@lvxianchao/dsh-web-guard 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 2.1.0 — 2026-11-05
+
+### Added
+
+- **Sessions survive a restart.** The table is cached beside the password file (`dsh-web-guard-sessions-<port>.json`, mode 0600, atomic write), so upgrading or restarting DSH no longer signs every browser out — the open tab reconnects instead of hanging on "reconnecting". Rows that expired while the process was down are dropped on load.
+- **Dead-session redirect.** The injected client probes the new `/__guard/session` endpoint (200 = live, 401 = gone) when the tab becomes visible, when the browser comes back online, after a WebSocket close, and every 30s. A 401 sends the browser to the login page with `?next=`, so a genuine revocation (password change, sign-out-all) looks like a login prompt rather than a dead spinner.
+
+### Changed
+
+- Restarting the guard is no longer a way to sign everyone out. Use the admin page's "sign out all devices" — revocation is an explicit action now.
+
+### Security
+
+- The session cache stores SHA-256 hashes, never raw tokens. Neither the file nor a heap dump can mint a working cookie.
+
+
+## 2.0.1 — 2026-11-05
+
+### Internal
+
+- Publishing is automatic: pushing a `v*` tag publishes to npm from GitHub Actions through an OIDC trusted publisher, with provenance. A mismatched tag/version fails the run instead of shipping the wrong thing.
+
+
 ## 2.0.0 — 2026-11-05
 
 ### Breaking

package/lib/auth.js

@@ -4,13 +4,17 @@
  * Design notes:
  * - Passwords are stored as scrypt `scrypt$N$r$p$salt$key` (same shape the
  *   Hermes dashboard uses) so a hash can be pasted into config.
- * - Sessions live in memory: the plugin restarts with dsh, and a restart
- *   should force a fresh login anyway. Tokens are stored hashed, so a heap
- *   dump does not hand out live sessions.
+ * - Sessions are hashed before they reach memory *and* the on-disk cache, so
+ *   neither a heap dump nor the state file can mint a working cookie. The
+ *   cache exists so a restart (upgrade, config change) does not sign everyone
+ *   out; revocation still goes through the admin page, and a session that
+ *   expired while the process was down is dropped on load.
  * - Every session carries its own expiry and last-seen stamp; the cookie
  *   lifetime is fixed at issue time, the server side slides on activity.
  */
 import { randomBytes, createHash, scryptSync, timingSafeEqual } from 'node:crypto'
+import { readFileSync, writeFileSync, renameSync, mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
 
 const SCRYPT_N = 16384
 const SCRYPT_R = 8
@@ -59,7 +63,7 @@ export class SessionStore {
    * @param {number} options.maxAttempts - failures before a temporary lock
    * @param {number} options.lockMinutes - lock duration in minutes
    */
-  constructor({ sessionDays = 7, maxAttempts = 5, lockMinutes = 5 } = {}) {
+  constructor({ sessionDays = 7, maxAttempts = 5, lockMinutes = 5, file } = {}) {
     this.sessionMs = Math.max(0, sessionDays) * 24 * 60 * 60 * 1000
     this.maxAttempts = Math.max(1, maxAttempts)
     this.lockMs = Math.max(1, lockMinutes) * 60 * 1000
@@ -67,10 +71,66 @@ export class SessionStore {
     this.sessions = new Map()
     /** @type {Map<string, {fails:number,until:number}>} */
     this.failures = new Map()
+    this.file = typeof file === 'string' && file.length > 0 ? file : ''
+    this.persistTimer = null
     this.timer = setInterval(() => this.sweep(), 10 * 60 * 1000)
     this.timer.unref?.()
   }
 
