aiolabs/spirekeeper
8
0
Fork 0
Code Issues 23 Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request 'fix(fleet-ui): pair-dialog v-else compiler error + TTL docstring correction' (#27) from fix/pair-dialog-and-ttl-doc into main
Some checks failed
ci.yml / Merge pull request 'fix(fleet-ui): pair-dialog v-else compiler error + TTL docstring correction' (#27) from fix/pair-dialog-and-ttl-doc into main (push) Failing after 0s
Details

Browse source 
Reviewed-on: #27
This commit is contained in:
padreug 2026-06-18 23:01:15 +00:00
commit cc8d786331
2 changed files with 17 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

13
pairing.py
View file

@ -165,10 +165,15 @@ async def pair_spire(
"""Mint a bunker-held key + scoped connect token for `machine` and """Mint a bunker-held key + scoped connect token for `machine` and
return the seed URL the spire redeems at first boot. return the seed URL the spire redeems at first boot.
`duration_hours` (optional, aiolabs/lnbits#54 item 2) sets a TTL on the `duration_hours` (optional, aiolabs/lnbits#54 item 2) stamps `expiresAt`
spire's connect token — the bunker stamps `expiresAt` and rejects the on the spire's connect token. NOTE: this bounds ONLY the window in which
token once it lapses, forcing a re-pair. None = non-expiring (the only an *un-redeemed* token can first connect — nsecbunkerd reads `expiresAt`
invalidation path is then revoke, `revoke_spire`). solely in `validateToken` at redeem time. Once the spire has connected
and its per-KeyUser grants are materialized, an expired token keeps
signing (the sign-time ACL never checks `expiresAt`; same ACL-ordering
subtlety as the revoke finding, #22). The real post-bind cutoff is
`revoke_spire` (`revoke_key_user`), not TTL. Post-bind TTL enforcement is
tracked at aiolabs/nsecbunkerd#24. None = non-expiring connect window.
`admin_client` must already be connected (the caller owns the `admin_client` must already be connected (the caller owns the
`async with NsecBunkerAdminClient.from_settings()` context) — keeps `async with NsecBunkerAdminClient.from_settings()` context) — keeps

12
templates/spirekeeper/index.html
View file

@ -855,7 +855,8 @@
</q-card-section> </q-card-section>
<!-- Step 1 — configure + generate --> <!-- Step 1 — configure + generate -->
<q-card-section v-if="!pairDialog.result"> <template v-if="!pairDialog.result">
<q-card-section>
<p class="text-caption q-mb-md" :style="{opacity: 0.7}"> <p class="text-caption q-mb-md" :style="{opacity: 0.7}">
Mints a dedicated signing key for Mints a dedicated signing key for
<b v-text="(pairDialog.machine && pairDialog.machine.name) || 'this spire'"></b> <b v-text="(pairDialog.machine && pairDialog.machine.name) || 'this spire'"></b>
@ -880,16 +881,18 @@
class="q-mb-md" class="q-mb-md"
dense outlined></q-input> dense outlined></q-input>
</q-card-section> </q-card-section>
<q-card-actions v-if="!pairDialog.result" align="right" class="text-primary"> <q-card-actions align="right" class="text-primary">
<q-btn flat label="Cancel" v-close-popup></q-btn> <q-btn flat label="Cancel" v-close-popup></q-btn>
<q-btn <q-btn
color="primary" label="Generate seed URL" icon="vpn_key" color="primary" label="Generate seed URL" icon="vpn_key"
:loading="pairDialog.saving" :loading="pairDialog.saving"
@click="submitPair"></q-btn> @click="submitPair"></q-btn>
</q-card-actions> </q-card-actions>
</template>
<!-- Step 2 — show the seed URL --> <!-- Step 2 — show the seed URL -->
<q-card-section v-else> <template v-else>
<q-card-section>
<q-banner dense rounded class="bg-green-1 text-grey-9 q-mb-md"> <q-banner dense rounded class="bg-green-1 text-grey-9 q-mb-md">
<template v-slot:avatar> <template v-slot:avatar>
<q-icon name="check_circle" color="green"></q-icon> <q-icon name="check_circle" color="green"></q-icon>
@ -928,9 +931,10 @@
</q-btn> </q-btn>
</div> </div>
</q-card-section> </q-card-section>
<q-card-actions v-else align="right" class="text-primary"> <q-card-actions align="right" class="text-primary">
<q-btn flat label="Done" color="primary" v-close-popup></q-btn> <q-btn flat label="Done" color="primary" v-close-popup></q-btn>
</q-card-actions> </q-card-actions>
</template>
</q-card> </q-card>
</q-dialog> </q-dialog>