@serve.zone/dcrouter 18.9.3 → 18.9.5

package/ts/security/classes.authentication-event-manager.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import { logger } from '../logger.js';
 import type { DcRouter } from '../classes.dcrouter.js';
+import { MetricsCache } from '../monitoring/classes.metricscache.js';
 import { AuthenticationEventDoc } from '../db/documents/classes.authentication-event.doc.js';
 import type {
   IAuthenticationEvent,
@@ -29,16 +30,23 @@ export class AuthenticationEventManager {
   private recentEvents = new Map<string, IAuthenticationEvent>();
   private flushInFlight?: Promise<void>;
   private pruneInFlight?: Promise<number>;
-  private windowStatsInFlight = new Map<string, Promise<IAuthenticationWindowStats>>();
+  private windowStatsCache = new MetricsCache(1_000, { maxAggregateEntries: 8, maxInFlight: 8 });
+  private lastPersistenceAvailable?: boolean;
 
   constructor(private dcRouterRef: DcRouter) {}
 
+  public start(): void { this.windowStatsCache.start(); }
+
+  /** Drain observer reads; MetricsManager still owns the final persistence flush. */
+  public async stop(): Promise<void> { await this.windowStatsCache.stop(); }
+
   private canPersist(): boolean {
     return this.dcRouterRef.options.dbConfig?.enabled !== false
       && Boolean(this.dcRouterRef.dcRouterDb?.isReady());
   }
 
   private rememberEvent(eventArg: IAuthenticationEvent): void {
+    this.windowStatsCache.clear();
     this.pendingEvents.set(eventArg.id, eventArg);
     this.recentEvents.set(eventArg.id, eventArg);
     while (this.pendingEvents.size > MAX_IN_MEMORY_EVENTS) {
@@ -108,7 +116,11 @@ export class AuthenticationEventManager {
 
   public flushBuffered(): Promise<void> {
     if (this.flushInFlight) return this.flushInFlight;
-    const run = this.flushBufferedUnlocked();
+    const mutates = this.canPersist() && this.pendingEvents.size > 0;
+    if (mutates) this.windowStatsCache.clear();
+    const run = this.flushBufferedUnlocked().finally(() => {
+      if (mutates) this.windowStatsCache.clear();
+    });
     this.flushInFlight = run;
     run.then(
       () => { if (this.flushInFlight === run) this.flushInFlight = undefined; },
@@ -119,9 +131,10 @@ export class AuthenticationEventManager {
 
   public pruneBefore(cutoffArg: number): Promise<number> {
     if (this.pruneInFlight) return this.pruneInFlight;
-    const run = this.canPersist()
+    this.windowStatsCache.clear();
+    const run = (this.canPersist()
       ? AuthenticationEventDoc.pruneBefore(cutoffArg)
-      : Promise.resolve(0);
+      : Promise.resolve(0)).finally(() => { this.windowStatsCache.clear(); });
     this.pruneInFlight = run;
     run.then(
       () => { if (this.pruneInFlight === run) this.pruneInFlight = undefined; },
@@ -151,12 +164,6 @@ export class AuthenticationEventManager {
       return this.getInMemoryWindow(cutoff, limitArg);
     }
 
-    try {
-      await this.flushBuffered();
-    } catch (error) {
-      logger.log('warn', `Unable to flush authentication event buffer: ${(error as Error).message}`);
-    }
-
     try {
       const durable = await AuthenticationEventDoc.getWindowSummary(cutoff, limitArg);
       const buffered = [...this.pendingEvents.values()]
@@ -190,7 +197,7 @@ export class AuthenticationEventManager {
     }
   }
 
