feat/event-store #4

Merged

David merged 2 commits from feat/event-store into main

2026-05-05 02:30:36 +02:00

David commented

2026-05-05 02:22:47 +02:00

Owner

No description provided.

David added 2 commits

2026-05-05 02:22:47 +02:00

feat: server event log 7975cb36a0

New `event_log` module persists `event/<domain>/<id>` docs and broadcasts each event to user sessions that should see it. Recipients: actor (event.userid), users with mesh-link visibility, and full site-admins. `list` applies the same filter for non-admin readers and supports nodeid / userid / limit narrowing.

Replaces the empty-list stub at `user_session::list_events` with a real query against `event_log::list`. Event records emitted at: login (etype=auth), agent connect / disconnect (etype=device), createmesh / editmesh / deletemesh (etype=mesh), changedevice / removenode (etype=device), adduser (etype=user). The browser's event panel populates without further changes once a PR merges.

Tests: 7 new (record-then-list for admin, nodeid/userid filters, non-admin visibility, push to actor, fan-out to mesh members + admins, time-desc + limit cap). Updated the legacy `list_events_returns_empty_until_event_store_lands` to assert empty-when-no-events instead of always-empty. All 329 meshcentral-web tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

feat: meshrelay rendezvous + auth/rauth cookie minting (server side of tunnel)

Create release / Create release from merged PR (pull_request) Has been skipped

Details

e486114785

Server scaffolding for the SPA's Desktop / Terminal / Files panels (the agent dialer + protocol layers ship in a follow-up).

meshrelay.rs: route now mounted at `/meshrelay.ashx` (and the per-domain `/:domain/meshrelay.ashx`); the previous file was unreferenced. Rendezvous keys on `?id=<rand>` (the per-tunnel nonce the SPA mints in `agent-redir-ws-0.1.1.js::Start`) instead of the auth token, so the matching browser+agent halves can find each other regardless of identity. Browser side authenticates with `?auth=<authCookie>`; agent side with `?rauth=<authRelayCookie>`. Optional `?nodeid=<id>` must match the cookie's `n` field when set, pinning a relay token to a single device. AppState gains a separate `mesh_relays: RelayRegistry` so the namespace doesn't collide with the existing HTTP `web_relays`.

cookie_auth.rs: `mint_cookie(key, user_id, action, ttl, node_scope)` helper plus `action::{LOGIN=1, RELAY=4}` tags. Encodes the legacy `{u, a, n?, exp}` payload, returns base64-url. None when the server has no cookie key configured.

lib.rs default.handlebars context: now injects `authCookie` (action=LOGIN) and `authRelayCookie` (action=RELAY) at root render time so the SPA's `var authCookie / authRelayCookie` reads pick them up. 24h TTL, both per-user, no node scope; the SPA's `authcookie` renew action will plug in once that handler lands.

user_session.rs `ControlIn::Msg`: adds optional `usage: u32` (the SPA's protocol bitmap on `type=tunnel`: 1=Terminal, 2=Desktop, 4=Files, 5=FileTransfer). Threaded through `MsgExtras` and `msg_to_agent` so the agent receives it on the eventual `msg/tunnel` envelope.

Tests: 2 new meshrelay (rendezvous-by-id pumps bytes, node-scoped cookie round trip). All 325 lib tests pass.

Status: tunnel rendezvous + auth scaffolding live; SPA can now mint identities and reach the relay endpoint. Agent-side `msg/tunnel` handler + outbound dialer + per-protocol layers still pending.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>