@lakutata/webrtc 0.0.0-stage → 3.1.4

package/dist/esm/lib/turn/turn/protocol.js

@@ -0,0 +1,781 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { StunServerProtocol } from '../protocol.js';
+import { classes, isComprehensionRequiredAttribute, isStunMessage, methods } from '../stun/const.js';
+import { Message, parseMessage } from '../stun/message.js';
+import { makeTurnIntegrityKey } from './auth.js';
+import { decodeChannelData, encodeChannelData, isChannelData, splitTurnTcpFrames } from './frame.js';
+const DEFAULT_ALLOCATION_LIFETIME = 600;
+const DEFAULT_PERMISSION_LIFETIME = 300;
+const DEFAULT_CHANNEL_LIFETIME = 600;
+const DEFAULT_NONCE_LIFETIME = 3600;
+const DEFAULT_MAX_ALLOCATIONS = 256;
+const UDP_TRANSPORT = 17;
+export class TurnServerProtocol {
+    constructor(options = {}) {
+        this.allocations = new Map();
+        this.allocationIdByClientId = new Map();
+        this.allocationIdByRelayId = new Map();
+        this.nonces = new Map();
+        this.tcpBuffers = new Map();
+        this.realm = options.realm ?? 'lakutata';
+        this.software = options.software;
+        this.fingerprint = options.fingerprint ?? 'if-present';
+        this.allocationLifetime =
+            options.allocationLifetime ?? DEFAULT_ALLOCATION_LIFETIME;
+        this.permissionLifetime =
+            options.permissionLifetime ?? DEFAULT_PERMISSION_LIFETIME;
+        this.channelLifetime = options.channelLifetime ?? DEFAULT_CHANNEL_LIFETIME;
+        this.nonceLifetime = options.nonceLifetime ?? DEFAULT_NONCE_LIFETIME;
+        this.maxAllocations = options.maxAllocations ?? DEFAULT_MAX_ALLOCATIONS;
+        this.allocationGate = options.allocationGate;
+        this.getPassword = options.getPassword ?? (() => undefined);
+        this.nowProvider = options.now;
+        this.bindingProtocol = new StunServerProtocol({
+            software: this.software,
+            fingerprint: this.fingerprint
+        });
+    }
+    /**the allocations in use */
+    get allocationCount() {
+        return this.allocations.size;
+    }
+    get nextTimeoutAt() {
+        return this.computeNextTimeoutAt();
+    }
+    handleClientDatagram(input) {
+        //Data on a channel, most of the packets: checked against its allocation and its binding only, no expiry to
+        //clean up or schedule (the timer does it)
+        if (isChannelData(input.data))
+            return this.handleChannelData(input, this.now());
+        return this.finalizeActions(this.handleClientPacket(input));
+    }
+    handleTcpChunk(input) {
+        const now = this.now();
+        const actions = [];
+        const buffer = Buffer.concat([
+            this.tcpBuffers.get(input.clientId) ?? Buffer.alloc(0),
+            input.data
+        ]);
+        const { frames, malformed, rest } = splitTurnTcpFrames(buffer);
+        if (malformed) {
+            this.tcpBuffers.delete(input.clientId);
+            actions.push({
+                type: 'close-client',
+                clientId: input.clientId
+            });
+            return this.finalizeActions(actions, now);
+        }
+        this.tcpBuffers.set(input.clientId, rest);
+        //Only data on channels: no expiry to clean up or schedule, as for a datagram of data
+        let control = false;
+        for (const frame of frames) {
+            const packet = {
+                clientId: input.clientId,
+                data: frame,
+                remoteAddress: input.remoteAddress,
+                localAddress: input.localAddress,
+                transport: input.transport
+            };
+            if (isChannelData(frame)) {
+                actions.push(...this.handleChannelData(packet, now));
+                continue;
+            }
+            control = true;
+            actions.push(...this.handleClientPacket(packet));
+        }
+        return control ? this.finalizeActions(actions, now) : actions;
+    }
+    handleRelayPacket(input) {
+        //Data of a peer, as handleChannelData: no expiry to clean up or schedule but those of what it uses
+        const now = this.now();
+        const actions = [];
+        const allocation = this.liveAllocation(this.getRelayAllocation(input.relayId), now, actions);
+        if (!allocation || !allocation.relayedAddress) {
+            actions.push({
+                type: 'ignore',
+                reason: 'unknown-relay'
