Peer relationship management: edit allow-lists without re-registering + per-peer disable (feeds #150) #176

Closed
opened 2026-08-10 00:49:45 +00:00 by Cordy · 3 comments
Owner

Two dogfood notes (Nikola), both about managing an existing peering:

  1. Allow-lists are immutable after registration. Adding or removing users/groups — send or receive side — currently requires deleting and re-registering the peer, which also means re-exchanging nothing but feels destructive and loses the mental model of a standing relationship. Needed: PATCH /api/v1/admin/peering/peers/{name} updating the four lists (sendUsers, sendGroups, recvUsers, recvGroups) in place, key and URL untouched, plus the UI edit affordance.
  2. Per-peer disable. The runtime switch today is global (peeringEnabled). Wanted: pause a single peer without deleting its configuration — an enabled flag on the peer entry, enforced on both planes (inbound auth check and outbound send eligibility), so one misbehaving or paused relationship doesn't force a choice between "all peering off" and "delete the trust".

Both land naturally in the #150 panel redesign (one relationship card per peer — the card gets an edit mode and an on/off toggle). Backend first: registry mutations + gRPC/send-path enforcement + tests; the card UI consumes them. Fail-closed semantics as everywhere in peering: a disabled peer answers exactly like an unknown one on the wire.

Two dogfood notes (Nikola), both about managing an existing peering: 1. **Allow-lists are immutable after registration.** Adding or removing users/groups — send *or* receive side — currently requires deleting and re-registering the peer, which also means re-exchanging nothing but *feels* destructive and loses the mental model of a standing relationship. Needed: `PATCH /api/v1/admin/peering/peers/{name}` updating the four lists (sendUsers, sendGroups, recvUsers, recvGroups) in place, key and URL untouched, plus the UI edit affordance. 2. **Per-peer disable.** The runtime switch today is global (`peeringEnabled`). Wanted: pause a single peer without deleting its configuration — an `enabled` flag on the peer entry, enforced on both planes (inbound auth check and outbound send eligibility), so one misbehaving or paused relationship doesn't force a choice between "all peering off" and "delete the trust". Both land naturally in the **#150 panel redesign** (one relationship card per peer — the card gets an edit mode and an on/off toggle). Backend first: registry mutations + gRPC/send-path enforcement + tests; the card UI consumes them. Fail-closed semantics as everywhere in peering: a disabled peer answers exactly like an unknown one on the wire.
Author
Owner

Triage: build-solo, verify-tandem. Edit a peer's sender allow-list without re-registering + per-peer disable (the runtime data behind #150's card). Buildable solo (peer registry already persists allow-lists); testing the actual gating needs a live peer. Do alongside #150.

**Triage: build-solo, verify-tandem.** Edit a peer's sender allow-list without re-registering + per-peer disable (the runtime data behind #150's card). Buildable solo (peer registry already persists allow-lists); testing the actual gating needs a live peer. Do alongside #150.
Author
Owner

Greenlit — build first (backend enabler for #150 + #125 discovery).

Confirmed as-specified:

  • PATCH /api/v1/admin/peering/peers/{name} updating the four lists (sendUsers, sendGroups, recvUsers, recvGroups) in place; key and URL untouched. Registry mutation method + tests.
  • Per-peer enabled flag, enforced fail-closed on both planes: a disabled peer answers inbound (Hello / PrepareTransfer / the new ListRecipients) exactly like an unknown one, and is ineligible outbound (CanSend → false). gRPC + send-path enforcement + tests.

Fail-closed semantics match the rest of peering. This lands before #150 (the card consumes both) and before the #125 discovery RPC (which must also honour the enabled flag).

**Greenlit — build first (backend enabler for #150 + #125 discovery).** Confirmed as-specified: - `PATCH /api/v1/admin/peering/peers/{name}` updating the four lists (`sendUsers`, `sendGroups`, `recvUsers`, `recvGroups`) in place; key and URL untouched. Registry mutation method + tests. - Per-peer `enabled` flag, enforced **fail-closed on both planes**: a disabled peer answers inbound (`Hello` / `PrepareTransfer` / the new `ListRecipients`) exactly like an unknown one, and is ineligible outbound (`CanSend` → false). gRPC + send-path enforcement + tests. Fail-closed semantics match the rest of peering. This lands before #150 (the card consumes both) and before the #125 discovery RPC (which must also honour the `enabled` flag).
Author
Owner

Both asks shipped in the v0.6.20/v0.6.21 peering panel v2 (#150) and verified live while completing #244:

  1. Edit allow-lists in place — the relationship card edits sendUsers/sendGroups/recvUsers/recvGroups (and now recvSpaces) via PATCH /api/v1/admin/peering/peers/{name}, key and URL untouched, no delete-and-re-register.
  2. Per-peer disable — each card has an enable/disable toggle backed by an enabled flag on the peer entry, enforced fail-closed on both planes (inbound auth via Registry.IsDisabled; outbound send eligibility + CanReceive/CanReceiveSpace honor Disabled). A disabled peer answers exactly like an unknown one on the wire.

Closing as done.

Both asks shipped in the v0.6.20/v0.6.21 peering panel v2 (#150) and verified live while completing #244: 1. **Edit allow-lists in place** — the relationship card edits sendUsers/sendGroups/recvUsers/recvGroups (and now recvSpaces) via `PATCH /api/v1/admin/peering/peers/{name}`, key and URL untouched, no delete-and-re-register. 2. **Per-peer disable** — each card has an enable/disable toggle backed by an `enabled` flag on the peer entry, enforced fail-closed on both planes (inbound auth via `Registry.IsDisabled`; outbound send eligibility + `CanReceive`/`CanReceiveSpace` honor `Disabled`). A disabled peer answers exactly like an unknown one on the wire. Closing as done.
Cordy closed this issue 2026-08-16 12:07:29 +00:00
Sign in to join this conversation.
No labels
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#176
No description provided.