@push.rocks/smartproxy 10.2.0 → 11.0.0

package/ts/smartproxy/classes.pp.domainconfigmanager.ts

@@ -1,5 +1,7 @@
 import * as plugins from '../plugins.js';
 import type { IDomainConfig, ISmartProxyOptions } from './classes.pp.interfaces.js';
+import type { ForwardingType, IForwardConfig, IForwardingHandler } from './types/forwarding.types.js';
+import { ForwardingHandlerFactory } from './forwarding/forwarding.factory.js';
 
 /**
  * Manages domain configurations and target selection
@@ -7,7 +9,10 @@ import type { IDomainConfig, ISmartProxyOptions } from './classes.pp.interfaces.
 export class DomainConfigManager {
   // Track round-robin indices for domain configs
   private domainTargetIndices: Map<IDomainConfig, number> = new Map();
-  
+
+  // Cache forwarding handlers for each domain config
+  private forwardingHandlers: Map<IDomainConfig, IForwardingHandler> = new Map();
+
   constructor(private settings: ISmartProxyOptions) {}
   
   /**
@@ -15,7 +20,7 @@ export class DomainConfigManager {
    */
   public updateDomainConfigs(newDomainConfigs: IDomainConfig[]): void {
     this.settings.domainConfigs = newDomainConfigs;
-    
+
     // Reset target indices for removed configs
     const currentConfigSet = new Set(newDomainConfigs);
     for (const [config] of this.domainTargetIndices) {
@@ -23,6 +28,31 @@ export class DomainConfigManager {
         this.domainTargetIndices.delete(config);
       }
     }
+
+    // Clear handlers for removed configs and create handlers for new configs
+    const handlersToRemove: IDomainConfig[] = [];
+    for (const [config] of this.forwardingHandlers) {
+      if (!currentConfigSet.has(config)) {
+        handlersToRemove.push(config);
+      }
+    }
+
+    // Remove handlers that are no longer needed
+    for (const config of handlersToRemove) {
+      this.forwardingHandlers.delete(config);
+    }
+
+    // Create handlers for new configs
+    for (const config of newDomainConfigs) {
+      if (!this.forwardingHandlers.has(config)) {
+        try {
+          const handler = this.createForwardingHandler(config);
+          this.forwardingHandlers.set(config, handler);
+        } catch (err) {
+          console.log(`Error creating forwarding handler for domain ${config.domains.join(', ')}: ${err}`);
+        }
+      }
+    }
   }
   
   /**
@@ -48,10 +78,12 @@ export class DomainConfigManager {
    */
   public findDomainConfigForPort(port: number): IDomainConfig | undefined {
     return this.settings.domainConfigs.find(
-      (domain) =>
-        domain.portRanges &&
-        domain.portRanges.length > 0 &&
-        this.isPortInRanges(port, domain.portRanges)
+      (domain) => {
+        const portRanges = domain.forwarding?.advanced?.portRanges;
+        return portRanges &&
+               portRanges.length > 0 &&
+               this.isPortInRanges(port, portRanges);
+      }
     );
   }
   
@@ -66,48 +98,102 @@ export class DomainConfigManager {
    * Get target IP with round-robin support
    */
   public getTargetIP(domainConfig: IDomainConfig): string {
-    if (domainConfig.targetIPs && domainConfig.targetIPs.length > 0) {
+    const targetHosts = Array.isArray(domainConfig.forwarding.target.host)
+      ? domainConfig.forwarding.target.host
+      : [domainConfig.forwarding.target.host];
+
+    if (targetHosts.length > 0) {
       const currentIndex = this.domainTargetIndices.get(domainConfig) || 0;
-      const ip = domainConfig.targetIPs[currentIndex % domainConfig.targetIPs.length];
+      const ip = targetHosts[currentIndex % targetHosts.length];
       this.domainTargetIndices.set(domainConfig, currentIndex + 1);
       return ip;
     }
-    
+
     return this.settings.targetIP || 'localhost';
   }
+
+  /**
+   * Get target host with round-robin support (for tests)
+   * This is just an alias for getTargetIP for easier test compatibility
+   */
+  public getTargetHost(domainConfig: IDomainConfig): string {
+    return this.getTargetIP(domainConfig);
+  }
+
+  /**
+   * Get target port from domain config
+   */
+  public getTargetPort(domainConfig: IDomainConfig, defaultPort: number): number {
+    return domainConfig.forwarding.target.port || defaultPort;
+  }
   