+            });
+            return actions;
+        }
+        const channel = this.getChannelBinding(allocation, input.remoteAddress, now);
+        const permission = this.getPermission(allocation, input.remoteAddress, now);
+        if (!channel && !permission) {
+            actions.push({
+                type: 'ignore',
+                reason: 'unknown-channel'
+            });
+            return actions;
+        }
+        const data = channel
+            ? encodeChannelData(channel.number, input.data)
+            : new Message(methods.DATA, classes.INDICATION)
+                .setAttribute('XOR-PEER-ADDRESS', input.remoteAddress)
+                .setAttribute('DATA', input.data).bytes;
+        actions.push(this.sendClient(allocation.client, data));
+        return actions;
+    }
+    handleRelayBound(input) {
+        const now = this.now();
+        const actions = this.cleanupExpired(now);
+        const allocation = this.allocations.get(input.allocationId);
+        if (!allocation || allocation.relayId !== input.relayId) {
+            actions.push({
+                type: 'ignore',
+                reason: 'unknown-relay'
+            });
+            return this.finalizeActions(actions, now);
+        }
+        if (!allocation.pendingAllocate) {
+            actions.push({
+                type: 'ignore',
+                reason: 'unknown-relay'
+            });
+            return this.finalizeActions(actions, now);
+        }
+        allocation.relayedAddress = input.relayedAddress;
+        allocation.expiresAt = now + allocation.lifetime * 1000;
+        const pending = allocation.pendingAllocate;
+        allocation.pendingAllocate = undefined;
+        const response = this.successResponse(pending.message, methods.ALLOCATE, [
+            ['XOR-RELAYED-ADDRESS', input.relayedAddress],
+            ['XOR-MAPPED-ADDRESS', allocation.mappedAddress],
+            ['LIFETIME', allocation.lifetime]
+        ], pending.integrityKey);
+        actions.push(this.sendClient(pending.client, response.bytes));
+        return this.finalizeActions(actions, now);
+    }
+    handleRelayBindFailure(input) {
+        const now = this.now();
+        const actions = this.cleanupExpired(now);
+        const allocation = this.allocations.get(input.allocationId);
+        if (!allocation?.pendingAllocate) {
+            actions.push({
+                type: 'ignore',
+                reason: 'unknown-relay'
+            });
+            return this.finalizeActions(actions, now);
+        }
+        const pending = allocation.pendingAllocate;
+        this.deleteAllocation(allocation);
+        const response = this.errorResponse(pending.message, input.errorCode ?? 508, input.reason ?? 'Insufficient Capacity', [], pending.integrityKey);
+        actions.push(this.sendClient(pending.client, response.bytes));
+        return this.finalizeActions(actions, now);
+    }
+    handleClientClosed(input) {
+        const now = this.now();
+        const actions = this.cleanupExpired(now);
+        this.tcpBuffers.delete(input.clientId);
+        const allocation = this.getClientAllocation(input.clientId);
+        if (allocation) {
+            actions.push(...this.deleteAllocation(allocation));
+        }
+        return this.finalizeActions(actions, now);
+    }
+    handleTimer(now = this.now()) {
+        return this.finalizeActions(this.cleanupExpired(now), now);
+    }
+    handleClientPacket(input) {
+        const now = this.now();
+        if (isChannelData(input.data))
+            return this.handleChannelData(input, now);
+        const actions = this.cleanupExpired(now);
+        if (!isStunMessage(input.data)) {
+            actions.push({
+                type: 'ignore',
+                reason: 'non-stun'
+            });
+            return actions;
+        }
+        const message = parseMessage(input.data);
+        if (!message) {
+            actions.push({
+                type: 'ignore',
+                reason: 'malformed'
+            });
+            return actions;
+        }
+        if (message.messageClass === classes.INDICATION) {
+            if (message.messageMethod === methods.BINDING) {
+                actions.push({
+                    type: 'ignore',
+                    reason: 'binding-indication'
+                });
+                return actions;
+            }
