@floegence/flowersec-core 3.2.1 → 4.0.0

package/dist/node/tunnelRuntime.js

@@ -1,559 +0,0 @@
-import { receiveSessionAdmissionV2, rejectSessionAdmissionV2, } from "../connector/sessionAcceptor.js";
-import { configureServerWebSocketCarrierRoleV2 } from "../transport/webSocketAdapter.js";
-import { AdmissionStatusV2, encodeFSA2ResponseV2, } from "../v2/artifact.js";
-import { runtimeAuthorizationRequestFromDecoded, TunnelAuthorizationResponse, } from "./controlplane.js";
-import { startNodeWebSocketServer } from "./webSocketServer.js";
-import { createNativeRawQuicDriver } from "./nativeTransportAddon.js";
-import { startNodeRawQuicServer } from "./rawQuicServer.js";
-const DEFAULT_PAIR_TIMEOUT_MS = 10_000;
-const DEFAULT_CLEANUP_TIMEOUT_MS = 2_000;
-const DEFAULT_MAX_PENDING_LEGS = 1_024;
-const DEFAULT_MAX_ACTIVE_PAIRS = 1_024;
-const DEFAULT_MAX_CONCURRENT_STREAMS = 128;
-const ID = /^[A-Za-z0-9._~-]{1,128}$/u;
-const REASON = /^[A-Za-z0-9._~-]{1,64}$/u;
-export class TunnelRuntime {
-    constructor() { }
-    async start() {
-        await startTunnelRuntime(tunnelRuntimeState(this));
-    }
-    addresses() {
-        return tunnelRuntimeState(this).listeners.map((listener) => listener.address());
-    }
-    async close() {
-        const state = tunnelRuntimeState(this);
-        if (state.abort.signal.aborted)
-            return;
-        state.abort.abort(new Error("Flowersec tunnel runtime closed"));
-        for (const generation of [...state.generations.values()])
-            finishGeneration(state, generation);
-        const starting = starts.get(state);
-        if (starting !== undefined)
-            await Promise.allSettled([starting]);
-        await Promise.allSettled(state.listeners.map(async (listener) => await listener.close()));
-        await boundedCleanup(state.tasks, state.limits.cleanupTimeoutMs);
-        state.tasks.clear();
-    }
-}
-const tunnelRuntimeStates = new WeakMap();
-function tunnelRuntimeState(runtime) {
-    const state = tunnelRuntimeStates.get(runtime);
-    if (state === undefined)
-        throw new Error("invalid Flowersec TunnelRuntime");
-    return state;
-}
-export function createTunnelRuntime(options) {
-    const limits = validateOptions(options);
-    const runtime = new TunnelRuntime();
-    const state = {
-        listeners: [],
-        options,
-        limits,
-        abort: new AbortController(),
-        generations: new Map(),
-        usedCredentials: new Map(),
-        legGenerations: new WeakMap(),
-        tasks: new Set(),
-        counts: { pendingLegs: 0, activePairs: 0 },
-    };
-    tunnelRuntimeStates.set(runtime, state);
-    return Object.freeze(runtime);
-}
-const starts = new WeakMap();
-async function startTunnelRuntime(state) {
-    if (state.abort.signal.aborted)
-        throw new Error("Flowersec tunnel runtime is closed");
-    let started = starts.get(state);
-    if (started === undefined) {
-        started = (async () => {
-            let rawQuicDriver;
-            try {
-                for (const listener of state.options.listeners) {
-                    if (state.abort.signal.aborted)
-                        throw new Error("Flowersec tunnel runtime is closed");
-                    const running = listener.carrier === "websocket"
-                        ? await startNodeWebSocketServer({
-                            ...listener,
-                            path: "tunnel",
-                            inboundBidirectionalStreamCapacity: state.options.maxInboundStreams + 2,
-                        })
-                        : await startNodeRawQuicServer(rawQuicDriver ??= createNativeRawQuicDriver(), {
-                            ...listener,
-                            path: "tunnel",
-                            inboundBidirectionalStreamCapacity: state.options.maxInboundStreams + 2,
-                        });
-                    if (state.abort.signal.aborted) {
-                        await running.close().catch(() => undefined);
-                        throw new Error("Flowersec tunnel runtime is closed");
-                    }
-                    state.listeners.push(running);
-                }
-            }
-            catch (error) {
-                await Promise.allSettled(state.listeners.splice(0).map(async (listener) => await listener.close()));
-                throw error;
-            }
-            for (const listener of state.listeners)
-                track(state, runListener(state, listener));
-        })();
-        starts.set(state, started);
-    }
-    await started;
