@floegence/flowersec-core 2.5.3 → 3.0.0

package/dist/node/v2.d.ts

@@ -0,0 +1,11 @@
+export * from "../v2/index.js";
+export { connect, createConnectionController } from "./connectSession.js";
+export type { ConnectionControllerOptions, SessionOptions, SessionTLSOptions, } from "./connectSession.js";
+export { AcceptedSession, Acceptor, HandlerRegistrationError, RPCHandlers, SessionHandlers, createAcceptor, } from "./acceptor.js";
+export type { AcceptorListener, AcceptorOptions, AuthorizationDecision, RPCHandler, RPCHandlerResult, NotificationHandler, SessionHandlerOptions, } from "./acceptor.js";
+export { TunnelRuntime, createTunnelRuntime } from "./tunnelRuntime.js";
+export type { TunnelAuthorizationDecision, TunnelRuntimeListener, TunnelRuntimeOptions, } from "./tunnelRuntime.js";
+export { AuthorizationRecord, AuthorizationResponse, TunnelAuthorizationResponse, ControlPlaneError, EndpointSet, IssuedArtifact, Issuer, RuntimeAuthorizationRequest, authorizeRuntime, authorizeTunnelRuntime, createEndpointSet, parseAuthorizationRecord, parseRuntimeAuthorizationRequest, rejectRuntime, rejectTunnelRuntime, } from "./controlplane.js";
+export type { ArtifactMetadata, ControlPlaneErrorCode, DirectIssueOptions, IssuedTunnelPair, Scope, SessionOptions as ControlPlaneSessionOptions, TunnelIssueOptions, } from "./controlplane.js";
+export { ProxyServer, ProxyServerError } from "./proxyServer.js";
+export type { ProxyServerOptions, StreamHandlerRegistrar } from "./proxyServer.js";

package/dist/node/v2.js

@@ -0,0 +1,6 @@
+export * from "../v2/index.js";
+export { connect, createConnectionController } from "./connectSession.js";
+export { AcceptedSession, Acceptor, HandlerRegistrationError, RPCHandlers, SessionHandlers, createAcceptor, } from "./acceptor.js";
+export { TunnelRuntime, createTunnelRuntime } from "./tunnelRuntime.js";
+export { AuthorizationRecord, AuthorizationResponse, TunnelAuthorizationResponse, ControlPlaneError, EndpointSet, IssuedArtifact, Issuer, RuntimeAuthorizationRequest, authorizeRuntime, authorizeTunnelRuntime, createEndpointSet, parseAuthorizationRecord, parseRuntimeAuthorizationRequest, rejectRuntime, rejectTunnelRuntime, } from "./controlplane.js";
+export { ProxyServer, ProxyServerError } from "./proxyServer.js";

package/dist/node/webSocketServerV3.d.ts

@@ -0,0 +1,27 @@
+import type { CarrierSessionV3 } from "../v3/carrier.js";
+import type { PathKind } from "../v3/contract.js";
+export type NodeWebSocketListenerOptionsV3 = Readonly<{
+    host: string;
+    port: number;
+    path: PathKind;
+    tls: Readonly<{
+        certificate: string;
+        privateKey: string;
+    }>;
+    allowedOrigins: readonly string[];
+    inboundBidirectionalStreamCapacity: number;
+    maxPendingSessions?: number;
+    pendingSessionTimeoutMs?: number;
+    cleanupTimeoutMs?: number;
+}>;
+export type NodeWebSocketListenerV3 = Readonly<{
+    address(): Readonly<{
+        host: string;
+        port: number;
+    }>;
+    accept(options?: Readonly<{
+        signal?: AbortSignal;
+    }>): Promise<CarrierSessionV3>;
+    close(): Promise<void>;
+}>;
+export declare function startNodeWebSocketListenerV3(options: NodeWebSocketListenerOptionsV3): Promise<NodeWebSocketListenerV3>;