   /**
    * Checks if a domain should use NetworkProxy
    */
   public shouldUseNetworkProxy(domainConfig: IDomainConfig): boolean {
-    return !!domainConfig.useNetworkProxy;
+    const forwardingType = this.getForwardingType(domainConfig);
+    return forwardingType === 'https-terminate-to-http' ||
+           forwardingType === 'https-terminate-to-https';
   }
-  
+
   /**
    * Gets the NetworkProxy port for a domain
    */
   public getNetworkProxyPort(domainConfig: IDomainConfig): number | undefined {
-    return domainConfig.useNetworkProxy 
-      ? (domainConfig.networkProxyPort || this.settings.networkProxyPort)
-      : undefined;
+    // First check if we should use NetworkProxy at all
+    if (!this.shouldUseNetworkProxy(domainConfig)) {
+      return undefined;
+    }
+
+    return domainConfig.forwarding.advanced?.networkProxyPort || this.settings.networkProxyPort;
   }
   
   /**
    * Get effective allowed and blocked IPs for a domain
+   *
+   * This method combines domain-specific security rules from the forwarding configuration
+   * with global security defaults when necessary.
    */
   public getEffectiveIPRules(domainConfig: IDomainConfig): {
     allowedIPs: string[],
     blockedIPs: string[]
   } {
+    // Start with empty arrays
+    const allowedIPs: string[] = [];
+    const blockedIPs: string[] = [];
+
+    // Add IPs from forwarding security settings if available
+    if (domainConfig.forwarding?.security?.allowedIps) {
+      allowedIPs.push(...domainConfig.forwarding.security.allowedIps);
+    } else {
+      // If no allowed IPs are specified in forwarding config and global defaults exist, use them
+      if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
+        allowedIPs.push(...this.settings.defaultAllowedIPs);
+      } else {
+        // Default to allow all if no specific rules
+        allowedIPs.push('*');
+      }
+    }
+
+    // Add blocked IPs from forwarding security settings if available
+    if (domainConfig.forwarding?.security?.blockedIps) {
+      blockedIPs.push(...domainConfig.forwarding.security.blockedIps);
+    }
+
+    // Always add global blocked IPs, even if domain has its own rules
+    // This ensures that global blocks take precedence
+    if (this.settings.defaultBlockedIPs && this.settings.defaultBlockedIPs.length > 0) {
+      // Add only unique IPs that aren't already in the list
+      for (const ip of this.settings.defaultBlockedIPs) {
+        if (!blockedIPs.includes(ip)) {
+          blockedIPs.push(ip);
+        }
+      }
+    }
+
     return {
-      allowedIPs: [
-        ...domainConfig.allowedIPs,
-        ...(this.settings.defaultAllowedIPs || [])
-      ],
-      blockedIPs: [
-        ...(domainConfig.blockedIPs || []),
-        ...(this.settings.defaultBlockedIPs || [])
-      ]
+      allowedIPs,
+      blockedIPs
     };
   }
   
