@torrent-tv/proxy 2.9.72 → 2.9.74

package/services/torrent-worker/webrtc-shim.js

@@ -0,0 +1,219 @@
+/**
+ * @file `webrtc-polyfill`'s interface, served by a pure-JavaScript WebRTC stack.
+ *
+ * **Why this exists.** node-datachannel is native, and its native side is not
+ * safe to use from two V8 isolates at once: the process aborts with
+ * `HandleScope: Entering the V8 API without proper locking in place`. Measured
+ * on win32/x64 and linux/arm64 alike — one isolate is fine (either the main
+ * thread or a worker), two at the same time is fatal, and preloading in both
+ * does not help. The upstream issue about workers (#129) was closed in 0.4.0
+ * but only covers use from a worker ALONE, which does work.
+ *
+ * We need it twice: `webrtc-manager.js` runs the video channel to the browser on
+ * the main thread, and the torrent client — which is now on its own thread —
+ * creates peer connections of its own to announce on `wss://` trackers. Before
+ * the thread split both lived in one isolate and nothing was wrong; afterwards
+ * any torrent carrying a wss tracker took the whole proxy down.
+ *
+ * So the native stack stays where it earns its keep — the main thread, carrying
+ * video — and the torrent's trackers get a JavaScript implementation, where the
+ * traffic is a handful of signalling messages. `services/torrent-worker/worker.js`
+ * installs a module resolution hook that points `webrtc-polyfill` here; nothing
+ * outside the worker thread is affected, and no dependency is patched (the addon
+ * installs with `--ignore-scripts`, so a postinstall patch would never run).
+ *
+ * **What the shim has to fix.** werift's peer connection matches the interface
+ * `simple-peer` expects, but its data channel differs in two ways that matter:
+ *
+ *  - it has no `binaryType`, and hands `onmessage` a `Buffer`. `simple-peer`
+ *    only recognises `ArrayBuffer`; anything else goes through `text2arr`,
+ *    which would corrupt every byte of torrent payload.
+ *  - it has no `onbufferedamountlow`. `simple-peer` builds its backpressure on
+ *    that event, so without it a send that hits the high-water mark never
+ *    resumes.
+ */
+
+import {
+  RTCPeerConnection as WeriftPeerConnection,
+  RTCIceCandidate
+} from "werift";
+
+/**
+ * A session description built the way browsers build it — from one object.
+ *
+ * werift's own class takes two positional arguments, `(sdp, type)`. Callers
+ * written against the browser pass `{ type, sdp }`, so with werift's class the
+ * type lands in the sdp slot and the description is rejected: field 2026-08-03,
+ * wss announces succeeded but every peer connection died with "Connection
+ * error: invalid sessionDescription".
+ *
+ * `RTCIceCandidate` needs no such treatment — werift already takes an object.
+ */
+class ShimSessionDescription {
+  /**
+   * @param {{ type?: string, sdp?: string } | string} init
+   * @param {string} [type] - Tolerated for callers using werift's own order.
+   */
+  constructor(init, type) {
+    if (typeof init === "string") {
+      this.sdp = init;
+      this.type = type;
+      return;
+    }
+    this.type = init?.type;
+    this.sdp = init?.sdp;
+  }
+
+  toJSON() {
+    return { type: this.type, sdp: this.sdp };
+  }
+}
+
+/**
+ * A werift data channel wearing the browser's interface.
+ *
+ * Only what `simple-peer` touches is implemented — promising more would be
+ * pretending, since anything else has no caller and would never be exercised.
+ */
+class ShimDataChannel {
+  #channel;
+  /** @type {"blob" | "arraybuffer"} */
+  binaryType = "blob";
+  /** @type {((event: { data: ArrayBuffer | Buffer }) => void) | null} */
+  onmessage = null;
+  /** @type {(() => void) | null} */
+  onopen = null;
+  /** @type {(() => void) | null} */
+  onclose = null;
+  /** @type {((event: { error?: Error }) => void) | null} */
+  onerror = null;
+  /** @type {(() => void) | null} */
+  onbufferedamountlow = null;
+
+  /**
+   * @param {object} channel - werift's `RTCDataChannel`.
+   */
+  constructor(channel) {
+    this.#channel = channel;
+
+    channel.onmessage = (event) => {
+      const data = event?.data ?? event;
