pairling 0.2.7 → 0.2.8

package/payload/mac/install/uninstall-runtime.sh

@@ -11,6 +11,11 @@ USER_PLIST="$HOME/Library/LaunchAgents/$PAIRLING_DAEMON_LABEL.plist"
 CONNECTD_USER_PLIST="$HOME/Library/LaunchAgents/$PAIRLING_CONNECTD_LABEL.plist"
 PTYBROKER_USER_PLIST="$HOME/Library/LaunchAgents/$PAIRLING_PTYBROKER_LABEL.plist"
 SYSTEM_PLIST="/Library/LaunchDaemons/$PAIRLING_GUARDIAN_LABEL.plist"
+# Legacy: the silent-join mint broker, removed from the product. Torn down below.
+MINTD_SYSTEM_LABEL="dev.pairling.mintd"
+MINTD_SYSTEM_PLIST="/Library/LaunchDaemons/$MINTD_SYSTEM_LABEL.plist"
+MINTD_SYSTEM_DIR="/Library/Application Support/Pairling/mint"
+MINTD_SERVICE_ACCOUNT="_pairling_mint"
 YES="false"
 DELETE_STATE="false"
 DELETE_LOGS="false"
@@ -98,6 +103,32 @@ bootout_system() {
   fi
 }
 
+# Legacy teardown: the silent-join mint broker (dev.pairling.mintd) was removed
+# from the product. Machines that ran the old `enable-silent-join` still carry a
+# root LaunchDaemon, a stored Tailscale OAuth secret under the system mint dir,
+# and the _pairling_mint role account. Remove all three. Best-effort, sudo-gated.
+teardown_legacy_mintd() {
+  if [[ ! -f "$MINTD_SYSTEM_PLIST" && ! -d "$MINTD_SYSTEM_DIR" ]] \
+     && ! id -u "$MINTD_SERVICE_ACCOUNT" >/dev/null 2>&1; then
+    return
+  fi
+  if is_dry_run; then
+    printf 'dry-run: would remove the legacy silent-join mint broker (%s, %s, user %s)\n' \
+      "$MINTD_SYSTEM_PLIST" "$MINTD_SYSTEM_DIR" "$MINTD_SERVICE_ACCOUNT"
+    return
+  fi
+  if sudo -n true >/dev/null 2>&1; then
+    sudo launchctl bootout "system/$MINTD_SYSTEM_LABEL" >/dev/null 2>&1 || true
+    sudo launchctl bootout system "$MINTD_SYSTEM_PLIST" >/dev/null 2>&1 || true
+    sudo rm -f "$MINTD_SYSTEM_PLIST"
+    sudo rm -rf "$MINTD_SYSTEM_DIR"
+    sudo /usr/sbin/sysadminctl -deleteUser "$MINTD_SERVICE_ACCOUNT" >/dev/null 2>&1 || true
+    printf 'Removed the legacy silent-join mint broker.\n'
+  else
+    printf 'Skipping legacy mint-broker removal: passwordless sudo is unavailable.\n' >&2
+  fi
+}
+
 confirm
 
 bootout_user "$PAIRLING_DAEMON_LABEL" "$USER_PLIST"
@@ -107,6 +138,7 @@ rm -f "$USER_PLIST"
 rm -f "$CONNECTD_USER_PLIST"
 rm -f "$PTYBROKER_USER_PLIST"
 bootout_system "$PAIRLING_GUARDIAN_LABEL" "$SYSTEM_PLIST"
+teardown_legacy_mintd
 
