mirror/Easytier
1
0
Fork 0
mirror of https://github.com/EasyTier/EasyTier.git synced 2026-09-02 09:09:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(credentials): centralize grant policy (#2517)

Browse Source 
* refactor(credentials): centralize grant policy

Represent ACL groups, relay permission, proxy CIDRs, and reuse as one
internal credential grant shared by generated, imported, managed, and
attached credentials. Normalize proxy CIDRs at construction while
preserving the flat credential storage schema.

Reuse one managed credential adapter for protobuf/TOML projection and
patching so defaults and future fields have a single mapping authority.

* fix(credentials): normalize grants loaded from storage

Run persisted grants through the same CIDR normalization used by new and
managed credentials. Reject invalid stored CIDRs through the existing
storage-unavailable path and include the credential ID in the error.

Cover whitespace migration and invalid legacy data with regression tests.
This commit is contained in:
KKRainbow
2026-08-22 23:55:29 +08:00
committed by GitHub
parent 3fe427bc99
commit 9f231ee76c
8 changed files with 313 additions and 175 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CONTEXT.md
+8
View File
@@ -22,6 +22,14 @@ operation transition.
Host capability operations use a separate seam. They turn Host readiness into
Rust task wakeups and do not share the caller-to-core broker state machine.
## Credential grant
A credential grant contains the authorization constraints shared by generated,
imported, managed, and attached-peer credentials: ACL groups, relay permission,
allowed proxy CIDRs, and whether concurrent reuse is allowed. It does not own
credential identity, key material, lifetime, persistence, or runtime ownership.
Each credential intake path normalizes the grant before installing it.
## Attached peer
An attached peer is an ordinary `PeerManagerCore` connected to another