@linkshell/gateway 0.5.2 → 0.6.0

package/src/main.ts

@@ -0,0 +1,65 @@
+import { supabaseVerifier } from "./accounts.js";
+import { packageVersion, startGateway } from "./serve.js";
+import { requirePro, supabaseSubscriptions } from "./subscription.js";
+
+// The gateway as a process (the Docker image runs this), configured by environment:
+//   PORT                          listen port (8787)
+//   RELAY_DATA_PATH               SQLite file with pairings and keys (./data/relay.db); keep it on a volume
+//   SUPABASE_URL + SUPABASE_ANON_KEY   turn accounts on
+//   AUTH_REQUIRED=true            computers need an active Pro account (with SUPABASE_SERVICE_ROLE_KEY)
+//   TRUSTED_PROXIES               comma-separated proxy addresses whose X-Forwarded-For is believed
+//   WS_CONNECT_RATE_LIMIT_MAX / WS_CONNECT_RATE_LIMIT_WINDOW_MS   connections per address (20 per 60000 ms)
+//   LOG_LEVEL                     debug | info | warn | error (info)
+
+const LOG_LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
+type LogLevel = keyof typeof LOG_LEVELS;
+const logLevel = (process.env.LOG_LEVEL ?? "info") as LogLevel;
+
+function log(level: LogLevel, message: string): void {
+  if (LOG_LEVELS[level] >= LOG_LEVELS[logLevel]) process.stdout.write(`[gateway:${level}] ${message}\n`);
+}
+
+const port = Number(process.env.PORT ?? 8787);
+const databasePath = process.env.RELAY_DATA_PATH ?? "./data/relay.db";
+const supabase = {
+  url: process.env.SUPABASE_URL ?? "",
+  anonKey: process.env.SUPABASE_ANON_KEY ?? "",
+  serviceRoleKey: process.env.SUPABASE_SERVICE_ROLE_KEY ?? "",
+};
+const version = packageVersion();
+
+const gateway = await startGateway({
+  port,
+  databasePath,
+  version,
+  log: (message) => log("info", `[relay] ${message}`),
+  verifyToken: supabase.url && supabase.anonKey ? supabaseVerifier(supabase.url, supabase.anonKey) : undefined,
+  admit:
+    process.env.AUTH_REQUIRED === "true"
+      ? requirePro(supabaseSubscriptions(supabase), (message) => log("warn", `[relay] ${message}`))
+      : undefined,
+  trustedProxies: (process.env.TRUSTED_PROXIES ?? "").split(","),
+  wsConnectLimit: {
+    max: Number(process.env.WS_CONNECT_RATE_LIMIT_MAX ?? 20),
+    windowMs: Number(process.env.WS_CONNECT_RATE_LIMIT_WINDOW_MS ?? 60_000),
+  },
+});
+
+log("info", `LinkShell Gateway v${version}`);
+log("info", `listening on http://0.0.0.0:${gateway.port}`);
+// Said at every start: coming up on an empty file is how every phone gets unpaired.
+log("info", `pairings and keys in ${databasePath}`);
+log("info", `log level: ${logLevel}`);
+
+function shutdown(): void {
+  process.stdout.write("[gateway] shutting down...\n");
+  void gateway.close().then(() => {
+    process.stdout.write("[gateway] stopped\n");
+    process.exit(0);
+  });
+  // Connections that won't close don't get to hold the process.
+  setTimeout(() => process.exit(1), 5000).unref();
+}
+
+process.on("SIGINT", shutdown);
+process.on("SIGTERM", shutdown);

package/src/rate-limit.ts

@@ -0,0 +1,72 @@
+import type { IncomingMessage } from "node:http";
+
+/** Counts hits per key in fixed windows; over `maxHits` in one window is refused. */
+export class RateLimiter {
+  private readonly hits = new Map<string, { count: number; resetAt: number }>();
+  private readonly pruneTimer: ReturnType<typeof setInterval>;
+
+  constructor(
+    private readonly maxHits: number,
+    private readonly windowMs: number,
+  ) {
+    // Finished windows are dropped, so the map holds only keys seen lately.
+    this.pruneTimer = setInterval(() => this.prune(), Math.max(windowMs, 60_000));
+    this.pruneTimer.unref();
+  }
+
+  allow(key: string): boolean {
+    const now = Date.now();
+    const entry = this.hits.get(key);
+    if (!entry || now >= entry.resetAt) {
+      this.hits.set(key, { count: 1, resetAt: now + this.windowMs });
+      return true;
+    }
+    entry.count++;
+    return entry.count <= this.maxHits;
+  }
+
+  private prune(): void {
+    const now = Date.now();
+    for (const [key, entry] of this.hits) {
+      if (now >= entry.resetAt) this.hits.delete(key);
+    }
+  }
+
+  destroy(): void {
+    clearInterval(this.pruneTimer);
+  }
+}
+
+/** A host or a test on this machine: never rate limited. */
+export function isLoopback(ip: string): boolean {
+  const normalized = ip.trim().toLowerCase();
+  return normalized === "127.0.0.1" || normalized === "::1" || normalized === "::ffff:127.0.0.1";
+}
+
+/** IPv4 addresses arrive IPv6-mapped (::ffff:1.2.3.4) on a dual-stack socket. */
+function normalizeIp(ip: string): string {
+  const trimmed = ip.trim().toLowerCase();
+  return trimmed.startsWith("::ffff:") ? trimmed.slice(7) : trimmed;
+}
+
+/** The reverse proxies in front of this gateway, from a list of their addresses. */
+export function trustedProxySet(addresses: readonly string[]): Set<string> {
+  return new Set(addresses.map(normalizeIp).filter(Boolean));
+}
+
+/**
+ * Who is connecting. X-Forwarded-For is believed only when the direct peer is
+ * one of `trustedProxies`: from anyone else the header is the caller's own
+ * claim, and believing it would let them pick their rate-limit key.
+ */
+export function clientIp(request: IncomingMessage, trustedProxies: ReadonlySet<string>): string {
+  const peer = request.socket.remoteAddress ?? "unknown";
+  if (trustedProxies.has(normalizeIp(peer))) {
+    const forwarded = request.headers["x-forwarded-for"];
+    if (typeof forwarded === "string") {
+      const first = forwarded.split(",")[0]?.trim();
+      if (first) return first;
+    }
+  }
+  return peer;
+}