@linkshell/gateway 0.5.3 → 0.6.0

package/src/tunnel.ts

@@ -1,644 +0,0 @@
-import type { IncomingMessage, ServerResponse } from "node:http";
-import { randomUUID } from "node:crypto";
-import type WebSocket from "ws";
-import {
-  createEnvelope,
-  serializeEnvelope,
-} from "@linkshell/protocol";
-import type { SessionManager } from "./sessions.js";
-import type { TokenManager } from "./tokens.js";
-import { AUTH_REQUIRED } from "./auth-middleware.js";
-
-const TUNNEL_TIMEOUT = 30_000;
-const MAX_TUNNEL_BODY = 10 * 1024 * 1024; // 10MB
-
-export interface PendingTunnelRequest {
-  res: ServerResponse;
-  headersSent: boolean;
-  timeout: ReturnType<typeof setTimeout>;
-  tunnelCookie?: string;
-  sessionId: string;
-  port: number;
-  requestPath: string;
-}
-
-export interface PendingTunnelWs {
-  ws: WebSocket;
-}
-
-// Module-level maps keyed by requestId
-const pendingRequests = new Map<string, PendingTunnelRequest>();
-const pendingWsSockets = new Map<string, PendingTunnelWs>();
-
-// Track requestIds per session for cleanup on host disconnect
-const sessionRequests = new Map<string, Set<string>>();
-
-function trackRequest(sessionId: string, requestId: string): void {
-  let set = sessionRequests.get(sessionId);
-  if (!set) {
-    set = new Set();
-    sessionRequests.set(sessionId, set);
-  }
-  set.add(requestId);
-}
-
-function untrackRequest(sessionId: string, requestId: string): void {
-  const set = sessionRequests.get(sessionId);
-  if (set) {
-    set.delete(requestId);
-    if (set.size === 0) sessionRequests.delete(sessionId);
-  }
-}
-
-function extractToken(req: IncomingMessage, url: URL): string | null {
-  // Check Authorization header
-  const auth = req.headers.authorization;
-  if (auth) {
-    const match = auth.match(/^Bearer\s+(.+)$/i);
-    if (match?.[1]) return match[1];
-  }
-  // Check query param
-  const qToken = url.searchParams.get("token");
-  if (qToken) return qToken;
-  // Check cookie (token-only cookie)
-  const cookie = req.headers.cookie;
-  if (cookie) {
-    const match = cookie.match(/lsh_token=([^;]+)/);
-    if (match?.[1]) return match[1];
-  }
-  return null;
-}
-
-function stripGatewayCookies(cookie: string): string | null {
-  const kept = cookie
-    .split(";")
-    .map((part) => part.trim())
-    .filter((part) => {
-      const name = part.split("=", 1)[0]?.trim();
-      return name !== "lsh_tunnel" && name !== "lsh_token";
-    });
-  return kept.length > 0 ? kept.join("; ") : null;
-}
-
-function bindExplicitDeviceToken(
-  tokens: TokenManager,
-  sessionId: string,
-  url: URL,
-  preAuthToken?: string,
-): string | null {
-  // Cookie fallback may pass a JWT as preAuthToken. Only bind the explicit
-  // browser/device token from the original tunnel URL after JWT ownership has
-  // been proven.
