feat(web): add webhook-managed machine access and multi-instance CLI support (#1989)

* feat: add webhook-managed access and multi-instance CLI support
* fix(foreign): verify credential of foreign credential peer

easytier-web/src/client_manager/storage.rs

@@ -22,6 +22,7 @@ struct ClientInfo {
 #[derive(Debug)]
 pub struct StorageInner {
     user_clients_map: DashMap<UserIdInDb, DashMap<uuid::Uuid, ClientInfo>>,
+    global_machine_map: DashMap<uuid::Uuid, ClientInfo>,
     pub db: Db,
 }
 
@@ -41,22 +42,19 @@ impl Storage {
     pub fn new(db: Db) -> Self {
         Storage(Arc::new(StorageInner {
             user_clients_map: DashMap::new(),
+            global_machine_map: DashMap::new(),
             db,
         }))
     }
 
-    fn remove_mid_to_client_info_map(
-        map: &DashMap<uuid::Uuid, ClientInfo>,
-        machine_id: &uuid::Uuid,
-        client_url: &url::Url,
-    ) {
-        map.remove_if(machine_id, |_, v| v.storage_token.client_url == *client_url);
+    fn remove_client_info_map(map: &DashMap<uuid::Uuid, ClientInfo>, stoken: &StorageToken) {
+        map.remove_if(&stoken.machine_id, |_, v| {
+            v.storage_token.client_url == stoken.client_url
+                && v.storage_token.user_id == stoken.user_id
+        });
     }
 
-    fn update_mid_to_client_info_map(
-        map: &DashMap<uuid::Uuid, ClientInfo>,
-        client_info: &ClientInfo,
-    ) {
+    fn update_client_info_map(map: &DashMap<uuid::Uuid, ClientInfo>, client_info: &ClientInfo) {
         map.entry(client_info.storage_token.machine_id)
             .and_modify(|e| {
                 if e.report_time < client_info.report_time {
@@ -78,14 +76,16 @@ impl Storage {
             report_time,
         };
 
-        Self::update_mid_to_client_info_map(&inner, &client_info);
+        Self::update_client_info_map(&inner, &client_info);
+        Self::update_client_info_map(&self.0.global_machine_map, &client_info);
     }
 
     pub fn remove_client(&self, stoken: &StorageToken) {
+        Self::remove_client_info_map(&self.0.global_machine_map, stoken);
         self.0
             .user_clients_map
             .remove_if(&stoken.user_id, |_, set| {
-                Self::remove_mid_to_client_info_map(set, &stoken.machine_id, &stoken.client_url);
+                Self::remove_client_info_map(set, stoken);
                 set.is_empty()
             });
     }
@@ -106,6 +106,22 @@ impl Storage {
         })
     }
 
+    /// Find client_url by machine_id across all users.
+    pub fn get_client_url_by_machine_id_global(&self, machine_id: &uuid::Uuid) -> Option<url::Url> {
+        self.0
+            .global_machine_map
+            .get(machine_id)
+            .map(|info| info.storage_token.client_url.clone())
+    }
+
+    /// Find user_id by machine_id across all users.
+    pub fn get_user_id_by_machine_id_global(&self, machine_id: &uuid::Uuid) -> Option<UserIdInDb> {
+        self.0
+            .global_machine_map
+            .get(machine_id)
+            .map(|info| info.storage_token.user_id)
+    }
+
     pub fn list_user_clients(&self, user_id: UserIdInDb) -> Vec<url::Url> {
         self.0
             .user_clients_map
@@ -129,3 +145,57 @@ impl Storage {
         Ok(new_user.id)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn make_storage_token(
+        user_id: UserIdInDb,
+        machine_id: uuid::Uuid,
+        client_url: &str,
+    ) -> StorageToken {
+        StorageToken {
+            token: format!("token-{machine_id}"),
+            client_url: client_url.parse().unwrap(),
+            machine_id,
+            user_id,
+        }
+    }
+
+    #[tokio::test]
+    async fn global_machine_index_uses_latest_report_and_ignores_stale_removal() {
+        let storage = Storage::new(Db::memory_db().await);
+        let machine_id = uuid::Uuid::new_v4();
+
+        let old_token = make_storage_token(1, machine_id, "tcp://127.0.0.1:1001");
+        let new_token = make_storage_token(1, machine_id, "tcp://127.0.0.1:1002");
+
+        storage.update_client(old_token.clone(), 10);
+        storage.update_client(new_token.clone(), 20);
+
+        assert_eq!(
+            storage.get_client_url_by_machine_id_global(&machine_id),
+            Some(new_token.client_url.clone())
+        );
+        assert_eq!(
+            storage.get_user_id_by_machine_id_global(&machine_id),
+            Some(1)
+        );
+
+        storage.remove_client(&old_token);
+
+        assert_eq!(
+            storage.get_client_url_by_machine_id_global(&machine_id),
+            Some(new_token.client_url.clone())
+        );
+
+        storage.remove_client(&new_token);
+
+        assert_eq!(
+            storage.get_client_url_by_machine_id_global(&machine_id),
+            None
+        );
+        assert_eq!(storage.get_user_id_by_machine_id_global(&machine_id), None);
+    }
+}