@linxin666/dsh-remote-web-ui 0.1.1

package/src/client/settings-form.ts

@@ -0,0 +1,294 @@
+/**
+ * Staged form model behind the plugin settings card. A card stages what the
+ * user types and writes it only when they save — the settings write is a
+ * durable, revision-fenced document mutation, so staging keeps what is on
+ * screen exactly what a save would store. Mirrors the official
+ * ui-plugin-config card-store pattern in a self-contained slice: this
+ * package must not depend on a sibling UI package.
+ */
+
+import type { SettingsScope, SettingsScopeSnapshot, SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
+
+/** The write one field's staged text performs when the card is saved. */
+export type FieldWrite =
+  | { kind: 'set'; value: unknown }
+  | { kind: 'clear' }
+
+/** How one field converts between its stored value and its draft text. */
+export interface FieldSpec {
+  /** Field name inside the namespace section. */
+  field: string
+  /** Render a stored value as draft text; the empty string when the section carries none. */
+  format: (value: unknown) => string
+  /**
+   * The write this draft text stages, or undefined when the text is not a
+   * value this field accepts — which blocks the save rather than discarding it.
+   */
+  parse: (text: string) => FieldWrite | undefined
+}
+
+/** One field as the card renders it. */
+export interface FieldState {
+  /** Draft text the control renders. */
+  text: string
+  /** Whether saving would leave a user-layer entry for this field. */
+  overridden: boolean
+  /** Whether the draft is not a value this field accepts, which blocks saving. */
+  invalid: boolean
+}
+
+/** Form state every plugin settings card shares. */
+export interface CardShell {
+  /** False while the namespace is not served to this client; the card renders nothing. */
+  available: boolean
+  /** Whether the Host document accepts writes. */
+  writable: boolean
+  /** Whether the form holds edits that a save would write. */
+  dirty: boolean
+  /** Whether any staged draft is invalid, which blocks the save. */
+  invalid: boolean
+  /** Whether a save is crossing the wire. */
+  saving: boolean
+  /** Whether the last save did not land as staged; cleared by the next edit or save. */
+  failed: boolean
+}
+
+/** The write actions the card's slot entry injects. */
+export interface CardActions {
+  /** Stage draft text for one field. */
+  edit: (field: string, text: string) => void
+  /** Stage a clear, so saving lets the field re-inherit the composition layer. */
+  resetField: (field: string) => void
+  /** Write every staged edit, then re-seed from what the Host accepted. */
+  save: () => void
+  /** Drop every staged edit. */
+  discard: () => void
+}
+
+/** One field's staged edit. */
+interface StagedEdit {
+  /** Draft text the control renders. */
+  text: string
+  /** True when this edit clears the field whatever text it shows. */
+  clear: boolean
+}
+
+/** One staged edit resolved into the write a save performs. */
+interface PlannedWrite {
+  /** Field this entry writes. */
+  field: string
+  /** Perform the write and report whether the Host holds the staged value afterwards. */
+  run: (() => Promise<boolean>) | undefined
+}
+
+/** A whole-number field. An empty draft clears the field; any other draft that is not a finite number blocks the save. */
+export function numberField(field: string): FieldSpec {
+  return {
+    field,
+    format: value => typeof value === 'number' ? String(value) : '',
+    parse: (text) => {
+      const trimmed = text.trim()
+      if (trimmed === '') return { kind: 'clear' }
+      const parsed = Number(trimmed)
+      return Number.isFinite(parsed) ? { kind: 'set', value: parsed } : undefined
+    },
+  }
+}
+
+/** A free-text field. An empty draft clears the field. */
+export function textField(field: string): FieldSpec {
+  return {
+    field,
+    format: value => typeof value === 'string' ? value : '',
+    parse: (text) => {
+      const trimmed = text.trim()
+      return trimmed === '' ? { kind: 'clear' } : { kind: 'set', value: trimmed }
+    },
+  }
+}
+
+/** A boolean field, edited through true/false draft text. */
+export function booleanField(field: string): FieldSpec {
+  return {
+    field,
+    format: value => typeof value === 'boolean' ? String(value) : '',
+    parse: (text) => {
+      if (text === 'true') return { kind: 'set', value: true }
+      if (text === 'false') return { kind: 'set', value: false }
+      return undefined
+    },
+  }
+}
+
+/**
+ * Stages one card's edits over one settings namespace and writes them on save.
