@betterportal/tunnels 1.0.24 → 1.0.26

package/lib/plugins/service-tunnels-proxy/index.js

@@ -0,0 +1,288 @@
+import { BSBService, bsb, optional, createConfigSchema, createEventSchemas, createFireAndForgetEvent } from "@bsb/base";
+import * as av from "anyvali";
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { H3, getRequestURL, toNodeHandler } from "h3";
+import { WebSocketServer } from "ws";
+import TunnelClientApiClient from "../../.bsb/clients/service-tunnels-client.js";
+import { buildProxyResponse, forwardedHeaders, proxyClientIp, tunnelUnavailable } from "./http.js";
+import { createVerificationFlow } from "./verification.js";
+import { prisma } from "../../prisma.js";
+import { initializePrisma } from "../../prisma.js";
+export const Config = createConfigSchema({
+    name: "service-tunnels-proxy",
+    description: "Front-facing H3 tunnel service",
+    tags: ["service", "h3", "tunnel"]
+}, av.object({
+    database: av.object({
+        connectionString: av.string().minLength(1).describe("PostgreSQL connection string")
+    }, { unknownKeys: "strip" }).describe("Database configuration"),
+    port: av.number().default(8080).describe("Public web listener port"),
+    domain: av.string().default("tunnels.betterportal.dev").describe("Tunnel root domain"),
+    verificationHost: av.string().default("verify.tunnels.betterportal.dev").describe("Verification host"),
+    cookieSecret: av.string().default("dev-cookie-secret").describe("Signed verification cookie secret"),
+    turnstileSiteKey: av.optional(av.string()).describe("Cloudflare Turnstile site key"),
+    turnstileSecretKey: av.optional(av.string()).describe("Cloudflare Turnstile secret key"),
+    maxHeaderBytes: av.number().default(32 * 1024).describe("Maximum accepted request header bytes"),
+    maxBodyBytes: av.number().default(2 * 1024 * 1024).describe("Maximum accepted request body bytes")
+}).describe("service-tunnels-proxy config"));
+export const EventSchemas = createEventSchemas({
+    emitEvents: {},
+    onEvents: {
+        "ws.fromOrigin": createFireAndForgetEvent(bsb.object({
+            publicSocketId: bsb.string({ description: "Web service local websocket id" }),
+            frameType: bsb.string({ description: "msg, ack, or event" }),
+            event: optional(bsb.string({ description: "close" })),
+            body: optional(bsb.string({ description: "Base64 websocket payload" }))
+        }, "Origin websocket frame to public client"), "Relay an origin websocket frame to the public websocket")
+    },
+    emitReturnableEvents: {},
+    onReturnableEvents: {},
+    emitBroadcast: {},
+    onBroadcast: {}
+});
+export class Plugin extends BSBService {
+    static Config = Config;
+    static EventSchemas = EventSchemas;
+    initBeforePlugins = [];
+    initAfterPlugins = [];
+    runBeforePlugins = [];
+    runAfterPlugins = [];
+    clientApi;
+    app;
+    server;
+    wss;
+    publicSockets = new Map();
+    verification;
+    constructor(cfg) {
+        super(cfg);
+        this.clientApi = new TunnelClientApiClient(this);
+        this.app = new H3();
+        this.server = createServer(toNodeHandler(this.app));
+        this.wss = new WebSocketServer({ noServer: true });
+        this.verification = createVerificationFlow({
+            domain: this.config.domain,
+            verificationHost: this.config.verificationHost,
+            cookieSecret: this.config.cookieSecret,
+            turnstileSiteKey: this.config.turnstileSiteKey,
+            turnstileSecretKey: this.config.turnstileSecretKey
+        });
+    }
+    async init(obs) {
+        await initializePrisma(this.config.database.connectionString, obs);
+        await this.events.onEventSpecific("ws.fromOrigin", this.appId, obs, async (_handlerObs, input) => {
+            const ws = this.publicSockets.get(input.publicSocketId);
+            if (!ws || ws.readyState !== ws.OPEN)
+                return;
+            if (input.frameType === "msg" && input.body) {
+                ws.send(Buffer.from(input.body, "base64"));
+                return;
+            }
+            if (input.frameType === "event" && input.event === "close")
+                ws.close();
+        });
+        this.app.get("/health", () => new Response("ok\n", {
+            headers: { "content-type": "text/plain; charset=utf-8" }
+        }));
+        this.server.on("upgrade", (request, socket, head) => {
+            const host = request.headers.host ?? "";
+            const url = new URL(request.url ?? "/", `https://${host}`);
+            const headers = requestHeaders(request.headers);
+            const clientIp = proxyClientIp(headers) ?? "unknown";
+            const userAgent = request.headers["user-agent"] ?? "";
+            const verificationResponse = this.verification.enforce({ req: new Request(url, { headers }) }, url, clientIp, Array.isArray(userAgent) ? userAgent.join(" ") : userAgent);