package/dist/node/webSocketServerV3.js

@@ -0,0 +1,219 @@
+import { createServer as createHTTPSServer } from "node:https";
+import { createRequire } from "node:module";
+import { constants } from "node:crypto";
+import { createServerWebSocketCarrierSessionV3 } from "../v3/webSocketCarrier.js";
+import { WebSocketBinaryTransport } from "../ws-client/binaryTransport.js";
+import { defaultWsMaxPayload } from "./wsDefaults.js";
+import { FLOWERSEC_V3_PATHS, websocketSubprotocolForPathV3, } from "../v3/transportConstants.js";
+export async function startNodeWebSocketListenerV3(options) {
+    validateOptions(options);
+    const maxPendingSessions = options.maxPendingSessions ?? 1_024;
+    const pendingSessionTimeoutMs = options.pendingSessionTimeoutMs ?? 10_000;
+    const cleanupTimeoutMs = options.cleanupTimeoutMs ?? 2_000;
+    const protocol = websocketSubprotocolForPathV3(options.path);
+    const endpoint = FLOWERSEC_V3_PATHS.websocket[options.path];
+    const require = createRequire(import.meta.url);
+    const wsModule = require("ws");
+    const WebSocketServer = wsModule.WebSocketServer;
+    const server = createHTTPSServer({
+        key: options.tls.privateKey,
+        cert: options.tls.certificate,
+        minVersion: "TLSv1.3",
+        maxVersion: "TLSv1.3",
+        secureOptions: constants.SSL_OP_NO_TICKET,
+    });
+    const sessions = new SessionQueueV3(maxPendingSessions, pendingSessionTimeoutMs);
+    const sockets = new Set();
+    const networkSockets = new Set();
+    const wss = new WebSocketServer({
+        noServer: true,
+        perMessageDeflate: false,
+        maxPayload: defaultWsMaxPayload({}),
+        handleProtocols(protocols) { return protocols.size === 1 && protocols.has(protocol) ? protocol : false; },
+    });
+    server.on("connection", (socket) => {
+        networkSockets.add(socket);
+        socket.once("close", () => networkSockets.delete(socket));
+    });
+    server.on("upgrade", (request, socket, head) => {
+        const origin = request.headers.origin;
+        const requested = request.headers["sec-websocket-protocol"];
+        if (request.url !== endpoint || typeof origin !== "string" ||
+            !options.allowedOrigins.includes(origin) || requested !== protocol) {
+            socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+            socket.destroy();
+            return;
+        }
+        wss.handleUpgrade(request, socket, head, (webSocket) => wss.emit("connection", webSocket));
+    });
+    wss.on("connection", (socket) => {
+        sockets.add(socket);
+        const session = createServerWebSocketCarrierSessionV3(new WebSocketBinaryTransport(socket), {
+            path: options.path,
+            inboundBidirectionalStreamCapacity: options.inboundBidirectionalStreamCapacity,
+        });
+        socket.once("close", () => {
+            sockets.delete(socket);
+            sessions.remove(session);
+        });
+        sessions.push(session);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port, options.host, resolve);
+    });
+    let closePromise;
+    return Object.freeze({
+        address() {
+            const address = server.address();
+            if (address === null || typeof address === "string")
+                throw new Error("Node WebSocket v3 listener is not listening");
+            return Object.freeze({ host: address.address, port: address.port });
+        },
+        async accept(acceptOptions = {}) { return await sessions.shift(acceptOptions.signal); },
+        async close() {
+            closePromise ??= closeListener();
+            await closePromise;
+        },
+    });
+    async function closeListener() {
+        sessions.close();
+        for (const socket of sockets)
+            socket.close();
+        const graceful = Promise.all([
+            new Promise((resolve, reject) => {
+                wss.close((error) => error === undefined ? resolve() : reject(error));
+            }),
+            new Promise((resolve, reject) => {
+                server.close((error) => error === undefined ? resolve() : reject(error));
+            }),
+        ]);
+        let timer;
+        let timedOut;
+        try {
+            timedOut = await Promise.race([
+                graceful.then(() => false),
+                new Promise((resolve) => {
+                    timer = setTimeout(() => resolve(true), cleanupTimeoutMs);
+                    timer.unref?.();
+                }),
+            ]);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+        if (!timedOut)
