@camstack/system 1.2.419 → 1.2.420

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
 import { Pn as storageOccupancyCapability, Y as backupCapability, Zr as toNodeId, cr as BaseAddon, ei as EventCategory, en as mayWriteToLocation, zr as nodePin } from "../../dist-C0wYvAHC.mjs";
-import { a as BackupSnapshotRefusedError, c as BackupKeyFormatError, d as generateBackupKeyPair, f as parseBackupPublicKey, i as BackupCancelledError, n as precheckRestoreKey, o as SystemBackupService, p as parseBackupSecretKey, r as prepareRestoreArchive, u as ENCRYPTED_BACKUP_SUFFIX } from "../../restore-archive-gGHgAZsz.mjs";
+import { a as BackupSnapshotRefusedError, c as BackupKeyFormatError, d as generateBackupKeyPair, f as parseBackupPublicKey, i as BackupCancelledError, n as precheckRestoreKey, o as SystemBackupService, p as parseBackupSecretKey, r as prepareRestoreArchive, u as ENCRYPTED_BACKUP_SUFFIX } from "../../restore-archive-Bt65Em24.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -86720,15 +86720,66 @@ import_moleculer.default.Validators;
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/tls-tcp-transporter.ts
 /**
-* Moleculer TCP transporter with a mutual-TLS listener (D826).
+* Moleculer TCP transporter with a mutual-TLS listener (D826, D848).
 *
 * Hub: `hubTlsOnly` — no clear TCP reader and no UDP discovery; TLS 1.3 on
-* `tlsPort` (default 6443) once mesh material is ready. Agents without mesh
-* material use clear TCP on their own listen port and dial the hub on TLS when
-* enrolled. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
-* is dropped.
+* `tlsPort` (default 6443) once mesh material is ready, and every peer is
+* dialled on mutual TLS too (a TLS-only hub has no clear peer to talk to).
+*
+* Enrolled agent: `hubOnlyPeers` (D848) — the hub is its ONLY mesh peer. No
+* clear TCP reader; the TLS listener accepts the hub's certificate only; the
+* writer dials the hub only; and the nodes the hub's gossip names are not
+* adopted, so the agent never learns, dials or broadcasts to another agent.
+* An agent without mesh material keeps clear TCP (it can reach only a
+* pre-D826 hub).
+*
+* On a TLS socket, any packet whose `sender` ≠ the peer certificate CN is
+* dropped. A TLS-listening node advertises its listen port in the gossip
+* HELLO it sends on every connection (`meshTlsPort`,
+* {@link MESH_TLS_PORT_HELLO_FIELD}); a peer dials it there, else on the
+* cluster-wide default (6443) — so two nodes on one host need not collide.
 */
+/** Field of the gossip HELLO payload carrying the sender's mesh-TLS listen port. */
+var MESH_TLS_PORT_HELLO_FIELD = "meshTlsPort";
+/** Moleculer packet types (`packets.PACKET_GOSSIP_*`). */
+var PACKET_GOSSIP_RES = "GOSSIP_RES";
+var PACKET_GOSSIP_HELLO = "GOSSIP_HELLO";
+/** The hub's node id — the only peer of a `hubOnlyPeers` agent. */
+var DEFAULT_HUB_NODE_ID = "hub";
 var TcpTransporterBase = Transporters.TCP;
+/** The mesh-TLS port a gossip HELLO payload advertises, or null. */
+function helloMeshTlsPort(payload) {
+	if (payload === null || typeof payload !== "object") return null;
+	const port = Reflect.get(payload, MESH_TLS_PORT_HELLO_FIELD);
+	return typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
+}
+/**
+* A gossip response with every node but `keep` removed. With nothing to
+* remove the payload is returned unchanged.
+*/
+function keepOnlyGossipNodes(payload, keep) {
+	if (payload === null || typeof payload !== "object") return {
+		payload,
+		removed: []
+	};
+	const removed = [];
+	const filtered = { ...payload };
+	for (const section of ["online", "offline"]) {
+		const entries = Reflect.get(payload, section);
+		if (entries === null || typeof entries !== "object") continue;
+		const kept = {};
+		for (const [nodeId, value] of Object.entries(entries)) if (keep.has(nodeId)) kept[nodeId] = value;
+		else removed.push(nodeId);
+		filtered[section] = kept;
+	}
+	return removed.length === 0 ? {
+		payload,
+		removed
+	} : {
+		payload: filtered,
+		removed
+	};
+}
 /**
 * Extract `sender` from a Moleculer TCP packet without fully trusting it —
 * used only to compare against the TLS peer CN.
