@soundworks/core 4.0.0-alpha.2 → 4.0.0-alpha.20

package/src/server/Server.js

@@ -5,17 +5,19 @@ import path from 'node:path';
 import os from 'node:os';
 import { X509Certificate, createPrivateKey } from 'node:crypto';
 
+import { isPlainObject, idGenerator, getTime } from '@ircam/sc-utils';
 import chalk from 'chalk';
 import compression from 'compression';
 import express from 'express';
-import isPlainObject from 'is-plain-obj';
+import equal from 'fast-deep-equal';
 import Keyv from 'keyv';
 import { KeyvFile } from 'keyv-file';
-import merge from 'lodash.merge';
+import merge from 'lodash/merge.js';
 import pem from 'pem';
 import compile from 'template-literal';
 
 import auditSchema from './audit-schema.js';
+import { encryptData, decryptData } from './crypto.js';
 import Client from './Client.js';
 import ContextManager from './ContextManager.js';
 import PluginManager from './PluginManager.js';
@@ -23,12 +25,14 @@ import StateManager from './StateManager.js';
 import Sockets from './Sockets.js';
 import logger from '../common/logger.js';
 import {
+  SERVER_ID,
   CLIENT_HANDSHAKE_REQUEST,
   CLIENT_HANDSHAKE_RESPONSE,
   CLIENT_HANDSHAKE_ERROR,
   AUDIT_STATE_NAME,
 } from '../common/constants.js';
 
+
 let _dbNamespaces = new Set();
 
 /**
@@ -73,6 +77,8 @@ const DEFAULT_CONFIG = {
   },
 };
 
+const TOKEN_VALID_DURATION = 20; // sec
+
 // set terminal title
 /** @private */
 function setTerminalTitle(server) {
@@ -156,8 +162,8 @@ class Server {
       throw new Error(`[soundworks:Server] Invalid argument for Server constructor, config should be an object`);
     }
     /**
-     * Given config object merged with the following defaults:
-     * ```
+     * @description Given config object merged with the following defaults:
+     * @example
      * {
      *   env: {
      *     type: 'development',
@@ -178,7 +184,6 @@ class Server {
      *     clients: {},
      *   }
      * }
-     * ```
      */
     this.config = merge({}, DEFAULT_CONFIG, config);
 
@@ -210,11 +215,11 @@ class Server {
         throw new Error(`[soundworks:Server] Invalid "env.httpsInfos" config, should contain both "cert" and "key" entries`);
       }
       // @todo - move that to constructor
-      if (!fs.existsSync(httpsInfos.cert)) {
+      if (httpsInfos.cert !== null && !fs.existsSync(httpsInfos.cert)) {
         throw new Error(`[soundworks:Server] Invalid "env.httpsInfos" config, "cert" file not found`);
       }
 
-      if (!fs.existsSync(httpsInfos.key)) {
+      if (httpsInfos.key !== null && !fs.existsSync(httpsInfos.key)) {
         throw new Error(`[soundworks:Server] Invalid "env.httpsInfos" config, "key" file not found`);
       }
     }
@@ -236,8 +241,10 @@ class Server {
      * // expose assets located in the `soundfiles` directory on the network
      * server.router.use('/soundfiles', express.static('soundfiles')));
      */
+    // @note: we use express() instead of express.Router() because all 404 and
+    // error stuff is handled by default
     this.router = express();
-    // compression (must be set before serve-static)
+    // compression (must be set before express.static())
     this.router.use(compression());
 
     /**
@@ -312,7 +319,15 @@ class Server {
     /** @private */
     this._onStatusChangeCallbacks = new Set();
     /** @private */
+    this._onClientConnectCallbacks = new Set();
+    /** @private */
+    this._onClientDisconnectCallbacks = new Set();
+    /** @private */
     this._auditState = null;
+    /** @private */
+    this._pendingConnectionTokens = new Set();
+    /** @private */
+    this._trustedClients = new Set();
 
     // register audit state schema
     this.stateManager.registerSchema(AUDIT_STATE_NAME, auditSchema);
@@ -321,6 +336,15 @@ class Server {
     setTerminalTitle(this);
   }
 
+  /**
+   * Id of the server, a constant set to -1
+   * @type {Number}
+   * @readonly
+   */
+  get id() {
+    return SERVER_ID;
+  }
+
   /**
    * The `init` method is part of the initialization lifecycle of the `soundworks`
    * server. Most of the time, the `init` method will be implicitly called by the
@@ -357,11 +381,24 @@ class Server {
 
     // basic http authentication
     if (this.config.env.auth) {
-      this.router.use((req, res, next) => {
+      const ids = idGenerator();
 
