iroh/auth hygiene: expiry-scheduled token refresh; visible + recoverable relay policy outage

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxConnectivityEngine.swift

@@ -26,6 +26,9 @@ public actor CmxConnectivityEngine {
     private let installRouteSnapshot: RouteSnapshotInstaller?
     private let diagnosticLog: DiagnosticLog?
     private let clock: any CmxIrohRelayClock
+    /// Deadline for each dial phase (public paths, private fallback, and the
+    /// admission barrier) of every peer session this engine creates.
+    private let dialPhaseTimeout: Duration
     private var desiredActive = false
     private var lifecycleRevision: UInt64 = 0
     private var endpointGeneration: UInt64?
@@ -59,7 +62,8 @@ public actor CmxConnectivityEngine {
         authority: (any CmxConnectivityAuthorityServing)? = nil,
         installRouteSnapshot: RouteSnapshotInstaller? = nil,
         diagnosticLog: DiagnosticLog? = nil,
-        clock: any CmxIrohRelayClock = CmxIrohSystemRelayClock()
+        clock: any CmxIrohRelayClock = CmxIrohSystemRelayClock(),
+        dialPhaseTimeout: Duration = .seconds(5)
     ) {
         precondition((authority == nil) == (installRouteSnapshot == nil))
         supervisor = CmxIrohEndpointSupervisor(
@@ -72,6 +76,7 @@ public actor CmxConnectivityEngine {
         self.installRouteSnapshot = installRouteSnapshot
         self.diagnosticLog = diagnosticLog
         self.clock = clock
+        self.dialPhaseTimeout = dialPhaseTimeout
     }
 
     /// Creates a stopped endpoint-only engine for a host acceptor.
@@ -90,6 +95,7 @@ public actor CmxConnectivityEngine {
         installRouteSnapshot = nil
         diagnosticLog = nil
         clock = CmxIrohSystemRelayClock()
+        dialPhaseTimeout = .seconds(5)
     }
 
     init(
@@ -99,7 +105,8 @@ public actor CmxConnectivityEngine {
         authority: (any CmxConnectivityAuthorityServing)? = nil,
         installRouteSnapshot: RouteSnapshotInstaller? = nil,
         diagnosticLog: DiagnosticLog? = nil,
-        clock: any CmxIrohRelayClock = CmxIrohSystemRelayClock()
+        clock: any CmxIrohRelayClock = CmxIrohSystemRelayClock(),
+        dialPhaseTimeout: Duration = .seconds(5)
     ) {
         precondition((authority == nil) == (installRouteSnapshot == nil))
         self.supervisor = supervisor
@@ -109,6 +116,7 @@ public actor CmxConnectivityEngine {
         self.installRouteSnapshot = installRouteSnapshot
         self.diagnosticLog = diagnosticLog
         self.clock = clock
+        self.dialPhaseTimeout = dialPhaseTimeout
     }
 
     /// Returns the current immutable UI-safe state.
@@ -306,6 +314,11 @@ public actor CmxConnectivityEngine {
         await supervisor.hasConfiguredRelay()
     }
 
+    /// Returns whether the active endpoint generation reports a usable home relay.
+    public func hasUsableHomeRelay() async -> Bool {
+        await supervisor.hasUsableHomeRelay()
+    }
+
     /// Waits for the active endpoint generation to report relay readiness.
     public func waitForUsableHomeRelay(
         timeout: Duration = .seconds(15)
@@ -332,17 +345,6 @@ public actor CmxConnectivityEngine {
         )
     }
 
-    /// Replaces active managed relay credentials without changing identity.
-    public func replaceRelays(
-        _ relays: [CmxIrohRelayConfiguration],
-        expectedIdentity: CmxIrohPeerIdentity
-    ) async throws {
-        try await supervisor.replaceRelays(
-            relays,
-            expectedIdentity: expectedIdentity
-        )
-    }
-
     /// Returns the selected live path after removing raw coordinates.
     public func selectedTransportPath(
         relayPolicy: CmxIrohEffectiveRelayPolicy?
@@ -533,6 +535,7 @@ public actor CmxConnectivityEngine {
         let protocolConfiguration = protocolConfiguration
         let diagnosticLog = diagnosticLog
         let clock = clock
+        let dialPhaseTimeout = dialPhaseTimeout
         let peer = CmxConnectivityPeerSession(
             peerID: peerID,
             buildSession: { request in
@@ -551,6 +554,7 @@ public actor CmxConnectivityEngine {
                             basedOn: context
                         )
                     },
+                    dialPhaseTimeout: dialPhaseTimeout,
                     protocolConfiguration: protocolConfiguration,
                     diagnostics: diagnosticLog
                 )
@@ -914,5 +918,3 @@ public actor CmxConnectivityEngine {
         return lhs.deviceID < rhs.deviceID
     }
 }
-
-extension CmxConnectivityEngine: CmxIrohRelayEndpointControlling {}

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohBackpressuredBroker.swift

@@ -74,18 +74,6 @@ public struct CmxIrohBackpressuredClientBroker:
         }
     }
 