@@ -86770,6 +86821,13 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
 	hubTlsOnly;
+	hubOnlyPeers;
+	hubNodeId;
+	peerTlsPortOption;
+	/** Peers already reported as not adopted (D848) — one line each. */
+	ignoredPeers = /* @__PURE__ */ new Set();
+	/** Node id → the mesh-TLS port its last HELLO advertised. */
+	helloTlsPorts = /* @__PURE__ */ new Map();
 	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
 	clearWriterConnect = null;
 	writerTlsPatched = false;
@@ -86778,8 +86836,15 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		this.meshTls = opts.meshTls ?? null;
 		this.crl = opts.crl ?? processMeshCrl();
 		this.hubTlsOnly = opts.hubTlsOnly === true;
+		this.hubOnlyPeers = opts.hubOnlyPeers === true;
+		this.hubNodeId = opts.hubNodeId ?? DEFAULT_HUB_NODE_ID;
+		this.peerTlsPortOption = opts.peerTlsPort;
 		if (this.opts.tlsPort === void 0) this.opts.tlsPort = require_constants$8.DEFAULT_HUB_TLS_TCP_PORT;
 	}
+	/** Clear TCP is never served: the TLS-only hub, or an agent whose only peer is the hub. */
+	get tlsOnly() {
+		return this.hubTlsOnly || this.hubOnlyPeers;
+	}
 	startTcpServer() {
 		const started = super.startTcpServer();
 		if (this.meshTls !== null) this.patchWriterForTlsClient();
@@ -86789,8 +86854,8 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		return this.Promise.resolve().then(() => {
 			if (this.opts.urls) return this.loadUrls();
 		}).then(() => this.startTcpServer()).then(() => {
-			if (this.hubTlsOnly) this.disableClearTransport();
-		}).then(() => this.startTlsServerIfReady()).then(() => this.hubTlsOnly ? this.Promise.resolve() : this.startUdpServer()).then(() => this.startTimers()).then(() => {
+			if (this.tlsOnly) this.disableClearTransport();
+		}).then(() => this.startTlsServerIfReady()).then(() => this.tlsOnly ? this.Promise.resolve() : this.startUdpServer()).then(() => this.startTimers()).then(() => {
 			this.logger.info("TCP Transporter started.");
 			this.connected = true;
 			this.nodes.localNode.port = this.opts.port;
@@ -86798,17 +86863,19 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		}).then(() => this.onConnected());
 	}
 	/**
-	* Outbound dial uses mTLS when the peer is already known on TLS (inbound
-	* handshake), or when dialling the hub node id (agent → hub). Everyone else
-	* (runners, unenrolled agents) stays on the clear writer — the hub must not
-	* TLS-wrap every `connect` after deferred `enableMeshTls`.
+	* Outbound dial uses mTLS when dialling the hub node id (agent → hub), on a
+	* TLS-only hub (it has no clear listener, so no clear peer exists to dial —
+	* D848 closes the hub → agent clear leg), or when the peer is already known
+	* on TLS (inbound handshake).
 	*/
 	shouldDialPeerWithTls(nodeID) {
-		if (nodeID === "hub") return true;
+		if (nodeID === this.hubNodeId) return true;
+		if (this.hubTlsOnly) return true;
 		return this.tlsPeers.has(nodeID);
 	}
-	peerTlsDialPort() {
-		return this.opts.tlsPort ?? 6443;
+	/** The peer's advertised mesh-TLS port, else the configured dial port, else 6443. */
+	peerTlsDialPort(nodeID) {
+		return this.helloTlsPorts.get(nodeID) ?? this.peerTlsPortOption ?? this.opts.tlsPort ?? 6443;
 	}
 	/**
 	* Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
@@ -86828,13 +86895,14 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		const crl = this.crl;
 		const self = this;
 		writer.connect = (nodeID) => {
+			if (self.hubOnlyPeers && nodeID !== self.hubNodeId) return writer.Promise.reject(/* @__PURE__ */ new Error(`mesh: an enrolled agent dials only "${self.hubNodeId}", not "${nodeID}"`));
 			if (!self.shouldDialPeerWithTls(nodeID)) return clearConnect(nodeID);
 			const material = self.meshTls;
 			if (material === null) return clearConnect(nodeID);
 			const node = writer.transporter.getNode(nodeID);
 			if (!node) return writer.Promise.reject(/* @__PURE__ */ new Error(`Missing node info for '${nodeID}'!`));
 			const host = writer.transporter.getNodeAddress(node);
-			const port = self.peerTlsDialPort();
+			const port = self.peerTlsDialPort(nodeID);
 			writer.logger.debug(`Connecting (TLS) to '${nodeID}' via ${host}:${port}`);
 			return new writer.Promise((resolve, reject) => {
 				const socket = node_tls.connect({
@@ -86940,7 +87008,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	}
 	/** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
 	async enableClearTransport() {
-		if (this.hubTlsOnly) return;
+		if (this.tlsOnly) return;
 		if (!this.clearDisabled) return;
 		this.clearDisabled = false;
 		if (this.reader !== null && this.reader.server?.listening !== true) await this.reader.listen();
@@ -86972,7 +87040,53 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		this.tlsPeers.clear();
 		return super.disconnect();
 	}
+	/**
+	* D848: an enrolled agent adopts no node from the hub's gossip but the hub
+	* itself, so it never learns — and therefore never dials or broadcasts to —
+	* another agent. Everything else is Moleculer's own handling.
