Skip to content

fix(leaf): grant unauthenticated peers capabilities explicitly; go-libfossil v0.11.0 #201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danmestas merged 1 commit into from
Oct 11, 2026
Merged

fix(leaf): grant unauthenticated peers capabilities explicitly; go-libfossil v0.11.0 #201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion bridge/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ go 1.26.0

require (
github.com/danmestas/EdgeSync/leaf v0.0.3
github.com/danmestas/go-libfossil v0.10.0
github.com/danmestas/go-libfossil v0.11.0
github.com/danmestas/go-libfossil/db/driver/modernc v0.3.0
github.com/nats-io/nats-server/v2 v2.14.5
github.com/nats-io/nats.go v1.53.1
Expand Down
4 changes: 2 additions & 2 deletions bridge/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@ github.com/antithesishq/antithesis-sdk-go v0.7.2 h1:oEEedg1Xgi8drRjqB0f9tfjhLoIn
github.com/antithesishq/antithesis-sdk-go v0.7.2/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/danmestas/go-libfossil v0.10.0 h1:POA4uzYgIv3iJhTMwLM1wGmGo5FnzOBtyd1BwR6H/lo=
github.com/danmestas/go-libfossil v0.10.0/go.mod h1:srcBH/pQu2vKaebmyTIQcwJ5Jev2PUtL76JQXxEy7mQ=
github.com/danmestas/go-libfossil v0.11.0 h1:oqd/1f0CooP7940Ten8i2NF5yRtZFjEvybbXqEn+otQ=
github.com/danmestas/go-libfossil v0.11.0/go.mod h1:srcBH/pQu2vKaebmyTIQcwJ5Jev2PUtL76JQXxEy7mQ=
github.com/danmestas/go-libfossil/db/driver/modernc v0.3.0 h1:O01NTY1LOkD9rcjneDAti5SC4RGvSARrrWtfnXyehBs=
github.com/danmestas/go-libfossil/db/driver/modernc v0.3.0/go.mod h1:spdUGmH76DTTxNqmE2BaH3PvzGkilaNYnGQbaHO3T7M=
github.com/danmestas/go-libfossil/db/driver/ncruces v0.3.0 h1:/0g6Ye9NFh6M9eH2n8shS/ahlyKK9Xtwl9w8K5/MEbE=
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ require (
github.com/alecthomas/kong v1.16.1
github.com/danmestas/EdgeSync/bridge v0.0.4
github.com/danmestas/EdgeSync/leaf v0.0.12
github.com/danmestas/go-libfossil v0.10.0
github.com/danmestas/go-libfossil v0.11.0
github.com/danmestas/go-libfossil/db/driver/modernc v0.3.0
github.com/nats-io/nats-server/v2 v2.14.5
github.com/nats-io/nats.go v1.53.1
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ github.com/antithesishq/antithesis-sdk-go v0.7.2 h1:oEEedg1Xgi8drRjqB0f9tfjhLoIn
github.com/antithesishq/antithesis-sdk-go v0.7.2/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/danmestas/go-libfossil v0.10.0 h1:POA4uzYgIv3iJhTMwLM1wGmGo5FnzOBtyd1BwR6H/lo=
github.com/danmestas/go-libfossil v0.10.0/go.mod h1:srcBH/pQu2vKaebmyTIQcwJ5Jev2PUtL76JQXxEy7mQ=
github.com/danmestas/go-libfossil v0.11.0 h1:oqd/1f0CooP7940Ten8i2NF5yRtZFjEvybbXqEn+otQ=
github.com/danmestas/go-libfossil v0.11.0/go.mod h1:srcBH/pQu2vKaebmyTIQcwJ5Jev2PUtL76JQXxEy7mQ=
github.com/danmestas/go-libfossil/db/driver/modernc v0.3.0 h1:O01NTY1LOkD9rcjneDAti5SC4RGvSARrrWtfnXyehBs=
github.com/danmestas/go-libfossil/db/driver/modernc v0.3.0/go.mod h1:spdUGmH76DTTxNqmE2BaH3PvzGkilaNYnGQbaHO3T7M=
github.com/danmestas/go-libfossil/db/driver/ncruces v0.3.0 h1:/0g6Ye9NFh6M9eH2n8shS/ahlyKK9Xtwl9w8K5/MEbE=
Expand Down
7 changes: 7 additions & 0 deletions leaf/agent/agent.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,13 @@ func New(cfg Config) (*Agent, error) {
}
applySQLiteTuning(r)

if cfg.NobodyCaps != "" {
if err := r.SetCaps("nobody", cfg.NobodyCaps); err != nil {
r.Close()
return nil, fmt.Errorf("agent: apply NobodyCaps: %w", err)
}
}

projectCode, err := r.Config("project-code")
if err != nil {
r.Close()
Expand Down
9 changes: 9 additions & 0 deletions leaf/agent/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,15 @@ type Config struct {
// project sync subject. Enables leaf-to-leaf sync without a bridge.
ServeNATSEnabled bool

// NobodyCaps, when non-empty, replaces the capabilities of the repo's
// "nobody" user at startup. Peers that sync with this leaf without
// credentials (HTTP, NATS or iroh serving) get exactly these. Empty
// keeps whatever the repo stores; a repo libfossil creates or clones
// grants nobody clone and pull ("gjorz") but not push. Set "gio" to
// let unauthenticated peers push to this leaf. Applied by New;
// NewFromParts does no I/O and ignores it.
NobodyCaps string

