@dainprotocol/tunnel 2.0.0 → 2.0.1

package/dist/server/index.d.ts

@@ -9,7 +9,9 @@ declare class DainTunnelServer {
     private challenges;
     private sseConnections;
     private wsConnections;
+    private pendingProxiedWSEvents;
     private tunnelRequestCount;
+    private buildCorsHeaders;
     private safeSend;
     private decrementRequestCount;
     private buildForwardedHeaders;
@@ -26,6 +28,7 @@ declare class DainTunnelServer {
     private handleSSEMessage;
     private cleanupSSEConnection;
     private handleWebSocketMessage;
+    private flushPendingWebSocketEvents;
     private handleRequest;
     private handleSSERequest;
     private removeTunnel;

package/dist/server/index.js

@@ -15,6 +15,7 @@ const LIMITS = {
     MAX_MISSED_PONGS: 2,
     MAX_PAYLOAD_BYTES: 100 * 1024 * 1024,
     BACKPRESSURE_THRESHOLD: 1024 * 1024,
+    MAX_PENDING_WS_EVENTS_PER_CONNECTION: 256,
     SERVER_MAX_HEADERS: 100,
     WS_BACKLOG: 100,
     TUNNEL_RETRY_COUNT: 2,
@@ -52,6 +53,21 @@ function isCorsOriginAllowed(origin, allowedOrigins) {
 }
 const ALLOWED_CORS_ORIGINS = parseAllowedCorsOrigins(process.env.TUNNEL_ALLOWED_ORIGINS || process.env.CORS_ALLOWED_ORIGINS);
 class DainTunnelServer {
+    buildCorsHeaders(origin) {
+        const headers = {
+            "access-control-allow-methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+            "access-control-allow-headers": "X-DAIN-SIGNATURE, X-DAIN-SMART-ACCOUNT-PDA, X-DAIN-AGENT-ID, X-DAIN-ORG-ID, X-DAIN-ADDRESS, X-DAIN-TIMESTAMP, X-DAIN-WEBHOOK-URL, X-Service, X-Service-Token, Content-Type, Authorization, Accept, Origin, X-Requested-With",
+        };
+        if (origin && isCorsOriginAllowed(origin, this.allowedCorsOrigins)) {
+            headers["access-control-allow-origin"] = origin;
+            headers["access-control-allow-credentials"] = "true";
+            headers["vary"] = "Origin";
+        }
+        else if (!origin) {
+            headers["access-control-allow-origin"] = "*";
+        }
+        return headers;
+    }
     safeSend(ws, data) {
         try {
             if (ws.readyState === 1) { // WebSocket.OPEN
@@ -99,6 +115,7 @@ class DainTunnelServer {
         this.challenges = new Map();
         this.sseConnections = new Map();
         this.wsConnections = new Map();
+        this.pendingProxiedWSEvents = new Map();
         this.tunnelRequestCount = new Map();
         this.app = new Hono();
         this.setupRoutes();
@@ -314,7 +331,7 @@ class DainTunnelServer {
         const pendingRequest = this.pendingRequests.get(data.requestId);
         if (!pendingRequest)
             return;
-        const { resolve, tunnelId, timeoutId } = pendingRequest;
+        const { resolve, tunnelId, timeoutId, origin } = pendingRequest;
         this.pendingRequests.delete(data.requestId);
         if (timeoutId)
             clearTimeout(timeoutId);
@@ -322,6 +339,8 @@ class DainTunnelServer {
         const headers = data.headers;
         delete headers["transfer-encoding"];
         delete headers["content-length"];
+        // Inject CORS headers — Hono middleware doesn't apply to Promise-resolved responses
+        Object.assign(headers, this.buildCorsHeaders(origin));
         const bodyBuffer = Buffer.from(data.body, "base64");
         headers["content-length"] = bodyBuffer.length.toString();
         resolve(new Response(bodyBuffer, {
@@ -373,8 +392,28 @@ class DainTunnelServer {
     }
     handleWebSocketMessage(data) {
         const connection = this.wsConnections.get(data.id);
-        if (!connection)
+        if (!connection) {
+            const pendingEvents = this.pendingProxiedWSEvents.get(data.id);
+            if (!pendingEvents)
+                return;
+            if (data.event === "message" &&
+                pendingEvents.length >= LIMITS.MAX_PENDING_WS_EVENTS_PER_CONNECTION) {
+                pendingEvents.push({
+                    type: "websocket",
+                    id: data.id,
+                    event: "error",
+                    data: "WebSocket downstream overloaded",
+                });
+                pendingEvents.push({
+                    type: "websocket",
+                    id: data.id,
+                    event: "close",
+                });
+                return;
+            }
+            pendingEvents.push(data);
             return;
