@livedesk/hub 0.1.30 → 0.1.31

package/src/settings/settings-schema.js

@@ -1,34 +1,17 @@
 import os from 'node:os';
 import path from 'node:path';
 
-export const SETTINGS_SCHEMA_VERSION = 1;
+export const SETTINGS_SCHEMA_VERSION = 2;
 
 export const DEFAULT_LIVEDESK_SETTINGS = Object.freeze({
   settingsSchemaVersion: SETTINGS_SCHEMA_VERSION,
-  connection: {
-    usePinToAddDevices: true,
-    pinValidityMinutes: 30,
-    rotatePinAfterPairing: true,
-    allowNewDevices: true,
-    approveNewDevices: true,
-    startWithComputer: true,
-    keepRunningInTray: true,
-    showConnectionNotifications: true
-  },
+  connection: {},
   security: {
     accessMode: 'trusted-only',
-    requireEncryptedConnections: true,
     allowInternetConnections: false,
     allowLanConnections: true,
-    allowUnencryptedLanFallback: false,
-    requireNewDeviceApproval: true,
-    requireAdministratorForSecurityChanges: true,
-    visibleControlIndicator: true,
     lockOnControlEnd: true,
-    disconnectIdleControlSessions: true,
-    idleControlMinutes: 30,
-    keepSessionHistory: true,
-    sessionHistoryDays: 30
+    idleControlMinutes: 30
   },
   control: {
     allowKeyboardMouse: true,
@@ -60,10 +43,8 @@ export const DEFAULT_LIVEDESK_SETTINGS = Object.freeze({
   filesAudio: {
     allowFileTransfer: true,
     allowFolderSync: false,
-    askBeforeReceivingFiles: true,
     openReceivedFolder: false,
     notifyTransferComplete: true,
-    allowOverwrite: false,
     defaultReceiveFolder: 'Desktop/LiveDeskFiles',
     maxFileSizeBytes: 1024 * 1024 * 1024,
     allowRemoteAudio: true,
@@ -103,7 +84,6 @@ export const DEFAULT_LIVEDESK_SETTINGS = Object.freeze({
     controlMaxHeight: 1080,
     controlQuality: 60,
     transport: 'auto',
-    allowPlainLanFallback: false,
     verboseLogs: false,
     frameStatistics: false
   }
@@ -115,7 +95,7 @@ const ENUMS = {
   permissionMode: new Set(['ask', 'safe-auto', 'full-access', 'custom']),
   wallFrameMode: new Set(['auto', 'mode2-lzo', 'mode3-h264-hw', 'mode4-h264-atlas']),
   controlFrameMode: new Set(['mode3-h264-hw', 'mode5-lzo-delta']),
-  transport: new Set(['auto', 'encrypted', 'plain-lan']),
+  transport: new Set(['auto', 'encrypted']),
   recordingQuality: new Set(['standard', 'high']),
   captureAutoDelete: new Set(['never', '7-days', '30-days'])
 };
@@ -156,14 +136,11 @@ const bools = keys => Object.fromEntries(keys.map(key => [key, { type: 'boolean'
 const numbers = (entries) => Object.fromEntries(entries.map(([key, min, max]) => [key, { type: 'number', min, max }]));
 
