jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-11-07 09:52:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reuse the configured NIP-FI mode label in policy status

Browse Source 
Co-authored-by: Honor <e0bf479eeebe47dde1e35705212a4df70616a7bc834d907ddfb18cf0405f8b1b@seiler-test.communities.public.builderlabstaging.xyz>
Signed-off-by: Brad Seiler <seiler@squareup.com>
This commit is contained in:
Brad Seiler
2026-11-06 11:09:32 -05:00
parent 019ec5510e
commit 87c9491404
3 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
crates/buzz-relay/src/api/operator/community_policy.rs
View File

@@ -49,14 +49,8 @@ fn unavailable(error: buzz_db::DbError) -> Error {
}
fn mode_fields(state: &AppState, required: Option<bool>) -> Value {
use buzz_auth::NipFiMode;
let mode = state.config.nip_fi.mode;
let name = match mode {
NipFiMode::Off => "off",
NipFiMode::Shadow => "shadow",
NipFiMode::Enforce => "enforce",
NipFiMode::DenyProtected => "deny-protected",
};
let name = crate::nip_fi_config::mode_name(mode);
serde_json::json!({
"mode": name,
"effective_required": required.map(|r| mode.with_requirement(r).restricts()),

13
crates/buzz-relay/src/nip_fi_config.rs
View File

@@ -620,14 +620,19 @@ fn parse_mode() -> Result<NipFiMode, ConfigError> {
}
}
/// A missing-setting startup error naming the configured mode.
fn mode_requires(mode: NipFiMode, missing: &str) -> ConfigError {
let value = match mode {
/// Stable configured mode name for operator diagnostics and status.
pub(crate) fn mode_name(mode: NipFiMode) -> &'static str {
match mode {
NipFiMode::Enforce => "enforce",
NipFiMode::Shadow => "shadow",
NipFiMode::Off => "off",
NipFiMode::DenyProtected => "deny_protected",
};
}
}
/// A missing-setting startup error naming the configured mode.
fn mode_requires(mode: NipFiMode, missing: &str) -> ConfigError {
let value = mode_name(mode);
ConfigError::InvalidValue(format!("BUZZ_NIP_FI_MODE={value} but {missing}"))
}

2
docs/community-auth-upgrades.md
View File

@@ -100,7 +100,7 @@ General status can read legacy receipts, with null CAS preconditions.
## Request enforcement and discovery
`off` ignores stored requirements; `shadow` enforces stored true; `enforce` is a
global requirement floor; `deny-protected` denies protected traffic. Report
global requirement floor; `deny_protected` denies protected traffic. Report
`effective_required` alongside stored state so disable under enforce and enable
under off cannot be mistaken for effective changes. Evaluating policy lookups
fail closed on errors; off does not require an FI policy read.