4bnode 4.2.0 → 4.2.1

package/skeleton/src/discovery.js

@@ -21,13 +21,23 @@
 //   - Clean shutdown sends TTL=0 "goodbye" packets so stale records do not linger
 //     in client caches for the record's full TTL (can be over an hour).
 //
-// Configure via .env:  BONJOUR_ENABLED=off | BONJOUR_NAME=... | BONJOUR_TYPE=http
+//   - OFF by default. Advertising only starts with BONJOUR_ENABLED=on.
+//   - On a machine with several networks (e.g. Wi-Fi AND Ethernet), mDNS is bound
+//     to ONE chosen interface (BONJOUR_INTERFACE=en0) and only that network's
+//     addresses are advertised. Otherwise a phone on Wi-Fi can be handed the
+//     Ethernet IP it cannot reach. The interface NAME is stored, not its IP, so a
+//     new DHCP lease does not break it.
+//
+// Configure via .env:
+//   BONJOUR_ENABLED=on | BONJOUR_NAME=... | BONJOUR_TYPE=http | BONJOUR_INTERFACE=en0
 
 import os from "os";
+import { execFileSync } from "child_process";
 
 let bonjour = null; // shared mDNS controller (created lazily, one per process)
 let published = null; // handle to the currently-advertised service, if any
 let BonjourCtor = null; // cached constructor after the first successful import
+let boundInterface = null; // interface name the current controller is bound to ("" = all)
 
 let selfState = {
   status: "idle", // idle | advertising | error | unsupported
@@ -37,6 +47,8 @@ let selfState = {
   host: null,
   txt: null,
   error: null,
+  interface: null, // { name, label, address } actually used, or null for all
+  warning: null,
 };
 
 // Import bonjour-service on demand. Returns the constructor, or null if the
@@ -74,9 +86,89 @@ function defaultServiceName() {
   return host ? base + " (" + host + ")" : base;
 }
 
-// On by default; opt out with BONJOUR_ENABLED=off.
+// Off by default; opt in with BONJOUR_ENABLED=on.
 export function isDiscoveryEnabled() {
-  return process.env.BONJOUR_ENABLED !== "off";
+  return process.env.BONJOUR_ENABLED === "on";
+}
+
+// Virtual / tunnel / container interfaces that never reach other LAN devices.
+const VIRTUAL_IFACE = /^(lo|utun|awdl|llw|gif|stf|anpi|ap|bridge|vmnet|vboxnet|docker|br-|veth|virbr|tun|tap|zt|tailscale|wg)/i;
+
+// macOS: map device names (en0) to their hardware port ("Wi-Fi", "Ethernet").
+let macPorts = null;
+function macHardwarePorts() {
+  if (macPorts) return macPorts;
+  macPorts = {};
+  try {
+    const out = execFileSync("networksetup", ["-listallhardwareports"], { encoding: "utf8", timeout: 3000 });
+    let current = null;
+    for (const raw of out.split(String.fromCharCode(10))) {
+      const line = raw.trim(); // trim also drops a Windows CR
+      const port = line.match(/^Hardware Port: (.+)$/);
+      if (port) current = port[1].trim();
+      const dev = line.match(/^Device: (.+)$/);
+      if (dev && current) macPorts[dev[1].trim()] = current;
+    }
+  } catch {}
+  return macPorts;
+}
+
+function interfaceKind(name) {
+  if (os.platform() === "darwin") {
+    const hw = macHardwarePorts()[name];
+    if (hw) return /wi-?fi|airport/i.test(hw) ? "Wi-Fi" : hw;
+  }
+  if (/^(wl|wlan|wifi)/i.test(name) || /wi-?fi|wireless|wlan/i.test(name)) return "Wi-Fi";
+  if (/^(eth|en|em|eno|ens|enp)/i.test(name) || /ethernet|lan/i.test(name)) return "Ethernet";
+  return "Network";
+}
+
+// Physical networks this machine is connected to, each with its IPv4 address.
+// Used by the dashboard / CLI to let the user choose which one to advertise on.
+export function listNetworkInterfaces() {
+  const all = os.networkInterfaces();
+  const result = [];
+  for (const name of Object.keys(all)) {
+    if (VIRTUAL_IFACE.test(name)) continue;
+    const addrs = all[name] || [];
+    const v4 = addrs.find((a) => a.family === "IPv4" && !a.internal);
+    if (!v4) continue;
+    const kind = interfaceKind(name);
+    result.push({
+      name,
+      kind,
+      label: kind + " (" + name + ")",
+      address: v4.address,
+      // 169.254.x.x = self-assigned: the cable/adapter is up but no network answered.
+      selfAssigned: v4.address.startsWith("169.254."),
+      ipv6: addrs.filter((a) => a.family === "IPv6" && !a.internal).map((a) => a.address),
+      mac: v4.mac,
+    });
+  }
+  return result;
+}
+
+// Resolve BONJOUR_INTERFACE to a live interface. Returns { iface, warning }:
+// iface null means "all interfaces".
+function resolveInterface() {
+  const wanted = (process.env.BONJOUR_INTERFACE || "").trim();
+  const list = listNetworkInterfaces();
+  if (wanted) {
+    const hit = list.find((i) => i.name === wanted);
+    if (hit) return { iface: hit, warning: null };
+    return {
+      iface: null,
+      warning: "Network " + JSON.stringify(wanted) + " is not connected; advertising on all networks instead.",
+    };
+  }
+  if (list.length > 1) {
+    return {
+      iface: null,
+      warning: "Several networks are connected (" + list.map((i) => i.label).join(", ") +
+        "). Advertising on all of them; choose one with BONJOUR_INTERFACE or in the dashboard.",
+    };
+  }
+  return { iface: null, warning: null };
 }
 
