@linkshell/gateway 0.2.12 → 0.2.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linkshell/gateway",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "type": "module",
   "main": "dist/gateway/src/index.js",
   "exports": {

package/src/embedded.ts

@@ -11,6 +11,7 @@ import {
 import { z, ZodError } from "zod";
 import { SessionManager } from "./sessions.js";
 import { PairingManager } from "./pairings.js";
+import { TokenManager } from "./tokens.js";
 import { handleSocketMessage } from "./relay.js";
 
 export interface EmbeddedGatewayOptions {
@@ -33,7 +34,10 @@ const MAX_WS_MESSAGE_SIZE = 50 * 1024 * 1024; // 50MB (supports base64 image upl
 const LOG_LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
 
 const createPairingBody = z.object({ sessionId: z.string().optional() });
-const claimPairingBody = z.object({ pairingCode: z.string().length(6) });
+const claimPairingBody = z.object({
+  pairingCode: z.string().length(6),
+  deviceToken: z.string().min(1).optional(),
+});
 
 class BodyTooLargeError extends Error {}
 
@@ -66,6 +70,13 @@ function getClientIp(req: IncomingMessage): string {
   return req.socket.remoteAddress ?? "unknown";
 }
 
+function extractBearerToken(req: IncomingMessage): string | null {
+  const auth = req.headers.authorization;
+  if (!auth) return null;
+  const match = auth.match(/^Bearer\s+(.+)$/i);
+  return match?.[1] ?? null;
+}
+
 /**
  * Start an embedded gateway. Returns a handle to get URLs and close it.
  * Used by CLI when no external --gateway is provided.
@@ -86,6 +97,7 @@ export function startEmbeddedGateway(
 
   const sessionManager = new SessionManager();
   const pairingManager = new PairingManager();
+  const tokenManager = new TokenManager();
 
   const server = createServer(async (req, res) => {
     if (req.method === "OPTIONS") {
@@ -126,30 +138,53 @@ export function startEmbeddedGateway(
           json(res, result.status, { error: result.error });
           return;
         }
-        json(res, 200, { sessionId: result.sessionId });
+        const token = tokenManager.register(body.deviceToken);
+        tokenManager.bind(token, result.sessionId);
+        json(res, 200, { sessionId: result.sessionId, deviceToken: token });
         return;
       }
 
       if (method === "GET" && url.pathname === "/sessions") {
-        const sessions = sessionManager.listActive().map((s) => ({
-          id: s.id,
-          state: s.state,
-          hasHost: !!s.host,
-          clientCount: s.clients.size,
-          controllerId: s.controllerId ?? null,
-          lastActivity: s.lastActivity,
-          createdAt: s.createdAt,
-          provider: s.provider ?? null,
-          hostname: s.hostname ?? null,
-          platform: s.platform ?? null,
-        }));
+        const token = extractBearerToken(req);
+        if (!token || !tokenManager.validate(token)) {
+          json(res, 401, {
+            error: "unauthorized",
+            message: "Valid device token required",
+          });
+          return;
+        }
+        const allowedIds = tokenManager.getSessionIds(token);
+        const sessions = sessionManager
+          .listActive()
+          .filter((s) => allowedIds.has(s.id))
+          .map((s) => ({
+            id: s.id,
+            state: s.state,
+            hasHost: !!s.host,
+            clientCount: s.clients.size,
+            controllerId: s.controllerId ?? null,
+            lastActivity: s.lastActivity,
+            createdAt: s.createdAt,
+            provider: s.provider ?? null,
+            hostname: s.hostname ?? null,
+            platform: s.platform ?? null,
+          }));
         json(res, 200, { sessions });
         return;
       }
 
       const sessionMatch = url.pathname.match(/^\/sessions\/([^/]+)$/);
       if (method === "GET" && sessionMatch) {
-        const summary = sessionManager.getSummary(sessionMatch[1]!);
+        const token = extractBearerToken(req);
+        const targetId = sessionMatch[1]!;
+        if (!token || !tokenManager.owns(token, targetId)) {
+          json(res, 401, {
+            error: "unauthorized",
+            message: "Valid device token required",
+          });
+          return;
+        }
+        const summary = sessionManager.getSummary(targetId);
         if (!summary) {
           json(res, 404, { error: "session_not_found" });
           return;
@@ -221,6 +256,15 @@ export function startEmbeddedGateway(
       }
 
