@goodandready/dsh-remote-workspace 0.1.1 → 0.3.0

package/lib/routes.js

@@ -1,41 +1,45 @@
-export function writeJson(res, code, data) {
-  try {
-    res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' });
-    res.end(JSON.stringify(data));
-  } catch {}
-}
+export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelService, store, dockerService, healthService, watcherService) {
+  function writeJson(res, statusCode, body) {
+    if (typeof res.setHeader === 'function') {
+      res.setHeader('Content-Type', 'application/json; charset=utf-8');
+      res.statusCode = statusCode;
+    } else if (typeof res.writeHead === 'function') {
+      res.writeHead(statusCode, { 'Content-Type': 'application/json; charset=utf-8' });
+    } else {
+      res.statusCode = statusCode;
+    }
+    res.end(JSON.stringify(body));
+  }
 
-export function readBody(req, maxBytes = 256 * 1024) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    let size = 0;
-    req.on('data', (c) => {
-      size += c.length;
-      if (size > maxBytes) {
-        reject(new Error('Payload too large'));
-        req.destroy();
-        return;
-      }
-      chunks.push(c);
-    });
-    req.on('end', () => {
-      try {
-        const raw = Buffer.concat(chunks).toString('utf8');
-        resolve(raw ? JSON.parse(raw) : {});
-      } catch (err) {
-        reject(new Error('Invalid JSON'));
-      }
+  function readBody(req) {
+    return new Promise((resolve, reject) => {
+      let body = '';
+      req.on('data', (chunk) => { body += chunk.toString(); });
+      req.on('end', () => {
+        try {
+          resolve(body ? JSON.parse(body) : {});
+        } catch (err) {
+          reject(err);
+        }
+      });
+      req.on('error', reject);
     });
-    req.on('error', reject);
-  });
-}
+  }
 
-/** Reject cross-site writes. LAN / reverse-proxy UIs are allowed. */
-export function isTrustedSettingsRequest(request) {
-  return request.headers['sec-fetch-site'] !== 'cross-site';
-}
+  function isTrustedSettingsRequest(req) {
+    const rawAuth = req.headers['authorization'];
+    if (typeof rawAuth === 'string' && rawAuth.startsWith('Bearer ')) return true;
+    const cookieHeader = req.headers['cookie'];
+    if (typeof cookieHeader === 'string' && (cookieHeader.includes('token=') || cookieHeader.includes('dsh_token='))) {
+      return true;
+    }
+    const secFetch = req.headers['sec-fetch-site'];
+    if (secFetch === 'same-origin') return true;
+    const ip = req.socket?.remoteAddress || '';
+    if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') return true;
+    return false;
+  }
 
-export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelService, store) {
   ctx.inject(['webServer'], (sctx) => {
     const webServer = sctx.get ? (sctx.get('webServer') ?? sctx.webServer) : sctx.webServer;
     if (!webServer || typeof webServer.register !== 'function') return;
@@ -46,10 +50,22 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
       path: '/dsh-remote-workspace/state',
       handler: async (req, res) => {
         if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-        const profiles = store.getProfiles();
-        const activeId = store.getActiveId();
-        const tunnels = tunnelService.listActiveTunnels();
-        writeJson(res, 200, { ok: true, profiles, activeId, tunnels });
+        try {
+          const profiles = store.getProfiles();
+          const activeId = store.getActiveId() || (profiles[0]?.id || '');
+          const tunnels = tunnelService.listActiveTunnels();
+          const autoSync = store.isAutoSyncEnabled ? store.isAutoSyncEnabled() : false;
+          writeJson(res, 200, {
+            ok: true,
+            profiles,
+            activeId,
+            tunnels,
+            autoSync,
+            vaultProtected: true
+          });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
       }
     }), 'dsh-remote-workspace: /state');
 
