@miraj181/ipingyou 2.1.18 → 2.1.22

package/src/server.js

@@ -13,7 +13,13 @@ import express from 'express';
 import rateLimit from 'express-rate-limit';
 import helmet from 'helmet';
 import crypto from 'node:crypto';
-import { cleanupSessionLog, initSessionLog, logSessionEvent } from './lib/session-log.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { cleanupSessionLog, initSessionLog, logSessionEvent } from './lib/mod/session-log.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, '../package.json'), 'utf8'));
 
 const app = express();
 const brokerLogPath = initSessionLog('broker');
@@ -359,6 +365,30 @@ app.get('/resolve/:uid', generalLimiter, (req, res) => {
       if (!approved) {
         return res.status(423).json({ error: 'Host approval required before resolving this session' });
       }
+      
+      // Client-specific E2E gating: verify client IP matches approved request IP
+      const clientIp = (req.headers['x-forwarded-for'] || req.socket.remoteAddress || '').split(',')[0].trim();
+      if (approved.ip && approved.ip !== clientIp) {
+        return res.status(403).json({ error: 'Client IP mismatch — access denied' });
+      }
+
+      if (approved.approvedPayload) {
+        entry.resolveCount = (entry.resolveCount || 0) + 1;
+        console.log(`🔍 [${new Date().toLocaleTimeString()}] Resolved UID (Client Specific): ${uid} (resolve #${entry.resolveCount})`);
+        res.json({
+          uid,
+          iv: approved.approvedPayload.iv,
+          ciphertext: approved.approvedPayload.ciphertext,
+          salt: approved.approvedPayload.salt,
+          isClientSpecific: true,
+          ip: clientIp
+        });
+        
+        if (entry.oneTime) {
+          deleteStoreEntry(uid);
+        }
+        return;
+      }
     }
 
     // Increment resolve counter atomically BEFORE sending response
@@ -400,6 +430,7 @@ app.post('/approval-request/:uid', generalLimiter, (req, res) => {
 
     // Generate cryptographically secure request ID
     const id = crypto.randomBytes(12).toString('hex');
+    const ip = (req.headers['x-forwarded-for'] || req.socket.remoteAddress || '').split(',')[0].trim();
     const request = {
       id,
       iv: req.body.iv,
@@ -408,6 +439,7 @@ app.post('/approval-request/:uid', generalLimiter, (req, res) => {
       status: entry.approvalRequired ? 'pending' : 'approved',
       createdAt: Date.now(),
       decidedAt: entry.approvalRequired ? null : Date.now(),
+      ip,
     };
 
     const requestBytes = encryptedPayloadBytes(request);
@@ -435,8 +467,12 @@ app.get('/approval-requests/:uid', hostLimiter, (req, res) => {
   if (!entry) return res.status(404).json({ error: 'UID not found' });
   // Require host token to view approval list
   if (!requireHostToken(req, res, entry)) return;
-  // Strip encrypted payloads — host dashboard only needs id/status/timestamps
-  const sanitized = entry.approvals.map(a => ({ id: a.id, status: a.status, createdAt: a.createdAt, decidedAt: a.decidedAt }));
+  // Include encrypted payloads so the host can decrypt client details locally
+  const sanitized = entry.approvals.map(a => ({
+    id: a.id, status: a.status, createdAt: a.createdAt, decidedAt: a.decidedAt,
+    iv: a.iv, ciphertext: a.ciphertext, salt: a.salt,
+    ip: a.ip,
+  }));
   res.json({ approvalRequired: entry.approvalRequired, approvals: sanitized });
 });
 
@@ -458,6 +494,14 @@ app.post('/approval-requests/:uid/:requestId/:decision', strictLimiter, (req, re
 
   request.status = req.params.decision;
   request.decidedAt = Date.now();
+  
+  if (req.params.decision === 'approved' && req.body && req.body.ciphertext) {
+    request.approvedPayload = {
+      iv: req.body.iv,
+      ciphertext: req.body.ciphertext,
+      salt: req.body.salt
+    };
+  }
   res.json({ status: request.status });
 });
 
@@ -470,8 +514,13 @@ app.get('/approval-status/:uid/:requestId', generalLimiter, (req, res) => {
   if (!entry) return res.status(404).json({ error: 'UID not found' });
   const request = entry.approvals.find(item => item.id === req.params.requestId);
   if (!request) return res.status(404).json({ error: 'Request not found' });
-  // Only return status — never leak encrypted approval data
-  res.json({ status: request.status });
+  
+  const clientIp = (req.headers['x-forwarded-for'] || req.socket.remoteAddress || '').split(',')[0].trim();
+  res.json({
+    status: request.status,
+    ip: clientIp,
+    approvedPayload: request.status === 'approved' ? request.approvedPayload : undefined
+  });
 });
 
