@danneillouven/remote-workspace 0.0.0-stage → 0.1.0

package/package.json

@@ -1,6 +1,83 @@
 {
   "name": "@danneillouven/remote-workspace",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "node scripts/dev.mjs",
+    "dev:web": "vite",
+    "dev:server": "node --watch --env-file-if-exists=.env server/src/main.ts",
+    "build": "tsc -b && vite build && tsc -p tsconfig.package.json",
+    "start": "npm run build && npm run serve",
+    "serve": "NODE_ENV=production node --env-file-if-exists=.env server/src/main.ts",
+    "start:tunnel": "npm run build && node --env-file-if-exists=.env scripts/tunnel.mjs",
+    "typecheck": "tsc -b",
+    "lint": "oxlint",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "reset-password": "node --env-file-if-exists=.env server/src/scripts/reset-password.ts",
+    "preview": "vite preview",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "@codemirror/commands": "^6.11.1",
+    "@codemirror/language": "^6.13.1",
+    "@codemirror/language-data": "^6.5.2",
+    "@codemirror/search": "^6.7.2",
+    "@codemirror/state": "^6.7.6",
+    "@codemirror/view": "^6.43.15",
+    "@fastify/cookie": "^11.1.3",
+    "@fastify/static": "^10.1.7",
+    "@fastify/websocket": "^11.3.4",
+    "@lezer/highlight": "^1.2.5",
+    "@tailwindcss/vite": "^4.3.3",
+    "@tanstack/react-query": "^5.104.4",
+    "@tanstack/react-router": "^1.170.45",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/addon-unicode11": "^0.9.0",
+    "@xterm/xterm": "^6.0.0",
+    "axios": "^1.20.0",
+    "fastify": "^5.12.7",
+    "lucide-react": "^1.61.0",
+    "material-icon-theme": "^5.39.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-markdown": "^10.1.0",
+    "remark-gfm": "^4.0.1",
+    "ssh2": "^1.17.0",
+    "tailwindcss": "^4.3.3",
+    "zod": "^4.6.7",
+    "zustand": "^5.0.15"
+  },
+  "devDependencies": {
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "^24.19.2",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.7",
+    "@types/ssh2": "^1.15.6",
+    "@types/ws": "^8.18.2",
+    "@vitejs/plugin-react": "^6.1.1",
+    "jsdom": "^29.1.1",
+    "oxlint": "^1.81.0",
+    "typescript": "~6.0.2",
+    "vite": "^8.3.0",
+    "vitest": "^5.0.5",
+    "ws": "^8.22.0"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "bin": {
+    "remote-workspace": "./bin/remote-workspace.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "bin/",
+    "dist/",
+    "runtime/",
+    "docs/",
+    ".env.example"
+  ]
+}

