@goodandready/dsh-remote-workspace 0.1.0 → 0.2.0

package/lib/routes.js

@@ -1,63 +1,88 @@
-function writeJson(res, code, data) {
-  try {
-    res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-    res.end(JSON.stringify(data));
-  } catch {}
-}
+export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelService, store) {
+  function writeJson(res, statusCode, body) {
+    if (typeof res.setHeader === 'function') {
+      res.setHeader('Content-Type', 'application/json; charset=utf-8');
+      res.statusCode = statusCode;
+    } else if (typeof res.writeHead === 'function') {
+      res.writeHead(statusCode, { 'Content-Type': 'application/json; charset=utf-8' });
+    } else {
+      res.statusCode = statusCode;
+    }
+    res.end(JSON.stringify(body));
+  }
 
-function readBody(req, maxBytes = 256 * 1024) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    let size = 0;
-    req.on('data', (c) => {
-      size += c.length;
-      if (size > maxBytes) {
-        reject(new Error('Payload too large'));
-        req.destroy();
-        return;
-      }
-      chunks.push(c);
-    });
-    req.on('end', () => {
-      try {
-        const raw = Buffer.concat(chunks).toString('utf8');
-        resolve(raw ? JSON.parse(raw) : {});
-      } catch (err) {
-        reject(new Error('Invalid JSON'));
-      }
+  function readBody(req) {
+    return new Promise((resolve, reject) => {
+      let body = '';
+      req.on('data', (chunk) => { body += chunk.toString(); });
+      req.on('end', () => {
+        try {
+          resolve(body ? JSON.parse(body) : {});
+        } catch (err) {
+          reject(err);
+        }
+      });
+      req.on('error', reject);
     });
-    req.on('error', reject);
-  });
-}
+  }
+
+  function isTrustedSettingsRequest(req) {
+    const rawAuth = req.headers['authorization'];
+    if (typeof rawAuth === 'string' && rawAuth.startsWith('Bearer ')) return true;
+    const cookieHeader = req.headers['cookie'];
+    if (typeof cookieHeader === 'string' && (cookieHeader.includes('token=') || cookieHeader.includes('dsh_token='))) {
+      return true;
+    }
+    const secFetch = req.headers['sec-fetch-site'];
+    if (secFetch === 'same-origin') return true;
+    const ip = req.socket?.remoteAddress || '';
+    if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') return true;
+    return false;
+  }
 
-export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelService, store) {
   ctx.inject(['webServer'], (sctx) => {
+    const webServer = sctx.get ? (sctx.get('webServer') ?? sctx.webServer) : sctx.webServer;
+    if (!webServer || typeof webServer.register !== 'function') return;
+
     // 1. GET /dsh-remote-workspace/state
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/state',
       handler: async (req, res) => {
-        if (req.method !== 'GET') return writeJson(res, 405, { error: 'GET only' });
-        const profiles = store.getProfiles();
-        const activeId = store.getActiveId();
-        const tunnels = tunnelService.listActiveTunnels();
-        writeJson(res, 200, { ok: true, profiles, activeId, tunnels });
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+        try {
+          const profiles = store.getProfiles();
+          const activeId = store.getActiveId() || (profiles[0]?.id || '');
+          const tunnels = tunnelService.listActiveTunnels();
+          writeJson(res, 200, {
+            ok: true,
+            profiles,
+            activeId,
+            tunnels,
+            vaultProtected: true
+          });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
       }
     }), 'dsh-remote-workspace: /state');
 
     // 2. POST /dsh-remote-workspace/profiles/save
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/profiles/save',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const profile = await readBody(req);
           if (!profile.id || !profile.host) {
             return writeJson(res, 400, { ok: false, error: 'ID and Host are required' });
           }
+          sshService.invalidate(profile.id);
           await store.saveProfile(profile);
-          writeJson(res, 200, { ok: true, profile });
+          const sanitized = store.vault ? store.vault.sanitizeProfile(profile) : profile;
+          writeJson(res, 200, { ok: true, profile: sanitized });
         } catch (err) {
           writeJson(res, 500, { ok: false, error: err.message });
         }
@@ -65,14 +90,16 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /profiles/save');
 
