@tiflis-io/tiflis-code-tunnel 0.3.1 → 0.3.3

package/dist/main.js

@@ -372,14 +372,16 @@ function registerWatchApiRoute(app, deps) {
   });
   app.post("/api/v1/watch/command", async (request, reply) => {
     try {
-      const { device_id, message } = request.body;
-      if (!device_id) {
+      const { tunnel_id, auth_key, device_id, message } = request.body;
+      if (!tunnel_id || !auth_key || !device_id) {
         return await reply.status(400).send({
           error: "missing_parameters",
-          message: "device_id and message are required"
+          message: "tunnel_id, auth_key, device_id, and message are required"
         });
       }
-      const sent = httpClientOperations.sendCommand({
+      const sent = httpClientOperations.sendCommandWithAuth({
+        tunnelId: tunnel_id,
+        authKey: auth_key,
         deviceId: device_id,
         message
       });
@@ -398,16 +400,18 @@ function registerWatchApiRoute(app, deps) {
   });
   app.get("/api/v1/watch/messages", async (request, reply) => {
     try {
-      const { device_id, since, ack } = request.query;
-      if (!device_id) {
+      const { tunnel_id, auth_key, device_id, since, ack } = request.query;
+      if (!tunnel_id || !auth_key || !device_id) {
         return await reply.status(400).send({
           error: "missing_parameters",
-          message: "device_id is required"
+          message: "tunnel_id, auth_key, and device_id are required"
         });
       }
       const sinceSequence = since ? parseInt(since, 10) : 0;
       const ackSequence = ack ? parseInt(ack, 10) : void 0;
-      const result = httpClientOperations.pollMessages({
+      const result = httpClientOperations.pollMessagesWithAuth({
+        tunnelId: tunnel_id,
+        authKey: auth_key,
         deviceId: device_id,
         sinceSequence,
         acknowledgeSequence: ackSequence
@@ -428,14 +432,16 @@ function registerWatchApiRoute(app, deps) {
   });
   app.get("/api/v1/watch/state", async (request, reply) => {
     try {
-      const { device_id } = request.query;
-      if (!device_id) {
+      const { tunnel_id, auth_key, device_id } = request.query;
+      if (!tunnel_id || !auth_key || !device_id) {
         return await reply.status(400).send({
           error: "missing_parameters",
-          message: "device_id is required"
+          message: "tunnel_id, auth_key, and device_id are required"
         });
       }
-      const result = httpClientOperations.getState({
+      const result = httpClientOperations.getStateWithAuth({
+        tunnelId: tunnel_id,
+        authKey: auth_key,
         deviceId: device_id
       });
       return await reply.status(200).send({
@@ -451,14 +457,18 @@ function registerWatchApiRoute(app, deps) {
   });
   app.post("/api/v1/watch/disconnect", async (request, reply) => {
     try {
-      const { device_id } = request.body;
-      if (!device_id) {
+      const { tunnel_id, auth_key, device_id } = request.body;
+      if (!tunnel_id || !auth_key || !device_id) {
         return await reply.status(400).send({
           error: "missing_parameters",
-          message: "device_id is required"
+          message: "tunnel_id, auth_key, and device_id are required"
         });
       }
-      const disconnected = httpClientOperations.disconnect(device_id);
+      const disconnected = httpClientOperations.disconnectWithAuth({
+        tunnelId: tunnel_id,
+        authKey: auth_key,
+        deviceId: device_id
+      });
       log.info({ deviceId: device_id }, "Watch disconnected via HTTP");
       return await reply.status(200).send({
         success: disconnected
@@ -967,29 +977,51 @@ var WebSocketServerWrapper = class {
     return this.wss?.clients.size ?? 0;
   }
   /**
-   * Closes the WebSocket server gracefully.
+   * Closes the WebSocket server gracefully with timeout.
