@studiometa/trafic-agent 0.1.8 → 0.1.9

package/dist/server-D0N_6y4c.js

@@ -0,0 +1,687 @@
+import { existsSync, readFileSync, watch } from "node:fs";
+import { execSync } from "node:child_process";
+import Database from "better-sqlite3";
+import { dirname, join, resolve } from "node:path";
+import { createServer } from "node:http";
+import { fileURLToPath } from "node:url";
+/**
+* Check if an IP matches a pattern (supports CIDR notation)
+*/
+function matchIp(ip, pattern) {
+	if (ip === pattern) return true;
+	if (pattern.includes("/")) return matchCidr(ip, pattern);
+	if (pattern.includes("*")) return new RegExp("^" + pattern.replace(/\./g, "\\.").replace(/\*/g, ".*") + "$").test(ip);
+	return false;
+}
+/**
+* Match IP against CIDR range
+*/
+function matchCidr(ip, cidr) {
+	const [range, bits] = cidr.split("/");
+	const mask = parseInt(bits, 10);
+	const ipNum = ipToNumber(ip);
+	const rangeNum = ipToNumber(range);
+	if (ipNum === null || rangeNum === null) return false;
+	const maskNum = ~((1 << 32 - mask) - 1);
+	return (ipNum & maskNum) === (rangeNum & maskNum);
+}
+/**
+* Convert IP string to number
+*/
+function ipToNumber(ip) {
+	const parts = ip.split(".");
+	if (parts.length !== 4) return null;
+	let num = 0;
+	for (const part of parts) {
+		const n = parseInt(part, 10);
+		if (isNaN(n) || n < 0 || n > 255) return null;
+		num = num << 8 | n;
+	}
+	return num >>> 0;
+}
+/**
+* Match hostname against a glob pattern
+*/
+function matchHostname(hostname, pattern) {
+	if (hostname === pattern) return true;
+	return new RegExp("^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".") + "$").test(hostname);
+}
+/**
+* Parse Basic auth header
+*/
+function parseBasicAuth(header) {
+	if (!header.startsWith("Basic ")) return null;
+	try {
+		const encoded = header.slice(6);
+		const decoded = Buffer.from(encoded, "base64").toString("utf-8");
+		const colonIndex = decoded.indexOf(":");
+		if (colonIndex === -1) return null;
+		return {
+			username: decoded.slice(0, colonIndex),
+			password: decoded.slice(colonIndex + 1)
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Parse Bearer token from header
+*/
+function parseBearerToken(header) {
+	if (!header.startsWith("Bearer ")) return null;
+	return header.slice(7);
+}
+/**
+* Check authentication for a request
+*/
+function checkAuth(request, config) {
+	const { hostname, ip, authorization } = request;
+	const realIp = request.forwardedFor?.split(",")[0].trim() ?? ip;
+	for (const pattern of config.allowedIps) if (matchIp(realIp, pattern)) return {
+		allowed: true,
+		reason: "ip"
+	};
+	for (const rule of config.rules) if (matchHostname(hostname, rule.match)) return checkRule(rule, realIp, authorization, config);
+	return applyDefaultPolicy(config, realIp, authorization);
+}
+/**
+* Check a specific rule
+*/
+function checkRule(rule, ip, authorization, config) {
+	if (rule.allowedIps) {
+		for (const pattern of rule.allowedIps) if (matchIp(ip, pattern)) return {
+			allowed: true,
+			reason: "rule"
+		};
+	}
+	switch (rule.policy) {
+		case "allow": return {
+			allowed: true,
+			reason: "rule"
+		};
+		case "deny": return {
+			allowed: false,
+			reason: "rule"
+		};
+		case "token": {
+			if (!authorization) return {
+				allowed: false,
+				reason: "rule"
+			};
+			const token = parseBearerToken(authorization);
+			const tokens = rule.tokens ?? config.tokens;
+			if (token && tokens.includes(token)) return {
+				allowed: true,
+				reason: "token"
+			};
+			return {
+				allowed: false,
+				reason: "rule"
+			};
+		}
+		case "basic": {
+			if (!authorization) return {
+				allowed: false,
+				reason: "rule"
+			};
+			const creds = parseBasicAuth(authorization);
