Secure first-loop control-plane auth and mount routing.

Protect the control-plane API with explicit bearer auth, add node-scoped
registration/heartbeat credentials, and make export mount paths an explicit
contract field so mount profiles stay correct across runtimes.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
Harivansh Rathi 2026-04-01 14:13:14 +00:00
parent a7f85f4871
commit ed40da7326
23 changed files with 3676 additions and 124 deletions

View file

@ -6,6 +6,11 @@ export const FOUNDATION_API_ROUTES = {
issueCloudProfile: "/api/v1/cloud-profiles/issue",
} as const;
export const FOUNDATION_API_HEADERS = {
authorization: "Authorization",
nodeToken: "X-BetterNAS-Node-Token",
} as const;
export type NasNodeStatus = "online" | "offline" | "degraded";
export type StorageAccessProtocol = "webdav";
export type AccessMode = "mount" | "cloud";
@ -29,6 +34,7 @@ export interface StorageExport {
nasNodeId: string;
label: string;
path: string;
mountPath?: string;
protocols: StorageAccessProtocol[];
capacityBytes: number | null;
tags: string[];
@ -64,6 +70,7 @@ export interface CloudProfile {
export interface StorageExportInput {
label: string;
path: string;
mountPath?: string;
protocols: StorageAccessProtocol[];
capacityBytes: number | null;
tags: string[];