remoteRF-server 1.4.8__tar.gz → 1.4.10__tar.gz

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remoteRF-server
-Version: 1.4.8
+Version: 1.4.10
 Summary: RemoteRF server-side control package
 License: GPL-3.0-or-later
 Classifier: Programming Language :: Python :: 3
@@ -881,10 +881,11 @@ After running `serverrf --serve`, you’ll enter the **RemoteRF Server Shell**.
 
 ### Users
 
-* `users list` — List all accounts
+* `users list` — List all accounts (this lab's own first, then visitors from partner labs)
 * `users manage` — Manage a specific user (perms / delete / reservations)
 * `users purge` — Delete **all** users
 * `users perms` — Show permissions table
+* `users prune-proxies [--stale DAYS] [-y]` — List federated proxies whose home lab is gone (dry run); `-y` removes them
 
 ---
 

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/README.md

@@ -850,10 +850,11 @@ After running `serverrf --serve`, you’ll enter the **RemoteRF Server Shell**.
 
 ### Users
 
-* `users list` — List all accounts
+* `users list` — List all accounts (this lab's own first, then visitors from partner labs)
 * `users manage` — Manage a specific user (perms / delete / reservations)
 * `users purge` — Delete **all** users
 * `users perms` — Show permissions table
+* `users prune-proxies [--stale DAYS] [-y]` — List federated proxies whose home lab is gone (dry run); `-y` removes them
 
 ---
 

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "remoteRF-server"
-version = "1.4.8"
+version = "1.4.10"
 description = "RemoteRF server-side control package"
 license = { text = "GPL-3.0-or-later" }
 requires-python = ">=3.10"

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/commands.py

@@ -116,6 +116,7 @@ def _table() -> list[Command]:
         Command(("users manage",), "Change a user's role (interactive)", _daemon("cmd_users_manage"), "Users", where=D, interactive=True),
         Command(("users perms",), "Show permissions", _daemon("cmd_users_perms"), "Users", where=D),
         Command(("users purge",), "Remove ALL accounts", _daemon("cmd_users_purge"), "Users", where=D),
+        Command(("users prune-proxies",), "Partner-lab visitors whose home is gone: list them, -y removes [--stale DAYS]", _daemon("cmd_users_prune_proxies"), "Users", where=D),
         # ---- reservations ----
         Command(("reservations list",), "List reservations", _daemon("cmd_reservations_list"), "Reservations", where=D),
         Command(("reservations purge",), "Remove ALL reservations", _daemon("cmd_reservations_purge"), "Reservations", where=D),

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/federation/cluster.py

@@ -51,10 +51,11 @@ from pathlib import Path
 from typing import Optional
 from uuid import uuid4
 
-from remoterf_federation_core import ContractError, FederationError, TransportFailure, canonical_json
+from remoterf_federation_core import ContractError, FederationError, OwnerSignedFailure, TransportFailure, canonical_json
 
 from .. import global_onboarding as g
 from .contracts import ContractStore
+from .enrollment import UNENROLL_CODE
 from .migrations import migrate_gate_f_usergroups_schema
 from .trust import TrustedKeyStore
 
@@ -760,9 +761,9 @@ def admit_account(home, local_account_id: int) -> None:
 
 
 def forget_account(local_account_id: int | None = None) -> None:
-    """A deleted account leaves every cluster, grants and all, so the tick
-    stops trying to enrol a ghost. None: every account (a purge)."""
-    where, args = ("local_account_id=? AND kind='local'", (int(local_account_id),)) if local_account_id is not None else ("1", ())
+    """A deleted account (native or proxy) leaves every cluster, grants and
+    all, so the tick stops trying to enrol a ghost. None: every account (a purge)."""
+    where, args = ("local_account_id=?", (int(local_account_id),)) if local_account_id is not None else ("1", ())
     with _usergroups() as conn:
         rows = conn.execute(f"SELECT DISTINCT cluster_name, local_account_id FROM ClusterAccounts WHERE {where}", args).fetchall()
         for name, account in rows:
@@ -861,6 +862,33 @@ def redeem_code(local_account_id: int, code_name: str) -> Optional[str]:
 