+			if (creds) {
+				const credString = `${creds.username}:${creds.password}`;
+				if (config.basicAuth.includes(credString)) return {
+					allowed: true,
+					reason: "basic"
+				};
+			}
+			return {
+				allowed: false,
+				reason: "rule"
+			};
+		}
+		default: return {
+			allowed: false,
+			reason: "rule"
+		};
+	}
+}
+/**
+* Apply default policy
+*/
+function applyDefaultPolicy(config, ip, authorization) {
+	switch (config.defaultPolicy) {
+		case "allow": return {
+			allowed: true,
+			reason: "default"
+		};
+		case "deny": return {
+			allowed: false,
+			reason: "default"
+		};
+		case "basic": {
+			if (!authorization) return {
+				allowed: false,
+				reason: "default"
+			};
+			const creds = parseBasicAuth(authorization);
+			if (creds) {
+				const credString = `${creds.username}:${creds.password}`;
+				if (config.basicAuth.includes(credString)) return {
+					allowed: true,
+					reason: "basic"
+				};
+			}
+			const token = parseBearerToken(authorization);
+			if (token && config.tokens.includes(token)) return {
+				allowed: true,
+				reason: "token"
+			};
+			return {
+				allowed: false,
+				reason: "default"
+			};
+		}
+		case "token": {
+			if (!authorization) return {
+				allowed: false,
+				reason: "default"
+			};
+			const token = parseBearerToken(authorization);
+			if (token && config.tokens.includes(token)) return {
+				allowed: true,
+				reason: "token"
+			};
+			return {
+				allowed: false,
+				reason: "default"
+			};
+		}
+		default: return {
+			allowed: false,
+			reason: "default"
+		};
+	}
+}
+function parseSimpleYaml$1(content) {
+	const result = {};
+	const lines = content.split("\n");
+	for (const line of lines) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#")) continue;
+		const colonIndex = trimmed.indexOf(":");
+		if (colonIndex === -1) continue;
+		const key = trimmed.slice(0, colonIndex).trim();
+		let value = trimmed.slice(colonIndex + 1).trim();
+		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+		result[key] = value;
+	}
+	return result;
+}
+/**
+* Load projects from DDEV's project_list.yaml
+* Returns a map of project name -> app root path
+*/
+function loadProjectList(projectListPath) {
+	if (!existsSync(projectListPath)) return /* @__PURE__ */ new Map();
+	const parsed = parseSimpleYaml$1(readFileSync(projectListPath, "utf-8"));
+	return new Map(Object.entries(parsed));
+}
+/**
+* Build a hostname -> project name index
+*/
+function buildHostnameIndex(projects, tld) {
+	const index = /* @__PURE__ */ new Map();
+	for (const [name] of projects) index.set(`${name}.${tld}`, name);
+	return index;
+}
+/**
+* Get project name from hostname
+*/
+function getProjectFromHostname(hostname, index) {
+	return index.get(hostname);
+}
+/**
+* Watch project_list.yaml for changes
+*/
+function watchProjectList(projectListPath, onChange) {
+	if (!existsSync(projectListPath)) {
+		console.warn(`Project list not found: ${projectListPath}`);
+		return;
+	}
+	watch(projectListPath, (eventType) => {
+		if (eventType === "change") onChange();
+	});
+}
+/**
+* Get detailed project info using ddev describe
+*/
+function getProjectInfo(name) {
+	try {
+		const output = execSync(`ddev describe ${name} -j`, {
+			encoding: "utf-8",
+			timeout: 1e4
+		});
+		const data = JSON.parse(output);
+		if (!data.raw) return void 0;
+		const raw = data.raw;
+		return {
+			name: raw.name,
+			status: raw.status,
+			appRoot: raw.approot,
+			httpURLs: raw.httpURLs ?? [],
+			httpsURLs: raw.httpsURLs ?? [],
+			type: raw.type,
+			phpVersion: raw.php_version,
+			dbType: raw.dbinfo?.dbType
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Start a DDEV project
+*/
