Hosted relay storage is off until an account is approved

cmd/codeaf-relay-admin/main.go

@@ -0,0 +1,181 @@
+// codeaf-relay-admin is an operator tool and is deliberately excluded from releases.
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/env"
+	"github.com/Agent-Field/codeaf/internal/syncsetup"
+	"github.com/Agent-Field/codeaf/internal/wireauth"
+)
+
+const adminDomain = "codeaf/relay-admin/v1\n"
+const adminPath = "/v1/admin/storage"
+
+var requestCode = regexp.MustCompile(`^id_[0-9a-f]{32}$`)
+
+type approval struct {
+	V        int    `json:"v"`
+	Host     string `json:"host"`
+	Identity string `json:"identity"`
+	Storage  string `json:"storage"`
+	At       int64  `json:"at"`
+	Nonce    string `json:"nonce"`
+}
+
+func main() {
+	if err := run(context.Background(), os.Args[1:], os.Stdout, &http.Client{Timeout: 30 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func run(ctx context.Context, args []string, out io.Writer, hc *http.Client) error {
+	if len(args) == 0 {
+		return errors.New("usage: codeaf-relay-admin approve|revoke <request-code> [--relay prod|staging|dev|<url>] [--key <path>], or public-key [--key <path>]")
+	}
+	action, args := args[0], args[1:]
+	if action != "approve" && action != "revoke" && action != "public-key" {
+		return errors.New("unknown admin command")
+	}
+	code := ""
+	if action != "public-key" {
+		if len(args) == 0 || !requestCode.MatchString(args[0]) {
+			return errors.New("request code must be id_ followed by 32 lowercase hex digits")
+		}
+		code, args = args[0], args[1:]
+	}
+	flags := flag.NewFlagSet("codeaf-relay-admin", flag.ContinueOnError)
+	flags.SetOutput(io.Discard)
+	relay := flags.String("relay", "prod", "relay name or URL")
+	keyPath := flags.String("key", env.Get("CODEAF_RELAY_ADMIN_KEY"), "private seed file")
+	if err := flags.Parse(args); err != nil {
+		return err
+	}
+	if flags.NArg() != 0 {
+		return errors.New("unexpected admin command argument")
+	}
+	if *keyPath == "" {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return err
+		}
+		*keyPath = filepath.Join(home, ".config", "codeaf-relay-admin", "admin.key")
+	}
+	key, err := readKey(*keyPath)
+	if err != nil {
+		return err
+	}
+	if action == "public-key" {
+		_, err = fmt.Fprintln(out, base64.RawURLEncoding.EncodeToString(key.Public().(ed25519.PublicKey)))
+		return err
+	}
+	base, err := relayURL(*relay)
+	if err != nil {
+		return err
+	}
+	nonce := make([]byte, 24)
+	if _, err = rand.Read(nonce); err != nil {
+		return err
+	}
+	storage := "on"
+	if action == "revoke" {
+		storage = "off"
+	}
+	raw, err := json.Marshal(approval{1, base.Host, code, storage, time.Now().UnixMilli(), base64.RawURLEncoding.EncodeToString(nonce)})
+	if err != nil {
+		return err
+	}
+	signature := ed25519.Sign(key, append([]byte(adminDomain), raw...))
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, wireauth.Endpoint(base.String(), adminPath), bytes.NewReader(raw))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("codeaf-admin-signature", base64.RawURLEncoding.EncodeToString(signature))
+	resp, err := hc.Do(req)
+	if err != nil {
+		return errors.New("relay request failed: " + err.Error())
+	}
+	defer resp.Body.Close()
+	answer, err := io.ReadAll(io.LimitReader(resp.Body, 4097))
+	if err != nil {
+		return err
+	}
+	if len(answer) > 4096 {
+		return errors.New("relay answer is too large")
+	}
+	var reply struct {
+		Identity string `json:"identity"`
+		Storage  string `json:"storage"`
+		Err      string `json:"err"`
+	}
+	if json.Unmarshal(answer, &reply) != nil {
+		return fmt.Errorf("relay answered HTTP %d with an unreadable answer", resp.StatusCode)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("relay refused: %s (HTTP %d)", reply.Err, resp.StatusCode)
+	}
+	if reply.Identity != code || reply.Storage != storage {
+		return errors.New("relay answer does not match the request")
+	}
+	_, err = fmt.Fprintf(out, "%s storage %s\n", reply.Identity, reply.Storage)
+	return err
+}
+
+func relayURL(raw string) (*url.URL, error) {
+	switch raw {
+	case "prod":
+		raw = syncsetup.ProductionRelayURL
+	case "staging":
+		raw = syncsetup.StagingRelayURL
+	case "dev":
+		raw = syncsetup.DevRelayURL
+	}
+	u, err := url.Parse(raw)
+	if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
+		return nil, errors.New("relay must be prod, staging, dev or an HTTP URL")
+	}
+	return u, nil
+}
+
+func readKey(path string) (ed25519.PrivateKey, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, errors.New("could not open admin key file")
+	}
+	defer file.Close()
+	info, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !info.Mode().IsRegular() || info.Mode().Perm()&0077 != 0 {
+		return nil, errors.New("admin key file must be a regular file readable only by its owner")
+	}
+	raw, err := io.ReadAll(io.LimitReader(file, 128))
+	if err != nil {
+		return nil, err
+	}
+	text := strings.TrimSuffix(strings.TrimSuffix(string(raw), "\n"), "\r")
+	seed, err := base64.RawURLEncoding.Strict().DecodeString(text)
+	if err != nil || len(seed) != ed25519.SeedSize {
+		return nil, errors.New("admin key file must contain one unpadded base64url Ed25519 seed")
+	}
+	return ed25519.NewKeyFromSeed(seed), nil
+}

