@push.rocks/smartproxy 27.18.0 → 27.20.0

package/ts/proxies/smart-proxy/models/metrics-types.ts

@@ -29,6 +29,18 @@ export interface IThroughputHistoryPoint {
   out: number;
 }
 
+export interface IProtocolHistoryPoint {
+  timestamp: number;
+  total: number;
+  protocols: Record<string, number>;
+}
+
+export interface IMetricsHistory {
+  throughputHistory: IThroughputHistoryPoint[];
+  frontendConnectionHistory: IProtocolHistoryPoint[];
+  backendConnectionHistory: IProtocolHistoryPoint[];
+}
+
 export interface IRequestRateMetrics {
   perSecond: number;
   lastMinute: number;
@@ -68,6 +80,8 @@ export interface IMetrics {
     topDomainRequests(limit?: number): Array<{ ip: string; domain: string; count: number }>;
     frontendProtocols(): IProtocolDistribution;
     backendProtocols(): IProtocolDistribution;
+    frontendHistory(seconds: number): Array<IProtocolHistoryPoint>;
+    backendHistory(seconds: number): Array<IProtocolHistoryPoint>;
   };
   
   // Throughput metrics (bytes per second)

package/ts/proxies/smart-proxy/models/route-types.ts

@@ -24,6 +24,11 @@ export type TTlsMode = 'passthrough' | 'terminate' | 'terminate-and-reencrypt';
  */
 export type TTransportProtocol = 'tcp' | 'udp' | 'all';
 
+/**
+ * Trusted transport path established by SmartProxy for an accepted connection.
+ */
+export type TIngressOrigin = 'direct' | 'trustedProxy' | 'smartVpn';
+
 /**
  * Inbound PROXY protocol handling for a listener.
  */
@@ -197,6 +202,11 @@ export interface IRouteSecurity {
     allowedAssignedIps?: string[];
   };
 
+  ingress?: {
+    /** Omit ingress entirely for legacy all-origin behavior. */
+    allowedOrigins: TIngressOrigin[];
+  };
+
   /** Browser-facing challenge policy. SmartProxy enforces this in the HTTP path. */
   challenge?: plugins.smartchallenge.IRouteChallengeConfig;
 }

package/ts/proxies/smart-proxy/models/rust-types.ts

@@ -105,6 +105,22 @@ export interface IRustThroughputSample {
   bytesOut: number;
 }
 
+export interface IRustProtocolHistorySample {
+  timestampMs: number;
+  total: number;
+  h1Active: number;
+  h2Active: number;
+  h3Active: number;
+  wsActive: number;
+  otherActive: number;
+}
+
+export interface IRustMetricsHistory {
+  throughputHistory: IRustThroughputSample[];
+  frontendProtocolHistory: IRustProtocolHistorySample[];
+  backendProtocolHistory: IRustProtocolHistorySample[];
+}
+
 export interface IRustRouteMetrics {
   activeConnections: number;
   totalConnections: number;