+function startProject(name) {
+	try {
+		execSync(`ddev start ${name}`, {
+			encoding: "utf-8",
+			timeout: 12e4,
+			stdio: "pipe"
+		});
+		return true;
+	} catch (error) {
+		console.error(`Failed to start project ${name}:`, error);
+		return false;
+	}
+}
+/**
+* Stop a DDEV project
+*/
+function stopProject(name) {
+	try {
+		execSync(`ddev stop ${name}`, {
+			encoding: "utf-8",
+			timeout: 6e4,
+			stdio: "pipe"
+		});
+		return true;
+	} catch (error) {
+		console.error(`Failed to stop project ${name}:`, error);
+		return false;
+	}
+}
+/**
+* List all DDEV projects with their status
+*/
+function listProjects() {
+	try {
+		const output = execSync("ddev list -j", {
+			encoding: "utf-8",
+			timeout: 3e4
+		});
+		const data = JSON.parse(output);
+		if (!Array.isArray(data)) return [];
+		return data.map((p) => ({
+			name: p.name,
+			status: p.status,
+			appRoot: p.approot,
+			httpURLs: p.httpURLs ?? [],
+			httpsURLs: p.httpsURLs ?? [],
+			type: p.type
+		}));
+	} catch {
+		return [];
+	}
+}
+var db = null;
+/**
+* Initialize the database connection and schema
+*/
+function initDb(dbPath) {
+	db = new Database(dbPath);
+	db.pragma("journal_mode = WAL");
+	db.exec(`
+    CREATE TABLE IF NOT EXISTS projects (
+      name TEXT PRIMARY KEY,
+      last_access INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'stopped'
+    );
+
+    CREATE TABLE IF NOT EXISTS access_logs (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      project TEXT NOT NULL,
+      timestamp INTEGER NOT NULL,
+      ip TEXT NOT NULL,
+      user_agent TEXT NOT NULL,
+      path TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_access_logs_project ON access_logs(project);
+    CREATE INDEX IF NOT EXISTS idx_access_logs_timestamp ON access_logs(timestamp);
+  `);
+	return db;
+}
+/**
+* Get the database instance
+*/
+function getDb() {
+	if (!db) throw new Error("Database not initialized. Call initDb first.");
+	return db;
+}
+/**
+* Close the database connection
+*/
+function closeDb() {
+	if (db) {
+		db.close();
+		db = null;
+	}
+}
+/**
+* Update project last access time
+*/
+function updateProjectAccess(name) {
+	getDb().prepare(`
+    INSERT INTO projects (name, last_access, status)
+    VALUES (?, ?, 'running')
+    ON CONFLICT(name) DO UPDATE SET last_access = excluded.last_access
+  `).run(name, Date.now());
+}
+/**
+* Get project record
+*/
+function getProject(name) {
+	return getDb().prepare("SELECT name, last_access as lastAccess, status FROM projects WHERE name = ?").get(name);
+}
+/**
+* Set project status
+*/
+function setProjectStatus(name, status) {
+	getDb().prepare(`
+    INSERT INTO projects (name, last_access, status)
+    VALUES (?, ?, ?)
+    ON CONFLICT(name) DO UPDATE SET status = excluded.status
+  `).run(name, Date.now(), status);
+}
+/**
+* Get idle projects (last access older than threshold)
+*/
+function getIdleProjects(thresholdMs) {
+	const database = getDb();
+	const cutoff = Date.now() - thresholdMs;
+	return database.prepare(`
+    SELECT name, last_access as lastAccess, status
+    FROM projects
+    WHERE last_access < ? AND status = 'running'
+  `).all(cutoff);
+}
+/**
+* Log an access
+*/
+function logAccess(log) {
+	getDb().prepare(`
+    INSERT INTO access_logs (project, timestamp, ip, user_agent, path)
+    VALUES (?, ?, ?, ?, ?)
+  `).run(log.project, log.timestamp, log.ip, log.userAgent, log.path);
+}
+/**
+* Get recent access logs for a project
+*/
+function getAccessLogs(project, limit = 100) {
+	return getDb().prepare(`
+    SELECT id, project, timestamp, ip, user_agent as userAgent, path
+    FROM access_logs
+    WHERE project = ?
+    ORDER BY timestamp DESC
+    LIMIT ?