 _ENROL_RETRY_FIRST, _ENROL_RETRY_CAP = 30.0, 600.0
 _unreachable: dict[str, tuple[float, float]] = {}  # peer -> (retry_at, delay), monotonic
+_revoke_retry: dict[str, tuple[float, float]] = {}  # same, for unenrols
+REVOCATION_TTL = 180 * 86400  # an unenrol for a partner we hold no contract with waits this long
+
+
+def _back_off(table: dict, peer: str) -> None:
+    delay = min(table.get(peer, (0.0, _ENROL_RETRY_FIRST / 2))[1] * 2, _ENROL_RETRY_CAP)
+    table[peer] = (time.monotonic() + delay, delay)
+
+
+def _forget_departed(plane) -> None:
+    """Drop enrolment records at partners we no longer hold a live contract
+    with: that partner may prune our users as "issuer gone", and on a rejoin
+    the next tick enrols everyone again (an existing proxy just stays)."""
+    if getattr(plane, "path", None) is None:
+        return
+    try:
+        with _usergroups() as conn:
+            live = {deployment for row in conn.execute(
+                "SELECT deployment_a, deployment_b FROM FederationContracts "
+                "WHERE state='active' AND superseded_by_version IS NULL") for deployment in row}
+        with closing(sqlite3.connect(plane.path, timeout=10.0)) as conn, conn:
+            peers = [row[0] for row in conn.execute("SELECT DISTINCT destination_deployment_id FROM FederatedEnrollments")]
+            for peer in peers:
+                if peer not in live:
+                    conn.execute("DELETE FROM FederatedEnrollments WHERE destination_deployment_id=?", (peer,))
+    except sqlite3.OperationalError:
+        pass  # no contracts or HOME device plane here yet
 
