lumbridge-public/tera
Archived
1
0
Fork 0
Code Activity

fix: close California play and asset acceptance gaps

Browse Source
This commit is contained in:
Kartios
2026-08-11 22:49:37 -07:00
parent d4859b33c6
commit dd18c6775d
12 changed files with 267 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/STATIC.md
+5
View File
@@ -73,6 +73,11 @@ face and every office screen placeholder intact. The CSP needs no camera/media
host exception: webcam and display tracks are caller-owned `MediaStream`s, not
network media URLs, and signaling remains under same-origin `connect-src`.
The production policy may contain deployment-specific sources, but every one is
an operator-owned exception to this repository minimum. Audit and remove stale
font/CDN/identity origins; do not cargo-cult a broader live header back into this
template. A same-origin Tera build needs no Google Fonts or jsDelivr source.
## Serving the API too
Only needed for live weather, real ADS-B, or markers from an external source.
deploy/coturn/README.md
+14 -16
View File
@@ -9,13 +9,12 @@ symmetric NATs and restrictive networks; it relays encrypted WebRTC packets and
never receives application signaling, screen URLs or recordings. The signaling
service remains the separate loopback API described in `server/README.md`.
> **Mandatory public-enablement gate:** do not expose the TURN listeners or set
> `TERA_ICE_URLS` / `TERA_TURN_SHARED_SECRET` in production until the deployed
> ICE endpoint requires an active, unexpired screen-signaling grant for the exact
> office/screen binding and authenticates that grant to the same signed-in
> subject. The current endpoint checks only global member authentication, which
> would let any signed-in member mint a general-purpose Internet relay credential.
> It is intentionally not approved for broad public TURN enablement.
> **Mandatory public-enablement gate:** the repository endpoint now requires an
> active, unexpired screen-signaling grant for the exact office/screen binding
> and authenticates it to the same signed-in subject. Do not infer that the live
> deployment has this build or that coturn is ready: prove the deployed cases in
> §4, then approve DNS/firewall/certificate/quota changes before exposing TURN
> listeners or setting `TERA_ICE_URLS` / `TERA_TURN_SHARED_SECRET`.
The production host audited on 2026-08-11 has private VNIC `10.0.0.2`, public
IPv4 `170.9.14.61`, and an existing `turn.lumbridgecorp.com` A record. Reconfirm
@@ -108,15 +107,14 @@ process argument. Clear the shell variable after both files are installed:
unset TURN_SECRET
```
The current authenticated `POST /api/v1/media/ice` endpoint validates only the
signed-in caller and returns a five-minute username/password generated with
coturn's REST scheme. That is insufficient authorization for a public relay.
Before enabling the environment above, the deployed request must also carry an
active screen-signaling credential and exact binding in its POST body. The server
must validate its token hash, subject, role, binding, lease and revocation state,
then rate-limit issuance by both subject and trusted client IP. The presenter or
viewer must join signaling before requesting ICE configuration. GET/query-string
credentials remain forbidden.
The repository `POST /api/v1/media/ice` contract carries an active screen-
signaling credential and exact binding in its POST body. The server validates
its token hash, subject, role, binding, lease and revocation state, then rate-
limits issuance independently by subject and trusted client IP. Before enabling
the environment above, prove that this exact behavior is running on the deployed
API; a source-tree test is not evidence that the host was upgraded. The presenter
or viewer must join signaling before requesting ICE configuration. GET/query-
string credentials remain forbidden.
Coturn removes the expiry prefix from a REST username before applying
`user-quota`. The suffix therefore must be a stable, opaque, session-participant