+  `).all(project, limit);
+}
+/**
+* Clean old access logs (older than given days)
+*/
+function cleanOldLogs(days) {
+	const database = getDb();
+	const cutoff = Date.now() - days * 24 * 60 * 60 * 1e3;
+	return database.prepare("DELETE FROM access_logs WHERE timestamp < ?").run(cutoff).changes;
+}
+/**
+* Simple YAML parser for config.trafic.yaml
+* Only supports simple key: value pairs (no nesting, no arrays)
+*/
+function parseSimpleYaml(content) {
+	const result = {};
+	const lines = content.split("\n");
+	for (const line of lines) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#")) continue;
+		const colonIndex = trimmed.indexOf(":");
+		if (colonIndex === -1) continue;
+		const key = trimmed.slice(0, colonIndex).trim();
+		let value = trimmed.slice(colonIndex + 1).trim();
+		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+		result[key] = value;
+	}
+	return result;
+}
+/**
+* Load project-specific Trafic config from .ddev/config.trafic.yaml
+*/
+function loadProjectConfig(projectDir) {
+	const configPath = join(projectDir, ".ddev", "config.trafic.yaml");
+	if (!existsSync(configPath)) return {};
+	try {
+		const parsed = parseSimpleYaml(readFileSync(configPath, "utf-8"));
+		const config = {};
+		if (parsed.auth_policy) {
+			const policy = parsed.auth_policy.toLowerCase();
+			if ([
+				"allow",
+				"deny",
+				"basic",
+				"token"
+			].includes(policy)) config.auth_policy = policy;
+		}
+		if (parsed.idle_timeout) config.idle_timeout = parsed.idle_timeout;
+		return config;
+	} catch (error) {
+		console.warn(`Failed to load project config from ${configPath}:`, error);
+		return {};
+	}
+}
+/**
+* Check if a project should never be stopped (idle_timeout = "never")
+*/
+function shouldNeverStop(config) {
+	return config.idle_timeout?.toLowerCase() === "never";
+}
+/**
+* Get idle timeout in milliseconds, or undefined to use global default
+*/
+function getIdleTimeoutMs(config) {
+	if (!config.idle_timeout) return void 0;
+	if (shouldNeverStop(config)) return void 0;
+	const match = config.idle_timeout.match(/(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?/);
+	if (!match) return void 0;
+	const hours = parseInt(match[1] ?? "0", 10);
+	const minutes = parseInt(match[2] ?? "0", 10);
+	const seconds = parseInt(match[3] ?? "0", 10);
+	const ms = (hours * 3600 + minutes * 60 + seconds) * 1e3;
+	return ms > 0 ? ms : void 0;
+}
+var __dirname = dirname(fileURLToPath(import.meta.url));
+var config;
+var projectList;
+var hostnameIndex;
+var projectConfigs = /* @__PURE__ */ new Map();
+/**
+* Load HTML template
+*/
+function loadTemplate(name) {
+	const templatePath = resolve(__dirname, "..", "templates", `${name}.html`);
+	try {
+		return readFileSync(templatePath, "utf-8");
+	} catch {
+		return `<html><body><h1>${name}</h1></body></html>`;
+	}
+}
+/**
+* Get effective auth config for a project (merges global + per-project)
+*/
+function getEffectiveAuthConfig(projectName) {
+	if (!projectName) return config.auth;
+	const projectConfig = projectConfigs.get(projectName);
+	if (!projectConfig?.auth_policy) return config.auth;
+	return {
+		...config.auth,
+		defaultPolicy: projectConfig.auth_policy
+	};
+}
+/**
+* Handle forward auth requests from Traefik
+* Traefik sends the original request headers, we return 200 (allow) or 401 (deny)
+*/
+function handleAuth(req, res) {
+	const hostname = req.headers["x-forwarded-host"] ?? "";
+	const ip = req.headers["x-forwarded-for"] ?? req.socket.remoteAddress ?? "";
+	const authorization = req.headers["authorization"];
+	const path = req.headers["x-forwarded-uri"] ?? "/";
+	const projectName = hostnameIndex.get(hostname);
+	const authConfig = getEffectiveAuthConfig(projectName);
+	if (checkAuth({
+		hostname,
+		ip: ip.split(",")[0].trim(),
+		authorization,
+		forwardedFor: ip
+	}, authConfig).allowed) {
+		if (projectName) {
+			updateProjectAccess(projectName);
+			logAccess({
+				project: projectName,
+				timestamp: Date.now(),
+				ip: ip.split(",")[0].trim(),
+				userAgent: req.headers["user-agent"] ?? "",
+				path
+			});
+		}
+		res.writeHead(200);
+		res.end();
+	} else {
+		res.writeHead(401, { "WWW-Authenticate": "Basic realm=\"Trafic\"" });
+		res.end("Unauthorized");
+	}
+}
+/**
+* Handle errors middleware requests (502 from Traefik)
+* When a project is stopped, Traefik returns 502. We show a waiting page and start the project.