@@ -115,9 +201,97 @@ export class DomainConfigManager {
    * Get connection timeout for a domain
    */
   public getConnectionTimeout(domainConfig?: IDomainConfig): number {
-    if (domainConfig?.connectionTimeout) {
-      return domainConfig.connectionTimeout;
+    if (domainConfig?.forwarding.advanced?.timeout) {
+      return domainConfig.forwarding.advanced.timeout;
     }
+
     return this.settings.maxConnectionLifetime || 86400000; // 24 hours default
   }
+
+  /**
+   * Creates a forwarding handler for a domain configuration
+   */
+  private createForwardingHandler(domainConfig: IDomainConfig): IForwardingHandler {
+    // Create a new handler using the factory
+    const handler = ForwardingHandlerFactory.createHandler(domainConfig.forwarding);
+
+    // Initialize the handler
+    handler.initialize().catch(err => {
+      console.log(`Error initializing forwarding handler for ${domainConfig.domains.join(', ')}: ${err}`);
+    });
+
+    return handler;
+  }
+
+  /**
+   * Gets a forwarding handler for a domain config
+   * If no handler exists, creates one
+   */
+  public getForwardingHandler(domainConfig: IDomainConfig): IForwardingHandler {
+    // If we already have a handler, return it
+    if (this.forwardingHandlers.has(domainConfig)) {
+      return this.forwardingHandlers.get(domainConfig)!;
+    }
+
+    // Otherwise create a new handler
+    const handler = this.createForwardingHandler(domainConfig);
+    this.forwardingHandlers.set(domainConfig, handler);
+
+    return handler;
+  }
+
+  /**
+   * Gets the forwarding type for a domain config
+   */
+  public getForwardingType(domainConfig?: IDomainConfig): ForwardingType | undefined {
+    if (!domainConfig?.forwarding) return undefined;
+    return domainConfig.forwarding.type;
+  }
+
+  /**
+   * Checks if the forwarding type requires TLS termination
+   */
+  public requiresTlsTermination(domainConfig?: IDomainConfig): boolean {
+    if (!domainConfig) return false;
+
+    const forwardingType = this.getForwardingType(domainConfig);
+    return forwardingType === 'https-terminate-to-http' ||
+           forwardingType === 'https-terminate-to-https';
+  }
+
+  /**
+   * Checks if the forwarding type supports HTTP
+   */
+  public supportsHttp(domainConfig?: IDomainConfig): boolean {
+    if (!domainConfig) return false;
+
+    const forwardingType = this.getForwardingType(domainConfig);
+
+    // HTTP-only always supports HTTP
+    if (forwardingType === 'http-only') return true;
+
+    // For termination types, check the HTTP settings
+    if (forwardingType === 'https-terminate-to-http' ||
+        forwardingType === 'https-terminate-to-https') {
+      // HTTP is supported by default for termination types
+      return domainConfig.forwarding?.http?.enabled !== false;
+    }
+
+    // HTTPS-passthrough doesn't support HTTP
+    return false;
+  }
+
+  /**
+   * Checks if HTTP requests should be redirected to HTTPS
+   */
+  public shouldRedirectToHttps(domainConfig?: IDomainConfig): boolean {
+    if (!domainConfig?.forwarding) return false;
+
+    // Only check for redirect if HTTP is enabled
+    if (this.supportsHttp(domainConfig)) {
+      return !!domainConfig.forwarding.http?.redirectToHttps;
+    }
+
+    return false;
+  }
 }

package/ts/smartproxy/classes.pp.interfaces.ts

@@ -1,23 +1,15 @@
 import * as plugins from '../plugins.js';
+import type { IForwardConfig } from './forwarding/index.js';
 
 /**
  * Provision object for static or HTTP-01 certificate
  */
 export type ISmartProxyCertProvisionObject = plugins.tsclass.network.ICert | 'http01';
 
-/** Domain configuration with per-domain allowed port ranges */
+/** Domain configuration with forwarding configuration */
 export interface IDomainConfig {
   domains: string[]; // Glob patterns for domain(s)
-  allowedIPs: string[]; // Glob patterns for allowed IPs
-  blockedIPs?: string[]; // Glob patterns for blocked IPs
-  targetIPs?: string[]; // If multiple targetIPs are given, use round robin.
-  portRanges?: Array<{ from: number; to: number }>; // Optional port ranges
-  // Allow domain-specific timeout override
-  connectionTimeout?: number; // Connection timeout override (ms)
-
-  // NetworkProxy integration options for this specific domain
-  useNetworkProxy?: boolean; // Whether to use NetworkProxy for this domain
-  networkProxyPort?: number; // Override default NetworkProxy port for this domain
+  forwarding: IForwardConfig; // Unified forwarding configuration
 }
 
 /** Port proxy settings including global allowed port ranges */

package/ts/smartproxy/classes.pp.portrangemanager.ts

@@ -84,8 +84,10 @@ export class PortRangeManager {
   } | undefined {
     for (let i = 0; i < this.settings.domainConfigs.length; i++) {
       const domain = this.settings.domainConfigs[i];
-      if (domain.portRanges) {
-        for (const range of domain.portRanges) {
+      // Get port ranges from forwarding.advanced if available
+      const portRanges = domain.forwarding?.advanced?.portRanges;
+      if (portRanges && portRanges.length > 0) {
+        for (const range of portRanges) {
           if (port >= range.from && port <= range.to) {
             return { domainIndex: i, range };
           }
@@ -129,17 +131,20 @@ export class PortRangeManager {
     