+            if (this.verification.isVerificationHost(url.hostname) || verificationResponse) {
+                socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+                socket.destroy();
+                return;
+            }
+            this.wss.handleUpgrade(request, socket, head, (ws) => {
+                void this.handlePublicSocket(ws, url, obs);
+            });
+        });
+        this.app.use("/**", async (event) => {
+            const url = getRequestURL(event);
+            const clientIp = proxyClientIp(event.req.headers) ?? "unknown";
+            const userAgent = event.req.headers.get("user-agent") ?? "";
+            if (this.verification.isVerificationHost(url.hostname)) {
+                return this.verification.handleVerificationHost(event, url, clientIp, userAgent);
+            }
+            const subdomain = url.hostname.split(".")[0] ?? "";
+            const tunnel = await prisma.tunnel.findUnique({
+                where: { subdomain },
+                select: { validation: true, session: { select: { ipHash: true, userAgent: true } } }
+            });
+            const identity = tunnel?.session.ipHash && tunnel.session.userAgent
+                ? { ipHash: tunnel.session.ipHash, userAgent: tunnel.session.userAgent }
+                : undefined;
+            const verificationResponse = this.verification.enforce(event, url, clientIp, userAgent, tunnel?.validation, identity);
+            if (verificationResponse)
+                return verificationResponse;
+            const requestObs = obs.startSpan("bt.web.request", {
+                "http.request.method": event.req.method,
+                "url.path": url.pathname,
+                "server.address": url.hostname,
+                "client.address": clientIp
+            });
+            const startedAt = Date.now();
+            try {
+                requestObs.log.info("WEB REQUEST start {method} {host}{path} clientIp={clientIp}", {
+                    method: event.req.method,
+                    host: url.hostname,
+                    path: url.pathname,
+                    clientIp
+                });
+                const headerBytes = approximateHeaderBytes(event.req.headers);
+                if (headerBytes > this.config.maxHeaderBytes) {
+                    requestObs.log.warn("WEB REQUEST rejected headers too large {headerBytes}", { headerBytes });
+                    requestObs.end({ "http.response.status_code": 431 });
+                    return new Response("Request headers too large.\n", { status: 431 });
+                }
+                const contentLength = Number(event.req.headers.get("content-length") ?? "0");
+                if (contentLength > this.config.maxBodyBytes) {
+                    requestObs.log.warn("WEB REQUEST rejected body too large {contentLength}", { contentLength });
+                    requestObs.end({ "http.response.status_code": 413 });
+                    return new Response("Request body too large.\n", { status: 413 });
+                }
+                const bodyBuffer = event.req.body ? Buffer.from(await event.req.arrayBuffer()) : undefined;
+                if (bodyBuffer && bodyBuffer.byteLength > this.config.maxBodyBytes) {
+                    requestObs.log.warn("WEB REQUEST rejected buffered body too large {bodyBytes}", { bodyBytes: bodyBuffer.byteLength });
+                    requestObs.end({ "http.response.status_code": 413 });
+                    return new Response("Request body too large.\n", { status: 413 });
+                }
+                const response = await this.clientApi.proxyRequest(obs, {
+                    hostname: url.hostname,
+                    method: event.req.method,
+                    path: `${url.pathname}${url.search}`,
+                    headers: forwardedHeaders(event.req.headers, url.hostname),
+                    body: bodyBuffer ? bodyBuffer.toString("base64") : undefined,
+                    webStartedAt: startedAt
+                }, 60);
+                const durationMs = Date.now() - startedAt;
+                this.sendProxyMetrics(obs, url.hostname, response, durationMs);
+                requestObs.log.info("WEB REQUEST complete {method} {host}{path} -> {status} in {durationMs}ms", {
+                    method: event.req.method,
+                    host: url.hostname,
+                    path: url.pathname,
+                    status: response.status,
+                    durationMs
+                });
+                requestObs.end({
+                    "http.response.status_code": response.status,
+                    "duration.ms": durationMs
+                });
+                if (response.status === 502 || response.status === 503) {