-}
-async function runListener(state, listener) {
-    while (!state.abort.signal.aborted) {
-        let carrier;
-        try {
-            carrier = await listener.accept({ signal: state.abort.signal });
-        }
-        catch {
-            return;
-        }
-        track(state, processCarrier(state, carrier));
-    }
-}
-async function processCarrier(state, carrier) {
-    try {
-        const received = await receiveSessionAdmissionV2(carrier, state.abort.signal);
-        const decoded = received.decoded;
-        if (carrier.path !== "tunnel" || decoded.request.pathKind !== "tunnel" ||
-            decoded.request.candidates.find((candidate) => candidate.id === decoded.request.chosen_candidate_id)?.carrier !== carrier.kind) {
-            await reject(received, "invalid_credential", false, state.abort.signal);
-            return;
-        }
-        const authorization = await abortableCallback(state.options.authorize(runtimeAuthorizationRequestFromDecoded(decoded), { signal: state.abort.signal }), state.abort.signal);
-        const decision = authorization instanceof TunnelAuthorizationResponse
-            ? authorization.asDecision()
-            : authorization;
-        if (decision.decision !== "allow") {
-            await reject(received, decision.reason, decision.decision === "retry", state.abort.signal);
-            return;
-        }
-        const leg = validatedLeg(state, received, decoded.request, decision);
-        if (leg === undefined) {
-            releaseDecision(state, decision);
-            await reject(received, "invalid_credential", false, state.abort.signal);
-            return;
-        }
-        configureRole(leg);
-        registerLeg(state, leg);
-    }
-    catch {
-        await carrier.close().catch(() => undefined);
-    }
-}
-function validatedLeg(state, received, request, authorization) {
-    const now = Math.floor(Date.now() / 1_000);
-    if (!ID.test(authorization.credentialId) || authorization.credentialId !== runtimeAuthorizationRequestFromDecoded(received.decoded).lookupKey() ||
-        !ID.test(authorization.leaseId) || !Number.isSafeInteger(authorization.expiresAtUnixSeconds) ||
-        authorization.expiresAtUnixSeconds <= now || !ID.test(authorization.expectedPeerEndpointInstanceId) ||
-        authorization.expectedPeerEndpointInstanceId === request.endpoint_instance_id)
-        return undefined;
-    let released = false;
-    return {
-        received,
-        request,
-        authorization,
-        release() {
-            if (released)
-                return;
-            released = true;
-            trackRelease(state, authorization.leaseId);
-        },
-    };
-}
-function registerLeg(state, leg) {
-    pruneCredentials(state);
-    if (state.usedCredentials.has(leg.authorization.credentialId)) {
-        leg.release();
-        track(state, reject(leg.received, "credential_replay", false, state.abort.signal));
-        return;
-    }
-    state.usedCredentials.set(leg.authorization.credentialId, leg.authorization.expiresAtUnixSeconds);
-    const key = pairKey(leg.request);
-    let generation = state.generations.get(key);
-    if (generation !== undefined && !generation.finished &&
-        (generation.active || generation.roles.has(leg.request.role))) {
-        if (leg.authorization.allowReplacement !== true) {
-            leg.release();
-            track(state, reject(leg.received, "replacement_denied", false, state.abort.signal));
-            return;
-        }
-        rejectGeneration(state, generation, "replaced", false);
-        generation = undefined;
-    }
-    if (generation === undefined || generation.finished) {
-        if (state.counts.pendingLegs >= state.limits.maxPendingLegs) {
-            leg.release();
-            track(state, reject(leg.received, "capacity", true, state.abort.signal));
-            return;
-        }
-        generation = {
-            key,
-            abort: new AbortController(),
-            roles: new Map(),
-            active: false,
-            finished: false,
-        };
-        state.generations.set(key, generation);
-    }
-    const peer = generation.roles.get(leg.request.role === 1 ? 2 : 1);
-    if (peer !== undefined && !mirrored(peer, leg)) {
-        leg.release();
-        track(state, reject(leg.received, "pair_mismatch", false, state.abort.signal));
-        return;
-    }
-    generation.roles.set(leg.request.role, leg);
-    state.legGenerations.set(leg, generation);
-    track(state, watchTermination(state, leg));
-    if (generation.roles.size === 1) {
