aiolabs/spirekeeper
8
0
Fork 0
Code Issues 23 Pull requests Projects Releases Packages Wiki Activity Actions

fix(fleet-ui): pair-dialog v-else compiler error + TTL docstring correction #27

Merged
padreug merged 2 commits from fix/pair-dialog-and-ttl-doc into main 2026-06-18 23:01:16 +00:00
Conversation 0 Commits 2 Files changed 2 +9 -4
1 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 554b2e2e17 - Show all commits

docs(pairing): correct duration_hours TTL docstring
Some checks failed
ci.yml / docs(pairing): correct duration_hours TTL docstring (pull_request) Failing after 0s
Details

Prev Next 
duration_hours stamps Token.expiresAt, but nsecbunkerd reads expiresAt
only in validateToken at connect/redeem time — the sign-time ACL never
checks it (materialised SigningConditions carry no expiry; the policy
join filters revokedAt only). So TTL bounds only the un-redeemed connect
window, not an established binding; revoke_key_user is the real post-bind
cutoff. Same ACL-ordering class as the revoke finding (#22). Tracked at
aiolabs/nsecbunkerd#24.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Padreug 2026-06-19 00:59:29 +02:00
commit 554b2e2e17

13
pairing.py
View file

@ -165,10 +165,15 @@ async def pair_spire(
"""Mint a bunker-held key + scoped connect token for `machine` and
return the seed URL the spire redeems at first boot.
`duration_hours` (optional, aiolabs/lnbits#54 item 2) sets a TTL on the
spire's connect token — the bunker stamps `expiresAt` and rejects the
token once it lapses, forcing a re-pair. None = non-expiring (the only
invalidation path is then revoke, `revoke_spire`).
`duration_hours` (optional, aiolabs/lnbits#54 item 2) stamps `expiresAt`
on the spire's connect token. NOTE: this bounds ONLY the window in which
an *un-redeemed* token can first connect — nsecbunkerd reads `expiresAt`
solely in `validateToken` at redeem time. Once the spire has connected
and its per-KeyUser grants are materialized, an expired token keeps
signing (the sign-time ACL never checks `expiresAt`; same ACL-ordering
subtlety as the revoke finding, #22). The real post-bind cutoff is
`revoke_spire` (`revoke_key_user`), not TTL. Post-bind TTL enforcement is
tracked at aiolabs/nsecbunkerd#24. None = non-expiring connect window.
`admin_client` must already be connected (the caller owns the
`async with NsecBunkerAdminClient.from_settings()` context) — keeps