PeerAllowPush: consent to exchange pushes, for a while, and nothing else

PeerTrust syncs a peer's pins and serves it everything - too much to
grant a stranger. An app that wants two peers sharing something (two
phones at the same place) to hand each other new content allows pushes
for ttl_secs (at most a day): both sides may push, the receiver pins,
and the allowance lapses on its own. Asking again extends it;
PeerUntrust ends it. varde-ctl peer allow-push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

varde-proto/src/lib.rs

@@ -20,6 +20,9 @@ use serde::{Deserialize, Serialize};
 /// Bumped on incompatible changes; reported in [`GlobalStatus`].
 pub const PROTOCOL_VERSION: u32 = 2;
 
+/// The longest a [`Request::PeerAllowPush`] allowance may last: a day.
+pub const MAX_PUSH_TTL_SECS: u64 = 24 * 60 * 60;
+
 /// The most bytes a [`Request::Put`] or a [`Request::Read`] reply carries
 /// inline. Larger content goes through `Add`/`Materialize` and a path.
 pub const MAX_INLINE_BYTES: u64 = 16 * 1024 * 1024;
@@ -116,6 +119,19 @@ pub enum Request {
         /// The peer's iroh NodeId (z-base-32).
         node_id: String,
     },
+    /// Allow pushes between this daemon and a peer for `ttl_secs` (at most
+    /// [`MAX_PUSH_TTL_SECS`]): we may push to it, and accept what it pushes
+    /// to us. Nothing else - unlike [`Request::PeerTrust`] it neither
+    /// syncs the peer's pins nor serves it our content - so an app can
+    /// grant it to strangers it shares something with for a while (two
+    /// phones at the same place) and let it lapse. Asking again extends
+    /// it; [`Request::PeerUntrust`] ends it early. Added in varde 0.1.5.
+    PeerAllowPush {
+        /// The peer's iroh NodeId (z-base-32).
+        node_id: String,
+        /// How long the allowance lasts, in seconds.
+        ttl_secs: u64,
+    },
     /// List trusted peers and their current connectivity.
     PeerList {},
     /// Push fully-present content to a trusted peer, unprompted.