@lornatang/dsh-frontgate 0.0.0-stage → 0.1.2

package/CHANGELOG.md

@@ -0,0 +1,72 @@
+# Changelog
+
+## 0.1.2 - 2026-11-12
+
+- Persist session revocations on sign-out, reject alternate token encodings,
+  and close WebSockets on sign-out, expiry, or shutdown.
+- Bound per-peer connections and incomplete logins; cancel disconnected clients
+  and time out stalled upstream HTTP responses without cutting off active streams.
+- Verify HTTPS harness certificates, refresh stale harness cookies after a 401,
+  and return an HTTP error for oversized chunked login forms.
+- Document Docker port mapping and add security, browser and proxy regression tests.
+
+## 0.1.1 - 2026-11-12
+
+- Publish as `@lornatang/dsh-frontgate`; install with `dsh plugin` using the
+  npm package name. Document migration from the previous unscoped package.
+- Compare the full browser-facing origin, including scheme and port, for login,
+  authenticated requests and WebSockets. Configure `publicOrigin` when HTTPS
+  is terminated by a reverse proxy; it also enables Secure session cookies.
+- Enforce per-client login lockouts before password verification, and limit
+  concurrent password checks from one client.
+- Refuse malformed, exposed or incorrectly owned state files instead of
+  silently replacing credentials; persist state through an atomic replacement.
+- Bound the harness launch-token exchange and retry on later requests after a
+  timeout.
+- Add browser and security regression tests to CI. Document the requirement
+  for a dedicated hostname or IP because browser cookies are shared by ports.
+
+## 0.1.0 - 2026-11-10
+
+First release.
+
+- Fix browser login failing with `Origin check failed` when the login page's
+  referrer policy caused browsers to send `Origin: null` on form submissions.
+- Print a reminder to save the generated password after its hash is stored.
+- Resolve the release tag to its commit when installing, so replacing a tag
+  does not leave an existing installation on a cached archive.
+- Create the default web profile correctly on first install.
+- Password gate for the DeepSeek Harness Web UI with a signed, stateless
+  session cookie (HMAC-SHA256, per-session nonce, absolute TTL).
+- Session tokens embed a tag of the current password hash, so changing the
+  password revokes every issued session without a session table.
+- Login uses async scrypt (N=32768, r=8, p=1, 32-byte key); no synchronous
+  hashing on the request path.
+- Failed logins are counted per client: once the limit is reached, failures
+  answer 429 with Retry-After, while a correct password is always verified and
+  accepted, so a shared address cannot be locked out by one client.
+- Proxied requests and WebSocket upgrades are checked against their Origin; a
+  cross-site request that carries a session cookie is refused with 403.
+- Host and Origin are rewritten to the harness origin; hop-by-hop headers
+  dropped; upstream Set-Cookie never reaches the browser.
+- The harness launch token is exchanged server-side and its cookie is injected
+  per request; the browser only ever holds the gate cookie.
+- WebSocket upgrades are authenticated, then spliced as raw TCP.
+- Adds a crypto.randomUUID polyfill to the harness HTML (plain HTTP on a LAN IP
+  is not a secure context).
+- Loopback-only by default, optional native TLS with HSTS; no admin page, no
+  i18n, no mutable settings file.
+- A configured password (option or `DSH_FRONTGATE_PASSWORD`) must be at least
+  12 characters; shorter values stop startup with an explicit error.
+- Upstream redirects that would leave the origin (protocol-relative or
+  backslash forms) are rewritten to `/`.
+- The listener sets header and request deadlines, checks connection deadlines
+  every 5 seconds, and caps concurrent connections at 1024.
+- The state file (password hash and signing secret) is chmod 0600 on startup,
+  including when it already existed with looser permissions.
+- Options are declared as a schemastery schema; sources are TypeScript modules
+  under `src/`, bundled into `lib/index.js` with generated type declarations.