// CustomDialer overrides the default net.Dial for NATS connections.
// Set to &wsdialer.WSDialer{URL: "ws://..."} for browser WebSocket.
CustomDialer nats.CustomDialer
Expand Down
2 changes: 2 additions & 0 deletions leaf/cmd/leaf/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ func main() {
pull := flag.Bool("pull", true, "enable pull")
serveHTTP := flag.String("serve-http", envOrDefault("LEAF_SERVE_HTTP", ""), "HTTP listen address (e.g. :8080) to serve fossil clone/sync")
serveNATS := flag.Bool("serve-nats", false, "enable NATS request/reply listener for leaf-to-leaf sync")
nobodyCaps := flag.String("nobody-caps", envOrDefault("LEAF_NOBODY_CAPS", ""), "capabilities for peers syncing without credentials (e.g. gio to accept their pushes); empty keeps the repo's")
uv := flag.Bool("uv", false, "enable unversioned file sync (wiki, forum, attachments)")
iroh := flag.Bool("iroh", envBool("LEAF_IROH"), "enable iroh sidecar for peer-to-peer sync")
irohKeyPath := flag.String("iroh-key", envOrDefault("LEAF_IROH_KEY", ""), "path to iroh Ed25519 keypair (default: <repo>.iroh-key)")
Expand Down Expand Up @@ -103,6 +104,7 @@ func main() {
UV: *uv,
ServeHTTPAddr: *serveHTTP,
ServeNATSEnabled: *serveNATS,
NobodyCaps: *nobodyCaps,
Observer: obs,
IrohEnabled: *iroh,
IrohPeers: irohPeers,
Expand Down
2 changes: 1 addition & 1 deletion leaf/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ module github.com/danmestas/EdgeSync/leaf
go 1.26.0

require (
github.com/danmestas/go-libfossil v0.10.0
github.com/danmestas/go-libfossil v0.11.0
github.com/danmestas/go-libfossil/db/driver/modernc v0.3.0
github.com/danmestas/go-libfossil/db/driver/ncruces v0.3.0
github.com/nats-io/nats-server/v2 v2.14.5
Expand Down
4 changes: 2 additions & 2 deletions leaf/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ github.com/chromedp/chromedp v0.15.0 h1:B5abPcaCVetu6GDHsQKj8HbMhDWdiOM52E/TuOfu
github.com/chromedp/chromedp v0.15.0/go.mod h1:V5szO2ASqoBZsIQ88EfNMRhi9737Equm5HFL9tsBt3Q=
github.com/chromedp/sysutil v1.1.0 h1:PUFNv5EcprjqXZD9nJb9b/c9ibAbxiYo4exNWZyipwM=
github.com/chromedp/sysutil v1.1.0/go.mod h1:WiThHUdltqCNKGc4gaU50XgYjwjYIhKWoHGPTUfWTJ8=
github.com/danmestas/go-libfossil v0.10.0 h1:POA4uzYgIv3iJhTMwLM1wGmGo5FnzOBtyd1BwR6H/lo=
github.com/danmestas/go-libfossil v0.10.0/go.mod h1:srcBH/pQu2vKaebmyTIQcwJ5Jev2PUtL76JQXxEy7mQ=
github.com/danmestas/go-libfossil v0.11.0 h1:oqd/1f0CooP7940Ten8i2NF5yRtZFjEvybbXqEn+otQ=
github.com/danmestas/go-libfossil v0.11.0/go.mod h1:srcBH/pQu2vKaebmyTIQcwJ5Jev2PUtL76JQXxEy7mQ=
github.com/danmestas/go-libfossil/db/driver/modernc v0.3.0 h1:O01NTY1LOkD9rcjneDAti5SC4RGvSARrrWtfnXyehBs=
github.com/danmestas/go-libfossil/db/driver/modernc v0.3.0/go.mod h1:spdUGmH76DTTxNqmE2BaH3PvzGkilaNYnGQbaHO3T7M=
github.com/danmestas/go-libfossil/db/driver/ncruces v0.3.0 h1:/0g6Ye9NFh6M9eH2n8shS/ahlyKK9Xtwl9w8K5/MEbE=
Expand Down
4 changes: 4 additions & 0 deletions sim/iroh_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,10 @@ func TestIrohConvergence(t *testing.T) {
if err != nil {
t.Fatalf("open leaf-%d: %v", i, err)
}
// leaf-0 pushes to leaf-1 without credentials.
if err := r.SetCaps("nobody", "gio"); err != nil {
t.Fatalf("leaf-%d: grant nobody push: %v", i, err)
}
a := agent.NewFromParts(agent.Config{
RepoPath: leafPaths[i],
Push: true,
Expand Down
1 change: 1 addition & 0 deletions sim/nats_iroh_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ func TestNATSOverIrohSync(t *testing.T) {
IrohKeyPath: filepath.Join(dir, fmt.Sprintf("leaf-%d.iroh-key", i)),
IrohBinaryPath: sidecarBin,
ServeNATSEnabled: true,
NobodyCaps: "gio", // peers push to each other without credentials
PeerID: fmt.Sprintf("test-peer-%d", i),
Logger: func(msg string) {
t.Logf("[leaf-%d] %s", idx, msg)
Expand Down
Loading