 
 def enroll_students(home, notify=None, *, only_account: int | None = None) -> None:
@@ -870,6 +898,7 @@ def enroll_students(home, notify=None, *, only_account: int | None = None) -> No
     enroller, plane = getattr(home, "federation_enroller", None), getattr(home, "federation_devices", None)
     if enroller is None or plane is None:
         return
+    _forget_departed(plane)
     clusters = load()
     with _usergroups() as conn:
         rows = conn.execute(
@@ -889,6 +918,7 @@ def enroll_students(home, notify=None, *, only_account: int | None = None) -> No
                 continue  # a lab nobody chose gets our accounts only once it shares a device
             if _unreachable.get(peer, (0.0, 0.0))[0] > time.monotonic():
                 continue  # unreachable a moment ago: back off rather than redial every tick
+            subject = _subject_of(plane, account)
             try:
                 enroller.outbound.execute(
                     local_account_id=account, destination_deployment_id=peer,
@@ -897,13 +927,76 @@ def enroll_students(home, notify=None, *, only_account: int | None = None) -> No
                 )
             except (FederationError, OSError) as exc:
                 if isinstance(exc, TransportFailure) and exc.code == "route_unavailable":
-                    delay = min(_unreachable.get(peer, (0.0, _ENROL_RETRY_FIRST / 2))[1] * 2, _ENROL_RETRY_CAP)
-                    _unreachable[peer] = (time.monotonic() + delay, delay)
+                    _back_off(_unreachable, peer)
                 notify(f"[cluster] {name}: could not enrol account {account} at "
                        f"{party.get('display_name') or peer}: {getattr(exc, 'code', exc)}")
                 continue
             _unreachable.pop(peer, None)
             plane.record_enrollment(local_account_id=account, destination_deployment_id=peer)
+            if subject and _subject_of(plane, account) is None:
+                # Deleted while the enrolment was in flight: its delete queued
+                # nothing for this peer, so queue the unenrol here.
+                with closing(sqlite3.connect(plane.path, timeout=10.0)) as conn, conn:
+                    conn.execute("INSERT OR IGNORE INTO FederatedRevocations VALUES (?,?,?)",
+                                 (subject, peer, int(time.time())))
+                    conn.execute("DELETE FROM FederatedEnrollments WHERE local_account_id=?", (account,))
+
+
+def _subject_of(plane, account: int) -> str | None:
+    if getattr(plane, "path", None) is None:
+        return None
+    with closing(sqlite3.connect(plane.path, timeout=10.0)) as conn:
+        row = conn.execute("SELECT subject_id FROM LocalAccountSubjects WHERE local_account_id=?",
+                           (account,)).fetchone()
+    return row[0] if row else None
+
+
+def deliver_revocations(home, notify=None) -> None:
+    """HOME: tell each partner a deleted account was enrolled at to drop its
+    proxy. A row stays until the partner answers; an older partner answers
+    code_invalid (keeps its orphan). A partner we hold no contract with right
+    now (left, kicked, past the candidate cap) keeps its row until it is back
+    or REVOCATION_TTL runs out."""
+    notify = notify or (lambda text: None)
+    enroller, plane = getattr(home, "federation_enroller", None), getattr(home, "federation_devices", None)
+    if enroller is None or plane is None:
+        return
+    path = _db_path().with_name("reservations.db")
+    try:
+        with closing(sqlite3.connect(path, timeout=10.0)) as conn:
+            rows = conn.execute("SELECT subject_id, destination_deployment_id, queued_at FROM FederatedRevocations").fetchall()
+    except sqlite3.OperationalError:
+        return  # no HOME device plane here yet
+    if not rows:
+        return
+    contracts = {}
+    for candidate in plane.permissions._candidates(int(plane.clock()), "FEDERATED_ENROLL")[0]:
+        contracts.setdefault(candidate["deployment_id"], candidate)
+    now = time.time()
+    for subject, peer, queued_at in rows:
+        contract = contracts.get(peer)
+        if contract is None:
+            if int(queued_at) > now - REVOCATION_TTL:
+                continue  # no contract right now: wait for one, the TTL lets go of a partner that is gone
+        else:
+            if _revoke_retry.get(peer, (0.0, 0.0))[0] > time.monotonic():
+                continue  # failed a moment ago: skip this peer's rows until the backoff runs out
+            try:
+                enroller.outbound.execute(
+                    local_account_id=None, revoked_subject_id=subject, destination_deployment_id=peer,
+                    contract_id=contract["contract_id"], contract_version=contract["contract_version"],
+                    action="federated_enroll", code_name=UNENROLL_CODE,
+                )
+            except (FederationError, OSError) as exc:
+                # code_invalid (signed): a partner too old to know the code keeps its orphan.
+                if not (isinstance(exc, OwnerSignedFailure) and exc.code == "code_invalid"):
+                    _back_off(_revoke_retry, peer)
+                    notify(f"[cluster] could not remove a deleted account at {peer}: {getattr(exc, 'code', exc)}")
+                    continue
+            _revoke_retry.pop(peer, None)
+        with closing(sqlite3.connect(path, timeout=10.0)) as conn, conn:
+            conn.execute("DELETE FROM FederatedRevocations WHERE subject_id=? AND destination_deployment_id=?",
+                         (subject, peer))
 
 
 # -----------------------------
@@ -1183,6 +1276,8 @@ def tick(notify=None, home=None) -> None:
     """One agent pass: move every cluster and member one step closer to active,
     then (given the HOME runtime) enrol students wherever they are missing."""
     notify = notify or (lambda text: None)
+    if home is not None:
+        deliver_revocations(home, notify)
     # Rosters, status notes and the public clusters: one GET for the whole pass.
     board = g.call("GET", "/v2/broker/clusters/roster")
     _walk_in(board.get("pools", []), notify)

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/federation/devices.py

@@ -210,6 +210,10 @@ class _DeviceHandlerBase:
             raise FederationBusinessError("principal_unknown")
         if row[2] != "active":
             raise FederationBusinessError("principal_disabled")
+        # At most hourly: `users prune-proxies --stale` reads it as the visitor's last activity.
+        now = int(time.time())
+        tx.execute("UPDATE FederatedPrincipals SET last_seen_at=? WHERE id=? AND last_seen_at<?",
+                   (now, row[0], now - 3600))
         return str(row[0]), int(row[1])
 
