@riceawa/dsh-lan-gateway 0.5.2 → 0.5.4

package/src/state.ts

@@ -9,7 +9,7 @@
 
 import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto'
+import { randomBytes, scrypt, scryptSync, timingSafeEqual } from 'node:crypto'
 import { homedir } from 'node:os'
 
 /** The state directory: `~/.dsh/lan-gateway`. */
@@ -37,17 +37,43 @@ export interface GatewayState {
    * immediately. Old state files without the field load as epoch 0.
    */
   sessionEpoch: number
+  /**
+   * Revoked session ids, each mapped to the epoch millis at which that
+   * session's own cookie expires. Signing out revokes the single id the
+   * browser presented, so the account's other sessions keep working, and it
+   * has to be persisted: the cookie it names stays unforgeable until it
+   * expires, and a restart must not resurrect it. Entries lapse once the
+   * cookie they name could no longer be presented anyway, which bounds the
+   * list by the sessions that are still live somewhere. Absent on state
+   * written before 0.5.4.
+   */
+  revokedSessions?: Record<string, number>
 }
 
 const STATE_FILENAME = 'state.json'
 
-/** Whether a password is present and passes scrypt verification. */
-export function verifyPassword(state: GatewayState, password: string): boolean {
+/** Promise wrapper around the threaded `scrypt`, which runs off the main loop. */
+function deriveKey(password: string, salt: Buffer, keylen: number): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, keylen, (error, derived) => {
+      if (error !== null) reject(error)
+      else resolve(derived)
+    })
+  })
+}
+
+/**
+ * Whether a password is present and passes scrypt verification. Asynchronous
+ * on purpose: `scryptSync` occupies the event loop for tens of milliseconds
+ * per attempt, and that loop is shared with the dsh process the gateway is
+ * forwarding to.
+ */
+export async function verifyPassword(state: GatewayState, password: string): Promise<boolean> {
   if (state.password === undefined) return false
   const { hash, salt } = state.password
   try {
     const expected = Buffer.from(hash, 'hex')
-    const actual = scryptSync(password, Buffer.from(salt, 'hex'), expected.length)
+    const actual = await deriveKey(password, Buffer.from(salt, 'hex'), expected.length)
     return expected.length === actual.length && timingSafeEqual(expected, actual)
   } catch {
     return false
@@ -60,10 +86,14 @@ export function verifyPassword(state: GatewayState, password: string): boolean {
  * password change must invalidate sessions the old password authorized.
  */
 export function setPassword(state: GatewayState, password: string | undefined): GatewayState {
-  const base = { ...state, sessionEpoch: state.sessionEpoch + 1 }
-  if (password === undefined) {
-    return { cookieSecret: base.cookieSecret, sessionEpoch: base.sessionEpoch }
+  // The new epoch invalidates every cookie on its own account, so the list of
+  // individually revoked sessions has nothing left to say: drop it rather than
+  // carry entries that can never match again.
+  const base: GatewayState = {
+    cookieSecret: state.cookieSecret,
+    sessionEpoch: state.sessionEpoch + 1,
   }
+  if (password === undefined) return base
   const salt = randomBytes(16)
   const hash = scryptSync(password, salt, 64)
   return {
@@ -72,10 +102,47 @@ export function setPassword(state: GatewayState, password: string | undefined):
   }
 }
 
+/**
+ * Record a session id as revoked.
+ * @param expiresMs - the revoked cookie's own expiry. Past it the cookie is
+ *   rejected on its own account, so the entry is no longer needed; dropping
+ *   expired entries here is what keeps the list bounded.
+ */
+export function revokeSession(state: GatewayState, sid: string, expiresMs: number): GatewayState {
+  const now = Date.now()
+  const revoked: Record<string, number> = {}
+  for (const [id, exp] of Object.entries(state.revokedSessions ?? {})) {
+    if (exp > now) revoked[id] = exp
+  }
+  revoked[sid] = expiresMs
+  return { ...state, revokedSessions: revoked }
+}
+
+/** Whether `sid` names a session that has been signed out. */
+export function isSessionRevoked(state: GatewayState, sid: string | undefined): boolean {
+  if (sid === undefined) return false
+  return Object.hasOwn(state.revokedSessions ?? {}, sid)
+}
+
 function defaultState(): GatewayState {
   return { cookieSecret: randomBytes(32).toString('base64'), sessionEpoch: 0 }
 }
 