     // 3. POST /dsh-remote-workspace/profiles/delete
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/profiles/delete',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const { id } = await readBody(req);
           if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
+          sshService.disconnect(id);
           await store.deleteProfile(id);
           writeJson(res, 200, { ok: true });
         } catch (err) {
@@ -82,11 +109,12 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /profiles/delete');
 
     // 4. POST /dsh-remote-workspace/profiles/active
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/profiles/active',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const { id } = await readBody(req);
           await store.setActiveId(id || null);
@@ -98,19 +126,30 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /profiles/active');
 
     // 5. POST /dsh-remote-workspace/test
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/test',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const body = await readBody(req);
-          const profile = body.profile || (body.id ? store.getProfile(body.id) : body);
+          let profile = body.profile || (body.id ? store.getProfile(body.id) : body);
+          if (store.vault && profile) {
+            profile = store.vault.hydrateProfile(profile);
+          }
           if (!profile || !profile.host) {
             return writeJson(res, 400, { ok: false, error: 'Invalid profile configuration' });
           }
           const result = await sshService.testConnection(profile);
-          writeJson(res, 200, { ok: result.success, ...result });
+          writeJson(res, 200, {
+            ok: result.success,
+            success: result.success,
+            latency: result.latency,
+            latencyMs: result.latency,
+            os: result.os,
+            remoteOs: result.os
+          });
         } catch (err) {
           writeJson(res, 200, { ok: false, error: err.message });
         }
@@ -118,11 +157,12 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
     }), 'dsh-remote-workspace: /test');
 
     // 6. POST /dsh-remote-workspace/browse
-    sctx.effect(() => sctx.webServer.register({
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/browse',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const body = await readBody(req);
           const profile = body.profile || (body.profileId ? store.getProfile(body.profileId) : store.getActiveProfile());
@@ -130,7 +170,7 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
             return writeJson(res, 400, { ok: false, error: 'No profile specified' });
           }
           const remotePath = body.remotePath || '/';
-          const entries = await remoteFs.listDir(profile, remotePath);
+          const entries = await remoteFs.listDir(profile, remotePath, Boolean(body.refresh));
           writeJson(res, 200, { ok: true, currentPath: remotePath, entries });
         } catch (err) {
           writeJson(res, 500, { ok: false, error: err.message });
@@ -138,21 +178,159 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
       }
     }), 'dsh-remote-workspace: /browse');
 
