eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: restore clippy quality gate

Browse source
This commit is contained in:
Eric Wendland 2026-07-05 17:24:03 +02:00
commit cad4bc0e74
4 changed files with 71 additions and 72 deletions
Download patch file Download diff file Expand all files Collapse all files

60
crates/geth-auth/src/lib.rs
View file

@ -258,46 +258,46 @@ fn explain_from_ops_and_view(
let evaluated_ops = ops.len();
if let Some(secret) = subject.as_str().strip_prefix("bearer:") {
let secret = SecretId::new(secret.to_owned());
if let Some(access) = view.bearer_access.get(&secret) {
if access.resource == resource {
if let Some(granted_capability) = access
.capabilities
.iter()
.find(|granted| capability_allows(granted, &capability))
{
return AuthExplanation {
subject: subject.to_string(),
resource: resource.to_string(),
capability: capability.to_string(),
allowed: true,
reason: format!(
"active bearer access {} allows resource-scoped capability via {} without granting node identity",
access.secret, granted_capability
),
evaluated_ops,
diagnostics: vec![
"subject:bearer-secret".to_owned(),
format!("bearer:active:{}", access.secret),
format!("capability:matched:{granted_capability}"),
],
};
}
if let Some(access) = view.bearer_access.get(&secret)
&& access.resource == resource
{
if let Some(granted_capability) = access
.capabilities
.iter()
.find(|granted| capability_allows(granted, &capability))
{
return AuthExplanation {
subject: subject.to_string(),
resource: resource.to_string(),
capability: capability.to_string(),
allowed: false,
reason:
"active bearer access exists for this resource but lacks the requested capability"
.to_owned(),
allowed: true,
reason: format!(
"active bearer access {} allows resource-scoped capability via {} without granting node identity",
access.secret, granted_capability
),
evaluated_ops,
diagnostics: vec![
"subject:bearer-secret".to_owned(),
format!("bearer:active:{secret}"),
"capability:missing".to_owned(),
format!("bearer:active:{}", access.secret),
format!("capability:matched:{granted_capability}"),
],
};
}
return AuthExplanation {
subject: subject.to_string(),
resource: resource.to_string(),
capability: capability.to_string(),
allowed: false,
reason:
"active bearer access exists for this resource but lacks the requested capability"
.to_owned(),
evaluated_ops,
diagnostics: vec![
"subject:bearer-secret".to_owned(),
format!("bearer:active:{secret}"),
"capability:missing".to_owned(),
],
};
}
if ops.iter().any(|op| {