+- `install.sh` installs the plugin into a profile and creates the profile from
+  the web template when it does not exist yet.
+- `DSH_FRONTGATE_PASSWORD` and `DSH_FRONTGATE_PASSWORD_HASH` environment
+  overrides keep the password out of configuration files.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,150 @@
-# Temporary Holding Version
+# dsh-frontgate
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Password protection for the DeepSeek Harness Web UI. The gate listens on its
+own port and forwards authenticated traffic to the local harness.
+
+**Requires:** Node.js 22.19+, DSH 0.2.2-rc.1+, and a Web profile.
+
+## Install
+
+```bash
+dsh plugin --profile web add @lornatang/dsh-frontgate
+```
+
+Restart DSH, or start it with `dsh web --no-open`. If no password is configured
+or saved, the first start prints a password to stderr or the service log:
+
+```text
+[dsh-frontgate] PASSWORD: xxxx-xxxx-xxxx-xxxx
+```
+
+Save it: only its hash is stored and the password is shown once. Open
+<http://127.0.0.1:3090> to sign in. For an existing Web profile with another
+name, replace `web` in the install and start commands.
+
+To update, run the same install command and restart DSH. The existing
+configuration and password are preserved.
+
+If you installed an older unscoped `dsh-frontgate` package, stop DSH first,
+install the scoped package, then remove the old package before restarting:
+
+```bash
+dsh plugin --profile web add @lornatang/dsh-frontgate
+dsh plugin --profile web remove dsh-frontgate
+```
+
+This keeps the profile configuration and saved password. Stopping DSH during
+the switch avoids loading both packages at once.
+
+## Configuration
+
+Edit `~/.dsh/profiles/web/cordis.patch.yml` (or use `$DSH_HOME` in place of
+`~/.dsh`) and add or edit the `frontgate` entry:
+
+```yaml
+- id: frontgate
+  config:
+    listenHost: '0.0.0.0' # only when remote access is needed
+    listenPort: 3090
+    # password: 'a-password-of-at-least-12-characters'
+```
+
+Restart DSH after changes. The gate listens on `127.0.0.1:3090` by default;
+its port must differ from the harness port.
+
+| Option | Default | Purpose |
+| --- | --- | --- |
+| `password` / `passwordHash` | empty | Fixed password (12+ characters) or scrypt hash; the hash takes precedence. |
+| `sessionDays` | `7` | Session lifetime, 1–365 days. |
+| `maxAttempts` / `lockMinutes` | `5` / `5` | Failed attempts and lockout duration per client IP. |
+| `tlsCertFile` / `tlsKeyFile` | empty | Set both for direct HTTPS. |
+| `publicOrigin` | empty | External origin when a reverse proxy terminates HTTPS. |
+| `trustProxy` | `false` | Use client IPs supplied by a trusted proxy. |
+| `exchangeTimeoutMs` | `5000` | Harness token exchange timeout in milliseconds. |
+| `maxConnectionsPerPeer` | `64` | Simultaneous TCP connections per peer; `0` disables this limit. |
+| `maxPendingLoginsPerIp` | `4` | Incomplete login forms allowed per client IP. |
+| `upstreamHeaderTimeoutMs` | `60000` | Upstream response-header deadline, including queue time; `0` disables. |
+| `upstreamIdleTimeoutMs` | `300000` | Upstream response idle deadline; `0` disables. |
+| `upstreamCaFile` / `upstreamServerName` | empty | CA file and optional TLS hostname for a private HTTPS harness. |
+| `title` | `DeepSeek Harness` | Login page title. |
+
+Password precedence is configured hash, configured password,
+`DSH_FRONTGATE_PASSWORD_HASH`, `DSH_FRONTGATE_PASSWORD`, saved hash, then a
+newly generated password. Lockout blocks all attempts from the IP, including
+correct passwords, until it expires; clients behind the same NAT may share it.