-        state.counts.pendingLegs += 1;
-        const timeout = Math.min(state.limits.pairTimeoutMs, Math.max(1, leg.authorization.expiresAtUnixSeconds * 1_000 - Date.now()));
-        generation.timer = setTimeout(() => rejectGeneration(state, generation, "pair_timeout", true), timeout);
-        return;
-    }
-    if (state.counts.activePairs >= state.limits.maxActivePairs) {
-        rejectGeneration(state, generation, "capacity", true);
-        return;
-    }
-    if (generation.timer !== undefined)
-        clearTimeout(generation.timer);
-    state.counts.pendingLegs -= 1;
-    state.counts.activePairs += 1;
-    generation.active = true;
-    track(state, activatePair(state, generation));
-}
-async function activatePair(state, generation) {
-    const first = generation.roles.get(1);
-    const second = generation.roles.get(2);
-    if (first === undefined || second === undefined) {
-        finishGeneration(state, generation);
-        return;
-    }
-    try {
-        await Promise.all([
-            acceptAdmission(first.received, generation.abort.signal),
-            acceptAdmission(second.received, generation.abort.signal),
-        ]);
-        await bridgePair(state, first.received.carrier, second.received.carrier, generation.abort.signal);
-    }
-    catch {
-        // Pair teardown below is the observable failure boundary for both endpoints.
-    }
-    finally {
-        finishGeneration(state, generation);
-    }
-}
-async function watchTermination(state, leg) {
-    try {
-        await leg.received.carrier.waitTermination();
-    }
-    catch {
-        // Carrier termination has the same generation cleanup below.
-    }
-    const generation = state.legGenerations.get(leg);
-    if (generation !== undefined && !generation.finished)
-        finishGeneration(state, generation);
-}
-function configureRole(leg) {
-    if (leg.received.carrier.kind === "websocket") {
-        configureServerWebSocketCarrierRoleV2(leg.received.carrier, leg.request.role === 2);
-    }
-}
-async function bridgePair(state, first, second, signal) {
-    const controller = new AbortController();
-    const cancel = () => controller.abort(signal.reason);
-    signal.addEventListener("abort", cancel, { once: true });
-    const tasks = new Set();
-    const slots = new StreamSlots(state.limits.maxConcurrentStreams);
-    const start = (task, fatal = true) => {
-        tasks.add(task);
-        void task.catch(() => { if (fatal)
-            controller.abort(); }).finally(() => tasks.delete(task));
-    };
-    try {
-        const controlIn = await first.acceptStream({ signal: controller.signal });
-        const controlOut = await second.openStream({ signal: controller.signal });
-        start(spliceStreams(controlIn, controlOut, controller.signal, true));
-        start(bridgeStreams(first, second, slots, controller.signal, start));
-        start(bridgeStreams(second, first, slots, controller.signal, start));
-        if (first.unreliableDatagrams !== undefined && second.unreliableDatagrams !== undefined) {
-            start(bridgeDatagrams(first.unreliableDatagrams, second.unreliableDatagrams, controller.signal));
-            start(bridgeDatagrams(second.unreliableDatagrams, first.unreliableDatagrams, controller.signal));
-        }
-        await aborted(controller.signal);
-    }
-    finally {
-        signal.removeEventListener("abort", cancel);
-        controller.abort();
-        first.abort({ code: 1, reason: "tunnel bridge closed" });
-        second.abort({ code: 1, reason: "tunnel bridge closed" });
-        await boundedCleanup(tasks, state.limits.cleanupTimeoutMs);
-    }
-}
-async function bridgeStreams(source, target, slots, signal, start) {
-    while (!signal.aborted) {
-        const incoming = await source.acceptStream({ signal });
-        const release = await slots.acquire(signal);
-        let outgoing;
-        try {
-            outgoing = await target.openStream({ signal });
-        }
-        catch (error) {
-            release();
-            if (signal.aborted) {
-                incoming.abort(asError(error));
-                throw error;
-            }
-            await incoming.reset().catch(() => undefined);
-            continue;
-        }
-        start(spliceStreams(incoming, outgoing, signal, false).finally(release), false);
-    }
-}
-async function spliceStreams(left, right, signal, closePair) {
-    const abort = () => {
-        left.abort(asError(signal.reason));
-        right.abort(asError(signal.reason));
-    };