-    // 7. POST /dsh-remote-workspace/sync
-    sctx.effect(() => sctx.webServer.register({
+    // 7. POST /dsh-remote-workspace/file/view
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/file/view',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, filePath } = await readBody(req);
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+          if (!filePath) return writeJson(res, 400, { ok: false, error: 'filePath required' });
+
+          const stat = await remoteFs.stat(profile, filePath);
+          if (stat.size > 1024 * 512) {
+            return writeJson(res, 400, { ok: false, error: `File too large for preview (${Math.round(stat.size / 1024)} KB). Max 512 KB.` });
+          }
+
+          const content = await remoteFs.readFile(profile, filePath, 'utf8');
+          writeJson(res, 200, { ok: true, filePath, content, size: stat.size, mtime: stat.mtime });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /file/view');
+
+    // 8. POST /dsh-remote-workspace/file/save
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/file/save',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, filePath, content } = await readBody(req);
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+          if (!filePath || content === undefined) return writeJson(res, 400, { ok: false, error: 'filePath and content required' });
+
+          const result = await remoteFs.writeFile(profile, filePath, content, 'utf8');
+          writeJson(res, 200, { ok: true, ...result });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /file/save');
+
+    // 9. POST /dsh-remote-workspace/terminal/create
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/terminal/create',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, cols, rows } = await readBody(req);
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+
+          const session = await sshService.createTerminalSession(profile, { cols, rows });
+          writeJson(res, 200, { ok: true, sessionId: session.id });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /terminal/create');
+
+    // 10. POST /dsh-remote-workspace/terminal/input
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/terminal/input',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { sessionId, data } = await readBody(req);
+          const session = sshService.getTerminalSession(sessionId);
+          if (!session) return writeJson(res, 404, { ok: false, error: 'Terminal session not found' });
+          session.write(data || '');
+          writeJson(res, 200, { ok: true });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /terminal/input');
+
+    // 11. GET /dsh-remote-workspace/terminal/stream (SSE)
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/terminal/stream',
+      handler: async (req, res) => {
+        const url = new URL(req.url, 'http://localhost');
+        const sessionId = url.searchParams.get('sessionId');
+        const session = sshService.getTerminalSession(sessionId);
+        if (!session) return writeJson(res, 404, { ok: false, error: 'Terminal session not found' });
+
+        if (typeof res.writeHead === 'function') {
+          res.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            'Connection': 'keep-alive'
+          });
+        }
+
+        // Send historical buffer
+        for (const chunk of session.buffer) {
+          res.write(`data: ${JSON.stringify({ chunk })}\n\n`);
+        }
+
+        const listener = (chunk) => {
+          res.write(`data: ${JSON.stringify({ chunk })}\n\n`);
+        };
+        session.subscribers.add(listener);
+
+        req.on('close', () => {
+          session.subscribers.delete(listener);
+        });
+      }
+    }), 'dsh-remote-workspace: /terminal/stream');
+
+    // 12. POST /dsh-remote-workspace/terminal/close
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/terminal/close',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { sessionId } = await readBody(req);
+          const ok = sshService.closeTerminalSession(sessionId);
+          writeJson(res, 200, { ok });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /terminal/close');
+
+    // 13. POST /dsh-remote-workspace/sync
+    sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/sync',
       handler: async (req, res) => {
-        if (req.method !== 'POST') return writeJson(res, 405, { error: 'POST only' });
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
-          const { profileId, direction } = await readBody(req);
-          const profile = store.getProfile(profileId) || store.getActiveProfile();
+          const { profileId, direction, force } = await readBody(req);
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
           if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
           if (!profile.remoteWorkspace || !profile.localMirrorPath) {
-            return writeJson(res, 400, { ok: false, error: 'Both remoteWorkspace and localMirrorPath must be set' });
+            return writeJson(res, 400, { ok: false, error: 'Both remoteWorkspace and localMirrorPath must be configured' });
           }
           const resSync = direction === 'push'
-            ? await mirrorSync.push(profile, profile.localMirrorPath, profile.remoteWorkspace)
+            ? await mirrorSync.push(profile, profile.localMirrorPath, profile.remoteWorkspace, Boolean(force))
             : await mirrorSync.pull(profile, profile.remoteWorkspace, profile.localMirrorPath);
           writeJson(res, 200, { ok: resSync.success, ...resSync });
         } catch (err) {
@@ -160,5 +338,61 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
         }
       }
     }), 'dsh-remote-workspace: /sync');
+
+    // 14. POST /dsh-remote-workspace/tunnels/start
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/tunnels/start',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, localPort, targetHost, remotePort } = await readBody(req);
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+          const lPort = parseInt(localPort, 10);
+          const rPort = parseInt(remotePort, 10);
+          if (!lPort || !rPort) {
+            return writeJson(res, 400, { ok: false, error: 'Valid localPort and remotePort required' });
+          }
+          const result = await tunnelService.startLocalTunnel(profile, lPort, targetHost || '127.0.0.1', rPort);
+          writeJson(res, 200, { ok: result.success, ...result });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /tunnels/start');
+
+    // 15. POST /dsh-remote-workspace/tunnels/stop
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/tunnels/stop',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { tunnelId } = await readBody(req);
+          if (!tunnelId) return writeJson(res, 400, { ok: false, error: 'tunnelId required' });
+          const stopped = tunnelService.stopTunnel(tunnelId);
+          writeJson(res, 200, { ok: stopped });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /tunnels/stop');
+
+    // 16. GET /dsh-remote-workspace/tunnels/telemetry
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/tunnels/telemetry',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+        try {
+          writeJson(res, 200, { ok: true, tunnels: tunnelService.listActiveTunnels() });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /tunnels/telemetry');
   });
 }