@imenam/self-register-proxy 1.0.37

package/routes/registration.js

@@ -0,0 +1,227 @@
+const { Router } = require('express');
+const { requireLocalOnly, requireAuth } = require('../services/auth');
+const { registry, mutex } = require('../services/registry');
+const { getNextAvailablePort, releasePort, isLocalTarget, isPortFree, findRouteForPath } = require('../services/portManager');
+const { checkServerHealth, unregisterServer } = require('../services/healthCheck');
+const { INTERNAL_PORT_START, INTERNAL_PORT_END } = require('../config');
+
+const router = Router();
+
+/**
+ * Logique commune d'enregistrement (auto et manuel)
+ */
+async function registerRouteInternal({ path, name, port, target, healthCheck, autoAssignPort }) {
+  const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+
+  let finalTarget = target || 'http://localhost';
+  if (!finalTarget.startsWith('http://') && !finalTarget.startsWith('https://')) {
+    finalTarget = `http://${finalTarget}`;
+  }
+  if (finalTarget.endsWith('/')) {
+    finalTarget = finalTarget.slice(0, -1);
+  }
+
+  await mutex.acquire();
+
+  let assignedPort = null;
+
+  try {
+    if (registry.routes.has(normalizedPath)) {
+      const existing = registry.routes.get(normalizedPath);
+
+      mutex.release();
+      const isAlive = await checkServerHealth(normalizedPath, existing);
+      await mutex.acquire();
+
+      if (!isAlive) {
+        console.log(`[REGISTER] Path ${normalizedPath} was occupied by a dead server. Overwriting...`);
+        registry.usedPorts.delete(existing.port);
+        registry.routes.delete(normalizedPath);
+      } else {
+        throw new Error('Path already registered');
+      }
+    }
+
+    if (!autoAssignPort) {
+      if (!port) throw new Error('Port is required for manual registration');
+      const manualPort = parseInt(port, 10);
+
+      if (registry.usedPorts.has(manualPort)) {
+        throw new Error(`Port ${manualPort} already in use`);
+      }
+      if (isLocalTarget(finalTarget) && !await isPortFree(manualPort)) {
+        throw new Error(`Port ${manualPort} is already in use by another process`);
+      }
+      assignedPort = manualPort;
+      registry.usedPorts.add(assignedPort);
+    } else {
+      assignedPort = await getNextAvailablePort(isLocalTarget(finalTarget));
+    }
+
+    registry.routes.set(normalizedPath, {
+      port: assignedPort,
+      target: finalTarget,
+      name: name || normalizedPath,
+      healthCheck: healthCheck !== undefined ? healthCheck === true || healthCheck === 'true' : true,
+      registeredAt: new Date().toISOString()
+    });
+
+    console.log(`[REGISTER] ${normalizedPath} -> ${finalTarget}:${assignedPort} (${name || 'unnamed'}) [Health: ${healthCheck !== undefined ? healthCheck : 'default'}]`);
+
+    return {
+      success: true,
+      path: normalizedPath,
+      port: assignedPort,
+      target: finalTarget,
+      name: name || normalizedPath,
+      healthCheck: healthCheck !== undefined ? healthCheck === true || healthCheck === 'true' : true,
+      message: `Route registered. Target: ${finalTarget}:${assignedPort}`
+    };
+
+  } catch (error) {
+    if (assignedPort !== null) {
+      if (!registry.routes.has(normalizedPath) || registry.routes.get(normalizedPath).port !== assignedPort) {
+        releasePort(assignedPort);
+      }
+    }
+    throw error;
+  } finally {
+    mutex.release();
+  }
+}
+
+/**
+ * POST /proxy/register
+ * Enregistrement automatique (rétro-compatibilité)
+ */
+router.post('/proxy/register', requireLocalOnly, async (req, res) => {
+  const { path, name, target, healthCheck } = req.body;
+
+  if (!path) return res.status(400).json({ success: false, error: 'Path is required' });
+
+  try {
+    const result = await registerRouteInternal({ path, name, target, healthCheck, autoAssignPort: true });
+    res.json(result);
+  } catch (error) {
+    console.error('[REGISTER AUTO ERROR]', error.message);
+    const status = error.message.includes('already') ? 409 : 500;
+    res.status(status).json({ success: false, error: error.message });
+  }
+});
+
+/**
+ * POST /proxy/register-manual
+ * Enregistrement manuel via l'interface graphique (port obligatoire)
+ */
+router.post('/proxy/register-manual', requireAuth, async (req, res) => {
+  const { path, name, port, target, healthCheck } = req.body;
+
+  if (!path) return res.status(400).json({ success: false, error: 'Path is required' });
+  if (!port) return res.status(400).json({ success: false, error: 'Port is required for manual registration' });
+
+  try {
+    const result = await registerRouteInternal({ path, name, port, target, healthCheck, autoAssignPort: false });
+    res.json(result);
+  } catch (error) {
+    console.error('[REGISTER MANUAL ERROR]', error.message);
+    const status = error.message.includes('already') ? 409 : 500;
+    res.status(status).json({ success: false, error: error.message });
+  }
+});
+
+/**
+ * DELETE /proxy/unregister
+ * Supprime une route
+ */
+router.delete('/proxy/unregister', requireLocalOnly, async (req, res) => {
+  const { path } = req.body;
+
+  if (!path) {
+    return res.status(400).json({ success: false, error: 'Path is required' });
+  }
+
+  const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+
+  await mutex.acquire();
+
+  try {
+    if (!registry.routes.has(normalizedPath)) {
+      return res.status(404).json({ success: false, error: 'Path not found' });
+    }
+
+    const route = registry.routes.get(normalizedPath);
+    registry.routes.delete(normalizedPath);
+    registry.usedPorts.delete(route.port);
+
+    console.log(`[UNREGISTER] ${normalizedPath} (was on port ${route.port})`);
+
+    res.json({ success: true, path: normalizedPath, freedPort: route.port });
+
+  } catch (error) {
+    console.error('[UNREGISTER ERROR]', error.message);
+    res.status(500).json({ success: false, error: error.message });
+  } finally {
+    mutex.release();
+  }
+});
+
+/**
+ * GET /proxy/routes
+ * Liste toutes les routes enregistrées
+ */
+router.get('/proxy/routes', requireAuth, (req, res) => {
+  const routes = [];
+  registry.routes.forEach((value, path) => {
+    routes.push({
+      path,
+      port: value.port,
+      target: value.target || 'http://localhost',
+      name: value.name,
+      healthCheck: value.healthCheck,
+      registeredAt: value.registeredAt,
+      fullTarget: `${value.target || 'http://localhost'}:${value.port}`
+    });
+  });
+
+  res.json({
+    count: routes.length,
+    routes,
+    availablePorts: (INTERNAL_PORT_END - INTERNAL_PORT_START) - registry.usedPorts.size
+  });
+});
+
+/**
+ * POST /proxy/check
+ * Déclenche manuellement un health check pour une route spécifique
+ */
+router.post('/proxy/check', requireAuth, async (req, res) => {
+  const { path } = req.body;
+
+  if (!path) {
+    return res.status(400).json({ success: false, error: 'Path is required' });
+  }
+
+  const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+  const route = registry.routes.get(normalizedPath);
+
+  if (!route) {
+    return res.status(404).json({ success: false, error: 'Path not found' });
+  }
+
+  console.log(`[MANUAL HEALTH CHECK] Checking ${normalizedPath}...`);
+  const isHealthy = await checkServerHealth(normalizedPath, route);
+
+  if (!isHealthy) {
+    await unregisterServer(normalizedPath);
+    return res.json({
+      success: true,
+      path: normalizedPath,
+      healthy: false,
+      message: 'Server was unhealthy and has been removed'
+    });
+  }
+
+  res.json({ success: true, path: normalizedPath, healthy: true, message: 'Server is healthy' });
+});
+
+module.exports = router;