+                    return tunnelUnavailable(event.req.headers);
+                }
+                return buildProxyResponse(Buffer.from(response.body, "base64"), response.status, response.headers);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                requestObs.error(error instanceof Error ? error : new Error(message), {
+                    "http.response.status_code": 502
+                });
+                requestObs.log.error("WEB REQUEST failed {method} {host}{path}: {message}", {
+                    method: event.req.method,
+                    host: url.hostname,
+                    path: url.pathname,
+                    message
+                });
+                requestObs.end({ "http.response.status_code": 503 });
+                return tunnelUnavailable(event.req.headers);
+            }
+        });
+    }
+    async run(obs) {
+        const port = this.config.port;
+        await new Promise((resolve) => {
+            this.server.listen(port, "0.0.0.0", () => resolve());
+        });
+        obs.log.info(`web listening on port ${port}`);
+    }
+    async dispose() {
+        this.wss.close();
+        await new Promise((resolve, reject) => {
+            this.server.close((error) => error ? reject(error) : resolve());
+        });
+    }
+    async handlePublicSocket(ws, url, obs) {
+        const publicSocketId = randomUUID();
+        const subdomain = url.hostname.split(".")[0] ?? "";
+        const tunnel = await prisma.tunnel.findUnique({ where: { subdomain } });
+        if (!tunnel?.ownerServerId || tunnel.status !== "active") {
+            ws.close();
+            return;
+        }
+        this.publicSockets.set(publicSocketId, ws);
+        await this.clientApi.wsToOriginSpecific(tunnel.ownerServerId, obs, {
+            publicServerId: this.appId,
+            publicSocketId,
+            hostname: url.hostname,
+            path: `${url.pathname}${url.search}`,
+            frameType: "event",
+            event: "open"
+        });
+        ws.on("message", (data) => {
+            const body = wsDataBuffer(data).toString("base64");
+            void this.clientApi.wsToOriginSpecific(tunnel.ownerServerId, obs, {
+                publicServerId: this.appId,
+                publicSocketId,
+                hostname: url.hostname,
+                path: `${url.pathname}${url.search}`,
+                frameType: "msg",
+                body
+            });
+        });
+        ws.on("close", () => {
+            this.publicSockets.delete(publicSocketId);
+            void this.clientApi.wsToOriginSpecific(tunnel.ownerServerId, obs, {
+                publicServerId: this.appId,
+                publicSocketId,
+                hostname: url.hostname,
+                path: `${url.pathname}${url.search}`,
+                frameType: "event",
+                event: "close"
+            });
+        });
+    }
+    sendProxyMetrics(obs, hostname, response, totalMs) {
+        const internalServerMs = roundMs(totalMs - response.clientApiRoundtripMs);
+        void this.clientApi.proxyMetricsSpecific(response.ownerServerId, obs, {
+            hostname,
+            requestId: response.requestId,
+            totalMs,
+            clientApiRoundtripMs: response.clientApiRoundtripMs,
+            cliOverheadMs: response.cliOverheadMs,
+            originMs: response.originMs,
+            internalServerMs
+        });
+    }
+}
+function roundMs(value) {
+    return Math.round(value * 100) / 100;
+}
+function approximateHeaderBytes(headers) {
+    let total = 0;
+    headers.forEach((value, name) => {
+        total += Buffer.byteLength(name) + Buffer.byteLength(value) + 4;
+    });
+    return total;
+}
+function requestHeaders(headers) {
+    const out = new Headers();
+    for (const [name, value] of Object.entries(headers)) {
+        if (Array.isArray(value))
+            out.set(name, value.join(", "));
+        else if (value !== undefined)
+            out.set(name, value);
+    }
+    return out;
+}
+function wsDataBuffer(data) {
+    if (Buffer.isBuffer(data))
+        return data;
+    if (Array.isArray(data))
+        return Buffer.concat(data);
+    return Buffer.from(data);
+}
+//# sourceMappingURL=index.js.map