       const deviceId = url.searchParams.get("deviceId") ?? randomUUID();
+
+      if (role === "client") {
+        const token = url.searchParams.get("token");
+        if (!token || !tokenManager.owns(token, sessionId)) {
+          socket.close(4001, "unauthorized");
+          return;
+        }
+      }
+
       const device = { socket, role, deviceId, connectedAt: Date.now() };
 
       if (role === "host") {
@@ -318,6 +362,7 @@ export function startEmbeddedGateway(
             wss.clients.forEach((ws) => ws.close(1001, "shutting down"));
             sessionManager.destroy();
             pairingManager.destroy();
+            tokenManager.destroy();
             server.close(() => res());
           }),
       });

package/src/index.ts

@@ -11,6 +11,7 @@ import {
 import { z, ZodError } from "zod";
 import { SessionManager } from "./sessions.js";
 import { PairingManager } from "./pairings.js";
+import { TokenManager } from "./tokens.js";
 import { handleSocketMessage } from "./relay.js";
 
 const port = Number(process.env.PORT ?? 8787);
@@ -29,6 +30,7 @@ function log(level: "debug" | "info" | "warn" | "error", msg: string): void {
 
 const sessionManager = new SessionManager();
 const pairingManager = new PairingManager();
+const tokenManager = new TokenManager();
 
 const PING_INTERVAL = 20_000;
 const MAX_BODY_SIZE = 4096;
@@ -93,6 +95,13 @@ function getClientIp(req: IncomingMessage): string {
   return req.socket.remoteAddress ?? "unknown";
 }
 
+function extractBearerToken(req: IncomingMessage): string | null {
+  const auth = req.headers.authorization;
+  if (!auth) return null;
+  const match = auth.match(/^Bearer\s+(.+)$/i);
+  return match?.[1] ?? null;
+}
+
 // ── CORS ────────────────────────────────────────────────────────────
 
 function setCors(res: ServerResponse): void {
@@ -105,7 +114,10 @@ function setCors(res: ServerResponse): void {
 // ── HTTP API ────────────────────────────────────────────────────────
 
 const createPairingBody = z.object({ sessionId: z.string().optional() });
-const claimPairingBody = z.object({ pairingCode: z.string().length(6) });
+const claimPairingBody = z.object({
+  pairingCode: z.string().length(6),
+  deviceToken: z.string().min(1).optional(),
+});
 
 const server = createServer(async (req, res) => {
   setCors(res);
@@ -183,24 +195,38 @@ async function handleRequest(
       json(res, result.status, { error: result.error });
       return;
     }
-    json(res, 200, { sessionId: result.sessionId });
+    const token = tokenManager.register(body.deviceToken);
+    tokenManager.bind(token, result.sessionId);
+    json(res, 200, { sessionId: result.sessionId, deviceToken: token });
     return;
   }
 
   // Session list
   if (method === "GET" && url.pathname === "/sessions") {
-    const sessions = sessionManager.listActive().map((s) => ({
-      id: s.id,
-      state: s.state,
-      hasHost: !!s.host,
-      clientCount: s.clients.size,
-      controllerId: s.controllerId ?? null,
-      lastActivity: s.lastActivity,
-      createdAt: s.createdAt,
-      provider: s.provider ?? null,
-      hostname: s.hostname ?? null,
-      platform: s.platform ?? null,
-    }));
+    const token = extractBearerToken(req);
+    if (!token || !tokenManager.validate(token)) {
+      json(res, 401, {
+        error: "unauthorized",
+        message: "Valid device token required",
+      });
+      return;
+    }
+    const allowedIds = tokenManager.getSessionIds(token);
+    const sessions = sessionManager
+      .listActive()
+      .filter((s) => allowedIds.has(s.id))
+      .map((s) => ({
+        id: s.id,
+        state: s.state,
+        hasHost: !!s.host,
+        clientCount: s.clients.size,
+        controllerId: s.controllerId ?? null,
+        lastActivity: s.lastActivity,
+        createdAt: s.createdAt,
+        provider: s.provider ?? null,
+        hostname: s.hostname ?? null,
+        platform: s.platform ?? null,
+      }));
     json(res, 200, { sessions });
     return;
   }
@@ -208,7 +234,16 @@ async function handleRequest(
   // Session detail
   const sessionMatch = url.pathname.match(/^\/sessions\/([^/]+)$/);
   if (method === "GET" && sessionMatch) {
-    const summary = sessionManager.getSummary(sessionMatch[1]!);
+    const token = extractBearerToken(req);
+    const targetId = sessionMatch[1]!;
+    if (!token || !tokenManager.owns(token, targetId)) {
+      json(res, 401, {
+        error: "unauthorized",
+        message: "Valid device token required",
+      });
+      return;
+    }
+    const summary = sessionManager.getSummary(targetId);
     if (!summary) {
       json(res, 404, { error: "session_not_found" });
       return;
@@ -271,6 +306,14 @@ wss.on(
 