package/ts/proxies/smart-proxy/rust-metrics-adapter.ts

@@ -1,6 +1,76 @@
-import type { IMetrics, IBackendMetrics, IProtocolCacheEntry, IProtocolDistribution, IRequestRateMetrics, IThroughputData, IThroughputHistoryPoint } from './models/metrics-types.js';
+import type {
+  IMetrics,
+  IMetricsHistory,
+  IBackendMetrics,
+  IProtocolCacheEntry,
+  IProtocolDistribution,
+  IProtocolHistoryPoint,
+  IRequestRateMetrics,
+  IThroughputData,
+  IThroughputHistoryPoint,
+} from './models/metrics-types.js';
 import type { RustProxyBridge } from './rust-proxy-bridge.js';
-import type { IRustBackendMetrics, IRustHttpDomainRequestMetrics, IRustIpMetrics, IRustMetricsSnapshot, IRustRouteMetrics } from './models/rust-types.js';
+import type {
+  IRustBackendMetrics,
+  IRustHttpDomainRequestMetrics,
+  IRustIpMetrics,
+  IRustMetricsHistory,
+  IRustMetricsSnapshot,
+  IRustProtocolHistorySample,
+  IRustRouteMetrics,
+} from './models/rust-types.js';
+
+function normalizeHistoryWindow(seconds: number, available: number): number {
+  if (!Number.isFinite(seconds) || seconds <= 0 || available <= 0) return 0;
+  return Math.min(Math.floor(seconds), available);
+}
+
+function sliceHistory<T>(points: T[], seconds: number): T[] {
+  const window = normalizeHistoryWindow(seconds, points.length);
+  return window === 0 ? [] : points.slice(-window);
+}
+
+function sliceWallClockHistory<T extends { timestampMs: number }>(
+  points: T[],
+  seconds: number,
+): T[] {
+  const requestedSeconds = Number.isFinite(seconds) ? Math.floor(seconds) : 0;
+  if (requestedSeconds <= 0 || points.length === 0) return [];
+
+  const newestTimestamp = points[points.length - 1].timestampMs;
+  const oldestTimestamp = newestTimestamp - (requestedSeconds - 1) * 1_000;
+  return points
+    .filter((point) => point.timestampMs >= oldestTimestamp)
+    .slice(-requestedSeconds);
+}
+
+function mergeThroughputHistory(
+  cachedHistory: IRustMetricsHistory['throughputHistory'],
+  snapshotHistory: IRustMetricsSnapshot['throughputHistory'],
+): IRustMetricsHistory['throughputHistory'] {
+  const mergedByTimestamp = new Map<number, IRustMetricsHistory['throughputHistory'][number]>();
+  for (const point of cachedHistory) {
+    mergedByTimestamp.set(point.timestampMs, point);
+  }
+  for (const point of snapshotHistory) {
+    mergedByTimestamp.set(point.timestampMs, point);
+  }
+  return [...mergedByTimestamp.values()].sort((a, b) => a.timestampMs - b.timestampMs);
+}
+
+function mapProtocolHistoryPoint(sample: IRustProtocolHistorySample): IProtocolHistoryPoint {
+  return {
+    timestamp: sample.timestampMs,
+    total: sample.total,
+    protocols: {
+      'HTTP/1.1': sample.h1Active,
+      'HTTP/2': sample.h2Active,
+      'HTTP/3': sample.h3Active,
+      WebSocket: sample.wsActive,
+      Other: sample.otherActive,
+    },
+  };
+}
 
 /**
  * Adapts Rust JSON metrics to the IMetrics interface.
@@ -16,6 +86,7 @@ import type { IRustBackendMetrics, IRustHttpDomainRequestMetrics, IRustIpMetrics
 export class RustMetricsAdapter implements IMetrics {
   private bridge: RustProxyBridge;
   private cache: IRustMetricsSnapshot | null = null;
+  private historyCache: IRustMetricsHistory | null = null;
   private pollTimer: ReturnType<typeof setInterval> | null = null;
   private pollIntervalMs: number;
 
@@ -35,6 +106,27 @@ export class RustMetricsAdapter implements IMetrics {
     }
   }
 
