@serve.zone/dcrouter 17.8.0 → 17.9.0

package/ts/opsserver/handlers/gatewayclient.handler.ts

@@ -1369,6 +1369,19 @@ export class GatewayClientHandler {
       gatewayDnsMode: dnsMode,
     };
     const normalizedRoute = this.normalizeGatewayClientRoute(validatedRoute, resolvedOwnership, externalKey);
+    if (!normalizedRoute.ingress) {
+      const existingIngress = existingRoute?.route.ingress;
+      normalizedRoute.ingress = existingIngress
+        ? structuredClone(existingIngress)
+        : {
+            directHub: true,
+            smartVpn: true,
+          };
+      console.warn(
+        `Gateway client route '${externalKey}' omitted route.ingress; `
+        + `${existingIngress ? 'preserved stored policy' : 'applied legacy directHub+smartVpn compatibility policy'}`,
+      );
+    }
 
     if (existingRoute) {
       const snapshot = structuredClone(existingRoute);
@@ -1596,7 +1609,7 @@ export class GatewayClientHandler {
     };
 
     const route = requireObject(routeArg, 'route');
-    requireOnlyKeys(route, ['name', 'match', 'action', 'priority', 'managedRouteKind', 'remoteIngress'], 'route');
+    requireOnlyKeys(route, ['name', 'match', 'action', 'priority', 'managedRouteKind', 'ingress', 'remoteIngress'], 'route');
     const name = requireString(route.name, 'route.name');
 
     const match = requireObject(route.match, 'route.match');
@@ -1670,6 +1683,15 @@ export class GatewayClientHandler {
       if (route.managedRouteKind !== 'letsencrypt-http01-forward') fail('route.managedRouteKind is unsupported');
       managedRouteKind = route.managedRouteKind as 'letsencrypt-http01-forward';
     }
+    let ingress: { directHub: boolean; smartVpn: boolean } | undefined;
+    if (route.ingress !== undefined) {
+      const ingressValue = requireObject(route.ingress, 'route.ingress');
+      requireOnlyKeys(ingressValue, ['directHub', 'smartVpn'], 'route.ingress');
+      ingress = {
+        directHub: requireBoolean(ingressValue.directHub, 'route.ingress.directHub'),
+        smartVpn: requireBoolean(ingressValue.smartVpn, 'route.ingress.smartVpn'),
+      };
+    }
     let remoteIngress: { enabled: boolean; edgeFilter?: string[] } | undefined;
     if (route.remoteIngress !== undefined) {
       const remoteValue = requireObject(route.remoteIngress, 'route.remoteIngress');
@@ -1694,6 +1716,7 @@ export class GatewayClientHandler {
       action: { type: 'forward', targets, ...(tls ? { tls } : {}), ...(websocket ? { websocket } : {}) },
       ...(priority !== undefined ? { priority } : {}),
       ...(managedRouteKind ? { managedRouteKind } : {}),
+      ...(ingress ? { ingress } : {}),
       ...(remoteIngress ? { remoteIngress } : {}),
     };
   }

package/ts/remoteingress/edge-derivation-routes.ts

@@ -21,6 +21,10 @@ export function buildEdgeOnlyDerivationRoutes(options: { dnsNsDomains?: string[]
       type: 'forward',
       targets: [{ host: '127.0.0.1', port: 53 }],
     },
+    ingress: {
+      directHub: false,
+      smartVpn: false,
+    },
     remoteIngress: {
       enabled: true,
       edgeFilter: [REMOTE_INGRESS_DNS_TAG],

package/ts/security/classes.route-policy-augmenter.ts

@@ -4,63 +4,70 @@ import type { ISecurityCompiledPolicy } from '../../ts_interfaces/data/security-
 import type { DcRouter } from '../classes.dcrouter.js';
 
 type TInboundProxyProtocolPolicy = NonNullable<plugins.smartproxy.IRouteMatch['inboundProxyProtocol']>;
+type TIngressOrigin = NonNullable<
+  NonNullable<plugins.smartproxy.IRouteConfig['security']>['ingress']
+>['allowedOrigins'][number];
 
 /**
  * Pure route-policy transformations applied before routes reach SmartProxy:
- * per-listener inbound PROXY protocol policies (driven by RemoteIngress and
- * VPN) and merging of compiled security policies.
+ * route-level trusted ingress authorization, listener-level inbound PROXY
+ * protocol policy, and merging of compiled security policies.
  */
 export class RoutePolicyAugmenter {
   constructor(private dcRouterRef: DcRouter) {}
 