+        }
         const { clientSocket } = connection;
         const isOpen = clientSocket.readyState === 1;
         switch (data.event) {
@@ -394,6 +433,17 @@ class DainTunnelServer {
                 break;
         }
     }
+    flushPendingWebSocketEvents(id) {
+        const pendingEvents = this.pendingProxiedWSEvents.get(id);
+        if (!pendingEvents || pendingEvents.length === 0) {
+            this.pendingProxiedWSEvents.delete(id);
+            return;
+        }
+        this.pendingProxiedWSEvents.delete(id);
+        for (const event of pendingEvents) {
+            this.handleWebSocketMessage(event);
+        }
+    }
     async handleRequest(c) {
         const tunnelId = c.req.param("tunnelId");
         if (!tunnelId || !tunnelId.includes("_")) {
@@ -453,6 +503,8 @@ class DainTunnelServer {
             }
             catch { }
         }
+        const origin = c.req.header("origin");
+        const corsHeaders = this.buildCorsHeaders(origin);
         return new Promise((resolve) => {
             const timeoutId = setTimeout(() => {
                 const pendingRequest = this.pendingRequests.get(requestId);
@@ -461,11 +513,11 @@ class DainTunnelServer {
                     this.pendingRequests.delete(requestId);
                     resolve(new Response(JSON.stringify({ error: "Gateway Timeout", message: "Request timed out" }), {
                         status: 504,
-                        headers: { "content-type": "application/json" },
+                        headers: { "content-type": "application/json", ...corsHeaders },
                     }));
                 }
             }, TIMEOUTS.REQUEST_TIMEOUT);
-            this.pendingRequests.set(requestId, { resolve, startTime: Date.now(), tunnelId, timeoutId });
+            this.pendingRequests.set(requestId, { resolve, startTime: Date.now(), tunnelId, timeoutId, origin });
             const sent = this.safeSend(tunnel.ws, {
                 type: "request",
                 id: requestId,
@@ -480,19 +532,35 @@ class DainTunnelServer {
                 this.decrementRequestCount(tunnelId);
                 resolve(new Response(JSON.stringify({ error: "Bad Gateway", message: "Tunnel connection lost" }), {
                     status: 502,
-                    headers: { "content-type": "application/json" },
+                    headers: { "content-type": "application/json", ...corsHeaders },
                 }));
             }
         });
     }
-    handleSSERequest(c, tunnelId, tunnel) {
+    async handleSSERequest(c, tunnelId, tunnel) {
         const sseId = fastId();
+        const requestUrl = new URL(c.req.url);
+        let path = requestUrl.pathname.slice(`/${tunnelId}`.length) || "/";
+        if (requestUrl.search)
+            path += requestUrl.search;
         // Extract headers
         const reqHeaders = {};
         c.req.raw.headers.forEach((value, key) => {
             reqHeaders[key] = value;
         });
         const forwardedHeaders = this.buildForwardedHeaders(reqHeaders, tunnelId);
+        let bodyBase64;
+        if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+            try {
+                const bodyBuffer = await c.req.arrayBuffer();
+                if (bodyBuffer.byteLength > 0) {
+                    bodyBase64 = Buffer.from(bodyBuffer).toString("base64");
+                }
+            }
+            catch {
+                // Best-effort body forwarding for streaming requests
+            }
+        }
         const origin = c.req.header("origin");
         const responseHeaders = {
             'Content-Type': 'text/event-stream',
@@ -540,9 +608,10 @@ class DainTunnelServer {
                 const sent = this.safeSend(tunnel.ws, {
                     type: "sse_connection",
                     id: sseId,
-                    path: new URL(c.req.url).pathname.slice(`/${tunnelId}`.length) || '/',
+                    path,
                     method: c.req.method,
                     headers: forwardedHeaders,
+                    body: bodyBase64,
                 });
                 if (!sent) {
                     this.cleanupSSEConnection(sseId, tunnelId);
@@ -604,7 +673,10 @@ class DainTunnelServer {
                     clearTimeout(pending.timeoutId);
                 pending.resolve(new Response(JSON.stringify({ error: "Bad Gateway", message: "Tunnel closed" }), {
