talon-agent 5.14.0 → 5.18.2

package/src/frontend/native/bridge/routes/mesh.ts

@@ -2,6 +2,37 @@ import type { RouteHost } from "./host.js";
 import type { BridgeRoutes } from "./table.js";
 import type { ServerResponse } from "node:http";
 import { deviceIdParam } from "./params.js";
+import { claimDevice } from "../credentials/claims.js";
+import { credentialHint } from "../credentials/upgrade.js";
+import type { RouteContext } from "./table.js";
+
+/**
+ * Resolve the device a mesh request acts as — the spoofing check. Returns
+ * the effective id (a per-device credential's own device when the request
+ * named none), or null after answering 403 for a claim the credential may
+ * not make.
+ */
+function actingDevice(
+  host: RouteHost,
+  ctx: RouteContext,
+  claimed: unknown,
+): { deviceId: string | undefined } | null {
+  const named =
+    typeof claimed === "string" && claimed.trim() ? claimed.trim() : undefined;
+  const claim = claimDevice(ctx.principal, named, host.credentials);
+  if (claim.ok) return { deviceId: claim.deviceId };
+  host.json(ctx.res, 403, { ok: false, error: claim.error });
+  return null;
+}
+
+/** Stamp the acting device onto a body field the handler reads it from. */
+function withDevice(
+  body: Record<string, unknown>,
+  field: "id" | "deviceId",
+  deviceId: string | undefined,
+): Record<string, unknown> {
+  return deviceId === undefined ? body : { ...body, [field]: deviceId };
+}
 
 // Streamed device file transfers (see core/mesh/transfers/transfers.ts). The
 // one-time `transfer` token authorizes exactly one direction+path; the
@@ -34,33 +65,59 @@ export function meshRoutes(
   return {
     // ── Mesh ───────────────────────────────────────────────────────────
 
-    "POST /devices/register": async ({ req, res }) => {
-      const body = await readJson(req);
-      const device = await h.registerDevice(body);
-      json(res, 200, { ok: true, deviceId: device.id });
+    // Registration is also the heartbeat, so its reply is where a device
+    // learns it should trade the shared token for its own credential, or
+    // rotate the one it has (`credential.action`).
+    "POST /devices/register": async (ctx) => {
+      const body = await readJson(ctx.req);
+      const acting = actingDevice(host, ctx, body.id);
+      if (!acting) return;
+      const device = await h.registerDevice(
+        withDevice(body, "id", acting.deviceId),
+      );
+      const hint = credentialHint(host.credentials, ctx.principal);
+      json(ctx.res, 200, {
+        ok: true,
+        deviceId: device.id,
+        ...(hint ? { credential: hint } : {}),
+      });
     },
-    "POST /location": async ({ req, res }) => {
-      const body = await readJson(req);
-      await h.storeLocation(body);
-      json(res, 200, { ok: true });
+    "POST /location": async (ctx) => {
+      const body = await readJson(ctx.req);
+      const acting = actingDevice(host, ctx, body.deviceId);
+      if (!acting) return;
+      await h.storeLocation(withDevice(body, "deviceId", acting.deviceId));
+      json(ctx.res, 200, { ok: true });
     },
     "GET /devices": async ({ res }) => json(res, 200, await h.listDevices()),
-    "POST /devices/command-result": async ({ req, res }) => {
-      const body = await readJson(req);
+    "POST /devices/command-result": async (ctx) => {
+      const body = await readJson(ctx.req);
+      // A credential answers as its own device only — so it can never
+      // complete (or forge the result of) another device's command.
+      const acting = actingDevice(host, ctx, body.deviceId);
+      if (!acting) return;
       // ok:false for a late/unknown correlation id — not an HTTP error,
       // the device's POST was well-formed; nothing was waiting anymore.
-      json(res, 200, { ok: h.completeCommand(body) });
+      json(ctx.res, 200, {
+        ok: h.completeCommand(withDevice(body, "deviceId", acting.deviceId)),
+      });
     },
-    "POST /devices/file": async ({ req, res, url }) => {
+    "POST /devices/file": async (ctx) => {
+      const { req, res, url } = ctx;
+      const acting = actingDevice(host, ctx, deviceIdParam(url));
+      if (!acting) return;
       const token = transferToken(host, url, res);
       if (token === null) return;
-      const result = await h.acceptFileUpload(token, req, deviceIdParam(url));
+      const result = await h.acceptFileUpload(token, req, acting.deviceId);
       json(res, result.ok ? 200 : 409, result);
     },
-    "GET /devices/file": async ({ res, url }) => {
+    "GET /devices/file": async (ctx) => {
+      const { res, url } = ctx;
+      const acting = actingDevice(host, ctx, deviceIdParam(url));
+      if (!acting) return;
       const token = transferToken(host, url, res);
       if (token === null) return;
-      const file = await h.openFileDownload(token, deviceIdParam(url));
+      const file = await h.openFileDownload(token, acting.deviceId);
       if (!file)
         return json(res, 404, {
           ok: false,