-  if (preAuthToken) return null;
-  const deviceToken = url.searchParams.get("token");
-  if (!deviceToken) return null;
-  const token = tokens.register(deviceToken);
-  return tokens.bind(token, sessionId) ? token : null;
-}
-
-function forwardedUrl(path: string, url: URL): string {
-  const params = new URLSearchParams(url.searchParams);
-  params.delete("token");
-  params.delete("auth_token");
-  const query = params.toString();
-  return query ? `${path}?${query}` : path;
-}
-
-function stripGatewayAuthParams(pathname: string, searchParams: URLSearchParams, hash = ""): string {
-  const params = new URLSearchParams(searchParams);
-  params.delete("token");
-  params.delete("auth_token");
-  const query = params.toString();
-  return `${pathname}${query ? `?${query}` : ""}${hash}`;
-}
-
-function rewriteTunnelLocation(
-  location: string,
-  input: { sessionId: string; port: number; requestPath: string },
-): string {
-  try {
-    const parsed = new URL(location, `http://127.0.0.1:${input.port}${input.requestPath}`);
-    const isLocal =
-      parsed.hostname === "127.0.0.1" ||
-      parsed.hostname === "localhost" ||
-      parsed.hostname === "::1";
-    if (!isLocal || parsed.port !== String(input.port)) return location;
-    const target = stripGatewayAuthParams(parsed.pathname, parsed.searchParams, parsed.hash);
-    return `/tunnel/${encodeURIComponent(input.sessionId)}/${input.port}${target}`;
-  } catch {
-    return location;
-  }
-}
-
-function rewriteTunnelResponseHeaders(
-  headers: Record<string, string | string[]>,
-  input: { sessionId: string; port: number; requestPath: string },
-): Record<string, string | string[]> {
-  const rewritten = { ...headers };
-  const locationKey = Object.keys(rewritten).find((key) => key.toLowerCase() === "location");
-  if (!locationKey) return rewritten;
-
-  const location = rewritten[locationKey];
-  if (typeof location === "string") {
-    rewritten[locationKey] = rewriteTunnelLocation(location, input);
-  }
-  return rewritten;
-}
-
-export function tokenFromTunnelCookie(
-  req: IncomingMessage,
-  sessionId: string,
-  port: number,
-): string | null {
-  const tunnelCookie = parseTunnelCookie(req);
-  if (!tunnelCookie) return null;
-  if (tunnelCookie.sessionId !== sessionId || tunnelCookie.port !== port) return null;
-  return tunnelCookie.token;
-}
-
-/** Parse lsh_tunnel cookie: "sessionId:port:token" */
-export function parseTunnelCookie(req: IncomingMessage): { sessionId: string; port: number; token: string } | null {
-  const cookie = req.headers.cookie;
-  if (!cookie) return null;
-  const match = cookie.match(/lsh_tunnel=([^;]+)/);
-  if (!match?.[1]) return null;
-  const parts = decodeURIComponent(match[1]).split(":");
-  if (parts.length < 3) return null;
-  const sessionId = parts[0]!;
-  const port = Number(parts[1]);
-  const token = parts.slice(2).join(":"); // token may contain colons
-  if (!sessionId || isNaN(port) || port < 1 || port > 65535 || !token) return null;
-  return { sessionId, port, token };
-}
-
-function errorResponse(res: ServerResponse, status: number, message: string, diagnostic?: string): void {
-  if (res.headersSent) return;
-  res.writeHead(status, {
-    "content-type": "text/plain",
-    "cache-control": "no-store, private",
-    "cdn-cache-control": "no-store",
-    "surrogate-control": "no-store",
-    "vary": "authorization, cookie",
-    "access-control-allow-origin": "*",
-    ...(diagnostic ? { "x-linkshell-tunnel-error": diagnostic } : {}),
-  });
-  res.end(message);
-}
-
-function isSecureRequest(req: IncomingMessage): boolean {
-  if ((req.socket as { encrypted?: boolean }).encrypted) return true;
-  const proto = req.headers["x-forwarded-proto"];
-  if (typeof proto === "string") {
-    return proto.split(",")[0]?.trim().toLowerCase() === "https";
-  }
-  return false;
-}
-
-export function parseTunnelPath(pathname: string): { sessionId: string; port: number; path: string } | null {
-  const match = pathname.match(/^\/tunnel\/([^/]+)\/(\d+)(\/.*)?$/);
-  if (!match) return null;
-  const port = Number(match[2]);
-  if (port < 1 || port > 65535) return null;
-  return {
-    sessionId: match[1]!,
-    port,
-    path: match[3] || "/",
-  };
-}
-
-export function hasTunnelReferer(req: IncomingMessage): boolean {
-  const referer = req.headers.referer;
-  if (typeof referer !== "string") return false;
-  try {
-    const ref = new URL(referer);
-    return ref.pathname.startsWith("/tunnel/");
-  } catch {
-    return false;
-  }
-}
-
-export function shouldUseTunnelCookieFallback(
-  req: IncomingMessage,
-  pathname: string,
-  isReservedPath: (pathname: string) => boolean = () => false,
-): boolean {
-  if (pathname === "/" || isReservedPath(pathname)) return false;
-
-  // A stale Path=/ tunnel cookie must not hijack normal top-level document
-  // visits to the LinkShell web app. Subresources are allowed through the
-  // cookie fallback even when Referrer-Policy strips the /tunnel/... path; the
-  // real LinkShell shell clears this HttpOnly cookie on index.html responses,
-  // and concrete LinkShell assets are served before fallback.
