@jingyi0605/codingns 0.5.1 → 0.6.0

package/dist/server/modules/relay-tunnel/relay-tunnel-service.js

@@ -1,10 +1,23 @@
-import os from "node:os";
+import http from "node:http";
+import https from "node:https";
 import { AppError } from "../../shared/errors/app-error.js";
 import { decryptSecret, encryptSecret } from "../../shared/utils/secret-box.js";
 import { nowIso } from "../../shared/utils/time.js";
 import { RelayTunnelIdentityService } from "./crypto/relay-tunnel-identity-service.js";
+import { RelayTunnelRuntimeHttpError } from "./relay-tunnel-runtime-adapter.js";
 import { createTaskManager } from "../tasks/task-manager.js";
 import { HOST_TASK_TYPES } from "../tasks/task-types.js";
+import { buildHostCandidateEndpoints } from "./relay-tunnel-candidate-endpoints.js";
+const DEFAULT_RELAY_TUNNEL_CONTROL_BASE_URL = normalizeHttpBaseUrl("https://channel.codingns.com:1443", "defaultRelayTunnelControlBaseUrl");
+const LEGACY_RELAY_TUNNEL_CONTROL_BASE_URL = normalizeHttpBaseUrl("https://channel.codingns.com:10247", "legacyRelayTunnelControlBaseUrl");
+const DEFAULT_RELAY_TUNNEL_CONTROL_REQUEST_TIMEOUT_MS = 10_000;
+const DEFAULT_RELAY_TUNNEL_CONTROL_TLS_ECDH_CURVE = "X25519";
+// 线上 channel:1443 的 TLS 握手对 Node 默认参数比较挑，控制站请求统一收敛到单个 X25519，
+// 避免首连阶段出现随机握手失败。
+const RELAY_TUNNEL_CONTROL_HTTPS_AGENT = new https.Agent({
+    keepAlive: true,
+    ecdhCurve: DEFAULT_RELAY_TUNNEL_CONTROL_TLS_ECDH_CURVE
+});
 export class RelayTunnelService {
     db;
     bootstrapStateRepository;
@@ -12,6 +25,7 @@ export class RelayTunnelService {
     defaultLocalTargetBaseUrl;
     legacyLocalTargetBaseUrl;
     controlSessionSecret;
+    controlRequestTimeoutMs;
     fetchFn;
     taskManager;
     runtimeAdapter;
@@ -24,7 +38,8 @@ export class RelayTunnelService {
         this.runtimeAdapter = runtimeAdapter;
         this.identityService = new RelayTunnelIdentityService(identityRepository);
         this.controlSessionSecret = normalizeRequiredText(options.controlSessionSecret, "controlSessionSecret");
-        this.fetchFn = options.fetchFn ?? fetch;
+        this.controlRequestTimeoutMs = normalizePositiveInt(options.controlRequestTimeoutMs, DEFAULT_RELAY_TUNNEL_CONTROL_REQUEST_TIMEOUT_MS);
+        this.fetchFn = resolveRelayTunnelControlFetch(options.fetchFn);
         this.defaultLocalTargetBaseUrl = normalizeHttpBaseUrl(options.defaultLocalTargetBaseUrl, "defaultLocalTargetBaseUrl");
         this.legacyLocalTargetBaseUrl = options.legacyLocalTargetBaseUrl
             ? normalizeHttpBaseUrl(options.legacyLocalTargetBaseUrl, "legacyLocalTargetBaseUrl")
@@ -63,17 +78,17 @@ export class RelayTunnelService {
     }
     async updateConfig(input) {
         const snapshot = this.readStateSnapshot();
+        const controlBaseUrl = input.controlBaseUrl !== undefined
+            ? normalizeHttpBaseUrl(input.controlBaseUrl, "controlBaseUrl")
+            : snapshot.config.controlBaseUrl;
         const nextConfig = {
             ...snapshot.config,
             activated: input.activated !== undefined
                 ? input.activated
                 : snapshot.config.activated,
-            relayBaseUrl: input.relayBaseUrl !== undefined
-                ? normalizeWebsocketBaseUrl(input.relayBaseUrl, "relayBaseUrl")
-                : snapshot.config.relayBaseUrl,
-            controlBaseUrl: input.controlBaseUrl !== undefined
-                ? normalizeHttpBaseUrl(input.controlBaseUrl, "controlBaseUrl")
-                : snapshot.config.controlBaseUrl,
+            // relay 入口统一跟随控制站点，同一条地址避免再出现 control 能通、relay 走死路的分裂配置。
+            relayBaseUrl: deriveRelayBaseUrlFromControlBaseUrl(controlBaseUrl),
+            controlBaseUrl,
             localTargetBaseUrl: input.localTargetBaseUrl !== undefined
                 ? normalizeHttpBaseUrl(input.localTargetBaseUrl, "localTargetBaseUrl")
                 : snapshot.config.localTargetBaseUrl,
@@ -169,10 +184,6 @@ export class RelayTunnelService {
