Add authorized file-root sync

crates/geth-control/src/lib.rs

@@ -81,6 +81,11 @@ pub enum ControlRequest {
     CasRootScan {
         name: String,
     },
+    CasRootSync {
+        node: String,
+        name: String,
+        bearer_secret: Option<String>,
+    },
     CasConflictRecord {
         root: String,
         path: String,
@@ -387,6 +392,17 @@ pub enum ControlResponse {
     CasRootScanned {
         scan: FileRootScan,
     },
+    CasRootSynced {
+        peer_node_id: String,
+        peer_agent_id: String,
+        endpoint_id: String,
+        name: String,
+        root: Option<FileRoot>,
+        tree_bytes_imported: bool,
+        allowed: bool,
+        reason: String,
+        note: String,
+    },
     CasConflictRecorded {
         conflict: FileConflict,
     },
@@ -689,6 +705,12 @@ pub enum PeerControlRequest {
         nonce: String,
         bearer_proof: Option<BearerProof>,
     },
+    CasRootSync {
+        peer_card: PeerCard,
+        name: String,
+        nonce: String,
+        bearer_proof: Option<BearerProof>,
+    },
     SshCertSync {
         peer_card: PeerCard,
         since_ms: i64,
@@ -803,6 +825,20 @@ pub enum PeerControlResponse {
         nonce: String,
         note: String,
     },
+    CasRootSynced {
+        node_id: String,
+        agent_id: String,
+        endpoint_id: String,
+        remote_endpoint_id: String,
+        name: String,
+        root: Option<FileRoot>,
+        tree_content_base64: Option<String>,
+        allowed: bool,
+        reason: String,
+        evaluated_ops: usize,
+        nonce: String,
+        note: String,
+    },
     SshCertSynced {
         node_id: String,
         agent_id: String,
@@ -1382,6 +1418,32 @@ mod tests {
             request
         );
 
+        let request = ControlRequest::CasRootSync {
+            node: "node:peer".to_owned(),
+            name: "notes".to_owned(),
+            bearer_secret: None,
+        };
+        assert_eq!(
+            decode_request(&encode_request(&request).expect("encode")).expect("decode"),
+            request
+        );
+
+        let response = ControlResponse::CasRootSynced {
+            peer_node_id: "node:peer".to_owned(),
+            peer_agent_id: "agent:peer".to_owned(),
+            endpoint_id: "endpoint:peer".to_owned(),
+            name: "notes".to_owned(),
+            root: None,
+            tree_bytes_imported: false,
+            allowed: false,
+            reason: "no grant".to_owned(),
+            note: "file-root sync".to_owned(),
+        };
+        assert_eq!(
+            decode_response(&encode_response(&response).expect("encode")).expect("decode"),
+            response
+        );
+
         let request = ControlRequest::CasConflictResolve {
             conflict_id: "file-conflict:notes:1".to_owned(),
             resolution: "keep-local".to_owned(),
@@ -1488,6 +1550,26 @@ mod tests {
             response
         );
 
+        let response = PeerControlResponse::CasRootSynced {
+            node_id: "node:peer".to_owned(),
+            agent_id: "agent:peer".to_owned(),
+            endpoint_id: "endpoint:peer".to_owned(),
+            remote_endpoint_id: "endpoint:caller".to_owned(),
+            name: "notes".to_owned(),
+            root: None,
+            tree_content_base64: None,
+            allowed: false,
+            reason: "no grant".to_owned(),
+            evaluated_ops: 0,
+            nonce: "nonce".to_owned(),
+            note: "file-root sync".to_owned(),
+        };
+        assert_eq!(
+            decode_peer_response(&encode_peer_response(&response).expect("encode"))
+                .expect("decode"),
+            response
+        );
+
         let request = PeerControlRequest::DbSync {
             peer_card: PeerCard {
                 node_id: "node:caller".into(),