@mmmbuto/nexuscrew 0.8.7 → 0.8.10

package/lib/proxy/federation.js

@@ -29,7 +29,10 @@ function peerAllows(peer, otherId) {
 
 function canTransit(ingress, egress) {
   if (!ingress || !egress || ingress.name === egress.name) return !ingress;
-  return peerAllows(ingress, egress.nodeId) && peerAllows(egress, ingress.nodeId);
+  // `shared` is the explicit publication gate. Visibility remains the hub ACL,
+  // but it cannot make a private peer routable on its own.
+  return egress.shared === true
+    && peerAllows(ingress, egress.nodeId) && peerAllows(egress, ingress.nodeId);
 }
 
 function parseRoute(raw) {
@@ -54,8 +57,15 @@ function knownResource(resource) {
     || resource === '/files'
     || resource === '/files/download'
     || resource === '/files/upload'
+    || resource === '/decks'
+    || /^\/decks\/[a-z0-9-]{1,32}$/.test(resource)
+    || resource === '/topology'
+    // A connected client may ask its hub to mint a hub-owned, one-time
+    // pairing invite. This is the only settings mutation exposed through
+    // Hydra: the rest of /settings stays unreachable.
+    || resource === '/settings/peering/invite'
     || resource === '/ws'
-    || /^\/fleet\/(status|schema|definitions|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell)$/.test(resource);
+    || /^\/fleet\/(status|schema|definitions|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells)$/.test(resource);
 }
 
 function allowedResource(resource, method = 'GET') {
@@ -66,9 +76,15 @@ function allowedResource(resource, method = 'GET') {
   if (resource === '/files') return method === 'GET' || method === 'DELETE';
   if (resource === '/files/download') return method === 'GET';
   if (resource === '/files/upload') return method === 'POST';
+  if (resource === '/decks') return method === 'GET' || method === 'POST';
+  if (/^\/decks\/[a-z0-9-]{1,32}$/.test(resource)) {
+    return method === 'PUT' || method === 'PATCH' || method === 'DELETE';
+  }
+  if (resource === '/topology') return method === 'GET';
+  if (resource === '/settings/peering/invite') return method === 'POST';
   if (resource === '/ws') return method === 'GET';
   if (/^\/fleet\/(status|schema|definitions)$/.test(resource)) return method === 'GET';
-  if (/^\/fleet\/(up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell)$/.test(resource)) return method === 'POST';
+  if (/^\/fleet\/(up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-cell|edit-cell|remove-cell|restore-cells)$/.test(resource)) return method === 'POST';
   return false;
 }
 
