Security

OPPA is a privileged local bridge with a deliberately narrow protocol surface.

Authentication

• OPPA accepts one validated server base URL; production discovery and pairing require HTTPS.
• Pairing codes are random, short-lived, single-use, body-only, and should be rate-limited.
• OPPA generates the Ed25519 key pair locally and stores the private key through the operating system.
• The server stores only the public JWK and revocation metadata.
• Gateway challenges are unpredictable, domain-separated, socket-bound, single-use, and expiring.
• Authentication, handshake, network, printer, and lifecycle operations have explicit timeouts.
• Normal frames are not individually signed; WSS protects the authenticated session.

If discovery returns a different stable server ID for a paired URL, OPPA refuses automatic connection. Changing or forgetting a service deletes the local key and requires pairing again.

Command boundary

OpenPrinter permits only documented message types. It has no arbitrary shell, script, filesystem, SQL, plugin execution, remote desktop, or generic proxy command. Remote printer IDs are validated against the enabled local registry.

Limits and diagnostics

Messages, documents, images, queues, printer inventories, callbacks, and diagnostic histories are bounded. Errors are sanitized. Diagnostics exclude private keys, pairing codes, signatures, complete challenges, and full print documents by default.

Server responsibilities

Production hosts must use durable pairing/public credential stores, authorize code creation, rate-limit attempts, revoke credentials when access ends, retain jobs durably, and implement connection affinity appropriate to their deployment.