+      this.onmessage?.({ data: this.#toWireFormat(data) });
+    };
+    channel.onopen = () => this.onopen?.();
+    channel.onclose = () => this.onclose?.();
+    channel.onerror = (event) => this.onerror?.(event ?? {});
+
+    // werift reports this as an observable rather than a handler property.
+    channel.bufferedAmountLow?.subscribe?.(() => this.onbufferedamountlow?.());
+  }
+
+  /**
+   * Match what a browser would deliver for the requested `binaryType`.
+   *
+   * `simple-peer` checks `instanceof ArrayBuffer` and sends everything else
+   * through a text decoder, so a `Buffer` handed over unchanged arrives
+   * mangled.
+   *
+   * @param {unknown} data
+   * @returns {ArrayBuffer | unknown}
+   */
+  #toWireFormat(data) {
+    if (this.binaryType !== "arraybuffer" || typeof data === "string") {
+      return data;
+    }
+    if (ArrayBuffer.isView(data)) {
+      return data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength);
+    }
+    return data;
+  }
+
+  get label() {
+    return this.#channel.label;
+  }
+
+  get readyState() {
+    return this.#channel.readyState;
+  }
+
+  get bufferedAmount() {
+    return this.#channel.bufferedAmount;
+  }
+
+  get bufferedAmountLowThreshold() {
+    return this.#channel.bufferedAmountLowThreshold;
+  }
+
+  set bufferedAmountLowThreshold(value) {
+    this.#channel.bufferedAmountLowThreshold = value;
+  }
+
+  /**
+   * @param {string | ArrayBuffer | ArrayBufferView} data
+   * @returns {void}
+   */
+  send(data) {
+    if (typeof data === "string") {
+      this.#channel.send(data);
+      return;
+    }
+    this.#channel.send(ArrayBuffer.isView(data) ? Buffer.from(data.buffer, data.byteOffset, data.byteLength) : Buffer.from(data));
+  }
+
+  close() {
+    this.#channel.close();
+  }
+}
+
+/**
+ * werift's peer connection, handing out data channels that carry the browser's
+ * interface. Everything else is inherited unchanged — the peer connection side
+ * already matches.
+ */
+class ShimPeerConnection extends WeriftPeerConnection {
+  /**
+   * @param {...unknown} args - Passed through to werift.
+   */
+  constructor(...args) {
+    super(...args);
+
+    // `ondatachannel` has to be redefined on the instance, not declared as an
+    // accessor on this class: werift assigns it as an own field in its own
+    // constructor, and an own property shadows a prototype accessor — so a
+    // subclass setter is simply never called, and the caller receives werift's
+    // bare channel instead of the wrapped one.
+    let handler = null;
+    const deliver = (event) => {
+      handler?.({ ...event, channel: new ShimDataChannel(event?.channel ?? event) });
+    };
+    Object.defineProperty(this, "ondatachannel", {
+      configurable: true,
+      // werift reads this property to dispatch, so it must hand back the
+      // wrapper rather than what the caller assigned.
+      get: () => (handler ? deliver : null),
+      set: (value) => {
+        handler = value;
+      }
+    });
+  }
+
+  /**
+   * @param {string} label
+   * @param {object} [options]
+   * @returns {ShimDataChannel}
+   */
+  createDataChannel(label, options) {
+    return new ShimDataChannel(super.createDataChannel(label, options));
+  }
+}
+
+export {
+  ShimPeerConnection as RTCPeerConnection,
+  ShimSessionDescription as RTCSessionDescription,
+  RTCIceCandidate
+};
+export default {
+  RTCPeerConnection: ShimPeerConnection,
+  RTCSessionDescription: ShimSessionDescription,
+  RTCIceCandidate
+};

package/services/torrent-worker/worker.js

@@ -17,11 +17,22 @@
  * threads.
  */
 
+// MUST stay first: it redirects `webrtc-polyfill` to a JavaScript WebRTC stack
+// before WebTorrent can reach the native one. Two isolates using
+// node-datachannel at once abort the process, and the torrent's wss trackers
+// create peer connections of their own.
+import "./install-webrtc-shim.js";
 import { parentPort, workerData } from "node:worker_threads";
-import { TorrentPool } from "../torrent-pool.js";
 import { createSendStream } from "./channel.js";
 import { Command, Event, STREAM_CHUNK_BYTES } from "./protocol.js";
 
