@artenx/dshb 0.0.3 → 0.1.0

package/lib/auth/webserver.d.ts

@@ -0,0 +1,18 @@
+import WebServer, { WebRoute, WebUpgradeRoute } from "@deepseek-ai/dsh-host-webserver";
+import { Context } from "@deepseek-ai/cordis";
+//#region src/auth/webserver.d.ts
+declare class AuthedWebServer extends WebServer {
+  private readonly gate;
+  constructor(ctx: Context, config: {
+    host: '127.0.0.1' | '0.0.0.0';
+    port: number;
+  });
+  register(route: WebRoute): () => void;
+  registerFallback(handler: WebRoute['handler']): () => void;
+  registerUpgrade(route: WebUpgradeRoute): () => void;
+  private guarded;
+  private guardedUpgrade;
+}
+//#endregion
+export { AuthedWebServer as default };
+//# sourceMappingURL=webserver.d.ts.map

package/lib/auth/webserver.js

@@ -0,0 +1,60 @@
+import { sharedCredentialStore } from "./credentials.js";
+import { AuthGate, rewriteToLoopback } from "./gate.js";
+import WebServer from "@deepseek-ai/dsh-host-webserver";
+//#region src/auth/webserver.ts
+var AuthedWebServer = class extends WebServer {
+	gate = new AuthGate(sharedCredentialStore());
+	constructor(ctx, config) {
+		super(ctx, config);
+	}
+	register(route) {
+		return super.register({
+			...route,
+			handler: (req, res) => this.guarded(route, req, res)
+		});
+	}
+	registerFallback(handler) {
+		return super.registerFallback((req, res) => this.guarded({
+			kind: "exact",
+			path: "/",
+			handler
+		}, req, res));
+	}
+	registerUpgrade(route) {
+		return super.registerUpgrade({
+			...route,
+			handler: (req, socket, head) => this.guardedUpgrade(route, req, socket, head)
+		});
+	}
+	guarded(route, req, res) {
+		const decision = this.gate.decide(req);
+		if (decision === "allow") {
+			rewriteToLoopback(req, this.port);
+			return route.handler(req, res);
+		}
+		if (decision === "exempt") return route.handler(req, res);
+		if (decision === "redirect-login") {
+			res.writeHead(302, { location: "/login" });
+			res.end();
+			return;
+		}
+		res.writeHead(401, { "content-type": "application/json" });
+		res.end(JSON.stringify({
+			ok: false,
+			error: "unauthorized"
+		}));
+	}
+	guardedUpgrade(route, req, socket, head) {
+		const decision = this.gate.decide(req);
+		if (decision === "allow" || decision === "exempt") {
+			if (decision === "allow") rewriteToLoopback(req, this.port);
+			return route.handler(req, socket, head);
+		}
+		socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+		socket.destroy();
+	}
+};
+//#endregion
+export { AuthedWebServer as default };
+
+//# sourceMappingURL=webserver.js.map