package/runtime/server/src/app.js

@@ -0,0 +1,71 @@
+import path from 'node:path';
+import fastifyCookie from '@fastify/cookie';
+import fastifyStatic from '@fastify/static';
+import fastifyWebsocket from '@fastify/websocket';
+import Fastify, {} from 'fastify';
+import { isAppError } from "./lib/errors.js";
+import { registerAuthGuards, registerSecurityHeaders } from "./modules/auth/auth-security.js";
+import { registerAuthRoutes } from "./modules/auth/auth.routes.js";
+import { registerGitRoutes } from "./modules/git/git.routes.js";
+import { registerHostRoutes } from "./modules/hosts/host.routes.js";
+import { registerTerminalRoutes } from "./modules/terminal/terminal.routes.js";
+import { registerWorkspaceRoutes } from "./modules/workspace/workspace.routes.js";
+function errorBody(code, message) {
+    return { error: { code, message } };
+}
+export function createServer(config, logger) {
+    return Fastify({
+        logger: logger ?? {
+            level: config.logLevel,
+            redact: ['req.headers.cookie', 'req.headers.authorization', 'res.headers["set-cookie"]'],
+        },
+        // Only trust X-Forwarded-* from a reverse proxy on this machine (e.g. `tailscale serve`).
+        trustProxy: config.trustProxy ? ['127.0.0.1', '::1'] : false,
+        bodyLimit: 1024 * 1024,
+    });
+}
+export async function registerApp(app, config, services) {
+    await app.register(fastifyCookie);
+    await app.register(fastifyWebsocket, { options: { maxPayload: 1024 * 1024 } });
+    registerSecurityHeaders(app, config);
+    registerAuthGuards(app, config, services.tokens);
+    app.setErrorHandler((error, request, reply) => {
+        if (isAppError(error)) {
+            if (error.statusCode >= 500)
+                request.log.error({ err: error.cause ?? error, code: error.code }, error.message);
+            return reply.status(error.statusCode).send(errorBody(error.code, error.message));
+        }
+        if (error.statusCode && error.statusCode >= 400 && error.statusCode < 500) {
+            return reply.status(error.statusCode).send(errorBody('BAD_REQUEST', error.message));
+        }
+        // Never leak internal details or stack traces to the browser.
+        request.log.error({ err: error }, 'unhandled error');
+        return reply.status(500).send(errorBody('INTERNAL', 'Internal server error.'));
+    });
+    app.get('/api/health', async () => ({ status: 'ok' }));
+    registerAuthRoutes(app, config, services.auth, services.tokens, services.limiter);
+    registerHostRoutes(app, services.hosts, services.workspaces);
+    registerWorkspaceRoutes(app, services.workspaces, config.limits.maxFileBytes);
+    registerGitRoutes(app, services.workspaces, services.commitMessages);
+    registerTerminalRoutes(app, services.terminals, services.tokens);
+    const staticDir = config.staticDir;
+    if (staticDir) {
+        await app.register(fastifyStatic, {
+            root: staticDir,
+            wildcard: false,
+            setHeaders(res, filePath) {
+                const hashedAsset = path.relative(staticDir, filePath).startsWith(`assets${path.sep}`);
+                res.header('Cache-Control', hashedAsset ? 'public, max-age=31536000, immutable' : 'no-cache');
+            },
+        });
+    }
+    app.setNotFoundHandler((request, reply) => {
+        const isApi = request.url.startsWith('/api/') || request.url.startsWith('/ws/');
+        if (staticDir && !isApi && request.method === 'GET') {
+            // Client-side routes (e.g. /login, /setup) fall back to the SPA entry point.
+            reply.header('Cache-Control', 'no-cache');
+            return reply.type('text/html').sendFile('index.html');
+        }
+        return reply.status(404).send(errorBody('NOT_FOUND', 'Not found.'));
+    });
+}