 const RULES = {
-  connection: {
-    ...bools(['usePinToAddDevices', 'rotatePinAfterPairing', 'allowNewDevices', 'approveNewDevices', 'startWithComputer', 'keepRunningInTray', 'showConnectionNotifications']),
-    ...numbers([['pinValidityMinutes', 10, 1440]])
-  },
+  connection: {},
   security: {
     accessMode: { type: 'enum', values: ENUMS.accessMode },
-    ...bools(['requireEncryptedConnections', 'allowInternetConnections', 'allowLanConnections', 'allowUnencryptedLanFallback', 'requireNewDeviceApproval', 'requireAdministratorForSecurityChanges', 'visibleControlIndicator', 'lockOnControlEnd', 'disconnectIdleControlSessions', 'keepSessionHistory']),
-    ...numbers([['idleControlMinutes', 5, 1440], ['sessionHistoryDays', 7, 365]])
+    ...bools(['allowInternetConnections', 'allowLanConnections', 'lockOnControlEnd']),
+    ...numbers([['idleControlMinutes', 5, 1440]])
   },
   control: {
     ...bools(['allowKeyboardMouse', 'allowSystemShortcuts', 'allowClipboardText', 'allowRemoteRestart', 'reconnectAfterRemoteRestart', 'allowSwitchingMonitors', 'showConnectionToolbar', 'showRemoteCursor', 'openControlOnDoubleClick', 'startRemoteAudioWithControl', 'fitRemoteScreen', 'rememberLastMonitor', 'keepControlReadyBetweenPages'])
@@ -173,7 +150,7 @@ const RULES = {
     ...bools(['autoStart', 'connectedOnly', 'keepEmptySlots', 'showDeviceStatus', 'showPerformanceDetails', 'pauseHiddenTiles', 'reduceWhenHidden', 'autoAdjustTileQuality', 'rememberDevicePositions'])
   },
   filesAudio: {
-    ...bools(['allowFileTransfer', 'allowFolderSync', 'askBeforeReceivingFiles', 'openReceivedFolder', 'notifyTransferComplete', 'allowOverwrite', 'allowRemoteAudio', 'startAudioMuted', 'rememberVolume', 'automaticallyRecoverAudio', 'showAudioTroubleshooting', 'rollingBufferEnabled', 'includeRemoteCursor']),
+    ...bools(['allowFileTransfer', 'allowFolderSync', 'openReceivedFolder', 'notifyTransferComplete', 'allowRemoteAudio', 'startAudioMuted', 'rememberVolume', 'automaticallyRecoverAudio', 'showAudioTroubleshooting', 'rollingBufferEnabled', 'includeRemoteCursor']),
     recordingQuality: { type: 'enum', values: ENUMS.recordingQuality },
     captureAutoDelete: { type: 'enum', values: ENUMS.captureAutoDelete },
     timelapseIntervalSeconds: { type: 'number', min: 5, max: 60 },
@@ -190,7 +167,7 @@ const RULES = {
     wallFrameMode: { type: 'enum', values: ENUMS.wallFrameMode },
     controlFrameMode: { type: 'enum', values: ENUMS.controlFrameMode },
     transport: { type: 'enum', values: ENUMS.transport },
-    ...bools(['allowPlainLanFallback', 'verboseLogs', 'frameStatistics']),
+    ...bools(['verboseLogs', 'frameStatistics']),
     ...numbers([['wallFps', 1, 60], ['wallMaxWidth', 320, 3840], ['wallMaxHeight', 180, 2160], ['wallQuality', 20, 95], ['controlFps', 20, 60], ['controlMaxWidth', 640, 3840], ['controlMaxHeight', 360, 2160], ['controlQuality', 20, 95]])
   }
 };
@@ -207,11 +184,6 @@ export function normalizeLiveDeskSettings(value = {}) {
     agent: normalizeSection(source.agent, DEFAULT_LIVEDESK_SETTINGS.agent, RULES.agent),
     advanced: normalizeSection(source.advanced, DEFAULT_LIVEDESK_SETTINGS.advanced, RULES.advanced)
   };
-  // Security invariants are enforced at the authority boundary, not just in
-  // the browser. Internet access can never use an unencrypted transport.
-  if (settings.security.requireEncryptedConnections) {
-    settings.security.allowUnencryptedLanFallback = false;
-  }
   if (!settings.security.allowInternetConnections) {
     settings.advanced.transport = settings.advanced.transport === 'encrypted' ? 'encrypted' : 'auto';
   }
@@ -247,8 +219,16 @@ export function effectiveDevicePolicy(settings = DEFAULT_LIVEDESK_SETTINGS) {
     accessMode,
     allowInternetConnections: normalized.security.allowInternetConnections,
     allowLanConnections: normalized.security.allowLanConnections,
-    requireEncryptedConnections: normalized.security.requireEncryptedConnections,
-    allowUnencryptedLanFallback: normalized.security.allowUnencryptedLanFallback,
+    // Encryption and no-overwrite are structural invariants. They are not
+    // user preferences and cannot be disabled through a legacy settings file.
+    requireEncryptedConnections: true,
+    allowUnencryptedLanFallback: false,
+    visibleControlIndicator: true,
+    lockOnControlEnd: normalized.security.lockOnControlEnd,
+    disconnectIdleControlSessions: true,
+    idleControlMinutes: normalized.security.idleControlMinutes,
+    allowFileOverwrite: false,
+    maxFileSizeBytes: normalized.filesAudio.maxFileSizeBytes,
     allowControl: allowMutation && normalized.control.allowKeyboardMouse,
     allowClipboardText: allowMutation && normalized.control.allowClipboardText,
     allowPowerActions: allowMutation && normalized.control.allowRemoteRestart,