package/routes/terminal.js

@@ -0,0 +1,68 @@
+const { Router } = require('express');
+const path = require('path');
+const fs = require('fs');
+const { requireAuth } = require('../services/auth');
+const { renderTerminal } = require('../views/terminal');
+const { PROXY_NAME, TERMINAL_CWD, TERMINAL_COMMAND } = require('../config');
+
+const router = Router();
+
+const IGNORED_DIRS = new Set(['.git', 'node_modules', '.next', 'dist', 'build', '__pycache__', '.cache', 'coverage']);
+
+function listFilesRecursive(rootDir) {
+  const results = [];
+  const stack = [{ dir: rootDir, base: '', depth: 0 }];
+  while (stack.length) {
+    const { dir, base, depth } = stack.pop();
+    if (depth > 6) continue;
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const entry of entries) {
+      if (entry.name.startsWith('.')) continue;
+      if (IGNORED_DIRS.has(entry.name)) continue;
+      const rel = base ? base + '/' + entry.name : entry.name;
+      if (entry.isDirectory()) {
+        stack.push({ dir: path.join(dir, entry.name), base: rel, depth: depth + 1 });
+      } else {
+        results.push(rel);
+      }
+    }
+  }
+  return results;
+}
+
+function fuzzyMatch(query, str) {
+  let qi = 0;
+  for (let i = 0; i < str.length && qi < query.length; i++) {
+    if (str[i] === query[qi]) qi++;
+  }
+  return qi === query.length;
+}
+
+/**
+ * GET /proxy/files
+ * Liste récursive des fichiers de TERMINAL_CWD pour l'autocomplete @
+ */
+router.get('/proxy/files', requireAuth, (req, res) => {
+  const q = (req.query.q || '').toLowerCase();
+  try {
+    const all = listFilesRecursive(TERMINAL_CWD);
+    const filtered = q
+      ? all.filter(f => fuzzyMatch(q, path.basename(f).toLowerCase())).slice(0, 20)
+      : all.slice(0, 20);
+    res.json(filtered);
+  } catch {
+    res.json([]);
+  }
+});
+
+/**
+ * GET /proxy/terminal
+ * Page du terminal en ligne (xterm.js + WebSocket)
+ */
+router.get('/proxy/terminal', requireAuth, (req, res) => {
+  const html = renderTerminal(PROXY_NAME, TERMINAL_COMMAND);
+  res.type('html').send(html);
+});
+
+module.exports = router;

