Struct Device 

pub struct Device {
    pub id: String,
    pub label: Option<String>,
    pub joined_at: i64,
    pub redeemed_at: Option<i64>,
    pub last_seen: Option<i64>,
    pub peer: Option<String>,
}

One device this machine has issued a key to.

The roster, and only the roster: no key field. A device’s key is a secret and lives in the 0600 file beside the endpoint identity, not here — gglib config settings show prints proxy_api_key unmasked by design, and that output gets pasted into bug reports. One shared key there was a known cost; every device key there would quietly undo what per-device revocation is for.

id is what modelpipe is told, and it travels to the backend as X-Modelpipe-Device on every request that device makes, so it is generated from the CSPRNG rather than derived from the key: an identifier that falls out of a live credential is needless coupling at best. label is for a person to read and is sent nowhere, because modelpipe’s names are [A-Za-z0-9._-]{1,64} and “Matt’s iPhone” is not one.

Fields

id: String

The name the tunnel edge holds this device’s token under.

label: Option<String>

What a person calls it, when the device said so at join.

joined_at: i64

Unix milliseconds at which this device’s invite was minted.

Not when it redeemed one: the row and the key are written before the code is shown, so that a device cannot end up holding a key this side has no record of. An invite nobody redeems therefore leaves a row behind, which is why it is listed rather than swept on a timer.

redeemed_at: Option<i64>

Unix milliseconds at which a device redeemed this row’s invite, or None if none ever has.

The counterpart to joined_at, which is when the invite was minted: a row with a joined_at and no redeemed_at is an invite nobody took, and is listed as such rather than swept on a timer. Written by the roster’s writer rather than on the request path, so it is advisory in the same way a label is — which is why a row is only ever called never-joined when last_seen is empty too. A device that has made a request has plainly joined, whatever this says.

last_seen: Option<i64>

Unix milliseconds of the last request that arrived bearing this device’s token, or None if none has since the daemon started.

Advisory, like the tunnelled request counter: it is written from a background task rather than the request path, and a local process that forges the marker headers can move it. Nothing is granted on it — it exists so a person deciding what to forget can see which row is still in use.

peer: Option<String>

The fingerprint of the endpoint that redeemed this device’s invite, or None if none was recorded.

A record, not a check: nothing is refused on it. A device that does not keep its endpoint key presents a new fingerprint every time it connects, so this says which endpoint redeemed the invite, not where the key is used from. Written by the roster’s writer with redeemed_at, and advisory in the same way.

Trait Implementations

impl Clone for Device

fn clone(&self) -> Device

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Device

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Device

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Device

fn eq(&self, other: &Device) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Device

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for Device

impl StructuralPartialEq for Device