+  /**
+   * Restore the table a previous process wrote. A missing or corrupt file is
+   * treated as "no sessions" — a damaged cache must never block sign-in.
+   */
+  load() {
+    if (!this.file) return
+    let data
+    try {
+      data = JSON.parse(readFileSync(this.file, 'utf8'))
+    } catch {
+      return
+    }
+    if (data === null || typeof data !== 'object' || data.version !== 1) return
+    if (data.sessions === null || typeof data.sessions !== 'object') return
+    const now = Date.now()
+    const limit = this.sessionMs === 0 ? 12 * 60 * 60 * 1000 : this.sessionMs
+    for (const [key, row] of Object.entries(data.sessions)) {
+      if (!/^[0-9a-f]{64}$/.test(key)) continue
+      if (typeof row?.createdAt !== 'number' || typeof row?.lastSeen !== 'number') continue
+      if (now - row.lastSeen > limit) continue
+      this.sessions.set(key, {
+        createdAt: row.createdAt,
+        lastSeen: row.lastSeen,
+        ip: typeof row.ip === 'string' ? row.ip : '',
+        ua: typeof row.ua === 'string' ? row.ua : '',
+      })
+    }
+  }
+
+  /** Write the table atomically (tmp + rename); disk problems never block auth. */
+  persist() {
+    if (!this.file) return
+    try {
+      const sessions = {}
+      for (const [key, row] of this.sessions) sessions[key] = row
+      mkdirSync(dirname(this.file), { recursive: true })
+      const tmp = `${this.file}.${process.pid}.tmp`
+      writeFileSync(tmp, JSON.stringify({ version: 1, savedAt: Date.now(), sessions }), { mode: 0o600 })
+      renameSync(tmp, this.file)
+    } catch {
+      // Read-only data dir or full disk: this process keeps working from memory.
+    }
+  }
+
+  /** Coalesce a burst of changes into one write. */
+  touch() {
+    if (!this.file || this.persistTimer !== null) return
+    this.persistTimer = setTimeout(() => {
+      this.persistTimer = null
+      this.persist()
+    }, 500)
+    this.persistTimer.unref?.()
+  }
+
   /** Whether this client is currently locked out. */
   isLocked(ip) {
     const row = this.failures.get(ip)
@@ -102,6 +162,7 @@ export class SessionStore {
     const token = randomBytes(32).toString('base64url')
     const now = Date.now()
     this.sessions.set(sha256(token), { createdAt: now, lastSeen: now, ip, ua })
+    this.touch()
     return token
   }
 
@@ -115,14 +176,17 @@ export class SessionStore {
     const limit = this.sessionMs === 0 ? 12 * 60 * 60 * 1000 : this.sessionMs
     if (now - row.lastSeen > limit) {
       this.sessions.delete(key)
+      this.touch()
       return undefined
     }
     row.lastSeen = now
+    this.touch()
     return row
   }
 
   revoke(token) {
-    if (typeof token === 'string' && token.length > 0) this.sessions.delete(sha256(token))
+    if (typeof token !== 'string' || token.length === 0) return
+    if (this.sessions.delete(sha256(token))) this.touch()
   }
 
   /** List live sessions with a short opaque id (the hashed key prefix). */
@@ -143,6 +207,7 @@ export class SessionStore {
     for (const key of this.sessions.keys()) {
       if (key.slice(0, 16) === id) {
         this.sessions.delete(key)
+        this.touch()
         return true
       }
     }
@@ -157,21 +222,32 @@ export class SessionStore {
 
   revokeAll() {
     this.sessions.clear()
+    this.touch()
   }
 
   sweep() {
     const now = Date.now()
+    let dropped = false
     const limit = this.sessionMs === 0 ? 12 * 60 * 60 * 1000 : this.sessionMs
     for (const [key, row] of this.sessions) {
-      if (now - row.lastSeen > limit) this.sessions.delete(key)
+      if (now - row.lastSeen > limit) {
+        this.sessions.delete(key)
+        dropped = true
+      }
     }
     for (const [ip, row] of this.failures) {
       if (row.until > 0 && row.until < now) this.failures.delete(ip)
     }
+    if (dropped) this.touch()
   }
 
   dispose() {
     clearInterval(this.timer)
+    if (this.persistTimer !== null) {
+      clearTimeout(this.persistTimer)
+      this.persistTimer = null
+    }
+    this.persist()
     this.sessions.clear()
     this.failures.clear()
   }

package/lib/index.js

@@ -60,6 +60,15 @@ function statePath(profileDir) {
   return join(profileDir, 'data', 'dsh-web-guard.json')
 }
 