+  /**
+   * Fetch histories only when an observer needs them; regular polling stays lightweight.
+   */
+  public async refreshHistory(seconds: number): Promise<IMetricsHistory> {
+    const history = await this.bridge.getMetricsHistory(seconds);
+    this.historyCache = history;
+    return {
+      throughputHistory: history.throughputHistory.map((point) => ({
+        timestamp: point.timestampMs,
+        in: point.bytesIn,
+        out: point.bytesOut,
+      })),
+      frontendConnectionHistory: history.frontendProtocolHistory.map(
+        mapProtocolHistoryPoint,
+      ),
+      backendConnectionHistory: history.backendProtocolHistory.map(
+        mapProtocolHistoryPoint,
+      ),
+    };
+  }
+
   public startPolling(): void {
     if (this.pollTimer) return;
     // Immediate first poll so cache is populated ASAP
@@ -154,6 +246,14 @@ export class RustMetricsAdapter implements IMetrics {
         otherTotal: bp?.otherTotal ?? 0,
       };
     },
+    frontendHistory: (seconds: number): Array<IProtocolHistoryPoint> => {
+      const history = this.historyCache?.frontendProtocolHistory ?? [];
+      return sliceHistory(history, seconds).map(mapProtocolHistoryPoint);
+    },
+    backendHistory: (seconds: number): Array<IProtocolHistoryPoint> => {
+      const history = this.historyCache?.backendProtocolHistory ?? [];
+      return sliceHistory(history, seconds).map(mapProtocolHistoryPoint);
+    },
   };
 
   public throughput = {
@@ -176,11 +276,14 @@ export class RustMetricsAdapter implements IMetrics {
       return this.throughput.instant();
     },
     history: (seconds: number): Array<IThroughputHistoryPoint> => {
-      if (!this.cache?.throughputHistory) return [];
-      return this.cache.throughputHistory.slice(-seconds).map((p) => ({
-        timestamp: p.timestampMs,
-        in: p.bytesIn,
-        out: p.bytesOut,
+      const history = mergeThroughputHistory(
+        this.historyCache?.throughputHistory ?? [],
+        this.cache?.throughputHistory ?? [],
+      );
+      return sliceWallClockHistory(history, seconds).map((point) => ({
+        timestamp: point.timestampMs,
+        in: point.bytesIn,
+        out: point.bytesOut,
       }));
     },
     byRoute: (_windowSeconds?: number): Map<string, IThroughputData> => {

package/ts/proxies/smart-proxy/rust-proxy-bridge.ts

@@ -5,12 +5,14 @@ import type {
   IRustChallengeOptions,
   IRustMetricsSnapshot,
   IRustProxyOptions,
+  IRustMetricsHistory,
   IRustRouteConfig,
   IRustStatistics,
 } from './models/rust-types.js';
 import type { IActiveConnectionSnapshot, IActiveConnectionSnapshotOptions, IActiveConnectionSnapshotPage, ISmartProxySecurityPolicy } from './models/interfaces.js';
 
 const MAXIMUM_RUST_CONNECTION_ID = 18_446_744_073_709_551_615n;
+const MAXIMUM_METRICS_HISTORY_SECONDS = 600;
 
 function validateActiveConnectionSnapshotOptions(options: IActiveConnectionSnapshotOptions): void {
   if (options.afterId === undefined) {
@@ -33,6 +35,7 @@ type TSmartProxyCommands = {
   updateRoutes:            { params: { routes: IRustRouteConfig[] };     result: void };
   setSecurityPolicy:       { params: { policy: ISmartProxySecurityPolicy }; result: void };
   getMetrics:              { params: Record<string, never>;              result: IRustMetricsSnapshot };
+  getMetricsHistory:       { params: { seconds: number };                 result: IRustMetricsHistory };
   getStatistics:           { params: Record<string, never>;              result: IRustStatistics };
   getActiveConnectionSnapshots: { params: IActiveConnectionSnapshotOptions; result: IActiveConnectionSnapshot[] };
   getActiveConnectionSnapshotPage: { params: IActiveConnectionSnapshotOptions; result: IActiveConnectionSnapshotPage };
@@ -167,6 +170,17 @@ export class RustProxyBridge extends plugins.EventEmitter {
     return this.bridge.sendCommand('getMetrics', {} as Record<string, never>);
   }
 