-  public getWindowStats(
+  public async getWindowStats(
     windowMsArg = 24 * 60 * 60 * 1000,
     limitArg = 100,
   ): Promise<IAuthenticationWindowStats> {
@@ -200,21 +207,25 @@ export class AuthenticationEventManager {
     if (!Number.isSafeInteger(limitArg) || limitArg <= 0 || limitArg > 500) {
       return Promise.reject(new Error('Authentication event limit must be from 1 to 500'));
     }
-    const key = `${windowMsArg}:${limitArg}`;
-    const existing = this.windowStatsInFlight.get(key);
-    if (existing) return existing;
-    const run = this.getWindowStatsUnlocked(windowMsArg, limitArg);
-    this.windowStatsInFlight.set(key, run);
-    run.then(
-      () => { if (this.windowStatsInFlight.get(key) === run) this.windowStatsInFlight.delete(key); },
-      () => { if (this.windowStatsInFlight.get(key) === run) this.windowStatsInFlight.delete(key); },
+    const persistenceAvailable = this.canPersist();
+    if (this.lastPersistenceAvailable !== persistenceAvailable) this.windowStatsCache.clear();
+    this.lastPersistenceAvailable = persistenceAvailable;
+    // Drain before entering the shared read boundary. Recording authentication itself never waits here.
+    try {
+      await this.flushBuffered();
+    } catch (error) {
+      logger.log('warn', `Unable to flush authentication event buffer: ${(error as Error).message}`);
+    }
+    return await this.windowStatsCache.get(
+      `${windowMsArg}:${limitArg}`,
+      () => this.getWindowStatsUnlocked(windowMsArg, limitArg),
     );
-    return run;
   }
 
   /** Test-only reset for the DcRouter-owned in-process buffers. */
   public async resetForTests(): Promise<void> {
     await this.flushInFlight?.catch(() => undefined);
+    this.windowStatsCache.clear();
     this.pendingEvents.clear();
     this.recentEvents.clear();
   }

package/ts/vpn/classes.vpn-manager.ts

@@ -811,6 +811,8 @@ export class VpnManager {
     client: Pick<VpnClientDoc, 'useHostIp' | 'useDhcp' | 'staticIp' | 'forceVlan' | 'vlanId'>,
   ): void {
     client.useHostIp = client.useHostIp === true;
+    client.staticIp = client.staticIp ?? undefined;
+    client.vlanId = client.vlanId ?? undefined;
 
     if (!client.useHostIp) {
       client.useDhcp = false;
@@ -883,6 +885,35 @@ export class VpnManager {
   }
 
   private async persistClient(client: VpnClientDoc): Promise<void> {
-    await client.save();
+    if (client.creationStatus === 'new') {
+      await client.save();
+      return;
+    }
+    const persisted = await VpnClientDoc.atomicUpdate({ clientId: client.clientId }, {
+      $set: {
+        enabled: client.enabled,
+        noisePublicKey: client.noisePublicKey,
+        wgPublicKey: client.wgPublicKey,
+        createdAt: client.createdAt,
+        updatedAt: client.updatedAt,
+        ...(client.targetProfileIds !== undefined ? { targetProfileIds: client.targetProfileIds } : {}),
+        ...(client.description !== undefined ? { description: client.description } : {}),
+        ...(client.assignedIp !== undefined ? { assignedIp: client.assignedIp } : {}),
+        ...(client.wgPrivateKey !== undefined ? { wgPrivateKey: client.wgPrivateKey } : {}),
+        ...(client.expiresAt !== undefined ? { expiresAt: client.expiresAt } : {}),
+        ...(client.destinationAllowList !== undefined ? { destinationAllowList: client.destinationAllowList } : {}),
+        ...(client.destinationBlockList !== undefined ? { destinationBlockList: client.destinationBlockList } : {}),
+        ...(client.useHostIp !== undefined ? { useHostIp: client.useHostIp } : {}),
+        ...(client.useDhcp !== undefined ? { useDhcp: client.useDhcp } : {}),
+        ...(client.staticIp !== undefined ? { staticIp: client.staticIp } : {}),
+        ...(client.forceVlan !== undefined ? { forceVlan: client.forceVlan } : {}),
+        ...(client.vlanId !== undefined ? { vlanId: client.vlanId } : {}),
+      },
+      $unset: {
+        ...(client.staticIp === undefined ? { staticIp: true } : {}),
+        ...(client.vlanId === undefined ? { vlanId: true } : {}),
+      },
+    });
+    if (persisted.matchedCount !== 1) throw new Error('VPN client disappeared during update');
   }
 }

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '18.9.3',
+  version: '18.9.5',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }