@mmmbuto/nexuscrew 0.8.9 → 0.8.10

package/lib/nodes/peering.js

@@ -7,6 +7,8 @@ const store = require('./store.js');
 
 const INVITE_TTL_MS = 10 * 60 * 1000;
 const REVERSE_PORT_BASE = 44001;
+const CAPABILITY_ID_RE = /^[a-f0-9]{64}$/;
+const CHALLENGE_RE = /^[A-Za-z0-9_-]{16,128}$/;
 
 function defaultInvitesPath(home) { return path.join(home, '.nexuscrew', 'invites.json'); }
 function defaultPendingPath(home) { return path.join(home, '.nexuscrew', 'pairing-pending.json'); }
@@ -162,21 +164,81 @@ function consumePending({ pendingPath, credential, now = Date.now() }) {
   return found;
 }
 
-// Probe di trasporto del tunnel -L provvisorio PRIMA di consumare l'invite
-// one-time: qualunque risposta HTTP dal peer attraverso la forward (anche un
-// 401 su /federation/health senza credenziali) dimostra che ssh+forward sono
-// vivi; un errore di rete no. Sostituisce lo sleep fisso 900ms: bounded, con
-// sleep iniettabile (deterministico nei test) e timeout per tentativo.
-async function probeTransportReady({ port, fetchImpl = fetch, attempts = 6, timeoutMs = 1500, sleep } = {}) {
+// Prova pubblica ma capability-bound usata durante il pairing. Il client NON
+// invia mai l'invito/credential: invia SHA256(SHA256(capability)) + challenge;
+// il peer cerca il record attivo e firma il challenge con SHA256(capability).
+// Un processo HTTP estraneo sulla stessa porta non puo' quindi diventare un
+// falso positivo e non riceve materiale sufficiente per consumare l'invito.
+function capabilityIdentity({ invitesPath, pendingPath, capabilityId, challenge, now = Date.now() } = {}) {
+  if (!CAPABILITY_ID_RE.test(String(capabilityId || '')) || !CHALLENGE_RE.test(String(challenge || ''))) return null;
+  const rows = [
+    ...readInvites(invitesPath, now),
+    ...readInvites(pendingPath, now),
+  ];
+  const row = rows.find((x) => {
+    if (!x || !CAPABILITY_ID_RE.test(String(x.hash || ''))) return false;
+    const id = crypto.createHash('sha256').update(Buffer.from(x.hash, 'hex')).digest('hex');
+    return safeEqual(id, capabilityId);
+  });
+  if (!row) return null;
+  return crypto.createHmac('sha256', Buffer.from(row.hash, 'hex')).update(challenge).digest('base64url');
+}
+
+function capabilityProbeMaterial(capability, randomBytes = crypto.randomBytes) {
+  if (!store.validToken(capability)) return null;
+  const key = crypto.createHash('sha256').update(capability).digest();
+  return {
+    key,
+    capabilityId: crypto.createHash('sha256').update(key).digest('hex'),
+    challenge: randomBytes(24).toString('base64url'),
+  };
+}
+
+// Probe di trasporto del tunnel -L PRIMA di consumare l'invito e dopo il
+// restart negoziato. Oltre alla reachability verifica prova capability e
+// instanceId atteso. Bounded, con sleep/random iniettabili per test.
+async function probeTransportReady({
+  port, capability, expectedInstanceId, fetchImpl = fetch, attempts = 6,
+  timeoutMs = 1500, sleep, randomBytes,
+} = {}) {
   const wait = typeof sleep === 'function' ? sleep : (ms) => new Promise((r) => setTimeout(r, ms));
+  const material = capabilityProbeMaterial(capability, randomBytes);
+  if (!store.isPort(port) || !material || !store.NODE_ID_RE.test(String(expectedInstanceId || ''))) {
+    return { ready: false, attempts: 0, code: 'identity-probe-invalid', lastError: 'parametri identity probe non validi' };
+  }
   let lastError = '';
+  let code = 'transport-not-ready';
   for (let i = 0; i < attempts; i += 1) {
     let timer;
     try {
       const ctrl = new AbortController();
       timer = setTimeout(() => ctrl.abort(), timeoutMs);
-      await fetchImpl(`http://127.0.0.1:${port}/federation/health`, { signal: ctrl.signal });
-      return { ready: true, attempts: i + 1 };
+      const response = await fetchImpl(`http://127.0.0.1:${port}/pair/identity`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ capabilityId: material.capabilityId, challenge: material.challenge }),
+        signal: ctrl.signal,
+      });
+      if (!response || response.status !== 200) {
+        code = 'identity-proof-rejected';
+        throw new Error(`identity probe HTTP ${(response && response.status) || '?'}`);
+      }
+      const body = await response.json().catch(() => null);
+      if (!body || body.ok !== true || !store.NODE_ID_RE.test(String(body.instanceId || ''))
+        || typeof body.proof !== 'string') {
+        code = 'identity-proof-invalid';
+        throw new Error('identity probe payload non valido');
+      }
+      if (body.instanceId !== expectedInstanceId) {
+        code = 'peer-identity-mismatch';
+        throw new Error('instanceId del peer non coincide con il link');
+      }
+      const expected = crypto.createHmac('sha256', material.key).update(material.challenge).digest('base64url');
+      if (!safeEqual(expected, body.proof)) {
+        code = 'identity-proof-invalid';
+        throw new Error('prova crittografica del peer non valida');
+      }
+      return { ready: true, attempts: i + 1, instanceId: body.instanceId };
     } catch (e) {
       lastError = String((e && e.message) || e);
     } finally {
@@ -184,12 +246,12 @@ async function probeTransportReady({ port, fetchImpl = fetch, attempts = 6, time
     }
     if (i < attempts - 1) await wait(250 * (i + 1));
   }
-  return { ready: false, attempts, lastError };
+  return { ready: false, attempts, code, lastError };
 }
 
