@statewalker/webrun-http-browser 0.6.5 → 0.7.0

package/src/link/http-link.ts

@@ -0,0 +1,222 @@
+import { fetchOverDuplex, serveFetchOverDuplex } from "@statewalker/webrun-http-streams";
+import { connect, overPipe, serve, structuredCodec } from "@statewalker/webrun-rpc";
+
+/**
+ * The version of the HTTP-over-`MessagePort` protocol this package speaks,
+ * sent in every hand-shake that sets up a link. Version 1 was this package's
+ * own `handleStreams` / `sendStream` (no backpressure); version 2 is
+ * webrun-rpc's `connect` / `serve` over `overPipe` with webrun-http-streams'
+ * `fetchOverDuplex` / `serveFetchOverDuplex`: one port per link, calls
+ * multiplexed on it, each call a stream with a one-chunk window in both
+ * directions, and cancellation that reaches the handler.
+ */
+export const HTTP_LINK_PROTOCOL = "webrun-http-link/2";
+
+export interface HttpLinkOptions {
+  /**
+   * Per-stream inactivity timeout in ms (webrun-rpc's): a stream with no chunk
+   * in either direction for that long fails. Unset — the default — means
+   * none: a slow consumer is throttled, never failed.
+   */
+  streamTimeout?: number;
+}
+
+/** The calling end of a link: sends requests, gets responses. */
+export interface HttpLink {
+  /** Sends `request` and resolves with the response, whose body streams. */
+  send(request: Request): Promise<Response>;
+  /**
+   * Requests whose response has not finished yet: still waiting for the head,
+   * or with a body still streaming.
+   */
+  readonly inflight: number;
+  /** Resolves when `inflight` falls to 0. */
+  whenIdle(): Promise<void>;
+  /**
+   * Closes the link. Requests in flight fail with `reason` (default: the link
+   * was closed) instead of hanging.
+   */
+  close(reason?: Error): Promise<void>;
+  readonly closed: boolean;
+}
+
+/**
+ * Why a request failed when its link went away under it: the far side (the
+ * handler, or the ServiceWorker) was lost. The request may or may not have
+ * been applied.
+ */
+export class LinkLostError extends Error {
+  constructor(message = "The link was lost while this request was in flight") {
+    super(`${message}; it may or may not have been applied.`);
+    this.name = "LinkLostError";
+  }
+}
+
+/**
+ * Posted on a link's port by the calling end when it closes the link, so the
+ * answering end can release it: a `MessagePort` never reports that its other
+ * end is gone.
+ */
+const LINK_CLOSE = "webrun-http:link-close";
+
+/** Opens the calling end of a link on `port` (one port per link). */
+export async function connectHttpLink(
+  port: MessagePort,
+  { streamTimeout }: HttpLinkOptions = {},
+): Promise<HttpLink> {
+  const { call, close } = await connect({
+    mux: overPipe(port, { codec: structuredCodec, side: "initiator" }),
+    timeout: streamTimeout,
+  });
+  return trackedLink(
+    (request) => fetchOverDuplex(call, request),
+    async () => {
+      try {
+        port.postMessage({ type: LINK_CLOSE });
+      } catch {}
+      await close();
+    },
+  );
+}
+
+/**
+ * Serves `handler` on the answering end of a link. Resolves with a teardown
+ * that abandons the requests still running (their handlers see the
+ * cancellation) and releases the port.
+ */
+export async function serveHttpLink(
+  port: MessagePort,
+  handler: (request: Request) => Response | Promise<Response>,
+  { streamTimeout }: HttpLinkOptions = {},
+): Promise<() => Promise<void>> {
+  const teardown = await serve(
+    {
+      mux: overPipe(port, { codec: structuredCodec, side: "responder" }),