     }
     async bindControlHost(hostLabel) {
         const snapshot = this.readStateSnapshot();
-        if (snapshot.config.bindingId && snapshot.config.tunnelDomain) {
-            const effectiveConfig = this.resolveConfigWithIdentity(snapshot.config);
-            return this.buildStatusDto(snapshot, effectiveConfig, this.resolveEffectiveStatus(effectiveConfig));
-        }
         const normalizedHostLabel = normalizeRequiredText(hostLabel, "hostLabel");
         const { controlBaseUrl, accessToken, accountId } = this.requireControlSession(snapshot.config);
         const identity = this.identityService.ensureIdentity();
@@ -219,17 +230,15 @@ export class RelayTunnelService {
         const bindingId = normalizeRequiredText(input.bindingId, "bindingId");
         const tunnelDomain = normalizeTunnelDomain(input.tunnelDomain, "tunnelDomain");
         const identity = this.identityService.ensureIdentity();
-        const relayBaseUrl = input.relayBaseUrl !== undefined
-            ? normalizeWebsocketBaseUrl(input.relayBaseUrl, "relayBaseUrl")
-            : snapshot.config.relayBaseUrl;
         const controlBaseUrl = input.controlBaseUrl !== undefined
             ? normalizeHttpBaseUrl(input.controlBaseUrl, "controlBaseUrl")
             : snapshot.config.controlBaseUrl;
+        const relayBaseUrl = deriveRelayBaseUrlFromControlBaseUrl(controlBaseUrl);
         if (!relayBaseUrl || !controlBaseUrl) {
             throw new AppError({
                 statusCode: 400,
                 errorCode: "INVALID_INPUT",
-                detail: "绑定前必须提供 relayBaseUrl 和 controlBaseUrl"
+                detail: "绑定前必须提供 controlBaseUrl"
             });
         }
         const timestamp = nowIso();
@@ -294,7 +303,7 @@ export class RelayTunnelService {
             throw new AppError({
                 statusCode: 409,
                 errorCode: "RELAY_TUNNEL_NOT_BOUND",
-                detail: "当前实例还没有绑定公共隧道"
+                detail: "当前实例还没有绑定 CodingNS Connect"
             });
         }
         const timestamp = nowIso();
@@ -352,7 +361,7 @@ export class RelayTunnelService {
         });
     }
     readStateSnapshot() {
-        const persistedConfig = this.reconcileLegacyLocalTargetBaseUrl(this.repository.findConfig());
+        const persistedConfig = this.reconcilePersistedConfig(this.repository.findConfig());
         return {
             config: persistedConfig
                 ?? {
@@ -360,7 +369,7 @@ export class RelayTunnelService {
                     enabled: false,
                     provider: "codingns_relay",
                     relayBaseUrl: null,
-                    controlBaseUrl: null,
+                    controlBaseUrl: DEFAULT_RELAY_TUNNEL_CONTROL_BASE_URL,
                     controlAccessTokenCiphertext: null,
                     controlAccountEmail: null,
                     controlSessionExpiresAt: null,
@@ -376,26 +385,58 @@ export class RelayTunnelService {
             hasPersistedConfig: persistedConfig !== null
         };
     }
-    reconcileLegacyLocalTargetBaseUrl(config) {
+    reconcilePersistedConfig(config) {
         if (!config) {
             return config;
         }
-        if ((config.localTargetBaseUrlSource ?? "default") !== "default") {
-            return config;
+        let nextConfig = config;
+        let changed = false;
+        if ((nextConfig.localTargetBaseUrlSource ?? "default") === "default"
+            && nextConfig.localTargetBaseUrl !== this.defaultLocalTargetBaseUrl) {
+            // `default` 源的目标地址由当前运行模式决定，不应该把历史默认值永久粘在库里。
+            // 只要默认入口变化了，就在启动时自动收敛到新的默认值；用户显式写入的 custom 配置不动。
+            nextConfig = {
+                ...nextConfig,
+                localTargetBaseUrl: this.defaultLocalTargetBaseUrl,
+                localTargetBaseUrlSource: "default",
+                updatedAt: nowIso()
+            };
+            changed = true;
         }
-        if (config.localTargetBaseUrl === this.defaultLocalTargetBaseUrl) {