     # -- result shaping ------------------------------------------------
@@ -669,6 +673,8 @@ def build_server_gate_h_executor(
         signing_kid=signing_kid,
         display_name=display_name,
         clock=clock,
+        account_remover=(lambda username: reservation_handler.remove_user(username=username))
+        if reservation_handler is not None else None,
     )
     for action, handler in build_device_handlers(
         reservations_path=reservations_path,

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/federation/enrollment.py

@@ -27,6 +27,9 @@ from remoterf_federation_core import (
 from .destination import ActionRegistry, FederationBusinessError, ServerFederationExecutor
 
 CLUSTER_CODE = "cluster"
+# A HOME that deleted the account tells each partner to drop its proxy. The
+# `cluster.` prefix is reserved and minted codes are uppercase: no collision.
+UNENROLL_CODE = "cluster.unenroll"
 from .migrations import configure_connection, migrate_gate_f_usergroups_schema
 from .principals import PreparedFederatedAccount, prepare_federated_account
 
@@ -310,6 +313,7 @@ class ServerFederatedEnrollHandler:
         perms_path=None,
         clock=None,
         account_preparer=prepare_federated_account,
+        account_remover=None,
     ):
         self.usergroups_path = Path(usergroups_path)
         self.reservations_path = Path(reservations_path)
@@ -318,6 +322,7 @@ class ServerFederatedEnrollHandler:
         self.display_name = str(display_name)
         self.clock = clock or (lambda: int(time.time()))
         self.account_preparer = account_preparer
+        self.account_remover = account_remover or _remove_account
         with sqlite3.connect(self.usergroups_path) as conn:
             migrate_gate_f_usergroups_schema(conn)
 
@@ -325,6 +330,18 @@ class ServerFederatedEnrollHandler:
         """Never mutates owner authorization; invalid cases wait for owner tx."""
         claims = action.claims
         payload = action.request.value["payload"]
+        if payload["code_name"] == UNENROLL_CODE:
+            # Runs only for a verified, current grant, and only ever touches
+            # the grant's own (iss, sub): a lab can revoke nobody else's users.
+            with sqlite3.connect(self.reservations_path) as conn:
+                row = conn.execute(
+                    "SELECT a.username FROM FederatedAccountBindings b JOIN Accounts a ON a.acc_id=b.local_account_id "
+                    "WHERE b.issuer_deployment_id=? AND b.remote_subject_id=? AND a.auth_type='federated'",
+                    (claims["iss"], claims["sub"]),
+                ).fetchone()
+            if row is not None:
+                self.account_remover(row[0])
+            return None
         if payload["code_name"] == CLUSTER_CODE:
             # No code to check: the home lab's signature under an active
             # cluster contract is the vouching. Prepare a proxy only once.
@@ -431,10 +448,29 @@ class ServerFederatedEnrollHandler:
             membership_present=True, groups=[{"group_id": "0", "group_name": f"cluster {name}"}], now=now,
         )
 
+    def _unenroll(self, tx, action, now):
+        """The proxy (and its reservations) went in prepare(); drop whatever
+        rows here still name it. Unknown subjects are fine: idempotent."""
+        claims = action.claims
+        principal = get_principal_tx(tx, claims["iss"], claims["sub"])
+        if principal is not None:
+            for table, column in (("UsersLookup", "user_id"), ("ClusterMemberships", "local_account_id"),
+                                  ("ClusterAccounts", "local_account_id")):
+                tx.execute(f"DELETE FROM {table} WHERE {column}=?", (int(principal[3]),))
+            tx.execute("DELETE FROM FederatedPrincipals WHERE id=?", (principal[0],))
+        self._audit(tx, action, code="ok", principal_id=None,
+                    metadata={"unenrolled": principal is not None})
+        return self._result(
+            action, redemption_id=str(uuid5(NAMESPACE_URL, f"remoterf-unenroll:{claims['iss']}:{claims['sub']}")),
+            membership_present=False, groups=[], now=now,
+        )
+
     def __call__(self, tx, action):
         claims = action.claims
         payload = action.request.value["payload"]
         now = int(self.clock())
+        if payload["code_name"] == UNENROLL_CODE:
+            return self._unenroll(tx, action, now)
         if payload["code_name"] == CLUSTER_CODE:
             return self._cluster_enroll(tx, action, now)
         receipt = lookup_redemption_tx(
@@ -579,6 +615,12 @@ class ServerFederatedEnrollHandler:
         )
 