+      timeout: streamTimeout,
+    },
+    serveFetchOverDuplex(async (request) => await handler(request)),
+  );
+  const onClose = (event: MessageEvent) => {
+    if ((event.data as { type?: unknown } | null)?.type === LINK_CLOSE) void close();
+  };
+  const close = async () => {
+    port.removeEventListener("message", onClose);
+    await teardown();
+  };
+  port.addEventListener("message", onClose);
+  return close;
+}
+
+/**
+ * Wraps a `send` so the link knows its requests in flight (for draining and
+ * load-based routing) and can fail them all at once when it is closed.
+ */
+export function trackedLink(
+  send: (request: Request) => Promise<Response>,
+  release: () => Promise<void> | void,
+): HttpLink {
+  let inflight = 0;
+  let closed = false;
+  let lostReason: Error | undefined;
+  const failers = new Set<(error: Error) => void>();
+  const idleWaiters: Array<() => void> = [];
+
+  const done = () => {
+    inflight--;
+    if (inflight === 0) {
+      for (const resolve of idleWaiters.splice(0)) resolve();
+    }
+  };
+
+  const link: HttpLink = {
+    get inflight() {
+      return inflight;
+    },
+    get closed() {
+      return closed;
+    },
+    whenIdle() {
+      return inflight === 0 ? Promise.resolve() : new Promise((r) => idleWaiters.push(r));
+    },
+    async send(request) {
+      if (closed) throw lostReason ?? new LinkLostError("The link is closed");
+      inflight++;
+      let finished = false;
+      const finish = () => {
+        if (finished) return;
+        finished = true;
+        failers.delete(fail);
+        done();
+      };
+      let fail: (error: Error) => void = () => {};
+      const lost = new Promise<never>((_, reject) => {
+        fail = reject;
+      });
+      failers.add(fail);
+      lost.catch(() => {});
+      let response: Response;
+      try {
+        response = await Promise.race([send(request), lost]);
+      } catch (error) {
+        finish();
+        throw lostReason ?? error;
+      }
+      if (!response.body) {
+        finish();
+        return response;
+      }
+      return new Response(
+        guardBody(response.body, lost, () => lostReason, finish),
+        {
+          status: response.status,
+          statusText: response.statusText,
+          headers: response.headers,
+        },
+      );
+    },
+    async close(reason) {
+      if (closed) return;
+      closed = true;
+      lostReason = reason ?? new LinkLostError("The link was closed");
+      for (const fail of [...failers]) fail(lostReason);
+      try {
+        await release();
+      } catch {}
+    },
+  };
+  return link;
+}
+
+/**
+ * A response body that reports its end (done, cancelled or failed) and fails
+ * with the link's reason when the link is lost mid-stream.
+ */
+function guardBody(
+  body: ReadableStream<Uint8Array>,
+  lost: Promise<never>,
+  reason: () => Error | undefined,
+  finish: () => void,
+): ReadableStream<Uint8Array> {
+  const reader = body.getReader();
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await Promise.race([reader.read(), lost]);
+        if (done) {
+          finish();
+          controller.close();
+          return;
+        }
+        controller.enqueue(value);
+      } catch (error) {
+        finish();
+        void reader.cancel().catch(() => {});
+        controller.error(reason() ?? error);
+      }
+    },
+    async cancel(why) {
+      finish();
+      await reader.cancel(why).catch(() => {});
+    },
+  });
+}