 module.exports = {
   INVITE_TTL_MS, REVERSE_PORT_BASE, defaultInvitesPath, defaultPendingPath, safeEqual,
   readInvites, writeInvites, encodePairing, decodePairing, parsePairingUrl,
   createInvite, consumeInvite, allocateReversePort, createPending, consumePending,
-  probeTransportReady,
+  capabilityIdentity, capabilityProbeMaterial, probeTransportReady,
 };

package/lib/nodes/store.js

@@ -104,7 +104,7 @@ const LABEL_MAX = 64;
 const NODE_KEYS = new Set([
   'name', 'ssh', 'sshPort', 'remotePort', 'localPort', 'keyPath', 'identityFile',
   'roles', 'rolesKnown', 'token', 'acceptToken', 'nodeId', 'transport', 'autostart', 'visibility', 'selected',
-  'direction', 'reversePort', 'label',
+  'direction', 'reversePort', 'shared', 'label',
 ]);
 function parseNode(n, schemaVersion = SCHEMA_VERSION) {
   if (!n || typeof n !== 'object' || Array.isArray(n)) return null;
@@ -148,12 +148,18 @@ function parseNode(n, schemaVersion = SCHEMA_VERSION) {
     direction,
     transport: n.transport || (direction === 'inbound' ? 'inbound' : (schemaVersion === LEGACY_SCHEMA_VERSION ? 'ssh' : 'auto')),
     autostart: n.autostart === undefined ? schemaVersion !== LEGACY_SCHEMA_VERSION : n.autostart,
+    // A paired device is private by default. `shared` only controls whether the
+    // hub may advertise/route this peer and whether the outbound SSH session
+    // requests the optional reverse (-R) channel. Old stores therefore migrate
+    // safely to private without a schema bump.
+    shared: n.shared === undefined ? false : n.shared,
     visibility: n.visibility || 'network',
   };
   if (!['auto', 'ssh', 'autossh', 'inbound'].includes(out.transport)) return null;
   if (direction === 'inbound' && out.transport !== 'inbound') return null;
   if (direction === 'outbound' && out.transport === 'inbound') return null;
   if (typeof out.autostart !== 'boolean') return null;
+  if (typeof out.shared !== 'boolean') return null;
   if (!['network', 'relay-only', 'selected'].includes(out.visibility)) return null;
   if (identityFile) out.identityFile = identityFile;
   // Keep the old public field while reading v1 so old callers/tests and a
@@ -188,7 +194,9 @@ function parseNode(n, schemaVersion = SCHEMA_VERSION) {
   return out;
 }
 
-// rendezvous (ruolo node/reverse): dove questa installazione si pubblica.
+// Legacy rendezvous record: read-only migration data from pre-0.8.10. It is
+// parsed so an existing store remains loadable, but no new runtime path writes
+// or starts it.
 const RDV_KEYS = new Set(['ssh', 'publishedPort', 'localPort', 'keyPath']);
 function parseRendezvous(r) {
   if (!r || typeof r !== 'object' || Array.isArray(r)) return null;
@@ -362,18 +370,6 @@ function updateNode(store, name, patch) {
   return { ...store, schemaVersion: SCHEMA_VERSION, nodes };
 }
 
-function setRendezvous(store, rdv) {
-  const parsed = parseRendezvous(rdv);
-  if (!parsed) throw new Error('rendezvous non valido: controlla ssh/publishedPort/localPort/keyPath');
-  return { ...store, schemaVersion: SCHEMA_VERSION, rendezvous: parsed };
-}
-
-function clearRendezvous(store) {
-  const out = { ...store, schemaVersion: SCHEMA_VERSION };
-  delete out.rendezvous;
-  return out;
-}
-
 // --- Redazione (view sicura per status/list: MAI il token) ------------------
 
 function redactNode(n) {
@@ -388,6 +384,7 @@ function redactNode(n) {
     rolesKnown: n.rolesKnown === true,
     transport: n.transport || 'ssh',
     autostart: !!n.autostart,
+    shared: n.shared === true,
     visibility: n.visibility || 'network',
     hasToken: !!n.token, // presenza, non il valore
     paired: !!(n.token && n.acceptToken),
@@ -405,11 +402,17 @@ function redactStore(store) {
     nodeId: store.nodeId,
     nodes: store.nodes.map(redactNode),
   };
-  // rendezvous non contiene token: sicuro da esporre integralmente.
-  if (store.rendezvous) out.rendezvous = { ...store.rendezvous };
   return out;
 }
 
