@qzsy/dsh-bridge 0.0.0-stage → 3.0.0

package/lib/index.js

@@ -0,0 +1,360 @@
+// DSH 远程隧道云 · 官方客户端插件（Host 侧）
+//
+// 职责（保持精简，全部为独立实现）：
+//   1. 本地门禁代理：监听本机端口 → 转发 DSH 本体，注入 DSH 原生 loopback cookie；
+//   2. SaaS 隧道客户端：设备码绑定 → 短期令牌 → v2 控制通道（转发 HTTP / SSE / WS）；
+//   3. 设置页面的 RPC 控制面：状态、绑定、解绑、启停、访问链接。
+import { randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { hostname, platform as osPlatform, arch as osArch } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import QRCode from 'qrcode';
+
+import { PLUGIN_ID, PACKAGE_NAME, DEFAULT_PORT, RPC_CHANNEL, RPC_ENDPOINTS, GATEWAY_PATH } from './identity.js';
+import { resolveConfigPath } from './data-dir.js';
+import {
+  ensureConfigSecrets,
+  loadConfig,
+  maskSecret,
+  normalizeConfig,
+  saveConfig,
+  createSecret,
+  hashPassword,
+} from './config.js';
+import { GateProxy } from './gate.js';
+import { SaasTunnelClient } from './saas/tunnel-client.mjs';
+import {
+  claimDeviceCode,
+  fetchDeviceCodeStatus,
+  maskDeviceSecret,
+  normalizeSaasBaseUrl,
+  refreshDeviceToken,
+  requestDeviceCode,
+  buildDeviceInfo,
+} from './saas/device-auth.mjs';
+
+const PACKAGE_JSON = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'));
+const VERSION = PACKAGE_JSON.version ?? '0.0.0';
+const PAIRING_POLL_MS = 2000;
+const PAIRING_MAX_MS = 10 * 60 * 1000;
+
+export const name = PLUGIN_ID;
+export const inject = ['connection', 'webServer'];
+
+function ok(value) {
+  return { ok: true, value };
+}
+
+function fail(code, message) {
+  return { ok: false, error: { code: String(code || 'bad-request'), message: String(message ?? '') } };
+}
+
+function errorPayload(err) {
+  return fail(err?.code || 'internal', err?.message ?? String(err));
+}
+
+function registerRpc(ctx, handler, logger) {
+  const rpc = ctx?.connection?.rpc;
+  if (!rpc?.handle) {
+    logger?.warn?.('connection RPC unavailable — panel will stay disabled');
+    return () => {};
+  }
+  try {
+    const dispose = rpc.handle(RPC_CHANNEL, handler, { authority: 'loopback' });
+    return typeof dispose === 'function' ? dispose : () => {};
+  } catch (err) {
+    logger?.warn?.(`RPC register with options failed, retrying without: ${err?.message ?? err}`);
+    try {
+      const dispose = rpc.handle(RPC_CHANNEL, handler);
+      return typeof dispose === 'function' ? dispose : () => {};
+    } catch (retryErr) {
+      logger?.error?.(`RPC register failed: ${retryErr?.message ?? retryErr}`);
+      return () => {};
+    }
+  }
+}
+
+export async function apply(ctx, pluginConfig = {}) {
+  const logger = ctx?.logger?.(name) ?? console;
+  const dshPort = Number(ctx?.webServer?.port) || Number(pluginConfig.targetPort) || 3080;
+  const configPath = resolveConfigPath();
+
+  let config = loadConfig(configPath);
+  if (pluginConfig.port) config.port = Number(pluginConfig.port) || config.port;
+  if (pluginConfig.gatewayUrl) config.gatewayUrl = String(pluginConfig.gatewayUrl);
+  if (ensureConfigSecrets(config)) config = saveConfig(config, configPath);
+
+  const internalSecret = createSecret(24);
+  const gate = new GateProxy({
+    targetPort: dshPort,
+    port: config.port || DEFAULT_PORT,
+    config,
+    internalSecret,
+    logger,
+    dshHome: process.env.DSH_HOME,
+  });
+  const gatePort = await gate.start();
+
+  let tunnel = null;
+  let pairing = null;
+  let pairingTimer = null;
+  let pairingDeadline = 0;
+  let lastError = null;
+
+  const persist = (patch) => {
+    config = saveConfig({ ...config, ...patch, access: { ...config.access, ...(patch?.access ?? {}) } }, configPath);
+    gate.config = config;
+    return config;
+  };
+
+  const clearPairing = () => {
+    if (pairingTimer) clearInterval(pairingTimer);
+    pairingTimer = null;
+    pairingDeadline = 0;
+  };
+
+  const stopTunnel = async ({ persistAutoStart = false } = {}) => {
+    if (tunnel) {
+      try { await tunnel.disconnect(); } catch {}
+      tunnel = null;
+    }
+    if (persistAutoStart) persist({ autoStart: false });
+    lastError = null;
+  };
+
+  const gatewayBase = () => normalizeSaasBaseUrl(config.gatewayUrl);
+
+  const createTunnel = () => new SaasTunnelClient({
+    gatewayUrl: gatewayBase(),
+    gatewayPath: GATEWAY_PATH,
+    localPort: gatePort,
+    internalTunnelSecret: internalSecret,
+    protocol: 'v2',
