@rstreamlabs/tunnels 2.0.0 → 3.1.0

package/dist/index.js

@@ -107,7 +107,7 @@ var RstreamAuthResource = class {
     if (options?.projectId !== void 0 || options?.workspaceId !== void 0) {
       return options;
     }
-    if (tokenParams.scopes === void 0 && !tunnelGrantsNeedDefaultTarget(tokenParams.tunnelsGrants)) {
+    if (!tunnelResourcesNeedDefaultTarget(tokenParams.resources?.tunnels)) {
       return options ?? {};
     }
     const target = await this.client.getEngineAuthTokenTarget();
@@ -124,8 +124,8 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
     metadata: {
       engine: options?.engine
     },
-    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams, options),
-    permissions: null
+    permissions: null,
+    resources: normalizeAuthTokenResources(tokenParams, options)
   };
   const { token } = (0, import_rstream.createClientCredentialsToken)(credentials, {
     claims: payload,
@@ -133,70 +133,73 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
   });
   return { token };
 }
-function normalizeAuthTokenTunnelGrants(params, options) {
-  const tunnelsGrants = params.tunnelsGrants;
-  if (tunnelsGrants !== void 0) {
-    return applyDefaultTunnelGrantTarget(tunnelsGrants, options);
-  }
-  if (params.scopes) {
-    return { ...normalizeTunnelGrantTarget(options), scopes: params.scopes };
-  }
-  return void 0;
+function normalizeAuthTokenResources(params, options) {
+  return {
+    tunnels: applyDefaultTunnelResourceTarget(
+      requireTunnelResource(params),
+      options
+    )
+  };
+}
+function requireTunnelResource(params) {
+  const tunnels = params.resources?.tunnels;
+  if (tunnels !== void 0) return tunnels;
+  throw new Error("Explicit resources.tunnels is required.");
 }
-function applyDefaultTunnelGrantTarget(grants, options, inheritedTarget = false) {
+function applyDefaultTunnelResourceTarget(resource, options, inheritedTarget = false) {
   if (options?.projectScoped === false) {
-    return grants;
+    return resource;
   }
-  if ("AND" in grants) {
-    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+  if ("AND" in resource) {
+    const branchHasTarget = inheritedTarget || resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
     return {
-      AND: grants.AND.map(
-        (grant) => applyDefaultTunnelGrantTarget(grant, options, branchHasTarget)
+      AND: resource.AND.map(
+        (child) => applyDefaultTunnelResourceTarget(child, options, branchHasTarget)
       )
     };
   }
-  if ("OR" in grants) {
+  if ("OR" in resource) {
     return {
-      OR: grants.OR.map(
-        (grant) => applyDefaultTunnelGrantTarget(grant, options, inheritedTarget)
+      OR: resource.OR.map(
+        (child) => applyDefaultTunnelResourceTarget(child, options, inheritedTarget)
       )
     };
   }
-  if (grants.scopes === void 0 || tunnelGrantHasTarget(grants) || inheritedTarget) {
-    return grants;
+  if (resource.scopes === void 0 || tunnelResourceHasTarget(resource) || inheritedTarget) {
+    return resource;
   }
-  return { ...normalizeTunnelGrantTarget(options), scopes: grants.scopes };
+  return { ...normalizeTunnelResourceTarget(options), scopes: resource.scopes };
 }
-function tunnelGrantsNeedDefaultTarget(grants, inheritedTarget = false) {
-  if (grants === void 0) {
+function tunnelResourcesNeedDefaultTarget(resource, inheritedTarget = false) {
+  if (resource === void 0) {
     return false;
   }
-  if ("AND" in grants) {
-    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
-    return grants.AND.some(
-      (grant) => tunnelGrantsNeedDefaultTarget(grant, branchHasTarget)