 rm -rf "$APP_SUPPORT/pair" 2>/dev/null || true
 

package/payload-manifest.json

@@ -1,11 +1,11 @@
 {
   "connectd": {
     "darwin-arm64": {
-      "sha256": "9941dbf0462cd6140c24d3c37f3351aa6dbe093183740fd042ddaa6f44cb1c65",
+      "sha256": "d4d9439eae6cfa244b491b5086050f932fe78058e5ac18a876b80b20ea8517ad",
       "team_id": "965AVD34A3"
     },
     "darwin-x64": {
-      "sha256": "66f6f18d836e43389d6efd70b0bd59200daaf668220907a6f1bfde17983ae7fe",
+      "sha256": "936c7046bfc3cd84289881444da57ad025d5c734c44a01c2dcbd9eb2afc7cbb8",
       "team_id": "965AVD34A3"
     }
   },
@@ -20,11 +20,11 @@
     },
     {
       "path": "payload/mac/SOURCE_REVISION",
-      "sha256": "15d265ea54cc0e8147c8f5e60a9f83297966a1f7c059888a09d97d3e5b7a6d0c"
+      "sha256": "354ac93fcb550a4bf353e3857282bafb747f158ce1ad6e7068a5d85c5cd071bd"
     },
     {
       "path": "payload/mac/VERSION",
-      "sha256": "5b57e3b8c153d1d33b0c0f1ee29d3de1bf93232ed95aa78b80fe885e99faa915"
+      "sha256": "283571d2642fc7b3befd294f45d53b896a1d54d34c86235b13151192b380606a"
     },
     {
       "path": "payload/mac/companiond/app_attest_lan.py",
@@ -96,7 +96,7 @@
     },
     {
       "path": "payload/mac/companiond/pairlingd.py",
-      "sha256": "ee2a9115531a15f9cc3aff0680be3bb7ab7b42c7cf001eac05b33cbf36755842"
+      "sha256": "e69188ec651d0a04af5cad73c9dd0a81dfa6455b6e32f8b733c412d11a4ead9e"
     },
     {
       "path": "payload/mac/companiond/providers/__init__.py",
@@ -210,18 +210,6 @@
       "path": "payload/mac/connectd/cmd/pairling-connectd/upstream_health_test.go",
       "sha256": "dc5b6d3a8d11f38bcc198287bdbc95f058d35792ca6cf34bc49ca0bed22bfacf"
     },
-    {
-      "path": "payload/mac/connectd/cmd/pairling-tailnet-mintd/main.go",
-      "sha256": "64fd4527c97397fce10793001af8d59ac3154c75c7ed9e1b532f8f2e4bf88bd4"
-    },
-    {
-      "path": "payload/mac/connectd/cmd/pairling-tailnet-mintd/mintd.go",
-      "sha256": "ca49b8ab8216eeec770ad6e9e8111aca819a9a88b050d7eefbdf69c0fad20376"
-    },
-    {
-      "path": "payload/mac/connectd/cmd/pairling-tailnet-mintd/mintd_test.go",
-      "sha256": "14a9af6b9575ba89314ce05f2fe465844fea3bb40b3eba5e0d33d059608bfb1f"
-    },
     {
       "path": "payload/mac/connectd/go.mod",
       "sha256": "c96748d396598b0952b4c0d43f7f85ca3a56f4019761088267421b22518d5905"
@@ -284,7 +272,7 @@
     },
     {
       "path": "payload/mac/install/install-runtime.sh",
-      "sha256": "152eed164fd4edfd42874f20e8476d8e42415d5e93e090b716fef2ea7ed6424e"
+      "sha256": "40ffa67a3833ce4342c241ca4f1e7dec471a86b0c80359746cd75a8df2e33f60"
     },
     {
       "path": "payload/mac/install/psk_dependency_check.py",
@@ -292,11 +280,11 @@
     },
     {
       "path": "payload/mac/install/render-launchd.py",
-      "sha256": "5c4c06b578e24726731650ff39d688248ba1bd412b9e21fc368b13d07e8ee0df"
+      "sha256": "29db1aa46d62cd23ba27ab283bb990d168bfc08fb82cfc681046dc7b887d85fe"
     },
     {
       "path": "payload/mac/install/uninstall-runtime.sh",
-      "sha256": "8af7b3bb4de4b053888fe44a9fdb576144d6cb154bafc9b3d02edac90a7055ec"
+      "sha256": "0edeb5336a71c235d8796a8e59072c6d8983d196de5aae0cfcb4b0c3560fa33f"
     },
     {
       "path": "payload/mac/mcp/phone_tools.py",
@@ -307,19 +295,9 @@
       "sha256": "5ebcd63fc53114ace518807c2221e562e65237e57945a76c457f5931a5791cc1"
     }
   ],
-  "mintd": {
-    "darwin-arm64": {
-      "sha256": "326d1d42a0b40bdb60687f7b7d190c12c520106e47542054b1b807d397e41fe9",
-      "team_id": "965AVD34A3"
-    },
-    "darwin-x64": {
-      "sha256": "477cf4d9b88f1e8303e5545eb3c03460e0c75b284f9d628641cb80e2be14af38",
-      "team_id": "965AVD34A3"
-    }
-  },
   "package": "pairling",
-  "package_version": "0.2.7",
+  "package_version": "0.2.8",
   "schema_version": 1,
   "source_dirty": false,
-  "source_revision": "102b7cf"
+  "source_revision": "c07a6fd"
 }

