fix(gateway): strip provider authority from client egress

2026-08-12 12:30:28 +07:00
parent 93246c14bf
commit 12ad2a4daa
4 changed files with 75 additions and 13 deletions
@@ -291,8 +291,11 @@ func (s *Server) handleConnection(parent context.Context, connection *quic.Conn)
 		_ = writeStableError(stream, "provider_state_unavailable", err, true)
 		return
 	}
-	authority.Capabilities = selected
-	authorityBytes, err := protocol.EncodeSessionAuthority(authority)
+	clientAuthority := protocol.ClientSessionAuthority{
+		Version: authority.Version, SessionID: authority.SessionID, GatewayID: authority.GatewayID, Audience: authority.Audience,
+		ReconnectSequence: authority.ReconnectSequence, ExpiresAt: authority.ExpiresAt, Capabilities: selected,
+	}
+	authorityBytes, err := protocol.EncodeClientSessionAuthority(clientAuthority)
 	if err != nil || writeWire(stream, authorityBytes, defaultHelloLimit) != nil {
 		_ = providerSession.ReleaseAll(context.Background())
 		_ = providerSession.Terminate(context.Background())
@@ -1010,7 +1013,7 @@ type Client struct {
 	controlReadMu  sync.Mutex
 	controlWriteMu sync.Mutex
 	pendingControl map[string][][]byte
-	Authority      protocol.SessionAuthority
+	Authority      protocol.ClientSessionAuthority
 }

 func Dial(ctx context.Context, address string, tlsConfig *tls.Config, request protocol.TunnelAdmissionRequest) (*Client, error) {
@@ -1045,7 +1048,7 @@ func Dial(ctx context.Context, address string, tlsConfig *tls.Config, request pr
 		_ = connection.CloseWithError(applicationError, "no authority")
 		return nil, err
 	}
-	authority, authorityErr := protocol.DecodeSessionAuthority(response)
+	authority, authorityErr := protocol.DecodeClientSessionAuthority(response)
 	if authorityErr != nil {
 		stable, stableErr := protocol.DecodeStableError(response)
 		if stableErr == nil {