let5see/clawdbot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: tighten tls fingerprints and approval events

Browse Source
This commit is contained in:
Peter Steinberger
2026-01-20 12:44:04 +00:00
parent ded578b1fa
commit 759068304e
6 changed files with 103 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/gateway/server-broadcast.ts
View File

@@ -2,6 +2,29 @@ import type { GatewayWsClient } from "./server/ws-types.js";
import { MAX_BUFFERED_BYTES } from "./server-constants.js";
import { logWs, summarizeAgentEventForWsLog } from "./ws-log.js";
const ADMIN_SCOPE = "operator.admin";
const APPROVALS_SCOPE = "operator.approvals";
const PAIRING_SCOPE = "operator.pairing";
const EVENT_SCOPE_GUARDS: Record<string, string[]> = {
"exec.approval.requested": [APPROVALS_SCOPE],
"exec.approval.resolved": [APPROVALS_SCOPE],
"device.pair.requested": [PAIRING_SCOPE],
"device.pair.resolved": [PAIRING_SCOPE],
"node.pair.requested": [PAIRING_SCOPE],
"node.pair.resolved": [PAIRING_SCOPE],
};
function hasEventScope(client: GatewayWsClient, event: string): boolean {
const required = EVENT_SCOPE_GUARDS[event];
if (!required) return true;
const role = client.connect.role ?? "operator";
if (role !== "operator") return false;
const scopes = Array.isArray(client.connect.scopes) ? client.connect.scopes : [];
if (scopes.includes(ADMIN_SCOPE)) return true;
return required.some((scope) => scopes.includes(scope));
}
export function createGatewayBroadcaster(params: { clients: Set<GatewayWsClient> }) {
let seq = 0;
const broadcast = (
@@ -33,6 +56,7 @@ export function createGatewayBroadcaster(params: { clients: Set<GatewayWsClient>
}
logWs("out", "event", logMeta);
for (const c of params.clients) {
if (!hasEventScope(c, event)) continue;
const slow = c.socket.bufferedAmount > MAX_BUFFERED_BYTES;
if (slow && opts?.dropIfSlow) continue;
if (slow) {