mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-11-12 23:31:02 +00:00
Maurice
01ae91c939
A new service-identity domain registers the installation with places.liketrek.com on its first Places request, in the background and behind a light scrypt proof of work, keeps the key encrypted in app_settings, renews it from day 60 through a daily job, drops it after three 401s in a row with up to six hours of jitter, and freezes it on a revocation until an admin starts over. TREK_SERVICES_KEY wins and turns registration off; TREK_SERVICES=off sends no key; a mirror set with TREK_PLACES_URL never registers and never sees the key, which goes only to the hosts in TREK_SERVICES_HOSTS over https. The Places client takes its headers from the identity port, sends a TREK/<version> User-Agent and keeps the instance token. A 401 or 403 does not open its breaker. GET /api/admin/service-identity reports the state, tier and today's allowance, asking the issuer at most every 20 seconds; POST .../regenerate starts a new identity.
6 lines
351 B
TypeScript
6 lines
351 B
TypeScript
/** A key in the tk1 shape for a payload of the test's choosing; the signature is never checked by TREK. */
|
|
export function serviceKeyTokenFor(payload: { i: string; iat: number; exp: number; q?: string }): string {
|
|
const body = Buffer.from(JSON.stringify({ q: 'std', ...payload })).toString('base64url');
|
|
return `tk1.test.${body}.c2lnbmF0dXJl`;
|
|
}
|