mirror of
https://github.com/stablyai/orca.git
synced 2026-10-30 16:47:34 +00:00
OrcaWinandm4air
fee083fa47
* feat(runtime): session-only browser keys and an opt-in for pairing from plain-http pages (host) - pairing.registerDeviceKey accepts ephemeral: true (advertised as pairing.device-key-ephemeral.v1). Such keyed rows are dropped when the host restarts and after 12 hours with no live socket; a sweep removes them and cuts any socket still bound to them, so later key auth gets device_revoked. - The WebSocket upgrade Origin is recorded per socket. A first pairing (a never-used pairing code) from an http:// page on another machine is refused with a sealed insecure_origin error unless the operator sets ORCA_ALLOW_INSECURE_WEB_PAIRING=1. Already-paired browsers, https and loopback pages, and native clients are unchanged. - Registry file reading moved to device-registry-file-read.ts to keep the registry under the size cap. * fix(runtime): gate first pairings only for the marked web client, never phones React Native sends an http Origin on every LAN WebSocket, so the Origin alone refused first-time QR pairing from released phones. The web bundle now marks its upgrade with ?orca-client=web; only a marked socket from an http page on another machine is gated. Released hosts ignore the query string. --------- Co-authored-by: m4air <m4air@Mac.localdomain>
22 lines
917 B
TypeScript
22 lines
917 B
TypeScript
import { z } from 'zod'
|
|
import { isDeviceProofB64, isDevicePublicKeyB64 } from './device-key-proof'
|
|
|
|
export const RegisterDeviceKeyParamsSchema = z
|
|
.object({
|
|
devicePublicKeyB64: z.string().refine(isDevicePublicKeyB64, 'expected a 32-byte Ed25519 key'),
|
|
// Ed25519 over encodeDeviceProofMessage('register', this connection's v2 transcript hash).
|
|
deviceProofB64: z.string().refine(isDeviceProofB64, 'expected a 64-byte signature'),
|
|
deviceLabel: z.string().max(256).optional(),
|
|
// Session-only browser key: the host drops the row on restart and after idling.
|
|
// Sent only to hosts advertising DEVICE_KEY_EPHEMERAL_RUNTIME_CAPABILITY (older hosts are strict).
|
|
ephemeral: z.literal(true).optional()
|
|
})
|
|
.strict()
|
|
|
|
export type RegisterDeviceKeyParams = z.infer<typeof RegisterDeviceKeyParamsSchema>
|
|
|
|
export type RegisterDeviceKeyResult = {
|
|
deviceId: string
|
|
credentialRevision: number
|
|
}
|