lfg2025/archy
1
0
Fork 0
Code Issues 16 Pull Requests 2 Actions Packages Projects Releases 44 Wiki Activity

fix(mesh): honour explicit !ai allowlist for unauthenticated stock clients

Browse Source 
A stock meshcore client (e.g. a phone) can't sign our typed envelopes, so it is
never 'authenticated' — which meant ticking it as an allowed assistant contact
had no effect and !ai stayed denied. The explicit per-contact allowlist is a
deliberate operator opt-in for a specific key, so match it regardless of
authentication, keyed on the asker's resolved identity (bound archipelago key,
else firmware routing key — how meshcore addresses the contact). The spoofable
federation-trust-list match still requires authentication.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
archipelago 2026-06-19 16:42:06 -04:00
parent 7831e68d13
commit 63611a4453
1 changed files with 14 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
core/archipelago/src/mesh/listener/assist.rs
View File

@ -200,15 +200,20 @@ async fn is_sender_allowed(
} }
} }
// Explicit per-contact allowlist: a listed pubkey may ask regardless of the // Explicit per-contact allowlist: the operator deliberately ticked THIS
// trusted_only policy — but only when the message is authenticated, so a // contact, so honour it even for an unauthenticated radio asker. A stock
// spoofed packet claiming an allowlisted key can't slip through. // meshcore client (e.g. a phone) can't sign our typed envelopes, so it can
if authenticated { // never be `authenticated` — gating the allowlist on authentication made
if let Some(ref pk) = pubkey_hex { // ticking such a contact have no effect. We match the asker's resolved
let allowed = state.assistant.read().await.allowed_contacts.clone(); // identity key: the bound archipelago key if we know it, else the firmware
if allowed.iter().any(|a| a.eq_ignore_ascii_case(pk)) { // routing key (`pubkey_hex`), which is how meshcore addresses the contact
return true; // and what the UI adds to the allowlist for a keyless radio peer. This is a
} // narrow, explicit opt-in for a specific key — the spoofable federation-
// trust-list match below still requires authentication.
if let Some(ref pk) = pubkey_hex {
let allowed = state.assistant.read().await.allowed_contacts.clone();
if allowed.iter().any(|a| a.eq_ignore_ascii_case(pk)) {
return true;
} }
} }