package/src/link/index.ts

@@ -0,0 +1,3 @@
+export * from "./http-link.js";
+export { holdLock, locksAvailable, newLockName, watchLock } from "./locks.js";
+export { PortRendezvous } from "./rendezvous.js";

package/src/link/locks.ts

@@ -0,0 +1,97 @@
+/**
+ * Liveness through Web Locks.
+ *
+ * A `MessagePort` never reports that the other side died, but a Web Lock
+ * does: a lock held by a page, a worker or a ServiceWorker is released by the
+ * browser the moment that context goes away, and a request waiting for it is
+ * granted then. So each side that must notice the other's death holds a lock
+ * of its own and watches the other's:
+ *
+ * - a handler holds an owner lock; the ServiceWorker watches it, and fails the
+ *   handler's requests in flight when it is granted (the tab closed, the
+ *   worker was terminated);
+ * - the ServiceWorker holds a router lock; handlers watch it, and fail their
+ *   calls through it when it is granted (the browser stopped the worker).
+ *
+ * Every function here degrades to a no-op where `navigator.locks` is missing.
+ */
+
+interface LockManagerLike {
+  query?(): Promise<{ held?: Array<{ name?: string }> }>;
+  request(
+    name: string,
+    options: { signal?: AbortSignal; mode?: "exclusive" | "shared" },
+    callback: () => unknown,
+  ): Promise<unknown>;
+}
+
+function lockManager(): LockManagerLike | undefined {
+  return (globalThis.navigator as { locks?: LockManagerLike } | undefined)?.locks;
+}
+
+export function locksAvailable(): boolean {
+  return lockManager() !== undefined;
+}
+
+/** A fresh lock name: `<prefix>:<uuid>`. */
+export function newLockName(prefix: string): string {
+  return `${prefix}:${crypto.randomUUID()}`;
+}
+
+/**
+ * Takes the lock `name` and holds it until the returned release is called or
+ * this context dies. Resolves once the lock is held; with no Web Locks,
+ * resolves at once.
+ */
+export async function holdLock(name: string): Promise<() => void> {
+  const locks = lockManager();
+  if (!locks) return () => {};
+  let release: () => void = () => {};
+  const released = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  await new Promise<void>((held) => {
+    void locks
+      .request(name, {}, () => {
+        held();
+        return released;
+      })
+      .catch(() => held());
+  });
+  return release;
+}
+
+/**
+ * Calls `onLost` once the lock `name` is granted to this context — that is,
+ * once whoever holds it is gone — and releases it at once. Returns a function
+ * that stops watching. With no Web Locks, never calls `onLost`.
+ */
+export function watchLock(name: string, onLost: () => void): () => void {
+  const locks = lockManager();
+  if (!locks) return () => {};
+  const controller = new AbortController();
+  void locks
+    .request(name, { signal: controller.signal }, () => {
+      if (!controller.signal.aborted) onLost();
+    })
+    .catch(() => {
+      // Aborted by the returned function: not a loss.
+    });
+  return () => controller.abort();
+}
+
+/**
+ * The names of the locks held right now in this origin, or `undefined` where
+ * that cannot be asked. A backup for `watchLock`: a grant can be late, a query
+ * cannot.
+ */
+export async function heldLockNames(): Promise<Set<string> | undefined> {
+  const locks = lockManager();
+  if (!locks?.query) return undefined;
+  try {
+    const { held = [] } = await locks.query();
+    return new Set(held.map((lock) => lock.name ?? ""));
+  } catch {
+    return undefined;
+  }
+}

package/src/link/rendezvous.ts

@@ -0,0 +1,60 @@
+/**
+ * Matches replies to requests by id, for the control messages that hand
+ * WebSocket ports across: each waiting request has a deadline, and all of a
+ * peer's waiting requests can be failed at once when the peer is lost.
+ */
+export class PortRendezvous<T> {
+  private readonly _waiting = new Map<
+    string,
+    {
+      resolve: (value: T) => void;
+      reject: (error: Error) => void;
+      timer: ReturnType<typeof setTimeout>;
+    }
+  >();
+  private _counter = 0;
+
+  constructor(private readonly _prefix = "r") {}
+
+  /** A fresh id for a request. */
+  newId(): string {
+    return `${this._prefix}:${++this._counter}`;
+  }
+
+  get size(): number {
+    return this._waiting.size;
+  }
+
+  /** Waits for the reply to `id`, failing after `timeoutMs`. */
+  wait(id: string, timeoutMs: number, describe = "the reply"): Promise<T> {
+    return new Promise<T>((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this._waiting.delete(id);
+        reject(new Error(`No answer to ${describe} within ${timeoutMs} ms`));
+      }, timeoutMs);
+      this._waiting.set(id, { resolve, reject, timer });
+    });
+  }
+
+  /** Delivers the reply to `id`. `false` when nobody waits for it (it timed out). */
+  settle(id: string, value: T): boolean {
+    const waiting = this._waiting.get(id);
+    if (!waiting) return false;
+    this._waiting.delete(id);
+    clearTimeout(waiting.timer);
+    waiting.resolve(value);
+    return true;
+  }
+
+  fail(id: string, error: Error): void {
+    const waiting = this._waiting.get(id);
+    if (!waiting) return;
+    this._waiting.delete(id);
+    clearTimeout(waiting.timer);
+    waiting.reject(error);
+  }
+
+  failAll(error: Error): void {
+    for (const id of [...this._waiting.keys()]) this.fail(id, error);
+  }
+}

