ShellHub.fromGrants constructor

ShellHub.fromGrants(Map<String, TokenGrant> grants, { String mount = '/shell', Clock clock = const SystemClock(), Duration heartbeatTimeout = const Duration(seconds: 30), void logger(String message)?, Authorizer? authorizer, AiConfig? aiConfig, })

Builds a shell broker sharing the OmnyServer Hub's credentials.

grants is the Hub's own token table — the same principal:token:roles set that authenticates OmnyServer nodes and the REST API — so one credential works across both fleets and there is no second thing to provision.

Authorization stays OmnyShell's: its default RoleBasedAuthorizer lets the admin role open a session on any node, and other roles only on nodes whose allow-roles label names them.

aiConfig enables the Hub's AI proxy: when set, the broker answers a web client's fetchHubAiConfig and forwards :ai / :ide provider calls with the Hub's key injected — the key never leaves the Hub. Without it, the broker reports no AI provider and the browser agent falls back to a user-supplied key. Load one with AiConfigIo.load(...).

Implementation

factory ShellHub.fromGrants(
  Map<String, TokenGrant> grants, {
  String mount = '/shell',
  Clock clock = const SystemClock(),
  Duration heartbeatTimeout = const Duration(seconds: 30),
  void Function(String message)? logger,
  omnyshell.Authorizer? authorizer,
  omnyshell.AiConfig? aiConfig,
}) {
  return ShellHub._(
    omnyshell.HubBroker(
      authenticator: omnyshell.TokenAuthenticator(toShellGrants(grants)),
      authorizer: authorizer ?? const omnyshell.RoleBasedAuthorizer(),
      clock: _ShellClock(clock),
      heartbeatTimeout: heartbeatTimeout,
      logger: logger,
      aiProxy: aiConfig == null
          ? null
          : omnyshell.HttpProxyService(defaultConfig: aiConfig),
    ),
    mount,
  );
}