
|
# (`opentelemetry_otlp::WithHttpConfig::with_http_client`) — pulled in
|
|
# directly (not just transitively via `opentelemetry-otlp` above) by
|
|
# `swarm-controller`'s own `otel_http_client` module, which implements the
|
|
# trait itself rather than using the crate's own blanket `reqwest`/
|
|
# `reqwest-blocking` impls (this workspace's implementation needs to mint
|
|
# a fresh bearer token per request, which no blanket impl can do). No
|
|
# extra cargo features requested here for exactly that reason — the
|
|
# blanket impls live behind `reqwest`/`reqwest-blocking` features this
|
|
# workspace never turns on for this crate.
|
|
opentelemetry-http = "0.32"
|
|
# `async-trait`: `opentelemetry_http::HttpClient` predates stable
|
|
# `async fn` in traits and is still expressed with this macro upstream —
|
|
# implementing the trait (rather than only consuming the crate's own
|
|
# blanket impls) means writing `#[async_trait::async_trait]` on the impl
|
|
# block to match its expansion.
|
|
async-trait = "0.1"
|
|
# `bytes`/`http`: the payload and request/response types
|
|
# `opentelemetry_http::HttpClient::send_bytes` is expressed in terms of —
|
|
# needed to implement the trait, not just call something that already
|
|
# does.
|
|
bytes = "1"
|
|
http = "1"
|
|
http-body-util = "0.1"
|
|
# ⚠️ Keep at 0.11.1 or newer, and keep it on the SAME reqwest as everything
|
|
# else. 0.11.0 links reqwest 0.12 while the workspace is on 0.13, and cargo
|
|
# resolves features per (crate, VERSION): that older client got neither the
|
|
# workspace's TLS features nor the system trust store, so every https call to
|
|
# a gateway name died with `invalid peer certificate: UnknownIssuer` while
|
|
# clients built here worked (#3391). One version of reqwest in the tree is
|
|
# what keeps that class impossible rather than merely fixed.
|
|
forgejo-api = { version = "0.11.1", default-features = false, features = [
|
|
"rustls-tls",
|
|
] }
|
|
url = "2"
|
|
time = { version = "0.3", default-features = false, features = [
|
|
"formatting",
|
|
"parsing",
|
|
] }
|
|
petgraph = { version = "0.8", default-features = false, features = ["std"] }
|
|
matrix-sdk = { version = "0.18", default-features = false, features = [
|
|
"sqlite",
|
|
"markdown",
|
|
"e2e-encryption",
|
|
] }
|
|
futures-util = "0.3"
|
|
hmac = "0.13"
|
|
sha2 = "0.11"
|
|
# The NATS protocol client, for the swarm queue's auth-callout responder.
|
|
# `default-features = false` because the default set is broad - jetstream, kv,
|
|
# object-store, websockets, service - and a callout responder speaks none of
|
|
# them. What is named is the whole requirement: the server generation we
|
|
# deploy, nkey auth, and a TLS backend.
|
|
async-nats = { version = "0.50", default-features = false, features = [
|
|
"server_2_14",
|
|
"nkeys",
|
|
"ring",
|
|
] }
|
|
data-encoding = "2"
|
|
# The nkey *format* - ed25519 + base32 + CRC16. The primitives are already in
|
|
# the tree; the format is not, and hand-rolling a key format on an auth path
|
|
# is how you get a CRC bug nobody reviews.
|
|
nkeys = "0.4"
|
|
# A TEST ORACLE, not a runtime dependency - see swarm-nats-auth's respond.rs.
|
|
nats-jwt = "0.3"
|
|
utoipa = { version = "5", features = ["axum_extras", "chrono"] }
|
|
utoipa-axum = "0.2"
|