@astralyn/sash 0.1.0 → 0.1.2

package/dist/daemon/handlers/daemon.js

@@ -1,14 +1,30 @@
 import { currentCoreVersion } from "../../core.js";
+import { HttpError } from "../../daemon-http.js";
 import { publicSettings } from "../../settings.js";
 export function health(ctx) {
     const body = { token: ctx.token, pid: process.pid, startedAt: ctx.startedAt };
     return { status: 200, json: body };
 }
+export function createWebBootstrap(ctx) {
+    const bootstrap = ctx.webAuth.createBootstrap();
+    const body = { token: bootstrap.token, expiresAt: bootstrap.expiresAt };
+    return { status: 200, json: body };
+}
+export async function redeemWebBootstrap(ctx, req) {
+    const body = await req.readJson(1024);
+    const token = typeof body.token === "string" ? body.token.trim() : "";
+    const session = ctx.webAuth.redeemBootstrap(token);
+    if (!session)
+        throw new HttpError(401, "Invalid or expired bootstrap token");
+    const response = { token: session, daemonToken: ctx.token };
+    return { status: 200, json: response };
+}
 export async function daemonStatus(ctx, req) {
     const settings = ctx.settings.committed();
+    const ownership = ctx.supervisor.ownedCoreSnapshot();
     const runtimeCore = await ctx.supervisor.status();
     const installedVersion = currentCoreVersion(ctx.layout);
-    const core = runtimeCore.version || !installedVersion
+    let core = runtimeCore.version || !installedVersion
         ? runtimeCore
         : { ...runtimeCore, version: installedVersion };
     let actualProxy;
@@ -21,22 +37,33 @@ export async function daemonStatus(ctx, req) {
         proxyApplied = inspection.applied;
         proxyAppliedKnown = inspection.appliedKnown;
         proxyStateKnown = inspection.stateKnown;
-        if (proxyStateKnown)
-            actualProxy = inspection.state;
+        actualProxy = inspection.state;
         proxyQueryError = inspection.queryError;
     }
     catch (err) {
         proxyQueryError = err instanceof Error ? err.message : String(err);
     }
     const active = ctx.profiles.active();
+    if (core.running && (!ownership || !ctx.supervisor.ownsCore(ownership)))
+        core = { running: false };
+    const applied = ctx.lifecycle.configuration();
     const status = {
         daemon: {
             pid: process.pid,
+            bootId: ctx.token,
             startedAt: ctx.startedAt,
             port: settings.daemonPort,
         },
         revisions: {
             profiles: ctx.profileRevision(),
+            runtime: ctx.lifecycle.revision,
+        },
+        configuration: {
+            pending: ctx.pendingApply(),
+            appliedProfile: applied?.profile ?? null,
+            appliedSettings: applied
+                ? { mixedPort: applied.settings.mixedPort, allowLan: applied.settings.allowLan }
+                : null,
         },
         core,
         systemProxy: {
@@ -53,9 +80,8 @@ export async function daemonStatus(ctx, req) {
     return { status: 200, json: status };
 }
 export function shutdownDaemon(ctx) {
-    return ctx.shutdown().then((snapshot) => ({
-        status: 200,
-        json: { coreWasRunning: snapshot.coreWasRunning },
+    return ctx.shutdown().then(() => ({
+        status: 204,
         after: () => {
             void ctx
                 .closeListener()