-    signal.addEventListener("abort", abort, { once: true });
-    try {
-        await Promise.all([copyStream(left, right, signal), copyStream(right, left, signal)]);
-        if (closePair)
-            throw new Error("Flowersec tunnel control stream closed");
-    }
-    catch (error) {
-        if (closePair || signal.aborted) {
-            left.abort(asError(error));
-            right.abort(asError(error));
-        }
-        else {
-            await Promise.allSettled([left.reset(), right.reset()]);
-        }
-        throw error;
-    }
-    finally {
-        signal.removeEventListener("abort", abort);
-    }
-}
-async function copyStream(source, target, signal) {
-    while (true) {
-        const chunk = await source.read({ signal });
-        if (chunk === null) {
-            await target.closeWrite();
-            return;
-        }
-        let offset = 0;
-        while (offset < chunk.length) {
-            const written = await target.write(chunk.subarray(offset), { signal });
-            if (written < 1 || written > chunk.length - offset)
-                throw new Error("invalid tunnel stream write");
-            offset += written;
-        }
-    }
-}
-async function bridgeDatagrams(source, target, signal) {
-    while (!signal.aborted) {
-        const message = await source.receive({ signal });
-        if (message.length <= target.maxDatagramSize)
-            await target.send(message, { signal });
-    }
-}
-function mirrored(first, second) {
-    const a = first.request;
-    const b = second.request;
-    return a.role !== b.role &&
-        a.channel_id === b.channel_id &&
-        a.profile === b.profile &&
-        a.rendezvous_group_id === b.rendezvous_group_id &&
-        a.session_contract_hash_b64u === b.session_contract_hash_b64u &&
-        a.candidate_set_hash_b64u === b.candidate_set_hash_b64u &&
-        a.listener_audience === b.listener_audience &&
-        first.authorization.expectedPeerEndpointInstanceId === b.endpoint_instance_id &&
-        second.authorization.expectedPeerEndpointInstanceId === a.endpoint_instance_id;
-}
-function pairKey(request) {
-    return JSON.stringify([
-        request.profile,
-        request.channel_id,
-        request.rendezvous_group_id,
-        request.listener_audience,
-    ]);
-}
-function rejectGeneration(state, generation, reason, retryable) {
-    if (generation.finished)
-        return;
-    detachGeneration(state, generation);
-    track(state, (async () => {
-        await Promise.allSettled([...generation.roles.values()].map(async (leg) => await reject(leg.received, reason, retryable, state.abort.signal)));
-        generation.abort.abort(new Error("Flowersec tunnel pair rejected"));
-        for (const leg of generation.roles.values())
-            leg.release();
-    })());
-}
-function finishGeneration(state, generation) {
-    if (generation.finished)
-        return;
-    detachGeneration(state, generation);
-    generation.abort.abort(new Error("Flowersec tunnel pair closed"));
-    for (const leg of generation.roles.values()) {
-        leg.received.carrier.abort({ code: 1, reason: "tunnel pair closed" });
-        leg.release();
-    }
-}
-function detachGeneration(state, generation) {
-    generation.finished = true;
-    if (generation.timer !== undefined)
-        clearTimeout(generation.timer);
-    if (generation.active)
-        state.counts.activePairs -= 1;
-    else if (generation.roles.size > 0)
-        state.counts.pendingLegs -= 1;
-    if (state.generations.get(generation.key) === generation)
-        state.generations.delete(generation.key);
-}
-async function acceptAdmission(received, signal) {
-    const response = encodeFSA2ResponseV2({ status: AdmissionStatusV2.Success, reason: "" });
-    let offset = 0;
-    while (offset < response.length) {
-        const written = await received.stream.write(response.subarray(offset), { signal });
-        if (written < 1 || written > response.length - offset)
-            throw new Error("invalid admission write");
-        offset += written;
-    }
-    await received.stream.closeWrite();
-}
-async function reject(received, reason, retryable, signal) {
-    const boundedReason = REASON.test(reason) ? reason : "invalid_credential";
-    try {
-        await rejectSessionAdmissionV2(received, {
-            accepted: false,
-            status: retryable ? AdmissionStatusV2.Retryable : AdmissionStatusV2.Reject,
-            reason: boundedReason,
-        }, signal);
-    }
-    catch {
-        // Rejection intentionally closes the carrier and reports through FSA2.