+        if (!normalizeOptionalText(nextConfig.controlBaseUrl)) {
+            // 正式包已经把官方控制站当成固定入口，Host 侧不能继续允许空值漂着，
+            // 否则前端显示的是固定地址，真正发请求时却因为配置为空直接失败。
+            nextConfig = {
+                ...nextConfig,
+                controlBaseUrl: DEFAULT_RELAY_TUNNEL_CONTROL_BASE_URL,
+                updatedAt: nowIso()
+            };
+            changed = true;
+        }
+        if (nextConfig.controlBaseUrl === LEGACY_RELAY_TUNNEL_CONTROL_BASE_URL) {
+            // 历史正式版把官方控制站写成了旧端口。正式包又不允许用户手改控制站地址，
+            // 所以这里必须在读取配置时自动迁移，否则老用户会永远卡在登录阶段。
+            nextConfig = {
+                ...nextConfig,
+                controlBaseUrl: DEFAULT_RELAY_TUNNEL_CONTROL_BASE_URL,
+                updatedAt: nowIso()
+            };
+            changed = true;
+        }
+        const managedRelayBaseUrl = deriveRelayBaseUrlFromControlBaseUrl(nextConfig.controlBaseUrl);
+        if (nextConfig.relayBaseUrl !== managedRelayBaseUrl) {
+            nextConfig = {
+                ...nextConfig,
+                relayBaseUrl: managedRelayBaseUrl,
+                updatedAt: nowIso()
+            };
+            changed = true;
+        }
+        if (!changed) {
             return config;
         }
-        // `default` 源的目标地址由当前运行模式决定，不应该把历史默认值永久粘在库里。
-        // 只要默认入口变化了，就在启动时自动收敛到新的默认值；用户显式写入的 custom 配置不动。
-        const migratedConfig = {
-            ...config,
-            localTargetBaseUrl: this.defaultLocalTargetBaseUrl,
-            localTargetBaseUrlSource: "default",
-            updatedAt: nowIso()
-        };
-        this.repository.upsertConfig(migratedConfig);
-        return migratedConfig;
+        this.repository.upsertConfig(nextConfig);
+        return nextConfig;
     }
     resolveEffectiveStatus(config) {
         const persisted = this.repository.findStatus();
@@ -470,6 +511,25 @@ export class RelayTunnelService {
                 const effectiveConfig = this.resolveConfigWithIdentity(latestSnapshot.config);
                 return this.buildStatusDto(latestSnapshot, effectiveConfig, this.resolveEffectiveStatus(effectiveConfig));
             }
+            if (shouldResetStaleRelayBinding(error)) {
+                const nextConfig = this.clearBoundState(snapshot.config, {
+                    updatedAt: nowIso()
+                });
+                const nextStatus = {
+                    ...buildSkeletonStatus("unbound", nextConfig, {
+                        observedAt: nowIso()
+                    }),
+                    lastError: error instanceof Error ? error.message : String(error)
+                };
+                this.db.transaction(() => {
+                    this.repository.upsertConfig(nextConfig);
+                    this.repository.upsertStatus(nextStatus);
+                })();
+                return this.buildStatusDto({
+                    config: nextConfig,
+                    hasPersistedConfig: true
+                }, nextConfig, nextStatus);
+            }
             const failedStatus = {
                 ...buildSkeletonStatus("error", snapshot.config, {
                     observedAt: nowIso()
@@ -532,6 +592,14 @@ export class RelayTunnelService {
         this.repository.upsertConfig(nextConfig);
         return nextConfig;
     }
+    clearBoundState(config, options) {
+        return {
+            ...config,
+            bindingId: null,
+            tunnelDomain: null,
+            updatedAt: options.updatedAt
+        };
+    }
     isBootstrapInitialized() {
         return this.bootstrapStateRepository.getState().initialized;
     }
@@ -568,16 +636,23 @@ export class RelayTunnelService {
     }
     async requestControlApi(input) {
         let response;
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.controlRequestTimeoutMs);
         try {
-            response = await this.fetchFn(new URL(input.path, ensureTrailingSlash(input.controlBaseUrl)), {