package/services/auth.js

@@ -0,0 +1,151 @@
+// TODO: envisager un stockage Redis pour les sessions en production
+const crypto = require('crypto');
+const { ADMIN_PASSWORD, SESSION_SECRET } = require('../config');
+
+const SESSION_TTL = 24 * 60 * 60 * 1000; // 24h
+const CLEANUP_INTERVAL = 60 * 60 * 1000; // 1h
+
+/** Stockage des sessions actives en mémoire (token → createdAt timestamp) */
+const activeSessions = new Map();
+
+setInterval(() => {
+  const now = Date.now();
+  for (const [token, createdAt] of activeSessions) {
+    if (now - createdAt > SESSION_TTL) {
+      activeSessions.delete(token);
+    }
+  }
+}, CLEANUP_INTERVAL);
+
+/**
+ * Parse manuellement le header Cookie
+ */
+function parseCookies(req) {
+  const header = req.headers.cookie || '';
+  const cookies = {};
+  header.split(';').forEach(pair => {
+    const [name, ...rest] = pair.trim().split('=');
+    if (name) cookies[name.trim()] = decodeURIComponent(rest.join('=').trim());
+  });
+  return cookies;
+}
+
+/**
+ * Signe un token avec HMAC-SHA256
+ */
+function signToken(token) {
+  const signature = crypto.createHmac('sha256', SESSION_SECRET).update(token).digest('hex');
+  return `${token}.${signature}`;
+}
+
+/**
+ * Vérifie et extrait un token signé
+ */
+function verifySignedToken(signedValue) {
+  if (!signedValue || !signedValue.includes('.')) return null;
+  const lastDot = signedValue.lastIndexOf('.');
+  const token = signedValue.slice(0, lastDot);
+  const signature = signedValue.slice(lastDot + 1);
+  const expected = crypto.createHmac('sha256', SESSION_SECRET).update(token).digest('hex');
+  if (signature.length !== expected.length) return null;
+  try {
+    if (crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expected, 'hex'))) {
+      return token;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+
+/**
+ * Comparaison sécurisée de deux chaînes (protection timing attack)
+ */
+function safeEqual(a, b) {
+  if (!a || !b) return false;
+  const bufA = Buffer.from(String(a));
+  const bufB = Buffer.from(String(b));
+  if (bufA.length !== bufB.length) return false;
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+function createSession() {
+  const token = crypto.randomBytes(32).toString('hex');
+  activeSessions.set(token, Date.now());
+  return token;
+}
+
+function destroySession(token) {
+  activeSessions.delete(token);
+}
+
+function isValidSession(token) {
+  if (!token || !activeSessions.has(token)) return false;
+  const createdAt = activeSessions.get(token);
+  if (Date.now() - createdAt > SESSION_TTL) {
+    activeSessions.delete(token);
+    return false;
+  }
+  return true;
+}
+
+function setSessionCookie(res, token) {
+  const signed = signToken(token);
+  const secure = ADMIN_PASSWORD ? '; Secure' : '';
+  res.setHeader('Set-Cookie', `proxy_session=${encodeURIComponent(signed)}; HttpOnly; SameSite=Lax; Path=/${secure}`);
+}
+
+function getSessionFromCookie(req) {
+  const cookies = parseCookies(req);
+  const signedValue = cookies['proxy_session'];
+  if (!signedValue) return null;
+  const token = verifySignedToken(signedValue);
+  if (!token) return null;
+  return isValidSession(token) ? token : null;
+}
+
+function clearSessionCookie(res) {
+  res.setHeader('Set-Cookie', 'proxy_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0');
+}
+
+/**
+ * Middleware : restreint l'accès aux requêtes provenant de localhost uniquement
+ */
+function requireLocalOnly(req, res, next) {
+  const ip = req.ip || req.socket.remoteAddress;
+  const localAddresses = ['127.0.0.1', '::1', '::ffff:127.0.0.1'];
+  if (!localAddresses.includes(ip)) {
+    return res.status(403).json({ success: false, error: 'Local access only' });
+  }
+  next();
+}
+
+/**
+ * Middleware : exige une session admin valide
+ * Si ADMIN_PASSWORD n'est pas configuré, la route reste ouverte (rétrocompatibilité)