package/src/relay/index-sw.ts

@@ -1,9 +1,12 @@
 import { HttpError } from "@statewalker/webrun-http-streams";
 import { get, set } from "idb-keyval";
-import { callChannel, handleChannelCalls } from "../core/data-calls.js";
+import { callChannel, handleChannelCalls, withTransfer } from "../core/data-calls.js";
 import { newRegistry } from "../core/registry.js";
 import { handleClaimRequests } from "../core/service-worker-control.js";
-import { sendHttpRequest } from "../http/http-send-recieve.js";
+import { HTTP_LINK_PROTOCOL } from "../link/http-link.js";
+import { WS_CONNECT_CALL } from "../sw/protocol.js";
+import type { WebSocketConnection } from "../ws/client.js";
+import { type ConnectReply, sendOverConnection, type WebSocketConnectParams } from "./index.js";
 import { type MountSpec, type MountTable, newMountTable } from "./mount-table.js";
 import { splitServiceUrl } from "./split-service-url.js";
 
@@ -125,8 +128,18 @@ export interface RelayServiceWorkerOptions {
   mounts?: Array<{ key: string } & MountSpec>;
   /** Paths the relay never claims. Checked before the table. */
   exclude?: (url: URL) => boolean;
-  /** Refuse a registration from the wrong client. Default: everyone may. */
-  canRegister?: (client: Client, key: string) => boolean | Promise<boolean>;
+  /**
+   * Refuse a registration from the wrong client. Default: everyone may.
+   *
+   * `path` is where the registrant asks to be mounted (`undefined` for the
+   * `/~<key>/` addressing), so a host can vet where a key lands, not only who
+   * takes it: on an origin whose name is not a secret, a page could otherwise
+   * mount an allowed key at `/index.html` and outrank `/` on longest-prefix.
+   * Also consulted for `UNREGISTER`, with the path the key is mounted at.
+   */
+  canRegister?: (client: Client, key: string, path?: string) => boolean | Promise<boolean>;
+  /** Per-stream inactivity timeout of the links to services, in ms. Default none. */
+  streamTimeout?: number;
   /** Default `"last-wins"`, the behaviour before this option existed. */
   takeover?: "first-wins" | "last-wins";
   /** Stamp headers on responses the relay makes. Not applied to network fetches. */
@@ -220,8 +233,12 @@ export function startRelayServiceWorker(
       if (!source) return false;
       const { key, path } = data as { key: string; path?: string };
 
-      if (options.canRegister != null && !(await options.canRegister(source, key))) {
-        throw new Error(`this client may not register "${key}"`);
+      if (options.canRegister != null && !(await options.canRegister(source, key, path))) {
+        throw new Error(
+          path == null
+            ? `this client may not register "${key}"`
+            : `this client may not register "${key}" at "${path}"`,
+        );
       }
 