package/lib/plugins/service-tunnels-proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/service-tunnels-proxy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EAGV,GAAG,EACH,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACtD,OAAO,EAAE,eAAe,EAAgC,MAAM,IAAI,CAAC;AACnE,OAAO,qBAAqB,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAyB,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,MAAM,GAAG,kBAAkB,CACtC;IACE,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,gCAAgC;IAC7C,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC;CAClC,EACD,EAAE,CAAC,MAAM,CAAC;IACR,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC;QAClB,gBAAgB,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;KACpF,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAC/D,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACpE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACtF,gBAAgB,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACtG,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IACpG,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACpF,kBAAkB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IACxF,cAAc,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAChG,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;CACnG,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAC5C,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAC7C,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE;QACR,eAAe,EAAE,wBAAwB,CACvC,GAAG,CAAC,MAAM,CAAC;YACT,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;YAC7E,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;YAC5D,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC;SACxE,EAAE,yCAAyC,CAAC,EAC7C,yDAAyD,CAC1D;KACF;IACD,oBAAoB,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE;IACtB,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,MAAO,SAAQ,UAA4D;IACtF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAC1B,iBAAiB,GAAa,EAAE,CAAC;IACjC,gBAAgB,GAAa,EAAE,CAAC;IAChC,gBAAgB,GAAa,EAAE,CAAC;IAChC,eAAe,GAAa,EAAE,CAAC;IACvB,SAAS,CAAwB;IACjC,GAAG,CAAK;IACR,MAAM,CAAS;IACf,GAAG,CAAkB;IACrB,aAAa,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,YAAY,CAAmB;IAEhD,YAAY,GAA4E;QACtF,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,IAAI,CAAC,SAAS,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,sBAAsB,CAAC;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SACnD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;YAC/F,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACxD,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,IAAI;gBAAE,OAAO;YAC7C,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5C,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;gBAAE,EAAE,CAAC,KAAK,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE;YACjD,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;SACzD,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;YACrD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,oBAAoB,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,EAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnL,IAAI,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC;gBAC/E,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;gBACpE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBACnD,KAAK,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;YAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAE5D,IAAI,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;YACnF,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC5C,KAAK,EAAE,EAAE,SAAS,EAAE;gBACpB,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;aACrF,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS;gBACjE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;gBACxE,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,oBAAoB,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACtH,IAAI,oBAAoB;gBAAE,OAAO,oBAAoB,CAAC;YAEtD,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE;gBACjD,qBAAqB,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;gBACvC,UAAU,EAAE,GAAG,CAAC,QAAQ;gBACxB,gBAAgB,EAAE,GAAG,CAAC,QAAQ;gBAC9B,gBAAgB,EAAE,QAAQ;aAC3B,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,IAAI,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,6DAA6D,EAAE;oBACjF,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;oBACxB,IAAI,EAAE,GAAG,CAAC,QAAQ;oBAClB,IAAI,EAAE,GAAG,CAAC,QAAQ;oBAClB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC7C,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,sDAAsD,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC7F,UAAU,CAAC,GAAG,CAAC,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;oBACrD,OAAO,IAAI,QAAQ,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvE,CAAC;gBAED,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC7E,IAAI,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBAC7C,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;oBAC9F,UAAU,CAAC,GAAG,CAAC,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;oBACrD,OAAO,IAAI,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3F,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACnE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;oBACtH,UAAU,CAAC,GAAG,CAAC,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;oBACrD,OAAO,IAAI,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE;oBACtD,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;oBACxB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;oBACpC,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;oBAC1