@balaji003/lantransfer 1.0.7 → 1.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@balaji003/lantransfer",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "LAN File Transfer — peer-to-peer file sharing over local network. Zero dependencies.",
   "main": "server.js",
   "bin": {

package/public/index.html

@@ -347,6 +347,8 @@
     evtSource = new EventSource('/events');
     evtSource.onmessage = e => {
       state = JSON.parse(e.data);
+      console.log('[sse] State update — peers:', state.peers?.length, 'files:', state.sharedFiles?.length,
+        'transfers:', state.transfers?.length, 'incoming:', !!state.incomingRequest);
       // Auto-select the latest file if none selected
       if (!selectedFileId && state.sharedFiles && state.sharedFiles.length > 0) {
         selectedFileId = state.sharedFiles[state.sharedFiles.length - 1].id;
@@ -354,9 +356,11 @@
       render();
     };
     evtSource.onopen = () => {
+      console.log('[sse] Connected');
       document.getElementById('conn-status').textContent = '';
     };
-    evtSource.onerror = () => {
+    evtSource.onerror = (e) => {
+      console.error('[sse] Error/disconnected', e);
       document.getElementById('conn-status').textContent = 'Reconnecting...';
     };
   }
@@ -366,10 +370,16 @@
   // API
   // ──────────────────────────────────────────────────────────────────────────
   function api(endpoint, data) {
+    console.log('[api]', endpoint, data || '');
     return fetch('/api/' + endpoint, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(data || {}),
+    }).then(r => {
+      console.log('[api]', endpoint, 'response:', r.status);
+      return r;
+    }).catch(err => {
+      console.error('[api]', endpoint, 'error:', err);
     });
   }
 
@@ -388,13 +398,9 @@
     if (selectedFileId === id) selectedFileId = null;
   }
 
-  async function doBrowse() {
-    if (browsing) return;
-    browsing = true;
-    document.getElementById('browse-btn').textContent = 'Opening...';
-    await api('browse');
-    browsing = false;
-    document.getElementById('browse-btn').textContent = 'Browse';
+  function doBrowse() {
+    console.log('[browse] Clicked');
+    api('browse');
   }
 
   function doSend() {
@@ -403,12 +409,14 @@
     }
   }
 
-  function respondTransfer(requestId, accepted) {
-    api('respond', { requestId: requestId, accepted: accepted });
+  function respondTransfer(accepted) {
+    console.log('[respondTransfer] accepted:', accepted);
+    api('respond', { accepted: accepted });
   }
 
-  function openFolder(filePath) {
-    api('open-folder', { path: filePath });
+  function openFolder(transferId) {
+    console.log('[openFolder] transferId:', transferId);
+    api('open-folder', { transferId: transferId });
   }
 
   function doShutdown() {
@@ -531,8 +539,8 @@
     // Modal
     const overlay = document.getElementById('modal-overlay');
     const modal = document.getElementById('modal');
-    if (state.incomingRequests && state.incomingRequests.length > 0) {
-      const req = state.incomingRequests[0];
+    if (state.incomingRequest) {
+      const req = state.incomingRequest;
       overlay.classList.add('show');
       modal.innerHTML =
         '<div class="modal-title">Incoming File</div>'
@@ -540,8 +548,8 @@
         + '<div class="modal-file">' + esc(req.filename) + '</div>'
         + '<div class="modal-size">' + formatSize(req.size) + '</div>'
         + '<div class="modal-buttons">'
-        + '<button class="btn-accept" onclick="respondTransfer(\'' + esc(req.id) + '\', true)">Accept</button>'
-        + '<button class="btn-reject" onclick="respondTransfer(\'' + esc(req.id) + '\', false)">Reject</button>'
+        + '<button class="btn-accept" onclick="respondTransfer(true)">Accept</button>'
+        + '<button class="btn-reject" onclick="respondTransfer(false)">Reject</button>'
         + '</div>';
     } else {
       overlay.classList.remove('show');
@@ -573,16 +581,18 @@
       extra = '<div class="transfer-actions">'
         + '<span class="transfer-size">' + formatSize(t.size) + '</span>';
       if (t.status === 'completed' && t.direction === 'receive' && t.savePath) {
-        extra += '<button class="btn-open-folder" onclick="openFolder(\'' + esc(t.savePath.replace(/\\/g, '\\\\')) + '\')">Open Folder</button>';
+        extra += '<button class="btn-open-folder" onclick="openFolder(\'' + esc(t.id) + '\')">Open Folder</button>';
       }
       extra += '</div>';
     }
 