     // Add domain-specific port ranges
     for (const domain of this.settings.domainConfigs) {
-      if (domain.portRanges) {
-        for (const range of domain.portRanges) {
+      // Get port ranges from forwarding.advanced
+      const portRanges = domain.forwarding?.advanced?.portRanges;
+      if (portRanges && portRanges.length > 0) {
+        for (const range of portRanges) {
           for (let port = range.from; port <= range.to; port++) {
             ports.add(port);
           }
         }
       }
-      
-      // Add domain-specific NetworkProxy port if configured
-      if (domain.useNetworkProxy && domain.networkProxyPort) {
-        ports.add(domain.networkProxyPort);
+
+      // Add domain-specific NetworkProxy port if configured in forwarding.advanced
+      const networkProxyPort = domain.forwarding?.advanced?.networkProxyPort;
+      if (networkProxyPort) {
+        ports.add(networkProxyPort);
       }
     }
     
@@ -170,8 +175,10 @@ export class PortRangeManager {
     
     // Track domain-specific port ranges
     for (const domain of this.settings.domainConfigs) {
-      if (domain.portRanges) {
-        for (const range of domain.portRanges) {
+      // Get port ranges from forwarding.advanced
+      const portRanges = domain.forwarding?.advanced?.portRanges;
+      if (portRanges && portRanges.length > 0) {
+        for (const range of portRanges) {
           for (let port = range.from; port <= range.to; port++) {
             if (!portMappings.has(port)) {
               portMappings.set(port, []);

package/ts/smartproxy/classes.pp.securitymanager.ts

@@ -63,45 +63,69 @@ export class SecurityManager {
   }
   
   /**
-   * Check if an IP is allowed using glob patterns
+   * Check if an IP is authorized using forwarding security rules
+   *
+   * This method is used to determine if an IP is allowed to connect, based on security
+   * rules configured in the forwarding configuration. The allowed and blocked IPs are
+   * typically derived from domain.forwarding.security.allowedIps and blockedIps through
+   * DomainConfigManager.getEffectiveIPRules().
+   *
+   * @param ip - The IP address to check
+   * @param allowedIPs - Array of allowed IP patterns from forwarding.security.allowedIps
+   * @param blockedIPs - Array of blocked IP patterns from forwarding.security.blockedIps
+   * @returns true if IP is authorized, false if blocked
    */
   public isIPAuthorized(ip: string, allowedIPs: string[], blockedIPs: string[] = []): boolean {
     // Skip IP validation if allowedIPs is empty
     if (!ip || (allowedIPs.length === 0 && blockedIPs.length === 0)) {
       return true;
     }
-    
-    // First check if IP is blocked
+
+    // First check if IP is blocked - blocked IPs take precedence
     if (blockedIPs.length > 0 && this.isGlobIPMatch(ip, blockedIPs)) {
       return false;
     }
-    
+
     // Then check if IP is allowed
     return this.isGlobIPMatch(ip, allowedIPs);
   }
   
   /**
-   * Check if the IP matches any of the glob patterns
+   * Check if the IP matches any of the glob patterns from security configuration
+   *
+   * This method checks IP addresses against glob patterns and handles IPv4/IPv6 normalization.
+   * It's used to implement IP filtering based on the forwarding.security configuration.
+   *
+   * @param ip - The IP address to check
+   * @param patterns - Array of glob patterns from forwarding.security.allowedIps or blockedIps
+   * @returns true if IP matches any pattern, false otherwise
    */
   private isGlobIPMatch(ip: string, patterns: string[]): boolean {
     if (!ip || !patterns || patterns.length === 0) return false;
 
