560f727797
`write_policy` called `vaultrs::sys::policy::set`, which targets `sys/policy/<name>` — the deprecated alias the store gates as a path of its own. Every grant in this tree names `sys/policies/acl/hive-*`, so a correctly-scoped controller was refused with a 403 and no hive read policy has ever been written, on any deployment. The doc comment three lines above the call already named the modern path; the code is what moves to meet it. vaultrs has no endpoint for that path (`grep policies/acl` over 0.8.0: zero hits, against 8 for `sys/policy`), so this defines one over its own endpoint machinery — which keeps the client's token header and `/v1` prefix middleware rather than re-deriving them. The alternative was to widen the grant to cover the legacy path. This way needs no policy change at all: the deployed grant already permits the write, so no store is re-bootstrapped and nothing is entrenched on an alias upstream has deprecated. Two tests pin the path and the body shape. The reason this survived deployment is that nothing in the tree ever asserted either one. Closes #4177.
23 lines
636 B
TOML
23 lines
636 B
TOML
[package]
|
|
name = "swarm-secret-client"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
|
|
[dependencies]
|
|
# `Identity` is re-exported by vaultrs, but the identity is built here (from
|
|
# the `BAO_*` files) rather than by its env defaults, so the dependency is
|
|
# direct rather than incidental.
|
|
reqwest.workspace = true
|
|
# vaultrs's own endpoint machinery, for the one endpoint it does not
|
|
# implement — see `client::WriteAclPolicy`.
|
|
rustify.workspace = true
|
|
rustify_derive.workspace = true
|
|
serde.workspace = true
|
|
thiserror.workspace = true
|
|
vaultrs.workspace = true
|
|
|
|
[dev-dependencies]
|
|
serde_json.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|