+    const encrypted = (t.status === 'in_progress' || t.status === 'completed') ? ' \uD83D\uDD12' : '';
+
     return '<div class="transfer">'
       + '<div class="transfer-top">'
       + '<div class="transfer-info">'
       + '<span class="transfer-icon">' + icon + '</span>'
-      + '<span>' + esc(t.filename) + ' ' + arrow + ' ' + esc(peer) + '</span>'
+      + '<span>' + esc(t.filename) + ' ' + arrow + ' ' + esc(peer) + encrypted + '</span>'
       + '</div>'
       + '<span class="badge ' + badgeClass + '">' + badgeText + '</span>'
       + '</div>'

package/server.js

@@ -4,10 +4,9 @@
  * server.js — LAN File Transfer (Node.js rewrite)
  *
  * Zero external dependencies. Uses built-in modules only.
- * Protocol-compatible with the original Rust version:
- *   - UDP discovery on port 34254
+ *   - HTTP + UDP discovery
  *   - TCP file transfer on port 34255
- *   - XOR obfuscation with key "LAN-XFER-KEY-2024"
+ *   - E2E encryption: ECDH key exchange + AES-256-CTR
  *
  * Run:  node server.js
  * Then open http://localhost:3000 in a browser.
@@ -16,6 +15,7 @@
 const http = require('http');
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const dgram = require('dgram');
 const net = require('net');
 const os = require('os');
@@ -27,9 +27,9 @@ const { exec } = require('child_process');
 const DISCOVERY_PORT = 34254;
 const TRANSFER_PORT = 34255;
 const HTTP_PORT = 3000;
-const XOR_KEY = Buffer.from('LAN-XFER-KEY-2024');
 const PEER_TIMEOUT = 10_000;   // ms
 const BROADCAST_INTERVAL = 3_000; // ms
+const ECDH_CURVE = 'prime256v1'; // NIST P-256
 
 // ──────────────────────────────────────────────────────────────────────────────
 // Persistent config (device name)
@@ -62,7 +62,7 @@ let downloadDir = config.downloadDir || path.join(os.homedir(), 'Downloads');
 const sharedFiles = [];               // [ { id, path, name, size } ]
 const peers = new Map();              // id → { device_name, ip, tcp_port, last_seen }
 const transfers = [];                 // [ TransferEntry ]
-const pendingRequests = new Map();    // id → { filename, size, senderName, resolve }
+let pendingRequest = null;            // { filename, size, senderName, resolve } or null
 let idCounter = 0;
 let browseInProgress = false;
 
@@ -114,9 +114,9 @@ function serializeState() {
       speed: t.speed, error: t.error,
       savePath: t.savePath || null,
     })),
-    incomingRequests: [...pendingRequests.entries()].map(([id, r]) => ({
-      id, filename: r.filename, size: r.size, senderName: r.senderName,
-    })),
+    incomingRequest: pendingRequest
+      ? { filename: pendingRequest.filename, size: pendingRequest.size, senderName: pendingRequest.senderName }
+      : null,
   });
 }
 