-    public func issueRelayToken(
-        bindingID: String,
-        endpointID: CmxIrohPeerIdentity
-    ) async throws -> CmxIrohRelayTokenResponse {
-        try await gate.perform(accountID: accountID, operation: .relayCredential) {
-            try await broker.issueRelayToken(
-                bindingID: bindingID,
-                endpointID: endpointID
-            )
-        }
-    }
-
     public func revoke(bindingID: String) async throws {
         try await gate.perform(accountID: accountID, operation: .revocation) {
             try await broker.revoke(bindingID: bindingID)
@@ -167,18 +155,6 @@ public struct CmxIrohBackpressuredHostBroker:
         }
     }
 
-    public func issueRelayToken(
-        bindingID: String,
-        endpointID: CmxIrohPeerIdentity
-    ) async throws -> CmxIrohRelayTokenResponse {
-        try await gate.perform(accountID: accountID, operation: .relayCredential) {
-            try await broker.issueRelayToken(
-                bindingID: bindingID,
-                endpointID: endpointID
-            )
-        }
-    }
-
     public func revoke(bindingID: String) async throws {
         try await gate.perform(accountID: accountID, operation: .revocation) {
             try await broker.revoke(bindingID: bindingID)
@@ -209,11 +185,10 @@ public struct CmxIrohBackpressuredRelayPolicyBroker: CmxIrohRelayPolicyServing,
         self.accountID = accountID
     }
 
-    public func issueRelayBootstrap(
-        endpointID: CmxIrohPeerIdentity
-    ) async throws -> CmxIrohRelayBootstrapResponse {
+    /// Fetches the signed relay policy through the shared account gate.
+    public func fetchRelayPolicy() async throws -> CmxIrohRelayPolicyResponse {
         try await gate.perform(accountID: accountID, operation: .relayCredential) {
-            try await broker.issueRelayBootstrap(endpointID: endpointID)
+            try await broker.fetchRelayPolicy()
         }
     }
 

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohBrokerCredentialRepository.swift

@@ -1,7 +1,9 @@
 import CryptoKit
 public import Foundation
 
-/// Persists one active account's broker binding and relay capability.
+/// Persists one active account's broker binding. The Keychain-backed secure
+/// store survives only to delete legacy relay-credential records; no relay
+/// credentials exist any more (relay admission is the relay's allow hook).
 public actor CmxIrohBrokerCredentialRepository {
     private static let activeScopeKey = "cmux.iroh.broker-credentials.scope.v1"
     private static let bindingKey = "cmux.iroh.broker-credentials.binding.v1"
@@ -53,7 +55,8 @@ public actor CmxIrohBrokerCredentialRepository {
         )
     }
 
-    /// Saves an exact broker binding, invalidating relay credentials if it changed.
+    /// Saves an exact broker binding, deleting any legacy token-era secure
+    /// record if the binding changed.
     ///
     /// - Parameters:
     ///   - binding: The binding tuple returned by registration or discovery.
@@ -82,123 +85,6 @@ public actor CmxIrohBrokerCredentialRepository {
         installState.set(String(decoding: encoded, as: UTF8.self), forKey: Self.bindingKey)
     }
 