@@ -67,7 +83,8 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
           }
           sshService.invalidate(profile.id);
           await store.saveProfile(profile);
-          writeJson(res, 200, { ok: true, profile });
+          const sanitized = store.vault ? store.vault.sanitizeProfile(profile) : profile;
+          writeJson(res, 200, { ok: true, profile: sanitized });
         } catch (err) {
           writeJson(res, 500, { ok: false, error: err.message });
         }
@@ -119,7 +136,10 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
         if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
           const body = await readBody(req);
-          const profile = body.profile || (body.id ? store.getProfile(body.id) : body);
+          let profile = body.profile || (body.id ? store.getProfile(body.id) : body);
+          if (store.vault && profile) {
+            profile = store.vault.hydrateProfile(profile);
+          }
           if (!profile || !profile.host) {
             return writeJson(res, 400, { ok: false, error: 'Invalid profile configuration' });
           }
@@ -152,7 +172,7 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
             return writeJson(res, 400, { ok: false, error: 'No profile specified' });
           }
           const remotePath = body.remotePath || '/';
-          const entries = await remoteFs.listDir(profile, remotePath);
+          const entries = await remoteFs.listDir(profile, remotePath, Boolean(body.refresh));
           writeJson(res, 200, { ok: true, currentPath: remotePath, entries });
         } catch (err) {
           writeJson(res, 500, { ok: false, error: err.message });
@@ -160,7 +180,143 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
       }
     }), 'dsh-remote-workspace: /browse');
 
-    // 7. POST /dsh-remote-workspace/sync
+    // 7. POST /dsh-remote-workspace/file/view
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/file/view',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, filePath } = await readBody(req);
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+          if (!filePath) return writeJson(res, 400, { ok: false, error: 'filePath required' });
+
+          const stat = await remoteFs.stat(profile, filePath);
+          if (stat.size > 1024 * 512) {
+            return writeJson(res, 400, { ok: false, error: `File too large for preview (${Math.round(stat.size / 1024)} KB). Max 512 KB.` });
+          }
+
+          const content = await remoteFs.readFile(profile, filePath, 'utf8');
+          writeJson(res, 200, { ok: true, filePath, content, size: stat.size, mtime: stat.mtime });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /file/view');
+
+    // 8. POST /dsh-remote-workspace/file/save
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/file/save',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, filePath, content } = await readBody(req);
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+          if (!filePath || content === undefined) return writeJson(res, 400, { ok: false, error: 'filePath and content required' });
+
+          const result = await remoteFs.writeFile(profile, filePath, content, 'utf8');
+          writeJson(res, 200, { ok: true, ...result });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /file/save');
+
+    // 9. POST /dsh-remote-workspace/terminal/create
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/terminal/create',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, cols, rows } = await readBody(req);
+          const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
+
+          const session = await sshService.createTerminalSession(profile, { cols, rows });
+          writeJson(res, 200, { ok: true, sessionId: session.id });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /terminal/create');
+
+    // 10. POST /dsh-remote-workspace/terminal/input
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/terminal/input',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { sessionId, data } = await readBody(req);
+          const session = sshService.getTerminalSession(sessionId);
+          if (!session) return writeJson(res, 404, { ok: false, error: 'Terminal session not found' });
+          session.write(data || '');
+          writeJson(res, 200, { ok: true });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /terminal/input');
+
+    // 11. GET /dsh-remote-workspace/terminal/stream (SSE)
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/terminal/stream',
+      handler: async (req, res) => {
+        const url = new URL(req.url, 'http://localhost');
+        const sessionId = url.searchParams.get('sessionId');
+        const session = sshService.getTerminalSession(sessionId);
+        if (!session) return writeJson(res, 404, { ok: false, error: 'Terminal session not found' });
+
+        if (typeof res.writeHead === 'function') {
+          res.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            'Connection': 'keep-alive'
+          });
+        }
+
+        for (const chunk of session.buffer) {
+          res.write(`data: ${JSON.stringify({ chunk })}\n\n`);
+        }
+
+        const listener = (chunk) => {
+          res.write(`data: ${JSON.stringify({ chunk })}\n\n`);
+        };
+        session.subscribers.add(listener);
+
+        req.on('close', () => {
+          session.subscribers.delete(listener);
+        });
+      }
+    }), 'dsh-remote-workspace: /terminal/stream');
+
+    // 12. POST /dsh-remote-workspace/terminal/close
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/terminal/close',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { sessionId } = await readBody(req);
+          const ok = sshService.closeTerminalSession(sessionId);
+          writeJson(res, 200, { ok });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /terminal/close');
+
+    // 13. POST /dsh-remote-workspace/sync
     sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/sync',
@@ -168,14 +324,14 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
         if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
         if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
         try {
-          const { profileId, direction } = await readBody(req);
+          const { profileId, direction, force } = await readBody(req);
           const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
           if (!profile) return writeJson(res, 404, { ok: false, error: 'Profile not found' });
           if (!profile.remoteWorkspace || !profile.localMirrorPath) {
             return writeJson(res, 400, { ok: false, error: 'Both remoteWorkspace and localMirrorPath must be configured' });
           }
           const resSync = direction === 'push'
-            ? await mirrorSync.push(profile, profile.localMirrorPath, profile.remoteWorkspace)
+            ? await mirrorSync.push(profile, profile.localMirrorPath, profile.remoteWorkspace, Boolean(force))
             : await mirrorSync.pull(profile, profile.remoteWorkspace, profile.localMirrorPath);
           writeJson(res, 200, { ok: resSync.success, ...resSync });
         } catch (err) {
@@ -184,7 +340,7 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
       }
     }), 'dsh-remote-workspace: /sync');
 