+    deviceInfo: buildDeviceInfo({
+      name: hostname(),
+      platform: osPlatform(),
+      hostname: hostname(),
+      arch: osArch(),
+      pluginVersion: VERSION,
+    }),
+    tokenProvider: () => refreshDeviceToken({
+      gatewayUrl: gatewayBase(),
+      deviceId: config.deviceId,
+      secret: config.deviceSecret,
+    }),
+    onHelloAck: (ack) => {
+      lastError = null;
+      logger?.info?.(`SaaS tunnel ready (publicId=%s)`, ack?.tunnel?.publicId ?? '');
+    },
+    onRouteUpdate: ({ routes, rev }) => {
+      persist({ routesVersion: rev });
+      logger?.info?.(`SaaS tunnel routes updated (rev=%s, count=%d)`, rev, Array.isArray(routes) ? routes.length : 0);
+    },
+    onDrain: () => logger?.warn?.('SaaS tunnel draining by gateway'),
+    onDrainComplete: () => { lastError = 'SaaS 网关已下线（drain）'; },
+    onStateChange: ({ state, detail }) => {
+      if (state === 'error') lastError = detail;
+    },
+    logger,
+  });
+
+  const ensureConnected = async () => {
+    if (!config.deviceId || !config.deviceSecret) {
+      throw new Error('尚未绑定设备：请先获取设备码并在控制台确认');
+    }
+    if (tunnel?.connected) return tunnel;
+    if (!tunnel) tunnel = createTunnel();
+    await tunnel.connect();
+    return tunnel;
+  };
+
+  const pairStatus = async () => {
+    if (!pairing) return null;
+    if (pairing.status === 'pending' && pairingDeadline && Date.now() > pairingDeadline) {
+      pairing.status = 'expired';
+      clearPairing();
+    }
+    return { ...pairing };
+  };
+
+  const startPairingPoll = () => {
+    clearPairing();
+    pairingDeadline = Date.now() + PAIRING_MAX_MS;
+    pairingTimer = setInterval(async () => {
+      if (!pairing || pairing.status !== 'pending') return;
+      try {
+        const info = await fetchDeviceCodeStatus({ gatewayUrl: gatewayBase(), code: pairing.code });
+        if (info.status === 'approved') {
+          const claimed = await claimDeviceCode({ gatewayUrl: gatewayBase(), code: pairing.code });
+          pairing.status = 'bound';
+          persist({
+            deviceId: String(claimed?.deviceId ?? ''),
+            deviceSecret: String(claimed?.secret ?? ''),
+            tunnel: claimed?.tunnel ?? null,
+            routesVersion: 0,
+          });
+          clearPairing();
+          if (config.autoStart) await ensureConnected().catch((err) => { lastError = err?.message ?? String(err); });
+        } else if (info.status === 'expired' || info.status === 'consumed') {
+          pairing.status = info.status;
+          clearPairing();
+        }
+      } catch (err) {
+        lastError = err?.message ?? String(err);
+      }
+    }, PAIRING_POLL_MS);
+    pairingTimer.unref?.();
+  };
+
+  const status = async () => {
+    const bound = Boolean(config.deviceId && config.deviceSecret);
+    const publicUrl = tunnel?.publicUrl || '';
+    return {
+      plugin: PACKAGE_NAME,
+      version: VERSION,
+      phase: tunnel?.connected ? 'ready' : (tunnel?.state ?? 'idle'),
+      phaseDetail: tunnel?.stateDetail ?? '',
+      connected: Boolean(tunnel?.connected),
+      gatewayUrl: config.gatewayUrl,
+      device: {
+        bound,
+        id: config.deviceId || '',
+        idMasked: config.deviceId ? maskSecret(config.deviceId) : '',
+        secretMasked: maskDeviceSecret(config.deviceSecret),
+        tunnel: config.tunnel ?? null,
+      },
+      publicUrl,
+      routes: Array.isArray(tunnel?.routes) ? tunnel.routes : [],
+      lastError: lastError || tunnel?.lastError || '',
+      proxy: { port: gatePort, host: '127.0.0.1', url: `http://127.0.0.1:${gatePort}` },
+      pairing: await pairStatus(),
+      protocol: tunnel?.protocolVersion ?? 2,
+      access: { passwordSet: gate.passwordConfigured() },
+    };
+  };
+
+  const requireAdmin = (payload) => {
+    if (!gate.verifyAdminToken(payload?.adminToken)) {
+      const error = new Error('需要管理员权限：请在本机打开 DSH 设置页「远程访问」操作');
+      error.code = 'unauthorized';
+      throw error;
+    }
+  };
+
+  const rpcHandler = async (endpoint, payload = {}) => {
+    try {
+      // getStatus 是面板启动引导（读取代理端口以领取 adminToken），只暴露脱敏状态；
+      // 其余端点一律要求物理回环签发的 adminToken。
+      if (endpoint === RPC_ENDPOINTS.getStatus) return ok(await status());
+      requireAdmin(payload);
+      switch (endpoint) {
+        case RPC_ENDPOINTS.saveGateway: {