+  if ("AND" in resource) {
+    const branchHasTarget = inheritedTarget || resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
+    return resource.AND.some(
+      (child) => tunnelResourcesNeedDefaultTarget(child, branchHasTarget)
     );
   }
-  if ("OR" in grants) {
-    return grants.OR.some(
-      (grant) => tunnelGrantsNeedDefaultTarget(grant, inheritedTarget)
+  if ("OR" in resource) {
+    return resource.OR.some(
+      (child) => tunnelResourcesNeedDefaultTarget(child, inheritedTarget)
     );
   }
-  return grants.scopes !== void 0 && !tunnelGrantHasTarget(grants) && !inheritedTarget;
+  return resource.scopes !== void 0 && !tunnelResourceHasTarget(resource) && !inheritedTarget;
 }
-function tunnelGrantHasTarget(grant) {
-  return grant.projects !== void 0 || grant.workspaces !== void 0;
+function tunnelResourceHasTarget(resource) {
+  return resource.projects !== void 0 || resource.workspaces !== void 0;
 }
-function tunnelGrantTreeHasTarget(grants) {
-  if ("AND" in grants) {
-    return grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+function tunnelResourceTreeHasTarget(resource) {
+  if ("AND" in resource) {
+    return resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
   }
-  if ("OR" in grants) {
-    return grants.OR.some((grant) => tunnelGrantTreeHasTarget(grant));
+  if ("OR" in resource) {
+    return resource.OR.some((child) => tunnelResourceTreeHasTarget(child));
   }
-  return tunnelGrantHasTarget(grants);
+  return tunnelResourceHasTarget(resource);
 }
-function normalizeTunnelGrantTarget(options) {
+function normalizeTunnelResourceTarget(options) {
   const projectId = normalizeOptionalString(options?.projectId);
   const workspaceId = normalizeOptionalString(options?.workspaceId);
   if (projectId !== void 0 && workspaceId !== void 0) {
@@ -212,7 +215,7 @@ function normalizeTunnelGrantTarget(options) {
     return {};
   }
   throw new Error(
-    "Project ID or workspace ID is required when using scope-only tunnel grants."
+    "Project ID or workspace ID is required when using scope-only tunnel resources."
   );
 }
 function normalizeOptionalString(value) {
@@ -1129,6 +1132,9 @@ function normalizeTTLSeconds(ttlSeconds) {
   }
   return ttl;
 }
+function createAPITURNCredentialsParams(ttlSeconds) {
+  return ttlSeconds === void 0 ? {} : { ttlSeconds: normalizeTTLSeconds(ttlSeconds) };
+}
 function normalizePort(port, fallback, name) {
   const normalized = port ?? fallback;
   if (!Number.isInteger(normalized) || normalized < 1 || normalized > 65535) {
@@ -1158,19 +1164,21 @@ function parseTURNTokenClaims(token) {
   if (!payloadPart) {
     throw new Error("Invalid token format.");
   }
-  let decoded;
-  try {
-    const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
-    decoded = JSON.parse(payload);
-  } catch {
-    throw new Error("Invalid token format.");
-  }
+  const decoded = parseTURNTokenPayload(payloadPart);
   const parsed = turnTokenClaimsSchema.safeParse(decoded);
   if (!parsed.success) {
     throw new Error("Invalid token format.");
   }
   return parsed.data;
 }
+function parseTURNTokenPayload(payloadPart) {
+  try {
+    const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
+    return JSON.parse(payload);
+  } catch {
+    throw new Error("Invalid token format.");
+  }
+}
 function requirePATExpiration(claims, now) {
   const exp = claims.exp;
   if (typeof exp !== "number") {
@@ -1244,8 +1252,12 @@ async function createAPITURNCredentials(options) {
     apiUrl: options.apiUrl,
     credentials: options.credentials
   });
+  const params = createAPITURNCredentialsParams(options.ttlSeconds);
