@imenam/self-register-proxy 1.0.37

package/proxy.js

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+
+const path = require('path');
+require('dotenv').config({ path: path.join(__dirname, '.env') });
+
+const express = require('express');
+const helmet = require('helmet');
+const rateLimit = require('express-rate-limit');
+const { setupLogging } = require('./logger');
+
+setupLogging('PROXY');
+
+// Config — doit être importé après dotenv
+const {
+  PROXY_PORT,
+  PROXY_NAME,
+  INTERNAL_PORT_START,
+  INTERNAL_PORT_END,
+  HEALTH_CHECK_INTERVAL,
+  HEALTH_CHECK_GRACE_PERIOD,
+  ADMIN_PASSWORD,
+  TERMINAL_CWD,
+  TERMINAL_COMMAND,
+} = require('./config');
+
+if (ADMIN_PASSWORD && !process.env.PROXY_SESSION_SECRET) {
+  console.error('FATAL: PROXY_SESSION_SECRET must be set when ADMIN_PASSWORD is configured.');
+  console.error('Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"');
+  process.exit(1);
+}
+
+// Services
+const { startHealthCheckPolling } = require('./services/healthCheck');
+const { routingMiddleware } = require('./services/proxyRouter');
+const { parseCookies, verifySignedToken, isValidSession } = require('./services/auth');
+
+// Routes
+const registrationRoutes = require('./routes/registration');
+const metaConfigRoutes = require('./routes/metaConfig');
+const terminalRoutes = require('./routes/terminal');
+const dashboardRoutes = require('./routes/dashboard');
+
+const app = express();
+
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", "'unsafe-inline'", "https://cdn.tailwindcss.com", "https://cdn.jsdelivr.net"],
+      scriptSrcAttr: ["'unsafe-inline'"],
+      styleSrc: ["'self'", "'unsafe-inline'", "https://cdn.jsdelivr.net"],
+      connectSrc: ["'self'", "ws:", "wss:"],
+      imgSrc: ["'self'", "data:", "https://i.ytimg.com"],
+    },
+  },
+  hsts: ADMIN_PASSWORD ? { maxAge: 31536000, includeSubDomains: true } : false,
+  referrerPolicy: { policy: 'same-origin' },
+}));
+
+const isLocalRequest = (req) => {
+  const ip = req.ip || req.connection?.remoteAddress || '';
+  return ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
+};
+
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 10,
+  message: { success: false, error: 'Too many login attempts, try again later' },
+  standardHeaders: true,
+  legacyHeaders: false,
+  skip: isLocalRequest,
+});
+app.use('/proxy/login', loginLimiter);
+
+const globalLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 300,
+  standardHeaders: true,
+  legacyHeaders: false,
+  skip: isLocalRequest,
+});
+app.use(globalLimiter);
+
+app.use(express.json({ limit: '1mb' }));
+app.use(express.urlencoded({ limit: '1mb', extended: false }));
+
+// Routes (ordre important : spécifiques avant le catch-all)
+app.use(dashboardRoutes);
+app.use(registrationRoutes);
+app.use(metaConfigRoutes);
+app.use(terminalRoutes);
+
+// Middleware proxy (catch-all, doit être en dernier)
+app.use(routingMiddleware);
+
+// ============================================
+// DÉMARRAGE DU SERVEUR
+// ============================================
+
+const server = app.listen(PROXY_PORT, () => {
+  console.log('='.repeat(50));
+  console.log(`🚀 ${PROXY_NAME}`);
+  console.log('='.repeat(50));
+  console.log(`Listening on port ${PROXY_PORT}`);
+  console.log(`Internal ports range: ${INTERNAL_PORT_START}-${INTERNAL_PORT_END}`);
+  console.log(`Health check interval: ${HEALTH_CHECK_INTERVAL}ms`);
+  console.log(`Health check grace period: ${HEALTH_CHECK_GRACE_PERIOD}ms`);
+  console.log('');
+
+  if (!ADMIN_PASSWORD) {
