bastion 0.55.3

client-go/pairing_ops.go

@@ -114,6 +114,14 @@ func handlePairingGrantSync(ws *websocket.Conn, _ string, args []string) {
 		pairingRefuse(ws, "grant_sync", t.Subject, "subject pairing was revoked — pair it again to re-approve")
 		return
 	}
+	// Approving would mark it active and start it with the endpoint its file
+	// holds, which this build refuses. The reason names a local file, so the
+	// host is told only what to do.
+	if c.invalid != "" {
+		anchorMu.Unlock()
+		pairingRefuse(ws, "grant_sync", t.Subject, "subject pairing is not served on this box: its file holds an endpoint this bastion refuses — pair it again to approve it")
+		return
+	}
 	if a := currentAnchor(); a != nil && a.AnchorHost == c.HostName {
 		anchorMu.Unlock()
 		pairingRefuse(ws, "grant_sync", t.Subject, "subject is the anchor itself; the anchor holds no grant")
@@ -143,6 +151,10 @@ func handlePairingGrantSync(ws *websocket.Conn, _ string, args []string) {
 	started := false
 	if wasPending {
 		started = supervisorStart(c)
+		// Every Host on this box reads this pairing's state from a beat, so
+		// each beats now rather than up to a minute from now (beatnow.go). A
+		// re-sync of an active pairing changes no state, so it beats nothing.
+		kickBeats()
 	}
 	pairingResult(ws, "grant_sync", c.HostName, map[string]any{
 		"state": "ok", "subject": c.HostName, "caps": sortedCaps(t.Caps),
@@ -209,6 +221,9 @@ func handlePairingGrantDrop(ws *websocket.Conn, _ string, args []string) {
 	}
 	anchorMu.Unlock()
 	stopped := stopPairing(subject)
+	// Every other Host on this box learns of the revoke on its next beat, which
+	// is now rather than up to a minute from now (beatnow.go).
+	kickBeats()
 	// A revoked pairing keeps no folder the person shared with it.
 	sharesDropped := dropSharesOf(subject) == nil
 	pairingResult(ws, "grant_drop", subject, map[string]any{