The first server-side part of docs/spec/features/relay.md ("Registry
objects", "Joining and reset"):
- inbuxa:Relay/get and /set under urn:inbuxa:jmap, kept in the fork's
subspace under E (crates/features/src/relay). A relay has its name,
the address and link port the downstream dials, enabled, sendThrough,
inboundOnly, and the settings pushed to it, which reuse the link's own
RelaySettings and are checked the way the relay would check them.
Settings change one at a time as settings/<name>; null puts one back
to its default; an unknown name is refused.
- A create returns the join token once. The first relay makes the
downstream's keys, shared by every node: a P-256 link CA, whose key
pin goes in every token, and the X25519 key held mail is sealed to.
Each relay gets its own recipient key. An update with rejoin: true
issues a new token for a relay that was reset, and forgets its pinned
key and recipient key (the spec gains this paragraph).
- smtpCertificate and smtpPrivateKey: the key reads back as ****, and
**** written back keeps it. The audit log redacts any property ending
in privateKey, and records a relay's before-values without its keys.
- Updates are compare-and-set on the stored bytes, retried, so a node
recording a join and an administrator's edit can't overwrite each
other.
- Four permissions, ids 690-693 (enum and schema labels):
sysRelayGet/Update and sysRelayQueueGet/QueueUpdate. Administrators
get all four, granted once to existing administrator roles; nobody in
a tenant gets any, and a tenant is refused.
- Privacy catalog entry for inbuxa:Relay.
tests/src/system/relay.rs: tokens decode with one CA pin for every
relay, validation, server-set properties refused, single settings and
defaults, the masked key kept, the stale write refused, rejoin, a tenant
administrator refused, destroy, and an audit log without the key or a
token.
jcoffey-dev