+            if (message.messageMethod !== methods.SEND) {
+                actions.push({
+                    type: 'ignore',
+                    reason: 'unsupported-indication'
+                });
+                return actions;
+            }
+            return [...actions, ...this.handleSendIndication(input, message, now)];
+        }
+        if (message.messageClass !== classes.REQUEST) {
+            actions.push({
+                type: 'ignore',
+                reason: 'non-request'
+            });
+            return actions;
+        }
+        const unknownAttributes = [
+            ...new Set(message.unknownAttributeTypes.filter(isComprehensionRequiredAttribute))
+        ].sort((left, right) => left - right);
+        if (unknownAttributes.length > 0) {
+            actions.push(this.sendClient(this.clientEndpoint(input), this.errorResponse(message, 420, 'Unknown Attribute', [
+                ['UNKNOWN-ATTRIBUTES', unknownAttributes]
+            ]).bytes));
+            return actions;
+        }
+        if (message.messageMethod === methods.BINDING) {
+            return [...actions, ...this.handleBindingRequest(input)];
+        }
+        switch (message.messageMethod) {
+            case methods.ALLOCATE:
+                return [...actions, ...this.handleAllocateRequest(input, message, now)];
+            case methods.REFRESH:
+                return [...actions, ...this.handleRefreshRequest(input, message, now)];
+            case methods.CREATE_PERMISSION:
+                return [
+                    ...actions,
+                    ...this.handleCreatePermissionRequest(input, message, now)
+                ];
+            case methods.CHANNEL_BIND:
+                return [
+                    ...actions,
+                    ...this.handleChannelBindRequest(input, message, now)
+                ];
+            default:
+                actions.push(this.sendClient(this.clientEndpoint(input), this.errorResponse(message, 400, 'Bad Request').bytes));
+                return actions;
+        }
+    }
+    handleBindingRequest(input) {
+        const stunActions = this.bindingProtocol.handleDatagram(input);
+        return stunActions.map((action) => this.mapBindingAction(input, action));
+    }
+    handleAllocateRequest(input, message, _now) {
+        const auth = this.authenticateRequest(input, message, methods.ALLOCATE);
+        if ('response' in auth) {
+            return [this.sendClient(this.clientEndpoint(input), auth.response.bytes)];
+        }
+        const requestedTransport = message.getAttributeValue('REQUESTED-TRANSPORT');
+        if (requestedTransport === undefined) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 400, 'Bad Request', [], auth.integrityKey)
+                    .bytes)
+            ];
+        }
+        if (requestedTransport >>> 24 !== UDP_TRANSPORT) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 442, 'Unsupported Transport Protocol', [], auth.integrityKey).bytes)
+            ];
+        }
+        const requestedAddressFamily = message.getAttributeValue('REQUESTED-ADDRESS-FAMILY');
+        if (requestedAddressFamily !== undefined &&
+            requestedAddressFamily !== 0x01) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 440, 'Address Family not Supported', [], auth.integrityKey).bytes)
+            ];
+        }
+        if (message.getAttributeValue('EVEN-PORT') !== undefined ||
+            message.getAttributeValue('RESERVATION-TOKEN') !== undefined) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 508, 'Insufficient Capacity', [], auth.integrityKey).bytes)
+            ];
+        }
+        if (this.getClientAllocation(input.clientId)) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 437, 'Allocation Mismatch', [], auth.integrityKey).bytes)
+            ];
+        }
+        if (this.allocationGate ? !this.allocationGate.reserve() : this.allocations.size >= this.maxAllocations) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 486, 'Allocation Quota Reached', [], auth.integrityKey).bytes)
+            ];
+        }
+        const allocationId = randomUUID();
+        const relayId = randomUUID();
+        const allocation = {
+            id: allocationId,
+            relayId,
+            username: auth.username,
+            integrityKey: auth.integrityKey,
+            client: this.clientEndpoint(auth),
+            mappedAddress: auth.remoteAddress,