+            return;
+        for (const socket of sockets)
+            socket.terminate();
+        for (const socket of networkSockets)
+            socket.destroy();
+    }
+}
+function validateOptions(options) {
+    if (!Number.isInteger(options.port) || options.port < 0 || options.port > 65_535 ||
+        options.allowedOrigins.length === 0 || new Set(options.allowedOrigins).size !== options.allowedOrigins.length ||
+        options.allowedOrigins.some((origin) => !validOrigin(origin)) ||
+        !Number.isInteger(options.inboundBidirectionalStreamCapacity) ||
+        options.inboundBidirectionalStreamCapacity < 3 || options.inboundBidirectionalStreamCapacity > 130 ||
+        (options.maxPendingSessions !== undefined && (!Number.isSafeInteger(options.maxPendingSessions) || options.maxPendingSessions < 1 || options.maxPendingSessions > 1_024)) ||
+        (options.pendingSessionTimeoutMs !== undefined && (!Number.isSafeInteger(options.pendingSessionTimeoutMs) || options.pendingSessionTimeoutMs < 1 || options.pendingSessionTimeoutMs > 600_000)) ||
+        (options.cleanupTimeoutMs !== undefined && (!Number.isSafeInteger(options.cleanupTimeoutMs) || options.cleanupTimeoutMs < 1 || options.cleanupTimeoutMs > 600_000)) ||
+        options.tls.certificate.length === 0 || options.tls.privateKey.length === 0) {
+        throw new TypeError("invalid Node WebSocket v3 listener options");
+    }
+}
+function validOrigin(raw) {
+    try {
+        const value = new URL(raw);
+        return (value.protocol === "https:" || value.protocol === "http:") && value.origin === raw &&
+            value.username === "" && value.password === "";
+    }
+    catch {
+        return false;
+    }
+}
+class SessionQueueV3 {
+    maximum;
+    timeoutMs;
+    values = [];
+    waiters = new Set();
+    closed = false;
+    constructor(maximum, timeoutMs) {
+        this.maximum = maximum;
+        this.timeoutMs = timeoutMs;
+    }
+    push(value) {
+        if (this.closed) {
+            value.abort({ code: 1, reason: "WebSocket v3 listener closed" });
+            return;
+        }
+        const waiter = this.waiters.values().next().value;
+        if (waiter !== undefined) {
+            this.waiters.delete(waiter);
+            waiter.resolve(value);
+            return;
+        }
+        if (this.values.length >= this.maximum) {
+            value.abort({ code: 1, reason: "WebSocket v3 pending capacity exceeded" });
+            return;
+        }
+        const entry = {
+            value,
+            timer: setTimeout(() => {
+                if (this.remove(value)) {
+                    value.abort({ code: 1, reason: "WebSocket v3 pending admission timed out" });
+                }
+            }, this.timeoutMs),
+        };
+        this.values.push(entry);
+    }
+    remove(value) {
+        const index = this.values.findIndex((entry) => entry.value === value);
+        if (index < 0)
+            return false;
+        const [entry] = this.values.splice(index, 1);
+        if (entry !== undefined)
+            clearTimeout(entry.timer);
+        return true;
+    }
+    async shift(signal) {
+        if (signal?.aborted === true)
+            throw signal.reason ?? new Error("accept canceled");
+        const entry = this.values.shift();
+        if (entry !== undefined) {
+            clearTimeout(entry.timer);
+            return entry.value;
+        }
+        if (this.closed)
+            throw new Error("WebSocket v3 listener is closed");
+        return await new Promise((resolve, reject) => {
+            const waiter = {
+                resolve: (session) => { cleanup(); resolve(session); },
+                reject: (error) => { cleanup(); reject(error); },
+            };
+            const abort = () => {
+                this.waiters.delete(waiter);
+                reject(signal?.reason ?? new Error("accept canceled"));
+            };
+            const cleanup = () => signal?.removeEventListener("abort", abort);
+            this.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+        });
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        const error = new Error("WebSocket v3 listener is closed");
+        for (const waiter of this.waiters)
+            waiter.reject(error);
+        this.waiters.clear();
+        for (const entry of this.values) {
+            clearTimeout(entry.timer);
+            entry.value.abort({ code: 1, reason: "WebSocket v3 listener closed" });
+        }
+        this.values.length = 0;
+    }
+}

