@lvce-editor/server 0.102.3 → 0.103.0

package/ThirdPartyNotices.txt

@@ -2,7 +2,7 @@ This project incorporates components from the projects listed below, that may ha
 differing from this project:
 
 
-1) License Notice for static/6580ba2/icons (from https://github.com/microsoft/vscode-codicons)
+1) License Notice for static/8afc276/icons (from https://github.com/microsoft/vscode-codicons)
 ---------------------------------------
 
 Attribution 4.0 International
@@ -402,7 +402,7 @@ public licenses.
 Creative Commons may be contacted at creativecommons.org.
 
 
-2) License Notice for static/6580ba2/fonts/FiraCode-VariableFont.ttf (from https://github.com/tonsky/FiraCode)
+2) License Notice for static/8afc276/fonts/FiraCode-VariableFont.ttf (from https://github.com/tonsky/FiraCode)
 ---------------------------------------
 
 Copyright (c) 2014, The Fira Code Project Authors (https://github.com/tonsky/FiraCode)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/server",
-  "version": "0.102.3",
+  "version": "0.103.0",
   "description": "Run LVCE Editor as a server.",
   "main": "index.js",
   "bin": "bin/server.js",
@@ -20,7 +20,7 @@
     "node": ">=24"
   },
   "dependencies": {
-    "@lvce-editor/shared-process": "0.102.3",
-    "@lvce-editor/static-server": "0.102.3"
+    "@lvce-editor/shared-process": "0.103.0",
+    "@lvce-editor/static-server": "0.103.0"
   }
 }

package/src/remoteSshOptions.js

@@ -0,0 +1,62 @@
+const defaultIdleTimeout = 3 * 60 * 60 * 1000
+
+const getArgument = (argv, name) => {
+  const prefix = `${name}=`
+  const argument = argv.find((value) => value.startsWith(prefix))
+  return argument ? argument.slice(prefix.length) : undefined
+}
+
+const parseInteger = (value, fallback, name) => {
+  if (value === undefined) {
+    return fallback
+  }
+  const parsed = Number.parseInt(value, 10)
+  if (!Number.isSafeInteger(parsed)) {
+    throw new TypeError(`${name} must be an integer`)
+  }
+  return parsed
+}
+
+export const getRemoteSshOptions = (argv, env = process.env) => {
+  const enabled = argv.includes('--as-remote-ssh-server')
+  if (!enabled) {
+    return {
+      enabled: false,
+      host: env.HOST || 'localhost',
+      idleTimeout: defaultIdleTimeout,
+      port: parseInteger(env.PORT, 3000, 'PORT'),
+      token: '',
+    }
+  }
+  const token = getArgument(argv, '--connection-token') || env.LVCE_REMOTE_SSH_CONNECTION_TOKEN || ''
+  if (!token) {
+    throw new TypeError('Remote SSH server requires --connection-token')
+  }
+  const port = parseInteger(getArgument(argv, '--port') || env.PORT, 0, '--port')
+  if (port < 0 || port > 65_535) {
+    throw new RangeError('--port must be between 0 and 65535')
+  }
+  const idleTimeout = parseInteger(getArgument(argv, '--idle-timeout') || env.LVCE_REMOTE_SSH_IDLE_TIMEOUT, defaultIdleTimeout, '--idle-timeout')
+  if (idleTimeout < 0) {
+    throw new RangeError('--idle-timeout must not be negative')
+  }
+  return {
+    enabled: true,
+    host: '127.0.0.1',
+    idleTimeout,
+    port,
+    token,
+  }
+}
+
+export const isAuthenticatedRemoteRequest = (request, options) => {
+  if (!options.enabled) {
+    return false
+  }
+  try {
+    const url = new URL(request.url || '/', 'http://127.0.0.1')
+    return url.searchParams.get('token') === options.token
+  } catch {
+    return false
+  }
+}

package/src/server.js

@@ -5,14 +5,13 @@ import { createServer } from 'node:http'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { Worker } from 'node:worker_threads'
+import { getRemoteSshOptions, isAuthenticatedRemoteRequest } from './remoteSshOptions.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const ROOT = resolve(__dirname, '../')
 
 const { argv, env } = process
 
-const PORT = env.PORT ? parseInt(env.PORT) : 3000
-
 let argv2 = argv[2]
 
 // TODO pass argv to shared process instead of using environment variables / global variables
@@ -30,6 +29,30 @@ if (!argv2) {
 }
 
 const isPublic = argv.includes('--public')
+const remoteSshOptions = getRemoteSshOptions(argvSliced, env)
+const PORT = remoteSshOptions.port
+let remoteClientCount = 0
+let remoteIdleTimer
+
+const scheduleRemoteIdleShutdown = () => {
+  if (!remoteSshOptions.enabled || remoteClientCount !== 0) {
+    return
+  }
+  clearTimeout(remoteIdleTimer)
+  remoteIdleTimer = setTimeout(() => {
+    server.close(() => process.exit(0))
+  }, remoteSshOptions.idleTimeout)
+  remoteIdleTimer.unref()
+}
+
+const trackRemoteClient = (socket) => {
+  clearTimeout(remoteIdleTimer)
+  remoteClientCount++
+  socket.once('close', () => {
+    remoteClientCount--
+    scheduleRemoteIdleShutdown()
+  })
+}
 