+            lifetime: this.clampLifetime(message.getAttributeValue('LIFETIME')),
+            pendingAllocate: {
+                client: this.clientEndpoint(auth),
+                integrityKey: auth.integrityKey,
+                message
+            },
+            permissions: new Map(),
+            channelsByNumber: new Map(),
+            channelsByPeer: new Map()
+        };
+        this.allocations.set(allocationId, allocation);
+        this.allocationIdByClientId.set(auth.clientId, allocationId);
+        this.allocationIdByRelayId.set(relayId, allocationId);
+        return [
+            {
+                type: 'bind-relay',
+                allocationId,
+                relayId
+            }
+        ];
+    }
+    handleRefreshRequest(input, message, now) {
+        const auth = this.authenticateRequest(input, message, methods.REFRESH);
+        if ('response' in auth) {
+            return [this.sendClient(this.clientEndpoint(input), auth.response.bytes)];
+        }
+        const allocation = this.getClientAllocation(input.clientId);
+        if (!allocation || allocation.username !== auth.username) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 437, 'Allocation Mismatch', [], auth.integrityKey).bytes)
+            ];
+        }
+        const requestedLifetime = message.getAttributeValue('LIFETIME');
+        if (requestedLifetime === 0) {
+            const actions = this.deleteAllocation(allocation);
+            const response = this.successResponse(message, methods.REFRESH, [['LIFETIME', 0]], auth.integrityKey);
+            return [this.sendClient(auth, response.bytes), ...actions];
+        }
+        allocation.lifetime = this.clampLifetime(requestedLifetime);
+        allocation.expiresAt = now + allocation.lifetime * 1000;
+        const lifetimeSeconds = Math.max(0, Math.floor((allocation.expiresAt - now) / 1000));
+        return [
+            this.sendClient(auth, this.successResponse(message, methods.REFRESH, [['LIFETIME', lifetimeSeconds]], auth.integrityKey).bytes)
+        ];
+    }
+    handleCreatePermissionRequest(input, message, now) {
+        const auth = this.authenticateRequest(input, message, methods.CREATE_PERMISSION);
+        if ('response' in auth) {
+            return [this.sendClient(this.clientEndpoint(input), auth.response.bytes)];
+        }
+        const allocation = this.getClientAllocation(input.clientId);
+        if (!allocation || allocation.username !== auth.username) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 437, 'Allocation Mismatch', [], auth.integrityKey).bytes)
+            ];
+        }
+        const peerAddress = message.getAttributeValue('XOR-PEER-ADDRESS');
+        if (!peerAddress) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 400, 'Bad Request', [], auth.integrityKey)
+                    .bytes)
+            ];
+        }
+        if (!hasSameAddressFamily(input.remoteAddress, peerAddress)) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 443, 'Peer Address Family Mismatch', [], auth.integrityKey).bytes)
+            ];
+        }
+        this.setPermission(allocation, peerAddress, now);
+        return [
+            this.sendClient(auth, this.successResponse(message, methods.CREATE_PERMISSION, [], auth.integrityKey).bytes)
+        ];
+    }
+    handleChannelBindRequest(input, message, now) {
+        const auth = this.authenticateRequest(input, message, methods.CHANNEL_BIND);
+        if ('response' in auth) {
+            return [this.sendClient(this.clientEndpoint(input), auth.response.bytes)];
+        }
+        const allocation = this.getClientAllocation(input.clientId);
+        if (!allocation || allocation.username !== auth.username) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 437, 'Allocation Mismatch', [], auth.integrityKey).bytes)
+            ];
+        }
+        const channelNumber = message.getAttributeValue('CHANNEL-NUMBER');
+        const peerAddress = message.getAttributeValue('XOR-PEER-ADDRESS');
+        if (!channelNumber || !peerAddress) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 400, 'Bad Request', [], auth.integrityKey)
+                    .bytes)
+            ];
+        }
+        if (channelNumber < 0x4000 || channelNumber > 0x7fff) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 400, 'Bad Request', [], auth.integrityKey)
+                    .bytes)