 
+def _remove_account(username: str) -> None:
+    from ..reservation import reservation_handler
+
+    reservation_handler.remove_user(username=username)
+
+
 class ServerFederatedEnrollmentHome:
     def __init__(self, outbound):
         self.outbound = outbound

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/federation/home.py

@@ -64,6 +64,7 @@ from remoterf_federation_core import (
     verify_eddsa_jwt,
 )
 
+from .enrollment import UNENROLL_CODE
 from .migrations import configure_connection, migrate_gate_e_usergroups_schema
 from .peers import PeerStore
 
@@ -202,6 +203,28 @@ class ServerHomeGrantIssuer:
             raise FederationError("native_account_required")
         return canonical_uuid(row["subject_id"])
 
+    def _subject(self, conn, local_account_id, revoked_subject_id, destination, action, code_name) -> str:
+        """The native account's subject; or, for an unenrol only, a deleted
+        account's subject still queued for that partner."""
+        if revoked_subject_id is None:
+            if code_name == UNENROLL_CODE:
+                raise FederationError("native_account_required")
+            return self._native_subject(local_account_id, conn=conn)
+        subject = canonical_uuid(revoked_subject_id)
+        if local_account_id is not None or action != "federated_enroll" or code_name != UNENROLL_CODE:
+            raise FederationError("native_account_required")
+        try:
+            queued = conn.execute(
+                "SELECT 1 FROM FederatedRevocations WHERE subject_id=? AND destination_deployment_id=?",
+                (subject, destination),
+            ).fetchone()
+            live = conn.execute("SELECT 1 FROM LocalAccountSubjects WHERE subject_id=?", (subject,)).fetchone()
+        except sqlite3.OperationalError:
+            queued = None
+        if queued is None or live is not None:
+            raise FederationError("native_account_required")
+        return subject
+
     def issue(
         self,
         *,
@@ -215,6 +238,7 @@ class ServerHomeGrantIssuer:
         device_payload: Mapping | None = None,
         enrollee: Mapping | None = None,
         jti: str | None = None,
+        revoked_subject_id: str | None = None,
     ) -> IssuedGrant:
         destination = canonical_uuid(destination_deployment_id)
         request_id = canonical_uuid(request_id or str(uuid4()))
@@ -239,7 +263,7 @@ class ServerHomeGrantIssuer:
         try:
             configure_connection(subject_conn)
             subject_conn.execute("BEGIN IMMEDIATE")
-            subject = self._native_subject(local_account_id, conn=subject_conn)
+            subject = self._subject(subject_conn, local_account_id, revoked_subject_id, destination, action, code_name)
         except Exception:
             conn.rollback()
             conn.close()
@@ -304,7 +328,7 @@ class ServerHomeGrantIssuer:
             issuance_hook = getattr(self, "_issuance_lock_hook", None)
             if issuance_hook is not None:
                 issuance_hook()
-            subject = self._native_subject(local_account_id, conn=subject_conn)
+            subject = self._subject(subject_conn, local_account_id, revoked_subject_id, destination, action, code_name)
             claims = build_grant_claims(
                 issuer_deployment_id=self.local_deployment_id,
                 subject_id=subject,
@@ -627,6 +651,7 @@ class HomeFederationOutbound:
         retry_ambiguous: bool = True,
         deadline: float | None = None,
         request_frame: bytes | None = None,
+        revoked_subject_id: str | None = None,
     ) -> dict:
         """Verified result; an ok device_rpc result also carries ``frame``, its
         raw response. With ``request_frame`` the caller leaves ``request_b64``
@@ -698,6 +723,7 @@ class HomeFederationOutbound:
                 # A downgrade resend keeps the JTI: if the refusal was forged
                 # after the first form ran, the destination answers "replayed".
                 **({"jti": resend_jti} if resend_jti else {}),
+                **({"revoked_subject_id": revoked_subject_id} if revoked_subject_id else {}),
             )
             resend_jti = None
             frame = request_frame if detached else b""

