pastilhasandClaude Opus 5
e13128846b
headscale leaves the platform. 45 files move to plugins/offscale/ and the
platform stops knowing it exists.
api/router.ts the thin auth-gated proxy, now at /api/offscale
sidecar/ 18 files, the whole headscale contract and its admin keys
db/ schema + queries, offscale_servers
web/ 26 files as panels and a layout — no screen, per the rule
removed from the platform: the hono mount, the `headscale` capability, the
App.tsx route pair, the screen and its barrel, the AppRegistry spread, the
officerdev re-exports, the dock tile, the page-title rule, and both database
barrels. tsgo is clean and nothing references it.
the imports tell the story of what the plugin↔host API actually is. the sidecar
takes @@/sidecar/protocol, @@/sidecar/connect, @@/data-path and
@@/officer-url.mjs; the queries take officerdb/db and officerdb/crypto; the
schema takes officerdb/auth/schema for the one reference a plugin may make; the
web half takes useClient, copyToClipboard, WorkspaceView and TerminalView from
the officerdev barrel. all of it resolves because a plugin lives inside the repo
— no publishing, no version negotiation.
AND IT FOUND A REAL BUG IN THE INSTALLER. createSidecarProxy learns its port
from a one-shot `<name>:server` event and subscribes when the plugin's router is
first imported — at mount. install started the sidecar BEFORE mounting, so the
announcement fired into a void: process online, routes mounted, every request
answering `503 sidecar not available` until something forced a reconnect. it
would have hit every plugin with an http sidecar. `example` never caught it
because it has no listener to announce.
install and enable now mount before starting; disable still unmounts before
stopping. neither direction leaves a mounted route in front of a sidecar that
cannot be reached.
verified live: /api/offscale/_officer/servers answers {"servers":[]}, /offscale
and /offscale/nodes serve, the old /api/headscale is 404, the offscale
capability is registered from the manifest, and officer-offscale is online.
757 pass, same 10 pre-existing failures.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
43 lines
1.6 KiB
TypeScript
43 lines
1.6 KiB
TypeScript
import { createHmac } from 'node:crypto';
|
|
import { getKey } from 'officerdb/secret-store';
|
|
|
|
const RELAY_TOKEN_CONTEXT = 'officer-browser-relay-v1';
|
|
|
|
// Nothing imports this file today — the browser relay is switched off pending extraction into a plugin
|
|
// (see server.tsx). Updated with everything else so it is coherent when it comes back: it read
|
|
// JWT_SECRET from the environment, which no longer exists, and would have thrown at module load.
|
|
//
|
|
// When it is extracted it should take its own purpose rather than borrowing 'jwt' — a plugin deriving
|
|
// tokens from the platform's signing key is the coupling the per-purpose split exists to remove.
|
|
|
|
export function deriveRelayToken(userId: number, port: number, salt: string): string {
|
|
return createHmac('sha256', getKey('jwt')).update(`${RELAY_TOKEN_CONTEXT}:${port}:${userId}:${salt}`).digest('hex');
|
|
}
|
|
|
|
const tokenToUser = new Map<string, number>();
|
|
|
|
export function registerUserToken(userId: number, port: number, salt: string): string {
|
|
const token = deriveRelayToken(userId, port, salt);
|
|
tokenToUser.set(token, userId);
|
|
return token;
|
|
}
|
|
|
|
export function unregisterUserToken(token: string): void {
|
|
tokenToUser.delete(token);
|
|
}
|
|
|
|
export function restoreUserTokens(entries: Array<{ userId: number; salt: string }>, port: number): void {
|
|
for (const { userId, salt } of entries) {
|
|
const token = deriveRelayToken(userId, port, salt);
|
|
tokenToUser.set(token, userId);
|
|
}
|
|
}
|
|
|
|
export function resolveUserFromToken(token: string): number | null {
|
|
return tokenToUser.get(token) ?? null;
|
|
}
|
|
|
|
export function getRelayAuthHeader(): string {
|
|
return 'x-officer-relay-token';
|
|
}
|