 /**
  * @enum {string}
@@ -49,7 +72,7 @@ const isStatic = (url) => {
   if (url === '/index.html' || url.startsWith('/index.html?')) {
     return true
   }
-  if (url.startsWith('/6580ba2')) {
+  if (url.startsWith('/8afc276')) {
     return true
   }
   if (url.startsWith('/favicon.ico')) {
@@ -65,6 +88,11 @@ const isStatic = (url) => {
 }
 
 const handleRequest = (req, res) => {
+  if (remoteSshOptions.enabled) {
+    res.statusCode = 404
+    res.end()
+    return
+  }
   if (isStatic(req.url)) {
     return handleResponseViaStaticServer(req, res, 'StaticServer.getResponse')
   }
@@ -220,6 +248,7 @@ const getHandleMessage = (request) => {
     httpVersionMajor: request.httpVersionMajor,
     httpVersionMinor: request.httpVersionMinor,
     query: request.query,
+    remoteAuthorityAuthenticated: remoteSshOptions.enabled,
   }
 }
 
@@ -334,6 +363,13 @@ const handleResponseViaStaticServer = async (request, res, method, ...params) =>
  * @param {import('net').Socket} socket
  */
 const handleUpgrade = (request, socket) => {
+  if (remoteSshOptions.enabled && !isAuthenticatedRemoteRequest(request, remoteSshOptions)) {
+    socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n')
+    return
+  }
+  if (remoteSshOptions.enabled) {
+    trackRemoteClient(socket)
+  }
   sendHandleSharedProcess(request, socket, 'HandleWebSocket.handleWebSocket')
 }
 
@@ -346,11 +382,16 @@ const handleServerError = (error) => {
   }
 }
 
+const server = createServer(handleRequest)
+
 const handleAppReady = () => {
+  scheduleRemoteIdleShutdown()
   if (process.send) {
     process.send('ready')
   } else {
-    console.info(`[server] listening on http://localhost:${PORT}`)
+    const address = server.address()
+    const port = typeof address === 'object' && address ? address.port : PORT
+    console.info(`[server] listening on http://${remoteSshOptions.host}:${port}`)
   }
 }
 
@@ -362,11 +403,10 @@ const handleUncaughtExceptionMonitor = (error, origin) => {
 const main = () => {
   process.on('message', handleMessageFromParent)
   process.on('uncaughtExceptionMonitor', handleUncaughtExceptionMonitor)
-  const server = createServer(handleRequest)
   server.on('listening', handleAppReady)
   server.on('upgrade', handleUpgrade)
   server.on('error', handleServerError)
-  const host = isPublic ? undefined : 'localhost'
+  const host = remoteSshOptions.enabled ? remoteSshOptions.host : isPublic ? undefined : remoteSshOptions.host
   server.listen(PORT, host)
 }
 

package/test/remoteSshOptions.test.js

@@ -0,0 +1,34 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { getRemoteSshOptions, isAuthenticatedRemoteRequest } from '../src/remoteSshOptions.js'
+
+test('uses the regular server defaults without the remote flag', () => {
+  assert.deepEqual(getRemoteSshOptions([], {}), {
+    enabled: false,
+    host: 'localhost',
+    idleTimeout: 10_800_000,
+    port: 3000,
+    token: '',
+  })
+})
+
+test('parses private remote SSH server options', () => {
+  assert.deepEqual(getRemoteSshOptions(['--as-remote-ssh-server', '--port=45123', '--connection-token=secret', '--idle-timeout=25'], {}), {
+    enabled: true,
+    host: '127.0.0.1',
+    idleTimeout: 25,
+    port: 45123,
+    token: 'secret',
+  })
+})
+
+test('requires an authentication token in remote mode', () => {
+  assert.throws(() => getRemoteSshOptions(['--as-remote-ssh-server'], {}), /requires --connection-token/)
+})
+
+test('accepts only the configured query token', () => {
+  const options = getRemoteSshOptions(['--as-remote-ssh-server', '--connection-token=secret'], {})
+  assert.equal(isAuthenticatedRemoteRequest({ url: '/websocket/terminal-process?token=secret' }, options), true)
+  assert.equal(isAuthenticatedRemoteRequest({ url: '/websocket/terminal-process?token=wrong' }, options), false)
+  assert.equal(isAuthenticatedRemoteRequest({ url: '/websocket/terminal-process' }, options), false)
+})

