@@ -358,8 +358,9 @@ type ActivePoll = {pubkey: PubkeyHex, startedAt: Timestamp}
358358-- any mismatch means the server restarted and the client must reset its cursor.
359359*serverGeneration : Int
360360
361−-- Bearer secret accepted on /maintenance/* endpoints. Rotated via /maintenance/rotate-secret;
362−-- empty value disables maintenance entirely (every check returns false).
361+-- Bearer secret accepted on /maintenance/* endpoints. Set via the
362+-- `runtimeMaintenanceSecret` CLI flag at startup; empty value disables
363+-- maintenance entirely (every check returns false).
363364*runtimeMaintenanceSecret : Text
364365
365366-- Ed25519 federation keypair (hex). Generated on first startup if blank, then persisted.
@@ -420,13 +421,11 @@ route MaintenanceApi where
420421 POST {ip: Text} /maintenance/sessions/revoke-ip headers {authorization: Text} -> {ok: Bool, revokedCount: Int, affectedKeys: Int} = AdminRevokeIp
421422 POST {limit: Int} /maintenance/sessions/list headers {authorization: Text} -> {sessions: [{pubkey: PubkeyHex, count: Int, ips: [Text], latestExpiry: Timestamp}], ok: Bool, total: Int} = AdminListAllSessions
422423 GET /maintenance/rate-limits headers {authorization: Text} -> {ok: Bool, globalRequest: Int, ipRate: Int, sendRate: Int, federationRate: Int, authGlobal: Int, recvRate: Int, challengeRate: Int, pairRate: Int, lookupRate: Int} = GetRateLimits
423− POST {globalRequest: Int, ipRate: Int, sendRate: Int, federationRate: Int, authGlobal: Int, recvRate: Int, challengeRate: Int, pairRate: Int, lookupRate: Int} /maintenance/rate-limits headers {authorization: Text} -> {ok: Bool} = SetRateLimits
424424 POST /maintenance/nonces/flush headers {authorization: Text} -> {ok: Bool, flushedCount: Int} = FlushNonces
425425 POST {server: ServerName} /maintenance/allow headers {authorization: Text} -> {ok: Bool, allowed: Int} = AllowPeer
426426 POST {server: ServerName} /maintenance/unallow headers {authorization: Text} -> {ok: Bool, removed: Bool} = UnallowPeer
427427 GET /maintenance/allowed headers {authorization: Text} -> {peers: [Text], ok: Bool} = ListAllowed
428428 POST /maintenance/reconcile headers {authorization: Text} -> {ok: Bool, messageDrift: Int, presenceDrift: Int, sessionDrift: Int} = Reconcile
429− POST {newSecret: Text} /maintenance/rotate-secret headers {authorization: Text} -> {ok: Bool, error: Text} = RotateSecret
430429 GET /maintenance/config headers {authorization: Text} -> {ok: Bool, pollTimeoutMs: Int, ackGracePeriod: Int} = GetConfig
431430
432431route HealthApi where
@@ -1862,13 +1861,6 @@ handleGetRateLimits = \authorization -> do
18621861 lookupRate: v maxLookupRatePerKey
18631862 }
18641863
1865−-- POST /maintenance/rate-limits: stub. Rate ceilings are compile-time constants
1866−-- in this simplified server, so this just authorizes and returns ok=true.
1867−handleSetRateLimits : a -> b -> c -> d -> e -> f -> g -> h -> i -> Text -> IO {r *runtimeMaintenanceSecret} {ok: Bool}
1868−handleSetRateLimits = \globalRequest ipRate sendRate federationRate authGlobal recvRate challengeRate pairRate lookupRate authorization -> do
1869− authorized <- verifyMaintenanceAuth authorization
1870− yield {ok: authorized}
1871−
18721864-- POST /maintenance/nonces/flush: stub. Nonce caches were removed; the
18731865-- endpoint is preserved so older operator tooling keeps working.
18741866handleFlushNonces : Text -> IO {r *runtimeMaintenanceSecret} {flushedCount: Int, ok: Bool}
@@ -1876,17 +1868,6 @@ handleFlushNonces = \authorization -> do
18761868 authorized <- verifyMaintenanceAuth authorization
18771869 yield {ok: authorized, flushedCount: 0}
18781870
1879−-- POST /maintenance/rotate-secret: replace the maintenance Bearer secret.
1880−-- The old secret authenticates the rotation; subsequent calls must use the
1881−-- new value.
1882−handleRotateSecret : Text -> Text -> IO {rw *runtimeMaintenanceSecret} {error: Text, ok: Bool}
1883−handleRotateSecret = \newSecret authorization -> withMaintAuth authorization (yield {
1884− ok: False {},
1885− error: "unauthorized"
1886−}) (do
1887− atomic *runtimeMaintenanceSecret = newSecret
1888− yield {ok: True {}, error: ""})
1889−
18901871-- GET /maintenance/config: expose a small set of operationally-relevant
18911872-- compile-time constants (poll timeout, ack grace).
18921873handleGetConfig : Text -> IO {r *runtimeMaintenanceSecret} {ackGracePeriod: Int, ok: Bool, pollTimeoutMs: Int}
@@ -2259,13 +2240,11 @@ api = serve Api where
22592240 AdminPurgeMessages = \{pubkey, authorization} -> handleAdminPurgeMessages pubkey authorization
22602241 AdminRevokeIp = \{ip, authorization} -> handleAdminRevokeIp ip authorization
22612242 GetRateLimits = \{authorization} -> handleGetRateLimits authorization
2262− SetRateLimits = \{globalRequest, ipRate, sendRate, federationRate, authGlobal, recvRate, challengeRate, pairRate, lookupRate, authorization} -> handleSetRateLimits globalRequest ipRate sendRate federationRate authGlobal recvRate challengeRate pairRate lookupRate authorization
22632243 FlushNonces = \{authorization} -> handleFlushNonces authorization
22642244 AllowPeer = \{server, authorization} -> handleAllowPeer server authorization
22652245 UnallowPeer = \{server, authorization} -> handleUnallowPeer server authorization
22662246 ListAllowed = \{authorization} -> handleListAllowed authorization
22672247 Reconcile = \{authorization} -> handleReconcile authorization
2268− RotateSecret = \{newSecret, authorization} -> handleRotateSecret newSecret authorization
22692248 GetConfig = \{authorization} -> handleGetConfig authorization
22702249 Health = \{authorization} -> handleHealth authorization
22712250 Stats = \{authorization} -> handleStats authorization