liminal_server/agents/
config.rs

1//! Positive bounds for agent identities and retained metadata.
2
3use serde::Deserialize;
4
5use super::error::AgentError;
6use crate::config::types::ServerConfig;
7
8/// `[auth.lys.agents]`. An absent block is distinct from a block using defaults.
9#[derive(Clone, Copy, Debug, PartialEq, Eq, Deserialize)]
10#[serde(default, deny_unknown_fields)]
11pub struct AgentsConfig {
12    /// Default 8: one person's assistant plus a hand of builders.
13    pub max_per_owner: usize,
14    /// Default 64: one exchange's console stays readable.
15    pub max_per_exchange: usize,
16    /// Default 512: identity, purpose and draft identifiers fit without
17    /// admitting arbitrarily large strings to the metadata registry.
18    pub max_field_bytes: usize,
19    /// Default 16 KiB: one transition and its receipt fit in one store request.
20    pub max_event_bytes: usize,
21    /// Default 64: restoration reads history in bounded pages.
22    pub replay_page_rows: usize,
23    /// Default 256: metadata watchers cannot grow an unbounded actor population.
24    pub max_watchers: usize,
25    /// Default 16: one watcher cannot retain an unbounded metadata backlog.
26    pub watcher_depth: usize,
27    /// Default 256 KiB: non-wire watchers also have a positive byte budget.
28    pub watcher_bytes: usize,
29    /// Default 32: one seat's graph stops stay within a bounded subscription list.
30    pub max_listened_subjects: usize,
31    /// Default 4 KiB: each granted subject name has a bounded graph representation.
32    pub max_subject_bytes: usize,
33}
34
35impl Default for AgentsConfig {
36    fn default() -> Self {
37        Self {
38            max_per_owner: 8,
39            max_per_exchange: 64,
40            max_field_bytes: 512,
41            max_event_bytes: 16 * 1024,
42            replay_page_rows: 64,
43            max_watchers: 256,
44            watcher_depth: 16,
45            watcher_bytes: 256 * 1024,
46            max_listened_subjects: 32,
47            max_subject_bytes: 4096,
48        }
49    }
50}
51
52impl AgentsConfig {
53    /// Validates every bound before allocation.
54    ///
55    /// # Errors
56    /// A bound is zero, or an event cannot hold one bounded field.
57    pub fn validate(&self) -> Result<(), AgentError> {
58        for (name, value) in self.bounds() {
59            if value == 0 {
60                return Err(AgentError::Bound {
61                    bound: name,
62                    limit: 0,
63                    count: 0,
64                });
65            }
66        }
67        if self.max_event_bytes < self.max_field_bytes {
68            return Err(AgentError::Invalid(
69                "max_event_bytes is below max_field_bytes",
70            ));
71        }
72        Ok(())
73    }
74
75    const fn bounds(&self) -> [(&'static str, usize); 10] {
76        [
77            ("max_per_owner", self.max_per_owner),
78            ("max_per_exchange", self.max_per_exchange),
79            ("max_field_bytes", self.max_field_bytes),
80            ("max_event_bytes", self.max_event_bytes),
81            ("replay_page_rows", self.replay_page_rows),
82            ("max_watchers", self.max_watchers),
83            ("watcher_depth", self.watcher_depth),
84            ("watcher_bytes", self.watcher_bytes),
85            ("max_listened_subjects", self.max_listened_subjects),
86            ("max_subject_bytes", self.max_subject_bytes),
87        ]
88    }
89
90    pub(crate) fn field(&self, value: &str, member: &'static str) -> Result<(), AgentError> {
91        if value.is_empty() || value.chars().any(char::is_control) {
92            return Err(AgentError::Invalid(member));
93        }
94        if value.len() > self.max_field_bytes {
95            return Err(AgentError::Bound {
96                bound: "max_field_bytes",
97                limit: self.max_field_bytes,
98                count: value.len(),
99            });
100        }
101        Ok(())
102    }
103}
104
105/// Collects deterministic configuration errors. A durable registry discovered
106/// at boot is checked again when opened, before the listener starts.
107pub fn collect_errors(config: &ServerConfig, errors: &mut Vec<String>) {
108    let lys = config.auth.as_ref().and_then(|auth| auth.lys.as_ref());
109    if let Some(bounds) = lys.and_then(|lys| lys.agents.as_ref()) {
110        if let Err(error) = bounds.validate() {
111            errors.push(error.to_string());
112        }
113    } else if config
114        .channels
115        .iter()
116        .any(|channel| channel.name.starts_with("agents."))
117        || lys
118            .and_then(|lys| lys.membership.as_ref())
119            .is_some_and(|membership| membership.channel_kind == "liminal.agent")
120    {
121        errors.push("[auth.lys.agents] is required when a liminal.agent is placed".into());
122    }
123}
liminal_server/agents/config.rs

liminal_server/agents/
config.rs