+            ];
+        }
+        if (!hasSameAddressFamily(input.remoteAddress, peerAddress)) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 443, 'Peer Address Family Mismatch', [], auth.integrityKey).bytes)
+            ];
+        }
+        const peerKey = addressKey(peerAddress);
+        const existingByNumber = allocation.channelsByNumber.get(channelNumber);
+        if (existingByNumber &&
+            addressKey(existingByNumber.peerAddress) !== peerKey) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 400, 'Bad Request', [], auth.integrityKey)
+                    .bytes)
+            ];
+        }
+        const existingByPeer = allocation.channelsByPeer.get(peerKey);
+        if (existingByPeer && existingByPeer.number !== channelNumber) {
+            return [
+                this.sendClient(auth, this.errorResponse(message, 400, 'Bad Request', [], auth.integrityKey)
+                    .bytes)
+            ];
+        }
+        this.setPermission(allocation, peerAddress, now);
+        const binding = {
+            peerAddress,
+            number: channelNumber,
+            expiresAt: now + this.channelLifetime * 1000
+        };
+        allocation.channelsByNumber.set(binding.number, binding);
+        allocation.channelsByPeer.set(peerKey, binding);
+        return [
+            this.sendClient(auth, this.successResponse(message, methods.CHANNEL_BIND, [], auth.integrityKey).bytes)
+        ];
+    }
+    handleSendIndication(input, message, now) {
+        const allocation = this.getClientAllocation(input.clientId);
+        if (!allocation) {
+            return [
+                {
+                    type: 'ignore',
+                    reason: 'unknown-client'
+                }
+            ];
+        }
+        const peerAddress = message.getAttributeValue('XOR-PEER-ADDRESS');
+        const data = message.getAttributeValue('DATA');
+        if (!peerAddress || !Buffer.isBuffer(data)) {
+            return [
+                {
+                    type: 'ignore',
+                    reason: 'malformed'
+                }
+            ];
+        }
+        if (!this.getPermission(allocation, peerAddress, now)) {
+            return [
+                {
+                    type: 'ignore',
+                    reason: 'unknown-channel'
+                }
+            ];
+        }
+        return [
+            {
+                type: 'send-relay',
+                relayId: allocation.relayId,
+                remoteAddress: peerAddress,
+                data
+            }
+        ];
+    }
+    authenticateRequest(input, message, method) {
+        const username = message.getAttributeValue('USERNAME');
+        const realm = message.getAttributeValue('REALM');
+        const nonce = message.getAttributeValue('NONCE');
+        const hasIntegrity = message.getAttributeValue('MESSAGE-INTEGRITY');
+        if (!username || realm !== this.realm || !nonce || !hasIntegrity) {
+            return {
+                response: this.unauthorizedResponse(message, 401, 'Unauthorized')
+            };
+        }
+        const nonceState = this.nonces.get(nonce.toString('hex'));
+        if (!nonceState || nonceState.expiresAt <= this.now()) {
+            return {
+                response: this.unauthorizedResponse(message, 438, 'Stale Nonce')
+            };
+        }
+        //The requests of an allocation other than Allocate are checked with the key it was made with, its username
+        //unchanged: time-limited credentials (TURN REST API) that expire do not end the allocations made with them
+        const allocation = method === methods.ALLOCATE ? undefined : this.getClientAllocation(input.clientId);
+        let integrityKey = allocation && allocation.username === username ? allocation.integrityKey : undefined;
+        if (!integrityKey) {
+            const password = this.getPassword(username, this.realm);
+            if (!password) {
+                return {
+                    response: this.unauthorizedResponse(message, 401, 'Unauthorized')
+                };
+            }
+            integrityKey = makeTurnIntegrityKey(username, this.realm, password);
+        }
+        const validated = parseMessage(input.data, integrityKey);
+        if (!validated || validated.messageMethod !== method) {
+            return {
+                response: this.unauthorizedResponse(message, 401, 'Unauthorized')
