astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-10-31 04:50:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

WEB: Base Path added

Browse Source
This commit is contained in:
Alexey
2026-09-26 13:49:28 +03:00
parent 326c0ecdb9
commit 5feded2919
32 changed files with 1094 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/web/manager/credentials.rs
+9 -2
View File
@@ -9,7 +9,9 @@ use super::state::{
Bootstrap, CarrierChainPhase, allow_rate, evict_oldest_unused_bootstrap, matching_profile,
new_unique_token, profile_key, remove_expired_locked,
};
use super::{BootstrapResult, ManagerError, TOKEN_BYTES, TokenHash, WebProcessRuntime};
use super::{
BootstrapResult, ManagerError, TOKEN_BYTES, TokenHash, TokenKind, WebProcessRuntime,
};
use crate::config::WebRuntimeProfile;
use crate::maestro::generation::RuntimeGeneration;
use crate::web::session::{SessionCloseReason, WebSession};
@@ -123,7 +125,12 @@ impl WebProcessRuntime {
.record_rejection(WebRejectionReason::BootstrapCapacity);
return Err(ManagerError::Limit);
}
let Some((token, hash)) = new_unique_token(generation, &state) else {
let Some((token, hash)) = new_unique_token(
generation,
&state,
&self.token_authenticator,
TokenKind::Bootstrap,
) else {
self.record_limit_hit();
self.telemetry
.record_rejection(WebRejectionReason::BootstrapCapacity);
src/web/manager/session_creation.rs
+7 -2
View File
@@ -13,7 +13,7 @@ use super::state::{
profile_key, remember_closed_token_locked, remove_expired_locked,
};
use super::{
CarrierLearningContext, CarrierRequest, CreateResult, ManagerError, TokenHash,
CarrierLearningContext, CarrierRequest, CreateResult, ManagerError, TokenHash, TokenKind,
WebProcessRuntime,
};
use crate::config::{WebCarrier, WebRuntimeProfile};
@@ -316,7 +316,12 @@ impl WebProcessRuntime {
if !admit_initial(self, &mut state, now, client_ip, profile_key, &profile) {
return Err(ManagerError::Limit);
}
let Some((session_token, session_hash)) = new_unique_token(&generation, &state) else {
let Some((session_token, session_hash)) = new_unique_token(
&generation,
&state,
&self.token_authenticator,
TokenKind::Session,
) else {
self.record_limit_hit();
self.telemetry
.record_rejection(crate::web::telemetry::WebRejectionReason::SessionCapacity);
src/web/manager/session_creation/replacement.rs
+6 -1
View File
@@ -60,7 +60,12 @@ impl WebProcessRuntime {
self.cancel_replacement(bootstrap_hash, &replacement.old_session);
return Err(ManagerError::Closed);
};
let Some((session_token, session_hash)) = new_unique_token(&generation, &state) else {
let Some((session_token, session_hash)) = new_unique_token(
&generation,
&state,
&self.token_authenticator,
TokenKind::Session,
) else {
self.record_limit_hit();
self.telemetry
.record_rejection(crate::web::telemetry::WebRejectionReason::SessionCapacity);
src/web/manager/state.rs
+8 -3
View File
@@ -7,7 +7,9 @@ use base64::Engine as _;
use sha2::{Digest, Sha256};
use zeroize::Zeroizing;
use super::{CarrierRequest, ProfileKey, TOKEN_BYTES, TokenHash};
use super::{
CarrierRequest, ProfileKey, TokenAuthenticator, TokenHash, TokenKind,
};
use crate::config::{WebCarrier, WebRuntimeConfig, WebRuntimeProfile, WebTimeoutsConfig};
use crate::maestro::generation::RuntimeGeneration;
use crate::proxy::user_admission::UserSessionRegistration;
@@ -233,10 +235,13 @@ impl Default for ManagerState {
pub(super) fn new_unique_token(
generation: &RuntimeGeneration,
state: &ManagerState,
authenticator: &TokenAuthenticator,
kind: TokenKind,
) -> Option<(String, TokenHash)> {
for _ in 0..8 {
let mut raw = [0u8; TOKEN_BYTES];
generation.rng.fill(&mut raw);
let mut nonce = [0u8; 16];
generation.rng.fill(&mut nonce);
let raw = authenticator.issue(kind, nonce);
let token = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(raw);
let hash = Sha256::digest(raw).into();
if !state.bootstraps.contains_key(&hash)