cmd/codeaf-relay-admin/main_test.go

@@ -0,0 +1,87 @@
+package main
+
+import (
+	"bytes"
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"github.com/Agent-Field/codeaf/internal/syncsetup"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestStorageOptInAdminSignedRequestAndRefusals(t *testing.T) {
+	pub, key, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(t.TempDir(), "test.key")
+	if err := os.WriteFile(path, []byte(base64.RawURLEncoding.EncodeToString(key.Seed())+"\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	code := "id_" + strings.Repeat("b", 32)
+	calls, refused := 0, false
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		raw, _ := io.ReadAll(r.Body)
+		signature, _ := base64.RawURLEncoding.DecodeString(r.Header.Get("codeaf-admin-signature"))
+		if !ed25519.Verify(pub, append([]byte(adminDomain), raw...), signature) {
+			t.Error("bad signature")
+		}
+		var body approval
+		if json.Unmarshal(raw, &body) != nil || body.Host != r.Host || body.Identity != code || body.Nonce == "" || time.Since(time.UnixMilli(body.At)).Abs() > time.Minute {
+			t.Errorf("bad body: %+v", body)
+		}
+		if r.URL.Path != "/fabric/v1/admin/storage" {
+			t.Errorf("lost prefix: %s", r.URL.Path)
+		}
+		if refused {
+			w.WriteHeader(409)
+			_, _ = w.Write([]byte(`{"err":"stale"}`))
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]string{"identity": code, "storage": body.Storage})
+	}))
+	defer srv.Close()
+	for _, action := range []string{"approve", "revoke"} {
+		var out bytes.Buffer
+		if err := run(t.Context(), []string{action, code, "--key", path, "--relay", srv.URL + "/fabric"}, &out, srv.Client()); err != nil {
+			t.Fatal(err)
+		}
+		state := "on"
+		if action == "revoke" {
+			state = "off"
+		}
+		if out.String() != code+" storage "+state+"\n" {
+			t.Fatalf("answer: %q", out.String())
+		}
+	}
+	refused = true
+	if err := run(t.Context(), []string{"approve", code, "--key", path, "--relay", srv.URL + "/fabric"}, io.Discard, srv.Client()); err == nil || !strings.Contains(err.Error(), "stale") {
+		t.Fatalf("refusal: %v", err)
+	}
+	if err := run(t.Context(), []string{"approve", "bad", "--key", path, "--relay", srv.URL}, io.Discard, srv.Client()); err == nil || calls != 3 {
+		t.Fatal("invalid code sent a request")
+	}
+	var out bytes.Buffer
+	if err := run(t.Context(), []string{"public-key", "--key", path}, &out, srv.Client()); err != nil || strings.TrimSpace(out.String()) != base64.RawURLEncoding.EncodeToString(pub) {
+		t.Fatalf("public key: %v %q", err, out.String())
+	}
+	_ = os.Chmod(path, 0640)
+	if _, err := readKey(path); err == nil {
+		t.Fatal("group-readable key accepted")
+	}
+	for name, want := range map[string]string{"prod": syncsetup.ProductionRelayURL, "staging": syncsetup.StagingRelayURL, "dev": syncsetup.DevRelayURL} {
+		got, err := relayURL(name)
+		if err != nil || got.String() != want {
+			t.Fatalf("relay %s: %v %v", name, got, err)
+		}
+	}
+}

cmd/codeaf/approvals.go

@@ -20,6 +20,7 @@ import (
 	"github.com/Agent-Field/codeaf/internal/directory"
 	"github.com/Agent-Field/codeaf/internal/identity"
 	"github.com/Agent-Field/codeaf/internal/pair"
+	"github.com/Agent-Field/codeaf/internal/reqsign"
 	"github.com/Agent-Field/codeaf/internal/syncsetup"
 	"github.com/Agent-Field/codeaf/internal/tui3"
 )
@@ -276,3 +277,21 @@ func (d *approvalsDoor) ownRow() tui3.DeviceRow {
 
