@mmmbuto/nexuscrew 0.8.9 → 0.8.10

package/lib/server.js

@@ -129,30 +129,19 @@ function createServer(opts = {}) {
     return { localPort: node.localPort, token: node.token || null };
   }
 
-  // A node-role installation must republish itself after service/reboot. The
-  // detached supervisor is idempotent and owns retry/backoff independently.
-  if (cfg.roles && cfg.roles.node === true) {
-    const st = nodesStore.loadStore(nodesPath);
-    if (st && st.rendezvous) {
-      const tr = nodesTunnel.startReverse({
-        home: cfg.home || os.homedir(), rendezvous: st.rendezvous,
-        spawnImpl: cfg.tunnelSpawnImpl, spawnSyncImpl: cfg.tunnelSpawnSyncImpl,
-        sshBin: cfg.sshBin, logFd: cfg.tunnelLogFd,
-      });
-      if (!tr.started && tr.reason !== 'already running') {
-        process.stderr.write(`[nexuscrew] reverse tunnel autostart failed: ${tr.reason || 'unknown'}\n`);
-      }
-    }
-  }
-
-  // New Hydra peers are ordinary local+remote nodes. Only the side that owns
-  // the outbound SSH alias dials; inbound records are reached through its -R.
-  {
+  const runtimePort = () => (server && server.address() ? server.address().port : cfg.port);
+  let tunnelsStarted = false;
+  function startManagedTunnels() {
+    if (tunnelsStarted) return;
+    tunnelsStarted = true;
     const st = nodesStore.loadStore(nodesPath);
+    // Exactly one connection per configured hub. Legacy `roles.node` /
+    // rendezvous data is migration-only and never starts a second hidden SSH
+    // process. Publishing this device is the optional -R on its outbound link.
     for (const node of (st && st.nodes) || []) {
       if (node.direction !== 'inbound' && node.autostart === true) {
         const tr = nodesTunnel.startForward({
-          home: cfg.home || os.homedir(), node, localAppPort: cfg.port,
+          home: cfg.home || os.homedir(), node, localAppPort: runtimePort(),
           spawnImpl: cfg.tunnelSpawnImpl, spawnSyncImpl: cfg.tunnelSpawnSyncImpl,
           sshBin: cfg.sshBin, logFd: cfg.tunnelLogFd,
         });
@@ -251,15 +240,13 @@ function createServer(opts = {}) {
         const h = healths[i] || null;
         return { ...n, tunnel: nodesHealth.tunnelFromHealth(h), health: h };
       });
-      const out = { nodeId: view.nodeId, nodes };
-      if (view.rendezvous) out.rendezvous = view.rendezvous;
-      res.json(out);
+      res.json({ nodeId: view.nodeId, nodes });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
   // Settings API B2 (design §4b(6)): read-only GET + mutanti lista chiusa per il
   // wizard/settings UI. Dietro lo stesso requireToken del router /api; il gate
   // READONLY route-level e la redazione token vivono dentro settingsRoutes.
-  api.use('/settings', settingsRoutes({ cfg, nodesPath, tokenStore, closeSessions, updater }));
+  api.use('/settings', settingsRoutes({ cfg, nodesPath, tokenStore, closeSessions, updater, runtimePort }));
   api.get('/topology', async (_req, res) => {
     try { res.json(await federation.collectLocalTopology({ nodesPath, cachePath: topologyCachePath })); }
     catch (e) { res.status(500).json({ error: String(e.message || e) }); }
@@ -291,6 +278,7 @@ function createServer(opts = {}) {
   app.use('/api', api);
   app.use('/federation', federation.peerRouter({
     nodesPath, localPort: () => (server && server.address() ? server.address().port : cfg.port), localCredential: () => tokenHolder.value, readonly: proxyReadonly, version: VERSION,
+    fetchImpl: healthFetch,
     roles: () => require('./cli/commands.js').readRoles(cfg.configPath || configJsonPath()),
   }));
 
