7a03ce096a
mara on #4015: "not merging code without callers", and on the same PR "see issue, we decided what the first thing should be". #3726 decided it: the controller writes a token to the store and tells the hive; the hive reads it back and writes /agents/<agent>/state/matrix-token-<account> at 0600, where matrix.nix's existing systemd.paths glob re-fires the daemon. So this is the hive half of that, and the library's first caller. The notice names a credential and never carries one, and deploy_subject's own doc is why: the auth-callout responder scopes publish and leaves sub unrestricted, so a hive that wanted another's messages could subscribe to them. A secret in that payload would be readable swarm-wide. The value is read from the store under the reading hive's own certificate, where the store's policy is what actually scopes it. Two boundaries guard the two addresses, and they are not the same check. `path::matrix_account` guards the address in the store. `Ident` guards the address on disk -- `agent_state_dir` takes one, so an unvalidated name off the queue cannot reach a directory. I had written the first and assumed it covered both; the compiler refused the `&str` and was right. `token_path` now takes the newtype so a call site cannot forget. The write is atomic because the path-watcher fires on the file appearing: written in place it would be visible while partial, and the daemon would read a truncated credential exactly once, which is the hardest possible failure to reproduce. The temp name is dot-prefixed so it cannot match the `matrix-token*` glob on its way past. The publish grant is here because without it the failure is invisible. policy.rs already says why for its siblings: a refused publish reaches the client as a timeout, so the symptom is a hive that never receives a credential with nothing in either log naming a permission. Two tests: the controller may publish, a hive may not -- its own subject included. A forged notice leaks nothing, but it would make a hive fetch and overwrite a token file for a name the forger chose. Refs #3726
67 lines
2.2 KiB
TOML
67 lines
2.2 KiB
TOML
[package]
|
|
name = "hive-c0re"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
# For `StreamExt::next` on the swarm-event subscription in `swarm_status`.
|
|
# Workspace-level, same version swarm-controller already uses — not a second copy.
|
|
futures-util.workspace = true
|
|
anyhow.workspace = true
|
|
# Named directly only for the client type the swarm status publisher passes
|
|
# around; the connect itself lives in `swarm-queue-client` below.
|
|
async-nats.workspace = true
|
|
axum.workspace = true
|
|
chrono.workspace = true
|
|
base64.workspace = true
|
|
bcrypt.workspace = true
|
|
reqwest.workspace = true
|
|
forgejo-api.workspace = true
|
|
url.workspace = true
|
|
clap.workspace = true
|
|
clap_complete.workspace = true
|
|
clap-markdown = "0.1"
|
|
# OTEL SDK for the per-agent container-resource metrics exporter
|
|
# (stats/otel_metrics.rs). "internal-logs" on top of the workspace base is
|
|
# this crate's own opt-in: it's not a transport, it's in `default`, and
|
|
# `default-features = false` upstream drops it unless named here.
|
|
opentelemetry.workspace = true
|
|
opentelemetry_sdk.workspace = true
|
|
opentelemetry-otlp = { workspace = true, features = ["internal-logs"] }
|
|
indicatif.workspace = true
|
|
hive-core-agent-sock.workspace = true
|
|
hive-sh4re.workspace = true
|
|
hive-host-sock.workspace = true
|
|
hive-jobq.workspace = true
|
|
hive-jobq-wire.workspace = true
|
|
hive-priv-sock.workspace = true
|
|
hive-agent-sock.workspace = true
|
|
hive-sock-client.workspace = true
|
|
hive-types.workspace = true
|
|
libc.workspace = true
|
|
listenfd = "1"
|
|
petgraph.workspace = true
|
|
hmac.workspace = true
|
|
sha2.workspace = true
|
|
rusqlite.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
# Offering this hive's status to the swarm (`swarm_status`). The same crate
|
|
# the swarm controller reads it with, and `kv` for the same reason: the
|
|
# bucket's name and creation config belong to neither end of it alone.
|
|
swarm-queue-client = { workspace = true, features = ["kv", "notices"] }
|
|
swarm-secret-client.workspace = true
|
|
tokio.workspace = true
|
|
tokio-stream.workspace = true
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
problem_details = { version = "0.9.0", features = ["axum"] }
|
|
utoipa.workspace = true
|
|
utoipa-axum.workspace = true
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|