package/dist/daemon/handlers/profiles.js

@@ -1,8 +1,15 @@
+import { requiredParam } from "../../daemon-http.js";
 import { ProfileInputError } from "../../profile-service.js";
-import { requiredParam } from "../router.js";
 export function listProfiles(ctx) {
     return { status: 200, json: ctx.profiles.list() };
 }
+export async function reorderProfiles(ctx, req) {
+    const { ids } = await req.readJson();
+    if (!Array.isArray(ids) || !ids.every((id) => typeof id === "string")) {
+        throw new ProfileInputError("Missing profile ids array");
+    }
+    return { status: 200, json: await ctx.profiles.reorder(ids) };
+}
 export async function addProfile(ctx, req) {
     const body = await req.readJson();
     const url = typeof body.url === "string" ? body.url.trim() : "";
@@ -42,7 +49,10 @@ export function readProfileContent(ctx, req) {
 export async function writeProfileContent(ctx, req) {
     const body = await req.readJson(8 * 1024 * 1024);
     const content = typeof body.content === "string" ? body.content : "";
-    const result = await ctx.profiles.writeContent(requiredParam(req, "id"), content);
+    const revision = body.revision;
+    if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 1)
+        throw new ProfileInputError("A positive profile revision is required");
+    const result = await ctx.profiles.writeContent(requiredParam(req, "id"), content, revision);
     return { status: 200, json: result };
 }
 export async function renameProfile(ctx, req) {

package/dist/daemon/handlers/settings.js

@@ -1,13 +1,6 @@
-import fs from "node:fs";
-import { parseSettingsPatch, } from "../../contracts.js";
+import { parseSettingsPatch } from "../../contracts.js";
 import { HttpError } from "../../daemon-http.js";
-import { parseSettingsText, publicSettings } from "../../settings.js";
-function writeResultBody(result) {
-    return {
-        restartRequired: result.restartRequired,
-        settings: publicSettings(result.settings),
-    };
-}
+import { publicSettings } from "../../settings.js";
 export function readSettings(ctx) {
     return { status: 200, json: publicSettings(ctx.settings.committed()) };
 }
@@ -15,34 +8,14 @@ export async function patchSettings(ctx, req) {
     const body = await req.readJson();
     let patch;
     try {
-        patch = parseSettingsPatch(body, "request");
+        patch = parseSettingsPatch(body);
     }
-    catch (err) {
-        throw new HttpError(400, err.message);
+    catch (error) {
+        throw new HttpError(400, error instanceof Error ? error.message : String(error));
     }
     const result = await ctx.settingsService.apply(patch);
-    return { status: 200, json: writeResultBody(result) };
-}
-export function readSettingsFile(ctx) {
-    let content;
-    try {
-        content = fs.readFileSync(ctx.layout.settingsFile, "utf8");
-    }
-    catch {
-        throw new HttpError(404, "Settings file does not exist yet");
-    }
-    return { status: 200, json: { content } };
-}
-export async function writeSettingsFile(ctx, req) {
-    const body = await req.readJson(256 * 1024);
-    const content = typeof body.content === "string" ? body.content : "";
-    let parsed;
-    try {
-        parsed = parseSettingsText(content, ctx.layout.settingsFile);
-    }
-    catch (err) {
-        throw new HttpError(400, err.message);
-    }
-    const result = await ctx.settingsService.applyFileSettings(parsed);
-    return { status: 200, json: writeResultBody(result) };
+    return {
+        status: 200,
+        json: { restartRequired: result.restartRequired, settings: publicSettings(result.settings) },
+    };
 }