package/dist/proxy/runtime.js

@@ -45,11 +45,34 @@ function normalizeTimeout(input) {
     }
     return input;
 }
+class InvalidProxyPathError extends TypeError {
+}
 function normalizePath(input) {
-    if (input !== input.trim() || !input.startsWith("/") || input.startsWith("//") || /[\u0000-\u0020]/u.test(input) || input.includes("://")) {
-        throw new TypeError("proxy path must be an origin-relative path");
+    if (input !== input.trim() || !input.startsWith("/") || input.startsWith("//") || /[\u0000-\u0020]/u.test(input) || input.includes("://") || input.includes("#")) {
+        throw new InvalidProxyPathError("proxy path must be an origin-relative path");
     }
-    return input;
+    let parsed;
+    try {
+        parsed = new URL(input, "https://flowersec.invalid/");
+    }
+    catch {
+        throw new InvalidProxyPathError("proxy path must be an origin-relative path");
+    }
+    const pathname = normalizePercentEscapes(parsed.pathname, true).replace(/\/{2,}/gu, "/");
+    const search = normalizePercentEscapes(parsed.search, false);
+    return pathname + search;
+}
+function normalizePercentEscapes(input, rejectEncodedSeparators) {
+    if (/%(?![0-9a-f]{2})/iu.test(input))
+        throw new InvalidProxyPathError("proxy path contains invalid percent encoding");
+    return input.replace(/%([0-9a-f]{2})/giu, (_match, hex) => {
+        const value = Number.parseInt(hex, 16);
+        if (rejectEncodedSeparators && (value === 0x2f || value === 0x5c)) {
+            throw new InvalidProxyPathError("proxy path contains an encoded separator");
+        }
+        const character = String.fromCharCode(value);
+        return /[A-Za-z0-9\-._~]/u.test(character) ? character : `%${hex.toUpperCase()}`;
+    });
 }
 function pathName(path) {
     const query = path.indexOf("?");
@@ -176,11 +199,19 @@ class StreamAdmission {
             return Promise.reject(new SessionError("resource_exhausted"));
         }
         return new Promise((resolve, reject) => {
+            let cleaned = false;
+            const cleanup = () => {
+                if (cleaned)
+                    return;
+                cleaned = true;
+                signal?.removeEventListener("abort", onAbort);
+            };
             const entry = {
                 bytes,
                 ...(signal === undefined ? {} : { signal }),
-                resolve,
-                reject: (error) => reject(error),
+                cleanup,
+                resolve: (release) => { cleanup(); resolve(release); },
+                reject: (error) => { cleanup(); reject(error); },
             };
             const onAbort = () => {
                 const index = this.queue.indexOf(entry);
@@ -188,7 +219,7 @@ class StreamAdmission {
                     return;
                 this.queue.splice(index, 1);
                 this.queuedBytes -= bytes;
-                reject(new SessionError("canceled"));
+                entry.reject(new SessionError("canceled"));
             };
             signal?.addEventListener("abort", onAbort, { once: true });
             this.queue.push(entry);
@@ -251,6 +282,8 @@ async function* readChunks(reader, maxChunkBytes, maxBodyBytes) {
 function publicFailure(error) {
     if (error instanceof ProxyPolicyError)
         return { status: 403, code: "policy_denied", message: "proxy request denied" };
+    if (error instanceof InvalidProxyPathError)
+        return { status: 400, code: "invalid_request", message: "invalid proxy request" };
     if (error instanceof SessionError && (error.code === "resource_exhausted" || error.code === "closed" || error.code === "going_away")) {
         return { status: 503, code: error.code, message: "proxy service unavailable" };
     }