+            const requestUrl = new URL(input.path, ensureTrailingSlash(input.controlBaseUrl)).toString();
+            response = await this.fetchFn(requestUrl, {
                 method: input.method,
                 headers: input.headers,
-                body: input.body
+                body: input.body,
+                signal: controller.signal
             });
         }
         catch (error) {
             throw buildControlFetchError(error, input.controlBaseUrl, input.failurePrefix);
         }
+        finally {
+            clearTimeout(timeoutId);
+        }
         if (!response.ok) {
             throw await buildControlApiError(response, input.controlBaseUrl, input.failurePrefix);
         }
@@ -605,133 +680,6 @@ function buildSkeletonStatus(phase, config, overrides) {
         observedAt: overrides?.observedAt ?? null
     };
 }
-function buildHostCandidateEndpoints(config) {
-    const endpoints = new Map();
-    const relayEndpoint = buildRelayPublicUrl(config);
-    if (relayEndpoint) {
-        endpoints.set(relayEndpoint, {
-            endpointId: `relay:${relayEndpoint}`,
-            kind: "relay",
-            url: relayEndpoint,
-            priority: 400,
-            expiresAt: null,
-            source: "host_reported"
-        });
-    }
-    for (const localCandidateUrl of buildLocalCandidateUrls(config.localTargetBaseUrl)) {
-        endpoints.set(localCandidateUrl, {
-            endpointId: `host_reported:${localCandidateUrl}`,
-            kind: classifyCandidateEndpointKind(localCandidateUrl),
-            url: localCandidateUrl,
-            priority: resolveCandidateEndpointPriority(localCandidateUrl),
-            expiresAt: null,
-            source: "host_reported"
-        });
-    }
-    return Array.from(endpoints.values()).sort((left, right) => {
-        if (left.priority !== right.priority) {
-            return left.priority - right.priority;
-        }
-        return left.url.localeCompare(right.url);
-    });
-}
-function buildRelayPublicUrl(config) {
-    if (!config.tunnelDomain || !config.controlBaseUrl) {
-        return null;
-    }
-    try {
-        const controlUrl = new URL(config.controlBaseUrl);
-        controlUrl.hostname = config.tunnelDomain.trim().toLowerCase();
-        controlUrl.pathname = "/";
-        controlUrl.search = "";
-        controlUrl.hash = "";
-        return controlUrl.toString().replace(/\/$/, "");
-    }
-    catch {
-        return null;
-    }
-}
-function buildLocalCandidateUrls(localTargetBaseUrl) {
-    let parsed;
-    try {
-        parsed = new URL(localTargetBaseUrl);
-    }
-    catch {
-        return [];
-    }
-    const candidates = new Set();
-    const hostname = parsed.hostname.trim().toLowerCase();
-    candidates.add(normalizeUrlWithoutTrailingSlash(parsed.toString()));
-    if (hostname === "0.0.0.0" || hostname === "::" || hostname === "::0") {
-        for (const networkAddress of listPrivateIpv4Addresses()) {
-            const candidateUrl = new URL(parsed.toString());
-            candidateUrl.hostname = networkAddress;
-            candidates.add(normalizeUrlWithoutTrailingSlash(candidateUrl.toString()));
-        }
-    }
-    if (hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1") {
-        for (const networkAddress of listPrivateIpv4Addresses()) {
-            const candidateUrl = new URL(parsed.toString());
-            candidateUrl.hostname = networkAddress;
-            candidates.add(normalizeUrlWithoutTrailingSlash(candidateUrl.toString()));
-        }
-    }
-    return Array.from(candidates);
-}
-function listPrivateIpv4Addresses() {
-    const interfaces = os.networkInterfaces();
-    const candidates = new Set();
-    for (const entries of Object.values(interfaces)) {
-        for (const entry of entries ?? []) {
-            if (!entry || entry.family !== "IPv4" || entry.internal) {
-                continue;
-            }
