Add manual signed peer card exchange

crates/geth/Cargo.toml

@@ -19,6 +19,8 @@ geth-cli = { path = "../geth-cli" }
 geth-cas = { path = "../geth-cas" }
 geth-config = { path = "../geth-config" }
 geth-control = { path = "../geth-control" }
+geth-discovery = { path = "../geth-discovery" }
+geth-iroh = { path = "../geth-iroh" }
 geth-node = { path = "../geth-node" }
 geth-store = { path = "../geth-store" }
 geth-types = { path = "../geth-types" }

crates/geth/tests/bootstrap.rs

@@ -103,6 +103,72 @@ fn geth_status_against_running_daemon() {
     assert!(stdout.contains("iroh discovery: local-network disabled"));
 }
 
+#[test]
+fn peer_card_export_import_and_list_are_candidate_only() {
+    let source_home = tempfile::tempdir().expect("source tempdir");
+    let source_paths = geth_config::GethPaths::from_home(source_home.path());
+    let mut source = geth_node::init_node(&source_paths).expect("init source");
+    source.iroh_status = geth_iroh::EndpointStatus {
+        enabled: true,
+        endpoint_id: Some("endpoint:test-source".to_owned()),
+        relay_mode: "disabled".to_owned(),
+        local_discovery: false,
+        note: "test endpoint".to_owned(),
+    };
+    let peer_card_path = source_home.path().join("peer-card.json");
+
+    let exported = geth_node::handle_request(
+        &source,
+        geth_control::ControlRequest::PeerCardExport {
+            out: Some(peer_card_path.clone()),
+        },
+    )
+    .expect("export peer card");
+    let exported_card = match exported {
+        geth_control::ControlResponse::PeerCardExported { card, out, note } => {
+            assert_eq!(out, Some(peer_card_path.clone()));
+            assert!(note.contains("never grants trust"));
+            card.validate_candidate().expect("valid exported card");
+            card
+        }
+        other => panic!("unexpected response: {other:?}"),
+    };
+    assert!(peer_card_path.exists());
+
+    let target_home = tempfile::tempdir().expect("target tempdir");
+    let target_paths = geth_config::GethPaths::from_home(target_home.path());
+    let target = geth_node::init_node(&target_paths).expect("init target");
+    let imported = geth_node::handle_request(
+        &target,
+        geth_control::ControlRequest::PeerCardImport {
+            path: peer_card_path,
+        },
+    )
+    .expect("import peer card");
+    match imported {
+        geth_control::ControlResponse::PeerCardImported { peer, note } => {
+            assert_eq!(peer.card, exported_card);
+            assert_eq!(
+                peer.trust_state,
+                geth_discovery::CandidateTrustState::CandidateOnly
+            );
+            assert!(note.contains("never grants trust"));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    let listed = geth_node::handle_request(&target, geth_control::ControlRequest::PeerCardList)
+        .expect("list peers");
+    match listed {
+        geth_control::ControlResponse::PeerCardList { peers, note } => {
+            assert_eq!(peers.len(), 1);
+            assert_eq!(peers[0].card, exported_card);
+            assert!(note.contains("never grants trust"));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+}
+
 #[test]
 fn initialized_node_can_roundtrip_cas_blob() {
     let home = tempfile::tempdir().expect("tempdir");