backspace

Files

T

Jannis Braun 058eb992e4 feat(federation): verify approval token before awaiting_approval → active

Receiver-side defense — closes the trust-bypass class the cheap fix
(4533e36) cannot cover. The /peer/accept handler's awaiting_approval
branch now requires an approvalToken matching the one stored on the
local peer row before promoting to active. Without a match:
- autoAccept=0 falls through to queueApprovalRequest (no bypass; new
  approval-request queued, existing awaiting_approval row untouched).
- autoAccept=1 falls back to permissive promotion (no regression vs
  prior behavior, since autoAccept=1 would accept any inbound regardless).

Successful match also deletes any stale approval-request row for the
origin to prevent debris accumulation from prior bypass attempts.

Refactor: queueing path extracted to a top-level queueApprovalRequest()
helper so both the no-existing-peer case and the awaiting_approval
mismatch fallback share one implementation. Helper generates a fresh
single-use token on every call.

Adds 'accept_awaiting_approval_fallback' variant to PeerActivationReason
to distinguish the autoAccept=1 fallback path from the verified path
in onPeerActivated audit logs.

Spec §3.5, §3.6.

Test counts: 289 → 301 (+12).

2026-04-26 11:48:33 +02:00

drizzle

feat(federation): add approval_token columns to peer schema

2026-04-26 11:44:06 +02:00

src

feat(federation): verify approval token before awaiting_approval → active

2026-04-26 11:48:33 +02:00

drizzle.config.ts

feat: add drizzle-kit config and generate initial migration

2026-04-09 00:26:53 +02:00

package.json

chore: add db:generate script for drizzle-kit migrations