-            if (!isPrivateIpv4Address(entry.address)) {
-                continue;
-            }
-            candidates.add(entry.address);
-        }
-    }
-    return Array.from(candidates).sort();
-}
-function isPrivateIpv4Address(address) {
-    return (/^10\./.test(address)
-        || /^192\.168\./.test(address)
-        || /^172\.(1[6-9]|2\d|3[0-1])\./.test(address));
-}
-function classifyCandidateEndpointKind(candidateUrl) {
-    try {
-        const hostname = new URL(candidateUrl).hostname.toLowerCase();
-        if (hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1") {
-            return "loopback";
-        }
-        if (isPrivateIpv4Address(hostname)) {
-            return "lan";
-        }
-        return "custom";
-    }
-    catch {
-        return "custom";
-    }
-}
-function resolveCandidateEndpointPriority(candidateUrl) {
-    const kind = classifyCandidateEndpointKind(candidateUrl);
-    switch (kind) {
-        case "loopback":
-            return 100;
-        case "lan":
-            return 200;
-        case "tailscale":
-            return 300;
-        case "relay":
-            return 400;
-        default:
-            return 500;
-    }
-}
-function normalizeUrlWithoutTrailingSlash(value) {
-    return value.endsWith("/") ? value.slice(0, -1) : value;
-}
 function isBound(config) {
     return Boolean(config.bindingId && config.tunnelDomain);
 }
@@ -849,6 +797,14 @@ function normalizeWebsocketBaseUrl(value, field) {
             : parsed.protocol;
     return `${normalizedProtocol}//${parsed.host}${pathname}`;
 }
+function deriveRelayBaseUrlFromControlBaseUrl(controlBaseUrl) {
+    const normalizedControlBaseUrl = normalizeHttpBaseUrl(controlBaseUrl, "controlBaseUrl");
+    if (!normalizedControlBaseUrl) {
+        return null;
+    }
+    const relayUrl = new URL("relay", ensureTrailingSlash(normalizedControlBaseUrl));
+    return normalizeWebsocketBaseUrl(relayUrl.toString(), "relayBaseUrl");
+}
 function requireConfiguredControlBaseUrl(config) {
     const controlBaseUrl = normalizeOptionalText(config.controlBaseUrl);
     if (!controlBaseUrl) {
@@ -873,6 +829,15 @@ function clearRelayTunnelControlSession(config, options) {
         updatedAt: options.updatedAt
     };
 }
+function shouldResetStaleRelayBinding(error) {
+    if (!(error instanceof RelayTunnelRuntimeHttpError)) {
+        return false;
+    }
+    return (error.errorCode === "TUNNEL_NOT_FOUND"
+        || error.errorCode === "BINDING_NOT_FOUND"
+        || error.errorCode === "HOST_AUTH_INVALID"
+        || error.errorCode === "HOST_BINDING_MISMATCH");
+}
 async function buildControlApiError(response, controlBaseUrl, failurePrefix) {
     const detail = await readControlApiErrorDetail(response);
     if (response.status === 401 || response.status === 403) {
@@ -934,6 +899,9 @@ function readJsonErrorText(value) {
 function resolveFetchErrorDetail(error) {
     if (error instanceof Error) {
         const code = readFetchErrorCode(error);
+        if (error.name === "AbortError") {
+            return "请求超时。";
+        }
         if (code === "ECONNREFUSED") {
             return "连接被目标服务器拒绝。";
         }
@@ -956,6 +924,133 @@ function readFetchErrorCode(error) {
         : undefined;
     return typeof cause?.code === "string" ? cause.code : null;
 }
+function normalizePositiveInt(value, fallback) {
+    if (value === null || value === undefined || !Number.isInteger(value) || value <= 0) {
+        return fallback;
+    }
+    return value;
+}
+function resolveRelayTunnelControlFetch(fetchFn) {
+    if (fetchFn) {
+        return fetchFn;
+    }
+    if (isBuiltinNodeFetch(globalThis.fetch)) {
+        return createRelayTunnelControlFetch();
+    }
+    return globalThis.fetch;
+}
+function isBuiltinNodeFetch(fetchFn) {
+    const source = Function.prototype.toString.call(fetchFn);
+    return source.includes("internal/deps/undici/undici");
+}
+function createRelayTunnelControlFetch() {
