From 4dbd83e1c38bb8c2e17884ba3fd5145251b3cc0f Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 12:28:21 +0000 Subject: api: a stream opened with a token ends with it A token was checked when a request came, and a stream answered to it (the dashboard's events, a subscription's links and messages, the store's streams) then went on for as long as the client kept it open: past the token's expiry, past its user's tokens being revoked, its user disabled or removed, its session ended. Now a middleware inside `login::bearer` (`login::streams_end`) ends a streaming answer (`text/event-stream`, `application/x-ndjson`) to a request with a token at the token's deadline, its expiry, or as soon as the document no longer takes it (`token::still_taken`, the checks `verify` makes of the document, now its own function): looked at when a change touches protocol data (the root, a switch, among it), and when a session ends on the node itself in a swarm without a registry (`AppState::session_ended`). No polling: a timer for the expiry, and the changes as they come. The client reconnects with the token it has then; a refreshed token is a new one, so a stream lasts a token's lifetime at most (12 hours by default). `futures` is a dependency of every build now (for `take_until`), not only of libp2p's and Tor's. --- Cargo.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'Cargo.toml') diff --git a/Cargo.toml b/Cargo.toml index e6cd6c6..920cbfe 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -13,7 +13,7 @@ dashboard = [] # supervises or one running elsewhere. mycelium = ["dep:reqwest", "dep:rustls", "dep:libc"] # The libp2p transport (`--libp2p-enable`). -libp2p = ["dep:libp2p", "dep:libp2p-stream", "dep:futures"] +libp2p = ["dep:libp2p", "dep:libp2p-stream"] # The Tor transport (`--tor-enable`): onion services, with arti. tor = [ "dep:arti-client", @@ -22,7 +22,6 @@ tor = [ "dep:tor-proto", "dep:tor-rtcompat", "dep:safelog", - "dep:futures", ] [dependencies] @@ -48,7 +47,8 @@ clap = "4.6" dashmap = "6.2" # Deflate (pure Rust), for large sync messages; Automerge uses it already. flate2 = "1.1" -futures = { version = "0.3", optional = true } +# Streams: an API stream ended with its token (`api::login::streams_end`), libp2p, tor. +futures = "0.3" libp2p = { version = "0.57", optional = true, features = ["tokio", "tcp", "quic", "dns", "noise", "yamux", "ed25519", "identify", "ping", "macros", "relay", "dcutr", "upnp", "autonat", "mdns", "kad"] } libp2p-stream = { version = "0.5.0-alpha", optional = true } ed25519-dalek = "3" -- cgit v1.3.1