5 Commits

Include renames

Author	SHA1	Message	Date
Matthew Meszaros	cbee2d3073	feat: answer a node heartbeat sent with INTERNAL_API_TOKEN where NODE_BROKER_TOKEN is required with the node's desired version only, recording nothing, through NodeHeartbeatAuthMiddleware and fleetnode UpdateOnly, so a node on an older release always updates itself onto the broker token without NODE_ACCEPT_INTERNAL_TOKEN, and say so in the configuration and split-deployment docs	2026-10-05 06:54:31 +02:00
Matthew Meszaros	c178dadf81	feat: keep the key and blob brokers on NODE_BROKER_TOKEN only, and let an operator admit INTERNAL_API_TOKEN on the other node routes with NODE_ACCEPT_INTERNAL_TOKEN=true while nodes joined before the split upgrade	2026-10-04 05:18:01 -07:00
Matthew Meszaros	e852a106a9	feat: serve every node-only internal route (data keys, message map, sync lookups, worker config, fleet heartbeat) on NODE_BROKER_TOKEN and leave only tracked links, domain redirects, page hits and forms on INTERNAL_API_TOKEN, render nodes only the node token when one is set, and have the installer generate a distinct NODE_BROKER_TOKEN for new installs and its own UPDATER_TOKEN	2026-10-04 03:21:58 -07:00
Matthew Meszaros	510ee692ba	feat: address the review on the split-deployment branch by moving the two broker routes onto their own NODE_BROKER_TOKEN so the internet-facing tracking and forms services no longer hold a credential that can open any organization's data key, refusing to presign any key outside the prefixes a node reaches, fixing IAM policies that named an alias ARN KMS never resolves in a Resource element, bounding both brokered HTTP clients because the sync loop's context never expires, no longer reporting a 403 from the object store as a missing body, and redacting the DSN and URL credentials the dry-run listing printed in clear	2026-09-10 14:19:53 +02:00
Matthew Meszaros	99226338c9	infra(encryptedkeys): pluggable DEK store with HTTP proxy for workers ... New encryptedkeys.Store interface with three impls: postgres - backend default, durable via PG dynamodb - existing AWS path, also covers Scylla Alternator via AWS_ENDPOINT_URL_DYNAMODB http - worker-side adapter that talks to the backend's new /api/v1/internal/dek/:userID endpoint, so workers never connect directly to Postgres The HTTP endpoint sits behind a new InternalAuthMiddleware that does constant-time bearer-token compare against INTERNAL_API_TOKEN. Fail- closed if the env var is unset. cipher.Service now takes an encryptedkeys.Store instead of a Dynamo repository. The old internal/repository/dynamo_user_encrypted_keys.go is deleted (the file also had a pre-existing copy-paste bug using EmailMessageMapTable in Get/Del that's gone with it). New migration 38 adds user_encrypted_keys (user_id PK, encrypted_data_key, created_at, updated_at). 20 tests cover HTTP round-trip, conflict semantics, factory selection, middleware auth (fail-closed / wrong-scheme / timing-safe / happy path), and DEK handler responses through gin's test harness.	2026-05-27 14:42:11 +00:00