2df19e4899
`swarmctl --swarm https://<swarm> login` runs the OAuth 2.0 authorization-code flow with PKCE against the swarm's authelia as a new public `swarmctl` client: a pushed authorization request, the browser login and explicit consent, and the code delivered by form_post to a loopback port. The access and refresh tokens are cached at mode 0600 under $XDG_STATE_HOME/swarmctl/ and refreshed under a file lock, since authelia rotates the refresh token and revokes the login when a used one is presented again. With --swarm (or SWARMCTL_SWARM), the agent, schedule and forge verbs send their requests to https://<swarm>/api/ with the bearer token instead of over the controller's unix socket, which stays the default. authelia registers the client on every authelia host with a swarm domain: `kind = "native"`, public, no minted secret, scopes offline_access and authelia.bearer.authz, audience https://<swarm>/api/ (matched as a URL prefix), redirect http://127.0.0.1/callback (any loopback port). Every field is one authelia 4.39.20's validator requires for a public client holding the bearer scope. The swarm apex's /api/ answers a refused caller that sent an Authorization header with the 401 itself instead of the login redirect, so the CLI can tell "log in again" apart from an answer; a browser still gets the redirect. The bearer token is not forwarded to the controller. Refs #4409 (mara: c94764, c94782).
41 lines
1.1 KiB
TOML
41 lines
1.1 KiB
TOML
[package]
|
|
name = "swarmctl"
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
edition.workspace = true
|
|
|
|
[[bin]]
|
|
name = "swarmctl"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
# PKCE verifier, state and S256 challenge for `swarmctl login`.
|
|
base64.workspace = true
|
|
chrono.workspace = true
|
|
# `agent create` — bare HTTP/1.1 client over swarm-controller's unix
|
|
# socket. No new workspace dependency: `bytes`, `http-body-util`,
|
|
# `hyper` and `hyper-util` are all already pinned in the root manifest.
|
|
bytes = "1"
|
|
clap.workspace = true
|
|
clap-markdown = "0.1"
|
|
clap_complete.workspace = true
|
|
getrandom.workspace = true
|
|
hive-types.workspace = true
|
|
http-body-util.workspace = true
|
|
# `server`: the loopback listener `swarmctl login` receives its code on.
|
|
hyper = { workspace = true, features = ["server"] }
|
|
hyper-util.workspace = true
|
|
# HTTPS to the swarm domain and its SSO provider, for `--swarm`.
|
|
reqwest.workspace = true
|
|
# `flock` on the login cache, which a refresh must not race.
|
|
rustix.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
serde_norway = "0.9.42"
|
|
sha2.workspace = true
|
|
tokio.workspace = true
|
|
url.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|