+            };
+        }
+        return {
+            ...input,
+            integrityKey,
+            message: validated,
+            username
+        };
+    }
+    unauthorizedResponse(request, errorCode, reason) {
+        return this.errorResponse(request, errorCode, reason, [
+            ['REALM', this.realm],
+            ['NONCE', this.issueNonce()]
+        ]);
+    }
+    successResponse(request, method, attributes = [], integrityKey) {
+        const response = new Message(method, classes.RESPONSE, request.transactionId);
+        this.addResponseAttributes(response, request, attributes, integrityKey);
+        return response;
+    }
+    errorResponse(request, errorCode, reason, attributes = [], integrityKey) {
+        const response = new Message(request.messageMethod, classes.ERROR, request.transactionId);
+        response.setAttribute('ERROR-CODE', [errorCode, reason]);
+        this.addResponseAttributes(response, request, attributes, integrityKey);
+        return response;
+    }
+    addResponseAttributes(response, request, attributes, integrityKey) {
+        for (const [key, value] of attributes) {
+            response.setAttribute(key, value);
+        }
+        if (this.software) {
+            response.setAttribute('SOFTWARE', this.software);
+        }
+        if (integrityKey) {
+            response.addMessageIntegrity(integrityKey);
+        }
+        if (this.shouldAddFingerprint(request)) {
+            response.addFingerprint();
+        }
+    }
+    shouldAddFingerprint(request) {
+        switch (this.fingerprint) {
+            case 'always':
+                return true;
+            case 'if-present':
+                return request.getAttributeValue('FINGERPRINT') !== undefined;
+            default:
+                return false;
+        }
+    }
+    issueNonce() {
+        const value = randomBytes(16);
+        this.nonces.set(value.toString('hex'), {
+            value,
+            expiresAt: this.now() + this.nonceLifetime * 1000
+        });
+        return value;
+    }
+    sendClient(client, data) {
+        return {
+            type: 'send-client',
+            clientId: client.clientId,
+            transport: client.transport,
+            remoteAddress: client.remoteAddress,
+            data
+        };
+    }
+    mapBindingAction(input, action) {
+        if (action.type === 'send') {
+            return this.sendClient(this.clientEndpoint(input), action.data);
+        }
+        return action;
+    }
+    clientEndpoint(input) {
+        return {
+            clientId: input.clientId,
+            transport: input.transport,
+            remoteAddress: input.remoteAddress,
+            localAddress: input.localAddress
+        };
+    }
+    /**
+     * Data of a client on a channel: relayed to the peer of the binding while the allocation and the binding last
+     * @param input
+     * @param now
+     */
+    handleChannelData(input, now) {
+        const actions = [];
+        const channelData = decodeChannelData(input.data);
+        if (!channelData) {
+            actions.push({
+                type: 'ignore',
+                reason: 'malformed'
+            });
+            return actions;
+        }
+        const allocation = this.liveAllocation(this.getClientAllocation(input.clientId), now, actions);
+        if (!allocation) {
+            actions.push({
+                type: 'ignore',
+                reason: 'unknown-client'
+            });
+            return actions;
+        }
+        const binding = allocation.channelsByNumber.get(channelData.channelNumber);
+        if (!binding || binding.expiresAt <= now) {
+            if (binding) {
+                this.removeChannelBinding(allocation, binding);
+            }
+            actions.push({
+                type: 'ignore',
+                reason: 'unknown-channel'
+            });
+            return actions;
+        }
+        actions.push({
+            type: 'send-relay',
+            relayId: allocation.relayId,
+            remoteAddress: binding.peerAddress,
+            data: channelData.data
+        });
+        return actions;
+    }
+    /**
+     * An allocation still alive: one expired is deleted now (the timer would delete it later)
+     * @param allocation
+     * @param now
+     * @param actions What deleting it takes.