@@ -128,14 +128,18 @@ function broadcast() {
 }
 
 // ──────────────────────────────────────────────────────────────────────────────
-// Helpers
+// Helpers — E2E encryption (ECDH + AES-256-CTR)
 // ──────────────────────────────────────────────────────────────────────────────
-function xorCrypt(buf, offset) {
-  const out = Buffer.allocUnsafe(buf.length);
-  for (let i = 0; i < buf.length; i++) {
-    out[i] = buf[i] ^ XOR_KEY[(offset + i) % XOR_KEY.length];
-  }
-  return out;
+function createKeyPair() {
+  const ecdh = crypto.createECDH(ECDH_CURVE);
+  ecdh.generateKeys();
+  return ecdh;
+}
+
+function deriveKey(ecdh, peerPubKey) {
+  const shared = ecdh.computeSecret(peerPubKey);
+  // SHA-256 the shared secret to get a 32-byte AES key
+  return crypto.createHash('sha256').update(shared).digest();
 }
 
 function readBody(req) {
@@ -180,6 +184,8 @@ function readExact(socket, n) {
 const htmlPath = path.join(__dirname, 'public', 'index.html');
 
 const server = http.createServer(async (req, res) => {
+  console.log(`  [http] ${req.method} ${req.url}`);
+
   // ── Serve the web UI ──
   if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html')) {
     fs.readFile(htmlPath, (err, data) => {
@@ -217,7 +223,11 @@ const server = http.createServer(async (req, res) => {
       'Connection': 'keep-alive',
     });
     sseClients.add(res);
-    req.on('close', () => sseClients.delete(res));
+    console.log(`  [sse] Client connected (total: ${sseClients.size})`);
+    req.on('close', () => {
+      sseClients.delete(res);
+      console.log(`  [sse] Client disconnected (total: ${sseClients.size})`);
+    });
     res.write(`data: ${serializeState()}\n\n`);
     return;
   }
@@ -233,32 +243,40 @@ const server = http.createServer(async (req, res) => {
       console.log(`  [toggle] Discoverable: ${isDiscoverable}`);
     }
     else if (req.url === '/api/browse') {
+      // Respond immediately so we don't block the HTTP connection
+      res.writeHead(200, { 'Content-Type': 'text/plain' });
+      res.end('ok');
       if (browseInProgress) {
         console.log('  [browse] Dialog already open, ignoring');
       } else {
         browseInProgress = true;
         console.log('  [browse] Opening file dialog...');
-        const fp = await openFileDialog();
-        browseInProgress = false;
-        if (fp) {
-          try {
+        try {
+          const fp = await openFileDialog();
+          browseInProgress = false;
+          if (fp) {
             const s = fs.statSync(fp);
             const file = { id: String(idCounter++), path: fp, name: path.basename(fp), size: s.size };
             sharedFiles.push(file);
             console.log(`  [browse] Added: ${file.name} (${formatSize(file.size)})`);
-          } catch (e) {
-            console.error(`  [browse] Error reading file: ${e.message}`);
+          } else {
+            console.log('  [browse] Cancelled by user');
           }
-        } else {
-          console.log('  [browse] Cancelled');
+        } catch (e) {
+          browseInProgress = false;
+          console.error(`  [browse] Error: ${e.message}`);
         }
+        broadcast();
       }
+      return; // already responded
     }
     else if (req.url === '/api/remove-file') {
       const idx = sharedFiles.findIndex(f => f.id === data.fileId);
       if (idx !== -1) {
         console.log(`  [files] Removed: ${sharedFiles[idx].name}`);
         sharedFiles.splice(idx, 1);
+      } else {
+        console.log(`  [files] Remove failed — fileId not found: ${data.fileId}`);
       }
     }
     else if (req.url === '/api/send') {
@@ -266,9 +284,9 @@ const server = http.createServer(async (req, res) => {
       const file = sharedFiles.find(f => f.id === data.fileId);
       if (peer && file) {
         console.log(`  [send] ${file.name} -> ${peer.device_name} (${peer.ip})`);
-        sendFile(peer, { ...file });
+        sendFile(peer, { ...file }).catch(e => console.error(`  [send] Unhandled: ${e.message}`));
       } else {
