2 Commits

Author	SHA1	Message	Date
Anso	982c7830b1	fix(mesh): address audit follow-ups (early-data, recompose, admiral gate, error codes, docs) (#1126) ... * fix(mesh): buffer early TcpData on reverse-relay path The reverse-relay code dropped the local-shaped reservation and any TcpData frames buffered in it before acceptReverseRelay had wired up the target stream. A peer that sent a request body immediately after tcp_open_reverse lost those bytes when the target lived on a third node, since reverse_local buffers them but reverse_relay did not. Carry the reservation through acceptReverseRelay: transplant its pendingData and pendingBytes into the new reverse_relay state, gate TcpData writes on targetOpen, and flush buffered frames into the target stream before sending tcp_open_ack. Mirrors the reverse_local pattern. Regression test fires tcp_open_reverse plus an immediate TcpData while ensureBridge is in flight and verifies the bytes arrive intact, in order, before the ack. * fix(mesh): recompose affected stacks when node-level mesh is disabled disableForNode used to clear DB rows and override files but leave the running containers attached to sencho_mesh with stale /etc/hosts alias entries until an operator redeployed every stack by hand. Mirror optOutStack: after the existing alias/forwarder cleanup, call regenerateOverridesAcrossFleet, cascadeRecomposeAcrossFleet, and triggerRedeploy for each previously meshed stack on the disabled node so containers detach from sencho_mesh and shed the alias entries they owned. The disabled node's mesh_stacks rows are deleted before the cascade so listMeshStacks returns the right set with no skip tuple required. Route threads the actor through actorFor(req) for parity with optInStack/optOutStack. Tests cover the redeploy fan-out, the cascade no-skip-tuple invariant, and the default actor fallback for non-route callers. * fix(mesh): require Admiral on the WS proxy-tunnel upgrade HTTP mesh routes in routes/mesh.ts all enforce requireAdmiral, but the /api/mesh/proxy-tunnel WS upgrade accepted any node_proxy or full-admin api_token regardless of the receiver's license. A node downgraded from Admiral kept serving mesh data-plane traffic to a sibling central while refusing every mesh management call. Read the receiver's local LicenseService at the upgrade and 403 when the tier is not paid+admiral. The check sits after the existing credential gate and uses LicenseService directly rather than effectiveTier (which trusts forwarded proxy headers); a remote peer dialing in cannot be trusted to assert our entitlement. Dialer and node_proxy token format are unchanged. Three regression tests cover community-tier node_proxy, skipper-tier node_proxy, and community-tier full-admin api_token all rejected with 403. * fix(mesh): handle no_target alongside push_failed in inspectStackServices proxyFetch throws MeshError('no_target') when getProxyTarget returns null (pilot tunnel offline, proxy bridge unreachable), but the inspectStackServices catch branch only matched push_failed. Offline remotes fell through to the generic 'remote unreachable' error log, which the Routing tab surfaces as an unexpected fault. Match both error codes and emit the operator-friendly warn message that names the unreachable node and the error code. Regression test spies on console.warn/console.error to pin the branch. * docs(mesh): align env defaults and forwarder comments with current architecture SENCHO_MESH_PROXY_TUNNEL_IDLE_MS in .env.example carried the old five-minute idle-close value (=300000), but the code default is DEFAULT_IDLE_TTL_MS=0 (persistent tunnel). Copying the example silently reintroduced the idle-close behavior the dialer removed. MeshForwarder.ts's leading docblock and inline listen comment still described host-network mode plus extra_hosts: host-gateway as required for forwarder reachability. Sencho runs in standard bridge mode and attaches to the shared sencho_mesh network at a stable IP; meshed user containers reach the forwarder by that IP directly. Flip the env default to 0, rewrite the env comment to describe the persistent behavior and the opt-in for idle teardown, and rewrite both forwarder comments to match the bridge-network reality. * fix(mesh): trust forwarded tier on proxy-tunnel WS and remove remote overrides on disable Admiral entitlement on the WS data plane now follows the same trust model as the HTTP mesh routes: the central asserts its tier via x-sencho-tier and x-sencho-variant on the WS handshake, and the receiver trusts those headers only when the upgrade carries a node_proxy credential. When no