Add SSH proxy authorization probe

crates/geth-control/src/lib.rs

@@ -12,6 +12,7 @@ use geth_secrets::{BearerAccess, ResourceMasterSecret};
 use geth_ssh_identity::{
     SshCertApproval, SshCertRequest, SshCertificateRecord, SshRevocationEntry,
 };
+use geth_ssh_proxy::SshProxyConnection;
 use geth_types::BlobHash;
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
@@ -186,6 +187,9 @@ pub enum ControlRequest {
     SshRevocationSync {
         node: String,
     },
+    SshProxyConnect {
+        node: String,
+    },
     DbAdd {
         name: String,
         path: PathBuf,
@@ -543,6 +547,15 @@ pub enum ControlResponse {
         reason: String,
         note: String,
     },
+    SshProxyConnected {
+        peer_node_id: String,
+        peer_agent_id: String,
+        endpoint_id: String,
+        connection: Option<SshProxyConnection>,
+        allowed: bool,
+        reason: String,
+        note: String,
+    },
     NotImplemented {
         module: String,
         command: String,
@@ -649,6 +662,10 @@ pub enum PeerControlRequest {
         target: String,
         nonce: String,
     },
+    SshProxyConnect {
+        peer_card: PeerCard,
+        nonce: String,
+    },
     DocumentSync {
         peer_card: PeerCard,
         name: String,
@@ -790,6 +807,18 @@ pub enum PeerControlResponse {
         nonce: String,
         note: String,
     },
+    SshProxyConnected {
+        node_id: String,
+        agent_id: String,
+        endpoint_id: String,
+        remote_endpoint_id: String,
+        connection: Option<SshProxyConnection>,
+        allowed: bool,
+        reason: String,
+        evaluated_ops: usize,
+        nonce: String,
+        note: String,
+    },
     DocumentSynced {
         node_id: String,
         agent_id: String,
@@ -1130,6 +1159,34 @@ mod tests {
             response
         );
 
+        let request = ControlRequest::SshProxyConnect {
+            node: "node:peer".to_owned(),
+        };
+        assert_eq!(
+            decode_request(&encode_request(&request).expect("encode")).expect("decode"),
+            request
+        );
+
+        let response = ControlResponse::SshProxyConnected {
+            peer_node_id: "node:peer".to_owned(),
+            peer_agent_id: "agent:peer".to_owned(),
+            endpoint_id: "endpoint:peer".to_owned(),
+            connection: Some(SshProxyConnection {
+                target_node: "node:peer".into(),
+                connected_at: geth_types::UnixMillis(1),
+                local_sshd_target: Some("127.0.0.1:22".to_owned()),
+                admin_shell_available: false,
+                note: "proxy".to_owned(),
+            }),
+            allowed: true,
+            reason: "direct grant".to_owned(),
+            note: "ssh proxy".to_owned(),
+        };
+        assert_eq!(
+            decode_response(&encode_response(&response).expect("encode")).expect("decode"),
+            response
+        );
+
         let request = ControlRequest::DbChanges {
             name: "notes".to_owned(),
             after_db_version: Some(7),
@@ -1476,6 +1533,50 @@ mod tests {
             response
         );
 
+        let request = PeerControlRequest::SshProxyConnect {
+            peer_card: PeerCard {
+                node_id: "node:caller".into(),
+                agent_id: "agent:caller".into(),
+                endpoints: Vec::new(),
+                issued_at: geth_types::UnixMillis(1),
+                signature: geth_discovery::SignatureMetadata {
+                    namespace: "geth.peer-card.v1@geth.local".to_owned(),
+                    signer: "agent:caller".to_owned(),
+                    public_key: "key".to_owned(),
+                    signature: "sig".to_owned(),
+                },
+            },
+            nonce: "nonce".to_owned(),
+        };
+        assert_eq!(
+            decode_peer_request(&encode_peer_request(&request).expect("encode")).expect("decode"),
+            request
+        );
+
+        let response = PeerControlResponse::SshProxyConnected {
+            node_id: "node:peer".to_owned(),
+            agent_id: "agent:peer".to_owned(),
+            endpoint_id: "endpoint:peer".to_owned(),
+            remote_endpoint_id: "endpoint:caller".to_owned(),
+            connection: Some(SshProxyConnection {
+                target_node: "node:peer".into(),
+                connected_at: geth_types::UnixMillis(1),
+                local_sshd_target: Some("127.0.0.1:22".to_owned()),
+                admin_shell_available: false,
+                note: "proxy".to_owned(),
+            }),
+            allowed: true,
+            reason: "direct grant".to_owned(),
+            evaluated_ops: 1,
+            nonce: "nonce".to_owned(),
+            note: "ssh proxy".to_owned(),
+        };
+        assert_eq!(
+            decode_peer_response(&encode_peer_response(&response).expect("encode"))
+                .expect("decode"),
+            response
+        );
+
         let response = PeerControlResponse::DbSynced {
             node_id: "node:peer".to_owned(),
             agent_id: "agent:peer".to_owned(),