   /**
-   * Ensure every route on a shared listener carries a compatible
-   * inboundProxyProtocol policy, deriving defaults from RemoteIngress/VPN.
+   * Compile each dcrouter ingress policy into SmartProxy route security, then
+   * derive one compatible PROXY protocol mode for every shared listener.
+   *
+   * The listener mode only controls parsing. Route security remains the
+   * authorization boundary, so a direct request cannot fall through to a
+   * wildcard route that only permits RemoteIngress or SmartVPN.
    */
   public applyInboundProxyProtocolPolicies(
     routes: plugins.smartproxy.IRouteConfig[],
   ): plugins.smartproxy.IRouteConfig[] {
-    const policiesByListener = new Map<string, TInboundProxyProtocolPolicy>();
-
-    for (const route of routes) {
-      const policy = route.match?.inboundProxyProtocol || this.getDesiredInboundProxyProtocolPolicy(route);
-      if (!policy) {
-        continue;
+    const routesWithIngressSecurity = routes.map((route) => {
+      const allowedOrigins = this.getAllowedIngressOrigins(route);
+      if (allowedOrigins.length === 0) {
+        throw new Error(`Route '${route.name}' has no enabled ingress path`);
       }
+      return {
+        ...route,
+        security: {
+          ...route.security,
+          ingress: {
+            allowedOrigins,
+          },
+        },
+      };
+    });
+
+    const originsByListener = new Map<string, Set<TIngressOrigin>>();
+    for (const route of routesWithIngressSecurity) {
+      const origins = route.security!.ingress!.allowedOrigins;
       for (const listenerKey of this.getInboundProxyListenerKeys(route)) {
-        const mergedPolicy = this.mergeInboundProxyProtocolPolicies(
-          policiesByListener.get(listenerKey),
-          policy,
-        );
-        if (mergedPolicy) {
-          policiesByListener.set(listenerKey, mergedPolicy);
+        const listenerOrigins = originsByListener.get(listenerKey) || new Set<TIngressOrigin>();
+        for (const origin of origins) {
+          listenerOrigins.add(origin);
         }
+        originsByListener.set(listenerKey, listenerOrigins);
       }
     }
 
-    if (policiesByListener.size === 0) {
-      return routes;
-    }
-
-    return routes.map((route) => {
-      if (route.match?.inboundProxyProtocol) {
-        return route;
-      }
-      let listenerPolicy: TInboundProxyProtocolPolicy | undefined;
+    return routesWithIngressSecurity.map((route) => {
+      const listenerOrigins = new Set<TIngressOrigin>();
       for (const listenerKey of this.getInboundProxyListenerKeys(route)) {
-        listenerPolicy = this.mergeInboundProxyProtocolPolicies(
-          listenerPolicy,
-          policiesByListener.get(listenerKey),
-        );
-      }
-      if (!listenerPolicy) {
-        return route;
+        for (const origin of originsByListener.get(listenerKey) || []) {
+          listenerOrigins.add(origin);
+        }
       }
+      const inboundProxyProtocol = this.getListenerProxyProtocolPolicy(listenerOrigins);
       return {
         ...route,
         match: {
           ...route.match,
-          inboundProxyProtocol: listenerPolicy,
+          inboundProxyProtocol,
         },
       };
     });
@@ -92,21 +99,40 @@ export class RoutePolicyAugmenter {
     };
   }
 
-  private getDesiredInboundProxyProtocolPolicy(
+  private getAllowedIngressOrigins(
     route: plugins.smartproxy.IRouteConfig,
-  ): TInboundProxyProtocolPolicy | undefined {
+  ): TIngressOrigin[] {
     const dcRoute = route as IDcRouterRouteConfig;
-    if (this.dcRouterRef.isRemoteIngressHubEnabled() && dcRoute.remoteIngress?.enabled) {
-      const ports = plugins.smartproxy.expandPortRange(route.match.ports as any) as number[];
-      if (ports.some((port) => port === 25 || port === 587)) {
-        return { mode: 'required' };
-      }
-      return { mode: 'optional' };
+    const origins = new Set<TIngressOrigin>();
+
+    if (dcRoute.ingress) {
+      if (dcRoute.ingress.directHub) origins.add('direct');
+      if (dcRoute.ingress.smartVpn) origins.add('smartVpn');
+    } else if (dcRoute.vpnOnly) {
+      origins.add('smartVpn');
+    } else {
+      // Compatibility for runtime routes and producers predating the explicit
+      // contract. Persisted routes are backfilled by the versioned migration.
+      origins.add('direct');
+      origins.add('smartVpn');
     }
-    if (this.dcRouterRef.options.vpnConfig?.enabled) {
-      return { mode: 'optional' };
+
+    if (dcRoute.remoteIngress?.enabled) {
+      origins.add('trustedProxy');
     }
-    return undefined;
+
+    return [...origins];
+  }
+
+  private getListenerProxyProtocolPolicy(
+    origins: Set<TIngressOrigin>,
+  ): TInboundProxyProtocolPolicy {
+    const allowsDirect = origins.has('direct');
+    const allowsProxied = origins.has('trustedProxy') || origins.has('smartVpn');
+
+    if (allowsDirect && allowsProxied) return { mode: 'optional' };
+    if (allowsProxied) return { mode: 'required' };
+    return { mode: 'reject' };
   }
 