-  const dest = req.headers["sec-fetch-dest"];
-  if (hasTunnelReferer(req)) return true;
-  if (!dest) return true;
-  if (dest === "iframe") return true;
-  if (dest !== "document") return true;
-
-  return false;
-}
-
-export function mergeTunnelSetCookie(
-  headers: Record<string, string | string[]>,
-  tunnelCookie?: string,
-): Record<string, string | string[]> {
-  if (!tunnelCookie) return headers;
-  const merged = { ...headers };
-  const setCookieKey = Object.keys(merged).find((key) => key.toLowerCase() === "set-cookie");
-  const upstreamSetCookie = setCookieKey ? merged[setCookieKey] : undefined;
-  if (setCookieKey) delete merged[setCookieKey];
-  merged["set-cookie"] = upstreamSetCookie
-    ? Array.isArray(upstreamSetCookie)
-      ? [...upstreamSetCookie, tunnelCookie]
-      : [upstreamSetCookie, tunnelCookie]
-    : tunnelCookie;
-  return merged;
-}
-
-export async function handleTunnelRequest(
-  req: IncomingMessage,
-  res: ServerResponse,
-  sessions: SessionManager,
-  tokens: TokenManager,
-  parsed: { sessionId: string; port: number; path: string },
-  url: URL,
-  preAuthToken?: string,
-): Promise<void> {
-  const { sessionId, port, path } = parsed;
-
-  // Auth: device token OR Supabase JWT (userId owns session)
-  let token = preAuthToken || extractToken(req, url) || tokenFromTunnelCookie(req, sessionId, port);
-  let tokenOwns = Boolean(token && await tokens.ownsFresh(token, sessionId));
-  let authOwns = false;
-  let authJwt: string | null = null;
-  let authDiagnostic = token ? "token_not_bound" : "missing_token";
-  if (!tokenOwns && AUTH_REQUIRED) {
-    // Try preAuthToken as JWT first (from cookie fallback), then from request headers/params
-    const jwtCandidate = preAuthToken || url.searchParams.get("auth_token") || (() => {
-      const auth = req.headers.authorization;
-      if (auth) { const m = auth.match(/^Bearer\s+(.+)$/i); if (m?.[1]) return m[1]; }
-      return null;
-    })();
-    if (jwtCandidate) {
-      try {
-        const SUPABASE_URL = process.env.SUPABASE_URL ?? "";
-        const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY ?? "";
-        if (SUPABASE_URL && SUPABASE_ANON_KEY) {
-          const userRes = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
-            headers: { Authorization: `Bearer ${jwtCandidate}`, apikey: SUPABASE_ANON_KEY },
-            signal: AbortSignal.timeout(5_000),
-          });
-          if (userRes.ok) {
-            const user = (await userRes.json()) as { id: string };
-            const session = sessions.get(sessionId);
-            if (user.id && session?.userId && user.id === session.userId) {
-              authOwns = true;
-              authJwt = jwtCandidate;
-            } else if (!session) {
-              authDiagnostic = "session_not_local";