-        const isProtected  = this.config.env.auth.clients
-          .map(type => req.path.endsWith(`/${type}`))
-          .reduce((acc, value) => acc || value, false);
+      const soundworksAuth = (req, res, next) => {
+        let role = null;
+
+        for (let [_role, config] of Object.entries(this.config.app.clients)) {
+          if (req.path === config.route) {
+            role = _role;
+          }
+        }
+
+        // route that are not client entry points just pass through the middleware
+        if (role === null) {
+          next();
+          return;
+        }
+
+        const isProtected  = this.isProtected(role);
 
         if (isProtected) {
           // authentication middleware
@@ -373,35 +410,57 @@ class Server {
           // verify login and password are set and correct
           if (login && password && login === auth.login && password === auth.password) {
             // -> access granted...
+            // generate token for web socket to check connections
+            const id = ids.next().value;
+            const ip = req.ip;
+            const time = getTime();
+            const token = { id, ip, time };
+            const encryptedToken = encryptData(token);
+
+            this._pendingConnectionTokens.add(encryptedToken);
+
+            setTimeout(() => {
+              this._pendingConnectionTokens.delete(encryptedToken);
+            }, TOKEN_VALID_DURATION * 1000);
+
+            // pass to the response object to be send to the client
+            res.swToken = encryptedToken;
+
             return next();
           }
 
-          // -> access denied...
+          // show login / password modal
           res.writeHead(401, {
             'WWW-Authenticate':'Basic',
             'Content-Type':'text/plain',
           });
+
           res.end('Authentication required.');
         } else {
-          // route not protected
+          // route is not protected
           return next();
         }
-      });
-    }
+      };
 
-    // start http server
-    const useHttps = this.config.env.useHttps || false;
+      this.router.use(soundworksAuth);
+    }
 
     // ------------------------------------------------------------
     // create HTTP(S) SERVER
     // ------------------------------------------------------------
+    const useHttps = this.config.env.useHttps || false;
+
     if (!useHttps) {
       this.httpServer = http.createServer(this.router);
     } else {
       const httpsInfos = this.config.env.httpsInfos;
+      let useSelfSigned = false;
 
-      // if certs have been given in config
-      if (httpsInfos !== null) {
+      if (!httpsInfos || equal(httpsInfos, { cert: null, key: null })) {
+        useSelfSigned = true;
+      }
+
+      if (!useSelfSigned) {
         try {
           // existance of file is checked in contructor
           let cert = fs.readFileSync(httpsInfos.cert);
@@ -411,7 +470,7 @@ class Server {
           // this fails with self-signed certificates for whatever reason...
           try {
             x509 = new X509Certificate(cert);
-          } catch(err) {
+          } catch (err) {
             this._dispatchStatus('errored');
             throw new Error(`[soundworks:Server] Invalid https cert file`);
           }
@@ -423,7 +482,7 @@ class Server {
               this._dispatchStatus('errored');
               throw new Error(`[soundworks:Server] Invalid https key file`);
             }
-          } catch(err) {
+          } catch (err) {
             this._dispatchStatus('errored');
             throw new Error(`[soundworks:Server] Invalid https key file`);
           }
@@ -447,7 +506,7 @@ class Server {
           };
 
           this.httpServer = https.createServer({ key, cert }, this.router);
-        } catch(err) {
+        } catch (err) {
           logger.error(`
 Invalid certificate files, please check your:
 - key file: ${httpsInfos.key}
@@ -591,7 +650,7 @@ Invalid certificate files, please check your:
     await this.sockets.start(
       this,
       this.config.env.websockets,
-      (role, socket) => this._onSocketConnection(role, socket),
+      (...args) => this._onSocketConnection(...args),
     );
 
     // ------------------------------------------------------------
@@ -648,6 +707,10 @@ Invalid certificate files, please check your:
 
         await this._dispatchStatus('started');
 
+        if (this.config.env.type === 'development') {
+          logger.log(`\n> press "${chalk.bold('Ctrl + C')}" to exit`);
+        }
+
         resolve();
       });
     });
@@ -706,6 +769,8 @@ Invalid certificate files, please check your:
       route += `${role}`;
     }
 
+    this.config.app.clients[role].route = route;
+
     // define template filename: `${role}.html` or `default.html`
     const {
       templatePath,
@@ -722,7 +787,7 @@ Invalid certificate files, please check your:
     try {
       const stats = fs.statSync(clientTmpl);
       template = stats.isFile() ? clientTmpl : defaultTmpl;
-    } catch(err) {
+    } catch (err) {
       template = defaultTmpl;
     }
 
@@ -730,15 +795,21 @@ Invalid certificate files, please check your:
 
     try {
       tmplString = fs.readFileSync(template, 'utf8');
-    } catch(err) {
+    } catch (err) {
       throw new Error(`[soundworks:Server] html template file "${template}" not found`);
     }
 
     const tmpl = templateEngine.compile(tmplString);
-    // http request
-    router.get(route, (req, res) => {
+
+    const soundworksClientHandler = (req, res) => {
       const data = clientConfigFunction(role, this.config, req);
 