+    // Handle IPv4/IPv6 normalization for proper matching
     const normalizeIP = (ip: string): string[] => {
       if (!ip) return [];
+      // Handle IPv4-mapped IPv6 addresses (::ffff:127.0.0.1)
       if (ip.startsWith('::ffff:')) {
         const ipv4 = ip.slice(7);
         return [ip, ipv4];
       }
+      // Handle IPv4 addresses by also checking IPv4-mapped form
       if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
         return [ip, `::ffff:${ip}`];
       }
       return [ip];
     };
 
+    // Normalize the IP being checked
     const normalizedIPVariants = normalizeIP(ip);
     if (normalizedIPVariants.length === 0) return false;
 
+    // Normalize the pattern IPs for consistent comparison
     const expandedPatterns = patterns.flatMap(normalizeIP);
+
+    // Check for any match between normalized IP variants and patterns
     return normalizedIPVariants.some((ipVariant) =>
       expandedPatterns.some((pattern) => plugins.minimatch(ipVariant, pattern))
     );

package/ts/smartproxy/classes.pp.timeoutmanager.ts

@@ -61,9 +61,9 @@ export class TimeoutManager {
    * Calculate effective max lifetime based on connection type
    */
   public getEffectiveMaxLifetime(record: IConnectionRecord): number {
-    // Use domain-specific timeout if available
-    const baseTimeout = record.domainConfig?.connectionTimeout || 
-                        this.settings.maxConnectionLifetime || 
+    // Use domain-specific timeout from forwarding.advanced if available
+    const baseTimeout = record.domainConfig?.forwarding?.advanced?.timeout ||
+                        this.settings.maxConnectionLifetime ||
                         86400000; // 24 hours default
     
     // For immortal keep-alive connections, use an extremely long lifetime

package/ts/smartproxy/classes.smartproxy.ts

@@ -12,6 +12,8 @@ import { Port80Handler } from '../port80handler/classes.port80handler.js';
 import { CertProvisioner } from './classes.pp.certprovisioner.js';
 import type { ICertificateData } from '../common/types.js';
 import { buildPort80Handler } from '../common/acmeFactory.js';
+import type { ForwardingType } from './types/forwarding.types.js';
+import { createPort80HandlerOptions } from '../common/port80-adapter.js';
 
 import type { ISmartProxyOptions, IDomainConfig } from './classes.pp.interfaces.js';
 export type { ISmartProxyOptions as IPortProxySettings, IDomainConfig };
@@ -156,11 +158,44 @@ export class SmartProxy extends plugins.EventEmitter {
       return;
     }
 