+// Imported dynamically, and that is load-bearing: static imports are RESOLVED
+// during linking, before any module body runs, so a statically imported pool
+// would drag in WebTorrent — and with it the real `webrtc-polyfill` — before
+// the hook above had a chance to register. Verified the hard way: with a static
+// import the process still aborted, and the stack named the genuine polyfill.
+const { TorrentPool } = await import("../torrent-pool.js");
+
 const pool = new TorrentPool({ maxDiskBytes: workerData?.maxDiskBytes });
 
 /** Torrents by sourceKey — the main thread names them, this thread owns them. */

package/test/piece-lru.test.js

@@ -0,0 +1,109 @@
+/**
+ * @file Recency and pinning for resident pieces.
+ *
+ * The pinning cases matter more than the ordering ones: proxy 2.9.71 removed a
+ * torrent's data while a reader was mid-read, and every later read hung. Here
+ * that is meant to be impossible by construction, so it is worth stating in
+ * tests rather than trusting to eviction order.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { PieceLru } from "../services/piece-store/piece-lru.js";
+
+test("evicts the least recently used piece", () => {
+  const lru = new PieceLru(3);
+  lru.touch(1);
+  lru.touch(2);
+  lru.touch(3);
+
+  assert.equal(lru.evictionCandidate(), 1);
+});
+
+test("using a piece again moves it out of the firing line", () => {
+  const lru = new PieceLru(3);
+  lru.touch(1);
+  lru.touch(2);
+  lru.touch(3);
+  lru.touch(1);
+
+  assert.equal(lru.evictionCandidate(), 2);
+});
+
+test("a pinned piece is never offered for eviction", () => {
+  const lru = new PieceLru(3);
+  lru.touch(1);
+  lru.touch(2);
+  lru.touch(3);
+  lru.pin(1);
+
+  assert.equal(lru.evictionCandidate(), 2, "the pinned piece was offered up");
+});
+
+test("pins nest, so one reader leaving does not expose the piece", () => {
+  const lru = new PieceLru(2);
+  lru.touch(1);
+  lru.touch(2);
+
+  // Two sessions reading the same piece — the union-window case.
+  lru.pin(1);
+  lru.pin(1);
+  lru.unpin(1);
+
+  assert.ok(lru.isPinned(1), "the piece stopped being held while a reader still had it");
+  assert.equal(lru.evictionCandidate(), 2);
+
+  lru.unpin(1);
+  assert.equal(lru.isPinned(1), false);
+});
+
+test("reports no candidate rather than evicting a piece in use", () => {
+  const lru = new PieceLru(2);
+  lru.touch(1);
+  lru.touch(2);
+  lru.pin(1);
+  lru.pin(2);
+
+  assert.equal(
+    lru.evictionCandidate(),
+    null,
+    "with every piece held, the caller must wait — not have memory taken from under it"
+  );
+});
+
+test("unpinning something that was never pinned is harmless", () => {
+  const lru = new PieceLru(2);
+  lru.touch(1);
+  lru.unpin(1);
+  lru.unpin(1);
+
+  assert.equal(lru.isPinned(1), false);
+  assert.equal(lru.evictionCandidate(), 1);
+});
+
+test("removal takes a piece out of the ordering", () => {
+  const lru = new PieceLru(3);
+  lru.touch(1);
+  lru.touch(2);
+  lru.remove(1);
+
+  assert.equal(lru.has(1), false);
+  assert.equal(lru.evictionCandidate(), 2);
+  assert.equal(lru.size, 1);
+});
+
+test("fullness follows capacity", () => {
+  const lru = new PieceLru(2);
+  assert.equal(lru.isFull(), false);
+  lru.touch(1);
+  lru.touch(2);
+  assert.equal(lru.isFull(), true);
+  lru.remove(1);
+  assert.equal(lru.isFull(), false);
+});
+
+test("a nonsensical capacity is refused at construction", () => {
+  assert.throws(() => new PieceLru(0), /positive integer/);
+  assert.throws(() => new PieceLru(-1), /positive integer/);
+  assert.throws(() => new PieceLru(1.5), /positive integer/);
+});