D,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC5D,YAAY,EAAE,SAAS;iBACxB,EAAE,EAAE,CAAC,CAAC;gBAEP,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAC1C,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC/D,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,0EAA0E,EAAE;oBAC9F,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;oBACxB,IAAI,EAAE,GAAG,CAAC,QAAQ;oBAClB,IAAI,EAAE,GAAG,CAAC,QAAQ;oBAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU;iBACX,CAAC,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC;oBACb,2BAA2B,EAAE,QAAQ,CAAC,MAAM;oBAC5C,aAAa,EAAE,UAAU;iBAC1B,CAAC,CAAC;gBAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvD,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9C,CAAC;gBAED,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,UAAU,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE;oBACpE,2BAA2B,EAAE,GAAG;iBACjC,CAAC,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,qDAAqD,EAAE;oBAC1E,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;oBACxB,IAAI,EAAE,GAAG,CAAC,QAAQ;oBAClB,IAAI,EAAE,GAAG,CAAC,QAAQ;oBAClB,OAAO;iBACR,CAAC,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,EAAE,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAe;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,EAAa,EAAE,GAAQ,EAAE,GAAe;QACvE,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzD,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE;YACjE,cAAc,EAAE,IAAI,CAAC,KAAK;YAC1B,cAAc;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnD,KAAK,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAc,EAAE,GAAG,EAAE;gBACjE,cAAc,EAAE,IAAI,CAAC,KAAK;gBAC1B,cAAc;gBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,SAAS,EAAE,KAAK;gBAChB,IAAI;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC1C,KAAK,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAc,EAAE,GAAG,EAAE;gBACjE,cAAc,EAAE,IAAI,CAAC,KAAK;gBAC1B,cAAc;gBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,SAAS,EAAE,OAAO;gBAClB,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,GAAe,EAAE,QAAgB,EAAE,QAO3D,EAAE,OAAe;QAChB,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAC1E,KAAK,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;YACpE,QAAQ;YACR,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO;YACP,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;;AAGH,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9B,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,OAAgD;IACtE,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aACrD,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/lib/plugins/service-tunnels-proxy/verification.d.ts

@@ -0,0 +1,31 @@
+import type { H3Event } from "h3";
+type VerificationConfig = {
+    domain: string;
+    verificationHost: string;
+    cookieSecret: string;
+    turnstileSiteKey?: string;
+    turnstileSecretKey?: string;
+};
+type IpValidationIdentity = {
+    ipHash: string;
+    userAgent: string;
+};
+export declare class VerificationFlow {
+    private readonly config;
+    constructor(config: VerificationConfig);
+    isVerificationHost(hostname: string): boolean;
+    handleVerificationHost(event: H3Event, url: URL, clientIp: string, userAgent: string): Promise<Response>;
+    enforce(event: H3Event, url: URL, clientIp: string, userAgent: string, validation?: string, identity?: IpValidationIdentity): Response | undefined;
+    private redirectWithWideCookie;
+    private redirectWithChallenge;
+    private validWideCookie;
+    private validHostCookie;
+    private signToken;
+    private verifyToken;
+    private isAllowedReturn;
+    private verifyTurnstile;
+    private verificationPage;
+}
+export declare function createVerificationFlow(config: VerificationConfig): VerificationFlow;
+export {};
+//# sourceMappingURL=verification.d.ts.map

package/lib/plugins/service-tunnels-proxy/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-tunnels-proxy/verification.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAgBlC,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,kBAAkB;IAEvD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIvC,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqB9G,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,MAAiB,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,QAAQ,GAAG,SAAS;IAgB5J,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,qBAAqB;IAM7B,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,SAAS;IAYjB,OAAO,CAAC,WAAW;IAkBnB,OAAO,CAAC,eAAe;YAWT,eAAe;IAiB7B,OAAO,CAAC,gBAAgB;CAgDzB;AA6CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,gBAAgB,CAEnF"}

package/lib/plugins/service-tunnels-proxy/verification.js

@@ -0,0 +1,211 @@
+import { createHmac, createHash, timingSafeEqual } from "node:crypto";
+const WIDE_COOKIE = "bt_verify";
+const HOST_COOKIE = "bt_tunnel";
+const CHALLENGE_PARAM = "bt_challenge";
+const COOKIE_TTL_SECONDS = 60 * 60;