-        console.log(`  [send] Failed — peer: ${!!peer}, file: ${!!file}`);
+        console.log(`  [send] Failed — peer: ${!!peer} (${data.peerId}), file: ${!!file} (${data.fileId})`);
       }
     }
     else if (req.url === '/api/rename') {
@@ -278,34 +296,62 @@ const server = http.createServer(async (req, res) => {
         config.deviceName = newName;
         saveConfig(config);
         console.log(`  [rename] Device name set to: ${deviceName}`);
+      } else {
+        console.log(`  [rename] Invalid name: "${data.name}"`);
       }
     }
     else if (req.url === '/api/set-download-dir') {
-      // Open native folder picker
-      const dir = await openFolderDialog();
-      if (dir) {
-        downloadDir = dir;
-        config.downloadDir = dir;
-        saveConfig(config);
-        console.log(`  [config] Download dir set to: ${downloadDir}`);
+      // Respond immediately so we don't block the HTTP connection
+      res.writeHead(200, { 'Content-Type': 'text/plain' });
+      res.end('ok');
+      console.log('  [config] Opening folder dialog...');
+      try {
+        const dir = await openFolderDialog();
+        if (dir) {
+          downloadDir = dir;
+          config.downloadDir = dir;
+          saveConfig(config);
+          console.log(`  [config] Download dir set to: ${downloadDir}`);
+        } else {
+          console.log('  [config] Folder dialog cancelled');
+        }
+      } catch (e) {
+        console.error(`  [config] Folder dialog error: ${e.message}`);
       }
+      broadcast();
+      return; // already responded
     }
     else if (req.url === '/api/respond') {
-      const pending = pendingRequests.get(data.requestId);
-      if (pending) {
-        pending.resolve(!!data.accepted);
-        pendingRequests.delete(data.requestId);
-        console.log(`  [respond] ${data.accepted ? 'Accepted' : 'Rejected'} transfer ${data.requestId}`);
+      console.log(`  [respond] Received: accepted=${data.accepted}`);
+      if (pendingRequest) {
+        pendingRequest.resolve(!!data.accepted);
+        console.log(`  [respond] ${data.accepted ? 'Accepted' : 'Rejected'}: ${pendingRequest.filename}`);
+        pendingRequest = null;
+      } else {
+        console.log(`  [respond] WARNING: No pending request`);
       }
     }
     else if (req.url === '/api/open-folder') {
-      const filePath = data.path;
-      if (filePath && fs.existsSync(filePath)) {
-        const dir = path.dirname(filePath);
-        if (process.platform === 'win32') exec(`explorer /select,"${filePath}"`);
-        else if (process.platform === 'darwin') exec(`open -R "${filePath}"`);
-        else exec(`xdg-open "${dir}"`);
-        console.log(`  [open] ${filePath}`);
+      const transferId = data.transferId;
+      const t = transfers.find(tr => tr.id === transferId);
+      if (t && t.savePath) {
+        console.log(`  [open] Opening folder for: ${t.savePath}`);
+        if (fs.existsSync(t.savePath)) {
+          if (process.platform === 'win32') exec(`explorer /select,"${t.savePath}"`);
+          else if (process.platform === 'darwin') exec(`open -R "${t.savePath}"`);
+          else exec(`xdg-open "${path.dirname(t.savePath)}"`);
+        } else {
+          console.log(`  [open] File no longer exists: ${t.savePath}`);
+          // Open the directory instead
+          const dir = path.dirname(t.savePath);
+          if (fs.existsSync(dir)) {
+            if (process.platform === 'win32') exec(`explorer "${dir}"`);
+            else if (process.platform === 'darwin') exec(`open "${dir}"`);
+            else exec(`xdg-open "${dir}"`);
+          }
+        }
+      } else {
+        console.log(`  [open] Failed — transferId: ${transferId}, found: ${!!t}, savePath: ${t ? t.savePath : 'N/A'}`);
       }
     }
     else if (req.url === '/api/shutdown') {
@@ -315,6 +361,9 @@ const server = http.createServer(async (req, res) => {
       setTimeout(() => process.exit(0), 200);
       return;
     }
+    else {
+      console.log(`  [http] Unknown POST endpoint: ${req.url}`);
+    }
 
