@kvbox/server 0.5.13 → 0.5.14

package/dist/kvbox-server.js

@@ -351,6 +351,18 @@ var PortForwardSchema = z3.object({
 var PortsRequest = z3.object({
   ports: z3.array(z3.object({ guestPort: z3.number().int().min(1).max(65535), proto: PortProtoSchema.optional() })).min(1).max(MAX_BOX_PORTS)
 });
+var BoxPortSchema = z3.number().int().min(1).max(65535);
+var ClaimSubdomainRequest = z3.object({ name: z3.string(), port: BoxPortSchema });
+var SubdomainPortRequest = z3.object({ port: BoxPortSchema });
+var SubdomainRouteRequest = z3.object({ name: z3.string(), port: BoxPortSchema });
+var SubdomainSchema = z3.object({
+  owner: z3.string(),
+  box: z3.string(),
+  subdomain: z3.string(),
+  port: BoxPortSchema,
+  url: z3.string(),
+  routes: z3.array(z3.object({ name: z3.string(), port: BoxPortSchema, url: z3.string() }))
+});
 var MachineSchema = z3.object({
   /** Host-unique short id (the tap is `kv-<id>`). Missing only on a box made before ids that has not restarted since. */
   id: z3.string(),
@@ -1970,7 +1982,7 @@ async function restoreMachine(fromText, owner, req, cfg, p) {
   }
 }
 var AGENT_REPLY_MS = 2e4;
-async function introduce(spec, vsock, cfg, failure) {
+async function introduce(spec, vsock, cfg, failure2) {
   const id = { name: spec.name, ip: spec.ip, prefixLen: prefixLenOf(cfg.subnet), gateway: cfg.gateway, mac: spec.mac, time: Math.floor(Date.now() / 1e3) };
   const deadline = Date.now() + 3e3;
   for (; ; ) {
@@ -1985,9 +1997,9 @@ async function introduce(spec, vsock, cfg, failure) {
         continue;
       }
       if (transient) throw new KvboxError(`${msg}
-  ${failure.silent}`);
+  ${failure2.silent}`);
       throw new KvboxError(`${msg}
-  ${failure.noAnswer}`);
+  ${failure2.noAnswer}`);
     }
   }
 }
@@ -2658,7 +2670,7 @@ import { createServer as createHttpsServer } from "node:https";
 import { createAdaptorServer } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono7 } from "hono";
 
 // ../shared/src/version.ts
 import { createRequire } from "node:module";
@@ -2673,10 +2685,25 @@ function versionOf(srcFileUrl, injected) {
 }
 
 // src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.13" : void 0);
+var VERSION = versionOf(import.meta.url, true ? "0.5.14" : void 0);
 