package/dist/proxy/serviceWorker.d.ts

@@ -15,6 +15,8 @@ export type ProxyServiceWorkerScriptOptions = Readonly<{
     sameOriginOnly?: boolean;
     maxRequestBodyBytes?: number;
     maxInjectHTMLBytes?: number;
+    responseMetadataTimeoutMs?: number;
+    responseBodyInactivityTimeoutMs?: number;
     passthrough?: ProxyServiceWorkerPassthroughOptions;
     proxyPathPrefix?: string;
     stripProxyPathPrefix?: boolean;

package/dist/proxy/serviceWorker.js

@@ -17,6 +17,12 @@ function bounded(name, value, fallback, maximum) {
         throw new TypeError(`${name} is invalid`);
     return result;
 }
+function optionalBounded(name, value, maximum) {
+    const result = value ?? 0;
+    if (!Number.isSafeInteger(result) || result < 0 || result > maximum)
+        throw new TypeError(`${name} is invalid`);
+    return result;
+}
 function token(name, value, fallback = "") {
     const result = value ?? fallback;
     if (result !== result.trim() || /[\u0000-\u0020\u007f]/u.test(result) || result.length > 512)
@@ -42,6 +48,8 @@ function normalizeOptions(options) {
         sameOriginOnly: options.sameOriginOnly ?? true,
         maxRequestBodyBytes: bounded("maxRequestBodyBytes", options.maxRequestBodyBytes, 64 * 1024 * 1024, 256 * 1024 * 1024),
         maxInjectHTMLBytes: bounded("maxInjectHTMLBytes", options.maxInjectHTMLBytes, 8 * 1024 * 1024, 32 * 1024 * 1024),
+        responseMetadataTimeoutMs: bounded("responseMetadataTimeoutMs", options.responseMetadataTimeoutMs, 10_000, 300_000),
+        responseBodyInactivityTimeoutMs: optionalBounded("responseBodyInactivityTimeoutMs", options.responseBodyInactivityTimeoutMs, 300_000),
         passthroughPaths: strings("passthrough.paths", options.passthrough?.paths),
         passthroughPrefixes: strings("passthrough.prefixes", options.passthrough?.prefixes),
         proxyPathPrefix,
@@ -127,6 +135,8 @@ function serviceWorkerMain(config) {
                 return new Response("proxy runtime unavailable", { status: 503 });
             }
             let body;
+            if (request.signal.aborted)
+                return new Response("proxy request canceled", { status: 499 });
             if (request.method !== "GET" && request.method !== "HEAD") {
                 const requestBody = await request.clone().arrayBuffer();
                 if (requestBody.byteLength > config.maxRequestBodyBytes)
@@ -138,16 +148,54 @@ function serviceWorkerMain(config) {
                 let metadata = null;
                 let controller = null;
                 let finished = false;
-                const finishError = (status, message) => {
+                let remoteAbortSent = false;
+                let bodyInactivityTimer;
+                const abortRemote = () => {
+                    if (remoteAbortSent)
+                        return;
+                    remoteAbortSent = true;
+                    try {
+                        channel.port1.postMessage({ type: "flowersec-proxy:abort" });
+                    }
+                    catch { /* Port already failed. */ }
+                };
+                const cleanup = () => {
+                    clearTimeout(metadataTimer);
+                    clearTimeout(bodyInactivityTimer);
+                    clearInterval(runtimeWatchdog);
+                    request.signal.removeEventListener("abort", requestAborted);
+                    channel.port1.close();
+                };
+                const finishError = (status, message, cancelRemote = false) => {
                     if (finished)
                         return;
                     finished = true;
+                    if (cancelRemote)
+                        abortRemote();
                     if (controller !== null)
                         controller.error(new Error(message));
                     else
                         resolve(new Response(message, { status }));
-                    channel.port1.close();
+                    cleanup();
+                };
+                const requestAborted = () => finishError(499, "proxy request canceled", true);
+                const armBodyInactivityTimer = () => {
+                    clearTimeout(bodyInactivityTimer);
+                    if (config.responseBodyInactivityTimeoutMs === 0)
+                        return;
+                    bodyInactivityTimer = setTimeout(() => finishError(504, "proxy response body timed out", true), config.responseBodyInactivityTimeoutMs);
                 };