 // SyncService names the local pairing service even when the chat runs elsewhere.
 func (d *approvalsDoor) SyncService() string { return syncsetup.Resolve(d.dir).URL }
+
+// RelayStorage reads this computer's account without creating keys or asking the network.
+func (d *approvalsDoor) RelayStorage() (code, state string) {
+	relay := syncsetup.Resolve(d.dir)
+	if !relay.On() || identity.Solo(d.dir) {
+		return "", ""
+	}
+	id, err := identity.Load(d.dir)
+	if err != nil {
+		return "", ""
+	}
+	code = reqsign.IDOf(id.PublicKey())
+	state = syncsetup.ReportedStorage(d.dir, relay.URL, code)
+	if state == "" {
+		return "", ""
+	}
+	return code, state
+}

cmd/codeaf/chatv3.go

@@ -1453,6 +1453,14 @@ func openV3Agent(cfg session.Config, workspace string, open func(session.Config)
 		return nil, cfg, "", errors.New(chatArrivingSentence)
 	}
 	cfg = v3Seated(v3Migrated(cfg))
+	constructed := false
+	defer func() {
+		if !constructed {
+			if seals, ok := cfg.Seals.(interface{ Retire() }); ok {
+				seals.Retire()
+			}
+		}
+	}()
 	// Restore the gate before construction, so restored work cannot start behind
 	// the profile default. Return the launch config unchanged: a subsequent new
 	// conversation must not inherit this one's saved override.
@@ -1493,6 +1501,7 @@ func openV3Agent(cfg session.Config, workspace string, open func(session.Config)
 		if savedEffort != "" {
 			agent.SetConversationEffort(savedEffort)
 		}
+		constructed = true
 		return agent, cfg, "", nil
 	}
 	if !errors.Is(err, session.ErrSessionLocked) {

cmd/codeaf/chatv3_layout.go

@@ -826,12 +826,15 @@ func v3SeatWith(place session.Place, say func(string), drives *driveBook) (execu
 	machine, err := preflight.OpenMachine(c.Root, place.Workspace)
 	watch := &cellstore.SealWatch{Say: say, SyncAddress: chatSyncService()}
 	failed(watch, err)
-	drive := drives.driveOf(c, cellstore.EngineFor(place.Workspace), watch.SyncReport)
+	drive := drives.driveOf(c, cellstore.EngineFor(place.Workspace), watch.SyncReport, watch)
 	if drive != nil {
 		watch.OnTurnEnd = drive.Idle // the agent waits for the person: upload what is sealed now
 	}
 	seat, err := cellstore.SeatOver(class, c, place.Workspace, observerOf(machine), watch.Report, driveStore(drive), cellstore.WithNotices(watch.Note), cellstore.WithPipeline(), cellstore.WithWarmCapture())
 	failed(watch, err)
+	if err != nil {
+		watch.Retire()
+	}
 	watch.OnTail = func() { sealTail(seat, drive) }
 	// A fresh seat has no foreground turn in flight. Background tasks may be
 	// the first input; their journal writes need a tail seal even before chat.
@@ -874,6 +877,9 @@ func sealSeamOf(agent any, seals session.SealState) tui3.SealSeam {
 	if seals != nil {
 		seam = tui3.SealSeam{Failing: seals.Failing, Notice: seals.Take}
 	}
+	if watch, ok := seals.(interface{ Listen(func()) func() }); ok {
+		seam.Listen = watch.Listen
+	}
 	if door, ok := agent.(interface{ SealFailing() bool }); ok {
 		seam.Failing = door.SealFailing
 	}

cmd/codeaf/chatv3_pair_test.go

@@ -95,7 +95,8 @@ func TestTeamPairedFollowsPairingAndSyncOff(t *testing.T) {
 	if teamPaired() {
 		t.Fatal("missing identity was paired")
 	}
-	if _, err := identity.EnsureSolo(root); err != nil {
+	id, err := identity.EnsureSolo(root)
+	if err != nil {
 		t.Fatal(err)
 	}
 	if teamPaired() {
@@ -104,6 +105,16 @@ func TestTeamPairedFollowsPairingAndSyncOff(t *testing.T) {
 	if err := identity.EndSolo(root); err != nil {
 		t.Fatal(err)
 	}
+	relay := syncsetup.Resolve(root)
+	if err := syncsetup.SaveStorage(root, relay.URL, id.ID(), "off"); err != nil {
+		t.Fatal(err)
+	}
+	if teamPaired() {
+		t.Fatal("paired identity with storage off was team-paired")
+	}
+	if err := syncsetup.SaveStorage(root, relay.URL, id.ID(), "on"); err != nil {
+		t.Fatal(err)
+	}
 	if !teamPaired() {
 		t.Fatal("shared identity was unpaired")
 	}

cmd/codeaf/chatv3_surface.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"github.com/Agent-Field/codeaf/internal/syncsetup"
 	"log"
 	"os"
 
@@ -49,6 +50,8 @@ var (
 // it would lack is everything below, which is why [TestOnlyTheSurfaceHelperRunsTheV3Surface]
 // reads this package's sources rather than trusting the next door to remember.
 func runSurface(ctx context.Context, options tui3.Options) error {
+	stopStorage := syncsetup.StartStorageRefresh(ctx, home.Dir(), false)
+	defer stopStorage()
 	if options.Host == "" {
 		if options.Notices == nil {
 			options.Notices = surfaceNotices