 // src/caller.ts
 import { createHash as createHash2, timingSafeEqual } from "node:crypto";
+
+// ../shared/src/names.ts
+import { createHmac } from "node:crypto";
+var PROXY_ERROR_HEADER = "x-kvbox-proxy-error";
+var PROXIED_HEADER = "x-kvbox-proxied";
+var VISITOR_PATH_HEADER = "x-kvbox-path";
+var VISITOR_AUTH_HEADER = "x-kvbox-authorization";
+var NOT_FORWARDED = /* @__PURE__ */ new Set(["expect"]);
+var HOP_BY_HOP = /* @__PURE__ */ new Set(["connection", "keep-alive", "proxy-authenticate", "proxy-authorization", "proxy-connection", "te", "trailer", "transfer-encoding", "upgrade"]);
+var BOX_HTTP_PATH_RE = /^\/machines\/([^/]+)\/http\/(\d{1,5})\/?$/;
+function edgeCredential(hostSecret) {
+  return createHmac("sha256", hostSecret).update("kvbox-edge-v1").digest("base64url");
+}
+
+// src/caller.ts
 var OWNER_HEADER = "x-kvbox-owner";
 function resolveCaller(opts = {}) {
   const cp = opts.controlPlane;
@@ -2688,10 +2715,11 @@ function resolveCaller(opts = {}) {
       await next();
     };
   }
-  const expected = digest(cp.secret);
+  const authorized = secretCheck(cp);
+  const edge = edgeCheck(cp);
   return async (c, next) => {
-    const m = /^Bearer\s+(\S+)$/i.exec(c.req.header("authorization") ?? "");
-    if (!m || !timingSafeEqual(digest(m[1]), expected)) return c.json({ error: "not authorized" }, 401);
+    const auth = c.req.header("authorization");
+    if (!authorized(auth) && !(edge(auth) && BOX_HTTP_PATH_RE.test(c.req.path))) return c.json({ error: "not authorized" }, 401);
     const user = c.req.header(OWNER_HEADER);
     if (user === void 0) {
       const path = c.req.path.replace(/\/$/, "");
@@ -2710,20 +2738,237 @@ function resolveCaller(opts = {}) {
     await next();
   };
 }
+function secretCheck(cp) {
+  return bearerCheck(cp.secret);
+}
+function edgeCheck(cp) {
+  return bearerCheck(edgeCredential(cp.secret));
+}
+function bearerCheck(token) {
+  const expected = digest(token);
+  return (authorization) => {
+    const m = /^Bearer\s+(\S+)$/i.exec(authorization ?? "");
+    return m !== null && timingSafeEqual(digest(m[1]), expected);
+  };
+}
 function digest(secret) {
   return createHash2("sha256").update(secret).digest();
 }
 