package/test/remoteSshServer.integration.test.js

@@ -0,0 +1,132 @@
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+
+const serverPath = path.join(import.meta.dirname, '..', 'src', 'server.js')
+
+const waitForListeningPort = (child) => {
+  return new Promise((resolve, reject) => {
+    let output = ''
+    const timeout = setTimeout(() => reject(new Error(`Timed out waiting for remote server\n${output}`)), 30_000)
+    const onData = (chunk) => {
+      output += chunk.toString('utf8')
+      const match = output.match(/listening on http:\/\/127\.0\.0\.1:(\d+)/)
+      if (match) {
+        clearTimeout(timeout)
+        child.stdout.off('data', onData)
+        resolve(Number.parseInt(match[1], 10))
+      }
+    }
+    child.stdout.on('data', onData)
+    child.stderr.on('data', (chunk) => {
+      output += chunk.toString('utf8')
+    })
+    child.once('error', reject)
+    child.once('exit', (code) => reject(new Error(`Remote server exited with code ${code}\n${output}`)))
+  })
+}
+
+const waitForOpen = (webSocket) => {
+  return new Promise((resolve, reject) => {
+    webSocket.onopen = resolve
+    webSocket.onerror = () => reject(new Error('WebSocket failed before opening'))
+  })
+}
+
+const waitForClose = (webSocket) => {
+  return new Promise((resolve) => {
+    webSocket.onclose = resolve
+    webSocket.onerror = () => {}
+  })
+}
+
+const createRpc = (webSocket) => {
+  let nextId = 1
+  const callbacks = new Map()
+  webSocket.onmessage = (event) => {
+    const response = JSON.parse(event.data)
+    const callback = callbacks.get(response.id)
+    if (callback) {
+      callbacks.delete(response.id)
+      callback(response)
+    }
+  }
+  return (method, ...params) => {
+    const id = nextId++
+    const promise = new Promise((resolve) => callbacks.set(id, resolve))
+    webSocket.send(JSON.stringify({ id, jsonrpc: '2.0', method, params }))
+    return promise.then((response) => {
+      if (response.error) {
+        const error = new Error(response.error.message)
+        error.code = response.error.data?.code
+        throw error
+      }
+      return response.result
+    })
+  }
+}
+
+const stopProcessGroup = (child) => {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return
+  }
+  try {
+    process.kill(process.platform === 'win32' ? child.pid : -child.pid, 'SIGTERM')
+  } catch {
+    child.kill('SIGTERM')
+  }
+}
+
+test('remote mode authenticates and exposes existing workspace processes', { skip: typeof WebSocket === 'undefined' }, async (context) => {
+  const directory = await mkdtemp(path.join(tmpdir(), 'lvce-remote-backend-'))
+  const token = 'integration-secret'
+  const child = spawn(process.execPath, [serverPath, '--as-remote-ssh-server', '--port=0', `--connection-token=${token}`, '--idle-timeout=30000'], {
+    detached: true,
+    env: process.env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  context.after(async () => {
+    stopProcessGroup(child)
+    await rm(directory, { force: true, recursive: true })
+  })
+  const port = await waitForListeningPort(child)
+
+  const unauthorized = new WebSocket(`ws://127.0.0.1:${port}/websocket/file-system-process?token=wrong`)
+  await waitForClose(unauthorized)
+
+  const webSocket = new WebSocket(`ws://127.0.0.1:${port}/websocket/file-system-process?token=${token}`)
+  await waitForOpen(webSocket)
+  context.after(() => webSocket.close())
+  const invoke = createRpc(webSocket)
+
+  const toUri = (value) => {
+    const url = new URL('file:///')
+    url.pathname = value
+    return url.href
+  }
+  assert.equal(await invoke('FileSystem.stat', toUri(directory)), 3)
+  const folder = path.join(directory, 'folder')
+  const file = path.join(folder, 'file.txt')
+  await invoke('FileSystem.mkdir', toUri(folder))
+  await invoke('FileSystem.writeFile', toUri(file), Buffer.from('hello').toString('base64'), 'base64')
+  assert.equal(Buffer.from(await invoke('FileSystem.readFile', toUri(file), 'base64'), 'base64').toString('utf8'), 'hello')
+  assert.deepEqual(await invoke('FileSystem.readDirWithFileTypes', toUri(directory)), [{ name: 'folder', type: 3 }])
+  assert.equal(await readFile(file, 'utf8'), 'hello')
+  await invoke('FileSystem.forceRemove', toUri(folder))
+  await assert.rejects(readFile(file, 'utf8'), { code: 'ENOENT' })
+
+  if (process.platform !== 'win32') {
+    const processWebSocket = new WebSocket(`ws://127.0.0.1:${port}/websocket/process-explorer?token=${token}`)
+    await waitForOpen(processWebSocket)
+    context.after(() => processWebSocket.close())
+    const invokeProcessExplorer = createRpc(processWebSocket)
+    const rootPid = await invokeProcessExplorer('ProcessId.getMainProcessId', { includeElectronData: false })
+    assert.equal(Number.isSafeInteger(rootPid), true)
+    const processes = await invokeProcessExplorer('ListProcessesWithMemoryUsage.listProcessesWithMemoryUsage', rootPid, false)
+    assert.equal(Array.isArray(processes), true)
+    assert.equal(processes.length > 0, true)
+  }
+})