+const CHALLENGE_TTL_SECONDS = 2 * 60;
+export class VerificationFlow {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    isVerificationHost(hostname) {
+        return hostname === this.config.verificationHost;
+    }
+    async handleVerificationHost(event, url, clientIp, userAgent) {
+        if (event.req.method === "POST") {
+            const form = await event.req.formData();
+            const returnTo = String(form.get("return") ?? "");
+            const turnstileToken = String(form.get("cf-turnstile-response") ?? "");
+            if (!this.isAllowedReturn(returnTo))
+                return new Response("Invalid return URL.\n", { status: 400 });
+            if (!await this.verifyTurnstile(turnstileToken, clientIp)) {
+                return this.verificationPage(returnTo, "Verification failed. Please try again.");
+            }
+            return this.redirectWithWideCookie(returnTo, clientIp, userAgent);
+        }
+        const returnTo = url.searchParams.get("return") ?? "";
+        if (!this.isAllowedReturn(returnTo))
+            return new Response("Invalid return URL.\n", { status: 400 });
+        if (this.validWideCookie(event.req.headers, clientIp, userAgent)) {
+            return this.redirectWithChallenge(returnTo, clientIp, userAgent);
+        }
+        return this.verificationPage(returnTo);
+    }
+    enforce(event, url, clientIp, userAgent, validation = "cookie", identity) {
+        if (validation === "ip" && identity && hash(clientIp) === identity.ipHash && hash(userAgent) === hash(identity.userAgent))
+            return undefined;
+        if (this.validHostCookie(event.req.headers, url.hostname, clientIp, userAgent))
+            return undefined;
+        const challenge = url.searchParams.get(CHALLENGE_PARAM);
+        if (challenge && this.verifyToken(challenge, "challenge", clientIp, userAgent, url.hostname)) {
+            const cleanUrl = new URL(url);
+            cleanUrl.searchParams.delete(CHALLENGE_PARAM);
+            return redirect(cleanUrl.toString(), hostCookie(HOST_COOKIE, this.signToken("host", clientIp, userAgent, url.hostname)));
+        }
+        const verifyUrl = new URL(`https://${this.config.verificationHost}/`);
+        verifyUrl.searchParams.set("return", url.toString());
+        return redirect(verifyUrl.toString());
+    }
+    redirectWithWideCookie(returnTo, clientIp, userAgent) {
+        const response = this.redirectWithChallenge(returnTo, clientIp, userAgent);
+        response.headers.append("set-cookie", wideCookie(WIDE_COOKIE, this.signToken("wide", clientIp, userAgent), this.config.domain));
+        return response;
+    }
+    redirectWithChallenge(returnTo, clientIp, userAgent) {
+        const target = new URL(returnTo);
+        target.searchParams.set(CHALLENGE_PARAM, this.signToken("challenge", clientIp, userAgent, target.hostname, CHALLENGE_TTL_SECONDS));
+        return redirect(target.toString());
+    }
+    validWideCookie(headers, clientIp, userAgent) {
+        const token = readCookie(headers, WIDE_COOKIE);
+        return !!token && this.verifyToken(token, "wide", clientIp, userAgent);
+    }
+    validHostCookie(headers, host, clientIp, userAgent) {
+        const token = readCookie(headers, HOST_COOKIE);
+        return !!token && this.verifyToken(token, "host", clientIp, userAgent, host);
+    }
+    signToken(kind, clientIp, userAgent, host, ttl = COOKIE_TTL_SECONDS) {
+        const payload = {
+            kind,
+            ip: hash(clientIp),
+            ua: hash(userAgent),
+            exp: Math.floor(Date.now() / 1000) + ttl,
+            ...(host ? { host } : {})
+        };
+        const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+        return `${body}.${hmac(body, this.config.cookieSecret)}`;
+    }
+    verifyToken(raw, kind, clientIp, userAgent, host) {
+        const [body, sig] = raw.split(".");
+        if (!body || !sig || !safeEqual(sig, hmac(body, this.config.cookieSecret)))
+            return false;
+        let token;
+        try {
+            token = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+        }
+        catch {
+            return false;
+        }
+        return token.kind === kind
+            && token.exp >= Math.floor(Date.now() / 1000)
+            && token.ip === hash(clientIp)
+            && token.ua === hash(userAgent)
+            && (!host || token.host === host);
+    }
+    isAllowedReturn(value) {
+        try {
+            const url = new URL(value);
+            return url.protocol === "https:"
+                && url.hostname !== this.config.verificationHost
+                && (url.hostname === this.config.domain || url.hostname.endsWith(`.${this.config.domain}`));
+        }
+        catch {
+            return false;
+        }
+    }
+    async verifyTurnstile(token, clientIp) {
