e7f3bd05f0
Customers install one command / log in once; hardware-generated keys never leave the device; CSRs return certs + subdomain; frpc + base-app run as durable services. No .p12, no manual cert import. Implements the MVP fast-path of docs/PLAN_TUNNEL_AUTOMATION.md. Control-plane / PKI (control-plane/): - ca/x509-assembler.ts: single KMS-signed real X.509 issuance primitive (Ed25519 + P-256) - ca/csr-ec.ts: P-256 PKCS#10 proof-of-possession (verifyCsrPoPEc) + CSR-key routing - ca/frpclient-issue.ts, ca/device-issue.ts: P-256 frp-client + device leaf signers - ca/rotate.ts + api/renew.ts: real-X.509 /renew + /device/:id/renew (mTLS current cert) - registry/devices.ts: device registry + per-account cap/rate-limit - auth/session.ts: device:enroll capability token mint/verify - api/device-enroll.ts: POST /device/enroll (ownership-gated, deny-by-default) - pairing/native-redeem.ts + shared gateAndConsumePairingCode; api/provision.ts native arm - boot/native-ca.ts + main.ts: wire two P-256 CAs + issuers + routers (dev / KMS fail-fast) Contracts: relay-contracts enroll right; relay-auth SPIFFE /device/ arm + spiffeIdFor(kind) Host agent (agent/): - transport/frpcToml.ts; provision/frpcBinary.ts + untar.ts (verify-download + traversal-safe extract) - keys P-256 keygen/CSR/loadIdentity; service two-unit install + BIND_HOST loopback S-GATE - net/loopbackLiteral.ts strict guard; health/probe.ts + transport/frpSupervise.ts; cli pair --install iOS (ios/Packages/ClientTLS): SecureEnclaveKey + CertificateSigningRequest + DeviceEnrollmentClient + Keychain enroll refactor (SecKey/Security.framework end-to-end, avoids the -25300 trap) Isolation (deploy/nginx): njs/getCertSub.js SAN parser + zone-anchored map -> 403 Verified: 758 tests green (control-plane 246, agent 267, relay-auth 133, relay-contracts 85, iOS ClientTLS 27), all tsc clean; real nginx+njs docker 403/200/400; Swift CSR accepted by the real control-plane verifier; frpc extract byte-identical to `tar -xO`. Cross-validation caught + fixed 5 real defects (1 critical, 4 high). Remaining = infra (KMS, nginx deploy, VPS frps, physical iPhone) per PROGRESS_LOG runbook. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
40 lines
1.3 KiB
JSON
40 lines
1.3 KiB
JSON
{
|
|
"name": "control-plane",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "P3 — Control Plane & Accounts for the rendezvous-relay service. Account/host/session registries (immutable, INV8), pairing issuance+redemption+BIND, subdomain assignment, Redis routing table, provisioning/metering/revocation APIs, registry-gated mTLS leaf signing (INV14), immutable zero-payload audit (INV10). Imports relay-contracts read-only. See docs/PLAN_RELAY_CONTROLPLANE.md.",
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"main": "src/main.ts",
|
|
"scripts": {
|
|
"start": "tsx src/server.ts",
|
|
"typecheck": "tsc --noEmit",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"coverage": "vitest run --coverage"
|
|
},
|
|
"dependencies": {
|
|
"@peculiar/asn1-ecc": "^2.8.0",
|
|
"@peculiar/asn1-schema": "^2.8.0",
|
|
"@peculiar/asn1-x509": "^2.8.0",
|
|
"@peculiar/x509": "^2.0.0",
|
|
"fastify": "^4.28.1",
|
|
"ioredis": "^5.4.1",
|
|
"pg": "^8.12.0",
|
|
"reflect-metadata": "^0.2.2",
|
|
"relay-auth": "file:../relay-auth",
|
|
"relay-contracts": "file:../relay-contracts",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^25.9.3",
|
|
"@types/pg": "^8.11.10",
|
|
"@vitest/coverage-v8": "^4.1.9",
|
|
"tsx": "^4.19.2",
|
|
"typescript": "^6.0.3",
|
|
"vitest": "^4.1.9"
|
|
}
|
|
}
|