     res.writeHead(200, { 'Content-Type': 'text/plain' });
     res.end('ok');
@@ -428,33 +477,41 @@ tcpServer.on('error', err => {
 tcpServer.listen(TRANSFER_PORT);
 
 async function handleIncoming(socket) {
+  const remoteAddr = `${socket.remoteAddress}:${socket.remotePort}`;
+  console.log(`  [recv] TCP connection from ${remoteAddr}`);
+
   // Read header length (8 bytes, little-endian u64)
   const lenBuf = await readExact(socket, 8);
   const headerLen = Number(lenBuf.readBigUInt64LE(0));
+  console.log(`  [recv] Header length: ${headerLen} bytes`);
 
   // Read header JSON
   const headerBuf = await readExact(socket, headerLen);
   const header = JSON.parse(headerBuf.toString('utf-8'));
   const { filename, size, sender_name } = header;
 
-  console.log(`  Incoming: ${filename} (${formatSize(size)}) from ${sender_name}`);
+  console.log(`  [recv] Incoming: "${filename}" (${formatSize(size)}) from ${sender_name}`);
 
   // Prompt user for accept / reject
-  const reqId = String(idCounter++);
+  console.log(`  [recv] Waiting for user decision...`);
+
   const accepted = await new Promise(resolve => {
-    pendingRequests.set(reqId, { filename, size, senderName: sender_name, resolve });
+    pendingRequest = { filename, size, senderName: sender_name, resolve };
     broadcast();
 
     // Auto-reject if sender disconnects while waiting
     socket.once('close', () => {
-      if (pendingRequests.has(reqId)) {
-        pendingRequests.delete(reqId);
+      if (pendingRequest && pendingRequest.resolve === resolve) {
+        console.log(`  [recv] Sender disconnected while waiting, auto-rejecting`);
+        pendingRequest = null;
         resolve(false);
         broadcast();
       }
     });
   });
 
+  console.log(`  [recv] User decision: ${accepted ? 'ACCEPTED' : 'REJECTED'}`);
+
   // Send decision byte
   socket.write(Buffer.from([accepted ? 1 : 0]));
   if (!accepted) { socket.end(); return; }
@@ -481,13 +538,34 @@ async function handleIncoming(socket) {
   }
 
   t.savePath = savePath;
-
+  console.log(`  [recv] Saving to: ${savePath}`);
+
+  // ── E2E key exchange: receive sender's public key, send ours ──
+  const pubKeyLenBuf = await readExact(socket, 2);
+  const pubKeyLen = pubKeyLenBuf.readUInt16BE(0);
+  const senderPubKey = await readExact(socket, pubKeyLen);
+  console.log(`  [recv] Got sender public key (${pubKeyLen} bytes)`);
+
+  const ecdh = createKeyPair();
+  const myPubKey = ecdh.getPublicKey();
+  const keyLenBuf = Buffer.alloc(2);
+  keyLenBuf.writeUInt16BE(myPubKey.length);
+  socket.write(keyLenBuf);
+  socket.write(myPubKey);
+  console.log(`  [recv] Sent our public key (${myPubKey.length} bytes)`);
+
+  // Derive AES key + receive IV
+  const aesKey = deriveKey(ecdh, senderPubKey);
+  const iv = await readExact(socket, 16);
+  console.log(`  [recv] AES key derived, IV received — decrypting with AES-256-CTR`);
+
+  const decipher = crypto.createDecipheriv('aes-256-ctr', aesKey, iv);
   const ws = fs.createWriteStream(savePath);
   let received = 0;
   let lastBc = 0;
 
   socket.on('data', chunk => {
-    const decrypted = xorCrypt(chunk, received);
+    const decrypted = decipher.update(chunk);
     ws.write(decrypted);
     received += chunk.length;
 