-            } else if (!session.userId) {
-              authDiagnostic = "session_user_missing";
-            } else {
-              authDiagnostic = "session_user_mismatch";
-            }
-          } else {
-            authDiagnostic = "invalid_jwt";
-          }
-        }
-      } catch {
-        authDiagnostic = "jwt_check_failed";
-      }
-    }
-  }
-  if (!tokenOwns && authOwns) {
-    const boundToken = bindExplicitDeviceToken(tokens, sessionId, url, preAuthToken);
-    if (boundToken) {
-      token = boundToken;
-      tokenOwns = true;
-    }
-  }
-  if (!tokenOwns && !authOwns) {
-    errorResponse(res, 401, "Unauthorized", authDiagnostic);
-    return;
-  }
-
-  // Set auth cookie for subsequent sub-resource requests
-  let tunnelCookie: string | undefined;
-  const cookieToken = tokenOwns ? token : authJwt;
-  if (cookieToken) {
-    const cookieVal = encodeURIComponent(`${sessionId}:${port}:${cookieToken}`);
-    const secure = isSecureRequest(req) ? "; Secure" : "";
-    tunnelCookie = `lsh_tunnel=${cookieVal}; Path=/; Max-Age=600; HttpOnly${secure}; SameSite=Lax`;
-  }
-
-  // Validate session & host
-  const session = sessions.get(sessionId);
-  if (!session || !session.host || session.host.socket.readyState !== session.host.socket.OPEN) {
-    errorResponse(res, 502, "Host not connected", !session ? "session_not_local" : "host_not_connected");
-    return;
-  }
-
-  const requestId = randomUUID();
-  const method = req.method ?? "GET";
-
-  // Read request body
-  let body: string | null = null;
-  if (method !== "GET" && method !== "HEAD") {
-    const chunks: Buffer[] = [];
-    let size = 0;
-    for await (const chunk of req) {
-      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      size += buf.length;
-      if (size > MAX_TUNNEL_BODY) {
-        errorResponse(res, 413, "Request body too large");
-        return;
-      }
-      chunks.push(buf);
-    }
-    if (chunks.length > 0) {
-      body = Buffer.concat(chunks).toString("base64");
-    }
-  }
-
-  // Build forwarded headers (strip hop-by-hop)
-  const headers: Record<string, string> = {};
-  const skipHeaders = new Set(["host", "connection", "upgrade", "transfer-encoding", "keep-alive"]);
-  for (const [key, val] of Object.entries(req.headers)) {
-    if (!skipHeaders.has(key) && typeof val === "string") {
-      if (key === "cookie") {
-        const cookie = stripGatewayCookies(val);
-        if (cookie) headers[key] = cookie;
-      } else {
-        headers[key] = val;
-      }
-    }
-  }
-
-  // Reconstruct URL with query string. The gateway authenticates fallback
-  // subresources with lsh_tunnel; it must not mutate host-facing URLs with
-  // auth query params because that leaks credentials and poisons cache keys.