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/federation/migrations.py

@@ -478,6 +478,7 @@ _GATE_H_RESERVATIONS_CHECKSUM = hashlib.sha256(
 # HOME side of the device plane: which partners a native account is enrolled
 # at, a HOME-local integer id for each partner device the Client has seen, and
 # the HOME-minted reservation rows that route a device token to the owner.
+# FederatedRevocations: deleted accounts' partners still to be told (the tick drains it).
 _HOME_DEVICES_RESERVATIONS_DDL = """
 CREATE TABLE IF NOT EXISTS FederatedEnrollments (
     local_account_id INTEGER NOT NULL,
@@ -485,6 +486,12 @@ CREATE TABLE IF NOT EXISTS FederatedEnrollments (
     enrolled_at INTEGER NOT NULL,
     PRIMARY KEY(local_account_id,destination_deployment_id)
 );
+CREATE TABLE IF NOT EXISTS FederatedRevocations (
+    subject_id TEXT NOT NULL CHECK(length(subject_id)=36),
+    destination_deployment_id TEXT NOT NULL CHECK(length(destination_deployment_id)=36),
+    queued_at INTEGER NOT NULL,
+    PRIMARY KEY(subject_id,destination_deployment_id)
+);
 CREATE TABLE IF NOT EXISTS FederatedDeviceAliases (
     alias_id INTEGER PRIMARY KEY,
     owner_deployment_id TEXT NOT NULL CHECK(length(owner_deployment_id)=36),

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/federation/permissions.py

@@ -393,6 +393,7 @@ def build_server_gate_g_executor(
     display_name,
     perms_path=None,
     clock=None,
+    account_remover=None,
 ):
     """Final Phase-1 destination registry: enroll plus permissions read."""
 
@@ -406,6 +407,7 @@ def build_server_gate_g_executor(
         local_deployment_id=local_deployment_id,
         display_name=display_name,
         clock=clock,
+        account_remover=account_remover,
     )
     permissions = ServerPermissionsReadHandler(
         local_deployment_id=local_deployment_id,