package/src/transport/relay-hub-control.js

@@ -1,6 +1,16 @@
 import crypto from 'node:crypto';
 import { EventEmitter } from 'node:events';
 import net from 'node:net';
+import {
+    SECURE_SESSION_MAX_CLOCK_SKEW_MS,
+    SECURE_SESSION_PROTOCOL,
+    deriveSecureSessionKey,
+    enrollmentProof,
+    fixedTimeBase64UrlEqual,
+    normalizeSecureChannel,
+    secureClientTranscript,
+    secureServerTranscript
+} from '@livedesk/runtime-core';
 
 export const RELAY_CONTROL_PROTOCOL = 'livedesk.relay.v1';
 export const RELAY_CONTROL_MAX_PLAINTEXT_BYTES = 512 * 1024;
@@ -161,6 +171,47 @@ export function deriveRelayRegistrationToken(pairToken, roomId = deriveRelayRoom
         .digest('base64url');
 }
 
+export function deriveCredentialRelayRoomId(hubId, hubPublicKey) {
+    const id = safeText(hubId, 128);
+    const key = decodeCanonicalBase64Url(hubPublicKey, 0, 160).toString('base64url');
+    if (!id) throw relayError('relay-hub-id-required');
+    return crypto.createHash('sha256')
+        .update(Buffer.from(`livedesk-relay-credential-room-v1\0${id}\0${key}`, 'utf8'))
+        .digest('base64url');
+}
+
+export function deriveCredentialRelayRegistrationToken(hubId, hubPublicKey) {
+    const roomId = deriveCredentialRelayRoomId(hubId, hubPublicKey);
+    return crypto.createHash('sha256')
+        .update(Buffer.from(`livedesk-relay-credential-register-v1\0${roomId}\0${hubPublicKey}`, 'utf8'))
+        .digest('base64url');
+}
+
+function requireP256SpkiPublicKey(value) {
+    const der = decodeCanonicalBase64Url(value, 0, 160);
+    if (der.length < 80) throw relayError('relay-public-key-invalid');
+    let key;
+    try {
+        key = crypto.createPublicKey({ key: der, format: 'der', type: 'spki' });
+    } catch {
+        throw relayError('relay-public-key-invalid');
+    }
+    if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
+        throw relayError('relay-public-key-invalid');
+    }
+    return { key, text: der.toString('base64url') };
+}
+
+function verifyP256Signature(publicKey, message, signature) {
+    const bytes = decodeCanonicalBase64Url(signature, 64, 64);
+    if (!crypto.verify('sha256', Buffer.from(String(message || ''), 'utf8'), {
+        key: publicKey,
+        dsaEncoding: 'ieee-p1363'
+    }, bytes)) {
+        throw relayError('device-signature-invalid');
+    }
+}
+
 export function deriveRelayClientProof(pairToken, {
     roomId = deriveRelayRoomId(pairToken),
     peerId,
@@ -403,15 +454,31 @@ export class HubRelayVirtualSocket extends EventEmitter {
 export function createHubRelayControl({
     env = process.env,
     pairToken,
+    secureSession = null,
     onPeerSocket = () => {},
     logEvent = () => {},
     logWarn = () => {},
     connect = options => net.createConnection(options),
     randomBytes = size => crypto.randomBytes(size)
 } = {}) {
-    const token = requirePairToken(pairToken);
-    const roomId = deriveRelayRoomId(token);
-    const registrationToken = deriveRelayRegistrationToken(token, roomId);
+    const secureMode = secureSession?.mode === 'credential'
+        ? 'credential'
+        : secureSession?.mode === 'enroll'
+            ? 'enroll'
+            : '';
+    const authority = secureMode ? secureSession?.authority : null;
+    if (secureMode && (!authority?.verifyCredential || !authority?.issueCredential || !authority?.signHubMessage)) {
+        throw relayError('relay-device-authority-required');
+    }
+    const token = secureMode === 'credential'
+        ? authority.hubPublicKey
+        : requirePairToken(pairToken);
+    const roomId = secureMode === 'credential'
+        ? deriveCredentialRelayRoomId(authority.hubId, authority.hubPublicKey)
+        : deriveRelayRoomId(token);
+    const registrationToken = secureMode === 'credential'
+        ? deriveCredentialRelayRegistrationToken(authority.hubId, authority.hubPublicKey)
+        : deriveRelayRegistrationToken(token, roomId);
     const enabled = isEnabled(
         env.LIVEDESK_RELAY_ENABLED,
         isEnabled(env.LIVEDESK_UDP_ENABLED, true));
@@ -817,6 +884,10 @@ export function createHubRelayControl({
     }
 
