@prosopo/provider 4.15.17 → 5.0.0

package/dist/cjs/tasks/detection/bundlePool.cjs

@@ -0,0 +1,220 @@
+let node_crypto = require("node:crypto");
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+//#region src/tasks/detection/bundlePool.ts
+/**
+* Detector bundle pool (provider side).
+*
+* Loads a pool of precomputed, obfuscated detector bundles from disk and caches
+* them in memory — the Node analogue of the Rust "bumblebee" `bundle_manager`.
+* Each bundle is a `{id}.js` (served to the browser) paired with a `{id}.json`
+* (`{ privateKey, innerConfig }`, kept server-side) produced by the catcher
+* `bundle:pool` build script.
+*
+* A bundle is assigned per detector session by {@link DetectorBundlePool.pickRandom},
+* served by id, and resolved again at decryption time so the provider uses the
+* single correct keypair + inner config rather than brute-forcing a key pool.
+* The session→bundle binding lives in Redis (short TTL); this module only holds
+* the immutable pool.
+*/
+/**
+* Default on-disk location of the pool inside the provider container. Backed by
+* a host volume (see docker-compose.provider.yml) so a pushed pool survives
+* container restarts — nothing is baked into the image, which matters because
+* `prosopo/provider` is a public Docker Hub image and each bundle ships with its
+* own RSA private key.
+*/
+var DEFAULT_DETECTOR_POOL_DIR = "/app/data/detector-pool";
+/**
+* In-memory pool of detector bundles. Immutable after {@link loadFromDir} except
+* via {@link replace} (used by the admin "emergency push" endpoint to hot-swap
+* the pool without a redeploy).
+*/
+var DetectorBundlePool = class {
+	constructor() {
+		this.bundles = /* @__PURE__ */ new Map();
+		this.ids = [];
+	}
+	/**
+	* Load every `{id}.js`/`{id}.json` pair from `dir` into memory. A `.js`
+	* without a readable, well-formed `.json` sibling is skipped (logged). Safe
+	* to call on a missing directory (yields an empty pool).
+	*/
+	loadFromDir(dir, logger = {}, expectedRelease) {
+		const next = /* @__PURE__ */ new Map();
+		if (!(0, node_fs.existsSync)(dir)) {
+			logger.warn?.("bundle pool directory does not exist", { dir });
+			this.bundles = next;
+			this.ids = [];
+			return;
+		}
+		let mismatched = 0;
+		let unstamped = 0;
+		for (const entry of (0, node_fs.readdirSync)(dir)) {
+			if ((0, node_path.extname)(entry) !== ".js") continue;
+			const bundleId = entry.slice(0, -3);
+			const jsPath = (0, node_path.join)(dir, entry);
+			const jsonPath = (0, node_path.join)(dir, `${bundleId}.json`);
+			try {
+				const js = (0, node_fs.readFileSync)(jsPath, "utf8");
+				const secrets = JSON.parse((0, node_fs.readFileSync)(jsonPath, "utf8"));
+				if (typeof secrets.privateKey !== "string" || typeof secrets.innerConfig !== "string") {
+					logger.warn?.("bundle pool entry has malformed secrets", { bundleId });
+					continue;
+				}
+				const release = typeof secrets.release === "string" ? secrets.release : void 0;
+				if (expectedRelease && release && release !== expectedRelease) {
+					mismatched++;
+					continue;
+				}
+				if (expectedRelease && !release) unstamped++;
+				next.set(bundleId, {
+					js,
+					privateKey: secrets.privateKey,
+					innerConfig: secrets.innerConfig,
+					...release && { release }
+				});
+			} catch (error) {
+				logger.warn?.("failed to load bundle pool entry", {
+					bundleId,
+					error: error instanceof Error ? error.message : String(error)
+				});
+			}
+		}
+		if (mismatched > 0) logger.warn?.("skipped bundle pool entries built for another release", {
+			skipped: mismatched,
+			expectedRelease
+		});
+		if (unstamped > 0) logger.warn?.("bundle pool entries have no release stamp", {
+			count: unstamped,
+			expectedRelease
+		});
+		this.replace(next);
+		logger.info?.("bundle pool loaded", {
+			count: this.ids.length,
+			dir
+		});
+	}
+	/** Hot-swap the entire pool (used by the admin replace-pool endpoint). */
+	replace(bundles) {
+		this.bundles = bundles;
+		this.ids = [...bundles.keys()].sort();
+	}
+	/** Number of loaded bundles. */
+	size() {
+		return this.ids.length;
+	}
+	/**
+	* Pick a uniformly-random bundle. Throws if the pool is empty — the caller
+	* must surface this as a hard failure (no bundle ⇒ no valid payload can be
+	* produced).