package/src/frontend/native/bridge/routes/table.ts

@@ -1,4 +1,11 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import type {
+  BridgePrincipal,
+  BridgeRouteAuth,
+  BridgeScope,
+} from "../credentials/principal.js";
+
+export type { BridgeRouteAuth };
 
 /**
  * ok: request carries the right token (or none is required).
@@ -7,22 +14,18 @@ import type { IncomingMessage, ServerResponse } from "node:http";
  */
 export type AuthState = "ok" | "anonymous" | "bad";
 
-/**
- * "public": served without a bearer token. Every entry is gated some other
- * way — a single-use grant minted by the daemon, or (for /health) by
- * answering only what pairing needs until a token is presented.
- * "bearer": the request must carry the bridge token.
- */
-export type BridgeRouteAuth = "public" | "bearer";
+/** Any authenticated caller — the route itself decides what it may see. */
+const ANY: readonly BridgeScope[] = ["device", "client", "operator"];
 
 /**
  * The bridge's routes and the auth tier of each — declared once, here,
  * rather than implied by where an `if` sits relative to the auth check.
  * The security posture of the transport is this table: a route is
- * pre-auth only by appearing in it as "public", and the route test walks
- * every entry and proves the tier holds on the wire. Adding a route
- * without an entry is a type error (`buildRoutes` is exhaustive over
- * these keys); adding one as "public" is a diff a reviewer sees.
+ * pre-auth only by appearing in it as "public", reachable by a per-device
+ * credential only through the scope written next to it, and the route
+ * tests walk every entry and prove each tier holds on the wire. Adding a
+ * route without an entry is a type error (`buildRoutes` is exhaustive over
+ * these keys); widening one is a diff a reviewer sees.
  */
 export const BRIDGE_ROUTE_AUTH = {
   // Pre-auth by design. /health serves pairing data (identity, protocol,
@@ -35,52 +38,69 @@ export const BRIDGE_ROUTE_AUTH = {
   "GET /node/install": "public",
   "GET /node/binary": "public",
 
-  // Everything a client can do once paired.
-  "GET /events": "bearer",
-  "GET /chats": "bearer",
-  "POST /chats": "bearer",
-  "POST /chats/rename": "bearer",
-  "POST /chats/delete": "bearer",
-  "POST /chats/reset": "bearer",
-  "POST /chats/interrupt": "bearer",
-  "POST /chats/pulse": "bearer",
-  "POST /queue": "bearer",
-  "GET /history": "bearer",
-  "GET /search": "bearer",
+  // Credential self-service. Any credential may ask who it is, and trade
+  // itself (or the shared legacy token) for a fresh per-device credential
+  // bound to ONE device id — the in-band upgrade and rotation path.
+  "GET /auth/whoami": ANY,
+  "POST /auth/upgrade": ANY,
+
+  // The event stream. A device-only credential receives only what is
+  // addressed to its own device (commands, locates) — never chat traffic.
+  "GET /events": ["device", "client"],
+
+  // The chat UI.
+  "GET /chats": "client",
+  "POST /chats": "client",
+  "POST /chats/rename": "client",
+  "POST /chats/delete": "client",
+  "POST /chats/reset": "client",
+  "POST /chats/interrupt": "client",
+  "POST /chats/pulse": "client",
+  "POST /queue": "client",
+  "GET /history": "client",
+  "GET /search": "client",
 
