@mh-gg/cli 0.1.1-alpha.20260613T085325975Z

package/runtime/host/sfuRelay.cjs

@@ -0,0 +1,553 @@
+const { verifyCallSignal } = require("./callAuth.cjs");
+const { peerJsOptionsFromAddress } = require("@mh-gg/relay-core");
+const crypto = require("node:crypto");
+
+function waitForPeerOpen(peer, timeoutMs = 15000) {
+  if (!peer || peer.open) return Promise.resolve(peer?.id);
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      cleanup();
+      reject(new Error("SFU peer did not open in time."));
+    }, timeoutMs);
+
+    function cleanup() {
+      clearTimeout(timer);
+      peer.off?.("open", onOpen);
+      peer.off?.("error", onError);
+      peer.removeListener?.("open", onOpen);
+      peer.removeListener?.("error", onError);
+    }
+
+    function onOpen(id) {
+      cleanup();
+      resolve(id);
+    }
+
+    function onError(error) {
+      cleanup();
+      reject(error);
+    }
+
+    peer.on("open", onOpen);
+    peer.on("error", onError);
+  });
+}
+
+function defaultEmptyMediaStream() {
+  const wrtcModule = require("@roamhq/wrtc");
+  const wrtc = wrtcModule.default || wrtcModule;
+  return new wrtc.MediaStream();
+}
+
+function loadWrtc() {
+  const wrtcModule = require("@roamhq/wrtc");
+  return wrtcModule.default || wrtcModule;
+}
+
+function metadataForCall(call) {
+  return call?.metadata?.MatterhornSfu || call?.options?.metadata?.MatterhornSfu;
+}
+
+function roomPayloadAad(roomName, kind) {
+  return Buffer.from(`matterhorn:v1:${roomName}:${kind}`, "utf8");
+}
+
+function deriveRoomPayloadKey(roomSecret, roomName) {
+  return crypto.pbkdf2Sync(String(roomSecret), `matterhorn:${roomName}`, 120000, 32, "sha256");
+}
+
+function isEncryptedPayload(payload, kind) {
+  return payload
+    && typeof payload === "object"
+    && payload.encrypted === true
+    && payload.alg === "A256GCM"
+    && payload.kind === kind
+    && typeof payload.iv === "string"
+    && typeof payload.data === "string";
+}
+
+function decryptRoomPayload(roomSecret, roomName, kind, payload) {
+  if (!roomSecret || !isEncryptedPayload(payload, kind)) throw new Error("Encrypted room payload is invalid.");
+  const bytes = Buffer.from(payload.data, "base64");
+  if (bytes.length < 17) throw new Error("Encrypted room payload is invalid.");
+  const ciphertext = bytes.subarray(0, bytes.length - 16);
+  const authTag = bytes.subarray(bytes.length - 16);
+  const decipher = crypto.createDecipheriv("aes-256-gcm", deriveRoomPayloadKey(roomSecret, roomName), Buffer.from(payload.iv, "base64"));
+  decipher.setAAD(roomPayloadAad(roomName, kind));
+  decipher.setAuthTag(authTag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return JSON.parse(plaintext.toString("utf8"));
+}
+
+function encryptRoomPayload(roomSecret, roomName, kind, value) {
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", deriveRoomPayloadKey(roomSecret, roomName), iv);
+  cipher.setAAD(roomPayloadAad(roomName, kind));
+  const ciphertext = Buffer.concat([
+    cipher.update(Buffer.from(JSON.stringify(value), "utf8")),
+    cipher.final(),
+    cipher.getAuthTag()
+  ]);
+  return {
+    encrypted: true,
+    alg: "A256GCM",
+    kind,
+    iv: iv.toString("base64"),
+    data: ciphertext.toString("base64")
+  };
+}
+
+function isCallRequest(signal) {
+  return signal
+    && signal.type === "call.request"
+    && typeof signal.sessionId === "string"
+    && (signal.mode === "voice" || signal.mode === "video")
+    && (!signal.mediaRoomId || typeof signal.mediaRoomId === "string")
+    && typeof signal.directPeerId === "string";
+}
+
+function isCallEnd(signal) {
+  return signal
+    && signal.type === "call.end"
+    && typeof signal.sessionId === "string";
+}
+
+function preferVp8Sdp(sdp) {
+  const sections = sdp.split(/(?=m=)/);
+  return sections.map((section) => {
+    if (!section.startsWith("m=video ")) return section;