   private getInboundProxyListenerKeys(route: plugins.smartproxy.IRouteConfig): string[] {
@@ -124,17 +150,4 @@ export class RoutePolicyAugmenter {
     }
     return keys;
   }
-
-  private mergeInboundProxyProtocolPolicies(
-    current?: TInboundProxyProtocolPolicy,
-    next?: TInboundProxyProtocolPolicy,
-  ): TInboundProxyProtocolPolicy | undefined {
-    if (!current) return next;
-    if (!next) return current;
-    if (current.mode === 'required') return current;
-    if (next.mode === 'required') return next;
-    if (current.mode === 'optional') return current;
-    if (next.mode === 'optional') return next;
-    return current;
-  }
 }

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.8.0',
+  version: '17.9.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts_web/elements/network/ops-view-routes.ts

@@ -500,6 +500,8 @@ export class OpsViewRoutes extends DeesElement {
       tags.push(mr.origin);
       if (!mr.enabled) tags.push('disabled');
       if (mr.route.vpnOnly) tags.push('vpn-only');
+      if (mr.route.ingress?.directHub) tags.push('direct-hub');
+      if (mr.route.ingress?.smartVpn && !mr.route.vpnOnly) tags.push('smartvpn');
 
       return {
         ...mr.route,
@@ -776,12 +778,18 @@ export class OpsViewRoutes extends DeesElement {
     const meta = merged.metadata;
     const isSystemManaged = this.isSystemManagedRoute(merged);
     const sourceBindingSummary = this.describeSourcePolicy(meta);
+    const ingressSummary = [
+      ...(merged.route.ingress?.directHub ? ['Direct hub'] : []),
+      ...(merged.route.ingress?.smartVpn ? ['SmartVPN'] : []),
+      ...(merged.route.remoteIngress?.enabled ? ['RemoteIngress'] : []),
+    ].join(', ') || 'None';
     await DeesModal.createAndShow({
       heading: `Route: ${merged.route.name}`,
       content: html`
         <div style="color: #ccc; padding: 8px 0;">
           <p>Origin: <strong style="color: #0af;">${merged.origin}</strong></p>
           <p>Status: <strong>${merged.enabled ? 'Enabled' : 'Disabled'}</strong></p>
+          <p>Ingress: <strong>${ingressSummary}</strong></p>
           ${merged.route.vpnOnly ? html`<p>Access: <strong style="color: #22c55e;">VPN only</strong></p>` : ''}
           <p>ID: <code style="color: #888;">${merged.id}</code></p>
           ${isSystemManaged ? html`<p>This route is managed by the system, a gateway client, or a specialized workflow.</p>` : ''}
@@ -908,6 +916,8 @@ export class OpsViewRoutes extends DeesElement {
       : '';
     const currentTargetPort = typeof firstTarget?.port === 'number' ? String(firstTarget.port) : '';
     const currentVpnOnly = route.vpnOnly === true;
+    const currentDirectHub = route.ingress?.directHub === true;
+    const currentSmartVpn = route.ingress?.smartVpn === true;
     const currentRemoteIngressEnabled = route.remoteIngress?.enabled === true;
     const currentEdgeFilter = route.remoteIngress?.edgeFilter || [];
     const sourceProfileOptions = getSourceProfileOptions(profiles);
@@ -947,6 +957,7 @@ export class OpsViewRoutes extends DeesElement {
           <dees-input-text .key=${'targetHost'} .label=${'Target Host'} .description=${'Used when no network target is selected'} .value=${currentTargetHost}></dees-input-text>
           <dees-input-text .key=${'targetPort'} .label=${'Target Port'} .description=${'Used when no network target is selected'} .value=${currentTargetPort}></dees-input-text>
           <dees-input-checkbox .key=${'preserveMatchPort'} .label=${'Preserve incoming port'} .value=${currentPreserveMatchPort}></dees-input-checkbox>
+          <dees-input-checkbox .key=${'directHub'} .label=${'Listen on Hub directly'} .description=${'Accept direct connections on the gateway hub. Pair private routes with the LOCAL NETWORK source policy.'} .value=${currentDirectHub}></dees-input-checkbox>
           <dees-input-checkbox .key=${'vpnOnly'} .label=${'VPN only'} .description=${'Only VPN clients with matching target profiles can access this route'} .value=${currentVpnOnly}></dees-input-checkbox>
           <dees-input-checkbox .key=${'remoteIngressEnabled'} .label=${'Enable Remote Ingress'} .value=${currentRemoteIngressEnabled}></dees-input-checkbox>
           <div class="remoteIngressGroup" style="display: ${currentRemoteIngressEnabled ? 'flex' : 'none'}; flex-direction: column; gap: 16px;">
@@ -1002,6 +1013,15 @@ export class OpsViewRoutes extends DeesElement {
               ? formData.remoteIngressEdgeFilter.filter(Boolean)
               : [];
             const vpnOnly = Boolean(formData.vpnOnly);
+            const directHub = Boolean(formData.directHub);
+            if (vpnOnly && (directHub || remoteIngressEnabled)) {
+              alert('VPN only cannot be combined with direct hub or RemoteIngress.');
+              return;
+            }
+            if (!directHub && !vpnOnly && !currentSmartVpn && !remoteIngressEnabled) {
+              alert('Enable at least one ingress path.');
+              return;
+            }
 