+   * @param timeoutMs - Maximum time to wait for graceful close (default: 5000ms)
    */
-  async close() {
+  async close(timeoutMs = 5e3) {
     if (this.heartbeatInterval) {
       clearInterval(this.heartbeatInterval);
       this.heartbeatInterval = null;
     }
     const wss = this.wss;
     if (!wss) return;
+    const clientCount = wss.clients.size;
+    this.logger.info({ clientCount }, "Closing WebSocket server");
     wss.clients.forEach((client) => {
-      client.close(1001, "Server shutting down");
+      try {
+        client.close(1001, "Server shutting down");
+      } catch {
+      }
     });
-    return new Promise((resolve, reject) => {
+    const closePromise = new Promise((resolve, reject) => {
       wss.close((err) => {
         if (err) {
           this.logger.error({ error: err }, "Error closing WebSocket server");
           reject(err);
         } else {
-          this.logger.info("WebSocket server closed");
+          this.logger.info("WebSocket server closed gracefully");
           resolve();
         }
       });
     });
+    const timeoutPromise = new Promise((resolve) => {
+      setTimeout(() => {
+        this.logger.warn(
+          { timeoutMs, remainingClients: wss.clients.size },
+          "WebSocket graceful close timed out, forcing termination"
+        );
+        wss.clients.forEach((client) => {
+          try {
+            client.terminate();
+          } catch {
+          }
+        });
+        resolve();
+      }, timeoutMs);
+    });
+    await Promise.race([closePromise, timeoutPromise]);
   }
 };
 
@@ -1817,6 +1849,7 @@ var HttpClientOperationsUseCase = class {
       throw new InvalidAuthKeyError();
     }
     let client = this.httpClientRegistry.get(deviceId);
+    const isNewClient = !client;
     if (client) {
       client.recordPoll();
       this.logger.info({ deviceId, tunnelId: tunnelIdStr }, "HTTP client reconnected");
@@ -1828,6 +1861,21 @@ var HttpClientOperationsUseCase = class {
       this.httpClientRegistry.register(client);
       this.logger.info({ deviceId, tunnelId: tunnelIdStr }, "HTTP client registered");
     }
+    if (workstation.isOnline) {
+      const authMessage = {
+        type: "auth",
+        payload: {
+          auth_key: authKeyStr,
+          device_id: deviceId
+        }
+      };
+      const sent = workstation.send(JSON.stringify(authMessage));
+      if (sent) {
+        this.logger.debug({ deviceId, isNewClient }, "Forwarded auth to workstation for HTTP client");
+      } else {
+        this.logger.warn({ deviceId }, "Failed to forward auth to workstation");
+      }
+    }
     return {
       success: true,
       tunnelId: tunnelIdStr,
@@ -1866,6 +1914,57 @@ var HttpClientOperationsUseCase = class {
     }
     return sent;
   }
+  /**
+   * Sends a command from HTTP client to workstation with auth validation.
+   * This method validates auth on every request and forwards auth to workstation
+   * to ensure the device_id is registered.
+   */
+  sendCommandWithAuth(input) {
+    const { tunnelId: tunnelIdStr, authKey: authKeyStr, deviceId, message } = input;
+    this.logger.info({ deviceId, tunnelId: tunnelIdStr, messageType: message.type }, "HTTP client sending command with auth");
+    const tunnelId = TunnelId.create(tunnelIdStr);
+    const authKey = AuthKey.create(authKeyStr);
+    const workstation = this.workstationRegistry.get(tunnelId);
+    if (!workstation) {
+      this.logger.warn({ tunnelId: tunnelIdStr, deviceId }, "Workstation not found for command");
+      throw new TunnelNotFoundError(tunnelIdStr);
+    }
+    if (!workstation.validateAuthKey(authKey)) {
+      this.logger.warn({ tunnelId: tunnelIdStr, deviceId }, "Invalid auth key for command");
+      throw new InvalidAuthKeyError();
+    }
+    if (!workstation.isOnline) {
+      this.logger.warn({ deviceId, tunnelId: tunnelIdStr }, "Workstation offline");
+      throw new WorkstationOfflineError(tunnelIdStr);
+    }
+    let client = this.httpClientRegistry.get(deviceId);
+    if (!client) {
+      client = new HttpClient({
+        deviceId,
+        tunnelId
+      });
+      this.httpClientRegistry.register(client);
+      this.logger.info({ deviceId, tunnelId: tunnelIdStr }, "HTTP client registered on command");
+    }
+    client.recordPoll();
+    const authMessage = {
+      type: "auth",
+      payload: {
+        auth_key: authKeyStr,
+        device_id: deviceId
+      }
+    };
+    workstation.send(JSON.stringify(authMessage));
+    const enrichedMessage = {
+      ...message,
+      device_id: deviceId
+    };
+    const sent = workstation.send(JSON.stringify(enrichedMessage));
+    if (!sent) {
+      this.logger.warn({ deviceId }, "Failed to send command to workstation");
+    }
+    return sent;
+  }
   /**
    * Polls for messages for an HTTP client.
    */
@@ -1934,6 +2033,98 @@ var HttpClientOperationsUseCase = class {
     this.logger.info({ deviceId }, "HTTP client disconnected");
     return true;
   }
+  /**
+   * Polls for messages with auth validation (stateless).
+   * Validates auth on every request.