@@ -103,7 +119,8 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
       return proxyHttp(req, res, { port: typeof localPort === 'function' ? localPort() : localPort, path: `/api${parsed.resource}${queryOf(req.url)}`, credential: localCredential() });
     }
     const next = st && store.getNode(st, parsed.route[0]);
-    if (!next || !next.token || (ingress && !canTransit(ingress, next))) return res.status(403).json({ error: 'route non consentita' });
+    const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
+    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return res.status(403).json({ error: 'route non consentita' });
     const rest = parsed.route.slice(1);
     const path = `/federation/route/${rest.length ? `${rest.join('/')}/` : ''}${ROUTE_DELIMITER}${parsed.resource}${queryOf(req.url)}`;
     proxyHttp(req, res, { port: next.localPort, path, credential: next.token, visited });
@@ -155,6 +172,14 @@ async function probeHealth({ port, token, expectedInstanceId = null, fetchImpl =
     } else if (expectedInstanceId && body.instanceId !== expectedInstanceId) {
       out.reachability = 'failed'; out.status = 'degraded'; out.detail = 'peer instanceId inatteso — tunnel/porta punta al nodo sbagliato';
     } else {
+      if (body.roles !== undefined) {
+        const roles = store.parseRoles(body.roles);
+        if (!roles) {
+          out.reachability = 'failed'; out.status = 'degraded'; out.detail = 'health roles non validi';
+          return out;
+        }
+        out.roles = roles; out.rolesKnown = true;
+      }
       out.reachability = 'ok'; out.status = 'healthy'; out.detail = 'ok';
     }
   } else if (r.status === 401) {
@@ -186,7 +211,11 @@ async function collectTopologyDetailed({ nodesPath, ingress = null, ttl = MAX_HO
   const out = [];
   const authoritative = [];
   for (const n of st.nodes) {
-    if (!n.nodeId || seen.has(n.nodeId) || (ingress && !canTransit(ingress, n))) continue;
+    // The local installation always keeps its outbound hub visible. Inbound
+    // clients become part of Hydra only after their explicit Share toggle.
+    if (!n.nodeId || seen.has(n.nodeId)
+      || (!ingress && n.direction === 'inbound' && n.shared !== true)
+      || (ingress && !canTransit(ingress, n))) continue;
     out.push({ instanceId: n.nodeId, name: n.name, route: [n.name], direct: true });
     if (ttl <= 1 || !n.token) continue;
     try {
@@ -226,7 +255,9 @@ async function collectTopology(opts) {
 async function collectLocalTopology({ nodesPath, cachePath, fetchImpl = fetch, now = Math.floor(Date.now() / 1000) }) {
   const live = await collectTopologyDetailed({ nodesPath, fetchImpl });
   const st = store.loadStore(nodesPath);
-  const directNames = new Set(((st && st.nodes) || []).map((n) => n.name));
+  const directNames = new Set(((st && st.nodes) || [])
+    .filter((n) => n.direction !== 'inbound' || n.shared === true)
+    .map((n) => n.name));
   const authoritative = new Set(live.authoritative);
   const liveIds = new Set(live.nodes.map((n) => n.instanceId));
   const liveRoutes = new Set(live.nodes.map((n) => n.route.join('/')));
@@ -256,7 +287,7 @@ async function collectLocalTopology({ nodesPath, cachePath, fetchImpl = fetch, n
   return { instanceId: live.instanceId, nodes };
 }
 
-function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly, version = null }) {
+function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly = () => false, version = null, roles = null }) {
   const r = express.Router();
   r.use((req, res, next) => {
     const peer = peerFromToken(nodesPath, bearerFrom(req));
@@ -269,13 +300,53 @@ function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly
   // reachability (payload). Nessun segreto in risposta.
   r.get('/health', (_req, res) => {
     const st = store.loadStore(nodesPath);
-    res.json({ ok: true, instanceId: (st && st.nodeId) || null, version, readonly: !!readonly() });
+    const advertisedRoles = typeof roles === 'function' ? roles() : null;
+    res.json({ ok: true, instanceId: (st && st.nodeId) || null, version, readonly: !!readonly(),
+      ...(advertisedRoles ? { roles: advertisedRoles } : {}) });
   });
   r.get('/topology', async (req, res) => {
     const ttl = Math.max(0, Math.min(MAX_HOPS, Number(req.query.ttl) || MAX_HOPS));
     const visited = String(req.query.visited || '').split(',');
     res.json(await collectTopology({ nodesPath, ingress: req.peer, ttl, visited, fetchImpl }));
   });
+  // A connected client publishes itself through the SAME SSH connection by
+  // toggling its optional -R channel. The hub records that intent only after a
+  // real authenticated health probe succeeds; Share off is immediate/fail-safe.
+  r.post('/share', express.json({ limit: '1kb' }), async (req, res) => {
+    if (readonly()) return res.status(403).json({ error: 'READONLY: share bloccato' });
+    const body = req.body || {};
+    if (Object.keys(body).some((k) => k !== 'shared') || typeof body.shared !== 'boolean') {
+      return res.status(400).json({ error: 'body non valido: atteso {shared:boolean}' });
+    }
+    try {
+      if (body.shared) {
+        const health = await probeHealth({
+          port: req.peer.localPort,
+          token: req.peer.token,
+          expectedInstanceId: req.peer.nodeId || null,
+          fetchImpl: fetchImpl || fetch,
+        });
+        if (health.status !== 'healthy') {
+          return res.status(409).json({
+            error: 'canale share non raggiungibile',
+            detail: health.detail || 'reverse SSH non pronto',
+          });
+        }
+      }
+      let st = store.loadOrInitStore(nodesPath);
+      const current = store.getNode(st, req.peer.name);
+      if (!current) return res.status(404).json({ error: 'peer non trovato' });
+      st = store.updateNode(st, current.name, {
+        shared: body.shared,
+        roles: { ...current.roles, node: body.shared },
+        rolesKnown: true,
+      });
+      store.atomicWriteStore(nodesPath, st);
+      return res.json({ shared: body.shared });
+    } catch (e) {
+      return res.status(500).json({ error: String(e && e.message || e) });
+    }
+  });
   r.use('/route', (req, res) => routeHandler({ nodesPath, localPort, localCredential, ingress: req.peer, readonly })(req, res));
   return r;
 }
@@ -297,7 +368,8 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
   let port = typeof localPort === 'function' ? localPort() : localPort; let credential = localCredential(); let path = '/ws';
   if (parsed.route.length) {
     const next = store.getNode(st, parsed.route[0]);
-    if (!next || !next.token || (ingress && !canTransit(ingress, next))) return reject(socket, 403);
+    const privateInbound = next && next.direction === 'inbound' && next.shared !== true;
+    if (!next || !next.token || privateInbound || (ingress && !canTransit(ingress, next))) return reject(socket, 403);
     port = next.localPort; credential = next.token;
     const rest = parsed.route.slice(1);
     path = `/federation/route/${rest.length ? `${rest.join('/')}/` : ''}${ROUTE_DELIMITER}/ws`;