-    // 8. POST /dsh-remote-workspace/tunnels/start
+    // 14. POST /dsh-remote-workspace/tunnels/start
     sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/tunnels/start',
@@ -208,7 +364,7 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
       }
     }), 'dsh-remote-workspace: /tunnels/start');
 
-    // 9. POST /dsh-remote-workspace/tunnels/stop
+    // 15. POST /dsh-remote-workspace/tunnels/stop
     sctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/dsh-remote-workspace/tunnels/stop',
@@ -225,5 +381,142 @@ export function registerApiRoutes(ctx, sshService, remoteFs, mirrorSync, tunnelS
         }
       }
     }), 'dsh-remote-workspace: /tunnels/stop');
+
+    // 16. GET /dsh-remote-workspace/tunnels/telemetry
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/tunnels/telemetry',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+        try {
+          writeJson(res, 200, { ok: true, tunnels: tunnelService.listActiveTunnels() });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /tunnels/telemetry');
+
+    // 17. GET /dsh-remote-workspace/health
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/health',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+        try {
+          const url = new URL(req.url, 'http://localhost');
+          const profileId = url.searchParams.get('profileId');
+          const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+
+          const health = await healthService.getHealth(profile);
+          writeJson(res, 200, { ok: true, health });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /health');
+
+    // 18. GET /dsh-remote-workspace/docker/list
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/docker/list',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
+        try {
+          const url = new URL(req.url, 'http://localhost');
+          const profileId = url.searchParams.get('profileId');
+          const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+
+          const result = await dockerService.listContainers(profile, true);
+          writeJson(res, 200, { ok: true, ...result });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /docker/list');
+
+    // 19. POST /dsh-remote-workspace/docker/action
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/docker/action',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, containerId, action } = await readBody(req);
+          const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+          if (!containerId || !action) return writeJson(res, 400, { ok: false, error: 'containerId and action required' });
+
+          const result = await dockerService.containerAction(profile, containerId, action);
+          writeJson(res, 200, { ok: result.success, ...result });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /docker/action');
+
+    // 20. POST /dsh-remote-workspace/docker/logs
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/docker/logs',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { profileId, containerId, tail } = await readBody(req);
+          const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
+          if (!profile) return writeJson(res, 404, { ok: false, error: 'No active profile' });
+          if (!containerId) return writeJson(res, 400, { ok: false, error: 'containerId required' });
+
+          const result = await dockerService.containerLogs(profile, containerId, tail || 100);
+          writeJson(res, 200, { ok: result.success, ...result });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /docker/logs');
+
+    // 21. POST /dsh-remote-workspace/watcher/toggle
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/watcher/toggle',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { enabled } = await readBody(req);
+          await store.setAutoSyncEnabled(Boolean(enabled));
+          writeJson(res, 200, { ok: true, autoSync: store.isAutoSyncEnabled() });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /watcher/toggle');
+
+    // 22. POST /dsh-remote-workspace/transfer
+    sctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/dsh-remote-workspace/transfer',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
+        if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+        try {
+          const { sourceProfileId, sourcePath, destProfileId, destPath } = await readBody(req);
+          const srcProfile = sourceProfileId ? store.getProfile(sourceProfileId) : store.getActiveProfile();
+          const destProfile = store.getProfile(destProfileId);
+
+          if (!srcProfile) return writeJson(res, 404, { ok: false, error: 'Source profile not found' });
+          if (!destProfile) return writeJson(res, 404, { ok: false, error: 'Destination profile not found' });
+          if (!sourcePath || !destPath) return writeJson(res, 400, { ok: false, error: 'sourcePath and destPath required' });
+
+          const result = await sshService.transferFileBetweenHosts(srcProfile, sourcePath, destProfile, destPath);
+          writeJson(res, 200, { ok: result.success, ...result });
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err.message });
+        }
+      }
+    }), 'dsh-remote-workspace: /transfer');
   });
 }