-// src/routes/capacity.ts
+// src/routes/boxHttp.ts
+import { connect as connect2 } from "node:net";
+import { Readable } from "node:stream";
 import { Hono } from "hono";
-function capacityRoutes() {
+import { request as request3 } from "undici";
+
+// ../shared/src/httpHead.ts
+var END = "\r\n\r\n";
+var HeadTimeoutError = class extends Error {
+};
+function readHead(socket, opts) {
+  return new Promise((resolve, reject) => {
+    let bytes = Buffer.alloc(0);
+    const done = (err) => {
+      clearTimeout(timer);
+      socket.off("data", onData);
+      socket.off("close", onClose);
+      socket.pause();
+      if (err) return reject(err);
+      const end = bytes.indexOf(END);
+      resolve({ head: bytes.subarray(0, end).toString("latin1"), rest: bytes.subarray(end + END.length) });
+    };
+    const onData = (chunk) => {
+      bytes = Buffer.concat([bytes, chunk]);
+      if (bytes.includes(END)) done();
+      else if (bytes.length > opts.maxBytes) done(new Error("answer head too large"));
+    };
+    const onClose = () => done(new Error("closed before answering"));
+    const timer = setTimeout(() => done(new HeadTimeoutError(`no answer within ${opts.timeoutMs / 1e3} s`)), opts.timeoutMs);
+    socket.on("data", onData);
+    socket.once("close", onClose);
+  });
+}
+function rewriteHead(head, drop, add = {}) {
+  const [status, ...lines] = head.split("\r\n");
+  const kept = lines.filter((l) => !drop(l.slice(0, l.indexOf(":")).trim().toLowerCase()));
+  const extra = Object.entries(add).map(([k, v]) => `${k}: ${v}`);
+  return Buffer.from(`${[status, ...kept, ...extra].join("\r\n")}${END}`, "latin1");
+}
+
+// src/routes/boxHttp.ts
+var HEADERS_TIMEOUT_MS = 55e3;
+var MAX_HANDSHAKE_BYTES = 16 * 1024;
+var CONNECT_TIMEOUT_MS = 5e3;
+var DROPPED = /* @__PURE__ */ new Set([...HOP_BY_HOP, ...NOT_FORWARDED, "host", "authorization", OWNER_HEADER, VISITOR_AUTH_HEADER, VISITOR_PATH_HEADER]);
+var ProxyFailure = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+};
+function visitorPath(value) {
+  const path = Array.isArray(value) ? value[0] : value;
+  return path !== void 0 && path !== null && path.startsWith("/") && !/[\s]/.test(path) ? path : "/";
+}
+async function targetOf(url, owner, path) {
+  const m = BOX_HTTP_PATH_RE.exec(url.pathname);
+  const port = Number(m?.[2]);
+  if (!m || port < 1 || port > 65535) throw new ProxyFailure(404, "not-found", `no route: ${url.pathname}`);
+  const name = decodeURIComponent(m[1]);
+  let box;
+  try {
+    box = await getMachine(parseRef(name, owner));
+  } catch (err) {
+    if (err instanceof NotFoundError) throw new ProxyFailure(404, "not-found", err.message);
+    throw err;
+  }
+  if (box.status !== "running") throw new ProxyFailure(409, "not-running", `box ${name} is ${box.status}`);
+  return { ip: box.ip, port, path };
+}
+function boxHeaders(incoming, target, upgrade = false) {
+  const out = [];
+  let host = `${target.ip}:${target.port}`;
+  for (const [name, value] of incoming) {
+    const key = name.toLowerCase();
+    if (key === "x-forwarded-host") host = value;
+    if (key === VISITOR_AUTH_HEADER) out.push(["authorization", value]);
+    if (upgrade && (key === "upgrade" || key === "connection")) out.push([name, value]);
+    else if (!DROPPED.has(key)) out.push([name, value]);
+  }
+  out.push(["host", host]);
+  return out;
+}
+var failure = (err) => new Response(JSON.stringify({ error: err.message }), { status: err.status, headers: { "content-type": "application/json", [PROXY_ERROR_HEADER]: err.code } });
+function boxHttpRoutes() {
   const r = new Hono();
+  r.all("/:name/http/:port", forward);
+  return r;
+}
+async function forward(c) {
+  let target;
+  try {
+    target = await targetOf(new URL(c.req.url), c.get("owner"), visitorPath(c.req.header(VISITOR_PATH_HEADER)));
+  } catch (err) {
+    if (err instanceof ProxyFailure) return failure(err);
+    throw err;
+  }
+  const raw = c.req.raw;
+  const pairs = [];
+  raw.headers.forEach((value, name) => pairs.push([name, value]));
+  let res;
+  try {
+    res = await request3(`http://${target.ip}:${target.port}${target.path}`, {
+      method: raw.method,
+      headers: boxHeaders(pairs, target).flat(),
+      body: raw.body === null ? null : Readable.fromWeb(raw.body),
+      headersTimeout: HEADERS_TIMEOUT_MS,
+      bodyTimeout: 0,
+      signal: raw.signal
+    });