package/runtime/server/src/config/config.js

@@ -0,0 +1,173 @@
+import { accessSync, constants, existsSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { z } from 'zod';
+export class ConfigError extends Error {
+    issues;
+    constructor(issues) {
+        super(`Invalid configuration:\n${issues.map((issue) => `  - ${issue}`).join('\n')}`);
+        this.name = 'ConfigError';
+        this.issues = issues;
+    }
+}
+const optionalString = z
+    .string()
+    .trim()
+    .optional()
+    .transform((value) => (value ? value : undefined));
+const booleanString = z
+    .enum(['true', 'false', '1', '0', 'yes', 'no'])
+    .transform((value) => value === 'true' || value === '1' || value === 'yes');
+const originList = z
+    .string()
+    .trim()
+    .optional()
+    .transform((value, ctx) => {
+    const origins = [];
+    for (const raw of (value ?? '').split(',').map((item) => item.trim()).filter(Boolean)) {
+        try {
+            const url = new URL(raw);
+            if (url.protocol !== 'http:' && url.protocol !== 'https:')
+                throw new Error('protocol');
+            if (!['localhost', '127.0.0.1', '[::1]'].includes(url.hostname) && !url.hostname.endsWith('.ts.net'))
+                throw new Error('private origin');
+            origins.push(url.origin);
+        }
+        catch {
+            ctx.addIssue({ code: 'custom', message: `"${raw}" is not a valid private http(s) origin (use localhost or a *.ts.net address)` });
+        }
+    }
+    return origins;
+});
+const pathList = z.string().optional().transform((value, ctx) => {
+    try {
+        const result = z.array(z.string().min(1).refine((item) => item.startsWith('/') && !item.includes('\0'))).parse(JSON.parse(value ?? '[]'));
+        return [...new Set(result.map((item) => path.posix.normalize(item)))];
+    }
+    catch {
+        ctx.addIssue({ code: 'custom', message: 'must be a JSON array of absolute directory paths' });
+        return [];
+    }
+});
+const envSchema = z.object({
+    NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
+    HOST: z.enum(['127.0.0.1', '::1']).default('127.0.0.1'),
+    PORT: z.coerce.number().int().min(1).max(65_535).default(4280),
+    LOG_LEVEL: z.enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace', 'silent']).default('info'),
+    // Trusts X-Forwarded-* only from proxies on this machine (e.g. `tailscale serve`).
+    TRUST_PROXY: booleanString.default(true),
+    ALLOWED_ORIGINS: originList,
+    // The tunnel's own hostname, so unlike ALLOWED_ORIGINS it may be public; HTTPS only (cookies are Secure).
+    PUBLIC_URL: z
+        .string()
+        .trim()
+        .optional()
+        .transform((value, ctx) => {
+        if (!value)
+            return [];
+        try {
+            const url = new URL(value);
+            if (url.protocol !== 'https:' || value.includes(','))
+                throw new Error('not a single https URL');
+            return [url.origin];
+        }
+        catch {
+            ctx.addIssue({ code: 'custom', message: `"${value}" must be a single https:// URL` });
+            return [];
+        }
+    }),
+    DATA_DIR: optionalString,
+    LOCAL_WORKSPACE_ROOTS: pathList,
+    SSH_WORKSPACE_ROOTS: pathList,
+    AI_COMMIT_ENABLED: booleanString.default(false),
+    SESSION_TTL_HOURS: z.coerce.number().positive().max(24).default(8),
+    SESSION_IDLE_MINUTES: z.coerce.number().positive().max(120).default(30),
+    COOKIE_SECURE: z.enum(['auto', 'true', 'false']).default('auto'),
+    SSH_READY_TIMEOUT_MS: z.coerce.number().int().min(1000).max(120_000).default(20_000),
+    SSH_KEEPALIVE_INTERVAL_MS: z.coerce.number().int().min(0).max(300_000).default(15_000),
+    SSH_KNOWN_HOSTS_PATH: optionalString,
+    TERMINAL_TERM: z.string().trim().regex(/^[A-Za-z0-9._+-]+$/).default('xterm-256color'),
+    TERMINAL_MAX_SESSIONS: z.coerce.number().int().min(1).max(64).default(10),
+    TERMINAL_REPLAY_BUFFER_BYTES: z.coerce.number().int().min(16 * 1024).max(16 * 1024 * 1024).default(512 * 1024),
+    TERMINAL_ORPHAN_TIMEOUT_MINUTES: z.coerce.number().min(0).max(7 * 24 * 60).default(0),
+    MAX_FILE_BYTES: z.coerce.number().int().min(1024).max(64 * 1024 * 1024).default(2 * 1024 * 1024),
+    MAX_IMAGE_BYTES: z.coerce.number().int().min(1024).max(256 * 1024 * 1024).default(20 * 1024 * 1024),
+    MAX_DIFF_BYTES: z.coerce.number().int().min(1024).max(64 * 1024 * 1024).default(4 * 1024 * 1024),
+    MAX_DIR_ENTRIES: z.coerce.number().int().min(100).max(100_000).default(5000),
+    STATIC_DIR: optionalString,
+});
+export function expandHome(value) {
+    return value === '~' || value.startsWith('~/') ? path.join(os.homedir(), value.slice(1)) : value;
+}
+/** Parse and validate configuration. Throws ConfigError listing every problem. */
+export function loadConfig(source = process.env, cwd = process.cwd()) {
+    const parsed = envSchema.safeParse(source);
+    if (!parsed.success) {
+        throw new ConfigError(parsed.error.issues.map((issue) => `${issue.path.join('.') || 'config'}: ${issue.message}`));
+    }
+    const env = parsed.data;
+    const issues = [];
+    // Serve the built frontend when it exists, so `npm start` needs no configuration.
+    let staticDir = null;
+    if (env.STATIC_DIR) {
+        staticDir = path.resolve(cwd, env.STATIC_DIR);
+        try {
+            accessSync(path.join(staticDir, 'index.html'), constants.R_OK);
+        }
+        catch {
+            issues.push(`STATIC_DIR: ${staticDir}/index.html not found (run \`npm run build\` first)`);
+        }
+    }
+    else if (env.NODE_ENV !== 'test' && existsSync(path.join(cwd, 'dist', 'index.html'))) {
+        staticDir = path.join(cwd, 'dist');
+    }
+    if (env.NODE_ENV === 'production' && env.COOKIE_SECURE === 'false')
+        issues.push('COOKIE_SECURE: cannot disable secure cookies in production');
+    if (issues.length > 0)
+        throw new ConfigError(issues);
+    return {
+        env: env.NODE_ENV,
+        host: env.HOST,
+        port: env.PORT,
+        logLevel: env.LOG_LEVEL,
+        trustProxy: env.TRUST_PROXY,
+        allowedOrigins: [...new Set([...env.ALLOWED_ORIGINS, ...env.PUBLIC_URL])],
+        publicUrl: env.PUBLIC_URL[0] ?? null,
+        dataDir: path.resolve(cwd, expandHome(env.DATA_DIR ?? 'data')),
+        workspace: {
+            localRoots: env.LOCAL_WORKSPACE_ROOTS,
+            sshRoots: env.SSH_WORKSPACE_ROOTS,
+            protectedPaths: [
+                path.resolve(cwd), path.resolve(cwd, expandHome(env.DATA_DIR ?? 'data')),
+                ...['.ssh', '.config', '.aws', '.azure', '.kube', '.gnupg', '.claude', '.codex'].map((name) => path.join(os.homedir(), name)),
+                '/proc', '/dev', '/sys',
+            ],
+        },
+        aiCommitEnabled: env.AI_COMMIT_ENABLED,
+        auth: {
+            sessionTtlMs: env.SESSION_TTL_HOURS * 60 * 60 * 1000,
+            sessionIdleMs: env.SESSION_IDLE_MINUTES * 60 * 1000,
+            cookieSecure: env.COOKIE_SECURE === 'auto' ? 'auto' : env.COOKIE_SECURE === 'true',
+        },
+        ssh: {
+            readyTimeoutMs: env.SSH_READY_TIMEOUT_MS,
+            keepaliveIntervalMs: env.SSH_KEEPALIVE_INTERVAL_MS,
+            agentSocket: source.SSH_AUTH_SOCK || null,
+            knownHostsPath: expandHome(env.SSH_KNOWN_HOSTS_PATH ?? '~/.ssh/known_hosts'),
+        },
+        terminal: {
+            term: env.TERMINAL_TERM,
+            maxSessions: env.TERMINAL_MAX_SESSIONS,
+            replayBufferBytes: env.TERMINAL_REPLAY_BUFFER_BYTES,
+            orphanTimeoutMs: env.TERMINAL_ORPHAN_TIMEOUT_MINUTES * 60 * 1000,
+        },
+        limits: {
+            maxFileBytes: env.MAX_FILE_BYTES,
+            maxImageBytes: env.MAX_IMAGE_BYTES,
+            maxDiffBytes: env.MAX_DIFF_BYTES,
+            maxDirEntries: env.MAX_DIR_ENTRIES,
+            maxGitChanges: 5000,
+        },
+        staticDir,
+    };
+}