package/test/shared-piece-store.test.js

@@ -0,0 +1,226 @@
+/**
+ * @file Pieces in shared memory, spilling to disk.
+ *
+ * The cases worth having are the ones that describe past failures: a buffer
+ * handed out must not be invalidated by later activity (2.9.71 transferred
+ * memory it did not own), and a piece being read must not be evicted (2.9.71
+ * again, at the torrent level).
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { SharedPieceStore } from "../services/piece-store/shared-piece-store.js";
+
+const CHUNK = 64 * 1024;
+
+/**
+ * @param {object} [options]
+ * @returns {Promise<{ store: SharedPieceStore, directory: string }>}
+ */
+async function makeStore({ pieces = 4, totalPieces = 16 } = {}) {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "piece-store-"));
+  const store = new SharedPieceStore(CHUNK, {
+    length: CHUNK * totalPieces,
+    memoryBytes: CHUNK * pieces,
+    path: directory,
+    name: "test"
+  });
+  return { store, directory };
+}
+
+/**
+ * @param {number} index
+ * @param {number} [length]
+ * @returns {Buffer}
+ */
+function piece(index, length = CHUNK) {
+  const bytes = Buffer.allocUnsafeSlow(length);
+  bytes.fill(index % 256);
+  bytes.writeUInt32BE(index, 0);
+  return bytes;
+}
+
+/** Promise-shaped wrappers, so the tests read as the sequence they describe. */
+const put = (store, index, bytes) =>
+  new Promise((resolve, reject) => store.put(index, bytes, (error) => (error ? reject(error) : resolve())));
+const get = (store, index, options) =>
+  new Promise((resolve, reject) =>
+    store.get(index, options, (error, bytes) => (error ? reject(error) : resolve(bytes)))
+  );
+
+test("a stored piece comes back byte for byte", async () => {
+  const { store, directory } = await makeStore();
+  try {
+    await put(store, 0, piece(0));
+    const read = await get(store, 0);
+    assert.deepEqual(read, piece(0));
+  } finally {
+    await new Promise((resolve) => store.destroy(resolve));
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("pieces past the memory budget spill to disk and read back intact", async () => {
+  const { store, directory } = await makeStore({ pieces: 4, totalPieces: 16 });
+  try {
+    for (let index = 0; index < 10; index += 1) {
+      await put(store, index, piece(index));
+    }
+
+    assert.equal(store.residentCount, 4, "more pieces stayed resident than the budget allows");
+    assert.ok(store.spilledCount >= 6, "pieces over budget were not written out");
+
+    // The earliest pieces can only come from disk now.
+    for (const index of [0, 1, 2, 5]) {
+      assert.deepEqual(await get(store, index), piece(index), `piece ${index} came back wrong`);
+    }
+  } finally {
+    await new Promise((resolve) => store.destroy(resolve));
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("the short last piece keeps its own length", async () => {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "piece-store-"));
+  const store = new SharedPieceStore(CHUNK, {
+    length: CHUNK * 3 + 1234,
+    memoryBytes: CHUNK * 4,
+    path: directory,
+    name: "tail"
+  });
+  try {
+    const tail = piece(3, 1234);
+    await put(store, 3, tail);
+    const read = await get(store, 3);
+    assert.equal(read.length, 1234);
+    assert.deepEqual(read, tail);
+  } finally {
+    await new Promise((resolve) => store.destroy(resolve));
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("a buffer handed out survives later writes to the same slot", async () => {
+  // This is the shape of the shipped defect: the caller keeps what it was
+  // given while the store carries on working.
+  const { store, directory } = await makeStore({ pieces: 2, totalPieces: 8 });
+  try {
+    await put(store, 0, piece(0));
+    const held = await get(store, 0);
+