package/dist/daemon/router.js

@@ -3,11 +3,12 @@ import { parseJsonObjectBody, sendError, sendJson } from "../daemon-http.js";
 import { forwardHttpToCore } from "../daemon-proxy.js";
 import { serveStaticUi } from "../daemon-static.js";
 import { errorToHttp } from "./errors.js";
-import { reloadCoreConfig, restartCore, startCore, stopCore } from "./handlers/core.js";
-import { daemonStatus, health, shutdownDaemon } from "./handlers/daemon.js";
-import { activateProfile, addProfile, importProfile, listProfiles, readProfileContent, removeProfile, renameProfile, updateAllProfiles, updateProfile, writeProfileContent, } from "./handlers/profiles.js";
+import { readAutostart, writeAutostart } from "./handlers/autostart.js";
+import { restartCore, setCoreMode, startCore, stopCore, updateCore } from "./handlers/core.js";
+import { createWebBootstrap, daemonStatus, health, redeemWebBootstrap, shutdownDaemon, } from "./handlers/daemon.js";
+import { activateProfile, addProfile, importProfile, listProfiles, readProfileContent, removeProfile, renameProfile, reorderProfiles, updateAllProfiles, updateProfile, writeProfileContent, } from "./handlers/profiles.js";
 import { proxyStatus } from "./handlers/proxy.js";
-import { patchSettings, readSettings, readSettingsFile, writeSettingsFile, } from "./handlers/settings.js";
+import { patchSettings, readSettings } from "./handlers/settings.js";
 export function parseDaemonRequestTarget(rawTarget, hostHeader) {
     if (!rawTarget.startsWith("/") || rawTarget.startsWith("//")) {
         throw new Error("Unsupported HTTP request-target form");
@@ -49,7 +50,20 @@ export function buildRoutes() {
             auth: "control",
             handler: shutdownDaemon,
         },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/web/bootstrap"),
+            auth: "control",
+            handler: createWebBootstrap,
+        },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/web/session"),
+            auth: "public",
+            handler: redeemWebBootstrap,
+        },
         { methods: ["POST"], pattern: path("/sash/core/start"), auth: "control", handler: startCore },
+        { methods: ["PUT"], pattern: path("/sash/core/mode"), auth: "control", handler: setCoreMode },
         { methods: ["POST"], pattern: path("/sash/core/stop"), auth: "control", handler: stopCore },
         {
             methods: ["POST"],
@@ -59,11 +73,18 @@ export function buildRoutes() {
         },
         {
             methods: ["POST"],
-            pattern: path("/sash/core/reload"),
+            pattern: path("/sash/core/update"),
             auth: "control",
-            handler: reloadCoreConfig,
+            handler: updateCore,
         },
         { methods: ["GET"], pattern: path("/sash/proxy"), auth: "public", handler: proxyStatus },
+        { methods: ["GET"], pattern: path("/sash/autostart"), auth: "control", handler: readAutostart },
+        {
+            methods: ["PUT"],
+            pattern: path("/sash/autostart"),
+            auth: "control",
+            handler: writeAutostart,
+        },
         { methods: ["GET"], pattern: path("/sash/settings"), auth: "public", handler: readSettings },
         {
             methods: ["PATCH"],
@@ -71,23 +92,13 @@ export function buildRoutes() {
             auth: "control",
             handler: patchSettings,
         },
-        {
-            methods: ["GET"],
-            pattern: path("/sash/settings/file"),
-            auth: "control",
-            handler: readSettingsFile,
-        },
+        { methods: ["GET"], pattern: path("/sash/profiles"), auth: "public", handler: listProfiles },
+        { methods: ["POST"], pattern: path("/sash/profiles"), auth: "control", handler: addProfile },
         {
             methods: ["PUT"],
-            pattern: path("/sash/settings/file"),
+            pattern: path("/sash/profiles/order"),
             auth: "control",
-            handler: writeSettingsFile,
-        },
-        {
-            methods: ["GET", "POST"],
-            pattern: path("/sash/profiles"),
-            auth: "public",
-            handler: (ctx, req) => (req.method === "POST" ? addProfile(ctx, req) : listProfiles(ctx)),
+            handler: reorderProfiles,
         },
         {
             methods: ["POST"],
@@ -158,6 +169,14 @@ export function buildRoutes() {
     ];
 }
 function forwardToCore(ctx, req, res, target) {
+    const method = req.method?.toUpperCase() ?? "GET";
+    const pathname = coreApiTarget(target).split("?")[0] ?? "/";
+    const allowedMutation = (method === "PUT" && /^\/proxies\/[^/]+$/.test(pathname)) ||
+        (method === "DELETE" && /^\/connections(?:\/[^/]+)?$/.test(pathname));
+    if (isControlMutation(method) && !allowedMutation) {
+        sendError(res, 403, "conflict", "Use Sash controls to change managed Core configuration");
+        return;
+    }
     const runtime = ctx.settings.runtime();
     forwardHttpToCore(req, res, coreApiTarget(target), runtime.controller, runtime.secret);
 }
@@ -179,12 +198,6 @@ function methodOrder(method) {
     const index = METHOD_ORDER.indexOf(method);
     return index < 0 ? METHOD_ORDER.length : index;
 }
-export function requiredParam(req, name) {
-    const value = req.params[name];
-    if (value === undefined)
-        throw new Error(`Missing route parameter: ${name}`);
-    return value;
-}
 function writeResponse(res, response) {
     if (response.after) {
         const after = response.after;
@@ -252,7 +265,7 @@ export async function dispatch(ctx, routes, req, res) {
     if (requiresAuth &&
         !isControlRequestAuthorized(req, {
             daemonSecret: ctx.settings.committed().daemonSecret,
-            bootToken: ctx.token,
+            isSessionToken: (token) => ctx.webAuth.isSession(token),
         })) {
         sendError(res, 401, "unauthorized", "Unauthorized control request");
         return;