-  const fullUrl = forwardedUrl(path, url);
-
-  // Register pending request
-  const pending: PendingTunnelRequest = {
-    res,
-    headersSent: false,
-    timeout: setTimeout(() => {
-      pendingRequests.delete(requestId);
-      untrackRequest(sessionId, requestId);
-      errorResponse(res, 504, "Tunnel request timed out");
-    }, TUNNEL_TIMEOUT),
-    tunnelCookie,
-    sessionId,
-    port,
-    requestPath: path,
-  };
-  pendingRequests.set(requestId, pending);
-  trackRequest(sessionId, requestId);
-
-  // Send tunnel.request to host
-  const envelope = createEnvelope({
-    type: "tunnel.request",
-    sessionId,
-    payload: {
-      requestId,
-      method,
-      url: fullUrl,
-      headers,
-      body,
-      port,
-    },
-  });
-  session.host.socket.send(serializeEnvelope(envelope));
-
-  // Handle client disconnect
-  req.on("close", () => {
-    const p = pendingRequests.get(requestId);
-    if (p) {
-      clearTimeout(p.timeout);
-      pendingRequests.delete(requestId);
-      untrackRequest(sessionId, requestId);
-    }
-  });
-}
-
-export function handleTunnelResponse(payload: {
-  requestId: string;
-  statusCode: number;
-  headers: Record<string, string>;
-  body: string;
-  isFinal: boolean;
-}): void {
-  try {
-    const pending = pendingRequests.get(payload.requestId);
-    if (!pending) return;
-
-    if (!pending.headersSent) {
-      const responseHeaders: Record<string, string | string[]> = {
-        ...rewriteTunnelResponseHeaders(payload.headers, pending),
-        "cache-control": "no-store, private",
-        "cdn-cache-control": "no-store",
-        "surrogate-control": "no-store",
-        "vary": "authorization, cookie",
-        "access-control-allow-origin": "*",
-      };
-      pending.res.writeHead(payload.statusCode, mergeTunnelSetCookie(responseHeaders, pending.tunnelCookie));
-      pending.headersSent = true;
-    }
-
-    if (payload.body) {
-      pending.res.write(Buffer.from(payload.body, "base64"));
-    }
-
-    if (payload.isFinal) {
-      clearTimeout(pending.timeout);
-      pendingRequests.delete(payload.requestId);
-      pending.res.end();
-    }
-  } catch {}
-}
-
-export function handleTunnelWsData(payload: {
-  requestId: string;
-  data: string;
-  isBinary: boolean;
-}): void {
-  try {
-    const pending = pendingWsSockets.get(payload.requestId);
-    if (!pending || pending.ws.readyState !== 1) return;
-    const buf = Buffer.from(payload.data, "base64");
-    pending.ws.send(payload.isBinary ? buf : buf.toString("utf8"));
-  } catch {}
-}
-
-export function handleTunnelWsClose(payload: {
-  requestId: string;
-  code?: number;
-  reason?: string;
-}): void {
-  try {
-    const pending = pendingWsSockets.get(payload.requestId);
-    if (!pending) return;
-    pendingWsSockets.delete(payload.requestId);
-    if (pending.ws.readyState === 1) {
-      const code = typeof payload.code === "number" && payload.code >= 1000 && payload.code <= 4999 ? payload.code : 1000;
-      pending.ws.close(code, payload.reason ?? "");
-    }
-  } catch {}
-}
-
-export function registerTunnelWs(requestId: string, ws: WebSocket): void {
-  pendingWsSockets.set(requestId, { ws });
-}
-
-export function removeTunnelWs(requestId: string): void {
-  pendingWsSockets.delete(requestId);
-}
-
-export function cleanupSessionTunnels(sessionId: string): void {
-  const requestIds = sessionRequests.get(sessionId);
-  if (!requestIds) return;
-  for (const rid of requestIds) {
-    const pending = pendingRequests.get(rid);
-    if (pending) {
-      clearTimeout(pending.timeout);
-      errorResponse(pending.res, 502, "Host disconnected");
-      pendingRequests.delete(rid);
-    }
-    const ws = pendingWsSockets.get(rid);
-    if (ws) {
-      ws.ws.close(1001, "Host disconnected");
-      pendingWsSockets.delete(rid);
-    }
-  }
-  sessionRequests.delete(sessionId);
-}
-
-export async function handleTunnelWsUpgrade(
-  ws: WebSocket,
-  parsed: { sessionId: string; port: number; path: string },
-  url: URL,
-  sessions: SessionManager,
-  tokens: TokenManager,
-  preAuthToken?: string,