-    }
-}
-function validateOptions(options) {
-    const limits = {
-        maxPendingLegs: options.maxPendingLegs ?? DEFAULT_MAX_PENDING_LEGS,
-        maxActivePairs: options.maxActivePairs ?? DEFAULT_MAX_ACTIVE_PAIRS,
-        maxConcurrentStreams: options.maxConcurrentStreams ?? DEFAULT_MAX_CONCURRENT_STREAMS,
-        pairTimeoutMs: options.pairTimeoutMs ?? DEFAULT_PAIR_TIMEOUT_MS,
-        cleanupTimeoutMs: options.cleanupTimeoutMs ?? DEFAULT_CLEANUP_TIMEOUT_MS,
-    };
-    if (options.listeners.length === 0 || !Number.isSafeInteger(options.maxInboundStreams) ||
-        options.maxInboundStreams < 1 || options.maxInboundStreams > 128 || typeof options.authorize !== "function" ||
-        !boundedInteger(limits.maxPendingLegs, 1, 65_536) || !boundedInteger(limits.maxActivePairs, 1, 65_536) ||
-        !boundedInteger(limits.maxConcurrentStreams, 1, 128) || !boundedInteger(limits.pairTimeoutMs, 1, 60_000) ||
-        !boundedInteger(limits.cleanupTimeoutMs, 1, 60_000)) {
-        throw new TypeError("invalid Flowersec TunnelRuntime options");
-    }
-    return limits;
-}
-function boundedInteger(value, minimum, maximum) {
-    return Number.isSafeInteger(value) && value >= minimum && value <= maximum;
-}
-function pruneCredentials(state) {
-    const now = Math.floor(Date.now() / 1_000);
-    for (const [credential, expiry] of state.usedCredentials) {
-        if (expiry <= now)
-            state.usedCredentials.delete(credential);
-    }
-}
-function releaseDecision(state, decision) {
-    if (!ID.test(decision.leaseId))
-        return;
-    trackRelease(state, decision.leaseId);
-}
-function trackRelease(state, leaseId) {
-    if (state.options.release === undefined)
-        return;
-    track(state, Promise.resolve()
-        .then(async () => await state.options.release(leaseId))
-        .then(() => undefined));
-}
-function track(state, task) {
-    state.tasks.add(task);
-    void task.catch(() => undefined).finally(() => state.tasks.delete(task));
-}
-async function boundedCleanup(tasks, timeoutMs) {
-    await Promise.race([
-        Promise.allSettled([...tasks]).then(() => undefined),
-        new Promise((resolve) => setTimeout(resolve, timeoutMs)),
-    ]);
-}
-async function abortableCallback(promise, signal) {
-    if (signal.aborted)
-        throw asError(signal.reason);
-    return await new Promise((resolve, reject) => {
-        let settled = false;
-        const cleanup = () => signal.removeEventListener("abort", abort);
-        const abort = () => {
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
-            reject(asError(signal.reason));
-        };
-        signal.addEventListener("abort", abort, { once: true });
-        void promise.then((value) => {
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
-            resolve(value);
-        }, (error) => {
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
-            reject(error);
-        });
-    });
-}
-function aborted(signal) {
-    if (signal.aborted)
-        return Promise.resolve();
-    return new Promise((resolve) => signal.addEventListener("abort", () => resolve(), { once: true }));
-}
-function asError(error) {
-    return error instanceof Error ? error : new Error(String(error));
-}
-class StreamSlots {
-    maximum;
-    active = 0;
-    waiters = [];
-    constructor(maximum) {
-        this.maximum = maximum;
-    }
-    async acquire(signal) {
-        if (signal.aborted)
-            throw asError(signal.reason);
-        if (this.active >= this.maximum) {
-            await new Promise((resolve, reject) => {
-                const ready = () => { cleanup(); resolve(); };
-                const abort = () => { cleanup(); reject(asError(signal.reason)); };