+      // if the client has gone through the connection middleware (add succedeed),
+      // add the token to the data object
+      if (res.swToken) {
+        data.token = res.swToken;
+      }
+
       // CORS / COOP / COEP headers for `crossOriginIsolated pages,
       // enables `sharedArrayBuffers` and high precision timers
       // cf. https://web.dev/why-coop-coep/
@@ -752,34 +823,78 @@ Invalid certificate files, please check your:
 
       const appIndex = tmpl(data);
       res.end(appIndex);
-    });
+    };
+
+    // http request
+    router.get(route, soundworksClientHandler);
 
     // return route infos for logging on server start
     return route;
   }
 
+  onClientConnect(callback) {
+    this._onClientConnectCallbacks.add(callback);
+
+    return () => this._onClientConnectCallbacks.delete(callback);
+  }
+
+  onClientDisconnect(callback) {
+    this._onClientDisconnectCallbacks.add(callback);
+
+    return () => this._onClientDisconnectCallbacks.delete(callback);
+  }
+
   /**
    * Socket connection callback.
    * @private
    */
-  _onSocketConnection(role, socket) {
+  _onSocketConnection(role, socket, connectionToken) {
     const client = new Client(role, socket);
     const roles = Object.keys(this.config.app.clients);
 
+    // this has been validated
+    if (this.isProtected(role) && this.isValidConnectionToken(connectionToken)) {
+      const { ip } = decryptData(connectionToken);
+      const newData = {
+        ip: ip,
+        id: client.id,
+      };
+
+      const newToken = encryptData(newData);
+
+      client.token = newToken;
+
+      this._pendingConnectionTokens.delete(connectionToken);
+      this._trustedClients.add(client);
+    }
+
     socket.addListener('close', async () => {
-      // do nothin if client type was invalid
+      // do nothing if client role is invalid
       if (roles.includes(role)) {
         // decrement audit state counter
         const numClients = this._auditState.get('numClients');
         numClients[role] -= 1;
         this._auditState.set({ numClients });
 
-        // clean context manager, await before cleaning state manager
-        await this.contextManager.removeClient(client);
-        // remove client from pluginManager
-        await this.pluginManager.removeClient(client);
-        // clean state manager
-        await this.stateManager.removeClient(client.id);
+        // delete token
+        if (this._trustedClients.has(client)) {
+          this._trustedClients.delete(client);
+        }
+
+        // if something goes wrong here, the 'close' event is called again and
+        // again and again... let's just log the error and terminate the socket
+        try {
+          // clean context manager, await before cleaning state manager
+          await this.contextManager.removeClient(client);
+          // remove client from pluginManager
+          await this.pluginManager.removeClient(client);
+          // clean state manager
+          await this.stateManager.removeClient(client.id);
+
+          this._onClientDisconnectCallbacks.forEach(callback => callback(client));
+        } catch (err) {
+          console.error(err);
+        }
       }
 
       // clean sockets
@@ -801,7 +916,7 @@ Invalid certificate files, please check your:
 
       try {
         this.pluginManager.checkRegisteredPlugins(registeredPlugins);
-      } catch(err) {
+      } catch (err) {
         socket.send(CLIENT_HANDSHAKE_ERROR, {
           type: 'invalid-plugin-list',
           message: err.message,
@@ -826,8 +941,10 @@ Invalid certificate files, please check your:
       // add client to context manager
       await this.contextManager.addClient(client);
 
-      const { id, uuid } = client;
-      socket.send(CLIENT_HANDSHAKE_RESPONSE, { id, uuid });
+      this._onClientConnectCallbacks.forEach(callback => callback(client));
+
+      const { id, uuid, token } = client;
+      socket.send(CLIENT_HANDSHAKE_RESPONSE, { id, uuid, token });
     });
   }
 
@@ -904,6 +1021,27 @@ Invalid certificate files, please check your:
    * you should rely on these defaults._
    */
   useDefaultApplicationTemplate() {
+    const buildDirectory = path.join('.build', 'public');
+
+    const useMinifiedFile = {};
+    const roles = Object.keys(this.config.app.clients);
+
+    roles.forEach(role => {
+      if (this.config.env.type === 'production') {
+        // check if minified file exists
+        const minifiedFilePath = path.join(buildDirectory, `${role}.min.js`);
+
+        if (fs.existsSync(minifiedFilePath)) {
+          useMinifiedFile[role] = true;
+        } else {
+          console.log(chalk.yellow(`    > Minified file not found for client "${role}", falling back to normal build file (use \`npm run build:production && npm start\` to use minified files)`));
+          useMinifiedFile[role] = false;
+        }
+      } else {
+        useMinifiedFile[role] = false;
+      }
+    });
+
     this._applicationTemplateOptions = {
       templateEngine: { compile },
       templatePath: path.join('.build', 'server', 'tmpl'),
@@ -918,13 +1056,14 @@ Invalid certificate files, please check your:
             type: config.env.type,
             websockets: config.env.websockets,
             subpath: config.env.subpath,
+            useMinifiedFile: useMinifiedFile[role],
           },
         };
       },
     };
 