+/** Keep the still-live entries of a persisted revocation list, or undefined. */
+function parseRevokedSessions(raw: unknown): Record<string, number> | undefined {
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) return undefined
+  const now = Date.now()
+  const out: Record<string, number> = {}
+  let anyLive = false
+  for (const [sid, exp] of Object.entries(raw)) {
+    if (typeof exp === 'number' && Number.isFinite(exp) && exp > now) {
+      out[sid] = exp
+      anyLive = true
+    }
+  }
+  return anyLive ? out : undefined
+}
+
 /** Load state; on first run (or a corrupt file) generate a fresh secret. */
 export function loadState(home: string = homedir()): GatewayState {
   const dir = stateDir(home)
@@ -91,6 +158,9 @@ export function loadState(home: string = homedir()): GatewayState {
         : 0
       const base: GatewayState = { cookieSecret: parsed.cookieSecret, sessionEpoch }
       if (parsed.password !== undefined) base.password = parsed.password
+      // Anything the file lists past its own expiry has lapsed on its own.
+      const revoked = parseRevokedSessions(parsed.revokedSessions)
+      if (revoked !== undefined) base.revokedSessions = revoked
       return base
     }
     return defaultState()

package/src/tls.ts

@@ -71,6 +71,27 @@ export function loadOrCreateSelfSigned(
   return { material, created: true }
 }
 
+/**
+ * Load the self-signed material a listener should serve: generate it on first
+ * use, reuse the persisted pair otherwise, and replace a persisted certificate
+ * whose validity has already lapsed.
+ *
+ * Nothing renews a self-signed certificate in place, and a browser refuses a
+ * lapsed one outright, so without this a certificate that ran out would keep
+ * being served until an operator happened to read the expiry date out of
+ * `status` and act on it. Renewing mints a fresh key, so a client that had
+ * trusted the old certificate has to trust the new one — but that is the case
+ * either way, the old one having lapsed.
+ */
+export function loadOrRenewSelfSigned(
+  opts: SelfSignedTlsOptions,
+  home: string = homedir(),
+): { material: TlsMaterial; renewed: boolean } {
+  const { material, created } = loadOrCreateSelfSigned(opts, home)
+  if (created || !isCertExpired(material.cert)) return { material, renewed: false }
+  return { material: regenerateSelfSigned(opts, home), renewed: true }
+}
+
 /**
  * Force-regenerate the self-signed certificate (new key + cert), replacing
  * the persisted files. Used by `lan_gateway tls-regenerate`.
@@ -146,6 +167,18 @@ export interface CertInfo {
   san?: string
 }
 
+/**
+ * Whether a PEM certificate's validity window has already closed. A lapsed
+ * certificate is a hard failure browsers will not let the user proceed past,
+ * so the listener replaces one rather than keep serving it.
+ */
+export function isCertExpired(certPem: string, now: number = Date.now()): boolean {
+  const expiresAt = Date.parse(new X509Certificate(certPem).validTo)
+  // An unparseable date reads as "not expired": serving the certificate we were
+  // handed beats discarding it over a date-parsing quirk.
+  return Number.isFinite(expiresAt) && expiresAt <= now
+}
+
 /** Describe a PEM certificate (throws on malformed input). */
 export function describeCert(certPem: string): CertInfo {
   const cert = new X509Certificate(certPem)

package/src/upstream-session.ts

@@ -57,6 +57,14 @@ export interface UpstreamSessionRelayOptions {
    * upstream restart is picked up.
    */
   authenticatedUrl: () => string | undefined
+  /**
+   * Optional low-frequency debug sink: one line per acquisition attempt,
+   * exchange outcome, and invalidation. Every other failure path here is
+   * silent by design (the relay never throws), which makes a mis-named cookie
+   * or an unreachable upstream indistinguishable from "the base has no
+   * browser sessions" — wire `ctx.logger` to make that visible.
+   */
+  log?: (message: string) => void
 }
 
 /** Split `name=value; Path=/; …` into the `name=value` request-Cookie fragment. */
@@ -65,6 +73,19 @@ function nameValueOnly(setCookie: string): string {
   return (semi === -1 ? setCookie : setCookie.slice(0, semi)).trim()
 }
 