+  } catch (err) {
+    const e = err;
+    if (e.code === "UND_ERR_HEADERS_TIMEOUT") return failure(new ProxyFailure(504, "timeout", `box took over ${HEADERS_TIMEOUT_MS / 1e3} s to answer on port ${target.port}`));
+    return failure(new ProxyFailure(502, "unreachable", `box answered nothing on port ${target.port} (${e.code ?? e.message})`));
+  }
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(res.headers)) {
+    if (value === void 0 || HOP_BY_HOP.has(name) || name.startsWith("x-kvbox-")) continue;
+    for (const v of Array.isArray(value) ? value : [value]) headers.append(name, v);
+  }
+  headers.set(PROXIED_HEADER, "1");
+  const empty = res.statusCode === 204 || res.statusCode === 304 || raw.method === "HEAD";
+  if (empty) res.body.resume();
+  return new Response(empty ? null : Readable.toWeb(res.body), { status: res.statusCode, headers });
+}
+function refuse(socket, status, text, code = "refused") {
+  const body = JSON.stringify({ error: text });
+  socket.end(`HTTP/1.1 ${status} ${status === 401 ? "Unauthorized" : "Error"}\r
+content-type: application/json\r
+content-length: ${Buffer.byteLength(body)}\r
+${PROXY_ERROR_HEADER}: ${code}\r
+connection: close\r
+\r
+${body}`);
+}
+function headerPairs(raw) {
+  const out = [];
+  for (let i = 0; i + 1 < raw.length; i += 2) out.push([raw[i], raw[i + 1]]);
+  return out;
+}
+function boxUpgradeHandler(cp, headersTimeoutMs = HEADERS_TIMEOUT_MS) {
+  const full = secretCheck(cp);
+  const edge = edgeCheck(cp);
+  const authorized = (auth) => full(auth) || edge(auth);
+  return (req, socket, head) => {
+    socket.on("error", () => socket.destroy());
+    void (async () => {
+      const headers = req.headers;
+      if (!authorized(headers.authorization)) return refuse(socket, 401, "not authorized");
+      const user = headers[OWNER_HEADER];
+      if (typeof user !== "string" || !LOCAL_OWNER_RE.test(user)) return refuse(socket, 400, "X-Kvbox-Owner header required");
+      let target;
+      try {
+        target = await targetOf(new URL(req.url ?? "/", "https://host"), `${user}@${cp.name}`, visitorPath(headers[VISITOR_PATH_HEADER]));
+      } catch (err) {
+        if (err instanceof ProxyFailure) return refuse(socket, err.status, err.message, err.code);
+        return refuse(socket, 500, err.message);
+      }
+      if (socket.destroyed) return;
+      const box = connect2({ host: target.ip, port: target.port, timeout: CONNECT_TIMEOUT_MS });
+      let connected = false;
+      let piped = false;
+      box.once("timeout", () => box.destroy(new Error("timed out")));
+      box.once("error", (err) => {
+        if (!connected && !socket.destroyed) refuse(socket, 502, `box answered nothing on port ${target.port} (${err.code ?? err.message})`, "unreachable");
+        else if (piped) socket.destroy();
+      });
+      socket.once("close", () => box.destroy());
+      box.once("close", () => {
+        if (piped) socket.destroy();
+      });
+      box.once("connect", () => {
+        connected = true;
+        box.setTimeout(0);
+        const lines = boxHeaders(headerPairs(req.rawHeaders), target, true).map(([k, v]) => `${k}: ${v}\r
+`);
+        box.write(`${req.method ?? "GET"} ${target.path} HTTP/1.1\r
+${lines.join("")}\r
+`);
+        if (head.length > 0) box.write(head);
+        readHead(box, { maxBytes: MAX_HANDSHAKE_BYTES, timeoutMs: headersTimeoutMs }).then(
+          (answer) => {
+            if (socket.destroyed) return void box.destroy();
+            socket.write(rewriteHead(answer.head, (name) => name.startsWith("x-kvbox-"), { [PROXIED_HEADER]: "1" }));
+            if (answer.rest.length > 0) socket.write(answer.rest);
+            piped = true;
+            box.pipe(socket);
+            socket.pipe(box);
+          },
+          (err) => {
+            box.destroy();
+            if (socket.destroyed) return;
+            if (err instanceof HeadTimeoutError) refuse(socket, 504, `box took over ${headersTimeoutMs / 1e3} s to answer on port ${target.port}`, "timeout");
+            else refuse(socket, 502, `box gave no answer on port ${target.port} (${err.message})`, "unreachable");
+          }
+        );
+      });
+    })();
+  };
+}
+
+// src/routes/capacity.ts
+import { Hono as Hono2 } from "hono";
+function capacityRoutes() {
+  const r = new Hono2();
   r.get("/", async (c) => c.json(await capacity()));
   return r;
 }
 