+ *
+ * The Host is the only authority on whether a value was accepted — its
+ * validators own the constraints no schema can express — so the outcome is
+ * read back from the section rather than predicted here. A save that did not
+ * land keeps its drafts, so the user can correct them instead of retyping.
+ */
+export class CardForm<T> {
+  private readonly specs: Map<string, FieldSpec>
+  private readonly staged = new Map<string, StagedEdit>()
+  private readonly listeners = new Set<() => void>()
+  private saving = false
+  private failed = false
+
+  /** @param scope - the bound settings scope for this card's namespace. */
+  constructor(
+    private readonly scope: SettingsScope<T>,
+    specs: FieldSpec[],
+  ) {
+    this.specs = new Map(specs.map(spec => [spec.field, spec]))
+    scope.subscribe(() => { this.publish() })
+  }
+
+  /** Publish a projection of this form, rebuilt whenever the scope or a draft changes. */
+  bind<S>(project: () => S): SnapshotStore<S> {
+    const store = createSnapshotStore(project())
+    this.listeners.add(() => { store.set(project()) })
+    return store
+  }
+
+  /** Read the card-level state: what the Host serves, and what a save would do. */
+  shell(): CardShell {
+    const snapshot = this.scope.getSnapshot()
+    const plan = this.plan()
+    return {
+      available: snapshot.status === 'ready',
+      writable: snapshot.writable,
+      dirty: plan.length > 0,
+      invalid: plan.some(item => item.run === undefined),
+      saving: this.saving,
+      failed: this.failed,
+    }
+  }
+
+  /** Read one field's state from the effective section and its staged draft. */
+  field(field: string): FieldState {
+    const spec = this.specOf(field)
+    const staged = this.staged.get(field)
+    if (staged === undefined) {
+      return { text: spec.format(this.sectionValue(field)), overridden: this.stored(field), invalid: false }
+    }
+    const write = staged.clear ? { kind: 'clear' as const } : spec.parse(staged.text)
+    return {
+      text: staged.text,
+      overridden: write?.kind === 'set',
+      invalid: write === undefined,
+    }
+  }
+
+  /** The actions the card's slot registration injects. */
+  actions(): CardActions {
+    return {
+      edit: (field, text) => { this.stage(field, { text, clear: false }) },
+      resetField: (field) => {
+        this.stage(field, { text: this.specOf(field).format(this.baseValue(field)), clear: true })
+      },
+      save: () => { void this.save() },
+      discard: () => {
+        if (this.staged.size === 0 && !this.failed) return
+        this.staged.clear()
+        this.failed = false
+        this.publish()
+      },
+    }
+  }
+
+  /**
+   * Write every staged edit, then re-seed from what the Host accepted.
+   * @returns settlement after every write and the read-back.
+   */
+  async save(): Promise<void> {
+    const plan = this.plan()
+    const writes = plan.flatMap(item => item.run === undefined ? [] : [item.run])
+    if (plan.length === 0 || this.saving || writes.length !== plan.length) return
+    this.saving = true
+    this.failed = false
+    this.publish()
+    let landed = true
+    for (const write of writes) {
+      landed = await write() && landed
+    }
+    if (landed) this.staged.clear()
+    this.saving = false
+    this.failed = !landed
+    this.publish()
+  }
+
+  /**
+   * Every staged edit a save would write. An entry whose draft is not a value
+   * its field accepts carries no write: the form is still dirty, and the save
+   * refuses rather than dropping the edit. A staged edit that matches the
+   * effective section is not a write at all.