package/lib/server.js

@@ -36,6 +36,7 @@ const { createPushService } = require('./notify/push.js');
 const { createAsksStore } = require('./notify/asks.js');
 const { createNotifier } = require('./notify/notifier.js');
 const { notifyRoutes } = require('./notify/routes.js');
+const { createNpmUpdater } = require('./update/manager.js');
 
 function sessionExists(tmuxBin, name) {
   if (typeof name !== 'string' || !/^[\w.@%:+-]{1,128}$/.test(name)) return false;
@@ -97,6 +98,13 @@ function createServer(opts = {}) {
   });
   const asksStore = createAsksStore({ dir: notifyDir });
   const notifier = createNotifier({ hub: eventsHub, push: pushSvc });
+  const updater = opts.updateManager || createNpmUpdater({
+    currentVersion: VERSION,
+    home: cfg.home || os.homedir(),
+    enabled: cfg.autoUpdate !== false,
+    readonly: bridgeReadonly(),
+    ...(cfg.updateSeams || {}),
+  });
   const attachedWs = new Map(); // ws -> session (per il push dei frame files)
   // selectProvider sceglie UNA volta (startup) il provider external|builtin|disabled
   // (design §4b/§9b/§9g) e ritorna {mode,reason,fleet}; routes consumano il .fleet,
@@ -121,30 +129,19 @@ function createServer(opts = {}) {
     return { localPort: node.localPort, token: node.token || null };
   }
 
