Per-client access control: grants + temporary guest access, host-enforced end to end (WP1–WP13) #245
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unom/punktfunk#245
Reference in New Issue
Block a user
Implements the full per-client access plan (
punktfunk-planning/design/per-client-access.md+ its implementation plan, PR #8 there; §7 status table updated with these shas). A paired device now carries what it may do (six grant bits: gamepad / pointer / keyboard / clipboard / mic / launch, surfaced as three presets — Full control · Controller only · View only) and for how long (wall-clock expiry with live mid-session cut). Headline flow: a guest knocks, the owner clicks "Approve as guest" — controller-only for 4 h, pad #2 lights up, and the grant cleans itself up after the evening.Ten commits, one per work package, plus a merge of main's 2026-08-15 security sweep:
97fe3a0f— grant vocabulary, exhaustiveclassify(InputKind)(a new InputKind breaks the build here — that's the default-deny),AccessUpdate(0x58), typed closes 0x69/0x6A, Welcome trailinggrants/expires_in_secs.WIRE_VERSIONstays 2 (trailing-append precedent).25487a8b— grants + expiry onPairedClient(serde-defaulted; old stores decode as full/permanent), per-fingerprint watch registry, and the security fix:add()is now name-only on re-pair, so a guest re-pair can no longer escalate to full control (tripwire test included).19411d8d— admission viaeffective()(expired ⇒ knock path, re-approval = re-grant), deadline task with T−5m/T−1m warnings and typed expiry close, one-relaxed-load classify-and-drop beforeoffer(), deny-at-setup (no uinput pad / pad-audio / mic attach / clip coordinator without the bit), launch refused pre-Welcome,CLIP_REASON_NOT_PERMITTED,access.granted/changed/expiredevents. Quiet drops: counters + first-drop-per-class only.6753641c— grants inNativeClient/PendingDevice(all optional — version-skewed consoles degrade), approve/arm with access,PATCH /native/clients/{fingerprint}, OpenAPI regen.ab8fa46b— one approve dialog (Full · Forever default + distinct "Approve as guest" secondary, two clicks total), arm-form access controls, Access column with a single shared countdown interval, edit dialog with partial PATCH; renders "—" against older hosts.b2e6debb— live grants on the connector (access_grants/access_deadline_unix/next_access_update/end_reject), capture funneled through the host's ownclassify(), chip + expiry toasts, typed end reasons.ee6dff11— new C ABI surface (punktfunk_connection_grants/_access_expires_in/_end_reject), class-gated send funnels, chip/countdown/toasts on macOS/iOS, tvOS stats-overlay line.1bed8242— JNI poll shim, GamepadRouter/pointer/IME/mic/clipboard gating, overlay pill + toasts.18f59569— owner-facing "Access levels" page + pairing-page section, honest about the limits (shared-desktop visibility, Moonlight ungoverned until a record exists, old clients get silent enforcement). Decky needs nothing.c32fad8a— launch/resume gated on LAUNCH + expiry besidepeer_is_paired, input classify-and-drop viaowner_fpon the control tick, expiry cuts the session through the normal TERMINATION path. Absent registry record = ungoverned full control (existing Moonlight pairings unchanged); an existing record governs like the native plane.97f81a6e— main's security sweep (#244) landedpunktfunk_connect_ex10as ABI v21, so this PR's access surface is v22 (ABI_VERSION21→22, header regenerated); the sweep's GameStream peer-identity gate and the grant-mask check compose in the receive path; the sweep's "state which knock you're approving" fix (device name + fingerprint) is carried into the access approve dialog that replaced the plain name prompt.Verified (pre-merge, per-WP): Linux (.25) full host suite 522 passed (sole failure = the box's known environmental hooks test) + clippy
-D warningsnon-vacuous; Windows (.133) host check+clippy (nvenc,amf-qsv) + client crates; Mac 405 core tests + fmt + header freshness + 5-slice xcframework + iOS/tvOS typechecks + 304 Swift tests; Android Kotlin compile/tests + 3-ABI cross-compile; web codegen/lint/storybook; docs build. Post-merge re-verification (Mac + web + Swift + .25 host suite) is running; results will land as a PR comment/commit if anything needs fixing.Still open (tracked in the plan's §7): the on-glass guest rehearsal (release gate for the console phase), the real-Moonlight run (.181/Deck), D1–D4 confirmation (implemented as the proposed defaults), mgmt upsert so console Moonlight rows become editable, Android typed-close polish, and the release-notes honesty blurb re old clients. WP14 (TLS handshake rejection) stays deferred by design.