+    // Process domain configs
+    // Note: ensureForwardingConfig is no longer needed since forwarding is now required
+
+    // Initialize domain config manager with the processed configs
+    this.domainConfigManager.updateDomainConfigs(this.settings.domainConfigs);
+
     // Initialize Port80Handler if enabled
     await this.initializePort80Handler();
+
     // Initialize CertProvisioner for unified certificate workflows
     if (this.port80Handler) {
       const acme = this.settings.acme!;
+
+      // Convert domain forwards to use the new forwarding system if possible
+      const domainForwards = acme.domainForwards?.map(f => {
+        // If the domain has a forwarding config in domainConfigs, use that
+        const domainConfig = this.settings.domainConfigs.find(
+          dc => dc.domains.some(d => d === f.domain)
+        );
+
+        if (domainConfig?.forwarding) {
+          return {
+            domain: f.domain,
+            forwardConfig: f.forwardConfig,
+            acmeForwardConfig: f.acmeForwardConfig,
+            sslRedirect: f.sslRedirect || domainConfig.forwarding.http?.redirectToHttps || false
+          };
+        }
+
+        // Otherwise use the existing configuration
+        return {
+          domain: f.domain,
+          forwardConfig: f.forwardConfig,
+          acmeForwardConfig: f.acmeForwardConfig,
+          sslRedirect: f.sslRedirect || false
+        };
+      }) || [];
+
       this.certProvisioner = new CertProvisioner(
         this.settings.domainConfigs,
         this.port80Handler,
@@ -169,13 +204,9 @@ export class SmartProxy extends plugins.EventEmitter {
         acme.renewThresholdDays!,
         acme.renewCheckIntervalHours!,
         acme.autoRenew!,
-        acme.domainForwards?.map(f => ({
-          domain: f.domain,
-          forwardConfig: f.forwardConfig,
-          acmeForwardConfig: f.acmeForwardConfig,
-          sslRedirect: f.sslRedirect || false
-        })) || []
+        domainForwards
       );
+
       this.certProvisioner.on('certificate', (certData) => {
         this.emit('certificate', {
           domain: certData.domain,
@@ -186,6 +217,7 @@ export class SmartProxy extends plugins.EventEmitter {
           isRenewal: certData.isRenewal
         });
       });
+
       await this.certProvisioner.start();
       console.log('CertProvisioner started');
     }
@@ -378,21 +410,41 @@ export class SmartProxy extends plugins.EventEmitter {
    */
   public async updateDomainConfigs(newDomainConfigs: IDomainConfig[]): Promise<void> {
     console.log(`Updating domain configurations (${newDomainConfigs.length} configs)`);
-    
+
     // Update domain configs in DomainConfigManager
     this.domainConfigManager.updateDomainConfigs(newDomainConfigs);
-    
+
     // If NetworkProxy is initialized, resync the configurations
     if (this.networkProxyBridge.getNetworkProxy()) {
       await this.networkProxyBridge.syncDomainConfigsToNetworkProxy();
     }
-    
-    // If Port80Handler is running, provision certificates per new domain
+
+    // If Port80Handler is running, provision certificates based on forwarding type
     if (this.port80Handler && this.settings.acme?.enabled) {
       for (const domainConfig of newDomainConfigs) {
+        // Skip certificate provisioning for http-only or passthrough configs that don't need certs
+        const forwardingType = domainConfig.forwarding.type;
+        const needsCertificate =
+          forwardingType === 'https-terminate-to-http' ||
+          forwardingType === 'https-terminate-to-https';
+
+        // Skip certificate provisioning if ACME is explicitly disabled for this domain
+        const acmeDisabled = domainConfig.forwarding.acme?.enabled === false;
+
+        if (!needsCertificate || acmeDisabled) {
+          if (this.settings.enableDetailedLogging) {
+            console.log(`Skipping certificate provisioning for ${domainConfig.domains.join(', ')} (${forwardingType})`);
+          }
+          continue;
+        }
+
         for (const domain of domainConfig.domains) {
           const isWildcard = domain.includes('*');
           let provision: string | plugins.tsclass.network.ICert = 'http01';
+
+          // Check for ACME forwarding configuration in the domain
+          const forwardAcmeChallenges = domainConfig.forwarding.acme?.forwardChallenges;
+
           if (this.settings.certProvisionFunction) {
             try {
               provision = await this.settings.certProvisionFunction(domain);
@@ -403,16 +455,17 @@ export class SmartProxy extends plugins.EventEmitter {
             console.warn(`Skipping wildcard domain without certProvisionFunction: ${domain}`);
             continue;
           }
+
           if (provision === 'http01') {
             if (isWildcard) {
               console.warn(`Skipping HTTP-01 for wildcard domain: ${domain}`);
               continue;
             }
-            this.port80Handler.addDomain({
-              domainName: domain,
-              sslRedirect: true,
-              acmeMaintenance: true
-            });
+
+            // Create Port80Handler options from the forwarding configuration
+            const port80Config = createPort80HandlerOptions(domain, domainConfig.forwarding);
+
+            this.port80Handler.addDomain(port80Config);
             console.log(`Registered domain ${domain} with Port80Handler for HTTP-01`);
           } else {
             // Static certificate (e.g., DNS-01 provisioned) supports wildcards

package/ts/smartproxy/forwarding/domain-config.ts

@@ -0,0 +1,28 @@
+import type { IForwardConfig } from '../types/forwarding.types.js';
+
+/**
+ * Domain configuration with unified forwarding configuration
+ */
+export interface IDomainConfig {
+  // Core properties - domain patterns
+  domains: string[];
+
+  // Unified forwarding configuration
+  forwarding: IForwardConfig;
+}
+
+/**
+ * Helper function to create a domain configuration
+ */
+export function createDomainConfig(
+  domains: string | string[],
+  forwarding: IForwardConfig
+): IDomainConfig {
+  // Normalize domains to an array
+  const domainArray = Array.isArray(domains) ? domains : [domains];
+
+  return {
+    domains: domainArray,
+    forwarding
+  };
+}