package/payload/mac/connectd/cmd/pairling-tailnet-mintd/main.go

@@ -1,121 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"os/exec"
-	"os/signal"
-	"strconv"
-	"strings"
-	"syscall"
-	"time"
-)
-
-func main() {
-	var (
-		secretPath    = flag.String("secret-path", "/Library/Application Support/Pairling/mint/client_secret.json", "OAuth client credential JSON")
-		socketPath    = flag.String("socket-path", "/Library/Application Support/Pairling/run/mintd/mintd.sock", "Unix socket path")
-		statePath     = flag.String("state-path", "/Library/Application Support/Pairling/mint/state.json", "persistent rate-limit state JSON")
-		auditPath     = flag.String("audit-path", "/Library/Application Support/Pairling/mint/audit.jsonl", "audit JSONL path")
-		alertPath     = flag.String("alert-path", "/Library/Application Support/Pairling/run/mintd/alerts.jsonl", "health-readable alert JSONL path")
-		apiBaseURL    = flag.String("api-base-url", "https://api.tailscale.com/api/v2", "Tailscale API base URL")
-		oauthURL      = flag.String("oauth-url", "https://api.tailscale.com/api/v2/oauth/token", "Tailscale OAuth token URL")
-		authorizedUID = flag.Int("authorized-uid", -1, "only this peer uid may request mints")
-	)
-	flag.Parse()
-
-	b, err := NewBroker(BrokerConfig{
-		SecretPath: *secretPath,
-		StatePath:  *statePath,
-		AuditPath:  *auditPath,
-		AlertPath:  *alertPath,
-		OAuthURL:   *oauthURL,
-		APIBaseURL: *apiBaseURL,
-		LockStatus: defaultLockStatus,
-	})
-	if err != nil {
-		log.Fatal(err)
-	}
-	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
-	defer stop()
-	if err := b.ServeUnix(ctx, *socketPath, *authorizedUID); err != nil {
-		log.Fatal(err)
-	}
-}
-
-func defaultLockStatus(ctx context.Context) (bool, error) {
-	if locked, err := lockStatusFromConnectdStatus(ctx, "http://127.0.0.1:7774/status"); err == nil {
-		return locked, nil
-	}
-	return lockStatusFromCandidates(ctx, []string{
-		"/opt/homebrew/bin/tailscale",
-		"/Applications/Tailscale.app/Contents/MacOS/Tailscale",
-		"tailscale",
-	})
-}
-
-func lockStatusFromConnectdStatus(ctx context.Context, statusURL string) (bool, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, statusURL, nil)
-	if err != nil {
-		return false, err
-	}
-	resp, err := (&http.Client{Timeout: 2 * time.Second}).Do(req)
-	if err != nil {
-		return false, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return false, fmt.Errorf("connectd status returned %s", resp.Status)
-	}
-	var body struct {
-		TailnetLockEnabled *bool `json:"tailnet_lock_enabled"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
-		return false, err
-	}
-	if body.TailnetLockEnabled == nil {
-		return false, errors.New("connectd status omitted tailnet_lock_enabled")
-	}
-	return *body.TailnetLockEnabled, nil
-}
-
-func lockStatusFromCandidates(ctx context.Context, candidates []string) (bool, error) {
-	var errs []error
-	for _, bin := range candidates {
-		out, err := exec.CommandContext(ctx, bin, "lock", "status").CombinedOutput()
-		if err != nil {
-			errs = append(errs, fmt.Errorf("%s: %w", bin, err))
-			continue
-		}
-		text := strings.ToLower(string(out))
-		if strings.Contains(text, "tailscale gui failed to start") {
-			errs = append(errs, fmt.Errorf("%s: gui unavailable", bin))
-			continue
-		}
-		if strings.Contains(text, "not enabled") || strings.Contains(text, "disabled") {
-			return false, nil
-		}
-		if strings.Contains(text, "enabled") {
-			return true, nil
-		}
-		return false, fmt.Errorf("unrecognized tailscale lock status: %q", strings.TrimSpace(string(out)))
-	}
-	return false, errors.New("tailscale lock status unavailable: " + joinErrors(errs))
-}
-
-func joinErrors(errs []error) string {
-	parts := make([]string, 0, len(errs))
-	for _, err := range errs {
-		parts = append(parts, err.Error())
-	}
-	if len(parts) == 0 {
-		return "no candidates"
-	}
-	return strconv.Quote(strings.Join(parts, "; "))
-}

