@linkshell/gateway 0.4.23 → 0.4.25

package/src/tunnel.ts

@@ -17,6 +17,9 @@ export interface PendingTunnelRequest {
   headersSent: boolean;
   timeout: ReturnType<typeof setTimeout>;
   tunnelCookie?: string;
+  sessionId: string;
+  port: number;
+  requestPath: string;
 }
 
 export interface PendingTunnelWs {
@@ -66,6 +69,17 @@ function extractToken(req: IncomingMessage, url: URL): string | null {
   return null;
 }
 
+function stripGatewayCookies(cookie: string): string | null {
+  const kept = cookie
+    .split(";")
+    .map((part) => part.trim())
+    .filter((part) => {
+      const name = part.split("=", 1)[0]?.trim();
+      return name !== "lsh_tunnel" && name !== "lsh_token";
+    });
+  return kept.length > 0 ? kept.join("; ") : null;
+}
+
 function bindExplicitDeviceToken(
   tokens: TokenManager,
   sessionId: string,
@@ -82,6 +96,55 @@ function bindExplicitDeviceToken(
   return tokens.bind(token, sessionId) ? token : null;
 }
 
+function forwardedUrl(path: string, url: URL): string {
+  const params = new URLSearchParams(url.searchParams);
+  params.delete("token");
+  params.delete("auth_token");
+  const query = params.toString();
+  return query ? `${path}?${query}` : path;
+}
+
+function stripGatewayAuthParams(pathname: string, searchParams: URLSearchParams, hash = ""): string {
+  const params = new URLSearchParams(searchParams);
+  params.delete("token");
+  params.delete("auth_token");
+  const query = params.toString();
+  return `${pathname}${query ? `?${query}` : ""}${hash}`;
+}
+
+function rewriteTunnelLocation(
+  location: string,
+  input: { sessionId: string; port: number; requestPath: string },
+): string {
+  try {
+    const parsed = new URL(location, `http://127.0.0.1:${input.port}${input.requestPath}`);
+    const isLocal =
+      parsed.hostname === "127.0.0.1" ||
+      parsed.hostname === "localhost" ||
+      parsed.hostname === "::1";
+    if (!isLocal || parsed.port !== String(input.port)) return location;
+    const target = stripGatewayAuthParams(parsed.pathname, parsed.searchParams, parsed.hash);
+    return `/tunnel/${encodeURIComponent(input.sessionId)}/${input.port}${target}`;
+  } catch {
+    return location;
+  }
+}
+
+function rewriteTunnelResponseHeaders(
+  headers: Record<string, string | string[]>,
+  input: { sessionId: string; port: number; requestPath: string },
+): Record<string, string | string[]> {
+  const rewritten = { ...headers };
+  const locationKey = Object.keys(rewritten).find((key) => key.toLowerCase() === "location");
+  if (!locationKey) return rewritten;
+
+  const location = rewritten[locationKey];
+  if (typeof location === "string") {
+    rewritten[locationKey] = rewriteTunnelLocation(location, input);
+  }
+  return rewritten;
+}
+
 export function tokenFromTunnelCookie(
   req: IncomingMessage,
   sessionId: string,
@@ -108,7 +171,7 @@ export function parseTunnelCookie(req: IncomingMessage): { sessionId: string; po
   return { sessionId, port, token };
 }
 
-function errorResponse(res: ServerResponse, status: number, message: string): void {
+function errorResponse(res: ServerResponse, status: number, message: string, diagnostic?: string): void {
   if (res.headersSent) return;
   res.writeHead(status, {
     "content-type": "text/plain",
@@ -117,6 +180,7 @@ function errorResponse(res: ServerResponse, status: number, message: string): vo
     "surrogate-control": "no-store",
     "vary": "authorization, cookie",
     "access-control-allow-origin": "*",
+    ...(diagnostic ? { "x-linkshell-tunnel-error": diagnostic } : {}),
   });
   res.end(message);
 }
@@ -204,9 +268,10 @@ export async function handleTunnelRequest(
 
   // Auth: device token OR Supabase JWT (userId owns session)
   let token = preAuthToken || extractToken(req, url) || tokenFromTunnelCookie(req, sessionId, port);
-  let tokenOwns = Boolean(token && tokens.owns(token, sessionId));
+  let tokenOwns = Boolean(token && await tokens.ownsFresh(token, sessionId));
   let authOwns = false;
   let authJwt: string | null = null;
+  let authDiagnostic = token ? "token_not_bound" : "missing_token";
   if (!tokenOwns && AUTH_REQUIRED) {
     // Try preAuthToken as JWT first (from cookie fallback), then from request headers/params
     const jwtCandidate = preAuthToken || url.searchParams.get("auth_token") || (() => {
@@ -229,10 +294,20 @@ export async function handleTunnelRequest(
             if (user.id && session?.userId && user.id === session.userId) {
               authOwns = true;
               authJwt = jwtCandidate;
+            } else if (!session) {
+              authDiagnostic = "session_not_local";
+            } else if (!session.userId) {
+              authDiagnostic = "session_user_missing";
+            } else {
+              authDiagnostic = "session_user_mismatch";
             }
+          } else {
+            authDiagnostic = "invalid_jwt";
           }
         }
-      } catch {}
+      } catch {
+        authDiagnostic = "jwt_check_failed";
+      }
     }
   }
   if (!tokenOwns && authOwns) {
@@ -243,7 +318,7 @@ export async function handleTunnelRequest(
     }
   }
   if (!tokenOwns && !authOwns) {
-    errorResponse(res, 401, "Unauthorized");
+    errorResponse(res, 401, "Unauthorized", authDiagnostic);
     return;
   }
 