package/dist/daemon/scheduler.js

@@ -1,4 +1,4 @@
-export function startProfileUpdateScheduler(profiles, scheduler = {}) {
+export function startProfileUpdateScheduler(profiles, scheduler = {}, isActive) {
     const intervalMs = scheduler.intervalMs ?? 15 * 60 * 1000;
     const kickoffMs = scheduler.kickoffMs ?? 10_000;
     const scheduleInterval = scheduler.setInterval ?? setInterval;
@@ -6,6 +6,8 @@ export function startProfileUpdateScheduler(profiles, scheduler = {}) {
     const scheduleTimeout = scheduler.setTimeout ?? setTimeout;
     const clearScheduledTimeout = scheduler.clearTimeout ?? clearTimeout;
     const autoUpdateProfiles = async () => {
+        if (!isActive())
+            return;
         try {
             await profiles.updateDue();
         }

package/dist/daemon/server.js

@@ -38,7 +38,7 @@ export function createDaemonServer(deps) {
         }
         if (!isWebSocketRequestAuthorized(req, {
             daemonSecret: context.settings.committed().daemonSecret,
-            bootToken: context.token,
+            isSessionToken: (token) => context.webAuth.isSession(token),
         })) {
             rejectUpgrade(socket, 401, "Unauthorized WebSocket request");
             return;
@@ -79,7 +79,10 @@ export function createDaemonServer(deps) {
                 rejectUpgrade(socket, 500, "WebSocket proxy failed");
         }
     });
-    const scheduler = startProfileUpdateScheduler(context.profiles, deps.scheduler ?? {});
+    let scheduler;
+    server.once("listening", () => {
+        scheduler = startProfileUpdateScheduler(context.profiles, deps.scheduler ?? {}, () => !context.gate.isClosing);
+    });
     let listenerClosePromise;
     const closeListener = () => {
         if (listenerClosePromise)
@@ -94,7 +97,7 @@ export function createDaemonServer(deps) {
                     socket.destroy();
                 await closed;
             }
-            scheduler.stop();
+            scheduler?.stop();
         })();
         listenerClosePromise = attempt;
         void attempt.catch(() => {

package/dist/daemon/web-auth.js

@@ -0,0 +1,52 @@
+import crypto from "node:crypto";
+export const WEB_BOOTSTRAP_TTL_MS = 90_000;
+const MAX_PENDING_BOOTSTRAPS = 32;
+const MAX_SESSIONS = 256;
+function hashToken(token) {
+    return crypto.createHash("sha256").update(token).digest("hex");
+}
+export class WebAuthManager {
+    pendingBootstraps = new Map();
+    sessions = new Map();
+    createBootstrap(now = Date.now()) {
+        this.sweepExpired(now);
+        while (this.pendingBootstraps.size >= MAX_PENDING_BOOTSTRAPS) {
+            const oldest = this.pendingBootstraps.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.pendingBootstraps.delete(oldest);
+        }
+        const token = crypto.randomBytes(32).toString("hex");
+        const expiresAtMs = now + WEB_BOOTSTRAP_TTL_MS;
+        this.pendingBootstraps.set(hashToken(token), expiresAtMs);
+        return { token, expiresAt: new Date(expiresAtMs).toISOString() };
+    }
+    redeemBootstrap(token, now = Date.now()) {
+        this.sweepExpired(now);
+        if (!token)
+            return null;
+        const key = hashToken(token);
+        const expiresAt = this.pendingBootstraps.get(key);
+        if (expiresAt === undefined || expiresAt <= now)
+            return null;
+        this.pendingBootstraps.delete(key);
+        while (this.sessions.size >= MAX_SESSIONS) {
+            const oldest = this.sessions.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.sessions.delete(oldest);
+        }
+        const session = crypto.randomBytes(32).toString("hex");
+        this.sessions.set(hashToken(session), true);
+        return session;
+    }
+    isSession(token) {
+        return token !== "" && this.sessions.has(hashToken(token));
+    }
+    sweepExpired(now) {
+        for (const [key, expiresAt] of this.pendingBootstraps) {
+            if (expiresAt <= now)
+                this.pendingBootstraps.delete(key);
+        }
+    }
+}

