eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: centralize peer control caller auth

Browse source
This commit is contained in:
Eric Wendland 2026-07-05 23:38:19 +02:00
commit 1a6d9db913
3 changed files with 153 additions and 384 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/architecture.md
View file

@ -101,6 +101,11 @@ authenticates the Iroh endpoint and peer-card signature, but it does not
authorize any resource module. Protected peer control requests must also prove
that the signed peer card binds the observed Iroh EndpointID, then reduce
resource auth ops; an EndpointID alone is not accepted as a resource principal.
Inbound protected control, pipe-wire, SSH-proxy, and overlay-wire handlers use a
shared authenticated caller context that validates the peer card, checks the
observed endpoint binding, records the peer card as untrusted candidate
metadata, and then passes the verified caller identity plus store handle to the
resource-specific authorization step.
Remote geth JSONL messages over Iroh are bounded before decoding:
peer-control and module wire requests/responses are limited to 16 MiB,
streaming handshakes for SSH proxy and TCP/Unix pipe forwarding are limited to

8
docs/production-readiness-roadmap.md
View file

@ -52,17 +52,17 @@ behavior.
- `[ ]` Each command family has a small handler module or function group.
- `[x]` Local-only behavior remains covered by existing integration tests.
- `[ ]` Extract protected peer-control routing.
- `[~]` Extract protected peer-control routing.
Acceptance criteria:
- `[x]` Shared bounded Iroh line-read and send-finish helpers live outside
the main feature handler module.
- `[x]` Outbound peer-control, pipe-wire, and overlay-wire request helpers
live outside the main feature handler module.
- `[ ]` Iroh control ALPN handling, nonce checks, peer-card validation, and
- `[~]` Iroh control ALPN handling, nonce checks, peer-card validation, and
endpoint-binding validation are centralized.
- `[ ]` Feature handlers receive authenticated caller context rather than
- `[x]` Feature handlers receive authenticated caller context rather than
repeating peer-card boilerplate.
- `[ ]` Remote request tests still prove discovery alone grants no access.
- `[x]` Remote request tests still prove discovery alone grants no access.
- `[ ]` Extract resource module handlers.
Acceptance criteria: