@dbx-tools/tunnel 0.6.120 → 0.6.124

package/src/interceptor.ts

@@ -17,11 +17,10 @@
  * @module
  */
 
-import type { ChildProcess } from "node:child_process";
 import type { Interceptor, InterceptorContext } from "@dbx-tools/appkit";
 import { log, object } from "@dbx-tools/shared-core";
-import { installFrp, resolveFrpConfig, startFrp, writeFrpConfig } from "./frp.ts";
-import { installPortr, resolvePortrConfig, startPortr, writePortrConfig } from "./portr.ts";
+import { installFrp, resolveFrpConfig, superviseFrp, writeFrpConfig } from "./frp.ts";
+import { installPortr, resolvePortrConfig, supervisePortr, writePortrConfig } from "./portr.ts";
 import { startPathProxy } from "./path-proxy.ts";
 
 const logger = log.logger("tunnel:interceptor");
@@ -61,13 +60,49 @@ export interface TunnelInterceptorOptions {
 /** Public tunnel clients supported by the interceptor and CLI. */
 export type TunnelTransport = "portr" | "frp" | "both";
 
+interface TunnelAuxiliary {
+  stop(): void;
+}
+
+interface TunnelRuntime {
+  startPortr(config: NonNullable<ReturnType<typeof resolvePortrConfig>>): Promise<TunnelAuxiliary>;
+  startFrp(
+    config: NonNullable<ReturnType<typeof resolveFrpConfig>>,
+    ctx: InterceptorContext,
+  ): Promise<TunnelAuxiliary>;
+}
+
+const defaultRuntime: TunnelRuntime = {
+  async startPortr(config) {
+    const portrEnv = await installPortr();
+    await writePortrConfig(config, portrEnv);
+    return supervisePortr(config, portrEnv);
+  },
+  async startFrp(config, ctx) {
+    const pathProxy =
+      config.stripPrefix && config.path !== "/"
+        ? await startPathProxy(config.targetPort, config.path)
+        : undefined;
+    if (pathProxy) {
+      config.targetPort = pathProxy.port;
+      ctx.onLifecycle("shutdown", () => void pathProxy.close());
+    }
+    const frpEnv = await installFrp();
+    const configPath = await writeFrpConfig(config, frpEnv);
+    const supervisor = superviseFrp(config, frpEnv, configPath);
+    return {
+      stop() {
+        supervisor.stop();
+        void pathProxy?.close();
+      },
+    };
+  },
+};
+
 /** Resolve and validate the tunnel transport selector. */
 export function resolveTunnelTransport(transport?: string): TunnelTransport {
   const resolved =
-    transport ??
-    process.env.DBX_TOOLS_TUNNEL_TRANSPORT ??
-    process.env.TUNNEL_TRANSPORT ??
-    "portr";
+    transport ?? process.env.DBX_TOOLS_TUNNEL_TRANSPORT ?? process.env.TUNNEL_TRANSPORT ?? "portr";
   if (resolved === "portr" || resolved === "frp" || resolved === "both") return resolved;
   throw new TypeError(`invalid tunnel transport: ${resolved} (expected portr, frp, or both)`);
 }
@@ -92,7 +127,10 @@ function resolvePublicPort(port?: number): number {
  *   interceptor: tunnelInterceptor(),
  * });
  */
-export function tunnelInterceptor(options: TunnelInterceptorOptions = {}): Interceptor {
+export function tunnelInterceptor(
+  options: TunnelInterceptorOptions = {},
+  runtime: TunnelRuntime = defaultRuntime,
+): Interceptor {
   return async (ctx: InterceptorContext): Promise<void> => {
     if (ctx.env.databricksHost) {
       process.env.DATABRICKS_HOST ??= ctx.env.databricksHost;
@@ -100,7 +138,7 @@ export function tunnelInterceptor(options: TunnelInterceptorOptions = {}): Inter
 
     const port = resolvePublicPort(options.port);
     const transport = resolveTunnelTransport(options.transport);
-    const children: ChildProcess[] = [];
+    const initializers: Array<Promise<TunnelAuxiliary>> = [];
     if (transport === "portr" || transport === "both") {
       const portrConfig = resolvePortrConfig({
         publicDomain: options.publicDomain,
@@ -108,9 +146,7 @@ export function tunnelInterceptor(options: TunnelInterceptorOptions = {}): Inter
         port,
       });
       if (portrConfig) {
-        const portrEnv = await installPortr();
-        await writePortrConfig(portrConfig, portrEnv);
-        children.push(await startPortr(portrConfig, portrEnv));
+        initializers.push(runtime.startPortr(portrConfig));
       } else {
         logger.info("portr not configured (requires PORTR_TOKEN and TUNNEL_PUBLIC_DOMAIN)");
       }
@@ -128,26 +164,31 @@ export function tunnelInterceptor(options: TunnelInterceptorOptions = {}): Inter
         port,
       });
       if (frpConfig) {
-        const pathProxy =
-          frpConfig.stripPrefix && frpConfig.path !== "/"
-            ? await startPathProxy(port, frpConfig.path)
-            : undefined;
-        if (pathProxy) {
-          frpConfig.targetPort = pathProxy.port;
-          ctx.onLifecycle("shutdown", () => void pathProxy.close());
-        }
-        const frpEnv = await installFrp();
-        const configPath = await writeFrpConfig(frpConfig, frpEnv);
-        children.push(startFrp(frpConfig, frpEnv, configPath));
+        initializers.push(runtime.startFrp(frpConfig, ctx));
       } else {
         logger.info("frp not configured (requires TUNNEL_PUBLIC_DOMAIN)");
       }
     }
-    if (!children.length) return;
-    for (const child of children) ctx.bindProcess(child);
-    ctx.onLifecycle("shutdown", () => {
-      for (const child of children) if (!child.killed) child.kill("SIGTERM");
+    if (!initializers.length) return;
+    const auxiliaries: TunnelAuxiliary[] = [];
+    let stopped = false;
+    const stop = () => {
+      stopped = true;
+      for (const auxiliary of auxiliaries) auxiliary.stop();
+    };
+    ctx.onTeardown(stop);
+    ctx.onLifecycle("shutdown", stop);
+    void Promise.allSettled(initializers).then((results) => {
+      for (const result of results) {
+        if (result.status === "rejected") {
+          logger.error("tunnel failed to start", { error: result.reason });
+          continue;
+        }
+        if (stopped) result.value.stop();
+        else auxiliaries.push(result.value);
+      }
+      if (!stopped && auxiliaries.length) logger.info(`tunnel bound: ${transport} -> :${port}`);
     });
-    logger.info(`tunnel bound: ${transport} -> :${port}`);
+    logger.info(`tunnel initialization scheduled: ${transport} -> :${port}`);
   };
 }

package/src/plugin.ts

@@ -25,6 +25,7 @@ import {
   ResourceType,
 } from "@databricks/appkit";
 import { plugin as appkitPlugin } from "@dbx-tools/appkit";
+import { brand as appkitBrand } from "@dbx-tools/appkit";
 import {
   auth as passwordlessAuth,
   storage as authStorage,
@@ -356,7 +357,7 @@ export class AuthGatePlugin extends Plugin<AuthGateConfig> {
   } satisfies PluginManifest<"authGate">;
 
   private resolved!: ResolvedAuthGateConfig;
-  private runtime?: PasswordlessAuthRuntime;
+  private readonly runtimes = new Map<string, PasswordlessAuthRuntime>();
 
   static getResourceRequirements(config: AuthGateConfig): ResourceRequirement[] {
     if (authStorage.resolveAuthStorageConfig(config).mode !== "lakebase") return [];
@@ -378,32 +379,40 @@ export class AuthGatePlugin extends Plugin<AuthGateConfig> {
 
   override async setup(): Promise<void> {
     this.resolved = resolveAuthGateConfig(this.config);
+    if (!this.config.brandName && !coreConfig.text("AUTH_BRAND_NAME", TUNNEL_CONFIG)) {
+      this.resolved.brandName = appkitBrand.getBrandContext().name;
+    }
 
     if (this.resolved.insecure) {
       logger.warn("insecure mode - the tunnel runs OPEN with no auth gate");
     } else {
       const lakebasePlugin = appkitPlugin.instance(this.context, lakebase);
-      const storage = await authStorage.createAuthStorage(
-        this.resolved,
-        lakebasePlugin?.exports().pool,
-      );
       const { key } = await signingKey(this.resolved.sessionCutoffMs);
-      this.runtime = await passwordlessAuth.createPasswordlessAuth({
-        storage,
-        baseURL: authOrigin(this.resolved.publicDomain),
-        basePath: "/api/email/auth",
-        appName: this.resolved.brandName,
-        secret: Buffer.from(key).toString("base64url"),
-        sessionTtlSeconds: this.resolved.sessionTtlSeconds,
-        sessionCutoffMs: this.resolved.sessionCutoffMs,
-        logoutRedirectPath: this.resolved.logoutRedirectPath,
-        codeTtlSeconds: this.resolved.codeTtlSeconds,
-        maxAttempts: this.resolved.maxAttempts,
-        authorizeIdentity: (email) => this.authorizeIdentity(email),
-        sendCode: (email, code, options) => this.sendCode(email, code, options),
-        subject: this.resolved.subject,
-        message: this.resolved.message,
-      });
+      const origins = this.resolved.publicDomains.length
+        ? this.resolved.publicDomains.map(authOrigin)
+        : [authOrigin(this.resolved.publicDomain)];
+      for (const origin of new Set(origins)) {
+        const storage = await authStorage.createAuthStorage(
+          this.resolved,
+          lakebasePlugin?.exports().pool,
+        );
+        this.runtimes.set(new URL(origin).host.toLowerCase(), await passwordlessAuth.createPasswordlessAuth({
+          storage,
+          baseURL: origin,
+          basePath: "/api/email/auth",
+          appName: this.resolved.brandName,
+          secret: Buffer.from(key).toString("base64url"),
+          sessionTtlSeconds: this.resolved.sessionTtlSeconds,
+          sessionCutoffMs: this.resolved.sessionCutoffMs,
+          logoutRedirectPath: this.resolved.logoutRedirectPath,
+          codeTtlSeconds: this.resolved.codeTtlSeconds,
+          maxAttempts: this.resolved.maxAttempts,
+          authorizeIdentity: (email) => this.authorizeIdentity(email),
+          sendCode: (email, code, options) => this.sendCode(email, code, options),
+          subject: this.resolved.subject,
+          message: this.resolved.message,
+        }));
+      }
       // `server()` is deferred, so it does not exist during this plugin's setup.
       // At `setup:complete` the Express app exists but has not injected plugin
       // routes or static handling yet, which is the one point the gate can mount
@@ -431,7 +440,8 @@ export class AuthGatePlugin extends Plugin<AuthGateConfig> {
   }
 
   async shutdown(): Promise<void> {
-    await this.runtime?.close();
+    await Promise.all([...this.runtimes.values()].map((runtime) => runtime.close()));
+    this.runtimes.clear();
   }
 
   /**
@@ -467,16 +477,19 @@ export class AuthGatePlugin extends Plugin<AuthGateConfig> {
   }
 
   override exports(): AuthGateApi {
-    const runtime = this.runtime;
+    const runtime = (headers?: Headers, request?: Request) => {
+      const host = (headers?.get("host") ?? (request ? new URL(request.url).host : "")).toLowerCase();
+      return this.runtimes.get(host) ?? this.runtimes.values().next().value;
+    };
     return {
-      passkeysEnabled: runtime?.passkeysEnabled ?? false,
+      passkeysEnabled: [...this.runtimes.values()].some((entry) => entry.passkeysEnabled),
       handler: (request) =>
-        runtime?.handler(request) ?? Promise.resolve(new Response("Not Found", { status: 404 })),
-      session: (headers) => runtime?.session(headers) ?? Promise.resolve(undefined),
+        runtime(request.headers, request)?.handler(request) ?? Promise.resolve(new Response("Not Found", { status: 404 })),
+      session: (headers) => runtime(headers)?.session(headers) ?? Promise.resolve(undefined),
       status: (headers) =>
-        runtime?.status(headers) ??
+        runtime(headers)?.status(headers) ??
         Promise.resolve({ authenticated: false, enabled: false, passkeysEnabled: false }),
-      close: () => runtime?.close() ?? Promise.resolve(),
+      close: () => this.shutdown(),
     };
   }
 }