+     */
+    liveAllocation(allocation, now, actions) {
+        if (allocation?.expiresAt !== undefined && allocation.expiresAt <= now) {
+            actions.push(...this.deleteAllocation(allocation));
+            return undefined;
+        }
+        return allocation;
+    }
+    getClientAllocation(clientId) {
+        const allocationId = this.allocationIdByClientId.get(clientId);
+        return allocationId ? this.allocations.get(allocationId) : undefined;
+    }
+    getRelayAllocation(relayId) {
+        const allocationId = this.allocationIdByRelayId.get(relayId);
+        return allocationId ? this.allocations.get(allocationId) : undefined;
+    }
+    setPermission(allocation, peerAddress, now) {
+        allocation.permissions.set(permissionKey(peerAddress), {
+            peerAddress,
+            expiresAt: now + this.permissionLifetime * 1000
+        });
+    }
+    getPermission(allocation, peerAddress, now) {
+        const key = permissionKey(peerAddress);
+        const permission = allocation.permissions.get(key);
+        if (!permission) {
+            return undefined;
+        }
+        if (permission.expiresAt <= now) {
+            allocation.permissions.delete(key);
+            return undefined;
+        }
+        return permission;
+    }
+    getChannelBinding(allocation, peerAddress, now) {
+        const key = addressKey(peerAddress);
+        const binding = allocation.channelsByPeer.get(key);
+        if (!binding) {
+            return undefined;
+        }
+        if (binding.expiresAt <= now) {
+            this.removeChannelBinding(allocation, binding);
+            return undefined;
+        }
+        return binding;
+    }
+    removeChannelBinding(allocation, binding) {
+        allocation.channelsByNumber.delete(binding.number);
+        allocation.channelsByPeer.delete(addressKey(binding.peerAddress));
+    }
+    deleteAllocation(allocation) {
+        if (this.allocations.delete(allocation.id))
+            this.allocationGate?.release();
+        this.allocationIdByClientId.delete(allocation.client.clientId);
+        this.allocationIdByRelayId.delete(allocation.relayId);
+        return [
+            {
+                type: 'close-relay',
+                relayId: allocation.relayId
+            }
+        ];
+    }
+    cleanupExpired(now) {
+        const actions = [];
+        for (const [key, nonce] of [...this.nonces]) {
+            if (nonce.expiresAt <= now) {
+                this.nonces.delete(key);
+            }
+        }
+        for (const allocation of [...this.allocations.values()]) {
+            if (allocation.expiresAt && allocation.expiresAt <= now) {
+                actions.push(...this.deleteAllocation(allocation));
+                continue;
+            }
+            for (const [permissionKey, permission] of [...allocation.permissions]) {
+                if (permission.expiresAt <= now) {
+                    allocation.permissions.delete(permissionKey);
+                }
+            }
+            for (const binding of [...allocation.channelsByNumber.values()]) {
+                if (binding.expiresAt <= now) {
+                    this.removeChannelBinding(allocation, binding);
+                }
+            }
+        }
+        return actions;
+    }
+    computeNextTimeoutAt() {
+        let next;
+        for (const nonce of this.nonces.values()) {
+            next =
+                next === undefined ? nonce.expiresAt : Math.min(next, nonce.expiresAt);
+        }
+        for (const allocation of this.allocations.values()) {
+            if (allocation.expiresAt !== undefined) {
+                next =
+                    next === undefined
+                        ? allocation.expiresAt
+                        : Math.min(next, allocation.expiresAt);
+            }
+            for (const permission of allocation.permissions.values()) {
+                next =
+                    next === undefined
+                        ? permission.expiresAt
+                        : Math.min(next, permission.expiresAt);
+            }
+            for (const binding of allocation.channelsByNumber.values()) {
+                next =
+                    next === undefined
+                        ? binding.expiresAt
+                        : Math.min(next, binding.expiresAt);
+            }
+        }
+        return next;
+    }
+    finalizeActions(actions, now = this.now()) {
+        const nextTimeoutAt = this.computeNextTimeoutAt();
+        if (nextTimeoutAt !== undefined) {
+            actions.push({
+                type: 'schedule-timeout',
+                at: Math.max(now, nextTimeoutAt)
+            });
+        }
+        return actions;
+    }
+    clampLifetime(requestedLifetime) {
+        if (!requestedLifetime || requestedLifetime <= 0) {
+            return this.allocationLifetime;
+        }
+        return Math.min(requestedLifetime, this.allocationLifetime);
+    }
+    now() {
+        return this.nowProvider?.() ?? Date.now();
+    }
+}
+function addressKey(address) {
+    return `${address[0]}:${address[1]}`;
+}
+function permissionKey(address) {
+    return address[0];
+}
+function hasSameAddressFamily(left, right) {
+    return isIpv6Address(left[0]) === isIpv6Address(right[0]);
+}
+function isIpv6Address(address) {
+    return address.includes(':');
+}