+    const lines = section.split("\r\n");
+    const mLine = lines[0].split(" ");
+    const payloads = mLine.slice(3);
+    const vp8Payloads = new Set();
+    const rtxByApt = new Map();
+    for (const line of lines) {
+      const rtpMatch = /^a=rtpmap:(\d+)\s+VP8\/90000/i.exec(line);
+      if (rtpMatch) vp8Payloads.add(rtpMatch[1]);
+      const fmtpMatch = /^a=fmtp:(\d+)\s+.*(?:^|[ ;])apt=(\d+)/i.exec(line);
+      if (fmtpMatch) rtxByApt.set(fmtpMatch[2], [...(rtxByApt.get(fmtpMatch[2]) || []), fmtpMatch[1]]);
+    }
+    const preferred = [];
+    for (const payload of payloads) {
+      if (!vp8Payloads.has(payload)) continue;
+      preferred.push(payload, ...(rtxByApt.get(payload) || []));
+    }
+    if (preferred.length === 0) return section;
+    const ordered = [...preferred, ...payloads.filter((payload) => !preferred.includes(payload))];
+    lines[0] = [...mLine.slice(0, 3), ...ordered].join(" ");
+    return lines.join("\r\n");
+  }).join("");
+}
+
+function createRelaySfu(options) {
+  const enabled = Boolean(options.enabled);
+  const peerId = options.peerId;
+  const peerAddress = options.peerAddress;
+  const maxParticipants = Number.isInteger(options.maxParticipants) && options.maxParticipants > 0
+    ? options.maxParticipants
+    : 16;
+  const createEmptyMediaStream = options.createEmptyMediaStream || defaultEmptyMediaStream;
+  const rooms = new Map();
+  const mediaStats = {
+    upstreamStreams: 0,
+    downstreamCalls: 0,
+    audioFrames: 0,
+    videoFrames: 0,
+    lastAudioFrameAt: 0,
+    lastVideoFrameAt: 0
+  };
+  let peer;
+
+  function roomKey(roomName, mediaRoomId) {
+    return mediaRoomId ? `${roomName}#${mediaRoomId}` : roomName;
+  }
+
+  function roomFor(roomName, mediaRoomId) {
+    const key = roomKey(roomName, mediaRoomId);
+    let room = rooms.get(key);
+    if (!room) {
+      room = { roomName, mediaRoomId, participants: new Map() };
+      rooms.set(key, room);
+    }
+    return room;
+  }
+
+  function participantCount(roomName) {
+    if (roomName) {
+      let count = 0;
+      for (const room of rooms.values()) {
+        if (room.roomName === roomName) count += room.participants.size;
+      }
+      return count;
+    }
+    let count = 0;
+    for (const room of rooms.values()) count += room.participants.size;
+    return count;
+  }
+
+  function stats() {
+    return {
+      enabled,
+      peerId: enabled ? peerId : undefined,
+      peerAddress: enabled ? peerAddress : undefined,
+      open: Boolean(peer?.open),
+      participants: participantCount(),
+      maxParticipants,
+      media: { ...mediaStats }
+    };
+  }
+
+  function status(roomName) {
+    if (!enabled) return { enabled: false };
+    return {
+      enabled: true,
+      peerId,
+      peerAddress,
+      participants: participantCount(roomName),
+      maxParticipants,
+      media: { ...mediaStats }
+    };
+  }
+
+  function emitStatus(roomName) {
+    if (enabled && typeof roomName === "string") options.onStatus?.(roomName, status(roomName));
+  }
+
+  function debugSfu(message) {
+    if (process.env.MATTERHORN_SFU_DEBUG === "1") options.logger?.log?.(`matterhorn relay SFU debug: ${message}`);
+  }
+
+  async function validJoin(call, metadata) {
+    if (!enabled || !metadata || metadata.protocol !== 1) return undefined;
+    if (typeof metadata.roomName !== "string" || typeof metadata.clientId !== "string") return undefined;
+    let signal = metadata.signal;
+    let auth = metadata.auth;
+    if (metadata.encryptedSignal) {
+      const roomSecret = await options.roomSecretForRoom?.(metadata.roomName);
+      try {
+        const payload = decryptRoomPayload(roomSecret, metadata.roomName, "call.signal", metadata.encryptedSignal);
+        signal = payload.signal;
+        auth = payload.auth;
+      } catch {
+        return undefined;
