@linxin666/dsh-remote-web-ui 0.2.8 → 0.3.0

package/src/routes.ts

@@ -13,7 +13,7 @@ import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
 import { z, type ZodType } from 'zod'
 import { UnknownLanAddressError, type PairingService, type PairingSnapshot } from './pairing.ts'
 import { isLoopbackClient, readCookie } from './gate.ts'
-import { readBoundedJson, writeJson } from './http.ts'
+import { readJsonBody, writeJson } from './http.ts'
 
 /**
  * Browser-trust fence for the /api/pair routes, mirroring the connection
@@ -115,26 +115,17 @@ export const revokePayloadSchema = z.object({
 export const pairActionPayloadSchema = z.object({}).passthrough()
 
 /**
- * Parse a pair request body through schema. A missing/empty or non-object
- * body is treated as an empty object (the same way the previous manual reads
- * yielded absent fields), and a value that fails the schema returns
- * `undefined` so the caller can answer with the existing error shape.
+ * Parse a pair request body through schema. A missing/empty, unparseable
+ * or non-object body (shared readJsonBody with objectOnly yields null for
+ * all of them) is treated as an empty object — the desktop stop/heartbeat
+ * send no body — and a value that fails the schema returns `undefined` so
+ * the caller can answer with the existing error shape.
  */
-function parsePairPayload<T>(schema: ZodType<T>, body: Record<string, unknown> | undefined): T | undefined {
+function parsePairPayload<T>(schema: ZodType<T>, body: unknown | null): T | undefined {
   const result = schema.safeParse(body ?? {})
   return result.success ? result.data : undefined
 }
 
-/** Read a request body up to MAX_BODY_BYTES and parse it as JSON (undefined on failure). */
-async function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown> | undefined> {
-  try {
-    const parsed: unknown = await readBoundedJson(req, MAX_BODY_BYTES)
-    return typeof parsed === 'object' && parsed !== null ? parsed as Record<string, unknown> : undefined
-  } catch {
-    return undefined
-  }
-}
-
 /** One open desktop status stream. */
 interface StatusStream {
   res: ServerResponse
@@ -265,7 +256,7 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       writeJson(res, 403, { ok: false, code: 'forbidden' })
       return
     }
-    const body = await readJsonBody(req)
+    const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true })
     const payload = parsePairPayload(issuePayloadSchema, body)
     if (payload === undefined) {
       writeJson(res, 400, { ok: false, code: 'bad-payload' })
@@ -313,7 +304,7 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       writeJson(res, 429, { ok: false, code: 'rate-limited' })
       return
     }
-    const body = await readJsonBody(req)
+    const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true })
     const payload = parsePairPayload(acceptPayloadSchema, body)
     if (payload === undefined) {
       writeJson(res, 400, { ok: false, code: 'bad-payload' })
@@ -328,13 +319,11 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
     // No Secure attribute: LAN pairing runs over plain HTTP (the cookie must
     // work there), and the same cookie rides HTTPS on the tunnel. Lax keeps
     // top-level navigations working while blocking cross-site subrequests.
-    res.writeHead(200, {
-      'content-type': 'application/json; charset=utf-8',
+    writeJson(res, 200, { ok: true, deviceId: result.deviceId }, {
       'set-cookie': [
         `${service.config.cookieName}=${result.deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`,
       ],
     })
-    res.end(JSON.stringify({ ok: true, deviceId: result.deviceId }))
   }
 
   const handleStop = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
@@ -343,7 +332,7 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       writeJson(res, 403, { ok: false, code: 'forbidden' })
       return
     }
-    const body = await readJsonBody(req)
+    const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true })
     if (parsePairPayload(pairActionPayloadSchema, body) === undefined) {
       writeJson(res, 400, { ok: false, code: 'bad-payload' })
       return
@@ -358,7 +347,7 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       writeJson(res, 403, { ok: false, code: 'forbidden' })
       return
     }
-    const body = await readJsonBody(req)
+    const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true })
     const payload = parsePairPayload(revokePayloadSchema, body)
     if (payload === undefined) {
       writeJson(res, 400, { ok: false, code: 'bad-payload' })
@@ -378,7 +367,7 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       writeJson(res, 403, { ok: false, code: 'forbidden' })
       return
     }
-    const body = await readJsonBody(req)
+    const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true })
     if (parsePairPayload(pairActionPayloadSchema, body) === undefined) {
       writeJson(res, 400, { ok: false, code: 'bad-payload' })
       return

package/src/uuid-polyfill.ts

@@ -0,0 +1,28 @@
+/**
+ * Polyfill for crypto.randomUUID for non-secure contexts (LAN HTTP)
+ * where the browser does not expose crypto.randomUUID.
+ *
+ * The script string is injected as an inline <script> in the desktop HTML
+ * head so the SDK's mintRpcId() sees a working randomUUID even on plain
+ * http:// origins (#1024).
+ */
+
+export const UUID_POLYFILL_SCRIPT = [
+  '(function(){',
+  'var g=typeof globalThis!=="undefined"?globalThis:typeof window!=="undefined"?window:self;',
+  'if(typeof g.crypto==="undefined"){g.crypto={};}',
+  'if(typeof g.crypto.randomUUID!=="function"){',
+  'g.crypto.randomUUID=function(){',
+  'var a=new Uint8Array(16);',
+  'if(g.crypto.getRandomValues){g.crypto.getRandomValues(a);}',
+  'else{for(var j=0;j<16;j++){a[j]=Math.random()*256|0;}}',
+  'a[6]=(a[6]&0x0f)|0x40;',
+  'a[8]=(a[8]&0x3f)|0x80;',
+  'var h="",x="0123456789abcdef";',
+  'for(var i=0;i<16;i++){h+=x[a[i]>>4]+x[a[i]&0x0f];',
+  'if(i===3||i===5||i===7||i===9)h+="-";}',
+  'return h;',
+  '};',
+  '}',
+  '})();',
+].join('')