+    for (let index = 1; index < 6; index += 1) {
+      await put(store, index, piece(index));
+    }
+
+    assert.deepEqual(held, piece(0), "the buffer changed under its holder");
+  } finally {
+    await new Promise((resolve) => store.destroy(resolve));
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("a pinned piece is not evicted to make room", async () => {
+  const { store, directory } = await makeStore({ pieces: 2, totalPieces: 8 });
+  try {
+    await put(store, 0, piece(0));
+    await put(store, 1, piece(1));
+
+    store.pin(0);
+    await put(store, 2, piece(2));
+
+    const located = store.locate(0);
+    assert.ok(located, "the pinned piece was evicted while held");
+    const view = Buffer.from(store.sharedBuffer, located.offset, located.length);
+    assert.deepEqual(view, piece(0), "the pinned piece was overwritten in place");
+
+    store.unpin(0);
+  } finally {
+    await new Promise((resolve) => store.destroy(resolve));
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("refuses to make room when every resident piece is being read", async () => {
+  const { store, directory } = await makeStore({ pieces: 2, totalPieces: 8 });
+  try {
+    await put(store, 0, piece(0));
+    await put(store, 1, piece(1));
+    store.pin(0);
+    store.pin(1);
+
+    await assert.rejects(
+      () => put(store, 2, piece(2)),
+      /pinned/,
+      "the store took memory from under a reader instead of refusing"
+    );
+  } finally {
+    store.unpin(0);
+    store.unpin(1);
+    await new Promise((resolve) => store.destroy(resolve));
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("a piece revived from disk is readable by offset again", async () => {
+  const { store, directory } = await makeStore({ pieces: 2, totalPieces: 8 });
+  try {
+    await put(store, 0, piece(0));
+    await put(store, 1, piece(1));
+    await put(store, 2, piece(2)); // pushes piece 0 out to disk
+    assert.equal(store.locate(0), null, "piece 0 should have left memory");
+
+    await get(store, 0); // brings it back
+    const located = store.locate(0);
+    assert.ok(located, "piece 0 was not brought back into memory");
+    const view = Buffer.from(store.sharedBuffer, located.offset, located.length);
+    assert.deepEqual(view, piece(0));
+  } finally {
+    await new Promise((resolve) => store.destroy(resolve));
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("a range within a piece is served correctly from memory and from disk", async () => {
+  const { store, directory } = await makeStore({ pieces: 2, totalPieces: 8 });
+  try {
+    const source = piece(4);
+    await put(store, 4, source);
+
+    assert.deepEqual(
+      await get(store, 4, { offset: 100, length: 256 }),
+      source.subarray(100, 356),
+      "range from memory is wrong"
+    );
+
+    await put(store, 5, piece(5));
+    await put(store, 6, piece(6)); // piece 4 spills
+
+    assert.deepEqual(
+      await get(store, 4, { offset: 100, length: 256 }),
+      source.subarray(100, 356),
+      "range after revival is wrong"
+    );
+  } finally {
+    await new Promise((resolve) => store.destroy(resolve));
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("destroy removes the spill file", async () => {
+  const { store, directory } = await makeStore({ pieces: 2, totalPieces: 8 });
+  await put(store, 0, piece(0));
+  await put(store, 1, piece(1));
+  await put(store, 2, piece(2)); // forces a spill
+
+  const before = await fs.readdir(directory);
+  assert.ok(before.length > 0, "nothing was written to spill");
+
+  await new Promise((resolve) => store.destroy(resolve));
+  const after = await fs.readdir(directory);
+  assert.equal(after.length, 0, "the spill file outlived the store");
+
+  await fs.rm(directory, { recursive: true, force: true });
+});