+        if (!this.config.turnstileSecretKey)
+            return true;
+        if (!token)
+            return false;
+        const body = new URLSearchParams({
+            secret: this.config.turnstileSecretKey,
+            response: token,
+            remoteip: clientIp
+        });
+        const response = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+            method: "POST",
+            body
+        });
+        const result = await response.json();
+        return result.success === true;
+    }
+    verificationPage(returnTo, error) {
+        const escapedReturn = escapeHtml(returnTo);
+        const widget = this.config.turnstileSiteKey
+            ? `<div class="cf-turnstile" data-sitekey="${escapeHtml(this.config.turnstileSiteKey)}"></div><script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>`
+            : "";
+        const errorHtml = error ? `<p class="error">${escapeHtml(error)}</p>` : "";
+        return new Response(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Continue to development tunnel</title>
+  <style>
+    :root { color-scheme: dark; --bg: #120506; --panel: #1b0b0d; --line: #5b2027; --text: #fff6f6; --muted: #f0b8bd; --danger: #ff344c; --danger2: #ff6b7b; }
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px; background: radial-gradient(circle at top, #3b0c13 0, #120506 46%, #080203 100%); color: var(--text); font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    main { width: min(560px, 100%); border: 1px solid var(--line); background: linear-gradient(180deg, rgba(255,52,76,.14), rgba(255,255,255,.02)), var(--panel); border-radius: 12px; box-shadow: 0 28px 90px rgba(0,0,0,.5); padding: 30px; }
+    .brand { color: var(--danger2); font-weight: 900; letter-spacing: .1em; text-transform: uppercase; font-size: 12px; }
+    h1 { margin: 18px 0 0; font-size: clamp(34px, 7vw, 62px); line-height: .95; letter-spacing: 0; }
+    p { margin: 18px 0 0; color: var(--muted); font-size: 18px; line-height: 1.45; }
+    .notice { border: 1px solid var(--danger); background: rgba(255,52,76,.12); padding: 16px; border-radius: 8px; margin-top: 22px; font-weight: 800; }
+    form { margin-top: 24px; display: grid; gap: 18px; }
+    button { height: 50px; border: 0; border-radius: 8px; background: var(--danger); color: white; font-weight: 900; font-size: 15px; cursor: pointer; }
+    button:hover { background: #e6273d; }
+    .error { color: #ff9f9f; }
+    small { display: block; margin-top: 18px; color: #d8969d; line-height: 1.45; }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="brand">BetterTunnels</div>
+    <h1>Stop.</h1>
+    <p>This is a temporary developer tunnel. It is not a real login, bank, Microsoft, or production service.</p>
+    <div class="notice">If you did not expect this exact developer tunnel, close this tab.</div>
+    ${errorHtml}
+    <form method="post">
+      <input type="hidden" name="return" value="${escapedReturn}">
+      ${widget}
+      <button type="submit">I expected this tunnel</button>
+    </form>
+    <small>Continuing verifies this browser and IP for a short time.</small>
+  </main>
+</body>
+</html>`, {
+            headers: { "content-type": "text/html; charset=utf-8" }
+        });
+    }
+}
+function redirect(location, cookie) {
+    const headers = new Headers({ location });
+    if (cookie)
+        headers.append("set-cookie", cookie);
+    return new Response(null, { status: 302, headers });
+}
+function readCookie(headers, name) {
+    const cookie = headers.get("cookie") ?? "";
+    return cookie.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`))?.slice(name.length + 1);
+}
+function wideCookie(name, value, domain) {
+    return `${name}=${value}; Max-Age=${COOKIE_TTL_SECONDS}; Domain=.${domain}; Path=/; HttpOnly; Secure; SameSite=Lax`;
+}
+function hostCookie(name, value) {
+    return `${name}=${value}; Max-Age=${COOKIE_TTL_SECONDS}; Path=/; HttpOnly; Secure; SameSite=Lax`;
+}
+function hmac(value, secret) {
+    return createHmac("sha256", secret).update(value).digest("base64url");
+}
+function hash(value) {
+    return createHash("sha256").update(value).digest("base64url");
+}
+function safeEqual(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (char) => ({
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        "\"": "&quot;",
+        "'": "&#39;"
+    })[char] ?? char);
+}
+export function createVerificationFlow(config) {
+    return new VerificationFlow(config);
+}
+//# sourceMappingURL=verification.js.map