       // `last-wins` -- the untouched default -- must cost exactly what it did
@@ -242,8 +259,22 @@ export function startRelayServiceWorker(
     }),
   );
   register(
-    handleChannelCalls(self, "UNREGISTER", async (_event, data) => {
+    handleChannelCalls(self, "UNREGISTER", async (event, data) => {
+      // Only the client that holds a key may drop it -- or anyone the host
+      // allows, once the holder is gone. Any page of the relay origin can post
+      // here, including foreign content the host serves there.
+      const source = event.source as Client | null;
+      if (!source) return false;
       const { key } = data as { key: string };
+      const current = await clientsRegistry.getMount(key);
+      if (current == null) return false;
+      const isCurrentLive = (await clientsRegistry.getClient(key)) != null;
+      if (isCurrentLive && current.clientId !== source.id) {
+        throw new Error(`"${key}" is served by another client`);
+      }
+      if (options.canRegister != null && !(await options.canRegister(source, key, current.path))) {
+        throw new Error(`this client may not unregister "${key}"`);
+      }
       removeRegisteredMount(mounts, key, hostKeys);
       return await clientsRegistry.removeClient(key);
     }),
@@ -253,7 +284,41 @@ export function startRelayServiceWorker(
       const { key } = data as { key: string };
       const client = await clientsRegistry.getClient(key);
       if (!client) throw new Error(`Target client was not found. Target key: "${key}".`);
-      return await callChannel<boolean>(client, "CONNECT", data, port);
+      const reply = await callChannel<unknown>(client, "CONNECT", data, port);
+      // A socket's port comes back in the reply: pass it on.
+      const socketPort = (reply as Partial<WebSocketConnection> | null)?.port;
+      return socketPort ? withTransfer(reply, [socketPort]) : reply;
+    }),
+  );
+  register(
+    handleChannelCalls(self, WS_CONNECT_CALL, async (event, data) => {
+      // A page of the relay origin -- content a service serves there -- opens
+      // a socket to the service its url routes to, as it would fetch it.
+      const source = event.source as Client | null;
+      if (!source?.url || new URL(source.url).origin !== self.location.origin) {
+        throw new Error("Only this origin's pages may open sockets");
+      }
+      const { url, protocols = [] } = data as { url: string; protocols?: string[] };
+      const httpUrl = new URL(url);
+      if (httpUrl.protocol === "ws:") httpUrl.protocol = "http:";
+      else if (httpUrl.protocol === "wss:") httpUrl.protocol = "https:";
+      await restored.catch(() => {});
+      const key = resolveServiceKey(httpUrl, mounts, self.location.origin);
+      if (key == null) throw new Error(`No service serves ${url}`);
+      const client = await clientsRegistry.getClient(key);
+      if (!client) throw new Error(`No service serves ${url}`);
+      const channel = new MessageChannel();
+      try {
+        const connection = await callChannel<WebSocketConnection>(
+          client,
+          "CONNECT",
+          { type: "ws", key, url: `${httpUrl}`, protocols } satisfies WebSocketConnectParams,
+          channel.port2,
+        );
+        return withTransfer(connection, [connection.port]);
+      } finally {
+        channel.port1.close();
+      }
     }),
   );
 
@@ -264,10 +329,17 @@ export function startRelayServiceWorker(
       const channel = new MessageChannel();
       const client = await clientsRegistry.getClient(key);
       if (!client) throw HttpError.errorResourceGone(params);
-      const data = { type: "http", key };
-      const accepted = await callChannel<boolean>(client, "CONNECT", data, channel.port2);
-      if (!accepted) throw HttpError.errorForbidden(params);
-      const response = await sendHttpRequest(channel.port1, request);
+      const data = { type: "http", key, wire: HTTP_LINK_PROTOCOL };
+      const reply = await callChannel<boolean | ConnectReply>(
+        client,
+        "CONNECT",
+        data,
+        channel.port2,
+      );
+      if (!reply) throw HttpError.errorForbidden(params);
+      const response = await sendOverConnection(channel.port1, reply, request, {
+        streamTimeout: options.streamTimeout,
+      });
       return options.decorateResponse?.(response, request) ?? response;
     } catch (error) {
       const httpError = HttpError.fromError(error);