headers are present or the credential is a full-admin api_token, the receiver falls back to its own local license. Without this an Admiral central could be rejected by a Community remote and a Community central could dial a locally-Admiral remote. disableForNode now routes through removeOverrideFromNode so override files pushed earlier via applyLocalOverride are removed on remote nodes via DELETE /api/mesh/local-override/:stack. Sequential awaits are wrapped in Promise.allSettled to match regenerateOverridesForNode's parallel push pattern. Other changes: - Cover the post-state-swap buffering window in the reverse-relay test (TcpData arriving after openTcpStream returns but before target open). - Refresh stale MeshService comments that still referenced the removed sidecar layer and host-network listener model. * test(mesh): pin removeOverrideFromNode remote HTTP shape The disableForNode regression test mocks removeOverrideFromNode itself, so a regression inside the helper would not be caught. Add a narrow contract test that spies on global fetch and asserts the request shape: DELETE /api/mesh/local-override/:stack against the resolved proxy target, with Authorization Bearer plus the x-sencho-tier and x-sencho-variant headers. Also covers the encodeURIComponent path and the swallowed-network-error behavior the disable cascade relies on. * test(mesh): use createTestApiToken helper in proxy-tunnel api_token gate test The full-admin api_token branch of the WS Admiral gate test inlined the canonical generateApiToken + sha256 + addApiToken triple that already lives in the createTestApiToken helper. Switching to the helper removes the duplicated insertion logic and aligns this test with the helper used by the other api_token call sites.	2026-05-20 12:53:29 -04:00
Anso	f599110386	feat(mesh): collapse sidecar into Sencho process via in-process forwarder (#1000) ... The separate saelix/sencho-mesh sidecar container is gone. The forwarder logic that previously lived in mesh-sidecar/src/forwarder.ts moves into the Sencho process as backend/src/services/MeshForwarder.ts, a thin per-port net.Server lifecycle wrapper. MeshService implements the host interface and owns resolve plus splice; MeshForwarder owns listener boilerplate. One container per node, no separate image to publish, no control WebSocket. Operator-facing change: the Sencho container now runs in network_mode: host so the forwarder can bind alias ports on the host network where meshed containers' extra_hosts host-gateway entries point. Without host network mode the listeners would land in the container's namespace and inbound traffic from peers would never reach them. The 1852:1852 port publish becomes a no-op under host mode and is commented out in the operator template. Same-node forward path now dials the target container's bridge IP via Dockerode (preferring the compose default network for deterministic selection across daemon versions) instead of 127.0.0.1. The legacy 127.0.0.1 path only worked when the target service published its port to the host; the IP path works regardless. Cross-node mesh routing in this phase is central -> pilot direction only via PilotTunnelManager.openTcpStream. Pilot -> central and pilot <-> pilot via central relay land in Phase B with the tcp_open_reverse frame. Deletions: - mesh-sidecar/ package entirely (Dockerfile, package, sources, tests) - backend/src/websocket/meshControl.ts - MeshService sidecar lifecycle: spawnSidecar, stopSidecar, isSidecarRunning, mintSidecarToken, verifySidecarToken, attachSidecarSocket, handleSidecarResolve, sendSidecar - POST /api/mesh/nodes/:id/sidecar/restart route - /api/mesh/control WS dispatch in upgradeHandler Type cleanup: 'sidecar' literal removed from MeshActivitySource and MeshProbeResult.where (also the frontend mirror). MeshNodeStatus sidecarRunning becomes localForwarderListening (boolean | null) so non-local nodes get a null instead of an unconditional false; the honest semantic is "this view only knows the local forwarder state; remote forwarder status lands in Phase B." MeshNodeDiagnostic sidecar object becomes forwarder { listening, listenerCount }. Frontend MeshDiagnosticsSheet drops the restart-sidecar action and sidecar liveness card; surfaces forwarder state plus a "runs in-process; no separate container" caption. Resolves audit findings C-1 (data plane non-functional), C-2 (sidecar control WS not loopback-enforced), C-4 (sidecar lifecycle Dockerode- on-remote, PR #999 closed), and C-5 (saelix/sencho-mesh:latest unreachable). C-3 (PR #992) is unchanged. M-12 (PR #994) is unchanged.	2026-05-08 15:51:39 -04:00