24 lines
1.2 KiB
Markdown
24 lines
1.2 KiB
Markdown
# Tasks — network-plugin-intra-relay-security
|
|
|
|
> Blocked on: `network-plugin-intra-relay` (core), `network-plugin-crypto-messages`.
|
|
|
|
## 1. Implementation
|
|
|
|
- [x] 1.1 Append three codes to `NETWORK_INTRA_RELAY_CODES`: `RELAY_SIGNATURE_INVALID`, `RELAY_PEER_UNTRUSTED`, `RELAY_RATE_LIMIT_EXCEEDED`.
|
|
- [x] 1.2 `src/security/relay-security-manager.ts` — `RelaySecurityManager`.
|
|
- [x] 1.3 Authenticate relay nodes using `PeerIdentityVerifier` from `@suaveplan/network-plugin-crypto-messages`.
|
|
- [x] 1.4 Validate relay-message signatures.
|
|
- [x] 1.5 Token-bucket rate limit per peer + global.
|
|
- [x] 1.6 `RelayAuthPolicy` + `RelayRateLimit` types in `src/types/security.types.ts`.
|
|
- [x] 1.7 Wire `IntraRelayPlugin.security` getter.
|
|
|
|
## 2. Tests
|
|
|
|
- [x] 2.1 `src/security/relay-security-manager.spec-conformance.test.ts` — auth, signature, rate limit, allowlist, signature-required toggle.
|
|
|
|
## 3. Verify
|
|
|
|
- [x] 3.1 `bunx turbo lint typecheck test --filter=@suaveplan/network-plugin-intra-relay` green.
|
|
- [x] 3.2 `bunx turbo test:coverage --filter=@suaveplan/network-plugin-intra-relay` 100/100/100/100.
|
|
- [x] 3.3 `bun scripts/openspec-conformance.ts @suaveplan/network-plugin-intra-relay` PASS.
|