package/payload/mac/connectd/cmd/pairling-tailnet-mintd/mintd.go

@@ -1,418 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strconv"
-	"sync"
-	"time"
-
-	"github.com/tailscale/peercred"
-	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/clientcredentials"
-)
-
-const phoneTag = "tag:pairling-phone"
-
-var pairIDPattern = regexp.MustCompile(`^pair_[A-Za-z0-9][A-Za-z0-9_-]{0,127}$`)
-
-var peerUID = func(conn net.Conn) (string, error) {
-	creds, err := peercred.Get(conn)
-	if err != nil {
-		return "", err
-	}
-	uid, ok := creds.UserID()
-	if !ok {
-		return "", fmt.Errorf("peer uid unavailable")
-	}
-	return uid, nil
-}
-
-type BrokerConfig struct {
-	SecretPath string
-	StatePath  string
-	AuditPath  string
-	AlertPath  string
-	OAuthURL   string
-	APIBaseURL string
-	Now        func() time.Time
-	LockStatus func(context.Context) (bool, error)
-	HTTPClient *http.Client
-}
-
-type Broker struct {
-	cfg         BrokerConfig
-	mu          sync.Mutex
-	tokenSource oauth2.TokenSource
-}
-
-type clientSecret struct {
-	ClientID     string   `json:"client_id"`
-	ClientSecret string   `json:"client_secret"`
-	Scopes       []string `json:"scopes,omitempty"`
-	Tags         []string `json:"tags,omitempty"`
-}
-
-type MintResult struct {
-	AuthKey   string `json:"authkey"`
-	KeyID     string `json:"key_id"`
-	ExpiresAt int64  `json:"expires_at"`
-}
-
-type socketRequest struct {
-	Op     string `json:"op"`
-	PairID string `json:"pair_id"`
-}
-
-type socketResponse struct {
-	OK        bool   `json:"ok"`
-	AuthKey   string `json:"authkey,omitempty"`
-	KeyID     string `json:"key_id,omitempty"`
-	ExpiresAt int64  `json:"expires_at,omitempty"`
-	Error     string `json:"error,omitempty"`
-}
-
-type brokerState struct {
-	SuccessfulPairs map[string]int64 `json:"successful_pairs,omitempty"`
-	SuccessfulMints []int64          `json:"successful_mints,omitempty"`
-}
-
-func NewBroker(cfg BrokerConfig) (*Broker, error) {
-	if cfg.OAuthURL == "" {
-		cfg.OAuthURL = "https://api.tailscale.com/api/v2/oauth/token"
-	}
-	if cfg.APIBaseURL == "" {
-		cfg.APIBaseURL = "https://api.tailscale.com/api/v2"
-	}
-	if cfg.Now == nil {
-		cfg.Now = time.Now
-	}
-	if cfg.HTTPClient == nil {
-		cfg.HTTPClient = http.DefaultClient
-	}
-	return &Broker{cfg: cfg}, nil
-}
-
-func writeClientSecret(path string, secret clientSecret) error {
-	data, err := json.MarshalIndent(secret, "", "  ")
-	if err != nil {
-		return err
-	}
-	data = append(data, '\n')
-	return os.WriteFile(path, data, 0o600)
-}
-
-func readClientSecret(path string) (clientSecret, error) {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return clientSecret{}, err
-	}
-	var secret clientSecret
-	if err := json.Unmarshal(data, &secret); err != nil {
-		return clientSecret{}, err
-	}
-	if secret.ClientID == "" || secret.ClientSecret == "" {
-		return clientSecret{}, fmt.Errorf("missing client_id or client_secret")
-	}
-	return secret, nil
-}
-
-func (b *Broker) MintPhoneKey(ctx context.Context, pairID string) (MintResult, error) {
-	if !pairIDPattern.MatchString(pairID) {
-		return MintResult{}, fmt.Errorf("invalid pair_id")
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	state, err := b.loadState()
-	if err != nil {
-		return MintResult{}, err
-	}
-	now := b.cfg.Now().Unix()
-	if state.SuccessfulPairs[pairID] != 0 {
-		_ = b.alert(map[string]any{
-			"event":   "duplicate_pair_id",
-			"ts":      now,
-			"pair_id": pairID,
-		})
-		return MintResult{}, fmt.Errorf("pair_id already minted")
-	}
-	state.SuccessfulMints = pruneSince(state.SuccessfulMints, now-24*60*60)