 // Snapshot of what this process is currently advertising (read by the dashboard).
@@ -84,6 +176,29 @@ export function getSelfState() {
   return { ...selfState, enabled: isDiscoveryEnabled() };
 }
 
+// (Re)create the mDNS controller bound to the chosen interface. Binding the
+// socket to 0.0.0.0 while pinning multicast to the interface IP keeps receiving
+// queries reliable on macOS/Linux.
+function ensureController(Ctor, iface) {
+  const key = iface ? iface.name : "";
+  if (bonjour && boundInterface === key) return;
+  if (bonjour) {
+    try { bonjour.destroy(); } catch {}
+  }
+  bonjour = iface ? new Ctor({ interface: iface.address, bind: "0.0.0.0" }) : new Ctor();
+  boundInterface = key;
+}
+
+// Keep only the chosen interface's addresses in A/AAAA records, so clients on
+// that network are never handed an IP from another network.
+function restrictAddresses(service, iface) {
+  if (!iface || typeof service.records !== "function") return;
+  const allowed = new Set([iface.address].concat(iface.ipv6));
+  const original = service.records.bind(service);
+  service.records = () =>
+    original().filter((r) => (r.type !== "A" && r.type !== "AAAA") || allowed.has(r.data));
+}
+
 // Advertise this app on the local network. Safe to call repeatedly; each call
 // replaces any prior advertisement, so a port change re-publishes cleanly. Must
 // be called AFTER the HTTP server is actually listening (so the port is bound).
@@ -113,7 +228,9 @@ export async function startAdvertising({ port, name, type } = {}) {
 
   // Replace any previous advertisement so two conflicting records never coexist.
   await stopAdvertising();
-  if (!bonjour) bonjour = new Ctor();
+  const { iface, warning } = resolveInterface();
+  ensureController(Ctor, iface);
+  if (warning) console.warn("mDNS: " + warning);
 
   const serviceName = name || defaultServiceName();
   const serviceType = type || process.env.BONJOUR_TYPE || "http";
@@ -125,6 +242,7 @@ export async function startAdvertising({ port, name, type } = {}) {
 
   try {
     published = bonjour.publish({ name: serviceName, type: serviceType, port, host, txt });
+    restrictAddresses(published, iface);
     selfState = {
       status: "advertising",
       name: serviceName,
@@ -133,10 +251,13 @@ export async function startAdvertising({ port, name, type } = {}) {
       host,
       txt,
       error: null,
+      interface: iface ? { name: iface.name, label: iface.label, address: iface.address } : null,
+      warning,
     };
     published.on("up", () => {
       console.log(
-        "mDNS: advertising " + JSON.stringify(serviceName) + " at " + host + ":" + port + " (_" + serviceType + "._tcp.local)",
+        "mDNS: advertising " + JSON.stringify(serviceName) + " at " + host + ":" + port + " (_" + serviceType + "._tcp.local)" +
+          (iface ? " on " + iface.label + " " + iface.address : " on all networks"),
       );
     });
     published.on("error", (err) => {
@@ -186,6 +307,7 @@ export async function destroyDiscovery() {
     if (bonjour) bonjour.destroy();
   } catch {}
   bonjour = null;
+  boundInterface = null;
 }
 