package/dist/daemon-auth.js

@@ -41,7 +41,7 @@ export function isControlRequestAuthorized(req, opts) {
     if (bearer && opts.daemonSecret && secretsEqual(bearer, opts.daemonSecret))
         return true;
     const webToken = firstHeader(req.headers["x-sash-token"]).trim();
-    return Boolean(webToken && secretsEqual(webToken, opts.bootToken));
+    return Boolean(webToken && opts.isSessionToken(webToken));
 }
 function webSocketProtocols(value) {
     return (Array.isArray(value) ? value.join(",") : (value ?? ""))
@@ -56,7 +56,7 @@ export function isWebSocketRequestAuthorized(req, opts) {
         if (!protocol.startsWith(WEB_SOCKET_TOKEN_PROTOCOL_PREFIX))
             return false;
         const token = protocol.slice(WEB_SOCKET_TOKEN_PROTOCOL_PREFIX.length);
-        return Boolean(token && secretsEqual(token, opts.bootToken));
+        return opts.isSessionToken(token);
     });
 }
 export function webSocketAuthResponseProtocol(value) {

package/dist/daemon-client.js

@@ -8,6 +8,7 @@ const daemonFetch = async (url, init) => {
         ...(init.body !== undefined ? { body: init.body } : {}),
         direct: true,
         deadlineMs: init.timeoutMs,
+        headersTimeoutMs: init.timeoutMs,
         ...(init.attempts !== undefined ? { attempts: init.attempts } : {}),
     });
     return {
@@ -32,6 +33,9 @@ export class SashDaemonClient {
     health() {
         return this.client.health();
     }
+    createWebBootstrap() {
+        return this.client.createWebBootstrap();
+    }
     async isReachable() {
         try {
             return Boolean((await this.health()).token);
@@ -43,11 +47,23 @@ export class SashDaemonClient {
     status(fresh = false) {
         return this.client.status(fresh);
     }
+    autostartStatus() {
+        return this.client.autostartStatus();
+    }
+    setAutostart(enabled) {
+        return this.client.setAutostart(enabled);
+    }
     startCore() {
         return this.client.startCore();
     }
-    maintenanceShutdown() {
-        return this.client.shutdown();
+    restartCore() {
+        return this.client.restartCore();
+    }
+    updateCore(version) {
+        return this.client.updateCore(version);
+    }
+    patchSettings(patch) {
+        return this.client.patchSettings(patch);
     }
     async shutdown() {
         await this.client.shutdown();

package/dist/daemon-http.js

@@ -9,6 +9,12 @@ export class HttpError extends Error {
         this.name = "HttpError";
     }
 }
+export function requiredParam(req, name) {
+    const value = req.params[name];
+    if (value === undefined)
+        throw new Error(`Missing route parameter: ${name}`);
+    return value;
+}
 export function parseJsonBody(req, maxBytes = 1024 * 1024) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -85,6 +91,7 @@ export function sendJson(res, statusCode, data) {
     res.writeHead(statusCode, {
         "Content-Type": "application/json; charset=utf-8",
         "Content-Length": Buffer.byteLength(body),
+        "Cache-Control": "no-store",
     });
     res.end(body);
 }