     this.router.use(express.static('public'));
-    this.router.use('/build', express.static(path.join('.build', 'public')));
+    this.router.use('/build', express.static(buildDirectory));
   }
 
   /**
@@ -960,6 +1099,81 @@ Invalid certificate files, please check your:
 
     return this._auditState;
   }
+
+  /** @private */
+  isProtected(role) {
+    if (this.config.env.auth && Array.isArray(this.config.env.auth.clients)) {
+      return this.config.env.auth.clients.includes(role);
+    }
+
+    return false;
+  }
+
+  /** @private */
+  isValidConnectionToken(token) {
+    // token should be in pending token list
+    if (!this._pendingConnectionTokens.has(token)) {
+      return false;
+    }
+
+    // check the token is not too old
+    const data = decryptData(token);
+    const now = getTime();
+
+    // token is valid only for 30 seconds (this is arbitrary)
+    if (now > data.time + TOKEN_VALID_DURATION) {
+      // delete the token, is too old
+      this._pendingConnectionTokens.delete(token);
+      return false;
+    } else {
+      return true;
+    }
+  }
+
+  /**
+   * Check if the given client is trusted, i.e. config.env.type == 'production'
+   * and the client is protected behind a password.
+   *
+   * @param {server.Client} client - Client to be tested
+   * @returns {Boolean}
+   */
+  isTrustedClient(client) {
+    if (this.config.env.type !== 'production') {
+      return true;
+    } else {
+      return this._trustedClients.has(client);
+    }
+  }
+
+  /**
+   * Check if the token from a client is trusted, i.e. config.env.type == 'production'
+   * and the client is protected behind a password.
+   *
+   * @param {Number} clientId - Id of the client
+   * @param {Number} clientIp - Ip of the client
+   * @param {String} token - Token to be tested
+   * @returns {Boolean}
+   */
+  // for stateless interactions, e.g. POST files
+  isTrustedToken(clientId, clientIp, token) {
+    if (this.config.env.type !== 'production') {
+      return true;
+    } else {
+      for (let client of this._trustedClients) {
+        if (client.id === clientId && client.token === token) {
+          // check that given token is consistent with client ip and id
+          const { id, ip } = decryptData(client.token);
+
+          if (clientId === id && clientIp === ip) {
+            return true;
+          }
+        }
+
+      }
+
+      return false;
+    }
+  }
 }
 
 export default Server;

package/src/server/SharedState.js

@@ -18,7 +18,6 @@ import BaseSharedState from '../common/BaseSharedState.js';
  * @callback server.SharedState~deleteOnUpdateCallback
  */
 
-
 /**
  * The `SharedState` is one of the most important and versatile abstraction provided
  * by `soundworks`. It represents a set of parameters that are synchronized accross

package/src/server/SharedStateCollection.js

@@ -0,0 +1,39 @@
+import BaseSharedStateCollection from '../common/BaseSharedStateCollection.js';
+
+// this file exists only for documentation purposesSharedStateCollection.js
+
+/**
+ * @callback server.SharedStateCollection~onUpdateCallback
+ * @param {server.SharedState} state - State that triggered the update.
+ * @param {Object} newValues - Key / value pairs of the updates that have been
+ *  applied to the state.
+ * @param {Object} oldValues - Key / value pairs of the updated params before
+ *  the updates has been applied to the state.
+ * @param {Mixed} [context=null] - Optionnal context object that has been passed
+ *  with the values updates in the `set` call.
+ */
+
+/**
+ * The `SharedStateCollection` interface represent a collection of all states
+ * created from a given schema name on the network.
+ *
+ * It can optionnaly exclude the states created by the current node.
+ *
+ * See {@link server.StateManager#getCollection} for factory method API
+ *
+ * ```
+ * const collection = await server.stateManager.getCollection('my-schema');
+ * const allValues = collection.getValues();
+ * collection.onUpdate((state, newValues, oldValues, context) => {
+ *   // do something
+ * });
+ * ```
+ * @memberof server
+ * @extends BaseSharedStateCollection
+ * @inheritdoc
+ * @hideconstructor
+ */
+class SharedStateCollection extends BaseSharedStateCollection {}
+
+export default SharedStateCollection;
+