+/**
+ * Session cache lives beside the password but keyed by listener port: a shadow
+ * instance (dev.yml, port 3100) runs against the same profile and must not
+ * fight the live one over one file. Ports are exclusive, so this is a safe key.
+ */
+function sessionsPath(profileDir, port) {
+  return join(profileDir, 'data', `dsh-web-guard-sessions-${port}.json`)
+}
+
 function readState(profileDir) {
   for (const path of [statePath(profileDir), legacyStatePath()]) {
     try {
@@ -181,7 +190,11 @@ export function apply(ctx, config = {}) {
     sessionDays: Number(cfg.sessionDays),
     maxAttempts: Number(cfg.maxAttempts),
     lockMinutes: Number(cfg.lockMinutes),
+    file: sessionsPath(profileDir, cfg.listenPort),
   })
+  // Restore sessions from the previous process: a restart (upgrade, config
+  // change) must not sign every browser out. Expired rows are dropped on load.
+  sessions.load()
 
   // Locale follows the harness: its language picker writes `preference` into
   // the profile patch file. Uncached reads would hit the filesystem on every
@@ -396,6 +409,13 @@ export function apply(ctx, config = {}) {
 
     if (path === '/__guard/health') return json(res, 200, { ok: true, service: 'dsh-web-guard' })
 
+    // Authenticated probe: 200 when this browser still holds a live session,
+    // 401 when it does not. The injected client uses it to leave the
+    // "reconnecting" spinner for the login page instead of retrying forever.
+    if (path === '/__guard/session') {
+      return sessionOf(req) ? json(res, 200, { ok: true }) : json(res, 401, { ok: false })
+    }
+
     if (path === '/login' && req.method === 'GET') {
       if (sessionOf(req)) return redirect(res, '/')
       return html(res, 200, loginPage({ title: cfg.title, next: url.searchParams.get('next') ?? '/', repo: cfg.repo, locale }))

package/lib/inject.js

@@ -58,6 +58,40 @@ border:1px solid #24282e;background:#0b0d10;box-shadow:0 24px 80px rgba(0,0,0,.6
     document.body.style.overflow = "hidden";
   }
   fab.addEventListener("click", open);
+
+  // ── session watchdog ────────────────────────────────────────────────
+  // DSH only ever sees "WebSocket closed"; it does not know this gate exists.
+  // When the session is really gone (password change, revoke-all, expiry) we
+  // send the browser to the login page instead of spinning on reconnect.
+  // A 401 is the only trigger: a failed fetch means the network is down.
+  var probing = false;
+  function probe() {
+    if (probing) return;
+    probing = true;
+    fetch("/__guard/session", { cache: "no-store", credentials: "same-origin" })
+      .then(function (r) {
+        if (r.status === 401) {
+          location.href = "/login?next=" + encodeURIComponent(location.pathname + location.search);
+        }
+      })
+      .catch(function () {})
+      .then(function () { probing = false; });
+  }
+  document.addEventListener("visibilitychange", function () { if (!document.hidden) probe(); });
+  window.addEventListener("online", probe);
+  setInterval(probe, 30000);
+  var NativeWS = window.WebSocket;
+  if (NativeWS) {
+    window.WebSocket = function (url, protocols) {
+      var ws = protocols === undefined ? new NativeWS(url) : new NativeWS(url, protocols);
+      ws.addEventListener("close", function () { setTimeout(probe, 2000); });
+      return ws;
+    };
+    window.WebSocket.prototype = NativeWS.prototype;
+    ["CONNECTING", "OPEN", "CLOSING", "CLOSED"].forEach(function (k) {
+      window.WebSocket[k] = NativeWS[k];
+    });
+  }
   window.addEventListener("message", function (ev) {
     if (ev.origin !== location.origin) return;
     if (ev.data === "dsh-web-guard:close") close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvxianchao/dsh-web-guard",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Password login for the DeepSeek Harness Web UI, so it can be exposed on the internet: sign in from anywhere instead of chasing one-off tokens, with reverse-proxy quirks handled.",
   "type": "module",
   "main": "lib/index.js",