-	if countSince(state.SuccessfulMints, now-10*60) >= 3 {
-		_ = b.alert(map[string]any{
-			"event":   "mint_rate_limited",
-			"ts":      now,
-			"pair_id": pairID,
-			"window":  "10m",
-		})
-		return MintResult{}, fmt.Errorf("mint rate limited")
-	}
-	if len(state.SuccessfulMints) >= 12 {
-		_ = b.alert(map[string]any{
-			"event":   "mint_rate_limited",
-			"ts":      now,
-			"pair_id": pairID,
-			"window":  "24h",
-		})
-		return MintResult{}, fmt.Errorf("mint rate limited")
-	}
-	locked, err := b.lockEnabled(ctx)
-	if err != nil {
-		return MintResult{}, err
-	}
-	if locked {
-		return MintResult{}, fmt.Errorf("tailnet lock enabled; unsigned minting is disabled")
-	}
-	secret, err := readClientSecret(b.cfg.SecretPath)
-	if err != nil {
-		return MintResult{}, err
-	}
-	token, err := b.token(ctx, secret)
-	if err != nil {
-		return MintResult{}, err
-	}
-	body := map[string]any{
-		"capabilities": map[string]any{
-			"devices": map[string]any{
-				"create": map[string]any{
-					"reusable":      false,
-					"ephemeral":     false,
-					"preauthorized": true,
-					"tags":          []string{phoneTag},
-				},
-			},
-		},
-		"expirySeconds": 600,
-	}
-	payload, err := json.Marshal(body)
-	if err != nil {
-		return MintResult{}, err
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, b.cfg.APIBaseURL+"/tailnet/-/keys", bytes.NewReader(payload))
-	if err != nil {
-		return MintResult{}, err
-	}
-	req.Header.Set("Authorization", "Bearer "+token.AccessToken)
-	req.Header.Set("Content-Type", "application/json")
-	resp, err := b.cfg.HTTPClient.Do(req)
-	if err != nil {
-		return MintResult{}, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return MintResult{}, fmt.Errorf("tailscale key mint failed: %s", resp.Status)
-	}
-	var out struct {
-		ID      string `json:"id"`
-		Key     string `json:"key"`
-		Expires string `json:"expires"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
-		return MintResult{}, err
-	}
-	exp, _ := time.Parse(time.RFC3339, out.Expires)
-	result := MintResult{AuthKey: out.Key, KeyID: out.ID, ExpiresAt: exp.Unix()}
-	state.SuccessfulPairs[pairID] = now
-	state.SuccessfulMints = append(state.SuccessfulMints, now)
-	if err := b.saveState(state); err != nil {
-		return MintResult{}, err
-	}
-	if err := b.audit(map[string]any{
-		"event":   "mint_success",
-		"ts":      now,
-		"pair_id": pairID,
-		"key_id":  out.ID,
-	}); err != nil {
-		return MintResult{}, err
-	}
-	return result, nil
-}
-
-func pruneSince(times []int64, cutoff int64) []int64 {
-	kept := times[:0]
-	for _, ts := range times {
-		if ts >= cutoff {
-			kept = append(kept, ts)
-		}
-	}
-	return kept
-}
-
-func countSince(times []int64, cutoff int64) int {
-	count := 0
-	for _, ts := range times {
-		if ts >= cutoff {
-			count++
-		}
-	}
-	return count
-}
-
-func (b *Broker) token(ctx context.Context, secret clientSecret) (*oauth2.Token, error) {
-	if b.tokenSource == nil {
-		oauth := clientcredentials.Config{
-			ClientID:     secret.ClientID,
-			ClientSecret: secret.ClientSecret,
-			TokenURL:     b.cfg.OAuthURL,
-			Scopes:       []string{"auth_keys"},
-		}
-		ctx = context.WithValue(ctx, oauth2.HTTPClient, b.cfg.HTTPClient)
-		b.tokenSource = oauth2.ReuseTokenSource(nil, oauth.TokenSource(ctx))
-	}
-	return b.tokenSource.Token()
-}
-
-func (b *Broker) lockEnabled(ctx context.Context) (bool, error) {
-	if b.cfg.LockStatus == nil {
-		return false, nil
-	}
-	return b.cfg.LockStatus(ctx)
-}
-
-func (b *Broker) ServeUnix(ctx context.Context, socketPath string, authorizedUID int) error {
-	if authorizedUID < 0 {