+/**
+ * The pathname of a URL, for logging. Never the whole URL: the authenticated
+ * URL carries the launch token as a query parameter, and that token is a
+ * bearer credential for the upstream harness.
+ */
+function pathOf(url: string): string {
+  try {
+    return new URL(url).pathname
+  } catch {
+    return '<unparseable>'
+  }
+}
+
 /** The cookie name of a `Set-Cookie` string (`''` when it is malformed). */
 function cookieNameOf(setCookie: string): string {
   const eq = setCookie.indexOf('=')
@@ -106,12 +127,14 @@ function exchange(
   url: string,
   authority: string,
   port: number,
+  log: (message: string) => void,
 ): Promise<ExchangeResult | undefined> {
   return new Promise((resolve) => {
     let target: URL
     try {
       target = new URL(url)
     } catch {
+      log('exchange: authenticatedUrl is not parseable')
       resolve(undefined)
       return
     }
@@ -125,21 +148,33 @@ function exchange(
       const setCookies = response.headers['set-cookie']
       response.resume() // drain so the socket can be reused
       if (setCookies === undefined) {
+        log(`exchange ${target.pathname} -> ${response.statusCode} (no set-cookie)`)
         resolve(undefined)
         return
       }
-      const raw = (Array.isArray(setCookies) ? setCookies : [setCookies])
-        .find(isUpstreamSessionCookie)
+      const all = Array.isArray(setCookies) ? setCookies : [setCookies]
+      const raw = all.find(isUpstreamSessionCookie)
       if (raw === undefined) {
+        // Name what did come back: a missing session cookie is otherwise
+        // indistinguishable from an upstream that mints a differently-named one.
+        const names = all.map(cookieNameOf).filter((name) => name !== '')
+        log(`exchange ${target.pathname} -> ${response.statusCode} (no ${UPSTREAM_COOKIE_PREFIX}* cookie; got: ${names.join(', ') || 'none'})`)
         resolve(undefined)
         return
       }
       const header = nameValueOnly(raw)
       const maxAge = maxAgeSeconds(raw)
+      log(`exchange ${target.pathname} -> ${response.statusCode} (got ${cookieNameOf(raw)}, maxAge=${maxAge ?? 'n/a'})`)
       resolve({ header, expiresAt: Date.now() + (maxAge ?? 0) * 1000 })
     })
-    request.on('error', () => resolve(undefined))
-    request.setTimeout(5000, () => request.destroy(new Error('upstream-session exchange timeout')))
+    request.on('error', (error: Error) => {
+      log(`exchange error: ${error.message}`)
+      resolve(undefined)
+    })
+    request.setTimeout(5000, () => {
+      log('exchange timeout (5s)')
+      request.destroy(new Error('upstream-session exchange timeout'))
+    })
     request.end()
   })
 }
@@ -153,6 +188,7 @@ export class UpstreamSessionRelay implements UpstreamSession {
   private readonly port: number
   private readonly authority: string
   private readonly authenticatedUrl: () => string | undefined
+  private readonly log: (message: string) => void
   private held: HeldCookie | undefined
   private inflight: Promise<string | undefined> | undefined
 
@@ -160,6 +196,7 @@ export class UpstreamSessionRelay implements UpstreamSession {
     this.port = options.port
     this.authority = options.authority ?? `127.0.0.1:${options.port}`
     this.authenticatedUrl = options.authenticatedUrl
+    this.log = options.log ?? (() => { /* no debug sink configured */ })
   }
 
   /** Whether the held session is still comfortably inside its lifetime. */
@@ -176,6 +213,7 @@ export class UpstreamSessionRelay implements UpstreamSession {
   }
 
   invalidate(): void {
+    if (this.held !== undefined) this.log('invalidating held session (upstream rejected it)')
     this.held = undefined
   }
 
@@ -195,9 +233,24 @@ export class UpstreamSessionRelay implements UpstreamSession {
 
   private async doExchange(): Promise<string | undefined> {
     const url = this.authenticatedUrl()
-    if (url === undefined) return undefined
-    const result = await exchange(url, this.authority, this.port)
-    if (result !== undefined) this.held = result
+    if (url === undefined) {
+      // The launch URL is transiently unavailable (e.g. the connection service
+      // is mid-restart). Keep whatever is held: returning undefined here would
+      // forward with no cookie at all and draw a 401 upstream, which is worse
+      // than riding a session that is probably still valid.
+      this.log('authenticatedUrl() returned undefined; keeping current session')
+      return this.held?.header
+    }
+    // Log only the path: the URL carries the launch token in its query string,
+    // and that token is a bearer credential for the upstream harness.
+    this.log(`acquiring session from ${pathOf(url)}`)
+    const result = await exchange(url, this.authority, this.port, this.log)
+    if (result !== undefined) {
+      this.held = result
+      this.log('session acquired and cached')
+    } else {
+      this.log('exchange failed; keeping current session')
+    }
     // On a transient failure keep whatever session is still held rather than
     // dropping to anonymous.
     return this.held?.header