eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Authorize remote modules with bearer proofs

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 19:16:30 +02:00
commit 7e39a19c18
8 changed files with 572 additions and 120 deletions
Download patch file Download diff file Expand all files Collapse all files

38
crates/geth-control/src/lib.rs
View file

@ -52,6 +52,7 @@ pub enum ControlRequest {
CasFetch {
node: String,
hash: BlobHash,
bearer_secret: Option<String>,
},
CasHash {
path: PathBuf,
@ -182,6 +183,7 @@ pub enum ControlRequest {
},
SshCertSync {
node: String,
bearer_secret: Option<String>,
},
SshRevocationAdd {
kind: String,
@ -205,9 +207,11 @@ pub enum ControlRequest {
},
SshRevocationSync {
node: String,
bearer_secret: Option<String>,
},
SshProxyConnect {
node: String,
bearer_secret: Option<String>,
},
DbAdd {
name: String,
@ -225,6 +229,7 @@ pub enum ControlRequest {
node: String,
name: String,
limit: u32,
bearer_secret: Option<String>,
},
KvCreate {
name: String,
@ -242,6 +247,7 @@ pub enum ControlRequest {
KvSync {
node: String,
name: String,
bearer_secret: Option<String>,
},
DocumentCreate {
name: String,
@ -259,15 +265,18 @@ pub enum ControlRequest {
DocumentSync {
node: String,
name: String,
bearer_secret: Option<String>,
},
PubsubPub {
topic: String,
message: String,
node: Option<String>,
bearer_secret: Option<String>,
},
PubsubSub {
topic: String,
node: Option<String>,
bearer_secret: Option<String>,
},
PipeListen {
name: String,
@ -275,6 +284,7 @@ pub enum ControlRequest {
PipeConnect {
target: String,
node: Option<String>,
bearer_secret: Option<String>,
},
ModuleStub {
module: String,
@ -666,48 +676,57 @@ pub enum PeerControlRequest {
peer_card: PeerCard,
hash: BlobHash,
nonce: String,
bearer_proof: Option<BearerProof>,
},
SshCertSync {
peer_card: PeerCard,
since_ms: i64,
nonce: String,
bearer_proof: Option<BearerProof>,
},
SshRevocationSync {
peer_card: PeerCard,
since_ms: i64,
nonce: String,
bearer_proof: Option<BearerProof>,
},
KvSync {
peer_card: PeerCard,
name: String,
since_ms: i64,
nonce: String,
bearer_proof: Option<BearerProof>,
},
PubsubPublish {
peer_card: PeerCard,
topic: String,
message: String,
nonce: String,
bearer_proof: Option<BearerProof>,
},
PubsubSubscribe {
peer_card: PeerCard,
topic: String,
nonce: String,
bearer_proof: Option<BearerProof>,
},
PipeConnect {
peer_card: PeerCard,
target: String,
nonce: String,
bearer_proof: Option<BearerProof>,
},
SshProxyConnect {
peer_card: PeerCard,
nonce: String,
bearer_proof: Option<BearerProof>,
},
DocumentSync {
peer_card: PeerCard,
name: String,
since_ms: i64,
nonce: String,
bearer_proof: Option<BearerProof>,
},
DbSync {
peer_card: PeerCard,
@ -715,6 +734,7 @@ pub enum PeerControlRequest {
after_db_version: Option<i64>,
limit: u32,
nonce: String,
bearer_proof: Option<BearerProof>,
},
}
@ -1000,6 +1020,7 @@ mod tests {
let request = ControlRequest::CasFetch {
node: "node:peer".to_owned(),
hash: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef".into(),
bearer_secret: Some("bearer:test".to_owned()),
};
assert_eq!(
decode_request(&encode_request(&request).expect("encode")).expect("decode"),
@ -1050,6 +1071,7 @@ mod tests {
let request = ControlRequest::SshCertSync {
node: "node:ca".to_owned(),
bearer_secret: None,
};
assert_eq!(
decode_request(&encode_request(&request).expect("encode")).expect("decode"),
@ -1058,6 +1080,7 @@ mod tests {
let request = ControlRequest::SshRevocationSync {
node: "node:ca".to_owned(),
bearer_secret: None,
};
assert_eq!(
decode_request(&encode_request(&request).expect("encode")).expect("decode"),
@ -1107,6 +1130,7 @@ mod tests {
let request = ControlRequest::KvSync {
node: "node:peer".to_owned(),
name: "prefs".to_owned(),
bearer_secret: None,
};
assert_eq!(
decode_request(&encode_request(&request).expect("encode")).expect("decode"),
@ -1148,6 +1172,7 @@ mod tests {
let request = ControlRequest::PipeConnect {
target: "inbox".to_owned(),
node: Some("node:peer".to_owned()),
bearer_secret: None,
};
assert_eq!(
decode_request(&encode_request(&request).expect("encode")).expect("decode"),
@ -1158,6 +1183,7 @@ mod tests {
topic: "presence/test".to_owned(),
message: "online".to_owned(),
node: Some("node:peer".to_owned()),
bearer_secret: None,
};
assert_eq!(
decode_request(&encode_request(&request).expect("encode")).expect("decode"),
@ -1167,6 +1193,7 @@ mod tests {
let request = ControlRequest::PubsubSub {
topic: "presence/test".to_owned(),
node: Some("node:peer".to_owned()),
bearer_secret: None,
};
assert_eq!(
decode_request(&encode_request(&request).expect("encode")).expect("decode"),
@ -1231,6 +1258,7 @@ mod tests {
let request = ControlRequest::SshProxyConnect {
node: "node:peer".to_owned(),
bearer_secret: None,
};
assert_eq!(
decode_request(&encode_request(&request).expect("encode")).expect("decode"),
@ -1271,6 +1299,7 @@ mod tests {
node: "node:peer".to_owned(),
name: "notes".to_owned(),
limit: 50,
bearer_secret: None,
};
assert_eq!(
decode_request(&encode_request(&request).expect("encode")).expect("decode"),
@ -1426,6 +1455,7 @@ mod tests {
after_db_version: Some(7),
limit: 10,
nonce: "nonce".to_owned(),
bearer_proof: None,
};
assert_eq!(
decode_peer_request(&encode_peer_request(&request).expect("encode")).expect("decode"),
@ -1552,6 +1582,7 @@ mod tests {
},
topic: "presence/test".to_owned(),
nonce: "nonce".to_owned(),
bearer_proof: None,
};
assert_eq!(
decode_peer_request(&encode_peer_request(&request).expect("encode")).expect("decode"),
@ -1618,6 +1649,13 @@ mod tests {
},
},
nonce: "nonce".to_owned(),
bearer_proof: Some(BearerProof {
secret: "bearer:test".into(),
resource: "resource:ssh-proxy:local".into(),
capabilities: vec!["ssh_proxy.connect".into()],
nonce: "nonce".to_owned(),
response: "response".to_owned(),
}),
};
assert_eq!(
decode_peer_request(&encode_peer_request(&request).expect("encode")).expect("decode"),