@@ -259,7 +334,7 @@ export async function handleTunnelRequest(
   // Validate session & host
   const session = sessions.get(sessionId);
   if (!session || !session.host || session.host.socket.readyState !== session.host.socket.OPEN) {
-    errorResponse(res, 502, "Host not connected");
+    errorResponse(res, 502, "Host not connected", !session ? "session_not_local" : "host_not_connected");
     return;
   }
 
@@ -290,14 +365,19 @@ export async function handleTunnelRequest(
   const skipHeaders = new Set(["host", "connection", "upgrade", "transfer-encoding", "keep-alive"]);
   for (const [key, val] of Object.entries(req.headers)) {
     if (!skipHeaders.has(key) && typeof val === "string") {
-      headers[key] = val;
+      if (key === "cookie") {
+        const cookie = stripGatewayCookies(val);
+        if (cookie) headers[key] = cookie;
+      } else {
+        headers[key] = val;
+      }
     }
   }
 
   // Reconstruct URL with query string. The gateway authenticates fallback
   // subresources with lsh_tunnel; it must not mutate host-facing URLs with
   // auth query params because that leaks credentials and poisons cache keys.
-  const fullUrl = path + (url.search || "");
+  const fullUrl = forwardedUrl(path, url);
 
   // Register pending request
   const pending: PendingTunnelRequest = {
@@ -309,6 +389,9 @@ export async function handleTunnelRequest(
       errorResponse(res, 504, "Tunnel request timed out");
     }, TUNNEL_TIMEOUT),
     tunnelCookie,
+    sessionId,
+    port,
+    requestPath: path,
   };
   pendingRequests.set(requestId, pending);
   trackRequest(sessionId, requestId);
@@ -352,7 +435,7 @@ export function handleTunnelResponse(payload: {
 
     if (!pending.headersSent) {
       const responseHeaders: Record<string, string | string[]> = {
-        ...payload.headers,
+        ...rewriteTunnelResponseHeaders(payload.headers, pending),
         "cache-control": "no-store, private",
         "cdn-cache-control": "no-store",
         "surrogate-control": "no-store",
@@ -443,8 +526,9 @@ export async function handleTunnelWsUpgrade(
 
   // Auth: device token OR Supabase JWT (userId owns session)
   let token = preAuthToken || url.searchParams.get("token");
-  let tokenOwns = Boolean(token && tokens.owns(token, sessionId));
+  let tokenOwns = Boolean(token && await tokens.ownsFresh(token, sessionId));
   let authOwns = false;
+  let authDiagnostic = token ? "token_not_bound" : "missing_token";
   if (!tokenOwns && AUTH_REQUIRED) {
     // Try auth_token param first, then fall back to token param (cookie fallback stores JWT there)
     const authToken = url.searchParams.get("auth_token") || token;
@@ -462,10 +546,20 @@ export async function handleTunnelWsUpgrade(
             const session = sessions.get(sessionId);
             if (user.id && session?.userId && user.id === session.userId) {
               authOwns = true;
+            } else if (!session) {
+              authDiagnostic = "session_not_local";
+            } else if (!session.userId) {
+              authDiagnostic = "session_user_missing";
+            } else {
+              authDiagnostic = "session_user_mismatch";
             }
+          } else {
+            authDiagnostic = "invalid_jwt";
           }
         }
-      } catch {}
+      } catch {
+        authDiagnostic = "jwt_check_failed";
+      }
     }
   }
   if (!tokenOwns && authOwns) {
@@ -476,7 +570,7 @@ export async function handleTunnelWsUpgrade(
     }
   }
   if (!tokenOwns && !authOwns) {
-    ws.close(4001, "Unauthorized");
+    ws.close(4001, `Unauthorized:${authDiagnostic}`);
     return;
   }
 
@@ -487,7 +581,7 @@ export async function handleTunnelWsUpgrade(
   }
 
   const requestId = randomUUID();
-  const fullUrl = path + (url.search || "");
+  const fullUrl = forwardedUrl(path, url);
 
   // Register this WS so host responses route here
   registerTunnelWs(requestId, ws);