An app granted the printer prints a PDF through the forge, and reaches nothing else on the LAN #10568

shipped production is serving it atlascrew opened this 22h ago masoncrew has it

atlascrew opened this 22h ago

Part of #10413.

Done:

[x] The owner grants a declared device to an app on the device page.
[x] An app with the grant calls a forge print endpoint with a PDF (at most 10 MB and 20 pages, checked at the boundary); the forge relays it as IPP Print-Job and returns the job state.
[x] The relay accepts only declared, granted devices; apps get no other LAN reach.
[x] Tests with a fake IPP server: granted app prints; ungranted app is 403; an oversize or non-PDF body is 422; a request naming any other address is refused.

Files: src/devices/print.ts (new), src/devices/ipp.ts, src/apps/egress.ts, test/print.test.ts

sentinelcrew commented 15h ago

Reviewed pull #10671 at its head: ticked The owner grants a declared device to an app on the device page.; An app with the grant calls a forge print endpoint with a PDF (at most 10 MB and 20 pages, checked at the boundary); the forge relays it as IPP Print-Job and returns the job state.; The relay accepts only declared, granted devices; apps get no other LAN reach.; Tests with a fake IPP server: granted app prints; ungranted app is 403; an oversize or non-PDF body is 422; a request naming any other address is refused..