+      }
+    }
+    if (!isCallRequest(signal) || signal.directPeerId !== call.peer) return undefined;
+    const guest = await options.getGuest?.(metadata.roomName, metadata.clientId);
+    if (!guest || guest.bannedAt || !guest.callPubkey) return undefined;
+    const targetClientId = `sfu:${peerId}`;
+    if (!verifyCallSignal({
+      roomName: metadata.roomName,
+      sourceClientId: metadata.clientId,
+      targetClientId,
+      signal,
+      auth,
+      expectedPubkey: guest.callPubkey
+    })) return undefined;
+    return { guest, signal };
+  }
+
+  function validSignal(roomName, clientId, signal, auth) {
+    if (!enabled || typeof roomName !== "string" || typeof clientId !== "string") return false;
+    const participant = findParticipant(roomName, clientId);
+    if (!participant?.callPubkey) return false;
+    return verifyCallSignal({
+      roomName,
+      sourceClientId: clientId,
+      targetClientId: `sfu:${peerId}`,
+      signal,
+      auth,
+      expectedPubkey: participant.callPubkey
+    });
+  }
+
+  function closeCall(call) {
+    try {
+      call?.close?.();
+    } catch {}
+  }
+
+  function stopStream(stream) {
+    for (const track of stream?.getTracks?.() || []) {
+      try {
+        track.stop?.();
+      } catch {}
+    }
+  }
+
+  function closeDownstream(call) {
+    if (!call || call.MatterhornSfuClosing) return;
+    call.MatterhornSfuClosing = true;
+    if (call.MatterhornForwarder) call.MatterhornForwarder.close();
+    else stopStream(call?.MatterhornSfuStream);
+    closeCall(call);
+  }
+
+  function findParticipant(roomName, clientId) {
+    for (const room of rooms.values()) {
+      if (room.roomName !== roomName) continue;
+      const participant = room.participants.get(clientId);
+      if (participant) return participant;
+    }
+    return undefined;
+  }
+
+  function streamTrackCount(stream) {
+    return stream?.getTracks?.().length || 0;
+  }
+
+  function createMediaForwarder(stream) {
+    const tracks = stream?.getTracks?.() || [];
+    if (tracks.length === 0) return { stream, close() {} };
+
+    const wrtc = loadWrtc();
+    const nonstandard = wrtc.nonstandard || {};
+    const output = new wrtc.MediaStream();
+    const sinks = [];
+
+    for (const track of tracks) {
+      if (track.kind === "video" && nonstandard.RTCVideoSink && nonstandard.RTCVideoSource) {
+        const sink = new nonstandard.RTCVideoSink(track);
+        const source = new nonstandard.RTCVideoSource();
+        const outputTrack = source.createTrack();
+        sink.onframe = ({ frame }) => {
+          mediaStats.videoFrames += 1;
+          mediaStats.lastVideoFrameAt = Date.now();
+          if (mediaStats.videoFrames === 1) debugSfu(`first video frame ${frame.width}x${frame.height}`);
+          source.onFrame(frame);
+        };
+        output.addTrack(outputTrack);
+        sinks.push({ sink, track: outputTrack });
+        continue;
+      }
+      if (track.kind === "audio" && nonstandard.RTCAudioSink && nonstandard.RTCAudioSource) {
+        const sink = new nonstandard.RTCAudioSink(track);
+        const source = new nonstandard.RTCAudioSource();
+        const outputTrack = source.createTrack();
+        sink.ondata = (data) => {
+          mediaStats.audioFrames += 1;
+          mediaStats.lastAudioFrameAt = Date.now();
+          if (mediaStats.audioFrames === 1) debugSfu(`first audio frame ${data.sampleRate}hz`);
+          source.onData(data);
+        };
+        output.addTrack(outputTrack);
+        sinks.push({ sink, track: outputTrack });
+      }
+    }
+
+    if (output.getTracks().length === 0) return {
+      stream: typeof stream.clone === "function" ? stream.clone() : stream,
+      close() {}
+    };
+
+    return {
+      stream: output,
+      close() {
+        for (const entry of sinks) {
+          try {