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/federation/principals.py

@@ -267,3 +267,64 @@ class FederatedPrincipalStore:
             ).fetchone()
             assert final is not None
             return self._decode(final)
+
+
+def orphan_proxies(reservations_path, usergroups_path, *, stale_days: int | None = None, now: int | None = None) -> list[dict]:
+    """Federated proxies nothing else will clean up: their home is no longer a
+    partner (left Global, kicked, contract revoked), half their rows are gone,
+    or -- only when asked -- inactive for ``stale_days``: no device action,
+    reservation or enrolment in that time and nothing booked ahead. A pruned
+    proxy whose home still lists it loses access here until that home re-enrols it."""
+    from contextlib import closing
+
+    now = int(time.time() if now is None else now)
+    with closing(sqlite3.connect(usergroups_path, timeout=10.0)) as conn:
+        principals = conn.execute(
+            "SELECT id, local_account_id, issuer_deployment_id, last_seen_at FROM FederatedPrincipals"
+        ).fetchall()
+        partners = {deployment for row in conn.execute(
+            "SELECT deployment_a, deployment_b FROM FederationContracts "
+            "WHERE state='active' AND superseded_by_version IS NULL") for deployment in row}
+    with closing(sqlite3.connect(reservations_path, timeout=10.0)) as conn:
+        accounts = dict(conn.execute("SELECT acc_id, username FROM Accounts WHERE auth_type='federated'").fetchall())
+        homes = dict(conn.execute("SELECT local_account_id, issuer_deployment_id FROM FederatedAccountBindings").fetchall())
+        ahead = dict(conn.execute(
+            "SELECT username, COUNT(*) FROM Reservations WHERE end_time > ? GROUP BY username", (datetime.now(),)
+        ).fetchall())
+        # Activity beyond the principal's own last_seen_at: past bookings not yet swept, and booking times.
+        active = {}
+        for username, end in conn.execute("SELECT username, MAX(end_time) FROM Reservations GROUP BY username"):
+            try:
+                active[username] = int(datetime.fromisoformat(str(end)).timestamp())
+            except ValueError:
+                pass
+        try:
+            booked = dict(conn.execute(
+                "SELECT local_account_id, MAX(created_at) FROM FederatedReservations GROUP BY local_account_id"))
+        except sqlite3.OperationalError:
+            booked = {}
+    out, seen = [], set()
+
+    def add(account, username, issuer, last_active, reason, principal_id=None):
+        out.append({"username": username, "local_account_id": account, "principal_id": principal_id,
+                    "issuer": issuer, "last_active": last_active, "reservations": ahead.get(username, 0),
+                    "reason": reason})
+
+    for principal_id, account, issuer, last_seen in principals:
+        account = int(account)
+        seen.add(account)
+        username = accounts.get(account)
+        last_active = max(int(last_seen or 0), active.get(username, 0), int(booked.get(account) or 0)) or None
+        if username is None:
+            reason = "dangling"
+        elif issuer not in partners:
+            reason = "issuer gone"
+        elif stale_days is not None and not ahead.get(username) and (last_active or 0) < now - stale_days * 86400:
+            reason = "stale"
+        else:
+            continue
+        add(account, username, issuer, last_active, reason, principal_id)
+    for account, username in accounts.items():
+        if int(account) not in seen:
+            add(int(account), username, homes.get(account), None, "dangling")
+    return out

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/global_onboarding.py

@@ -59,8 +59,9 @@ reach your users as soon as you are in (`cluster remove` leaves such a
 cluster). Joining Global shares none of your hardware on its own.
 
 Once an hour it sends Global a short note: this deployment's name and
-ID, version, uptime, how many accounts, what devices it has, how many
-reservations are active, and your LAN address. Nothing else leaves your
+ID, version, uptime, how many accounts (and how many visit from partner
+labs), what devices it has, how many reservations are active, and your
+LAN address. Nothing else leaves your
 server -- no credentials, no user or reservation details -- and the
 connection only goes outward.
 
@@ -179,14 +180,17 @@ def account_name(username: str) -> str:
 def invite(code_name: str, *, lan_only: bool = False) -> str:
     """What to hand a new user: the form `remoterf --register` accepts.
 
-    On a live Global deployment that is `<public hostname>/<code>`, which the
-    client resolves to this server from anywhere. A LAN-only group's code (or
+    On a live Global deployment that is `<deployment>/<code>` (e.g. `ucla/AB12C`),
+    which the client expands to `<deployment>.global.remoterf.net` from anywhere;
+    a lab on its own domain keeps the full `<hostname>/<code>`. A LAN-only group's code (or
     a deployment that is not on Global) is the bare code, entered after
     `remoterf -c -a <lan address>`.
     """
-    if state() == "active" and not lan_only and hostname():
-        return f"{hostname()}/{code_name}"
-    return code_name
+    host = hostname() if state() == "active" and not lan_only else None
+    if not host:
+        return code_name
+    slug, _, domain = host.partition(".")
+    return f"{slug if domain == 'global.remoterf.net' else host}/{code_name}"
 
 
 # -----------------------------
@@ -698,6 +702,7 @@ STATUS_FIELDS = frozenset(
         "server_version",
         "uptime_s",
         "users",
+        "proxies",
         "devices",
         "active_reservations",
         "lan_address",
@@ -783,7 +788,9 @@ def status_payload() -> dict:
     payload = {
         "server_version": server_version(),
         "uptime_s": _uptime_seconds(),
-        "users": _count(reservations, "SELECT COUNT(*) FROM Accounts"),
+        # A partner's user visiting here is counted at their own lab, not again here.
+        "users": _count(reservations, "SELECT COUNT(*) FROM Accounts WHERE auth_type != 'federated'"),
+        "proxies": _count(reservations, "SELECT COUNT(*) FROM Accounts WHERE auth_type = 'federated'"),
         "devices": device_summary(),
         "active_reservations": _count(
             reservations,
@@ -807,7 +814,14 @@ def send_liveness() -> None:
 def send_status() -> None:
     from datetime import datetime, timezone
 