+	*/
+	receive(cmd, data, socket) {
+		if (cmd === PACKET_GOSSIP_HELLO) this.noteHelloTlsPort(data);
+		if (!this.hubOnlyPeers || cmd !== PACKET_GOSSIP_RES) return super.receive(cmd, data, socket);
+		let payload;
+		try {
+			payload = this.broker.serializer.deserialize(data, cmd);
+		} catch {
+			return super.receive(cmd, data, socket);
+		}
+		const filtered = keepOnlyGossipNodes(payload, new Set([this.hubNodeId, this.nodeID]));
+		if (filtered.removed.length === 0) return super.receive(cmd, data, socket);
+		for (const nodeId of filtered.removed) {
+			if (this.ignoredPeers.has(nodeId)) continue;
+			this.ignoredPeers.add(nodeId);
+			this.logger.info(`Mesh: not adopting node '${nodeId}' from the hub's gossip — an enrolled agent's only peer is the hub (D848)`);
+		}
+		return super.receive(cmd, this.broker.serializer.serialize(filtered.payload, cmd), socket);
+	}
+	/** Remember the TLS port a peer's HELLO advertises (absent: an older node → the default). */
+	noteHelloTlsPort(data) {
+		let payload;
+		try {
+			payload = this.broker.serializer.deserialize(data, PACKET_GOSSIP_HELLO);
+		} catch {
+			return;
+		}
+		const sender = payload !== null && typeof payload === "object" ? Reflect.get(payload, "sender") : null;
+		if (typeof sender !== "string") return;
+		const port = helloMeshTlsPort(payload);
+		if (port === null) this.helloTlsPorts.delete(sender);
+		else this.helloTlsPorts.set(sender, port);
+	}
+	/** A TLS-listening node says where in every HELLO it sends. */
+	publish(packet) {
+		if (packet.type === PACKET_GOSSIP_HELLO && this.tlsServer !== null) packet.payload[MESH_TLS_PORT_HELLO_FIELD] = this.opts.tlsPort;
+		return super.publish(packet);
+	}
 	onIncomingMessage(type, message, socket) {
+		if (this.hubOnlyPeers && (socket === void 0 || !isTlsSocket(socket))) {
+			this.logger.warn("Dropping mesh packet — an enrolled agent accepts TLS from the hub only");
+			return;
+		}
 		if (socket !== void 0 && isTlsSocket(socket)) {
 			const tlsSock = socket;
 			const identity = tlsSock.meshPeerCn ? {
@@ -87043,6 +87157,11 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 			socket.destroy();
 			return;
 		}
+		if (this.hubOnlyPeers && identity.cn !== this.hubNodeId) {
+			this.logger.warn(`Mesh TLS client rejected — an enrolled agent accepts only '${this.hubNodeId}', not CN=${identity.cn} (D848)`);
+			socket.destroy();
+			return;
+		}
 		socket.meshPeerCn = identity.cn;
 		socket.meshPeerSerial = identity.serial;
 		this.tlsSockets.add(socket);
@@ -87745,6 +87864,7 @@ exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.Errors = Errors;
 exports.JoinTokenJtiStore = JoinTokenJtiStore;
 exports.MESH_AUTH_MODE_FIELD = MESH_AUTH_MODE_FIELD;
+exports.MESH_TLS_PORT_HELLO_FIELD = MESH_TLS_PORT_HELLO_FIELD;
 exports.MeshCaKeeper = MeshCaKeeper;
 exports.MeshCrl = MeshCrl;
 exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;