+
+## Remote access
+
+For Docker, set `listenHost: '0.0.0.0'` and publish the gate port, for example:
+
+```yaml
+# ~/.dsh/profiles/web/cordis.patch.yml
+- id: frontgate
+  config:
+    listenHost: '0.0.0.0'
+    listenPort: 30010
+```
+
+```yaml
+# Docker Compose
+ports:
+  - '30190:30010'
+```
+
+Restart DSH after editing its profile, then open `http://<host-ip>:30190`. The
+container port in the mapping must equal `listenPort`; the external port can
+be different. Leave `publicOrigin` empty and `trustProxy` disabled for direct
+HTTP access. Keep the harness itself on loopback so it cannot bypass the gate.
+HTTP exposes passwords and cookies; use a trusted LAN, VPN, or HTTPS.
+
+Use a dedicated hostname or IP for the gate. Browser cookies are shared by
+all ports on the same hostname or IP, so an untrusted service on another port
+could receive the session cookie, even when both services use HTTPS.
+
+For an HTTPS reverse proxy, set `publicOrigin`, for example
+`https://gate.example.com`, and preserve the original `Host` header including
+any non-default port (Nginx: `proxy_set_header Host $http_host;`). Restrict
+direct access to the gate listener to the proxy. If `trustProxy` is enabled,
+the proxy must replace client-supplied `X-Forwarded-For` with the real client
+IP (Nginx: `proxy_set_header X-Forwarded-For $remote_addr;`).
+`maxConnectionsPerPeer` counts the TCP peer, so proxied connections share the
+proxy's limit. Adjust the limit for expected traffic and apply per-client limits
+at the proxy when appropriate.
+
+HTTPS harness certificates and hostnames are verified. For a private CA, set
+`upstreamCaFile` to its PEM file; if the harness origin is an IP but its
+certificate names a DNS host, also set `upstreamServerName` to that host.
+For a stream that may be silent for more than five minutes, raise or disable
+`upstreamIdleTimeoutMs`.
+
+## Troubleshooting
+
+- **No password in the log:** An existing hash or configured password is being
+  reused. Set `password` and remove `passwordHash` to change it; this signs out
+  existing sessions.
+- **Cannot connect:** Check `listenHost`, the gate's startup log and the Docker
+  port mapping. The gate port must match the container side of the mapping.
+  To sign out, visit `/__gate/logout`.
+- **Origin or host check fails:** Verify `publicOrigin` and the proxy's `Host`.
+- **State file error:** Restore a trusted backup and ensure the file is owned
+  by the DSH user with mode `0600`. If no backup exists, stop DSH and move the
+  broken file aside; restart to create a new secret and invalidate sessions.
+
+The state file is `~/.dsh/profiles/<name>/data/dsh-frontgate.json`. Keep it and
+its parent directories accessible only to trusted users. On Windows, use ACLs
+to restrict access. Sign-out revocations persist across restarts; each profile
+must have only one running gate instance. Expired revocations are removed on
+sign-out, and a full or unwritable revocation store makes sign-out fail safely.
+
+## Development
+
+```bash
+npm ci
+npm run typecheck
+npm test
+```
+
+Browser tests require Chrome and OpenSSL; set `CHROME_PATH` if needed. They are
+required in CI and skipped locally when Chrome is unavailable.
+
+[Apache-2.0](LICENSE)

package/cordis.patch.yml

@@ -0,0 +1,16 @@
+# dsh-frontgate bundle patch.
+#
+# Safe defaults: listen on loopback only. A remote deployment overrides this in
+# the profile's own cordis.patch.yml (the profile entry wins):
+#
+#   - id: frontgate
+#     config:
+#       listenHost: '0.0.0.0'
+#       listenPort: 30010
+#
+- insert:
+    - id: frontgate
+      name: '@lornatang/dsh-frontgate'
+      config:
+        listenHost: '127.0.0.1'
+        listenPort: 3090