   // Memory — read-only. The typed memory store is readable over the
   // bridge but never writable from it: asserting and dropping stay with
   // the daemon's own write path.
-  "GET /memory": "bearer",
-  "GET /memory/why": "bearer",
+  "GET /memory": "client",
+  "GET /memory/why": "client",
+
+  "POST /send": "client",
+  "POST /upload": "client",
+  "GET /media": "client",
+  "GET /models": "client",
+  "POST /model": "client",
+  "GET /backends": "client",
+  "POST /backend": "client",
+  "GET /effort": "client",
+  "POST /effort": "client",
+  // Reads of the non-secret, allowlisted settings snapshot and the
+  // extension lists are the UI's; changing any of it is the operator's.
+  "GET /plugins": "client",
+  "GET /skills": "client",
+  "GET /config": "client",
 
-  "POST /send": "bearer",
-  "POST /upload": "bearer",
-  "GET /media": "bearer",
-  "GET /models": "bearer",
-  "POST /model": "bearer",
-  "GET /backends": "bearer",
-  "POST /backend": "bearer",
-  "GET /effort": "bearer",
-  "POST /effort": "bearer",
-  "GET /logs": "bearer",
-  "GET /plugins": "bearer",
-  "POST /plugins/toggle": "bearer",
-  "GET /skills": "bearer",
-  "POST /skills/toggle": "bearer",
-  "GET /config": "bearer",
-  "POST /config": "bearer",
-  "POST /control": "bearer",
+  // Operator. Logs carry command lines, paths and device output, so they
+  // are not a chat-UI read.
+  "GET /logs": "operator",
+  "POST /plugins/toggle": "operator",
+  "POST /skills/toggle": "operator",
+  "POST /config": "operator",
+  "POST /control": "operator",
 
-  // Mesh. The one-time `transfer` token on /devices/file authorizes one
-  // direction+path, but the route still sits behind the bearer like every
-  // device route — the token is a scope, not a credential.
-  "POST /devices/register": "bearer",
-  "POST /location": "bearer",
-  "GET /devices": "bearer",
-  "POST /devices/command-result": "bearer",
-  "POST /devices/file": "bearer",
-  "GET /devices/file": "bearer",
+  // Mesh — a device acting as itself. Every body/query naming a device id
+  // is checked against the credential's own device (credentials/claims.ts).
+  // The one-time `transfer` token on /devices/file authorizes one
+  // direction+path for one device; the credential still has to be that
+  // device's.
+  "POST /devices/register": "device",
+  "POST /location": "device",
+  "POST /devices/command-result": "device",
+  "POST /devices/file": "device",
+  "GET /devices/file": "device",
+  // The fleet view (every device and its last location) is the UI's.
+  "GET /devices": "client",
 } as const satisfies Record<string, BridgeRouteAuth>;
 
 export type BridgeRouteKey = keyof typeof BRIDGE_ROUTE_AUTH;
@@ -91,6 +111,8 @@ export type RouteContext = {
   res: ServerResponse;
   url: URL;
   auth: AuthState;
+  /** Who is calling — null only on a public route hit without a credential. */
+  principal: BridgePrincipal | null;
 };
 
 export type RouteHandler = (ctx: RouteContext) => void | Promise<void>;