+          const baseUrl = normalizeSaasBaseUrl(payload?.gatewayUrl);
+          persist({ gatewayUrl: baseUrl });
+          return ok({ gatewayUrl: baseUrl });
+        }
+        case RPC_ENDPOINTS.requestDeviceCode: {
+          const created = await requestDeviceCode({
+            gatewayUrl: gatewayBase(),
+            deviceInfo: buildDeviceInfo({
+              name: hostname(),
+              platform: osPlatform(),
+              hostname: hostname(),
+              arch: osArch(),
+              pluginVersion: VERSION,
+            }),
+          });
+          pairing = {
+            code: created.code,
+            expiresAt: created.expiresAt ?? null,
+            expiresAtMs: created.expiresAtMs ?? null,
+            verificationUrl: created.verificationUrl ?? '',
+            status: 'pending',
+          };
+          lastError = null;
+          startPairingPoll();
+          return ok({ ...pairing });
+        }
+        case RPC_ENDPOINTS.bindDevice: {
+          const code = String(payload?.code ?? '').trim();
+          if (!code) return fail('bad-request', '设备码不能为空');
+          const claimed = await claimDeviceCode({ gatewayUrl: gatewayBase(), code });
+          pairing = { code, status: 'bound', expiresAt: null, expiresAtMs: null, verificationUrl: '' };
+          clearPairing();
+          persist({
+            deviceId: String(claimed?.deviceId ?? ''),
+            deviceSecret: String(claimed?.secret ?? ''),
+            tunnel: claimed?.tunnel ?? null,
+            routesVersion: 0,
+          });
+          if (payload?.autoStart === true) {
+            persist({ autoStart: true });
+            await ensureConnected();
+          }
+          return ok({ deviceId: config.deviceId, tunnel: config.tunnel });
+        }
+        case RPC_ENDPOINTS.unbindDevice:
+          await stopTunnel();
+          clearPairing();
+          pairing = null;
+          persist({ deviceId: '', deviceSecret: '', tunnel: null, routesVersion: 0, autoStart: false });
+          return ok({ unbound: true });
+        case RPC_ENDPOINTS.startTunnel:
+          if (!gate.passwordConfigured()) return fail('password_not_set', '请先设置访问密码：远程访客需要凭此口令访问');
+          persist({ autoStart: payload?.autoStart !== false });
+          await ensureConnected();
+          return ok(await status());
+        case RPC_ENDPOINTS.stopTunnel:
+          await stopTunnel({ persistAutoStart: true });
+          return ok(await status());
+        case RPC_ENDPOINTS.getAccessUrl: {
+          const publicUrl = tunnel?.publicUrl || '';
+          const url = publicUrl ? gate.accessUrl(publicUrl) : '';
+          let qrDataUrl = null;
+          if (url) {
+            try {
+              qrDataUrl = await QRCode.toDataURL(url, { width: 240, margin: 2, color: { dark: '#1F2421', light: '#FFFFFF' } });
+            } catch { qrDataUrl = null; }
+          }
+          return ok({ url, token: config.access.token, qrDataUrl });
+        }
+        case RPC_ENDPOINTS.setAccessPassword: {
+          const password = String(payload?.password ?? '');
+          if (password.length < 6) return fail('bad-request', '访问密码至少 6 位');
+          const digest = hashPassword(password);
+          persist({ access: { ...config.access, ...digest } });
+          return ok({ passwordSet: true });
+        }
+        case RPC_ENDPOINTS.clearAccessPassword: {
+          persist({ access: { ...config.access, passwordHash: '', passwordSalt: '' } });
+          return ok({ passwordSet: false });
+        }
+        default:
+          return fail('bad-request', `未知 RPC 端点: ${endpoint}`);
+      }
+    } catch (err) {
+      lastError = err?.message ?? String(err);
+      return errorPayload(err);
+    }
+  };
+
+  const disposeRpc = registerRpc(ctx, rpcHandler, logger);
+
+  if (config.deviceSecret && config.autoStart && gate.passwordConfigured()) {
+    ensureConnected().catch((err) => { lastError = err?.message ?? String(err); });
+  }
+
+  const dispose = async () => {
+    clearPairing();
+    disposeRpc();
+    await stopTunnel();
+    await gate.stop();
+  };
+  try { ctx.effect?.(() => dispose, `${PLUGIN_ID}: lifecycle`); } catch {}
+
+  return { gate, dispose };
+}
+
+export { GateProxy } from './gate.js';
+export { SaasTunnelClient } from './saas/tunnel-client.mjs';