-): Promise<void> {
-  const { sessionId, port, path } = parsed;
-
-  // Auth: device token OR Supabase JWT (userId owns session)
-  let token = preAuthToken || url.searchParams.get("token");
-  let tokenOwns = Boolean(token && await tokens.ownsFresh(token, sessionId));
-  let authOwns = false;
-  let authDiagnostic = token ? "token_not_bound" : "missing_token";
-  if (!tokenOwns && AUTH_REQUIRED) {
-    // Try auth_token param first, then fall back to token param (cookie fallback stores JWT there)
-    const authToken = url.searchParams.get("auth_token") || token;
-    if (authToken) {
-      try {
-        const SUPABASE_URL = process.env.SUPABASE_URL ?? "";
-        const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY ?? "";
-        if (SUPABASE_URL && SUPABASE_ANON_KEY) {
-          const userRes = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
-            headers: { Authorization: `Bearer ${authToken}`, apikey: SUPABASE_ANON_KEY },
-            signal: AbortSignal.timeout(5_000),
-          });
-          if (userRes.ok) {
-            const user = (await userRes.json()) as { id: string };
-            const session = sessions.get(sessionId);
-            if (user.id && session?.userId && user.id === session.userId) {
-              authOwns = true;
-            } else if (!session) {
-              authDiagnostic = "session_not_local";
-            } else if (!session.userId) {
-              authDiagnostic = "session_user_missing";
-            } else {
-              authDiagnostic = "session_user_mismatch";
-            }
-          } else {
-            authDiagnostic = "invalid_jwt";
-          }
-        }
-      } catch {
-        authDiagnostic = "jwt_check_failed";
-      }
-    }
-  }
-  if (!tokenOwns && authOwns) {
-    const boundToken = bindExplicitDeviceToken(tokens, sessionId, url, preAuthToken);
-    if (boundToken) {
-      token = boundToken;
-      tokenOwns = true;
-    }
-  }
-  if (!tokenOwns && !authOwns) {
-    ws.close(4001, `Unauthorized:${authDiagnostic}`);
-    return;
-  }
-
-  const session = sessions.get(sessionId);
-  if (!session || !session.host || session.host.socket.readyState !== session.host.socket.OPEN) {
-    ws.close(4002, "Host not connected");
-    return;
-  }
-
-  const requestId = randomUUID();
-  const fullUrl = forwardedUrl(path, url);
-
-  // Register this WS so host responses route here
-  registerTunnelWs(requestId, ws);
-  trackRequest(sessionId, requestId);
-
-  // Send tunnel.request with upgrade header to host
-  const envelope = createEnvelope({
-    type: "tunnel.request",
-    sessionId,
-    payload: {
-      requestId,
-      method: "GET",
-      url: fullUrl,
-      headers: { "upgrade": "websocket" },
-      body: null,
-      port,
-    },
-  });
-  session.host.socket.send(serializeEnvelope(envelope));
-
-  // Forward data from browser WS to host
-  ws.on("message", (data: Buffer | string) => {
-    try {
-      const s = sessions.get(sessionId);
-      if (!s?.host || s.host.socket.readyState !== s.host.socket.OPEN) return;
-      const isBinary = typeof data !== "string";
-      const buf = typeof data === "string" ? Buffer.from(data) : data;
-      const fwd = createEnvelope({
-        type: "tunnel.ws.data",
-        sessionId,
-        payload: {
-          requestId,
-          data: buf.toString("base64"),
-          isBinary,
-        },
-      });
-      s.host.socket.send(serializeEnvelope(fwd));
-    } catch {}
-  });
-
-  ws.on("close", (code, reason) => {
-    try {
-      removeTunnelWs(requestId);
-      untrackRequest(sessionId, requestId);
-      const s = sessions.get(sessionId);
-      if (!s?.host || s.host.socket.readyState !== s.host.socket.OPEN) return;
-      const safeCode = typeof code === "number" && code >= 1000 && code <= 4999 ? code : 1000;
-      const fwd = createEnvelope({
-        type: "tunnel.ws.close",
-        sessionId,
-        payload: {
-          requestId,
-          code: safeCode,
-          reason: reason?.toString() || "",
-        },
-      });
-      s.host.socket.send(serializeEnvelope(fwd));
-    } catch {}
-  });
-}