+ */
+function requireAuth(req, res, next) {
+  if (!ADMIN_PASSWORD) return next();
+  const sessionToken = getSessionFromCookie(req);
+  if (sessionToken) return next();
+  const acceptHeader = req.get('Accept') || '';
+  if (acceptHeader.includes('text/html') || !acceptHeader.includes('application/json')) {
+    return res.redirect('/proxy/login');
+  }
+  return res.status(401).json({ success: false, error: 'Authentication required' });
+}
+
+module.exports = {
+  parseCookies,
+  signToken,
+  verifySignedToken,
+  safeEqual,
+  createSession,
+  destroySession,
+  isValidSession,
+  setSessionCookie,
+  getSessionFromCookie,
+  clearSessionCookie,
+  requireLocalOnly,
+  requireAuth,
+};

package/services/healthCheck.js

@@ -0,0 +1,95 @@
+// NOTE: le timeout est appliqué globalement, pas par route individuelle
+const { HEALTH_CHECK_INTERVAL, HEALTH_CHECK_TIMEOUT, HEALTH_CHECK_GRACE_PERIOD } = require('../config');
+const { registry, mutex } = require('./registry');
+
+/**
+ * Vérifie la santé d'un serveur enregistré
+ */
+async function checkServerHealth(path, route) {
+  const target = route.target || 'http://localhost';
+  const healthUrl = `${target}:${route.port}/proxy/health`;
+
+  try {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), HEALTH_CHECK_TIMEOUT);
+    const response = await fetch(healthUrl, { method: 'GET', signal: controller.signal });
+    clearTimeout(timeoutId);
+    return response.status === 200;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Désenregistre un serveur via le mutex
+ */
+async function unregisterServer(path, reason = 'unhealthy') {
+  await mutex.acquire();
+  try {
+    const route = registry.routes.get(path);
+    if (route) {
+      registry.routes.delete(path);
+      registry.usedPorts.delete(route.port);
+      console.log(`[UNREGISTER] ${path} (was on port ${route.port}) - reason: ${reason}`);
+    }
+  } finally {
+    mutex.release();
+  }
+}
+
+/**
+ * Vérifie si un serveur est encore dans sa période de grâce
+ */
+function isInGracePeriod(route) {
+  const registeredAt = new Date(route.registeredAt).getTime();
+  return (Date.now() - registeredAt) < HEALTH_CHECK_GRACE_PERIOD;
+}
+
+/**
+ * Effectue un health check sur tous les serveurs enregistrés
+ */
+async function performHealthChecks() {
+  if (registry.routes.size === 0) return;
+
+  const checks = [];
+  let skippedCount = 0;
+
+  for (const [path, route] of registry.routes.entries()) {
+    if (route.healthCheck === false) continue;
+    if (isInGracePeriod(route)) { skippedCount++; continue; }
+    checks.push(
+      checkServerHealth(path, route).then(isHealthy => ({ path, route, isHealthy }))
+    );
+  }
+
+  if (checks.length === 0) {
+    if (skippedCount > 0) {
+      console.log(`[HEALTH CHECK] ${skippedCount} server(s) in grace period, skipping checks`);
+    }
+    return;
+  }
+
+  console.log(`[HEALTH CHECK] Checking ${checks.length} server(s)...${skippedCount > 0 ? ` (${skippedCount} in grace period)` : ''}`);
+
+  const results = await Promise.all(checks);
+
+  for (const { path, isHealthy } of results) {
+    if (!isHealthy) await unregisterServer(path, 'failed health check');
+  }
+
+  const healthyCount = results.filter(r => r.isHealthy).length;
+  const unhealthyCount = results.length - healthyCount;
+  if (unhealthyCount > 0) {
+    console.log(`[HEALTH CHECK] Complete: ${healthyCount} healthy, ${unhealthyCount} removed`);
+  }
+}
+
+/**
+ * Démarre le polling de health check
+ */
+function startHealthCheckPolling() {
+  console.log(`[HEALTH CHECK] Starting polling every ${HEALTH_CHECK_INTERVAL}ms`);
+  setInterval(performHealthChecks, HEALTH_CHECK_INTERVAL);
+}
+
+module.exports = { checkServerHealth, unregisterServer, isInGracePeriod, performHealthChecks, startHealthCheckPolling };