package/runtime/server/src/lib/concurrency.js

@@ -0,0 +1,44 @@
+/** Minimal FIFO semaphore used to cap concurrent SSH channels. */
+export class Semaphore {
+    #available;
+    #waiters = [];
+    constructor(permits) {
+        this.#available = permits;
+    }
+    async run(task) {
+        await this.#acquire();
+        try {
+            return await task();
+        }
+        finally {
+            this.#release();
+        }
+    }
+    #acquire() {
+        if (this.#available > 0) {
+            this.#available -= 1;
+            return Promise.resolve();
+        }
+        return new Promise((resolve) => this.#waiters.push(resolve));
+    }
+    #release() {
+        const next = this.#waiters.shift();
+        if (next)
+            next();
+        else
+            this.#available += 1;
+    }
+}
+/** Map over items with at most `limit` promises in flight, preserving order. */
+export async function mapWithConcurrency(items, limit, mapper) {
+    const results = new Array(items.length);
+    let index = 0;
+    const worker = async () => {
+        while (index < items.length) {
+            const current = index++;
+            results[current] = await mapper(items[current]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return results;
+}

package/runtime/server/src/lib/errors.js

@@ -0,0 +1,39 @@
+const defaultStatus = {
+    BAD_REQUEST: 400,
+    UNAUTHORIZED: 401,
+    FORBIDDEN: 403,
+    NOT_FOUND: 404,
+    CONFLICT: 409,
+    SETUP_REQUIRED: 409,
+    PATH_OUTSIDE_WORKSPACE: 403,
+    PERMISSION_DENIED: 403,
+    NOT_A_DIRECTORY: 400,
+    NOT_A_FILE: 400,
+    REMOTE_UNAVAILABLE: 503,
+    TIMEOUT: 504,
+    NOT_A_REPOSITORY: 404,
+    GIT_ERROR: 500,
+    GENERATION_FAILED: 502,
+    TERMINAL_UNAVAILABLE: 503,
+    TERMINAL_LIMIT: 429,
+    SESSION_NOT_FOUND: 404,
+    TOO_MANY_REQUESTS: 429,
+    INTERNAL: 500,
+};
+/**
+ * Error whose `message` is safe to show to the browser. Anything that is not
+ * an AppError is reported to clients as a generic INTERNAL error.
+ */
+export class AppError extends Error {
+    code;
+    statusCode;
+    constructor(code, message, options) {
+        super(message, { cause: options?.cause });
+        this.name = 'AppError';
+        this.code = code;
+        this.statusCode = options?.statusCode ?? defaultStatus[code];
+    }
+}
+export function isAppError(error) {
+    return error instanceof AppError;
+}

package/runtime/server/src/lib/http-range.js

@@ -0,0 +1,27 @@
+/**
+ * Parse a `Range: bytes=...` request header against a file of `size` bytes.
+ * Returns null to send the whole file (no header, an unsupported unit, or several
+ * ranges, which a server may answer in full) and 'unsatisfiable' for a 416.
+ */
+export function parseByteRange(header, size) {
+    if (!header || size === 0)
+        return null;
+    const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+    if (!match)
+        return null;
+    const [, first, last] = match;
+    if (first === '' && last === '')
+        return null;
+    if (first === '') {
+        // Suffix range: the last N bytes.
+        const length = Number(last);
+        if (length === 0)
+            return 'unsatisfiable';
+        return { start: Math.max(0, size - length), end: size - 1 };
+    }
+    const start = Number(first);
+    const end = last === '' ? size - 1 : Math.min(Number(last), size - 1);
+    if (start >= size || end < start)
+        return 'unsatisfiable';
+    return { start, end };
+}

package/runtime/server/src/lib/shell-quote.js

@@ -0,0 +1,14 @@
+/**
+ * Quote a single argument for a POSIX shell (sh, bash, zsh, dash, ksh).
+ * Everything is wrapped in single quotes; embedded single quotes are closed,
+ * escaped, and reopened. NUL bytes cannot be represented and are rejected.
+ */
+export function quoteShellArg(value) {
+    if (value.includes('\0')) {
+        throw new Error('Shell arguments must not contain NUL bytes');
+    }
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+export function buildShellCommand(argv) {
+    return argv.map(quoteShellArg).join(' ');
+}

package/runtime/server/src/lib/validation.js

@@ -0,0 +1,11 @@
+import { AppError } from "./errors.js";
+/** Parse untrusted input, converting validation failures into a 400 AppError. */
+export function parseInput(schema, input) {
+    const result = schema.safeParse(input);
+    if (!result.success) {
+        const issue = result.error.issues[0];
+        const where = issue?.path.length ? `${issue.path.join('.')}: ` : '';
+        throw new AppError('BAD_REQUEST', `${where}${issue?.message ?? 'Invalid request.'}`);
+    }
+    return result.data;
+}

package/runtime/server/src/main.js

@@ -0,0 +1,70 @@
+import path from 'node:path';
+import { createServer, registerApp } from "./app.js";
+import { ConfigError, loadConfig } from "./config/config.js";
+import { AppStore, StoreError } from "./modules/store/app-store.js";
+import { createServices } from "./services.js";
+function fail(message) {
+    console.error(message);
+    process.exit(1);
+}
+function readConfig() {
+    try {
+        return loadConfig();
+    }
+    catch (error) {
+        if (error instanceof ConfigError)
+            fail(`${error.message}\n\nSee .env.example and docs/configuration.md.`);
+        throw error;
+    }
+}
+function openStore(dataDir) {
+    try {
+        return AppStore.open(dataDir);
+    }
+    catch (error) {
+        if (error instanceof StoreError)
+            fail(error.message);
+        throw error;
+    }
+}
+const LOOPBACK = ['127.0.0.1', '::1', 'localhost', '0.0.0.0', '::'];
+/** Human-readable startup hints on stdout (separate from the JSON logs). */
+function printBanner(config, setupToken) {
+    const serverUrl = `http://${LOOPBACK.includes(config.host) ? 'localhost' : config.host}:${config.port}`;
+    // Without a built frontend the UI comes from the Vite dev server (npm run dev).
+    const uiUrl = config.staticDir ? serverUrl : 'http://localhost:5173';
+    const lines = ['', '  Remote Workspace is running', `  ➜ Open:  ${uiUrl}`];
+    if (config.publicUrl)
+        lines.push(`  ➜ Public: ${config.publicUrl}`);
+    if (setupToken) {
+        lines.push('', '  First-time setup — open this one-time link to create your password:', `  ➜ ${uiUrl}/setup#token=${setupToken}`, ...(config.publicUrl && config.staticDir ? [`  ➜ ${config.publicUrl}/setup#token=${setupToken}`] : []), `    (token also saved in ${path.join(config.dataDir, 'setup-token')}; it stops working after setup)`);
+    }
+    if (!config.staticDir)
+        lines.push('', '  No built frontend found: start the UI with `npm run dev`, or run `npm start` to build and serve it.');
+    process.stdout.write(`${lines.join('\n')}\n\n`);
+}
+const config = readConfig();
+const store = openStore(config.dataDir);
+const app = createServer(config);
+const services = createServices(config, store, app.log);
+app.addHook('onClose', async () => services.dispose());
+await registerApp(app, config, services);
+process.on('unhandledRejection', (reason) => app.log.error({ err: reason }, 'unhandled promise rejection'));
+let shuttingDown = false;
+async function shutdown(signal) {
+    if (shuttingDown)
+        return;
+    shuttingDown = true;
+    app.log.info({ signal }, 'shutting down');
+    setTimeout(() => process.exit(1), 10_000).unref();
+    await app.close();
+    process.exit(0);
+}
+process.once('SIGINT', (signal) => void shutdown(signal));
+process.once('SIGTERM', (signal) => void shutdown(signal));
+await app.listen({ host: config.host, port: config.port });
+if (!['127.0.0.1', '::1', 'localhost'].includes(config.host)) {
+    app.log.warn({ host: config.host }, 'listening on a non-loopback address; make sure it is only reachable from your tailnet');
+}
+app.log.info({ dataDir: config.dataDir, hosts: store.state.hosts.length, projects: store.state.workspaces.length, setupRequired: services.auth.setupRequired }, 'remote workspace ready');
+printBanner(config, services.auth.setupToken);