+            entry.sink.stop();
+          } catch {}
+          try {
+            entry.track.stop();
+          } catch {}
+        }
+      }
+    };
+  }
+
+  function removeParticipant(participant) {
+    const room = rooms.get(participant.roomKey);
+    if (room?.participants.get(participant.clientId) === participant) room.participants.delete(participant.clientId);
+    closeCall(participant.upstreamCall);
+    for (const call of participant.downstreamCalls.values()) closeDownstream(call);
+    participant.downstreamCalls.clear();
+    if (!room) return;
+    for (const other of room.participants.values()) {
+      const call = other.downstreamCalls.get(participant.clientId);
+      if (call) {
+        other.downstreamCalls.delete(participant.clientId);
+        closeDownstream(call);
+      }
+    }
+    emitStatus(participant.roomName);
+  }
+
+  function replaceSourceStream(participant, stream) {
+    participant.stream = stream;
+    const room = rooms.get(participant.roomKey);
+    if (!room) return;
+    for (const other of room.participants.values()) {
+      if (other === participant) continue;
+      const existing = other.downstreamCalls.get(participant.clientId);
+      if (existing) {
+        other.downstreamCalls.delete(participant.clientId);
+        closeDownstream(existing);
+      }
+      bridgeSourceToTarget(participant, other);
+    }
+  }
+
+  function bridgeSourceToTarget(source, target) {
+    if (!peer?.open || source.clientId === target.clientId || !source.stream) return;
+    const existing = target.downstreamCalls.get(source.clientId);
+    if (existing) closeDownstream(existing);
+    const forwarder = createMediaForwarder(source.stream);
+    const roomSecret = options.roomSecretForRoom?.(source.roomName);
+    const encryptedPayload = roomSecret ? encryptRoomPayload(roomSecret, source.roomName, "sfu.downstream", {
+      sourceName: source.name,
+      sourceAvatar: source.avatar,
+      mode: source.mode,
+      media: source.media,
+      mediaTracks: source.mediaTracks,
+      mediaRoomId: source.mediaRoomId
+    }) : undefined;
+    mediaStats.downstreamCalls += 1;
+    const downstream = peer.call(target.peerId, forwarder.stream, {
+      sdpTransform: preferVp8Sdp,
+      metadata: {
+        MatterhornSfuDownstream: encryptedPayload ? {
+          protocol: 1,
+          roomName: source.roomName,
+          sfuPeerId: peerId,
+          sessionId: target.sessionId,
+          sourceClientId: source.clientId,
+          encryptedPayload
+        } : {
+          protocol: 1,
+          roomName: source.roomName,
+          sfuPeerId: peerId,
+          sessionId: target.sessionId,
+          sourceClientId: source.clientId,
+          sourceName: source.name,
+          sourceAvatar: source.avatar,
+          mode: source.mode,
+          media: source.media,
+          mediaTracks: source.mediaTracks,
+          mediaRoomId: source.mediaRoomId
+        }
+      }
+    });
+    downstream.MatterhornForwarder = forwarder;
+    target.downstreamCalls.set(source.clientId, downstream);
+    downstream.on?.("close", () => {
+      if (target.downstreamCalls.get(source.clientId) === downstream) target.downstreamCalls.delete(source.clientId);
+      closeDownstream(downstream);
+    });
+    downstream.on?.("error", () => {
+      if (target.downstreamCalls.get(source.clientId) === downstream) target.downstreamCalls.delete(source.clientId);
+      closeDownstream(downstream);
+    });
+  }
+
+  function addParticipant(call, metadata, validation, stream) {
+    const room = roomFor(metadata.roomName, validation.signal.mediaRoomId);
+    const existing = room.participants.get(metadata.clientId);
+    if (existing?.upstreamCall === call) {
+      if (streamTrackCount(stream) > streamTrackCount(existing.stream)) replaceSourceStream(existing, stream);