-                const cleanup = () => {
-                    const index = this.waiters.indexOf(ready);
-                    if (index >= 0)
-                        this.waiters.splice(index, 1);
-                    signal.removeEventListener("abort", abort);
-                };
-                this.waiters.push(ready);
-                signal.addEventListener("abort", abort, { once: true });
-            });
-        }
-        this.active += 1;
-        let released = false;
-        return () => {
-            if (released)
-                return;
-            released = true;
-            this.active -= 1;
-            this.waiters.shift()?.();
-        };
-    }
-}

package/dist/node/v2.d.ts

@@ -1,11 +0,0 @@
-export * from "../v2/index.js";
-export { connect, createConnectionController } from "./connectSession.js";
-export type { ConnectionControllerOptions, SessionOptions, SessionTLSOptions, } from "./connectSession.js";
-export { AcceptedSession, Acceptor, HandlerRegistrationError, RPCHandlers, SessionHandlers, createAcceptor, } from "./acceptor.js";
-export type { AcceptorListener, AcceptorOptions, AuthorizationDecision, RPCHandler, RPCHandlerResult, NotificationHandler, SessionHandlerOptions, } from "./acceptor.js";
-export { TunnelRuntime, createTunnelRuntime } from "./tunnelRuntime.js";
-export type { TunnelAuthorizationDecision, TunnelRuntimeListener, TunnelRuntimeOptions, } from "./tunnelRuntime.js";
-export { AuthorizationRecord, AuthorizationResponse, TunnelAuthorizationResponse, ControlPlaneError, EndpointSet, IssuedArtifact, Issuer, RuntimeAuthorizationRequest, authorizeRuntime, authorizeTunnelRuntime, createEndpointSet, parseAuthorizationRecord, parseRuntimeAuthorizationRequest, rejectRuntime, rejectTunnelRuntime, } from "./controlplane.js";
-export type { ArtifactMetadata, ControlPlaneErrorCode, DirectIssueOptions, IssuedTunnelPair, Scope, SessionOptions as ControlPlaneSessionOptions, TunnelIssueOptions, } from "./controlplane.js";
-export { ProxyServer, ProxyServerError } from "./proxyServer.js";
-export type { ProxyServerOptions, StreamHandlerRegistrar } from "./proxyServer.js";

package/dist/node/v2.js

@@ -1,6 +0,0 @@
-export * from "../v2/index.js";
-export { connect, createConnectionController } from "./connectSession.js";
-export { AcceptedSession, Acceptor, HandlerRegistrationError, RPCHandlers, SessionHandlers, createAcceptor, } from "./acceptor.js";
-export { TunnelRuntime, createTunnelRuntime } from "./tunnelRuntime.js";
-export { AuthorizationRecord, AuthorizationResponse, TunnelAuthorizationResponse, ControlPlaneError, EndpointSet, IssuedArtifact, Issuer, RuntimeAuthorizationRequest, authorizeRuntime, authorizeTunnelRuntime, createEndpointSet, parseAuthorizationRecord, parseRuntimeAuthorizationRequest, rejectRuntime, rejectTunnelRuntime, } from "./controlplane.js";
-export { ProxyServer, ProxyServerError } from "./proxyServer.js";

package/dist/node/webSocketServer.d.ts

@@ -1,24 +0,0 @@
-import type { CarrierSessionV2 } from "../v2/carrier.js";
-import type { PathKind } from "../v2/contract.js";
-export type NodeWebSocketServerOptions = Readonly<{
-    host: string;
-    port: number;
-    path: PathKind;
-    tls?: Readonly<{
-        certificate: string;
-        privateKey: string;
-    }>;
-    allowedOrigins: readonly string[];
-    inboundBidirectionalStreamCapacity: number;
-}>;
-export type NodeWebSocketServer = Readonly<{
-    address(): Readonly<{
-        host: string;
-        port: number;
-    }>;
-    accept(options?: Readonly<{
-        signal?: AbortSignal;
-    }>): Promise<CarrierSessionV2>;
-    close(): Promise<void>;
-}>;
-export declare function startNodeWebSocketServer(options: NodeWebSocketServerOptions): Promise<NodeWebSocketServer>;