-		return fmt.Errorf("authorized uid required")
-	}
-	if err := os.MkdirAll(filepath.Dir(socketPath), 0o750); err != nil {
-		return err
-	}
-	_ = os.Remove(socketPath)
-	l, err := net.Listen("unix", socketPath)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		_ = l.Close()
-		_ = os.Remove(socketPath)
-	}()
-	_ = os.Chmod(socketPath, 0o660)
-	go func() {
-		<-ctx.Done()
-		_ = l.Close()
-	}()
-	for {
-		conn, err := l.Accept()
-		if err != nil {
-			if ctx.Err() != nil {
-				return nil
-			}
-			return err
-		}
-		go b.handleConn(ctx, conn, authorizedUID)
-	}
-}
-
-func (b *Broker) handleConn(ctx context.Context, conn net.Conn, authorizedUID int) {
-	defer conn.Close()
-	uid, err := peerUID(conn)
-	if err != nil {
-		_ = json.NewEncoder(conn).Encode(socketResponse{OK: false, Error: "peercred_unavailable"})
-		return
-	}
-	if err := authorizePeer(uid, authorizedUID); err != nil {
-		_ = b.alert(map[string]any{"event": "unexpected_peer_uid", "ts": b.cfg.Now().Unix(), "uid": uid})
-		_ = json.NewEncoder(conn).Encode(socketResponse{OK: false, Error: "unauthorized_peer"})
-		return
-	}
-	var req socketRequest
-	if err := json.NewDecoder(conn).Decode(&req); err != nil {
-		_ = json.NewEncoder(conn).Encode(socketResponse{OK: false, Error: "bad_json"})
-		return
-	}
-	if req.Op != "mint_phone_key" || req.PairID == "" {
-		_ = json.NewEncoder(conn).Encode(socketResponse{OK: false, Error: "bad_request"})
-		return
-	}
-	res, err := b.MintPhoneKey(ctx, req.PairID)
-	if err != nil {
-		_ = json.NewEncoder(conn).Encode(socketResponse{OK: false, Error: err.Error()})
-		return
-	}
-	_ = json.NewEncoder(conn).Encode(socketResponse{
-		OK:        true,
-		AuthKey:   res.AuthKey,
-		KeyID:     res.KeyID,
-		ExpiresAt: res.ExpiresAt,
-	})
-}
-
-func authorizePeer(uid string, authorizedUID int) error {
-	if uid != strconv.Itoa(authorizedUID) {
-		return fmt.Errorf("unexpected peer uid")
-	}
-	return nil
-}
-
-func (b *Broker) loadState() (brokerState, error) {
-	state := brokerState{SuccessfulPairs: map[string]int64{}}
-	if b.cfg.StatePath == "" {
-		return state, nil
-	}
-	data, err := os.ReadFile(b.cfg.StatePath)
-	if os.IsNotExist(err) {
-		return state, nil
-	}
-	if err != nil {
-		return state, err
-	}
-	if err := json.Unmarshal(data, &state); err != nil {
-		return state, err
-	}
-	if state.SuccessfulPairs == nil {
-		state.SuccessfulPairs = map[string]int64{}
-	}
-	return state, nil
-}
-
-func (b *Broker) saveState(state brokerState) error {
-	if b.cfg.StatePath == "" {
-		return nil
-	}
-	if err := os.MkdirAll(filepath.Dir(b.cfg.StatePath), 0o700); err != nil {
-		return err
-	}
-	data, err := json.MarshalIndent(state, "", "  ")
-	if err != nil {
-		return err
-	}
-	data = append(data, '\n')
-	return os.WriteFile(b.cfg.StatePath, data, 0o600)
-}
-
-func (b *Broker) audit(record map[string]any) error {
-	return appendJSONL(b.cfg.AuditPath, record, 0o700, 0o600)
-}
-
-func (b *Broker) alert(record map[string]any) error {
-	if err := b.audit(record); err != nil {
-		return err
-	}
-	return appendJSONL(b.cfg.AlertPath, record, 0o750, 0o640)
-}
-
-func appendJSONL(path string, record map[string]any, dirMode, fileMode os.FileMode) error {
-	if path == "" {
-		return nil
-	}
-	if err := os.MkdirAll(filepath.Dir(path), dirMode); err != nil {
-		return err
-	}
-	data, err := json.Marshal(record)
-	if err != nil {
-		return err
-	}
-	data = append(data, '\n')
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, fileMode)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	_, err = f.Write(data)
-	return err
-}