+                const metadataTimer = setTimeout(() => finishError(504, "proxy response timed out", true), config.responseMetadataTimeoutMs);
+                const runtimeWatchdog = setInterval(() => {
+                    void worker.clients.get(target.id).then((current) => {
+                        if (current !== null || finished)
+                            return;
+                        if (config.windowTarget === "registered_runtime")
+                            runtimeClientId = "";
+                        finishError(503, "proxy runtime unavailable", true);
+                    }).catch(() => finishError(503, "proxy runtime unavailable", true));
+                }, 250);
+                request.signal.addEventListener("abort", requestAborted, { once: true });
                 channel.port1.onmessage = (message) => {
                     const value = message.data;
                     if (value === null || typeof value !== "object" || finished)
@@ -162,13 +210,21 @@ function serviceWorkerMain(config) {
                                     headers.append(entry.name, entry.value);
                             }
                         metadata = { status: value.status, headers };
+                        clearTimeout(metadataTimer);
+                        armBodyInactivityTimer();
                         const stream = new ReadableStream({
                             start(valueController) {
                                 controller = valueController;
                                 channel.port1.postMessage({ type: "flowersec-proxy:response_credit" });
                             },
                             pull() { channel.port1.postMessage({ type: "flowersec-proxy:response_credit" }); },
-                            cancel() { channel.port1.postMessage({ type: "flowersec-proxy:abort" }); channel.port1.close(); },
+                            cancel() {
+                                if (finished)
+                                    return;
+                                finished = true;
+                                abortRemote();
+                                cleanup();
+                            },
                         });
                         resolve(new Response(stream, { status: metadata.status, headers: metadata.headers }));
                         return;
@@ -177,19 +233,20 @@ function serviceWorkerMain(config) {
                         if (controller === null || !(value.data instanceof ArrayBuffer))
                             return finishError(502, "invalid proxy response");
                         controller.enqueue(new Uint8Array(value.data));
+                        armBodyInactivityTimer();
                         return;
                     }
                     if (value.type === "flowersec-proxy:response_end") {
                         finished = true;
                         controller?.close();
-                        channel.port1.close();
+                        cleanup();
                         return;
                     }
                     if (value.type === "flowersec-proxy:response_error") {
                         finishError(Number.isInteger(value.status) ? value.status : 502, typeof value.message === "string" ? value.message : "proxy request failed");
                     }
                 };
-                channel.port1.onmessageerror = () => finishError(502, "proxy request failed");
+                channel.port1.onmessageerror = () => finishError(502, "proxy request failed", true);
                 const headers = Array.from(request.headers.entries()).map(([name, value]) => ({ name, value }));
                 try {
                     target.postMessage({
@@ -207,8 +264,7 @@ function serviceWorkerMain(config) {
                 catch {
                     if (config.windowTarget === "registered_runtime")
                         runtimeClientId = "";
-                    channel.port1.close();
-                    resolve(new Response("proxy runtime unavailable", { status: 503 }));
+                    finishError(503, "proxy runtime unavailable");
                 }
             });
             const injection = config.injectHTML;

package/dist/proxy/windowBridge.d.ts

@@ -23,6 +23,7 @@ export declare class MessagePortByteStream implements ByteStream {
     private handle;
     private finish;
     private fail;
+    private settleWrite;
 }
 export type RegisterProxyAppWindowOptions = Readonly<{
     controllerOrigin: string;