     function handleClientHandshake(message) {
+        if (secureMode) {
+            handleSecureClientHandshake(message);
+            return;
+        }
         let peerId = '';
         try {
             peerId = requirePeerId(message.peerId);
@@ -917,6 +988,142 @@ export function createHubRelayControl({
         }
     }
 
+    function handleSecureClientHandshake(message) {
+        let peerId = '';
+        try {
+            peerId = requirePeerId(message.peerId);
+            if (message.direction && requireDirection(message.direction) !== RELAY_CONTROL_DIRECTIONS.clientToHub) {
+                throw relayError('relay-direction-invalid');
+            }
+            if (safeText(message.stage, 40).toLowerCase() !== 'client-hello') throw relayError('relay-secure-stage-invalid');
+            if (message.securityProtocol !== SECURE_SESSION_PROTOCOL) {
+                lastError = `relay-secure-protocol:${safeText(message.securityProtocol, 80) || 'missing'}`;
+                throw relayError(message.securityProtocol === undefined
+                    ? 'relay-secure-protocol-missing'
+                    : 'relay-secure-protocol-invalid');
+            }
+            if (peers.has(peerId) || retiredPeerIds.has(peerId)) throw relayError('relay-handshake-replay');
+            if (peers.size >= maxPeers) throw relayError('relay-peer-capacity');
+            const expectedMode = secureMode === 'credential' ? 'resume' : 'enroll';
+            if (message.mode !== expectedMode) throw relayError('relay-secure-mode-invalid');
+            const current = Date.now();
+            const timestamp = Number(message.timestamp);
+            if (!Number.isSafeInteger(timestamp) || Math.abs(current - timestamp) > SECURE_SESSION_MAX_CLOCK_SKEW_MS) {
+                throw relayError('secure-handshake-timestamp-invalid');
+            }
+            const channel = normalizeSecureChannel(message.channel);
+            const deviceId = safeText(message.deviceId, 128);
+            if (!deviceId) throw relayError('device-id-required');
+            const devicePublic = requireP256SpkiPublicKey(message.devicePublicKey);
+            const clientEphemeral = requireP256SpkiPublicKey(message.clientEphemeralPublicKey);
+            const clientTranscript = secureClientTranscript(message);
+            const identity = secureSession.getIdentity?.() || {};
+            const accountId = safeText(identity.accountId, 128);
+            if (!accountId) throw relayError('secure-account-session-required');
+
+            let issued;
+            let enrollmentSecret = '';
+            if (expectedMode === 'enroll') {
+                enrollmentSecret = String(secureSession.getEnrollmentToken?.() || token);
+                if (!fixedTimeBase64UrlEqual(message.enrollmentProof, enrollmentProof(enrollmentSecret, clientTranscript), 32)) {
+                    throw relayError('secure-enrollment-proof-invalid');
+                }
+                verifyP256Signature(devicePublic.key, clientTranscript, message.deviceSignature);
+                if (!secureSession.consumeEnrollmentToken?.(enrollmentSecret)) throw relayError('secure-enrollment-token-used');
+                issued = authority.issueCredential({ accountId, deviceId, devicePublicKey: devicePublic.text, replace: true });
+            } else {
+                const verified = authority.verifyCredential(message.credential, { accountId, deviceId });
+                if (verified.payload.devicePublicKey !== devicePublic.text) throw relayError('device-credential-binding-invalid');
+                authority.verifyDeviceSignature(verified, clientTranscript, message.deviceSignature);
+                issued = { credential: verified.text, payload: verified.payload };
+            }
+
+            const { privateKey: serverPrivate, publicKey: serverPublic } = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+            const response = {
+                type: 'relay.handshake',
+                protocol: RELAY_CONTROL_PROTOCOL,
+                roomId,
+                peerId,
