huskies: merge 480_story_cryptographic_node_auth_for_distributed_mesh

server/src/crdt_state.rs

@@ -600,6 +600,19 @@ pub fn our_node_id() -> Option<String> {
     Some(hex::encode(&state.crdt.id))
 }
 
+/// Sign a byte slice with this node's Ed25519 private key.
+///
+/// Used by the CRDT sync auth handshake: when a remote peer sends a
+/// challenge nonce, this node signs it to prove possession of the
+/// private key corresponding to its public node ID.
+/// Returns `None` before `init()`.
+pub fn sign_bytes(message: &[u8]) -> Option<Vec<u8>> {
+    use bft_json_crdt::keypair::sign;
+    let state = CRDT_STATE.get()?.lock().ok()?;
+    let sig = sign(&state.keypair, message);
+    Some(sig.as_ref().to_vec())
+}
+
 /// Write a claim on a pipeline item via CRDT.
 ///
 /// Sets `claimed_by` to this node's ID and `claimed_at` to the current time.