   if (projectId) {
-    return await client.tunnels.projects.createTurnCredentials(projectId);
+    return await client.tunnels.projects.createTurnCredentials(
+      projectId,
+      params
+    );
   }
   if (!projectEndpoint) {
     throw new Error(
@@ -1253,7 +1265,8 @@ async function createAPITURNCredentials(options) {
     );
   }
   return await client.tunnels.projects.createTurnCredentialsByEndpoint(
-    projectEndpoint
+    projectEndpoint,
+    params
   );
 }
 function createPATTURNCredentials(options) {
@@ -1371,7 +1384,8 @@ async function createTURNCredentials(options) {
       apiUrl: options.apiUrl,
       credentials: controlPlaneCredentials,
       projectEndpoint,
-      projectId: options.projectId
+      projectId: options.projectId,
+      ttlSeconds: options.ttlSeconds
     });
   }
   const clusterDomain = normalizeClusterDomain(options.clusterDomain) ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
@@ -1607,9 +1621,11 @@ var RstreamTunnelsClient = class {
   async getEngineAuthTokenParams() {
     const target = await this.getEngineAuthTokenTarget();
     return {
-      tunnelsGrants: {
-        ...target,
-        scopes: engineAuthTokenScopes
+      resources: {
+        tunnels: {
+          ...target,
+          scopes: engineAuthTokenScopes
+        }
       }
     };
   }
@@ -1719,37 +1735,38 @@ function validateWatchQueryToken(token) {
       "Watch requires a token with a bounded lifetime of at most 3600 seconds."
     );
   }
-  if (!hasWatchOnlyTunnelGrants(parsed.data)) {
+  if (!hasWatchOnlyTunnelResources(parsed.data)) {
     throw new Error(
-      "Watch requires a fine-grained token limited to tunnel list grants for URL-based authentication."
+      "Watch requires a fine-grained token limited to tunnel list resources for URL-based authentication."
     );
   }
 }
-function hasWatchOnlyTunnelGrants(token) {
+function hasWatchOnlyTunnelResources(token) {
   if (!hasWatchOnlyPermissions(token.permissions)) {
     return false;
   }
-  if (token.tunnelsGrants === void 0) {
+  const resource = token.resources?.tunnels;
+  if (resource === void 0) {
     return false;
   }
-  return hasWatchOnlyTunnelGrant(token.tunnelsGrants);
+  return hasWatchOnlyTunnelResource(resource);
 }
-function hasWatchOnlyTunnelGrant(grant) {
-  return watchGrantBranches(grant).every(
+function hasWatchOnlyTunnelResource(resource) {
+  return watchResourceBranches(resource).every(
     (branch) => branch.hasList && !branch.hasMutationOrConnect
   );
 }
-function watchGrantBranches(grant) {
-  if ("AND" in grant) {
-    return grant.AND.reduce(
-      (branches, child) => combineWatchGrantBranches(branches, child),
+function watchResourceBranches(resource) {
+  if ("AND" in resource) {
+    return resource.AND.reduce(
+      (branches, child) => combineWatchResourceBranches(branches, child),
       [{ hasList: false, hasMutationOrConnect: false }]
     );
   }
-  if ("OR" in grant) {
-    return grant.OR.flatMap(watchGrantBranches);
+  if ("OR" in resource) {
+    return resource.OR.flatMap(watchResourceBranches);
   }
-  const tunnels = grant.scopes?.tunnels;
+  const tunnels = resource.scopes?.tunnels;
   if (tunnels === void 0) {
     return [{ hasList: false, hasMutationOrConnect: false }];
   }
@@ -1760,9 +1777,9 @@ function watchGrantBranches(grant) {
     }
   ];
 }
-function combineWatchGrantBranches(branches, child) {
+function combineWatchResourceBranches(branches, child) {
   return branches.flatMap(
-    (branch) => watchGrantBranches(child).map((childBranch) => ({
+    (branch) => watchResourceBranches(child).map((childBranch) => ({