package/runtime/server/src/modules/auth/auth-security.js

@@ -0,0 +1,104 @@
+import { isIP } from 'node:net';
+import { AppError } from "../../lib/errors.js";
+export const SESSION_COOKIE = 'rw_session';
+const PUBLIC_API_ROUTES = new Set(['/api/health', '/api/auth/login', '/api/auth/session', '/api/auth/setup']);
+function requestPath(request) {
+    const queryIndex = request.url.indexOf('?');
+    return queryIndex === -1 ? request.url : request.url.slice(0, queryIndex);
+}
+function isTrustedHostname(hostname) {
+    const bare = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    return bare === 'localhost' || bare.endsWith('.localhost') || isIP(bare) !== 0 || bare.endsWith('.ts.net');
+}
+/**
+ * Whether a browser Origin may make state-changing requests. Accepted:
+ *  - origins listed in ALLOWED_ORIGINS;
+ *  - same-origin requests (Origin matches the Host the browser used) when that
+ *    host is a loopback name, an IP literal, or a Tailscale *.ts.net name.
+ * A DNS-rebinding page always carries the attacker's own domain in both Origin
+ * and Host, so it fails the hostname check; other sites fail the equality check.
+ */
+export function isTrustedOrigin(origin, requestHost, allowedOrigins) {
+    if (!origin)
+        return false;
+    if (allowedOrigins.has(origin))
+        return true;
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        return false;
+    return url.host === requestHost.toLowerCase() && isTrustedHostname(url.hostname);
+}
+/**
+ * Global request guards for /api and /ws:
+ *  - state-changing requests and WebSocket upgrades must carry an allowed Origin
+ *    (CSRF and cross-site WebSocket hijacking protection);
+ *  - everything except a few public endpoints requires a valid session cookie.
+ * The static SPA bundle is public: it contains no data or secrets.
+ */
+export function registerAuthGuards(app, config, tokens) {
+    const allowedOrigins = new Set(config.allowedOrigins);
+    app.addHook('onRequest', async (request) => {
+        const path = requestPath(request);
+        const isApi = path === '/api' || path.startsWith('/api/');
+        const isSocket = path.startsWith('/ws/');
+        if (!isApi && !isSocket)
+            return;
+        if (request.headers['sec-fetch-site'] === 'cross-site') {
+            throw new AppError('FORBIDDEN', 'Cross-site requests are not allowed.');
+        }
+        const unsafe = isSocket || (request.method !== 'GET' && request.method !== 'HEAD' && request.method !== 'OPTIONS');
+        if (unsafe) {
+            const origin = request.headers.origin;
+            if (!isTrustedOrigin(origin, request.host, allowedOrigins)) {
+                request.log.warn({ origin: origin ?? null, host: request.host, path }, 'rejected request from disallowed origin');
+                throw new AppError('FORBIDDEN', 'Origin not allowed. Add the address you use to ALLOWED_ORIGINS.');
+            }
+        }
+        if (PUBLIC_API_ROUTES.has(path))
+            return;
+        const token = request.cookies[SESSION_COOKIE];
+        if (!tokens.verify(token)) {
+            throw new AppError('UNAUTHORIZED', 'Authentication required.');
+        }
+        if (unsafe && !isSocket)
+            tokens.touch(token);
+    });
+}
+function contentSecurityPolicy(config) {
+    const socketOrigins = config.allowedOrigins.map((origin) => origin.replace(/^http/, 'ws'));
+    return [
+        "default-src 'self'",
+        "script-src 'self'",
+        // CodeMirror and xterm.js inject runtime styles.
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' data:",
+        "font-src 'self' data:",
+        ['connect-src', "'self'", ...socketOrigins].join(' '),
+        "worker-src 'self' blob:",
+        "frame-ancestors 'none'",
+        "base-uri 'none'",
+        "form-action 'self'",
+        "object-src 'none'",
+    ].join('; ');
+}
+export function registerSecurityHeaders(app, config) {
+    const csp = contentSecurityPolicy(config);
+    app.addHook('onSend', async (request, reply, payload) => {
+        reply.header('X-Content-Type-Options', 'nosniff');
+        reply.header('Referrer-Policy', 'no-referrer');
+        reply.header('X-Frame-Options', 'DENY');
+        reply.header('Cross-Origin-Opener-Policy', 'same-origin');
+        if (requestPath(request).startsWith('/api/'))
+            reply.header('Cache-Control', 'no-store');
+        const contentType = reply.getHeader('content-type');
+        if (typeof contentType === 'string' && contentType.startsWith('text/html'))
+            reply.header('Content-Security-Policy', csp);
+        return payload;
+    });
+}