package/src/portr.ts

@@ -18,6 +18,7 @@ import { promisify } from "node:util";
 import { bin, config } from "@dbx-tools/core";
 import { log } from "@dbx-tools/shared-core";
 import { TUNNEL_CONFIG } from "./_config.ts";
+import { superviseProcessForever, type ProcessSupervisor } from "./supervisor.ts";
 
 const logger = log.logger("tunnel:portr");
 const PORTR_VERSION = "1.0.15-sse.2";
@@ -141,3 +142,11 @@ export async function startPortr(
   logger.info(`portr tunneling https://${config.subdomain}.${config.server} -> :${config.port}`);
   return spawn("portr", ["start"], { env: childEnv, stdio: "inherit" });
 }
+
+export function supervisePortr(config: PortrConfig, childEnv: NodeJS.ProcessEnv): ProcessSupervisor {
+  return superviseProcessForever({
+    name: "portr",
+    logger,
+    start: () => startPortr(config, childEnv),
+  });
+}

package/src/supervisor.ts

@@ -0,0 +1,89 @@
+import type { ChildProcess } from "node:child_process";
+import { async as asyncTools, type Logger } from "@dbx-tools/shared-core";
+
+const STABLE_CONNECTION_MS = 60_000;
+
+export interface ProcessSupervisor {
+  stop(): void;
+}
+
+type ProcessOutcome = {
+  code?: number | null;
+  signal?: NodeJS.Signals | null;
+  error?: unknown;
+};
+
+export function superviseProcessForever(options: {
+  name: string;
+  logger: Logger;
+  start: () => ChildProcess | Promise<ChildProcess>;
+  retryDelaysMs?: readonly number[];
+}): ProcessSupervisor {
+  const controller = new AbortController();
+  let child: ChildProcess | undefined;
+
+  const stop = () => {
+    if (controller.signal.aborted) return;
+    controller.abort();
+    if (child && !child.killed) child.kill("SIGTERM");
+    process.off("exit", onProcessExit);
+  };
+  const onProcessExit = () => {
+    if (child && !child.killed) child.kill("SIGTERM");
+  };
+  process.once("exit", onProcessExit);
+
+  const run = async () => {
+    let failures = 0;
+    while (!controller.signal.aborted) {
+      const startedAt = Date.now();
+      let outcome: ProcessOutcome;
+      try {
+        child = await options.start();
+        outcome = await processOutcome(child, controller.signal);
+      } catch (error) {
+        outcome = { error };
+      } finally {
+        child = undefined;
+      }
+      if (controller.signal.aborted) return;
+      if (Date.now() - startedAt >= STABLE_CONNECTION_MS) failures = 0;
+      const delayMs = asyncTools.boundedRetryDelay(failures++, options.retryDelaysMs);
+      options.logger.warn(`${options.name} stopped; retrying`, { ...outcome, delayMs });
+      try {
+        await asyncTools.sleep(delayMs, controller.signal);
+      } catch {
+        return;
+      }
+    }
+  };
+
+  void run().catch((error) => options.logger.error(`${options.name} supervisor failed`, { error }));
+  return {
+    stop,
+  };
+}
+
+function processOutcome(child: ChildProcess, signal: AbortSignal): Promise<ProcessOutcome> {
+  return new Promise((resolve) => {
+    const finish = (outcome: ProcessOutcome) => {
+      child.off("exit", onExit);
+      child.off("error", onError);
+      signal.removeEventListener("abort", onAbort);
+      resolve(outcome);
+    };
+    const onExit = (code: number | null, exitSignal: NodeJS.Signals | null) =>
+      finish({ code, signal: exitSignal });
+    const onError = (error: Error) => {
+      if (!child.killed) child.kill("SIGTERM");
+      finish({ error });
+    };
+    const onAbort = () => {
+      if (!child.killed) child.kill("SIGTERM");
+      finish({ signal: "SIGTERM" });
+    };
+    child.once("exit", onExit);
+    child.once("error", onError);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}