Unclear documentation of --private usage

[brailateo]

Tried to use a --private hypertele proxy connection, there is no hints of how this should be properly used.
I tried a server-client connection without --private and everything was ok, then

• I have generated a keypair file (identity) for the client
• added the public key of the client in config-server.json at "allowed" list
• started client with -i identity file
• started server with --private option

but the connection is not working!
It's bad when a good software is not well documented! :-(
Teo

[HDegroote]

The --private flag uses a different approach. In particular, the 'allowed' list is incompatible with --private mode in the server, and the -i option is incompatible with the --private option for the client.

Can you post the exact commands you were using to start the client and server (with dummy seeds/keys if your commands include any)?

The client should error when both the -i and --private flag are set, here:

hypertele/client.js

Lines 45 to 46 in ab9d258

	if (conf.private) {
	if (keyPair != null) throw new Error('The --private flag is not compatible with the -i(dentity) flag, since the identity is derived from the peer key')

The server should error when both the --private and --allow flag are set, here:

hypertele/server.js

Lines 58 to 59 in ab9d258

	if (argv.private) {
	if (conf.allow) throw new Error('--private flag is not compatible with an allow list, as the private key derived from the seed is the capability')

So if it's not erroring, that's a bug.

Fwiw, for an example usage with --private

hypertele-server --private -l 8080 --seed <a-secret-seed>
hypertele --private -p 18080 -s <a-secret-seed>

Both the client and server use the same secret seed, and derive their private/public key pair from it, so they use the same key pair. The server then creates an allowedList which only allows that public key.