+   */
+  pollMessagesWithAuth(input) {
+    const { tunnelId: tunnelIdStr, authKey: authKeyStr, deviceId, sinceSequence, acknowledgeSequence } = input;
+    const tunnelId = TunnelId.create(tunnelIdStr);
+    const authKey = AuthKey.create(authKeyStr);
+    const workstation = this.workstationRegistry.get(tunnelId);
+    if (!workstation) {
+      throw new TunnelNotFoundError(tunnelIdStr);
+    }
+    if (!workstation.validateAuthKey(authKey)) {
+      throw new InvalidAuthKeyError();
+    }
+    let client = this.httpClientRegistry.get(deviceId);
+    if (!client) {
+      client = new HttpClient({
+        deviceId,
+        tunnelId
+      });
+      this.httpClientRegistry.register(client);
+    }
+    client.recordPoll();
+    if (acknowledgeSequence !== void 0 && acknowledgeSequence > 0) {
+      client.acknowledgeMessages(acknowledgeSequence);
+    }
+    const messages = client.getMessagesSince(sinceSequence);
+    this.logger.debug(
+      { deviceId, sinceSequence, messageCount: messages.length, currentSequence: client.currentSequence },
+      "HTTP client poll with auth"
+    );
+    return {
+      messages,
+      currentSequence: client.currentSequence,
+      workstationOnline: workstation.isOnline
+    };
+  }
+  /**
+   * Gets current state with auth validation (stateless).
+   */
+  getStateWithAuth(input) {
+    const { tunnelId: tunnelIdStr, authKey: authKeyStr, deviceId } = input;
+    const tunnelId = TunnelId.create(tunnelIdStr);
+    const authKey = AuthKey.create(authKeyStr);
+    const workstation = this.workstationRegistry.get(tunnelId);
+    if (!workstation) {
+      throw new TunnelNotFoundError(tunnelIdStr);
+    }
+    if (!workstation.validateAuthKey(authKey)) {
+      throw new InvalidAuthKeyError();
+    }
+    let client = this.httpClientRegistry.get(deviceId);
+    if (!client) {
+      client = new HttpClient({
+        deviceId,
+        tunnelId
+      });
+      this.httpClientRegistry.register(client);
+    }
+    client.recordPoll();
+    return {
+      connected: true,
+      workstationOnline: workstation.isOnline,
+      workstationName: workstation.name,
+      queueSize: client.queueSize,
+      currentSequence: client.currentSequence
+    };
+  }
+  /**
+   * Disconnects an HTTP client with auth validation (stateless).
+   */
+  disconnectWithAuth(input) {
+    const { tunnelId: tunnelIdStr, authKey: authKeyStr, deviceId } = input;
+    const tunnelId = TunnelId.create(tunnelIdStr);
+    const authKey = AuthKey.create(authKeyStr);
+    const workstation = this.workstationRegistry.get(tunnelId);
+    if (!workstation) {
+      throw new TunnelNotFoundError(tunnelIdStr);
+    }
+    if (!workstation.validateAuthKey(authKey)) {
+      throw new InvalidAuthKeyError();
+    }
+    const client = this.httpClientRegistry.get(deviceId);
+    if (!client) {
+      return false;
+    }
+    client.markInactive();
+    this.httpClientRegistry.unregister(deviceId);
+    this.logger.info({ deviceId }, "HTTP client disconnected with auth");
+    return true;
+  }
   /**
    * Queues a message for all HTTP clients connected to a tunnel.
    * Called when workstation sends a message.
@@ -2111,14 +2302,21 @@ async function bootstrap() {
     logger.fatal({ error }, "Failed to start server");
     process.exit(1);
   }
+  const SHUTDOWN_TIMEOUT_MS = 1e4;
   const shutdown = async (signal) => {
     logger.info({ signal }, "Shutdown signal received");
+    const forceExitTimer = setTimeout(() => {
+      logger.error("Shutdown timed out, forcing exit");
+      process.exit(1);
+    }, SHUTDOWN_TIMEOUT_MS);
     try {
       await wsServer.close();
       await app.close();
+      clearTimeout(forceExitTimer);
       logger.info("Shutdown complete");
       process.exit(0);
     } catch (error) {
+      clearTimeout(forceExitTimer);
       logger.error({ error }, "Error during shutdown");
       process.exit(1);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiflis-io/tiflis-code-tunnel",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Tunnel server for tiflis-code - reverse proxy for workstation connections",
   "author": "Roman Barinov <rbarinov@gmail.com>",
   "license": "FSL-1.1-NC",
@@ -53,7 +53,7 @@
     "vitest": "^2.1.8"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=24.0.0"
   },
   "scripts": {
     "dev": "tsx watch src/main.ts",