+   * @returns the planned writes, in the order the fields were staged.
+   */
+  private plan(): PlannedWrite[] {
+    const plan: PlannedWrite[] = []
+    for (const [field, staged] of this.staged) {
+      const spec = this.specOf(field)
+      if (staged.clear) {
+        if (this.stored(field)) plan.push({ field, run: () => this.clear(field) })
+        continue
+      }
+      if (staged.text === spec.format(this.sectionValue(field))) continue
+      const write = spec.parse(staged.text)
+      if (write === undefined) plan.push({ field, run: undefined })
+      else if (write.kind === 'clear') plan.push({ field, run: () => this.clear(field) })
+      else plan.push({ field, run: () => this.store(field, write.value) })
+    }
+    return plan
+  }
+
+  private async clear(field: string): Promise<boolean> {
+    await this.scope.unset(field)
+    return !this.stored(field)
+  }
+
+  private async store(field: string, value: unknown): Promise<boolean> {
+    await this.scope.set(field, value)
+    return this.userLayer()?.[field] === value
+  }
+
+  private stage(field: string, edit: StagedEdit): void {
+    this.staged.set(field, edit)
+    this.failed = false
+    this.publish()
+  }
+
+  private specOf(field: string): FieldSpec {
+    const spec = this.specs.get(field)
+    // Every call site names a field this card declared; a missing one is a
+    // wiring mistake that must not degrade into a silently inert control.
+    if (spec === undefined) throw new Error(`settings card has no field ${field}`)
+    return spec
+  }
+
+  private snapshotOf(): SettingsScopeSnapshot<T> {
+    return this.scope.getSnapshot()
+  }
+
+  private sectionValue(field: string): unknown {
+    return (this.snapshotOf().value as Record<string, unknown> | undefined)?.[field]
+  }
+
+  private baseValue(field: string): unknown {
+    return (this.snapshotOf().base as Record<string, unknown> | undefined)?.[field]
+  }
+
+  private userLayer(): Record<string, unknown> | undefined {
+    return this.snapshotOf().user as Record<string, unknown> | undefined
+  }
+
+  private stored(field: string): boolean {
+    const user = this.userLayer()
+    return user !== undefined && Object.hasOwn(user, field)
+  }
+
+  private publish(): void {
+    for (const listener of this.listeners) listener()
+  }
+}

package/src/css-modules.d.ts

@@ -0,0 +1,6 @@
+declare module '*.module.css' {
+  const classes: Record<string, string>
+  export default classes
+}
+
+declare module '*.css'

package/src/gate.ts

@@ -0,0 +1,121 @@
+/**
+ * The `api/gate` listener: application-level access control layered on top
+ * of the transport fence (the fence is Host/Origin based and explicitly not
+ * an authentication layer — packages/client/connection documents this
+ * event as the sanctioned seam for pairing/revocation).
+ *
+ * Policy: loopback requests (the desktop) pass without a device identity;
+ * every non-loopback /api request must carry a live, non-revoked device
+ * cookie. This makes the QR the only way into a LAN-exposed dsh web and
+ * gives "停止" real teeth: revoked devices 403 on their next request,
+ * including the mux/SSE stream (which then dies on reconnect).
+ */
+
+import type { IncomingMessage } from 'node:http'
+import type { PairingService } from './pairing.ts'
+
+/**
+ * Whether a normalized URL hostname names the local loopback authority.
+ * Semantics mirror the connection package's internal predicate (localhost,
+ * IPv6 loopback, any IPv4 address in 127/8); it is reimplemented here because
+ * the connection package no longer exports it — the fence now lives inside
+ * the connection plugin, and external host plugins only need the
+ * classification, not the whole trust decision.