+  public async getMetricsHistory(seconds: number): Promise<IRustMetricsHistory> {
+    if (!Number.isFinite(seconds) || seconds < 0) {
+      throw new Error('Metrics history seconds must be a finite non-negative number');
+    }
+    const boundedSeconds = Math.min(
+      MAXIMUM_METRICS_HISTORY_SECONDS,
+      Math.floor(seconds),
+    );
+    return this.bridge.sendCommand('getMetricsHistory', { seconds: boundedSeconds });
+  }
+
   public async getStatistics(): Promise<IRustStatistics> {
     return this.bridge.sendCommand('getStatistics', {} as Record<string, never>);
   }

package/ts/proxies/smart-proxy/smart-proxy.ts

@@ -20,7 +20,7 @@ import { ConcurrencySemaphore } from './utils/concurrency-semaphore.js';
 // Types
 import type { ISmartProxyOptions, ISmartProxySecurityPolicy, TSmartProxyCertProvisionObject, IAcmeOptions, ICertProvisionEventComms, ICertificateIssuedEvent, ICertificateFailedEvent, ISmartProxyCertProvisionCertificate, IActiveConnectionSnapshot, IActiveConnectionSnapshotOptions, IActiveConnectionSnapshotPage } from './models/interfaces.js';
 import type { IRouteConfig } from './models/route-types.js';
-import type { IMetrics } from './models/metrics-types.js';
+import type { IMetrics, IMetricsHistory } from './models/metrics-types.js';
 import type { IRustCertificateStatus, IRustChallengeOptions, IRustProxyOptions, IRustStatistics } from './models/rust-types.js';
 
 type TChallengeProvider = plugins.smartchallenge.IChallengeProvider;
@@ -496,6 +496,13 @@ export class SmartProxy extends plugins.EventEmitter {
     return this.metricsAdapter;
   }
 
+  /**
+   * Refresh bounded histories on demand without expanding the periodic metrics poll.
+   */
+  public async refreshMetricsHistory(seconds: number): Promise<IMetricsHistory> {
+    return this.metricsAdapter.refreshHistory(seconds);
+  }
+
   /**
    * Get sanitized active connection snapshots from the Rust engine.
    */

package/ts/proxies/smart-proxy/socket-handler-server.ts

@@ -169,6 +169,7 @@ export class SocketHandlerServer {
       domain: metadata.domain,
       clientIp: metadata.remoteIP || 'unknown',
       serverIp: '0.0.0.0',
+      ingressOrigin: metadata.ingressOrigin,
       vpn: metadata.vpn,
       path: metadata.path,
       isTls: metadata.isTLS || false,

package/ts/proxies/smart-proxy/utils/route-validator.ts

@@ -269,6 +269,34 @@ export class RouteValidator {
         }
       }
 
+      if (route.security.ingress) {
+        const origins = route.security.ingress.allowedOrigins;
+        if (!Array.isArray(origins) || origins.length === 0) {
+          errors.push('security.ingress.allowedOrigins must be a non-empty array');
+        } else {
+          const supportedOrigins = new Set(['direct', 'trustedProxy', 'smartVpn']);
+          const uniqueOrigins = new Set(origins);
+          if (uniqueOrigins.size !== origins.length) {
+            errors.push('security.ingress.allowedOrigins must not contain duplicates');
+          }
+          for (const origin of origins) {
+            if (!supportedOrigins.has(origin)) {
+              errors.push(`Invalid security ingress origin: ${origin}`);
+            }
+          }
+
+          const inboundMode = route.match.inboundProxyProtocol?.mode;
+          const allowsDirect = origins.includes('direct');
+          const allowsTrustedProxy = origins.includes('trustedProxy') || origins.includes('smartVpn');
+          if (allowsDirect && inboundMode === 'required') {
+            errors.push('inboundProxyProtocol.required conflicts with the allowed direct ingress origin');
+          }
+          if (allowsTrustedProxy && inboundMode === 'reject') {
+            errors.push('inboundProxyProtocol.reject conflicts with trustedProxy or smartVpn ingress origins');
+          }
+        }
+      }
+
       // Validate connection limits
       if (route.security.maxConnections && route.security.maxConnections < 0) {
         errors.push('Max connections must be positive');