-    call("POST", REPORT_PATH, {"kind": "status", "status": status_payload()})
+    payload = status_payload()
+    try:
+        call("POST", REPORT_PATH, {"kind": "status", "status": payload})
+    except GlobalError as exc:
+        if exc.code != "invalid_status":
+            raise
+        # A Global older than `proxies` takes the note as it was before.
+        call("POST", REPORT_PATH, {"kind": "status", "status": {k: v for k, v in payload.items() if k != "proxies"}})
     update(GLOBAL_LAST_REPORT_AT=datetime.now(timezone.utc).isoformat())
 
 

{remoterf_server-1.4.8 → remoterf_server-1.4.10}/src/remoteRF_server/server/grpc_server.py

@@ -1245,6 +1245,54 @@ def cmd_users_manage(argv): set_acc()
 def cmd_users_perms(argv): perms.print_perms()
 def cmd_users_purge(argv): reservation_handler.remove_all_users()
 def cmd_reservations_list(argv): reservation_handler.print_all_reservations()
+
+
+def cmd_users_prune_proxies(argv):
+    """Dry run unless -y: proxies whose home left, half-deleted ones, and with
+    --stale DAYS those unseen that long with nothing booked."""
+    import sqlite3
+    from contextlib import closing
+
+    from ..common.utils.panel import print_table
+    from .federation import cluster
+    from .federation.principals import orphan_proxies
+    from .user_group_handler import user_group_handler
+
+    stale = None
+    if "--stale" in argv:
+        try:
+            stale = int(argv[argv.index("--stale") + 1])
+        except (IndexError, ValueError):
+            printf("Usage: users prune-proxies [--stale DAYS] [-y]", Sty.RED)
+            return 2
+    orphans = orphan_proxies(reservation_handler.filepath, user_group_handler.filepath, stale_days=stale)
+    names = {}
+    for item in cluster.load().values():
+        for peer, party in cluster._parties(item):
+            names.setdefault(peer, party.get("display_name"))
+    rows = [{"username": o["username"] or "(no account)", "home": names.get(o["issuer"]) or o["issuer"] or "?",
+             "last_active": datetime.fromtimestamp(o["last_active"]).strftime("%Y-%m-%d") if o["last_active"] else "",
+             "reservations": o["reservations"], "reason": o["reason"]} for o in orphans]
+    print_table("Orphaned federated proxies", rows, ["username", "home", "last_active", "reservations", "reason"],
+                empty="No orphaned proxies.")
+    if not orphans:
+        return 0
+    if any(o["reason"] == "stale" for o in orphans):
+        printf("A 'stale' visitor may still be real: removing one ends their access here until "
+               "their home lab enrols them again.", Sty.YELLOW)
+    if not ("-y" in argv or "--yes" in argv):
+        printf(f"{len(orphans)} orphaned proxies. Nothing removed; run `users prune-proxies"
+               f"{f' --stale {stale}' if stale is not None else ''} -y` to remove them.", Sty.GRAY)
+        return 0
+    for o in orphans:
+        if o["username"]:
+            reservation_handler.remove_user(username=o["username"])
+        else:
+            with closing(sqlite3.connect(user_group_handler.filepath, timeout=10.0)) as conn, conn:
+                conn.execute("DELETE FROM FederatedPrincipals WHERE id=?", (o["principal_id"],))
+            cluster.forget_account(o["local_account_id"])
+    printf(f"Removed {len(orphans)} orphaned proxies.", Sty.GRAY)
+    return 0
 def cmd_reservations_purge(argv): reservation_handler.remove_all_reservations()
 def cmd_db_purge(argv): reservation_handler.rm_db()
 def cmd_stats_purge(argv):