puter/paseo
1
0
Fork 0
mirror of https://github.com/getpaseo/paseo.git synced 2026-11-07 17:04:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(hub): correct relationship trust boundaries

Browse Source 
Authenticated daemon sessions own relationship management regardless of transport. The separate Hub session remains operation-allowlisted, rejects malformed execution inputs, and uses bounded outbound handshakes.
This commit is contained in:
Mohamed Boudra
2026-07-13 17:47:40 +02:00
parent 3772a8a118
commit dfcaa9bf89
11 changed files with 142 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/hub.md
+3 -5
View File
@@ -15,11 +15,9 @@ The daemon persists a relationship ID and private connection credential before e
relationship is independent of its current transport, so a future transport can replace the direct
WebSocket without pairing again. The current foundation supports one Hub relationship per daemon.
Only a trusted session arriving through a server-observed local, non-browser daemon transport may
run the `hub.relationship.connect`, `hub.relationship.get_status`, and
`hub.relationship.disconnect` RPCs. Remote, relay, browser-origin, and Hub sessions cannot manage
the relationship. The CLI also rejects an explicit non-loopback connect target before sending the
one-time token. A hello message's `clientType` is descriptive and grants no authority.
Normal authenticated daemon sessions may run the `hub.relationship.connect`,
`hub.relationship.get_status`, and `hub.relationship.disconnect` RPCs regardless of transport.
The restricted Hub session cannot manage the relationship.
## Hub session scope