-  // A node-role installation must republish itself after service/reboot. The
-  // detached supervisor is idempotent and owns retry/backoff independently.
-  if (cfg.roles && cfg.roles.node === true) {
-    const st = nodesStore.loadStore(nodesPath);
-    if (st && st.rendezvous) {
-      const tr = nodesTunnel.startReverse({
-        home: cfg.home || os.homedir(), rendezvous: st.rendezvous,
-        spawnImpl: cfg.tunnelSpawnImpl, spawnSyncImpl: cfg.tunnelSpawnSyncImpl,
-        sshBin: cfg.sshBin, logFd: cfg.tunnelLogFd,
-      });
-      if (!tr.started && tr.reason !== 'already running') {
-        process.stderr.write(`[nexuscrew] reverse tunnel autostart failed: ${tr.reason || 'unknown'}\n`);
-      }
-    }
-  }
-
-  // New Hydra peers are ordinary local+remote nodes. Only the side that owns
-  // the outbound SSH alias dials; inbound records are reached through its -R.
-  {
+  const runtimePort = () => (server && server.address() ? server.address().port : cfg.port);
+  let tunnelsStarted = false;
+  function startManagedTunnels() {
+    if (tunnelsStarted) return;
+    tunnelsStarted = true;
     const st = nodesStore.loadStore(nodesPath);
+    // Exactly one connection per configured hub. Legacy `roles.node` /
+    // rendezvous data is migration-only and never starts a second hidden SSH
+    // process. Publishing this device is the optional -R on its outbound link.
     for (const node of (st && st.nodes) || []) {
       if (node.direction !== 'inbound' && node.autostart === true) {
         const tr = nodesTunnel.startForward({
-          home: cfg.home || os.homedir(), node, localAppPort: cfg.port,
+          home: cfg.home || os.homedir(), node, localAppPort: runtimePort(),
           spawnImpl: cfg.tunnelSpawnImpl, spawnSyncImpl: cfg.tunnelSpawnSyncImpl,
           sshBin: cfg.sshBin, logFd: cfg.tunnelLogFd,
         });
@@ -243,15 +240,13 @@ function createServer(opts = {}) {
         const h = healths[i] || null;
         return { ...n, tunnel: nodesHealth.tunnelFromHealth(h), health: h };
       });
-      const out = { nodeId: view.nodeId, nodes };
-      if (view.rendezvous) out.rendezvous = view.rendezvous;
-      res.json(out);
+      res.json({ nodeId: view.nodeId, nodes });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   // Settings API B2 (design §4b(6)): read-only GET + mutanti lista chiusa per il
   // wizard/settings UI. Dietro lo stesso requireToken del router /api; il gate
   // READONLY route-level e la redazione token vivono dentro settingsRoutes.
-  api.use('/settings', settingsRoutes({ cfg, nodesPath, tokenStore, closeSessions }));
+  api.use('/settings', settingsRoutes({ cfg, nodesPath, tokenStore, closeSessions, updater, runtimePort }));
   api.get('/topology', async (_req, res) => {
     try { res.json(await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath })); }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
@@ -283,6 +278,8 @@ function createServer(opts = {}) {
   app.use('/api', api);
   app.use('/federation', federation.peerRouter({
     nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly, version: VERSION,
+    fetchImpl: healthFetch,
+    roles: () => require('./cli/commands.js').readRoles(cfg.configPath || configJsonPath()),
   }));
 