+                direction: RELAY_CONTROL_DIRECTIONS.hubToClient,
+                stage: 'hub-hello',
+                securityProtocol: SECURE_SESSION_PROTOCOL,
+                sessionId: crypto.randomBytes(16).toString('base64url'),
+                channel,
+                timestamp: current,
+                serverNonce: crypto.randomBytes(16).toString('base64url'),
+                serverEphemeralPublicKey: serverPublic.export({ format: 'der', type: 'spki' }).toString('base64url'),
+                credential: issued.credential,
+                hubId: authority.hubId,
+                accountId,
+                deviceId
+            };
+            const serverTranscript = secureServerTranscript(response, clientTranscript);
+            response.hubSignature = authority.signHubMessage(serverTranscript);
+            if (expectedMode === 'enroll') response.enrollmentServerProof = enrollmentProof(enrollmentSecret, serverTranscript);
+            const sharedSecret = crypto.diffieHellman({ privateKey: serverPrivate, publicKey: clientEphemeral.key });
+            let sessionKey;
+            try {
+                sessionKey = deriveSecureSessionKey({
+                    sharedSecret,
+                    clientTranscript,
+                    serverTranscript,
+                    sessionId: response.sessionId,
+                    channel
+                });
+            } finally {
+                sharedSecret.fill(0);
+            }
+            const remoteAddress = `relay://${host}:${port}/${peerId}`;
+            const peer = {
+                peerId,
+                sessionKey,
+                receiveSequence: 0,
+                sendSequence: 0,
+                handshakeState: 'established',
+                createdAt: current,
+                lastActivityAt: current,
+                socket: null
+            };
+            peer.socket = new HubRelayVirtualSocket(api, peerId, remoteAddress, port);
+            peer.socket.__liveDeskSecurityContext = Object.freeze({
+                protocol: SECURE_SESSION_PROTOCOL,
+                accountId,
+                hubId: authority.hubId,
+                deviceId,
+                channel,
+                credentialSerial: issued.payload.serial,
+                authenticated: true,
+                encrypted: true,
+                transport: 'relay'
+            });
+            peers.set(peerId, peer);
+            counters.peerOwnersCreated += 1;
+            peerOwnerHighWater = Math.max(peerOwnerHighWater, peers.size);
+            if (!enqueueEnvelope(response, peerId)) {
+                closePeer(peerId, 'relay-handshake-backpressure', { notify: false });
+                return;
+            }
+            onPeerSocket(peer.socket, {
+                protocol: RELAY_CONTROL_PROTOCOL,
+                securityProtocol: SECURE_SESSION_PROTOCOL,
+                peerId,
+                endpoint: `${host}:${port}`,
+                accountId,
+                hubId: authority.hubId,
+                deviceId,
+                channel
+            });
+            authority.markConnected(deviceId);
+            counters.handshakes += 1;
+        } catch (error) {
+            counters.rejectedPeers += 1;
+            if (peerId) {
+                rememberRetiredPeer(peerId);
+                sendRelayClose(peerId, safeText(error?.code || error?.message, 80) || 'relay-handshake-rejected');
+            }
+        }
+    }
+
     function handleClientData(message) {
         let peerId = '';
         try {
@@ -1374,3 +1581,122 @@ export function createHubRelayControl({
     };
     return api;
 }
+
+export function createSecureHubRelayControl({
+    env = process.env,
+    authority,
+    getIdentity = () => ({}),
+    getEnrollmentToken = () => '',
+    consumeEnrollmentToken = () => false,
+    onPeerSocket = () => {},
+    logEvent = () => {},
+    logWarn = () => {}
+} = {}) {
+    if (!authority?.hubId || !authority?.hubPublicKey) throw relayError('relay-device-authority-required');
+    let started = false;
+    let closed = false;