+    console.log('⚠️  WARNING: ADMIN_PASSWORD is not set — web interface is unprotected');
+  } else {
+    console.log('🔒 Web interface protected by admin password');
+    console.log('🔒 Session secret configured');
+  }
+  console.log('🔒 API routes restricted to localhost only');
+  console.log('');
+
+  console.log('API Endpoints:');
+  console.log('  POST   /proxy/register-auto    - Register a new route (auto port)');
+  console.log('  POST   /proxy/register-manual  - Register a new route (manual port)');
+  console.log('  DELETE /proxy/unregister - Remove a route');
+  console.log('  GET    /proxy/routes     - List all routes');
+  console.log('  GET    /proxy/health     - Health check');
+  console.log('  GET    /proxy/login      - Admin login page');
+  console.log('  GET    /proxy/terminal   - Agent terminal');
+  console.log('');
+  console.log('Note: Registered servers must implement GET /proxy/health');
+  console.log('      returning status 200 to stay registered.');
+  console.log('='.repeat(50));
+
+  // Terminal en ligne
+  const { TerminalServer } = require('./terminal-server');
+  new TerminalServer(server, {
+    path: '/terminal-ws',
+    command: TERMINAL_COMMAND,
+    ptyOptions: {
+      cwd: TERMINAL_CWD,
+    },
+    wsOptions: {
+      verifyClient: (info) => {
+        if (ADMIN_PASSWORD) {
+          const origin = info.origin || info.req.headers.origin;
+          const host = info.req.headers.host;
+          if (origin) {
+            try {
+              const originHost = new URL(origin).host;
+              if (originHost !== host) return false;
+            } catch {
+              return false;
+            }
+          }
+
+          const cookies = parseCookies(info.req);
+          const signedValue = cookies['proxy_session'];
+          if (!signedValue) return false;
+          const token = verifySignedToken(signedValue);
+          return token ? isValidSession(token) : false;
+        }
+        return true;
+      },
+    },
+  });
+  console.log(`🖥️  Agent terminal at /proxy/terminal (cwd: ${TERMINAL_CWD}, command: ${TERMINAL_COMMAND || 'none'})`);
+
+  startHealthCheckPolling();
+});
+
+module.exports = { app };

package/routes/dashboard.js

@@ -0,0 +1,152 @@
+const { Router } = require('express');
+const { exec } = require('child_process');
+const { requireAuth } = require('../services/auth');
+const { safeEqual, createSession, setSessionCookie, destroySession, clearSessionCookie, getSessionFromCookie } = require('../services/auth');
+const { registry } = require('../services/registry');
+const { renderLogin } = require('../views/login');
+const { renderDashboard } = require('../views/dashboard');
+const { PROXY_NAME, PROXY_PORT, ADMIN_PASSWORD, INTERNAL_PORT_START, INTERNAL_PORT_END, OPENCODE_CLEAN_UP, TERMINAL_CWD } = require('../config');
+
+const router = Router();
+
+/**
+ * GET /proxy/health
+ * Health check du proxy — info minimale sans auth, complète avec auth
+ */
+router.get('/proxy/health', (req, res) => {
+  if (!ADMIN_PASSWORD || getSessionFromCookie(req)) {
+    return res.json({
+      name: PROXY_NAME,
+      status: 'healthy',
+      uptime: process.uptime(),
+      registeredRoutes: registry.routes.size,
+      usedPorts: registry.usedPorts.size
+    });
+  }
+  res.json({ status: 'healthy' });
+});
+
+/**
+ * GET /proxy/login
+ * Page de connexion administrateur
+ */
+router.get('/proxy/login', (req, res) => {
+  const error = req.query.error === '1';
+  res.type('html').send(renderLogin(PROXY_NAME, error));
+});
+
+/**
+ * POST /proxy/login
+ * Traitement du formulaire de connexion
+ */
+router.post('/proxy/login', (req, res) => {
+  const { password } = req.body;
+
+  if (ADMIN_PASSWORD && safeEqual(password, ADMIN_PASSWORD)) {
+    const token = createSession();
+    setSessionCookie(res, token);
+    return res.redirect('/');
+  }
+
+  res.redirect('/proxy/login?error=1');
+});
+
+/**
+ * POST /proxy/logout
+ * Déconnexion — détruit la session et redirige vers /proxy/login
+ */
+router.post('/proxy/logout', (req, res) => {
+  const sessionToken = getSessionFromCookie(req);
+  if (sessionToken) {
+    destroySession(sessionToken);
+  }
+  clearSessionCookie(res);
+  res.redirect('/proxy/login');
+});
+
+/**
+ * GET /
+ * Dashboard — retourne HTML ou JSON selon l'en-tête Accept
+ */
+router.get('/', requireAuth, (req, res) => {
+  const routes = [];
+  registry.routes.forEach((value, path) => {
+    routes.push({
+      path,
+      port: value.port,
+      target: value.target || 'http://localhost',
+      name: value.name,
+      healthCheck: value.healthCheck,
+      registeredAt: value.registeredAt,
+      fullTarget: `${value.target || 'http://localhost'}:${value.port}`
+    });
+  });
+
+  routes.sort((a, b) => a.name.localeCompare(b.name));
+
+  const acceptHeader = req.get('Accept') || '';
+  const wantsJson = acceptHeader.includes('application/json') ||
+                    (acceptHeader.includes('*/*') && !acceptHeader.includes('text/html'));
+
+  if (wantsJson) {
+    return res.json({
+      name: PROXY_NAME,
+      status: 'healthy',
+      uptime: process.uptime(),
+      count: routes.length,
+      routes,
+      availablePorts: (INTERNAL_PORT_END - INTERNAL_PORT_START) - registry.usedPorts.size
+    });
+  }
+
+  const availablePorts = (INTERNAL_PORT_END - INTERNAL_PORT_START) - registry.usedPorts.size;
+  const html = renderDashboard(routes, availablePorts, PROXY_NAME, !!ADMIN_PASSWORD, OPENCODE_CLEAN_UP);
+  res.type('html').send(html);
+});
+
+/**
+ * POST /proxy/cleanup
+ * Exécute la commande de nettoyage des processus (OPENCODE_CLEAN_UP)
+ */
+router.post('/proxy/cleanup', requireAuth, (req, res) => {
+  if (!OPENCODE_CLEAN_UP) {
+    return res.status(400).json({ error: 'OPENCODE_CLEAN_UP non configuré' });
+  }
+  console.log(`[CLEANUP] CWD: ${TERMINAL_CWD}`);
+  console.log(`[CLEANUP] Executing: ${OPENCODE_CLEAN_UP}`);
+  exec(OPENCODE_CLEAN_UP, { shell: true, cwd: TERMINAL_CWD }, (err, stdout, stderr) => {
+    if (stdout) console.log(`[CLEANUP] stdout: ${stdout.trim()}`);
+    if (stderr) console.log(`[CLEANUP] stderr: ${stderr.trim()}`);
+    if (err) {
+      console.log(`[CLEANUP] Error: code=${err.code}, signal=${err.signal}, message=${err.message}`);
+    } else {
+      console.log('[CLEANUP] Done (exit code: 0)');
+    }
+  });
+  res.json({ ok: true });
+});
+
+/**
+ * POST /proxy/kill-port
+ * Tue le process écoutant sur un port donné (cross-platform)
+ */
+router.post('/proxy/kill-port', requireAuth, (req, res) => {
+  const port = parseInt(req.body.port, 10);
+  if (!port || port < 1 || port > 65535) {
+    return res.status(400).json({ error: 'Port invalide' });
+  }
+  const cmd = process.platform === 'win32'
+    ? `Get-NetTCPConnection -LocalPort ${port} -ErrorAction SilentlyContinue | Where-Object { $_.OwningProcess -ne 0 } | Select-Object -ExpandProperty OwningProcess -Unique | ForEach-Object { Stop-Process -Id $_ -Force -ErrorAction SilentlyContinue }`
+    : `fuser -k ${port}/tcp`;
+  const options = process.platform === 'win32'
+    ? { shell: 'powershell.exe' }
+    : { shell: true };
+  exec(cmd, options, (err, stdout, stderr) => {