+*/
+async function handleErrors(req, res) {
+	const hostname = req.headers["x-forwarded-host"] ?? req.headers.host ?? "";
+	const projectName = hostnameIndex.get(hostname);
+	if (!projectName) {
+		const template = loadTemplate("error");
+		res.writeHead(404, { "Content-Type": "text/html" });
+		res.end(template.replace("{{message}}", "Project not found"));
+		return;
+	}
+	if (getProject(projectName)?.status === "starting") {
+		const template = loadTemplate("wait");
+		res.writeHead(503, {
+			"Content-Type": "text/html",
+			"Retry-After": "5"
+		});
+		res.end(template.replace(/\{\{project\}\}/g, projectName).replace(/\{\{hostname\}\}/g, hostname));
+		return;
+	}
+	setProjectStatus(projectName, "starting");
+	const template = loadTemplate("wait");
+	res.writeHead(503, {
+		"Content-Type": "text/html",
+		"Retry-After": "5"
+	});
+	res.end(template.replace(/\{\{project\}\}/g, projectName).replace(/\{\{hostname\}\}/g, hostname));
+	setTimeout(() => {
+		setProjectStatus(projectName, startProject(projectName) ? "running" : "stopped");
+	}, 100);
+}
+/**
+* Handle status polling requests
+*/
+function handleStatus(req, res) {
+	const projectName = new URL(req.url ?? "/", `http://${req.headers.host}`).searchParams.get("project");
+	if (!projectName) {
+		res.writeHead(400, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "Missing project parameter" }));
+		return;
+	}
+	const info = getProjectInfo(projectName);
+	const record = getProject(projectName);
+	res.writeHead(200, { "Content-Type": "application/json" });
+	res.end(JSON.stringify({
+		name: projectName,
+		status: info?.status ?? record?.status ?? "unknown",
+		ready: info?.status === "running"
+	}));
+}
+/**
+* Request handler
+*/
+async function handleRequest(req, res) {
+	const url = req.url ?? "/";
+	try {
+		if (url === "/__auth__" || url.startsWith("/__auth__/")) handleAuth(req, res);
+		else if (url === "/__status__" || url.startsWith("/__status__/")) handleStatus(req, res);
+		else if (url === "/__health__") {
+			res.writeHead(200, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({
+				status: "ok",
+				version: "__VERSION__"
+			}));
+		} else await handleErrors(req, res);
+	} catch (error) {
+		console.error("Request error:", error);
+		res.writeHead(500, { "Content-Type": "text/plain" });
+		res.end("Internal Server Error");
+	}
+}
+/**
+* Reload project list and their configs
+*/
+function reloadProjects() {
+	projectList = loadProjectList(config.projectListPath);
+	hostnameIndex = buildHostnameIndex(projectList, config.tld);
+	projectConfigs.clear();
+	for (const [name, projectDir] of projectList) {
+		const projectConfig = loadProjectConfig(projectDir);
+		if (projectConfig.auth_policy || projectConfig.idle_timeout) {
+			projectConfigs.set(name, projectConfig);
+			console.log(`  ${name}: auth=${projectConfig.auth_policy ?? "default"}, idle=${projectConfig.idle_timeout ?? "default"}`);
+		}
+	}
+	console.log(`Loaded ${projectList.size} projects (${projectConfigs.size} with custom config)`);
+}
+/**
+* Start the agent server
+*/
+function startServer(agentConfig) {
+	config = agentConfig;
+	initDb(config.dbPath);
+	reloadProjects();
+	watchProjectList(config.projectListPath, () => {
+		console.log("Project list changed, reloading...");
+		reloadProjects();
+	});
+	createServer((req, res) => {
+		handleRequest(req, res).catch((error) => {
+			console.error("Unhandled error:", error);
+			if (!res.headersSent) {
+				res.writeHead(500);
+				res.end("Internal Server Error");
+			}
+		});
+	}).listen(config.port, () => {
+		console.log(`Trafic agent listening on port ${config.port}`);
+		console.log(`TLD: ${config.tld}`);
+		console.log(`Projects: ${projectList.size}`);
+	});
+}
+export { checkAuth as C, parseBearerToken as D, parseBasicAuth as E, watchProjectList as S, matchIp as T, getProjectInfo as _, cleanOldLogs as a, startProject as b, getDb as c, initDb as d, logAccess as f, getProjectFromHostname as g, buildHostnameIndex as h, shouldNeverStop as i, getIdleProjects as l, updateProjectAccess as m, getIdleTimeoutMs as n, closeDb as o, setProjectStatus as p, loadProjectConfig as r, getAccessLogs as s, startServer as t, getProject as u, listProjects as v, matchHostname as w, stopProject as x, loadProjectList as y };
+
+//# sourceMappingURL=server-D0N_6y4c.js.map