+    return async (input, init) => {
+        const requestUrl = resolveFetchInputUrl(input);
+        const parsedUrl = new URL(requestUrl);
+        if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+            throw new TypeError(`Unsupported protocol for relay tunnel control fetch: ${parsedUrl.protocol}`);
+        }
+        return await new Promise((resolve, reject) => {
+            const transport = parsedUrl.protocol === "https:" ? https : http;
+            const headers = normalizeFetchHeaders(init?.headers);
+            const body = normalizeFetchBody(init?.body);
+            const abortHandler = () => request.destroy(createAbortRequestError());
+            const request = transport.request(parsedUrl, {
+                method: init?.method ?? "GET",
+                headers,
+                agent: parsedUrl.protocol === "https:" ? RELAY_TUNNEL_CONTROL_HTTPS_AGENT : undefined
+            }, (response) => {
+                const chunks = [];
+                response.on("data", (chunk) => {
+                    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                });
+                response.on("end", () => {
+                    cleanup();
+                    resolve(new Response(Buffer.concat(chunks), {
+                        status: response.statusCode ?? 500,
+                        headers: buildFetchResponseHeaders(response.headers)
+                    }));
+                });
+                response.on("error", (error) => {
+                    cleanup();
+                    reject(error);
+                });
+            });
+            function cleanup() {
+                init?.signal?.removeEventListener("abort", abortHandler);
+            }
+            request.on("error", (error) => {
+                cleanup();
+                reject(error);
+            });
+            if (init?.signal) {
+                if (init.signal.aborted) {
+                    cleanup();
+                    request.destroy(createAbortRequestError());
+                    return;
+                }
+                init.signal.addEventListener("abort", abortHandler, { once: true });
+            }
+            if (body !== null) {
+                request.write(body);
+            }
+            request.end();
+        });
+    };
+}
+function resolveFetchInputUrl(input) {
+    if (typeof input === "string") {
+        return input;
+    }
+    if (input instanceof URL) {
+        return input.toString();
+    }
+    return input.url;
+}
+function normalizeFetchHeaders(headers) {
+    if (!headers) {
+        return {};
+    }
+    return Object.fromEntries(new Headers(headers).entries());
+}
+function normalizeFetchBody(body) {
+    if (body === null || body === undefined) {
+        return null;
+    }
+    if (typeof body === "string" || Buffer.isBuffer(body)) {
+        return body;
+    }
+    if (body instanceof URLSearchParams) {
+        return body.toString();
+    }
+    if (body instanceof ArrayBuffer) {
+        return Buffer.from(body);
+    }
+    if (ArrayBuffer.isView(body)) {
+        return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+    }
+    throw new TypeError("Unsupported relay tunnel control request body type");
+}
+function buildFetchResponseHeaders(headers) {
+    const responseHeaders = new Headers();
+    for (const [name, value] of Object.entries(headers)) {
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                responseHeaders.append(name, item);
+            }
+            continue;
+        }
+        if (typeof value === "string") {
+            responseHeaders.set(name, value);
+        }
+    }
+    return responseHeaders;
+}
+function createAbortRequestError() {
+    const error = new Error("This operation was aborted");
+    error.name = "AbortError";
+    return error;
+}
 function appendControlApiDetail(detail) {
     const normalized = normalizeOptionalText(detail);
     if (!normalized) {