   // Reverse-proxy single-origin /node/<name>/… (design §4b(2)). Auth locale PRIMA
@@ -296,14 +293,18 @@ function createServer(opts = {}) {
   // per costruire path: validazione ^[a-z0-9-]{1,32}$, nome invalido → 404 secco
   // (niente traversal, niente fallback silenzioso alla SPA su nomi sporchi).
   const DECK_NAME_RE = /^[a-z0-9-]{1,32}$/;
+  const DECK_OWNER_RE = /^[a-f0-9]{16,64}$/;
   // Cattura TUTTO cio' che sta sotto /deck/ (anche slash/segmenti extra o encoded)
   // e valida il remainder: qualunque cosa non sia un nome deck strict → 404,
   // senza mai cadere nel catch-all SPA con un nome sporco.
   app.get(/^\/deck\/(.*)$/, (req, res) => {
     // parita' col client: deckFromPath accetta UN trailing slash (/deck/main/),
     // il server deve fare lo stesso; piu' di uno resta 404 (regex strict).
-    const name = req.params[0].replace(/\/$/, '');
-    if (!DECK_NAME_RE.test(name)) {
+    const value = req.params[0].replace(/\/$/, '');
+    const parts = value.split('/');
+    const valid = (parts.length === 1 && DECK_NAME_RE.test(parts[0]))
+      || (parts.length === 2 && DECK_OWNER_RE.test(parts[0]) && DECK_NAME_RE.test(parts[1]));
+    if (!valid) {
       return res.status(404).type('text/plain').send('invalid deck name');
     }
     return res.sendFile(path.join(distDir, 'index.html'));
@@ -314,7 +315,8 @@ function createServer(opts = {}) {
   // Close the watcher when the HTTP server closes. Registered HERE (inside
   // createServer) — not in start() — so every createServer consumer is covered,
   // not only the start() path. watcher.close() is idempotent.
-  server.on('close', () => { watcher.close(); previews.close(); eventsHub.closeAll(); });
+  server.on('listening', () => { updater.start(); startManagedTunnels(); });
+  server.on('close', () => { watcher.close(); previews.close(); eventsHub.closeAll(); updater.close(); });
   // noServer: gestiamo l'upgrade a mano per instradare /ws (locale) e /node/*
   // (proxy). Il WS locale resta identico; il proxy WS applica gli STESSI check
   // dell'HTTP (auth locale -> name strict -> inject token) prima del piping.
@@ -343,13 +345,13 @@ function createServer(opts = {}) {
       let u; try { u = new URL(req.url, 'http://127.0.0.1'); } catch (_) { return socket.destroy(); }
       const given = bearerFrom(req) || u.searchParams.get('token') || '';
       if (!verify(tokenHolder.value, given)) return socket.destroy();
-      federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: () => cfg.port, localCredential: () => tokenHolder.value, ingress: null, readonly: proxyReadonly, activeSockets: proxySockets });
+      federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: runtimePort, localCredential: () => tokenHolder.value, ingress: null, readonly: proxyReadonly, activeSockets: proxySockets });
       return;
     }
     if (pathname.startsWith('/federation/route/')) {
       const ingress = federation.peerFromToken(nodesPath, bearerFrom(req));
       if (!ingress) return socket.destroy();
-      federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: () => cfg.port, localCredential: () => tokenHolder.value, ingress, readonly: proxyReadonly, activeSockets: proxySockets });
+      federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: runtimePort, localCredential: () => tokenHolder.value, ingress, readonly: proxyReadonly, activeSockets: proxySockets });
       return;
     }
     if (pathname === '/node' || pathname.startsWith('/node/')) {
@@ -394,19 +396,25 @@ function createServer(opts = {}) {
     }
   });
 
-  return { app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP };
+  return { app, server, wss, cfg, token: tokenHolder.value, tokenStore, watcher, fleetP, updater };
 }
 
 function start(opts = {}) {
   const { server, cfg } = createServer(opts);
   const log = opts.log || console.log;
   const requestedPort = cfg.port;
+  const nodesPath = opts.nodesPath || nodesStore.defaultNodesPath(cfg.home || os.homedir());
+  const pairedPeers = nodesStore.hasPairedPeers(nodesStore.loadStore(nodesPath));
+  const listenError = (error) => {
+    if (typeof opts.onListenError === 'function') return opts.onListenError(error);
+    throw error;
+  };
   const onListening = () => {
     cfg.port = server.address().port;
     // Il token NON si stampa allo startup: finirebbe nei log del servizio
     // (journalctl/logfile). L'apertura autenticata passa da `nexuscrew show`.
     log(`nexuscrew on http://${cfg.bind}:${cfg.port}  (open with \`nexuscrew show\`)`);
-    log('localhost-only — reach it via SSH/autossh/VPN tunnel.');
+    log('localhost-only — reach it via a user-controlled SSH or VPN channel.');
   };
   const persistFallback = () => {
     const selected = server.address().port;
@@ -432,10 +440,17 @@ function start(opts = {}) {
   };
   server.once('error', (error) => {
     if (error && error.code === 'EADDRINUSE' && requestedPort !== 0 && opts.autoPort !== false) {
+      if (pairedPeers) {
+        const refused = new Error(`preferred port ${requestedPort} is busy; paired peers exist, refusing automatic port change`);
+        refused.code = 'EADDRINUSE_PAIRED';
+        refused.cause = error;
+        listenError(refused);
+        return;
+      }
       tryFallback(requestedPort >= 65535 ? 41820 : requestedPort + 1, 200);
       return;
     }
-    throw error;
+    listenError(error);
   });
   server.listen(requestedPort, cfg.bind, onListening);
   return server;