+      return;
+    }
+    if (existing) removeParticipant(existing);
+
+    const participant = {
+      roomName: metadata.roomName,
+      roomKey: roomKey(metadata.roomName, validation.signal.mediaRoomId),
+      mediaRoomId: validation.signal.mediaRoomId,
+      clientId: metadata.clientId,
+      peerId: call.peer,
+      sessionId: validation.signal.sessionId,
+      mode: validation.signal.mode,
+      media: validation.signal.media,
+      mediaTracks: validation.signal.mediaTracks,
+      name: validation.guest.name || validation.signal.profile?.name || "Guest",
+      avatar: validation.guest.avatar || validation.signal.profile?.avatar || "*",
+      callPubkey: validation.guest.callPubkey,
+      stream,
+      upstreamCall: call,
+      downstreamCalls: new Map()
+    };
+
+    room.participants.set(participant.clientId, participant);
+    mediaStats.upstreamStreams += 1;
+    debugSfu(`upstream stream from ${participant.clientId} with ${stream.getTracks?.().length || 0} tracks`);
+    for (const other of room.participants.values()) {
+      if (other === participant) continue;
+      bridgeSourceToTarget(other, participant);
+      bridgeSourceToTarget(participant, other);
+    }
+    emitStatus(metadata.roomName);
+  }
+
+  function handleCall(call) {
+    const metadata = metadataForCall(call);
+    void validJoin(call, metadata).then((validation) => {
+      const room = metadata?.roomName && validation ? roomFor(metadata.roomName, validation.signal.mediaRoomId) : undefined;
+      if (!validation || !room || room.participants.size >= maxParticipants) {
+        closeCall(call);
+        return;
+      }
+      call.answer(createEmptyMediaStream());
+      call.on?.("stream", (stream) => addParticipant(call, metadata, validation, stream));
+      call.on?.("close", () => {
+        const participant = room.participants.get(metadata.clientId);
+        if (participant?.upstreamCall === call) removeParticipant(participant);
+      });
+      call.on?.("error", () => {
+        const participant = room.participants.get(metadata.clientId);
+        if (participant?.upstreamCall === call) removeParticipant(participant);
+      });
+    }).catch(() => closeCall(call));
+  }
+
+  function handleSignal(message) {
+    if (!isCallEnd(message?.signal) || !validSignal(message.roomName, message.sourceClientId, message.signal, message.auth)) return false;
+    const participant = findParticipant(message.roomName, message.sourceClientId);
+    if (participant?.sessionId === message.signal.sessionId) removeParticipant(participant);
+    return true;
+  }
+
+  async function start() {
+    if (!enabled) return undefined;
+    peer = await options.createPeer(peerId, options.iceServers || [], {
+      signaling: peerJsOptionsFromAddress(peerAddress)
+    });
+    peer.on("call", handleCall);
+    await waitForPeerOpen(peer);
+    options.logger?.log?.(`matterhorn relay SFU peer is live as ${peerId}`);
+    return peer;
+  }
+
+  function close() {
+    const roomNames = Array.from(rooms.keys());
+    const calls = [];
+    for (const room of rooms.values()) {
+      for (const participant of room.participants.values()) {
+        calls.push(participant.upstreamCall, ...participant.downstreamCalls.values());
+        participant.downstreamCalls.clear();
+      }
+    }
+    rooms.clear();
+    const peerToDestroy = peer;
+    peer = undefined;
+    for (const roomName of roomNames) emitStatus(roomName);
+    setTimeout(() => {
+      for (const call of calls) {
+        if (call?.MatterhornForwarder || call?.MatterhornSfuStream) closeDownstream(call);
+        else closeCall(call);
+      }
+      peerToDestroy?.destroy?.();
+    }, 0);
+  }
+
+  return {
+    close,
+    handleCall,
+    handleSignal,
+    start,
+    stats,
+    status
+  };
+}
+
+module.exports = {
+  createRelaySfu
+};