Fleet trust, stage 3: a directory the relay cannot read, and a browser that pairs once

cmd/flue/main.go

@@ -111,6 +111,7 @@ const usageText = `flue — your terminal, as a browser tab
   flue relay status       show the configured relay
   flue relay update       redeploy this release's relay; secret and pairings kept
   flue relay address URL  repoint this machine at a custom domain on the same relay
+  flue relay reset        empty the relay's fleet directory; the fleet republishes
   flue open [path]        spawn a session in path and open it in the browser
   flue serve [--port N] [--open]   run the daemon in the foreground
   flue update             download the newest release, swap this binary, restart the daemon
@@ -411,17 +412,63 @@ func startRelay(ctx context.Context, srv *daemon.Server, identity daemon.Identit
 			return false
 		}
 	}
-	cfg := relay.Config{URL: rc.URL, Secret: rc.Secret, Origin: rc.Origin, MachineID: rc.MachineID, FleetPub: fleetKey.Public()}
+	cfg := relay.Config{
+		URL:         rc.URL,
+		Secret:      rc.Secret,
+		Origin:      rc.Origin,
+		MachineID:   rc.MachineID,
+		MachineCert: rc.MachineCert,
+		FleetPub:    fleetKey.Public(),
+	}
 	t, err := relay.New(cfg, srv, identity.Key, identity.Devices, logger)
 	if err != nil {
 		logger.Warn("relay not started", "err", err)
 		return false
 	}
+	// The directory leg, beside the hub leg and independent of it: one keeps
+	// this machine's browsers connected, the other keeps this machine's idea
+	// of who the fleet trusts up to date (spec/fleet-trust.md, "The fleet
+	// directory"). It is started here rather than inside the transport
+	// because neither needs the other — a daemon whose hub socket is down
+	// still has to hear a revocation, and one whose directory is down still
+	// serves every device paired to it.
+	//
+	// A directory this daemon cannot build is a warning and nothing more, for
+	// the reason every fault in this function is: flue's promise is a terminal
+	// in a browser tab, and the fleet is what makes that tab openable from the
+	// next machine along.
+	dir, err := relay.NewDirectory(cfg, srv, identity.Key, identity.Devices, logger)
+	if err != nil {
+		logger.Warn("fleet directory not started", "err", err)
+	} else {
+		// Installed before the goroutine, so a pairing or a revoke that
+		// happens while the first dial is still in flight is queued rather
+		// than lost.
+		srv.SetFleetPublisher(dir)
+		srv.SetDirectoryCounts(func() daemon.DirectoryCounts {
+			c := dir.Counts()
+			return daemon.DirectoryCounts(c)
+		})
+		go func() {
+			if err := dir.Run(ctx); err != nil {
+				logger.Warn("fleet directory stopped", "err", err)
+			}
+		}()
+	}
 	// The machine's identity rides every welcome alongside the status, so the
 	// UI can build /client/<id> URLs for this machine. It is configuration
 	// rather than socket state, which is why it is set here — once, by the
 	// process that read relay.json — and not by the transport's callbacks.
 	srv.SetRelayMachine(rc.MachineID, rc.MachineName)
+	// And the origin, for the Content-Security-Policy this daemon serves its own
+	// UI under. A loopback tab talks to the relay for everything that is not
+	// this machine — `wss://<relay>/client/<id>` per sibling machine, and
+	// `https://<relay>/directory` to learn which siblings exist — and neither is
+	// covered by `'self'`. Set from relay.json rather than from the transport's
+	// status because a document's policy is fixed when it is served, and a tab
+	// opened while the relay is still dialling still has to be allowed to reach
+	// it (daemon.LocalCSPFor).
+	srv.SetRelayOrigin(rc.Origin)
 	// Before the goroutine, never after it. The transport reports this itself
 	// the moment it starts dialling, and this only covers the window before it
 	// is scheduled — but a seed written *after* the goroutine started races the

cmd/flue/main_test.go

@@ -1297,16 +1297,27 @@ func TestStatusReportsAConfiguredRelayWithoutItsSecret(t *testing.T) {
 func TestStartRelayDialsAConfiguredRelay(t *testing.T) {
 	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 
-	var attempts atomic.Int64
-	var auth, path atomic.Value
+	// Both legs dial the same host, so what is recorded is per path: the hub
+	// leg at /daemon/<id> and the fleet directory at /directory. Recording a
+	// single "last dial" would be a race between two goroutines that both
+	// start here.
+	var mu sync.Mutex
+	dialed := map[string]string{} // path -> Authorization
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		auth.Store(r.Header.Get("Authorization"))
-		path.Store(r.URL.Path)
-		attempts.Add(1)
+		mu.Lock()
+		dialed[r.URL.Path] = r.Header.Get("Authorization")
+		mu.Unlock()
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
 	}))
 	defer ts.Close()
 
+	sawDial := func(path string) (string, bool) {
+		mu.Lock()
+		defer mu.Unlock()
+		auth, ok := dialed[path]
+		return auth, ok
+	}
+
 	const secret = "s3cr3t-daemon-secret"
 	if err := config.SaveRelay(config.Relay{
 		URL:         "ws" + strings.TrimPrefix(ts.URL, "http"),
@@ -1336,20 +1347,26 @@ func TestStartRelayDialsAConfiguredRelay(t *testing.T) {
 	defer cancel()
 	startRelay(ctx, srv, id)
 
-	deadline := time.Now().Add(3 * time.Second)
-	for attempts.Load() == 0 {
-		if time.Now().After(deadline) {
-			t.Fatal("the daemon never dialled the configured relay")
+	// One relay.json, two legs: the hub the browsers arrive on, and the fleet
+	// directory the revocations arrive on. The machine id from relay.json
+	// rides the hub path — it is how the Worker knows which machine's hub this
+	// socket is — and the directory has no id in its path at all, because one
+	// relay is one fleet.
+	for _, want := range []string{"/daemon/karns-macbook-pro-a1b2-0f9a12cd", "/directory"} {
+		deadline := time.Now().Add(3 * time.Second)
+		for {
+			auth, ok := sawDial(want)
+			if ok {
+				if auth != "Bearer "+secret {
+					t.Errorf("Authorization on %s = %q, want %q", want, auth, "Bearer "+secret)
+				}
+				break
+			}
+			if time.Now().After(deadline) {
+				t.Fatalf("the daemon never dialled %s", want)
+			}
+			time.Sleep(5 * time.Millisecond)
 		}
-		time.Sleep(5 * time.Millisecond)
-	}
-	if got, want := auth.Load().(string), "Bearer "+secret; got != want {
-		t.Errorf("Authorization = %q, want %q", got, want)
-	}
-	// The machine id from relay.json rides the dial path — it is how the
-	// Worker knows which machine's hub this socket is.
-	if got, want := path.Load().(string), "/daemon/karns-macbook-pro-a1b2-0f9a12cd"; got != want {
-		t.Errorf("dial path = %q, want %q", got, want)
 	}
 }