+    let enrollment = null;
+    const retired = new Set();
+    const retirementTimers = new Set();
+    const stable = createHubRelayControl({
+        env,
+        pairToken: authority.hubPublicKey,
+        secureSession: { mode: 'credential', authority, getIdentity },
+        onPeerSocket,
+        logEvent,
+        logWarn
+    });
+
+    function makeEnrollmentControl(token) {
+        return createHubRelayControl({
+            env,
+            pairToken: token,
+            secureSession: {
+                mode: 'enroll',
+                authority,
+                getIdentity,
+                getEnrollmentToken: () => token,
+                consumeEnrollmentToken: expected => {
+                    if (expected !== token || !consumeEnrollmentToken(expected)) return false;
+                    queueMicrotask(() => { void rotateEnrollment(); });
+                    return true;
+                }
+            },
+            onPeerSocket,
+            logEvent,
+            logWarn
+        });
+    }
+
+    function retireControl(control) {
+        if (!control) return;
+        retired.add(control);
+        const deadline = Date.now() + 10_000;
+        const poll = () => {
+            if (closed || control.getStatus().peerCount === 0 || Date.now() >= deadline) {
+                retired.delete(control);
+                void control.close().catch(error => logWarn('relay', `Secure enrollment relay retirement failed code=${safeText(error?.code, 80) || 'unknown'}`));
+                return;
+            }
+            const timer = setTimeout(() => {
+                retirementTimers.delete(timer);
+                poll();
+            }, 100);
+            timer.unref?.();
+            retirementTimers.add(timer);
+        };
+        poll();
+    }
+
+    async function rotateEnrollment() {
+        if (closed) return;
+        const previous = enrollment;
+        enrollment = makeEnrollmentControl(getEnrollmentToken());
+        if (started) await enrollment.start();
+        retireControl(previous);
+    }
+
+    async function start() {
+        if (started || closed) return getStatus();
+        started = true;
+        enrollment = makeEnrollmentControl(getEnrollmentToken());
+        await Promise.all([stable.start(), enrollment.start()]);
+        return getStatus();
+    }
+
+    async function close() {
+        if (closed) return;
+        closed = true;
+        started = false;
+        for (const timer of retirementTimers) clearTimeout(timer);
+        retirementTimers.clear();
+        const controls = [stable, enrollment, ...retired].filter(Boolean);
+        retired.clear();
+        enrollment = null;
+        const results = await Promise.allSettled(controls.map(control => control.close()));
+        const failure = results.find(result => result.status === 'rejected');
+        if (failure) throw failure.reason;
+    }
+
+    function getStatus() {
+        const stableStatus = stable.getStatus();
+        const enrollmentStatus = enrollment?.getStatus() || null;
+        const retiredStatuses = [...retired].map(control => control.getStatus());
+        const statuses = [stableStatus, enrollmentStatus, ...retiredStatuses].filter(Boolean);
+        return {
+            ...stableStatus,
+            started,
+            connected: statuses.some(status => status.connected),
+            state: stableStatus.connected ? 'registered' : enrollmentStatus?.state || stableStatus.state,
+            peerCount: statuses.reduce((sum, status) => sum + Number(status.peerCount || 0), 0),
+            activeSocketCount: statuses.reduce((sum, status) => sum + Number(status.activeSocketCount || 0), 0),
+            secureCredentialRelay: true,
+            credentialRoomId: deriveCredentialRelayRoomId(authority.hubId, authority.hubPublicKey),
+            enrollmentGenerationCount: 1 + retiredStatuses.length,
+            enrollment: enrollmentStatus,
+            retiredEnrollmentCount: retiredStatuses.length
+        };
+    }
+
+    return Object.freeze({ start, close, getStatus });
+}