package/lib/plugins/service-tunnels-proxy/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../../src/plugins/service-tunnels-proxy/verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGtE,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,eAAe,GAAG,cAAc,CAAC;AACvC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAC;AACnC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,CAAC;AAoBrC,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,MAA0B;QAA1B,WAAM,GAAN,MAAM,CAAoB;IAAG,CAAC;IAE3D,kBAAkB,CAAC,QAAgB;QACjC,OAAO,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAc,EAAE,GAAQ,EAAE,QAAgB,EAAE,SAAiB;QACxF,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACnG,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAC;YACnF,CAAC;YAED,OAAO,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACnG,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,KAAc,EAAE,GAAQ,EAAE,QAAgB,EAAE,SAAiB,EAAE,aAAqB,QAAQ,EAAE,QAA+B;QACnI,IAAI,UAAU,KAAK,IAAI,IAAI,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5I,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjG,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC9C,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3H,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC;QACtE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,sBAAsB,CAAC,QAAgB,EAAE,QAAgB,EAAE,SAAiB;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3E,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAChI,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,qBAAqB,CAAC,QAAgB,EAAE,QAAgB,EAAE,SAAiB;QACjF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACnI,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,CAAC;IAEO,eAAe,CAAC,OAAgB,EAAE,QAAgB,EAAE,SAAiB;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;IAEO,eAAe,CAAC,OAAgB,EAAE,IAAY,EAAE,QAAgB,EAAE,SAAiB;QACzF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;IAEO,SAAS,CAAC,IAAmB,EAAE,QAAgB,EAAE,SAAiB,EAAE,IAAa,EAAE,GAAG,GAAG,kBAAkB;QACjH,MAAM,OAAO,GAAU;YACrB,IAAI;YACJ,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC;YAClB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;YACxC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1B,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxE,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IAC3D,CAAC;IAEO,WAAW,CAAC,GAAW,EAAE,IAAmB,EAAE,QAAgB,EAAE,SAAiB,EAAE,IAAa;QACtG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAEzF,IAAI,KAAY,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAU,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI;eACrB,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;eAC1C,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC;eAC3B,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC;eAC5B,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,eAAe,CAAC,KAAa;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;mBAC3B,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,gBAAgB;mBAC7C,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,QAAgB;QAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YACtC,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,2DAA2D,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,IAAI;SACL,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA2B,CAAC;QAC9D,OAAO,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACjC,CAAC;IAEO,gBAAgB,CAAC,QAAgB,EAAE,KAAc;QACvD,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB;YACzC,CAAC,CAAC,2CAA2C,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,mGAAmG;YACxL,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,oBAAoB,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAE3E,OAAO,IAAI,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA4BlB,SAAS;;kDAEmC,aAAa;QACvD,MAAM;;;;;;QAMN,EAAE;YACJ,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,MAAe;IACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IAC7D,OAAO,GAAG,IAAI,IAAI,KAAK,aAAa,kBAAkB,aAAa,MAAM,0CAA0C,CAAC;AACtH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,OAAO,GAAG,IAAI,IAAI,KAAK,aAAa,kBAAkB,0CAA0C,CAAC;AACnG,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,OAAO;KACb,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/lib/prisma.d.ts

@@ -0,0 +1,7 @@
+import { PrismaClient } from "./generated/prisma/index.js";
+import type { Observable } from "@bsb/base";
+export declare function initializePrisma(connectionString: string, obs?: Observable): Promise<PrismaClient>;
+export declare function configurePrisma(connectionString: string): PrismaClient;
+export declare function getPrisma(): PrismaClient;
+export declare const prisma: PrismaClient<import("./generated/prisma/index.js").Prisma.PrismaClientOptions, never, import("./generated/prisma/runtime/client.js").DefaultArgs>;
+//# sourceMappingURL=prisma.d.ts.map

package/lib/prisma.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.d.ts","sourceRoot":"","sources":["../src/prisma.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAO3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAS5C,wBAAsB,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAGxG;AAED,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,YAAY,CAgBtE;AA0HD,wBAAgB,SAAS,IAAI,YAAY,CAKxC;AAED,eAAO,MAAM,MAAM,mJAMjB,CAAC"}