 /**
@@ -568,7 +617,7 @@ const HOST = process.env.HOST || '0.0.0.0';
 app.listen(PORT, HOST, () => {
   console.log('');
   console.log('  ╔══════════════════════════════════════════╗');
-  console.log('  ║   🔗  SecureLink Broker — Active         ║');
+  console.log(`  ║   🔗  SecureLink Broker — Active (v${packageJson.version})`.padEnd(45) + '║');
   console.log(`  ║   📡  Port: ${String(PORT).padEnd(29)}║`);
   console.log('  ║   🔒  Zero-Knowledge Encrypted Store     ║');
   console.log('  ║   ⏱️   TTL: 1 hour per UID                ║');

package/src/lib/platform.js

@@ -1,90 +0,0 @@
-import { execa } from 'execa';
-import chalk from 'chalk';
-import os from 'node:os';
-import fs from 'node:fs';
-
-export function detectOS() {
-  const platform = process.platform;
-  return {
-    platform,
-    isLinux: platform === 'linux',
-    isMac: platform === 'darwin',
-    isWindows: platform === 'win32',
-    distro: null,
-    arch: os.arch(),
-    hostname: os.hostname(),
-  };
-}
-
-export async function detectLinuxDistro() {
-  try {
-    const data = await fs.promises.readFile('/etc/os-release', 'utf8');
-    const lower = data.toLowerCase();
-    if (/(ubuntu|debian|kali|mint)/.test(lower)) return 'debian';
-    if (/(arch|manjaro)/.test(lower)) return 'arch';
-    if (/(fedora|centos|rhel)/.test(lower)) return 'fedora';
-  } catch {
-    // Manual instructions fall back to the generic Linux guidance.
-  }
-  return 'unknown';
-}
-
-export async function commandExists(command) {
-  if (!/^[a-zA-Z0-9._+-]{1,64}$/.test(String(command || ''))) return false;
-  try {
-    const probe = process.platform === 'win32' ? ['where', command] : ['which', command];
-    await execa(probe[0], [probe[1]], {
-      reject: true,
-      timeout: 5000,
-      maxBuffer: 64 * 1024,
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function printInstallGuidance(osInfo, missing) {
-  console.log(chalk.yellow('  ⚠️  Required system tools are missing.'));
-  console.log(chalk.dim('     iPingYou does not download or execute native installers automatically.'));
-  console.log(chalk.dim('     Install the tools through your trusted OS package manager, then rerun iPingYou.'));
-  console.log('');
-
-  if (missing.includes('cloudflared')) {
-    if (osInfo.isMac) console.log(chalk.cyan('     brew install cloudflared'));
-    else if (osInfo.isWindows) console.log(chalk.cyan('     winget install --id Cloudflare.cloudflared -e'));
-    else console.log(chalk.cyan('     Follow: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/'));
-  }
-
-  if (missing.includes('ssh')) {
-    if (osInfo.isMac) console.log(chalk.cyan('     Enable Remote Login in System Settings → General → Sharing'));
-    else if (osInfo.isWindows) console.log(chalk.cyan('     Add OpenSSH Client/Server from Windows Optional Features'));
-    else console.log(chalk.cyan('     Debian/Ubuntu: sudo apt-get install openssh-client openssh-server'));
-  }
-  console.log('');
-}
-
-export async function checkDependencies() {
-  const osInfo = detectOS();
-  const results = {
-    ssh: await commandExists('ssh'),
-    cloudflared: await commandExists('cloudflared'),
-  };
-
-  console.log('');
-  console.log(chalk.bold('  🔍 Dependency Check'));
-  console.log(chalk.dim('  ─────────────────────────────────'));
-  console.log(`  ${results.ssh ? chalk.green('✓') : chalk.red('✗')} ssh          ${results.ssh ? chalk.dim('found') : chalk.red('missing')}`);
-  console.log(`  ${results.cloudflared ? chalk.green('✓') : chalk.red('✗')} cloudflared  ${results.cloudflared ? chalk.dim('found') : chalk.red('missing')}`);
-  console.log('');
-
-  const missing = Object.entries(results)
-    .filter(([, available]) => !available)
-    .map(([name]) => name);
-  if (missing.length > 0) {
-    printInstallGuidance(osInfo, missing);
-  } else {
-    console.log(chalk.green('  ✅ All dependencies satisfied!\n'));
-  }
-  return results;
-}