     const deviceId = url.searchParams.get("deviceId") ?? randomUUID();
 
+    if (role === "client") {
+      const token = url.searchParams.get("token");
+      if (!token || !tokenManager.owns(token, sessionId)) {
+        socket.close(4001, "unauthorized");
+        return;
+      }
+    }
+
     const device = {
       socket,
       role,
@@ -397,6 +440,7 @@ function shutdown() {
   wss.clients.forEach((ws) => ws.close(1001, "server shutting down"));
   sessionManager.destroy();
   pairingManager.destroy();
+  tokenManager.destroy();
   server.close(() => {
     process.stdout.write("[gateway] stopped\n");
     process.exit(0);

package/src/tokens.ts

@@ -0,0 +1,87 @@
+import { randomUUID } from "node:crypto";
+
+const CLEANUP_INTERVAL = 5 * 60_000;
+const SESSION_TTL = 7 * 24 * 60 * 60_000; // 7 days — prune stale bindings
+
+interface TokenRecord {
+  token: string;
+  sessionIds: Set<string>;
+  createdAt: number;
+  lastUsedAt: number;
+}
+
+export class TokenManager {
+  private tokens = new Map<string, TokenRecord>();
+  private sessionToToken = new Map<string, string>();
+  private cleanupTimer: ReturnType<typeof setInterval>;
+
+  constructor() {
+    this.cleanupTimer = setInterval(() => this.cleanup(), CLEANUP_INTERVAL);
+  }
+
+  register(deviceToken?: string): string {
+    if (deviceToken && this.tokens.has(deviceToken)) {
+      const record = this.tokens.get(deviceToken)!;
+      record.lastUsedAt = Date.now();
+      return deviceToken;
+    }
+    const token = deviceToken || randomUUID();
+    this.tokens.set(token, {
+      token,
+      sessionIds: new Set(),
+      createdAt: Date.now(),
+      lastUsedAt: Date.now(),
+    });
+    return token;
+  }
+
+  bind(token: string, sessionId: string): boolean {
+    const record = this.tokens.get(token);
+    if (!record) return false;
+    record.sessionIds.add(sessionId);
+    record.lastUsedAt = Date.now();
+    this.sessionToToken.set(sessionId, token);
+    return true;
+  }
+
+  validate(token: string): boolean {
+    const record = this.tokens.get(token);
+    if (!record) return false;
+    record.lastUsedAt = Date.now();
+    return true;
+  }
+
+  owns(token: string, sessionId: string): boolean {
+    const record = this.tokens.get(token);
+    if (!record) return false;
+    record.lastUsedAt = Date.now();
+    return record.sessionIds.has(sessionId);
+  }
+
+  getSessionIds(token: string): Set<string> {
+    const record = this.tokens.get(token);
+    if (!record) return new Set();
+    record.lastUsedAt = Date.now();
+    return record.sessionIds;
+  }
+
+  getTokenForSession(sessionId: string): string | undefined {
+    return this.sessionToToken.get(sessionId);
+  }
+
+  private cleanup(): void {
+    const now = Date.now();
+    for (const [token, record] of this.tokens) {
+      if (now - record.lastUsedAt > SESSION_TTL) {
+        for (const sid of record.sessionIds) {
+          this.sessionToToken.delete(sid);
+        }
+        this.tokens.delete(token);
+      }
+    }
+  }
+
+  destroy(): void {
+    clearInterval(this.cleanupTimer);
+  }
+}