feat(credential): enforce signed credential distribution across mixed admin/shared topology (#1972)

easytier/src/peers/peer_conn.rs

@@ -690,7 +690,7 @@ impl PeerConn {
     /// | Admin | SharedNode | pinned key match | PeerVerified | EncryptedUnauthenticated | SharedNode | SharedNode |
     /// | Admin | SharedNode | local has no pinned key requirement | EncryptedUnauthenticated | EncryptedUnauthenticated | SharedNode | SharedNode |
     /// | Credential | SharedNode | no pin and not trusted | EncryptedUnauthenticated | EncryptedUnauthenticated | SharedNode | SharedNode |
-    /// | Credential | Credential | both keys trusted by admin distribution | PeerVerified | PeerVerified | Credential | Credential |
+    /// | Credential | Credential | should reject | handshake reject | handshake reject | unknown | unknown |
     ///
     /// Logic (in priority order):
     /// 1. **NetworkSecretConfirmed**: proof verification succeeds
@@ -699,6 +699,7 @@ impl PeerConn {
     /// 3. **PeerVerified**: pubkey is in trusted list
     /// 4. **EncryptedUnauthenticated**: initiator without network_secret
     /// 5. **Reject**: none of the above
+    #[allow(clippy::too_many_arguments)]
     fn verify_remote_auth(
         &self,
         proof: Option<&[u8]>,
@@ -707,6 +708,7 @@ impl PeerConn {
         pinned_pubkey: Option<&[u8]>,
         has_network_secret: bool,
         is_initiator: bool,
+        remote_network_name: &str,
     ) -> Result<SecureAuthLevel, Error> {
         // 1. Verify proof
         if let Some(proof) = proof {
@@ -725,7 +727,11 @@ impl PeerConn {
                 ));
             }
             // If no network_secret, pinned key must be in trusted list
-            if !has_network_secret && !self.global_ctx.is_pubkey_trusted(remote_pubkey) {
+            if !has_network_secret
+                && !self
+                    .global_ctx
+                    .is_pubkey_trusted(remote_pubkey, remote_network_name)
+            {
                 return Err(Error::WaitRespError(
                     "pinned pubkey not in trusted list".to_owned(),
                 ));
@@ -734,7 +740,10 @@ impl PeerConn {
         }
 
         // 3. Check if pubkey is in trusted list
-        if self.global_ctx.is_pubkey_trusted(remote_pubkey) {
+        if self
+            .global_ctx
+            .is_pubkey_trusted(remote_pubkey, remote_network_name)
+        {
             return Ok(SecureAuthLevel::PeerVerified);
         }
 
@@ -903,6 +912,7 @@ impl PeerConn {
                 pinned_remote_pubkey.as_deref(),
                 network.network_secret.is_some(),
                 true, // is_initiator
+                &remote_network_name,
             )?
         };
         let peer_identity_type = self.classify_remote_identity(
@@ -1154,6 +1164,7 @@ impl PeerConn {
                     .network_secret
                     .is_some(),
                 false, // is_initiator
+                &remote_network_name,
             )?
         } else {
             SecureAuthLevel::EncryptedUnauthenticated