-    /// Loads a fresh relay credential for one exact binding and managed fleet.
-    ///
-    /// Stale, corrupt, wrong-binding, and wrong-fleet capabilities are deleted
-    /// and returned as a cache miss.
-    ///
-    /// - Parameters:
-    ///   - accountID: The authenticated account identifier.
-    ///   - binding: The exact active binding tuple.
-    ///   - expectedRelayFleet: The complete configured managed relay fleet.
-    ///   - now: The validation time.
-    /// - Returns: A validated relay credential, or `nil` when a new mint is required.
-    /// - Throws: A scope-validation or secure-storage error.
-    public func loadRelayCredential(
-        accountID: String,
-        binding: CmxIrohBrokerBindingMetadata,
-        expectedRelayFleet: Set<String>,
-        now: Date
-    ) async throws -> CmxIrohRelayTokenResponse? {
-        let epoch = try beginOperation()
-        let scope = try await prepareScope(
-            accountID: accountID,
-            appInstanceID: binding.appInstanceID,
-            epoch: epoch
-        )
-        guard try await loadBinding(
-            scope: scope,
-            appInstanceID: binding.appInstanceID,
-            epoch: epoch
-        ) == binding else {
-            try await deleteSecureRecord(account: scope, epoch: epoch)
-            return nil
-        }
-        guard let data = try await readSecureRecord(account: scope, epoch: epoch),
-              let stored = try? JSONDecoder().decode(
-                  CmxIrohStoredRelayCredential.self,
-                  from: data
-              ),
-              stored.version == CmxIrohStoredRelayCredential.currentVersion,
-              stored.binding == binding,
-              hasExactFleet(stored.response.relayFleet, expected: expectedRelayFleet),
-              (try? stored.response.relayConfigurations(now: now))?.count
-                  == expectedRelayFleet.count else {
-            try await deleteSecureRecord(account: scope, epoch: epoch)
-            return nil
-        }
-        try requireCurrent(epoch)
-        return stored.response
-    }
-
-    /// Saves a fresh relay credential for one exact binding and managed fleet.
-    ///
-    /// - Parameters:
-    ///   - response: The relay token response returned by the trust broker.
-    ///   - accountID: The authenticated account identifier.
-    ///   - binding: The exact active binding tuple.
-    ///   - expectedRelayFleet: The complete configured managed relay fleet.
-    ///   - now: The validation time.
-    /// - Throws: A validation, encoding, or secure-storage error.
-    public func saveRelayCredential(
-        _ response: CmxIrohRelayTokenResponse,
-        accountID: String,
-        binding: CmxIrohBrokerBindingMetadata,
-        expectedRelayFleet: Set<String>,
-        now: Date
-    ) async throws {
-        let epoch = try beginOperation()
-        let scope = try await prepareScope(
-            accountID: accountID,
-            appInstanceID: binding.appInstanceID,
-            epoch: epoch
-        )
-        guard let storedBinding = try await loadBinding(
-            scope: scope,
-            appInstanceID: binding.appInstanceID,
-            epoch: epoch
-        ) else {
-            throw CmxIrohBrokerCredentialRepositoryError.bindingNotStored
-        }
-        guard storedBinding == binding else {
-            try await deleteSecureRecord(account: scope, epoch: epoch)
-            throw CmxIrohBrokerCredentialRepositoryError.bindingMismatch
-        }
-        guard hasExactFleet(response.relayFleet, expected: expectedRelayFleet) else {
-            throw CmxIrohBrokerCredentialRepositoryError.relayFleetMismatch
-        }
-        guard (try? response.relayConfigurations(now: now))?.count
-            == expectedRelayFleet.count else {
-            throw CmxIrohBrokerCredentialRepositoryError.invalidRelayCredential
-        }
-        let record = CmxIrohStoredRelayCredential(binding: binding, response: response)
-        try await writeSecureRecord(
-            JSONEncoder().encode(record),
-            account: scope,
-            accessibility: .afterFirstUnlockThisDeviceOnly,
-            epoch: epoch
-        )
-    }
-
-    /// Removes a relay credential while preserving its broker binding.
-    ///
-    /// - Parameters:
-    ///   - accountID: The authenticated account identifier.
-    ///   - appInstanceID: The installation's lowercase app-instance UUID.
-    /// - Throws: A scope-validation or secure-storage error.
-    public func deleteRelayCredential(
-        accountID: String,
-        appInstanceID: String
-    ) async throws {
-        let epoch = try beginOperation()
-        let scope = try await prepareScope(
-            accountID: accountID,
-            appInstanceID: appInstanceID,
-            epoch: epoch
-        )
-        try await deleteSecureRecord(account: scope, epoch: epoch)
-    }
-
     /// Removes a broker binding and every capability scoped to it.
     ///
     /// - Parameters:
@@ -347,12 +233,6 @@ public actor CmxIrohBrokerCredentialRepository {
         }
     }
 
-    private func hasExactFleet(_ fleet: [String], expected: Set<String>) -> Bool {
-        (1 ... CmxIrohRelayPolicyVerifier.maximumRelayCount).contains(expected.count)
-            && fleet.count == expected.count
-            && Set(fleet) == expected
-    }
-
     private static func scope(accountID: String, appInstanceID: String) -> String {
         let transcript = Data(
             "cmux/iroh/broker-credential-scope/v1\0\(accountID)\0\(appInstanceID)".utf8

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohBrokerModels.swift

@@ -352,9 +352,9 @@ public struct CmxIrohRegistrationResponse: Decodable, Equatable, Sendable {
     }
 }
 
-/// Result of the registration route's best-effort initial relay mint.
+/// Wire-compatibility status field of the registration response. Clients hold
+/// no relay credentials; relay admission is the relay's server-side allow hook.
 public enum CmxIrohRegistrationRelay: Decodable, Equatable, Sendable {
-    case issued(CmxIrohRelayTokenResponse)
     case unavailable
     case notRequested
 
@@ -364,9 +364,7 @@ public enum CmxIrohRegistrationRelay: Decodable, Equatable, Sendable {
         let status = try decoder.container(keyedBy: CodingKeys.self)
             .decode(String.self, forKey: .status)
         switch status {
-        case "issued":
-            self = try .issued(CmxIrohRelayTokenResponse(from: decoder))
-        case "unavailable":
+        case "unavailable", "issued":
             self = .unavailable
         case "not_requested":
             self = .notRequested

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohClientBrokerServing.swift

@@ -1,6 +1,6 @@
 /// Trust-broker operations required by an iOS Iroh client runtime.
 public protocol CmxIrohClientBrokerServing: CmxIrohRegistryServing,
-    CmxIrohRelayTokenServing, CmxIrohBindingRevoking
+    CmxIrohBindingRevoking
 {
     /// Checks a caller-owned broker floor without performing network work.
     func preflight(operation: CmxIrohBrokerOperation) async throws