       hasList: branch.hasList || childBranch.hasList,
       hasMutationOrConnect: branch.hasMutationOrConnect || childBranch.hasMutationOrConnect
     }))
@@ -1773,7 +1790,7 @@ function hasWatchOnlyPermissions(permissions) {
     return true;
   }
   return permissions.every(
-    (permission) => permission === "tunnels.resources.read-only" || permission === "network.resources.read-only"
+    (permission) => permission === "tunnels.resources.read-only"
   );
 }
 var Watch = class {
@@ -1859,34 +1876,50 @@ var Watch = class {
 
 // src/webtty.ts
 var z7 = __toESM(require("zod"));
-var osFamilies = [
+var osFamilySchema = z7.enum([
   "linux",
   "macos",
   "windows",
   "netbsd",
   "openbsd",
   "freebsd"
-];
+]);
+var webttyCapabilitySchema = z7.enum(["exec", "fs"]);
+var webttyFSModeSchema = z7.enum(["read-write", "read-only"]);
 var webttyServerSchema = z7.object({
   tunnel_id: z7.string(),
   host: z7.string(),
   token_auth: z7.boolean(),
-  os_family: z7.enum(osFamilies).optional(),
+  capabilities: z7.array(webttyCapabilitySchema).optional(),
+  exec_path: z7.string().optional(),
+  fs_path: z7.string().optional(),
+  fs_mode: webttyFSModeSchema.optional(),
+  os_family: osFamilySchema.optional(),
   arch: z7.string().optional(),
   os_id: z7.string().optional(),
-  // /etc/os-release::ID (ubuntu, debian, rocky, etc.)
   os_version_id: z7.string().optional(),
-  // /etc/os-release::VERSION_ID (24.04, 22.04, 11, 10.0.19045, ...)
   os_version_codename: z7.string().optional(),
-  // /etc/os-release::VERSION_CODENAME (jammy, noble...)
   os_pretty_name: z7.string().optional(),
-  // /etc/os-release::PRETTY_NAME
   kernel_release: z7.string().optional(),
-  // uname -r
   hostname: z7.string().optional(),
-  // uname -n
   labels: z7.record(z7.string(), z7.string().optional()).optional()
 });
+function isWebTTYCapability(value) {
+  return webttyCapabilitySchema.safeParse(value).success;
+}
+function parseWebTTYCapabilities(value) {
+  const values = (value ?? "").split(",").map((capability) => capability.trim()).filter(isWebTTYCapability);
+  return webttyCapabilitySchema.options.filter(
+    (capability) => values.includes(capability)
+  );
+}
+function webTTYCapabilitiesForLabels(labels) {
+  const parsed = parseWebTTYCapabilities(labels["rstream.webtty.capabilities"]);
+  return parsed.length > 0 ? parsed : ["exec"];
+}
+function webTTYHasCapability(capabilities, capability) {
+  return capabilities.includes(capability);
+}
 function parser(tunnel) {
   if (tunnel.status !== "online") return null;
   if (tunnel.publish !== true) return null;
@@ -1895,6 +1928,7 @@ function parser(tunnel) {
   if (tunnelLabels["application-protocol"] !== "rstream.webtty") {
     return null;
   }
+  const capabilities = webTTYCapabilitiesForLabels(tunnelLabels);
   const labels = {};
   for (const [key, value] of Object.entries(tunnelLabels)) {
     if (!key.startsWith("rstream.webtty.label.")) continue;
@@ -1906,6 +1940,10 @@ function parser(tunnel) {
     tunnel_id: tunnel.id,
     host: formatTunnelHost(tunnel),
     token_auth: tunnel.token_auth === true,
+    capabilities,
+    exec_path: webTTYHasCapability(capabilities, "exec") ? tunnelLabels["rstream.webtty.exec.path"] ?? "/" : void 0,
+    fs_path: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.path"] ?? "/fs" : void 0,
+    fs_mode: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.mode"] ?? "read-write" : void 0,
     os_family: tunnelLabels["rstream.webtty.os_family"],
     arch: tunnelLabels["rstream.webtty.arch"],
     os_id: tunnelLabels["rstream.webtty.os_id"],