+ * @param hostname - WHATWG URL hostname (IPv6 literals retain brackets).
+ * @returns true for localhost, IPv6 loopback, or any IPv4 address in 127/8.
+ */
+export function isLoopbackHostname(hostname: string): boolean {
+  if (hostname === 'localhost' || hostname === '[::1]') return true
+  const parts = hostname.split('.')
+  return parts.length === 4
+    && parts[0] === '127'
+    && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export function isLoopbackAddress(address: string | undefined): boolean {
+  if (address === undefined) return false
+  const normalized = address.toLowerCase()
+  if (normalized === '::1') return true
+  if (normalized.startsWith('::ffff:')) return isIPv4Loopback(normalized.slice('::ffff:'.length))
+  return isIPv4Loopback(normalized)
+}
+
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+function isIPv4Loopback(v4: string): boolean {
+  const parts = v4.split('.')
+  return parts.length === 4
+    && parts[0] === '127'
+    && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+/**
+ * Read one cookie value from a Cookie header.
+ * @param header - the raw Cookie header value (or undefined).
+ * @param name - the cookie name.
+ * @returns the value, or undefined when absent.
+ */
+export function readCookie(header: string | undefined, name: string): string | undefined {
+  if (header === undefined) return undefined
+  for (const part of header.split(';')) {
+    const eq = part.indexOf('=')
+    if (eq < 0) continue
+    const key = part.slice(0, eq).trim()
+    if (key === name) return part.slice(eq + 1).trim()
+  }
+  return undefined
+}
+
+/**
+ * The effective Host hostname of a request.
+ * @param request - node HTTP request.
+ * @returns the normalized hostname, or undefined when unparsable.
+ */
+export function hostnameOf(request: IncomingMessage): string | undefined {
+  const host = request.headers.host
+  if (typeof host !== 'string') return undefined
+  try {
+    return new URL(`http://${host}`).hostname
+  } catch {
+    return undefined
+  }
+}
+
+/** Whether a request comes from the desktop loopback client (loopback socket AND loopback Host). */
+export function isLoopbackClient(request: IncomingMessage): boolean {
+  const hostname = hostnameOf(request)
+  if (hostname === undefined || !isLoopbackHostname(hostname)) return false
+  const socket = request.socket as { remoteAddress?: string } | undefined
+  return isLoopbackAddress(socket?.remoteAddress)
+}
+
+/**
+ * Build the api/gate listener for one pairing service.
+ * @param service - the pairing service.
+ * @param requirePairingForLan - when false, non-loopback requests pass
+ * without a device cookie (the feature then only manages tokens/status;
+ * revocation of paired devices still holds). A function is re-read per
+ * request, so a settings edit takes effect without a restart. Defaults to true.
+ * @param enabled - when false, every non-loopback request is vetoed while
+ * loopback stays available. A function is re-read per request so the fence
+ * stays mounted for the plugin lifetime and disabling the plugin cannot open
+ * a LAN-exposed /api. Defaults to true.
+ * @returns the cordis waterfall listener: call `next()` to delegate,
+ * return false (without calling it) to veto with 403.
+ */
+export function makeGateListener(
+  service: PairingService,
+  requirePairingForLan: boolean | (() => boolean) = true,
+  enabled: boolean | (() => boolean) = true,
+): (request: IncomingMessage, method: string | undefined, next: () => boolean | Promise<boolean>) => boolean | Promise<boolean> {
+  return (request, _method, next) => {
+    if (isLoopbackClient(request)) return next()
+    const active = typeof enabled === 'function' ? enabled() : enabled
+    if (!active) return false
+    const require = typeof requirePairingForLan === 'function' ? requirePairingForLan() : requirePairingForLan
+    if (!require) return next()
+    const deviceId = readCookie(request.headers.cookie, service.config.cookieName)
+    if (deviceId === undefined) return false
+    return service.touchDevice(deviceId) ? next() : false
+  }
+}