The wire layer of design/per-client-access.md: quic/access.rs carries the GRANT_* bits (u32, reserved-must-be-zero), the three presets, and the exhaustive InputKind -> GrantClass classifier whose wildcard-free match is the default-deny mechanism — a new input kind now fails to compile until someone decides its grant class. AccessUpdate { grants, remaining_secs } rides the control stream as 0x58 (verified free; both peers' dispatch loops drop unknown ids with a warn, so old clients just miss the courtesy). reject.rs grows the 0x69/0x6A close codes -> RejectReason::{AccessExpired, LaunchNotPermitted}, mirrored into PunktfunkStatus -30/-31 and the shared client-facing sentences. The Welcome advertises grants + expires_in_secs as trailing fields one link past mgmt_port, with the same placeholder discipline: emitting the advert forces the cipher byte and the mgmt port so the two u32s land at a deterministic offset, while a full-control permanent session stays byte-identical to the pre-grants wire form. Absent fields decode to GRANT_ALL / permanent — exactly what an old host enforces. No WIRE_VERSION bump (trailing fields, per the v20 mgmt_port precedent), no ABI bump (no new C symbols; the header gains prefixed defines and two appended status values only). The host sends GRANT_ALL until WP2/WP3 wire the trust store in.ABI v21 (per-client access WP10): punktfunk_connection_grants and punktfunk_connection_access_expires_in read the session's LIVE access state (Welcome seed, latest-wins over every mid-session AccessUpdate), and punktfunk_connection_end_reject surfaces the typed rejection a mid-session close carried, so an access expiry renders its real sentence instead of the generic host-error one. NEW symbols only; the Rust-side live slots they read landed with the pf-client-core work. Swift: PunktfunkConnection wraps the three (grant bits, the derived AccessLevel labels, and class-gated send funnels — key/pointer/pad/pen/ mic events the grants exclude never leave the device); SessionModel polls at the 1 Hz stats tick for the chip ("Controller only · ends in 1 h 58 m"), the T−5 m / T−1 m warning toasts, mic + clipboard hiding, and the live release of an engaged capture on revoke; macOS gates engage + the cursor grab and the iPad gates pointer lock on the bits; tvOS states the level as a stats-overlay line instead of a chip. A full-and-permanent session — every old host — renders exactly today's UI.The Android leg of per-client-access.md §7 (WP11). The bridge grows one poll shim, nativeAccessState -> [grants, remainingSecs, updateSeq]: the connector already folds every AccessUpdate latest-wins into its live grants/deadline slots, so Kotlin polls the fold ~1 Hz alongside its session-ended watchdog instead of holding a blocking event thread; the seq counter is only how a fresh update (the host's T-5m/T-1m warnings) is told apart from state the poll would re-read anyway. The countdown is clamped to >= 1 once a deadline exists — 0 stays the permanent sentinel. Kotlin gates what can't land rather than capturing it: GamepadRouter's wire sends fold the GAMEPAD grant into the existing forwarding gate (slots and the exit/mic/stats chords stay alive — they are local controls that happen to sit on pad buttons, and the phone-gyro mirror stands down through the same sendsEnabled read); without POINTER the touch/stylus gesture layer is never installed, the mouse forwarder goes inert and never grabs the pointer, and the TV remote can't enter pointer mode; without KEYBOARD the VK path consumes without sending and the IME summon (gesture and remote toggle) declines; without MIC no capture opens — the recording indicator must not announce a mic nobody can hear — and a mid-session revocation stops a running one; without CLIPBOARD the sync never starts. StreamScreen carries the Access chip top-end in the shared pill family ("Controller only · 1 h 58 m left"), composed only when there is something to say — a full-control permanent session, which is every session against an old host, looks exactly like today. The expiry warnings surface as toasts, and a session that dies inside the final countdown is worded with the shared rejection sentence ("Your access to this host has expired") — recognized off the countdown because the generic end-reason byte predates the typed close. ConnectErrors learns the two new reject tokens (access-expired, launch-not-permitted). Verified: cargo clippy -D warnings + fmt (host target), gradle :kit:/:app:compileDebugKotlin, :kit:+:app: unit tests (new SessionAccessTest pins the bit mirror and the preset labels), and the release cargo-ndk cross-build of all three ABIs. The gradle cargoNdkClippy leg could not complete on this machine — the shared disk filled mid-run (environment, not code; the Rust delta is target-independent and is covered by the host clippy + the ABI builds).The connector now carries the session's LIVE access truth: the Welcome advert seeds NativeClient::access_grants / access_deadline_unix (client-anchored, so skew never moves the countdown), the control task folds every MSG_ACCESS_UPDATE in latest-wins before waking next_access_update, and a typed mid-session close latches as end_reject — an access expiry now ends as "your access to this host has expired", not "the host ended the session with an error". pf-client-core surfaces it as SessionEvent::Access { SessionAccess, notice } (module `access`: derived preset labels, chip text, toast wording — the rules the Apple/Android ports mirror), gates the mic uplink and clipboard bridge at spawn on their grants (deny-at-setup, client half), and follows a live MIC edit by stopping/starting the uplink without a reconnect. The presenter gates capture on the mask (§7 "not capture what can't land"): no pointer lock without POINTER, no keyboard grab without KEYBOARD, engage refuses outright when neither is granted (the hint pill stays down), every wire send funnels through the host's own classify(), and a live edit flushes what a removed class still held. The overlay wears the chip — "Controller only · ends in 1 h 58 m", top-right beside the mic badge, at every stats tier — and the T−5 m / T−1 m warnings ride the pill slot as toasts. Full-control permanent (every old host) renders exactly today's look.The management API is where grants become operable (WP6): the paired-client and pending-device payloads carry grants/expiry/grant-time plus a derived access_level preset name, the approve and arm requests take an optional access choice (expiry RELATIVE in the API, stored absolute), and a new PATCH /native/clients/{fingerprint} does partial access edits — omitted halves keep their current value, clear_expiry makes access permanent. Reserved grant bits are a 400, never silently cleared.