glm-5.3-flash
2202149fc0
- auth_publickey: ed25519-only gate → single fingerprint path → resolve_from_fingerprint → accept-with-identity (stored per- connection, read by wave 3) / reject fail-closed; the gate is explicit-over-inherited (ADR-002 decision 4) and precedes resolution - auth_publickey_offered: explicit accept-and-delegate (counting stays honest, POC-1) - auth_none / auth_password / auth_keyboard_interactive / auth_openssh_certificate: four explicit family-contract declines - username carried by no hook — resolution is fingerprint-only (OQ-03) - SessionHandler constructible via #[doc(hidden)] re-export (the w2-server-mount note's widening); resolve_bridge structured out of the #[non_exhaustive]-arg hooks so contract tests drive the bridge core directly - tests/auth_bridge.rs: 21 rows — wire rows over the real adapter mount (accept, fail-closed reject, username independence, revoke between attempts, none/password/certificate declines) + direct rows over the wave-1 doubles - cert fixture (throwaway ca + alpha-cert.pub) recorded in fingerprints.txt; MemHostKeySource double in tests/common Verification: cargo test (76 across the suite), --all-features, clippy --all-targets (both feature sets, -D warnings), fmt --check, doc --no-deps, taskgraph validate — all green
48 lines
2.3 KiB
Rust
48 lines
2.3 KiB
Rust
//! alkssh — the alk family's SSH adapter (the alkhttp-style door for the
|
||
//! SSH protocol): a thin wrapper around russh terminating the vanilla-ssh
|
||
//! wire and bridging to/from alkcall channels (the `alk/ssh` ALPN).
|
||
//!
|
||
//! No SSH framing is authored in-family (family ADR-003): russh owns the
|
||
//! wire, and the crate's substance is the channel-type mappings —
|
||
//! session/pty → alktty, direct/forwarded-tcpip → alktunnels, git exec →
|
||
//! alkgit, sftp → alkfs later (a declining placeholder until then), each
|
||
//! behind its cargo feature. Git over SSH is exec-only (ADR-006): a
|
||
//! subsystem request can never carry the repository, so it declines. A
|
||
//! client opening an unfeatured or unimplemented channel type gets a
|
||
//! clean decline — never a half-capability, never a silent fallback; the
|
||
//! default build (no features) is structurally incapable of serving
|
||
//! anything but declines.
|
||
//!
|
||
//! Identity is the family's, not SSH's: a verified key's fingerprint →
|
||
//! alkcall `IdentityProvider`. Keys the crate holds (client dial keys,
|
||
//! host keys) come from alkvault-backed sources — vault-encrypted at
|
||
//! rest, decrypted at use (ADR-005), never env vars.
|
||
//!
|
||
//! Architecture: `docs/architecture/` (phase 1 — ADRs 001–006 accepted;
|
||
//! the dependency surface, feature graph, and wave-1 foundations are
|
||
//! landed; the server stack, the mappings, the client direction, and
|
||
//! validation are later implementation waves — wave 2 decomposes after
|
||
//! this gate). See also `docs/research/` and family ADR-003.
|
||
|
||
mod adapter;
|
||
mod config;
|
||
mod error;
|
||
mod fingerprint;
|
||
mod handler;
|
||
mod host_key;
|
||
mod key_source;
|
||
|
||
pub use adapter::SshAdapter;
|
||
pub use config::{DialConfig, Limits, ServeConfig};
|
||
pub use error::{AdapterError, KeySourceError};
|
||
pub use fingerprint::fingerprint;
|
||
/// Contract-test surface (`#[doc(hidden)]`): the per-connection auth
|
||
/// bridge handler — constructible so the tests drive its hooks directly
|
||
/// against the wave-1 doubles (see `handler.rs` §Test surface). Not
|
||
/// documented API: the wire-facing surface is exactly `SshAdapter` +
|
||
/// the config/error/host/key-source types.
|
||
#[doc(hidden)]
|
||
pub use handler::SessionHandler;
|
||
pub use host_key::{HostKeyPolicy, PresentedHostKey, RejectAll};
|
||
pub use key_source::{HostKeySource, KeySource, VaultHostKeySource, VaultKeySource};
|