@@ -504,11 +582,13 @@ async function handleIncoming(socket) {
 
   await new Promise((resolve, reject) => {
     socket.on('end', () => {
+      const final = decipher.final();
+      if (final.length > 0) ws.write(final);
       ws.end();
       t.status = 'completed';
       t.progress = 100;
       broadcast();
-      console.log(`  Saved: ${savePath}`);
+      console.log(`  [recv] Complete: ${savePath} (${formatSize(received)})`);
       resolve();
     });
     socket.on('error', err => {
@@ -516,6 +596,7 @@ async function handleIncoming(socket) {
       t.status = 'failed';
       t.error = err.message;
       broadcast();
+      console.error(`  [recv] Socket error: ${err.message}`);
       reject(err);
     });
   });
@@ -540,6 +621,7 @@ async function sendFile(peer, file) {
       socket.connect(peer.tcp_port, peer.ip, res);
       socket.once('error', rej);
     });
+    console.log(`  [send] Connected to ${peer.ip}:${peer.tcp_port}`);
 
     // Send header
     const headerJSON = JSON.stringify({
@@ -558,20 +640,44 @@ async function sendFile(peer, file) {
       t.error = 'Rejected by recipient';
       broadcast();
       socket.end();
+      console.log(`  [send] Rejected by ${peer.device_name}`);
       return;
     }
 
+    console.log(`  [send] Accepted — starting E2E key exchange`);
+
+    // ── E2E key exchange: send our public key, receive receiver's ──
+    const ecdh = createKeyPair();
+    const myPubKey = ecdh.getPublicKey();
+    const keyLenBuf = Buffer.alloc(2);
+    keyLenBuf.writeUInt16BE(myPubKey.length);
+    socket.write(keyLenBuf);
+    socket.write(myPubKey);
+    console.log(`  [send] Sent our public key (${myPubKey.length} bytes)`);
+
+    const recvKeyLenBuf = await readExact(socket, 2);
+    const recvKeyLen = recvKeyLenBuf.readUInt16BE(0);
+    const recvPubKey = await readExact(socket, recvKeyLen);
+    console.log(`  [send] Got receiver public key (${recvKeyLen} bytes)`);
+
+    // Derive AES key, generate IV, send IV
+    const aesKey = deriveKey(ecdh, recvPubKey);
+    const iv = crypto.randomBytes(16);
+    socket.write(iv);
+    console.log(`  [send] AES key derived, IV sent — encrypting with AES-256-CTR`);
+
     t.status = 'in_progress';
     t._start = Date.now();
     broadcast();
 
-    // Stream file with XOR encryption
+    // Stream file with AES-256-CTR encryption
+    const cipher = crypto.createCipheriv('aes-256-ctr', aesKey, iv);
     const rs = fs.createReadStream(file.path, { highWaterMark: 65536 });
     let sent = 0;
     let lastBc = 0;
 
     for await (const chunk of rs) {
-      const encrypted = xorCrypt(Buffer.from(chunk), sent);
+      const encrypted = cipher.update(Buffer.from(chunk));
       const ok = socket.write(encrypted);
       sent += chunk.length;
 
@@ -594,16 +700,20 @@ async function sendFile(peer, file) {
       }
     }
 
+    // Write final cipher block
+    const final = cipher.final();
+    if (final.length > 0) socket.write(final);
+
     socket.end();
     t.status = 'completed';
     t.progress = 100;
     broadcast();
-    console.log(`  Sent: ${file.name} → ${peer.device_name}`);
+    console.log(`  [send] Complete: ${file.name} → ${peer.device_name}`);
   } catch (e) {
     t.status = 'failed';
     t.error = e.message;
     broadcast();
-    console.error(`  Send error: ${e.message}`);
+    console.error(`  [send] Error: ${e.message}`);
   }
 }
 
@@ -715,6 +825,7 @@ server.listen(HTTP_PORT, () => {
   console.log(`  Discovery  HTTP scan (no firewall needed)`);
   console.log(`  Discovery  UDP :${DISCOVERY_PORT} (fallback)`);
   console.log(`  Transfer   TCP :${TRANSFER_PORT}`);
+  console.log(`  Encryption ECDH + AES-256-CTR (E2E)`);
   console.log(`  UI:        http://localhost:${HTTP_PORT}`);
   console.log('');