             const updatedRoute: any = {
               name: formData.name,
@@ -1018,6 +1038,10 @@ export class OpsViewRoutes extends DeesElement {
                   },
                 ],
               },
+              ingress: {
+                directHub,
+                smartVpn: vpnOnly || currentSmartVpn,
+              },
               vpnOnly: vpnOnly ? true : null,
               remoteIngress: remoteIngressEnabled
                 ? {
@@ -1121,6 +1145,7 @@ export class OpsViewRoutes extends DeesElement {
           <dees-input-text .key=${'targetHost'} .label=${'Target Host'} .description=${'Used when no network target is selected'} .value=${'localhost'}></dees-input-text>
           <dees-input-text .key=${'targetPort'} .label=${'Target Port'} .description=${'Used when no network target is selected'}></dees-input-text>
           <dees-input-checkbox .key=${'preserveMatchPort'} .label=${'Preserve incoming port'} .value=${false}></dees-input-checkbox>
+          <dees-input-checkbox .key=${'directHub'} .label=${'Listen on Hub directly'} .description=${'Off by default. Pair private routes with the LOCAL NETWORK source policy.'} .value=${false}></dees-input-checkbox>
           <dees-input-checkbox .key=${'vpnOnly'} .label=${'VPN only'} .description=${'Only VPN clients with matching target profiles can access this route'} .value=${false}></dees-input-checkbox>
           <dees-input-checkbox .key=${'remoteIngressEnabled'} .label=${'Enable Remote Ingress'} .value=${false}></dees-input-checkbox>
           <div class="remoteIngressGroup" style="display: none; flex-direction: column; gap: 16px;">
@@ -1176,6 +1201,15 @@ export class OpsViewRoutes extends DeesElement {
               ? formData.remoteIngressEdgeFilter.filter(Boolean)
               : [];
             const vpnOnly = Boolean(formData.vpnOnly);
+            const directHub = Boolean(formData.directHub);
+            if (vpnOnly && (directHub || remoteIngressEnabled)) {
+              alert('VPN only cannot be combined with direct hub or RemoteIngress.');
+              return;
+            }
+            if (!directHub && !vpnOnly && !remoteIngressEnabled) {
+              alert('Enable at least one ingress path.');
+              return;
+            }
 
             const route: any = {
               name: formData.name,
@@ -1192,6 +1226,10 @@ export class OpsViewRoutes extends DeesElement {
                   },
                 ],
               },
+              ingress: {
+                directHub,
+                smartVpn: vpnOnly,
+              },
               ...(vpnOnly ? { vpnOnly: true } : {}),
               ...(remoteIngressEnabled
                 ? {

package/ts_web/elements/network/special-forward-dialog.ts

@@ -93,7 +93,7 @@ export async function showLetsEncryptHttp01ForwardDialog(options: {
         <dees-input-checkbox
           .key=${'remoteIngressEnabled'}
           .label=${'Enable Remote Ingress'}
-          .value=${existing?.route.remoteIngress?.enabled === true}
+          .value=${existing ? existing.route.remoteIngress?.enabled === true : true}
         ></dees-input-checkbox>
         <dees-input-list
           .key=${'remoteIngressEdgeFilter'}