@@ -305,14 +293,18 @@ function createServer(opts = {}) {
   // per costruire path: validazione ^[a-z0-9-]{1,32}$, nome invalido → 404 secco
   // (niente traversal, niente fallback silenzioso alla SPA su nomi sporchi).
   const DECK_NAME_RE = /^[a-z0-9-]{1,32}$/;
+  const DECK_OWNER_RE = /^[a-f0-9]{16,64}$/;
   // Cattura TUTTO cio' che sta sotto /deck/ (anche slash/segmenti extra o encoded)
   // e valida il remainder: qualunque cosa non sia un nome deck strict → 404,
   // senza mai cadere nel catch-all SPA con un nome sporco.
   app.get(/^\/deck\/(.*)$/, (req, res) => {
     // parita' col client: deckFromPath accetta UN trailing slash (/deck/main/),
     // il server deve fare lo stesso; piu' di uno resta 404 (regex strict).
-    const name = req.params[0].replace(/\/$/, '');
-    if (!DECK_NAME_RE.test(name)) {
+    const value = req.params[0].replace(/\/$/, '');
+    const parts = value.split('/');
+    const valid = (parts.length === 1 && DECK_NAME_RE.test(parts[0]))
+      || (parts.length === 2 && DECK_OWNER_RE.test(parts[0]) && DECK_NAME_RE.test(parts[1]));
+    if (!valid) {
       return res.status(404).type('text/plain').send('invalid deck name');
     }
     return res.sendFile(path.join(distDir, 'index.html'));
@@ -323,7 +315,7 @@ function createServer(opts = {}) {
   // Close the watcher when the HTTP server closes. Registered HERE (inside
   // createServer) — not in start() — so every createServer consumer is covered,
   // not only the start() path. watcher.close() is idempotent.
-  server.on('listening', () => updater.start());
+  server.on('listening', () => { updater.start(); startManagedTunnels(); });
   server.on('close', () => { watcher.close(); previews.close(); eventsHub.closeAll(); updater.close(); });
   // noServer: gestiamo l'upgrade a mano per instradare /ws (locale) e /node/*
   // (proxy). Il WS locale resta identico; il proxy WS applica gli STESSI check
@@ -353,13 +345,13 @@ function createServer(opts = {}) {
       let u; try { u = new URL(req.url, 'http://127.0.0.1'); } catch (_) { return socket.destroy(); }
       const given = bearerFrom(req) || u.searchParams.get('token') || '';
       if (!verify(tokenHolder.value, given)) return socket.destroy();
-      federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: () => cfg.port, localCredential: () => tokenHolder.value, ingress: null, readonly: proxyReadonly, activeSockets: proxySockets });
+      federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: runtimePort, localCredential: () => tokenHolder.value, ingress: null, readonly: proxyReadonly, activeSockets: proxySockets });
       return;
     }
     if (pathname.startsWith('/federation/route/')) {
       const ingress = federation.peerFromToken(nodesPath, bearerFrom(req));
       if (!ingress) return socket.destroy();
-      federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: () => cfg.port, localCredential: () => tokenHolder.value, ingress, readonly: proxyReadonly, activeSockets: proxySockets });
+      federation.forwardUpgrade({ req, socket, head, nodesPath, localPort: runtimePort, localCredential: () => tokenHolder.value, ingress, readonly: proxyReadonly, activeSockets: proxySockets });
       return;
     }
     if (pathname === '/node' || pathname.startsWith('/node/')) {
@@ -411,12 +403,18 @@ function start(opts = {}) {
   const { server, cfg } = createServer(opts);
   const log = opts.log || console.log;
   const requestedPort = cfg.port;
+  const nodesPath = opts.nodesPath || nodesStore.defaultNodesPath(cfg.home || os.homedir());
+  const pairedPeers = nodesStore.hasPairedPeers(nodesStore.loadStore(nodesPath));
+  const listenError = (error) => {
+    if (typeof opts.onListenError === 'function') return opts.onListenError(error);
+    throw error;
+  };
   const onListening = () => {
     cfg.port = server.address().port;
     // Il token NON si stampa allo startup: finirebbe nei log del servizio
     // (journalctl/logfile). L'apertura autenticata passa da `nexuscrew show`.
     log(`nexuscrew on http://${cfg.bind}:${cfg.port}  (open with \`nexuscrew show\`)`);
-    log('localhost-only — reach it via SSH/autossh/VPN tunnel.');
+    log('localhost-only — reach it via a user-controlled SSH or VPN channel.');
   };
   const persistFallback = () => {
     const selected = server.address().port;
@@ -442,10 +440,17 @@ function start(opts = {}) {
   };
   server.once('error', (error) => {
     if (error && error.code === 'EADDRINUSE' && requestedPort !== 0 && opts.autoPort !== false) {
+      if (pairedPeers) {
+        const refused = new Error(`preferred port ${requestedPort} is busy; paired peers exist, refusing automatic port change`);
+        refused.code = 'EADDRINUSE_PAIRED';
+        refused.cause = error;
+        listenError(refused);
+        return;
+      }
       tryFallback(requestedPort >= 65535 ? 41820 : requestedPort + 1, 200);
       return;
     }
-    throw error;
+    listenError(error);
   });
   server.listen(requestedPort, cfg.bind, onListening);
   return server;