2 Commits

Include renames

Author	SHA1	Message	Date
jaap-jan	6e39807cc0	Reach a Spelunk-managed server through Spelunk, and open one from a Spelunk link ... A server Spelunk manages runs Spelunk's agent, which keeps a connection open to Spelunk. A host can now be marked "Connect through Spelunk": a connect asks Spelunk for a ticket, opens a WebSocket, and the agent connects to the SSH server on the machine's own loopback, so the server needs no open SSH port. Shells and file transfers both go this way. Client, in Client.Session: - SpelunkTunnel implements Spelunk's contract: POST {api}/api/servers/{id}/tunnel-tickets with the API key as a bearer token and {"port":N}, then a WebSocket to the API's own origin at the path Spelunk returns, offering spelunk.tunnel.v1 and ticket.<ticket>. After the upgrade the relay's RelayBridge carries the bytes unchanged. Every refusal is a sentence: 401 key, 403 role (with Spelunk's detail), 404 server, 503 agent not connected, 401/503 on the upgrade, and close codes 4502 (agent could not reach the port, or is too old: "Unknown stream kind") and 4503 (agent disconnected). Only a path is taken from the ticket response, so it cannot send the ticket to another host. - IConnectionRoute is what RelayRoute and SpelunkTunnelRoute have in common, so the connect path has one shape for both. Host model: HostSecret.Spelunk is a SpelunkRoute (normalised API base, server id, and the id of the credential holding the API key), at payload schema version 8. It is written last and only when present, so every other host keeps its bytes and its version; an older build reads a Spelunk host as read-only rather than dropping the route. A half-written route makes the item unreadable instead of dialled. It merges as one value and is exclusive with RelayEnabled. The API address must be https, or http to loopback. The API key is an ordinary keychain credential whose password is the key, referenced by id, so it is encrypted, synced, merged and rotated like every other secret, one credential serves every server in the organisation, and the used-by list and deletion warning count it. Routing: OpenRouteAsync is the one decision for both transports. A Spelunk host is never dialled directly, never probed after a failure, and a route that hung up with a reason replaces SSH.NET's transport error. UI: a "Connect through Spelunk" card beside the relay card in the desktop drawer and the phone's editor; ticking one unticks the other. dodossh://spelunk/connect?api=&server=&name=&host= links: - SpelunkLink parses them strictly and never reads a credential from one. - Program reads a link from the arguments; a launch that finds DodoSSH running passes it down the doorbell as "dodossh.open-link <link>", which the running instance parses again, bounded, and otherwise ignores whole. The plain come-forward ring is unchanged. - A saved host routed to that server on that Spelunk is connected to; otherwise the editor opens on a new, unsaved Spelunk host, with the key pre-chosen only when another host already sends it to that Spelunk. A link that arrives while locked waits for the unlock. - Windows registers the scheme under HKCU from Velopack's install and update hooks and removes it on uninstall only if it still points at this executable; the macOS plist template declares CFBundleURLTypes and the app takes the URL from Avalonia's activation event; the Linux desktop entry gets %u and MimeType=x-scheme-handler/dodossh.	2026-09-28 21:25:04 +02:00
jaap-jan	b20f7cae04	Let a host marked for the relay actually be reached through it ... The relay checkbox said it was not wired up, and the plan said the server half was built and shipped. It was not: there was ADR 0004, the contract records, RelayOptions and a CHECK constraint, and RelayOptions said in its own remarks that there was no endpoint and no dialler. So both halves are built here, as step 3 of docs/reaching-a-host-you-cannot-dial.md. Server, in Features/Relay: - POST /api/v1/relay/tickets makes every decision: the host, Connect on its vault, the relay switched on, and the stored name resolved once and judged by RelayAddressPolicy. Loopback, link-local, 0.0.0.0/8, multicast and the metadata endpoints are refused with no configuration escape, with IPv4-mapped and NAT64 spellings unwrapped first; then the operator's denials, allow-list and private-network switch. What passes goes into a Data Protection ticket, and nothing resolves the name again. Every target refusal is the same 403, so the endpoint cannot be used to map the operator's DNS; the real reason is logged. - GET /api/v1/relay/connect takes the ticket as a second subprotocol, checks its expiry against TimeProvider and spends it with a unique insert into relay_ticket_use before accepting the upgrade. After the upgrade a refusal is a close code: 4502 for a host the server could not reach, 4429 for a limit, 4408 idle, 4409 lifetime, 1001 after a drain. - relay_session is the audit row, written from short-lived scopes. Client: - RelayBridge is a loopback SOCKS5 listener that accepts once and pipes to the relay socket. It rides on the new SshLoopbackProxy.Lifetime, so the connection disposes it on every way a session ends and a failed connect disposes it before throwing. - ServerRelay, exposed as IVaultServer.Relay from /api/v1/meta, asks for the ticket, opens the socket, starts the bridge and turns every refusal into a sentence. - VaultViewModel and TransfersViewModel reach a relayed host through it, never fall back to dialling it directly, and replace SSH.NET's transport error with the relay's own reason when it gave one. Neither side ever cancels a WebSocket operation. Cancelling one aborts the socket, and an aborted socket sends no close frame, which is the only way the client learns the server could not reach the host. AnIdleSession_IsClosedWithTheIdleCode asserts that the code arrives. Three departures from ADR 0004, recorded in it: awaited copy loops rather than Pipelines (same backpressure, two 32 KiB buffers), no ?ticket= fallback, and no device id in the ticket. Tests: API 245, shell 582 (5 skipped), layout 170, SSH 110 including a real login through the bridge, API client 30, contracts 25. Not run: the Android build (its change is copy only) and the Alpine layout oracle.	2026-09-28 14:37:20 +02:00