Sync SSH metadata over Iroh

crates/geth-control/src/lib.rs

@@ -150,6 +150,9 @@ pub enum ControlRequest {
         cert_path: PathBuf,
     },
     SshCertList,
+    SshCertSync {
+        node: String,
+    },
     SshRevocationAdd {
         kind: String,
         target: String,
@@ -165,6 +168,9 @@ pub enum ControlRequest {
         path: PathBuf,
         format: String,
     },
+    SshRevocationSync {
+        node: String,
+    },
     DbAdd {
         name: String,
         path: PathBuf,
@@ -360,6 +366,16 @@ pub enum ControlResponse {
         requests: Vec<SshCertRequest>,
         certificates: Vec<SshCertificateRecord>,
     },
+    SshCertSynced {
+        peer_node_id: String,
+        peer_agent_id: String,
+        endpoint_id: String,
+        requests_imported: usize,
+        certificates_imported: usize,
+        allowed: bool,
+        reason: String,
+        note: String,
+    },
     SshRevocationAdded {
         revocation: SshRevocationEntry,
     },
@@ -378,6 +394,15 @@ pub enum ControlResponse {
         count: usize,
         note: String,
     },
+    SshRevocationSynced {
+        peer_node_id: String,
+        peer_agent_id: String,
+        endpoint_id: String,
+        revocations_imported: usize,
+        allowed: bool,
+        reason: String,
+        note: String,
+    },
     DbAdded {
         db: DbResource,
     },
@@ -486,6 +511,14 @@ pub enum PeerControlRequest {
         hash: BlobHash,
         nonce: String,
     },
+    SshCertSync {
+        peer_card: PeerCard,
+        nonce: String,
+    },
+    SshRevocationSync {
+        peer_card: PeerCard,
+        nonce: String,
+    },
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -527,6 +560,31 @@ pub enum PeerControlResponse {
         nonce: String,
         note: String,
     },
+    SshCertSynced {
+        node_id: String,
+        agent_id: String,
+        endpoint_id: String,
+        remote_endpoint_id: String,
+        requests: Vec<SshCertRequest>,
+        certificates: Vec<SshCertificateRecord>,
+        allowed: bool,
+        reason: String,
+        evaluated_ops: usize,
+        nonce: String,
+        note: String,
+    },
+    SshRevocationSynced {
+        node_id: String,
+        agent_id: String,
+        endpoint_id: String,
+        remote_endpoint_id: String,
+        revocations: Vec<SshRevocationEntry>,
+        allowed: bool,
+        reason: String,
+        evaluated_ops: usize,
+        nonce: String,
+        note: String,
+    },
     Error {
         message: String,
     },
@@ -629,6 +687,22 @@ mod tests {
             request
         );
 
+        let request = ControlRequest::SshCertSync {
+            node: "node:ca".to_owned(),
+        };
+        assert_eq!(
+            decode_request(&encode_request(&request).expect("encode")).expect("decode"),
+            request
+        );
+
+        let request = ControlRequest::SshRevocationSync {
+            node: "node:ca".to_owned(),
+        };
+        assert_eq!(
+            decode_request(&encode_request(&request).expect("encode")).expect("decode"),
+            request
+        );
+
         let response = ControlResponse::SshRevocationExported {
             out: PathBuf::from("revocations.krl-spec"),
             format: "openssh-krl-spec".to_owned(),
@@ -640,6 +714,35 @@ mod tests {
             response
         );
 
+        let response = ControlResponse::SshCertSynced {
+            peer_node_id: "node:ca".to_owned(),
+            peer_agent_id: "agent:ca".to_owned(),
+            endpoint_id: "endpoint:ca".to_owned(),
+            requests_imported: 1,
+            certificates_imported: 0,
+            allowed: true,
+            reason: "direct grant".to_owned(),
+            note: "cert sync".to_owned(),
+        };
+        assert_eq!(
+            decode_response(&encode_response(&response).expect("encode")).expect("decode"),
+            response
+        );
+
+        let response = ControlResponse::SshRevocationSynced {
+            peer_node_id: "node:ca".to_owned(),
+            peer_agent_id: "agent:ca".to_owned(),
+            endpoint_id: "endpoint:ca".to_owned(),
+            revocations_imported: 2,
+            allowed: true,
+            reason: "direct grant".to_owned(),
+            note: "revocation sync".to_owned(),
+        };
+        assert_eq!(
+            decode_response(&encode_response(&response).expect("encode")).expect("decode"),
+            response
+        );
+
         let request = ControlRequest::DocumentSet {
             name: "notes".to_owned(),
             state_json: r#"{"title":"notes"}"#.to_owned(),
@@ -762,5 +865,42 @@ mod tests {
                 .expect("decode"),
             response
         );
+
+        let response = PeerControlResponse::SshCertSynced {
+            node_id: "node:peer".to_owned(),
+            agent_id: "agent:peer".to_owned(),
+            endpoint_id: "endpoint:peer".to_owned(),
+            remote_endpoint_id: "endpoint:caller".to_owned(),
+            requests: Vec::new(),
+            certificates: Vec::new(),
+            allowed: false,
+            reason: "no grant".to_owned(),
+            evaluated_ops: 0,
+            nonce: "nonce".to_owned(),
+            note: "cert sync".to_owned(),
+        };
+        assert_eq!(
+            decode_peer_response(&encode_peer_response(&response).expect("encode"))
+                .expect("decode"),
+            response
+        );
+
+        let response = PeerControlResponse::SshRevocationSynced {
+            node_id: "node:peer".to_owned(),
+            agent_id: "agent:peer".to_owned(),
+            endpoint_id: "endpoint:peer".to_owned(),
+            remote_endpoint_id: "endpoint:caller".to_owned(),
+            revocations: Vec::new(),
+            allowed: false,
+            reason: "no grant".to_owned(),
+            evaluated_ops: 0,
+            nonce: "nonce".to_owned(),
+            note: "revocation sync".to_owned(),
+        };
+        assert_eq!(
+            decode_peer_response(&encode_peer_response(&response).expect("encode"))
+                .expect("decode"),
+            response
+        );
     }
 }