package/services/portManager.js

@@ -0,0 +1,82 @@
+const net = require('net');
+const { INTERNAL_PORT_START, INTERNAL_PORT_END } = require('../config');
+const { registry } = require('./registry');
+
+/**
+ * Vérifie si le target pointe vers la machine locale
+ */
+function isLocalTarget(target) {
+  try {
+    const { hostname } = new URL(target);
+    return ['localhost', '127.0.0.1', '::1', '0.0.0.0'].includes(hostname);
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * Vérifie si un port est réellement libre au niveau OS
+ */
+function isPortFree(port) {
+  return new Promise((resolve) => {
+    const server = net.createServer();
+    server.once('error', () => resolve(false));
+    server.once('listening', () => {
+      server.close(() => resolve(true));
+    });
+    server.listen(port);
+  });
+}
+
+/**
+ * Trouve le prochain port disponible et le réserve atomiquement
+ * DOIT être appelé avec le mutex acquis
+ */
+async function getNextAvailablePort(checkSystem = true) {
+  while (true) {
+    while (registry.usedPorts.has(registry.nextPort)) {
+      registry.nextPort++;
+      if (registry.nextPort > INTERNAL_PORT_END) {
+        registry.nextPort = INTERNAL_PORT_START;
+        if (registry.usedPorts.size >= (INTERNAL_PORT_END - INTERNAL_PORT_START)) {
+          throw new Error('No available ports');
+        }
+      }
+    }
+
+    const port = registry.nextPort;
+
+    if (!checkSystem || await isPortFree(port)) {
+      registry.usedPorts.add(port);
+      registry.nextPort++;
+      return port;
+    }
+
+    console.log(`[PORT] Port ${port} is in use by another process, skipping...`);
+    registry.usedPorts.add(port);
+    registry.nextPort++;
+  }
+}
+
+/**
+ * Libère un port réservé (en cas d'échec d'enregistrement)
+ */
+function releasePort(port) {
+  registry.usedPorts.delete(port);
+}
+
+/**
+ * Trouve la route correspondant à un chemin de requête
+ * Tri par longueur décroissante pour matcher le plus spécifique d'abord
+ */
+function findRouteForPath(requestPath) {
+  const sortedPaths = [...registry.routes.keys()].sort((a, b) => b.length - a.length);
+  for (const routePath of sortedPaths) {
+    if (requestPath.startsWith(routePath)) {
+      return registry.routes.get(routePath);
+    }
+  }
+  return null;
+}
+
+module.exports = { isLocalTarget, isPortFree, getNextAvailablePort, releasePort, findRouteForPath };