+	*/
+	pickRandom() {
+		if (this.ids.length === 0) throw new Error("detector bundle pool is empty");
+		const bundleId = this.ids[(0, node_crypto.randomInt)(this.ids.length)];
+		const bundle = bundleId !== void 0 ? this.bundles.get(bundleId) : void 0;
+		if (bundleId === void 0 || !bundle) throw new Error("detector bundle pool selection failed");
+		return {
+			bundleId,
+			bundle
+		};
+	}
+	/** Resolve a bundle by id, or `undefined` if it is not (or no longer) in the pool. */
+	get(bundleId) {
+		return this.bundles.get(bundleId);
+	}
+};
+/** Process-global pool singleton (mirrors bumblebee's OnceCell). */
+var globalPool = null;
+/** Where {@link initDetectorBundlePool} last loaded from — the persist target. */
+var globalPoolDir = DEFAULT_DETECTOR_POOL_DIR;
+/** Initialise the global pool from `dir`. Idempotent (reloads on each call). */
+function initDetectorBundlePool(dir, logger = {}, expectedRelease) {
+	const pool = new DetectorBundlePool();
+	pool.loadFromDir(dir, logger, expectedRelease);
+	globalPool = pool;
+	globalPoolDir = dir;
+	return pool;
+}
+/**
+* Write a pool to `dir` in the same `{id}.js` / `{id}.json` layout
+* {@link DetectorBundlePool.loadFromDir} reads, so a pushed pool is picked up
+* again on the next boot instead of vanishing with the process.
+*
+* Writes *into* `dir` and never replaces the directory itself. In the provider
+* container `dir` is a bind-mount point, and removing or renaming over a mount
+* point from inside the container fails with EBUSY ("Device or resource busy")
+* — which is exactly what an earlier stage-into-a-sibling-and-rename version of
+* this function did on every push.
+*
+* Each file is still written to a temp name and renamed into place, so a reader
+* never observes a partially-written bundle; renames within one directory are
+* atomic and don't touch the mount. Bundles no longer in the pool are then
+* pruned, giving replace semantics rather than an ever-growing merge.
+*
+* Throws on failure — the caller decides whether an unpersisted push is
+* acceptable.
+*/
+function persistDetectorBundlePool(bundles, dir = globalPoolDir) {
+	(0, node_fs.mkdirSync)(dir, { recursive: true });
+	const written = /* @__PURE__ */ new Set();
+	for (const [bundleId, bundle] of bundles) {
+		const jsName = `${bundleId}.js`;
+		const jsonName = `${bundleId}.json`;
+		const jsTmp = (0, node_path.join)(dir, `.${jsName}.tmp`);
+		(0, node_fs.writeFileSync)(jsTmp, bundle.js, "utf8");
+		(0, node_fs.renameSync)(jsTmp, (0, node_path.join)(dir, jsName));
+		const jsonTmp = (0, node_path.join)(dir, `.${jsonName}.tmp`);
+		(0, node_fs.writeFileSync)(jsonTmp, JSON.stringify({
+			privateKey: bundle.privateKey,
+			innerConfig: bundle.innerConfig,
+			...bundle.release && { release: bundle.release }
+		}), {
+			encoding: "utf8",
+			mode: 384
+		});
+		(0, node_fs.renameSync)(jsonTmp, (0, node_path.join)(dir, jsonName));
+		written.add(jsName);
+		written.add(jsonName);
+	}
+	for (const entry of (0, node_fs.readdirSync)(dir)) if (((0, node_path.extname)(entry) === ".js" || (0, node_path.extname)(entry) === ".json") && !written.has(entry)) (0, node_fs.rmSync)((0, node_path.join)(dir, entry), { force: true });
+}
+/** Get the global pool, or `null` if {@link initDetectorBundlePool} was never called. */
+function getDetectorBundlePool() {
+	return globalPool;
+}
+/**
+* Hot-swap the global pool's contents (admin "emergency push" channel) and
+* write it to the pool directory so it survives a restart. Creates the global
+* pool if it does not exist yet.
+*
+* The in-memory swap happens first and is never rolled back: a running provider
+* serving the new pool is the point of the push, and it is strictly better than
+* a provider serving the old one. A failed persist is reported so the caller can
+* warn — the pool is live but will be lost on the next restart.
+*/
+function replaceDetectorBundlePool(bundles, logger = {}) {
+	if (!globalPool) globalPool = new DetectorBundlePool();
+	globalPool.replace(bundles);
+	let persisted = false;
+	try {
+		persistDetectorBundlePool(bundles);
+		persisted = true;
+	} catch (error) {
+		logger.warn?.("failed to persist detector bundle pool to disk", {
+			dir: globalPoolDir,
+			error: error instanceof Error ? error.message : String(error)
+		});
+	}
+	return {
+		count: globalPool.size(),
+		persisted
+	};
+}
+//#endregion
+exports.DEFAULT_DETECTOR_POOL_DIR = DEFAULT_DETECTOR_POOL_DIR;
+exports.DetectorBundlePool = DetectorBundlePool;
+exports.getDetectorBundlePool = getDetectorBundlePool;
+exports.initDetectorBundlePool = initDetectorBundlePool;
+exports.persistDetectorBundlePool = persistDetectorBundlePool;
+exports.replaceDetectorBundlePool = replaceDetectorBundlePool;