 // src/routes/machines.ts
-import { Hono as Hono2 } from "hono";
+import { Hono as Hono3 } from "hono";
 
 // src/core/stats.ts
 var STATS_REPLY_MS = 3e3;
@@ -2756,7 +3001,7 @@ async function usageReport(scope, window, p = paths()) {
 
 // src/routes/machines.ts
 function machineRoutes() {
-  const r = new Hono2();
+  const r = new Hono3();
   r.get("/", async (c) => c.json(await listMachines(c.get("listScope"))));
   r.post("/", async (c) => {
     const body = CreateMachineRequest.parse(await c.req.json().catch(() => ({})));
@@ -2812,7 +3057,7 @@ function machineRoutes() {
 }
 
 // src/routes/snapshots.ts
-import { Hono as Hono3 } from "hono";
+import { Hono as Hono4 } from "hono";
 
 // src/core/snapshots.ts
 import { existsSync as existsSync3 } from "node:fs";
@@ -2882,21 +3127,21 @@ async function snapshotBox(ref, req, owner, p) {
   try {
     const since = box.memSnapshots ?? 0;
     const mode = since === 0 || existsSync3(m.memBase) ? "Diff" : "Full";
-    let failure;
+    let failure2;
     await fc.pause();
     try {
       await fc.snapshotCreate(s.vmstate, s.mem, mode);
       lineageTouched = true;
       await run(["cp", "--sparse=always", "--reflink=auto", m.overlay, s.overlay]);
     } catch (err) {
-      failure = err;
+      failure2 = err;
     } finally {
       if (!box.paused) await fc.resume();
     }
     if (lineageTouched) {
       await writeMachineMeta({ ...box, memSnapshots: since + 1 }, p);
     }
-    if (failure !== void 0) throw failure;
+    if (failure2 !== void 0) throw failure2;
     if (mode === "Full") {
       await run(["fallocate", "--dig-holes", s.mem]);
     } else if (since > 0) {
@@ -2939,7 +3184,7 @@ async function deleteSnapshot(ref, p = paths()) {
 
 // src/routes/snapshots.ts
 function snapshotRoutes() {
-  const r = new Hono3();
+  const r = new Hono4();
   r.get("/", async (c) => c.json(await listSnapshots(c.get("listScope"))));
   r.post("/", async (c) => {
     const body = CreateSnapshotRequest.parse(await c.req.json());
@@ -2953,9 +3198,9 @@ function snapshotRoutes() {
 }
 
 // src/routes/ssh.ts
-import { Hono as Hono4 } from "hono";
+import { Hono as Hono5 } from "hono";
 function sshRoutes(opts = {}) {
-  const r = new Hono4();
+  const r = new Hono5();
   if (opts.controlPlane) {
     r.all("/*", (c) => c.json({ error: "trusting a CA is done on the host itself (kvbox server trust-ca there); the control plane cannot ask a host to" }, 403));
     return r;
@@ -2970,10 +3215,10 @@ function sshRoutes(opts = {}) {
 }
 
 // src/routes/usage.ts
-import { Hono as Hono5 } from "hono";
+import { Hono as Hono6 } from "hono";
 var PULL_LIMIT = 1e3;
 function usageRoutes(opts = {}) {
-  const r = new Hono5();
+  const r = new Hono6();
   r.get("/", async (c) => {
     let window;
     try {
@@ -3000,7 +3245,7 @@ function whole(value, name) {
 
 // src/app.ts
 function createApp(opts = {}) {
-  const app = new Hono6();
+  const app = new Hono7();
   app.use(resolveCaller(opts));
   app.get("/health", async (c) => {
     const cfg = await loadConfig();
@@ -3016,6 +3261,7 @@ function createApp(opts = {}) {
       recovery: lastRecovery()
     });
   });
+  if (opts.controlPlane) app.route("/machines", boxHttpRoutes());
   app.route("/machines", machineRoutes());
   app.route("/snapshots", snapshotRoutes());
   app.route("/capacity", capacityRoutes());
@@ -3061,6 +3307,7 @@ async function listen(opts = {}) {
       createServer: createHttpsServer,
       serverOptions: { key, cert }
     });
+    httpsServer.on("upgrade", boxUpgradeHandler({ name: cp.name, secret: cp.secret }));
     const port = opts.httpsPort ?? cp.port;
     await new Promise((resolve, reject) => {
       httpsServer.once("error", reject);