package/lib/auth/webserver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webserver.js","names":[],"sources":["../../src/auth/webserver.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport WebServer from '@deepseek-ai/dsh-host-webserver'\nimport type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sharedCredentialStore } from './credentials.js'\nimport { AuthGate, rewriteToLoopback } from './gate.js'\n\nexport default class AuthedWebServer extends WebServer {\n  private readonly gate = new AuthGate(sharedCredentialStore())\n\n  constructor(ctx: Context, config: { host: '127.0.0.1' | '0.0.0.0'; port: number }) {\n    super(ctx, config)\n  }\n\n  override register(route: WebRoute): () => void {\n    return super.register({ ...route, handler: (req, res) => this.guarded(route, req, res) })\n  }\n\n  override registerFallback(handler: WebRoute['handler']): () => void {\n    return super.registerFallback((req, res) =>\n      this.guarded({ kind: 'exact', path: '/', handler }, req, res),\n    )\n  }\n\n  override registerUpgrade(route: WebUpgradeRoute): () => void {\n    return super.registerUpgrade({\n      ...route,\n      handler: (req, socket, head) => this.guardedUpgrade(route, req, socket, head),\n    })\n  }\n\n  private guarded(route: WebRoute, req: IncomingMessage, res: ServerResponse): void | Promise<void> {\n    const decision = this.gate.decide(req)\n    if (decision === 'allow') {\n      rewriteToLoopback(req, this.port)\n      return route.handler(req, res)\n    }\n    if (decision === 'exempt') {\n      return route.handler(req, res)\n    }\n    if (decision === 'redirect-login') {\n      res.writeHead(302, { location: '/login' })\n      res.end()\n      return\n    }\n    res.writeHead(401, { 'content-type': 'application/json' })\n    res.end(JSON.stringify({ ok: false, error: 'unauthorized' }))\n  }\n\n  private guardedUpgrade(\n    route: WebUpgradeRoute,\n    req: IncomingMessage,\n    socket: Duplex,\n    head: Buffer,\n  ): void | Promise<void> {\n    const decision = this.gate.decide(req)\n    if (decision === 'allow' || decision === 'exempt') {\n      if (decision === 'allow') rewriteToLoopback(req, this.port)\n      return route.handler(req, socket, head)\n    }\n    socket.write('HTTP/1.1 401 Unauthorized\\r\\nConnection: close\\r\\n\\r\\n')\n    socket.destroy()\n  }\n}\n"],"mappings":";;;;AAQA,IAAqB,kBAArB,cAA6C,UAAU;CACrD,OAAwB,IAAI,SAAS,sBAAsB,CAAC;CAE5D,YAAY,KAAc,QAAyD;EACjF,MAAM,KAAK,MAAM;CACnB;CAEA,SAAkB,OAA6B;EAC7C,OAAO,MAAM,SAAS;GAAE,GAAG;GAAO,UAAU,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,GAAG;EAAE,CAAC;CAC1F;CAEA,iBAA0B,SAA0C;EAClE,OAAO,MAAM,kBAAkB,KAAK,QAClC,KAAK,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAK;EAAQ,GAAG,KAAK,GAAG,CAC9D;CACF;CAEA,gBAAyB,OAAoC;EAC3D,OAAO,MAAM,gBAAgB;GAC3B,GAAG;GACH,UAAU,KAAK,QAAQ,SAAS,KAAK,eAAe,OAAO,KAAK,QAAQ,IAAI;EAC9E,CAAC;CACH;CAEA,QAAgB,OAAiB,KAAsB,KAA2C;EAChG,MAAM,WAAW,KAAK,KAAK,OAAO,GAAG;EACrC,IAAI,aAAa,SAAS;GACxB,kBAAkB,KAAK,KAAK,IAAI;GAChC,OAAO,MAAM,QAAQ,KAAK,GAAG;EAC/B;EACA,IAAI,aAAa,UACf,OAAO,MAAM,QAAQ,KAAK,GAAG;EAE/B,IAAI,aAAa,kBAAkB;GACjC,IAAI,UAAU,KAAK,EAAE,UAAU,SAAS,CAAC;GACzC,IAAI,IAAI;GACR;EACF;EACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;EACzD,IAAI,IAAI,KAAK,UAAU;GAAE,IAAI;GAAO,OAAO;EAAe,CAAC,CAAC;CAC9D;CAEA,eACE,OACA,KACA,QACA,MACsB;EACtB,MAAM,WAAW,KAAK,KAAK,OAAO,GAAG;EACrC,IAAI,aAAa,WAAW,aAAa,UAAU;GACjD,IAAI,aAAa,SAAS,kBAAkB,KAAK,KAAK,IAAI;GAC1D,OAAO,MAAM,QAAQ,KAAK,QAAQ,IAAI;EACxC;EACA,OAAO,MAAM,wDAAwD;EACrE,OAAO,QAAQ;CACjB;AACF"}