+    if (stdout) console.log(`[KILL-PORT] stdout: ${stdout.trim()}`);
+    if (stderr) console.log(`[KILL-PORT] stderr: ${stderr.trim()}`);
+    if (err) console.log(`[KILL-PORT] Error: ${err.message}`);
+  });
+  res.json({ ok: true });
+});
+
+module.exports = router;

package/routes/metaConfig.js

@@ -0,0 +1,180 @@
+const { Router } = require('express');
+const metaConfig = require('../meta-config');
+const { requireAuth } = require('../services/auth');
+const { registry } = require('../services/registry');
+const { renderMetaConfigs } = require('../views/metaConfigs');
+const { PROXY_NAME } = require('../config');
+
+const router = Router();
+
+/**
+ * GET /proxy/mcp-configurations
+ * Découvre les configurations disponibles auprès de tous les MCPs enregistrés
+ */
+router.get('/proxy/mcp-configurations', requireAuth, async (req, res) => {
+  try {
+    const results = await metaConfig.discoverConfigurations(registry.routes);
+    const compatible = results.filter(r => r.configurations !== null);
+    const incompatible = results.filter(r => r.configurations === null);
+
+    res.json({ success: true, compatible: compatible.length, incompatible: incompatible.length, results });
+  } catch (error) {
+    console.error('[META-CONFIG] Discovery error:', error.message);
+    res.status(500).json({ success: false, error: error.message });
+  }
+});
+
+/**
+ * GET /proxy/meta-configs
+ * Liste toutes les méta-configurations sauvegardées
+ */
+router.get('/proxy/meta-configs', requireAuth, (req, res) => {
+  const data = metaConfig.getAll();
+  res.json({ success: true, metaConfigs: data.metaConfigs, activeMetaConfig: data.activeMetaConfig });
+});
+
+/**
+ * POST /proxy/meta-configs
+ * Crée une nouvelle méta-configuration
+ */
+router.post('/proxy/meta-configs', requireAuth, (req, res) => {
+  const { id, name, description, mappings } = req.body;
+
+  if (!id || !name) {
+    return res.status(400).json({ success: false, error: 'id and name are required' });
+  }
+
+  try {
+    const created = metaConfig.create(id, name, description, mappings);
+    console.log(`[META-CONFIG] Created: ${id}`);
+    res.json({ success: true, metaConfig: { id, ...created } });
+  } catch (error) {
+    const status = error.message.includes('already exists') ? 409 : 500;
+    res.status(status).json({ success: false, error: error.message });
+  }
+});
+
+/**
+ * PUT /proxy/meta-configs/:id
+ * Met à jour une méta-configuration existante
+ */
+router.put('/proxy/meta-configs/:id', requireAuth, (req, res) => {
+  const { id } = req.params;
+  const { name, description, mappings } = req.body;
+
+  try {
+    const updated = metaConfig.update(id, { name, description, mappings });
+    console.log(`[META-CONFIG] Updated: ${id}`);
+    res.json({ success: true, metaConfig: { id, ...updated } });
+  } catch (error) {
+    const status = error.message.includes('not found') ? 404 : 500;
+    res.status(status).json({ success: false, error: error.message });
+  }
+});
+
+/**
+ * DELETE /proxy/meta-configs/:id
+ * Supprime une méta-configuration
+ */
+router.delete('/proxy/meta-configs/:id', requireAuth, (req, res) => {
+  const { id } = req.params;
+
+  try {
+    metaConfig.remove(id);
+    console.log(`[META-CONFIG] Deleted: ${id}`);
+    res.json({ success: true, deleted: id });
+  } catch (error) {
+    const status = error.message.includes('not found') ? 404 : 500;
+    res.status(status).json({ success: false, error: error.message });
+  }
+});
+
+/**
+ * POST /proxy/meta-configs/:id/apply