+// A peer with both scoped credentials has completed pairing. Its advertised
+// HTTP port is part of the established SSH/federation contract; silently
+// moving that port would strand the peer even though the local PWA still works.
+function hasPairedPeers(store) {
+  return !!(store && Array.isArray(store.nodes)
+    && store.nodes.some((node) => validToken(node.token) && validToken(node.acceptToken)));
+}
+
 // --- Migrazione esplicita da config.json (guarded, no-op se assente) ---------
 // Se config.json contiene un array `nodes` legacy (vecchio formato pre-B0),
 // lo importa in nodes.json. Guarded: no-op se config.json non ha `nodes`, o se
@@ -497,9 +500,9 @@ module.exports = {
   // I/O
   defaultNodesPath, loadStore, atomicWriteStore, loadOrInitStore, emptyStore, newNodeId,
   // mutazioni
-  getNode, addNode, removeNode, setNodeToken, updateNode, setRendezvous, clearRendezvous,
+  getNode, addNode, removeNode, setNodeToken, updateNode,
   // redazione
-  redactNode, redactStore,
+  redactNode, redactStore, hasPairedPeers,
   // migrazione
   migrateLegacyNodes,
   // label / slug

package/lib/nodes/tunnel-supervisor.js

@@ -10,7 +10,11 @@ const { backoffDelay } = require('./tunnel.js');
 const sshBin = process.argv[2];
 const sshArgs = process.argv.slice(3);
 const statePath = process.env.NEXUSCREW_TUNNEL_STATE;
-if (!sshBin || !statePath) process.exit(2);
+const pidPath = process.env.NEXUSCREW_TUNNEL_PIDFILE;
+const runId = process.env.NEXUSCREW_TUNNEL_RUN_ID;
+const stableMsRaw = Number(process.env.NEXUSCREW_TUNNEL_STABLE_MS || 3000);
+const stableMs = Number.isFinite(stableMsRaw) && stableMsRaw >= 100 ? Math.min(stableMsRaw, 30000) : 3000;
+if (!sshBin || !statePath || !pidPath || !runId) process.exit(2);
 
 let child = null;
 let stopping = false;
@@ -18,16 +22,26 @@ let attempt = 0;
 let retryTimer = null;
 let upTimer = null;
 
+function ownsGeneration() {
+  try {
+    const meta = JSON.parse(fs.readFileSync(pidPath, 'utf8'));
+    return meta && meta.pid === process.pid && meta.runId === runId;
+  } catch (_) { return false; }
+}
+
 function writeState(status, extra = {}) {
-  const tmp = `${statePath}.tmp.${process.pid}`;
-  const data = { status, supervisorPid: process.pid, attempt, updatedAt: Date.now(), ...extra };
+  if (!ownsGeneration()) return false;
+  const tmp = `${statePath}.tmp.${process.pid}.${runId}`;
+  const data = { status, runId, transport: path.basename(sshBin), supervisorPid: process.pid, attempt, updatedAt: Date.now(), ...extra };
   try {
     fs.mkdirSync(path.dirname(statePath), { recursive: true });
     fs.writeFileSync(tmp, `${JSON.stringify(data)}\n`, { mode: 0o600 });
     fs.chmodSync(tmp, 0o600);
     fs.renameSync(tmp, statePath);
+    return true;
   } catch (_) {
     try { fs.unlinkSync(tmp); } catch (_e) {}
+    return false;
   }
 }
 
@@ -58,14 +72,15 @@ function run() {
     scheduleRetry(detail);
   };
   child.once('spawn', () => {
-    // ExitOnForwardFailure makes bind/auth failures exit. Surviving this short
-    // grace window is the best portable readiness signal available for ssh -N.
+    // ExitOnForwardFailure makes bind/auth failures exit. Do not reset backoff
+    // or advertise readiness on the spawn event: only a stable transport window
+    // qualifies as transport-ready; HTTP federation health is checked above us.
     upTimer = setTimeout(() => {
       if (!stopping && child && child.exitCode == null) {
         attempt = 0;
-        writeState('up', { sshPid: child.pid });
+        writeState('transport-ready', { sshPid: child.pid, stableMs });
       }
-    }, 750);
+    }, stableMs);
   });
   child.once('error', (e) => {
     handleFailure(String(e && e.message || e));
@@ -79,8 +94,13 @@ function run() {
 function finish() {
   clearTimeout(retryTimer);
   clearTimeout(upTimer);
-  writeState('down');
-  try { fs.unlinkSync(statePath); } catch (_) {}
+  if (ownsGeneration()) {
+    writeState('down');
+    try {
+      const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+      if (state.runId === runId && state.supervisorPid === process.pid) fs.unlinkSync(statePath);
+    } catch (_) {}
+  }
   process.exit(0);
 }