 // Browse the LAN for services of a given type. Collects results for timeoutMs
@@ -194,7 +316,7 @@ export async function destroyDiscovery() {
 export async function browse({ type = "http", timeoutMs = 2500 } = {}) {
   const Ctor = await loadBonjour();
   if (!Ctor) return { available: false, services: [] };
-  if (!bonjour) bonjour = new Ctor();
+  if (!bonjour) ensureController(Ctor, resolveInterface().iface);
 
   return new Promise((resolve) => {
     const found = new Map();

package/skeleton/src/middleware/apiKey.js

@@ -1,49 +1,92 @@
-// API key authentication. Named keys are managed by the 4bnode dashboard and
-// stored in src/api-keys.json. Send a key in the `x-api-key` request header:
-//   import apiKey from './src/middleware/apiKey.js';
-//   app.use('/api/private', apiKey);
+// API key authentication.
+//
+// Every request to this app's API must carry a valid key in the x-api-key
+// header, including login and registration, unless the gate is switched off
+// with API_KEY_REQUIRED=off. Keys are created and revoked in the 4bnode
+// dashboard (Security -> API keys) and stored HASHED in src/api-keys.json, so
+// that file never holds a usable key. Revoking a key takes effect immediately.
+//
+//   index.js (whole app, built in):  app.use(apiKeyGate);
+//   a single router only:            app.use('/api/private', apiKey);
+//
+// Never needs a key: the /docs page, CORS preflight (OPTIONS) requests, the
+// /_dev dashboard, and any path prefix listed in API_KEY_PUBLIC_PATHS
+// (comma-separated, e.g. /health,/webhooks/stripe).
+//
+// Routes that need a signed-in user still check the JWT (auth middleware) on
+// top of this: the API key identifies the calling app, the JWT the user.
 import fs from 'fs';
 import path from 'path';
 import crypto from 'crypto';
 import { fileURLToPath } from 'url';
 
 const KEYS_FILE = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'api-keys.json');
-let _cache = { mtimeMs: -1, keys: [] };
+let _cache = { mtimeMs: -1, hashes: [] };
 
-// Read the keys file fresh when it changes (mtime-cached), so keys generated or
-// revoked in the dashboard take effect immediately — no restart needed.
-function loadKeys() {
+export function hashApiKey(key) {
+  return crypto.createHash('sha256').update(String(key)).digest('hex');
+}
+
+// Read the keys file fresh when it changes (mtime-cached), so keys created or
+// revoked in the dashboard apply without a restart. Older files stored the
+// plaintext key; those entries are hashed on read.
+function loadKeyHashes() {
   try {
     const { mtimeMs } = fs.statSync(KEYS_FILE);
     if (mtimeMs !== _cache.mtimeMs) {
       const list = JSON.parse(fs.readFileSync(KEYS_FILE, 'utf8'));
-      _cache = { mtimeMs, keys: (Array.isArray(list) ? list : []).map((k) => k && k.key).filter(Boolean) };
+      const hashes = (Array.isArray(list) ? list : [])
+        .map((k) => k && (k.hash || (k.key ? hashApiKey(k.key) : null)))
+        .filter(Boolean);
+      _cache = { mtimeMs, hashes };
     }
   } catch {
-    _cache = { mtimeMs: -1, keys: [] };
+    _cache = { mtimeMs: -1, hashes: [] };
   }
-  return _cache.keys;
+  return _cache.hashes;
 }
 
-// Constant-time membership test: hash both sides to a fixed length so neither the
-// match result nor the key length leaks through string-comparison timing.
-function keyMatches(provided, valid) {
-  const p = crypto.createHash('sha256').update(String(provided)).digest();
+// Constant-time membership test over fixed-length digests: no early return,
+// so timing reveals neither which key matched nor the key length.
+function keyMatches(provided) {
+  const p = Buffer.from(hashApiKey(provided), 'hex');
   let ok = false;
-  for (const k of valid) {
-    const h = crypto.createHash('sha256').update(String(k)).digest();
-    if (crypto.timingSafeEqual(p, h)) ok = true; // no early return — keep timing flat
+  for (const h of loadKeyHashes()) {
+    const v = Buffer.from(h, 'hex');
+    if (v.length === p.length && crypto.timingSafeEqual(p, v)) ok = true;
   }
   return ok;
 }
 
 const apiKey = (req, res, next) => {
   const provided = req.header('x-api-key');
-  const valid = loadKeys();
-  if (!provided || !keyMatches(provided, valid)) {
+  if (!provided || !keyMatches(provided)) {
     return res.status(401).json({ message: 'Invalid or missing API key' });
   }
   next();
 };
 
+function publicPaths() {
+  const extra = String(process.env.API_KEY_PUBLIC_PATHS || '')
+    .split(',')
+    .map((p) => p.trim())
+    .filter((p) => p.startsWith('/'));
+  return ['/_dev', '/docs'].concat(extra);
+}
+
+function isPublicPath(p) {
+  return publicPaths().some((pre) => {
+    const base = pre.length > 1 && pre.endsWith('/') ? pre.slice(0, -1) : pre;
+    return p === base || p.startsWith(base + '/');
+  });
+}
+
+// App-wide gate. Mount after static files and before any routes.
+export function apiKeyGate(req, res, next) {
+  if (process.env.API_KEY_REQUIRED === 'off') return next();
+  if (req.method === 'OPTIONS') return next();
+  if (isPublicPath(req.path)) return next();
+  return apiKey(req, res, next);
+}
+
 export default apiKey;