+ * Applique une méta-configuration
+ */
+router.post('/proxy/meta-configs/:id/apply', requireAuth, async (req, res) => {
+  const { id } = req.params;
+
+  try {
+    const result = await metaConfig.applyMetaConfig(id, registry.routes);
+    console.log(`[META-CONFIG] Applied "${id}": ${result.success ? 'all OK' : 'some failures'}`);
+    res.json({ success: result.success, warnings: result.warnings, metaConfigId: id, results: result.results });
+  } catch (error) {
+    const status = error.message.includes('not found') ? 404 : 500;
+    res.status(status).json({ success: false, error: error.message });
+  }
+});
+
+/**
+ * GET /proxy/meta-configs/active/sync
+ * Vérifie si les configurations actives des MCPs correspondent à la méta-config active
+ */
+router.get('/proxy/meta-configs/active/sync', requireAuth, async (req, res) => {
+  const activeId = metaConfig.getActive();
+  console.log(`[META-CONFIG SYNC] activeId = ${JSON.stringify(activeId)}`);
+
+  if (!activeId) {
+    return res.json({ synced: true, activeMetaConfigId: null });
+  }
+
+  const activeCfg = metaConfig.getById(activeId);
+  console.log(`[META-CONFIG SYNC] mappings = ${JSON.stringify(activeCfg?.mappings)}`);
+  if (!activeCfg) {
+    return res.json({ synced: true, activeMetaConfigId: null });
+  }
+
+  try {
+    const results = await metaConfig.discoverConfigurations(registry.routes);
+    console.log(`[META-CONFIG SYNC] discoverConfigurations results:`);
+    results.forEach(r => {
+      if (r.configurations) {
+        const active = r.configurations.find(c => c.active);
+        console.log(`  ${r.path} → configs: [${r.configurations.map(c => `${c.id}${c.active ? '*' : ''}`).join(', ')}] — active: ${JSON.stringify(active?.id ?? null)}`);
+      } else {
+        console.log(`  ${r.path} → error: ${r.error}`);
+      }
+    });
+
+    const conflicts = [];
+
+    for (const [mcpPath, expectedConfigId] of Object.entries(activeCfg.mappings)) {
+      const mcpResult = results.find(r => r.path === mcpPath);
+      if (!mcpResult) {
+        console.log(`  [META-CONFIG SYNC] ${mcpPath} → MCP non trouvé dans les résultats, ignoré`);
+        continue;
+      }
+      if (!mcpResult.configurations) {
+        console.log(`  [META-CONFIG SYNC] ${mcpPath} → pas de configurations (erreur: ${mcpResult.error}), ignoré`);
+        continue;
+      }
+
+      const activeConfig = mcpResult.configurations.find(c => c.active);
+      const actualConfigId = activeConfig ? activeConfig.id : null;
+
+      console.log(`  [META-CONFIG SYNC] ${mcpPath} → attendu: ${JSON.stringify(expectedConfigId)} | actuel: ${JSON.stringify(actualConfigId)} | match: ${actualConfigId === expectedConfigId}`);
+
+      if (actualConfigId !== expectedConfigId) {
+        conflicts.push({ path: mcpPath, expected: expectedConfigId, actual: actualConfigId });
+      }
+    }
+
+    console.log(`[META-CONFIG SYNC] synced=${conflicts.length === 0}, conflicts=${JSON.stringify(conflicts)}`);
+    res.json({ synced: conflicts.length === 0, activeMetaConfigId: activeId, conflicts });
+  } catch (error) {
+    console.error('[META-CONFIG SYNC] Erreur:', error.message);
+    res.status(500).json({ success: false, error: error.message });
+  }
+});
+
+/**
+ * GET /proxy/meta-configs-ui
+ * Interface de gestion des méta-configurations
+ */
+router.get('/proxy/meta-configs-ui', requireAuth, (req, res) => {
+  const data = metaConfig.getAll();
+  const html = renderMetaConfigs(PROXY_NAME, data.metaConfigs, data.activeMetaConfig);
+  res.type('html').send(html);
+});
+
+module.exports = router;