                     status: 502,
-                    headers: { "content-type": "application/json" },
+                    headers: {
+                        "content-type": "application/json",
+                        ...this.buildCorsHeaders(pending.origin),
+                    },
                 }));
                 this.pendingRequests.delete(requestId);
             }
@@ -678,6 +750,13 @@ class DainTunnelServer {
                         reqHeaders[key] = value;
                     });
                     const forwardedHeaders = self.buildForwardedHeaders(reqHeaders, tunnelId);
+                    self._pendingProxiedWs = self._pendingProxiedWs || new Map();
+                    self._pendingProxiedWs.set(wsConnectionId, {
+                        tunnelId,
+                        path: remainingPath,
+                        headers: forwardedHeaders,
+                    });
+                    self.pendingProxiedWSEvents.set(wsConnectionId, []);
                     const success = server.upgrade(req, {
                         data: {
                             isProxiedWebSocket: true,
@@ -686,13 +765,6 @@ class DainTunnelServer {
                         },
                     });
                     if (success) {
-                        // Store setup info so open handler can register the connection
-                        self._pendingProxiedWs = self._pendingProxiedWs || new Map();
-                        self._pendingProxiedWs.set(wsConnectionId, {
-                            tunnelId,
-                            path: remainingPath,
-                            headers: forwardedHeaders,
-                        });
                         self.safeSend(tunnel.ws, {
                             type: "websocket_connection",
                             id: wsConnectionId,
@@ -701,6 +773,8 @@ class DainTunnelServer {
                         });
                         return undefined;
                     }
+                    self._pendingProxiedWs?.delete(wsConnectionId);
+                    self.pendingProxiedWSEvents.delete(wsConnectionId);
                     return new Response("WebSocket upgrade failed", { status: 400 });
                 }
                 // Regular HTTP request - pass to Hono
@@ -720,6 +794,7 @@ class DainTunnelServer {
                                 tunnelId: pending.tunnelId,
                             });
                             pendingMap.delete(ws.data.proxiedWsId);
+                            self.flushPendingWebSocketEvents(ws.data.proxiedWsId);
                         }
                     }
                     self.handleWsOpen(ws);
@@ -760,9 +835,15 @@ class DainTunnelServer {
             for (const [requestId, pending] of this.pendingRequests.entries()) {
                 if (pending.timeoutId)
                     clearTimeout(pending.timeoutId);
-                pending.resolve(new Response(JSON.stringify({ error: "Service Unavailable", message: "Server shutting down" }), {
+                pending.resolve(new Response(JSON.stringify({
+                    error: "Service Unavailable",
+                    message: "Server shutting down",
+                }), {
                     status: 503,
-                    headers: { "content-type": "application/json" },
+                    headers: {
+                        "content-type": "application/json",
+                        ...this.buildCorsHeaders(pending.origin),
+                    },
                 }));
                 this.pendingRequests.delete(requestId);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dainprotocol/tunnel",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "",
   "main": "dist/index.js",
   "private": false,
@@ -9,6 +9,7 @@
   },
   "scripts": {
     "build": "tsc",
+    "build:production": "tsc && bun build dist/server/start.js --outdir dist-prod --target bun --minify --sourcemap=external",
     "build:types": "tsc --emitDeclarationOnly",
     "test": "bun test",
     "prepublishOnly": "npm run build && npm run build:types",
@@ -19,7 +20,7 @@
   "author": "Ryan",
   "license": "ISC",
   "dependencies": {
-    "@dainprotocol/service-sdk": "2.0.88",
+    "@dainprotocol/service-sdk": "2.0.91",
     "@types/node": "^22.5.4",
     "@types/ws": "^8.5.12",
     "hono": "^4.7.0",