@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/http/ClusterIngressRouter.js

@@ -0,0 +1,355 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterIngressRouter = void 0;
+const global_logger_factory_1 = require("global-logger-factory");
+const node_stream_1 = require("node:stream");
+const community_server_1 = require("@solid/community-server");
+const community_server_2 = require("@solid/community-server");
+const db_1 = require("../identity/drizzle/db");
+const EdgeNodeRepository_1 = require("../identity/drizzle/EdgeNodeRepository");
+/**
+ * Cluster Ingress Router - 集群统一入口路由器
+ *
+ * 实现我们设计的混合路由策略：
+ * 1. 所有节点子域名DNS都指向集群入口
+ * 2. 认证请求路由到集群IDP
+ * 3. 数据请求根据节点模式智能路由（307重定向 vs 代理）
+ *
+ * Note: WebSocket 代理由 ClusterWebSocketConfigurator 处理
+ */
+class ClusterIngressRouter extends community_server_1.HttpHandler {
+    constructor(options) {
+        super();
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        // Authentication paths that should always route to cluster IDP
+        this.authPaths = [
+            '/idp/',
+            '/.well-known/openid-configuration',
+            '/.well-known/oauth-authorization-server',
+            '/login',
+            '/logout'
+        ];
+        this.repository = options.repository ?? new EdgeNodeRepository_1.EdgeNodeRepository((0, db_1.getIdentityDatabase)(options.identityDbUrl));
+        this.enabled = this.normalizeBoolean(options.edgeNodesEnabled);
+        this.clusterIngressDomain = this.normalizeDomain(options.clusterIngressDomain);
+        this.skipAuthRedirect = options.skipAuthRedirect ?? false;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+    }
+    async canHandle({ request }) {
+        this.logger.debug('ClusterIngressRouter.canHandle called');
+        if (!this.enabled) {
+            this.logger.debug('ClusterIngressRouter disabled');
+            throw new community_server_2.NotImplementedHttpError('Cluster ingress router disabled.');
+        }
+        const hostname = this.extractHostname(request);
+        if (!hostname) {
+            throw new community_server_2.NotImplementedHttpError('Missing Host header.');
+        }
+        // Only handle requests to node subdomains, not the cluster domain itself
+        if (hostname === this.clusterIngressDomain) {
+            throw new community_server_2.NotImplementedHttpError('Request to cluster domain, not a node subdomain.');
+        }
+        // Check if this is a valid node subdomain
+        const nodeId = this.extractNodeIdFromHostname(hostname);
+        if (!nodeId) {
+            throw new community_server_2.NotImplementedHttpError('Not a node subdomain pattern.');
+        }
+        // Verify the node exists
+        const nodeSecret = await this.repository.getNodeSecret(nodeId);
+        if (!nodeSecret) {
+            throw new community_server_2.NotImplementedHttpError(`Node ${nodeId} not registered.`);
+        }
+        const url = this.parseUrl(request);
+        if (this.isAuthenticationRequest(url.pathname)) {
+            this.rewriteRequestForClusterIdp(request, hostname);
+            throw new community_server_2.NotImplementedHttpError('Authentication routed to cluster IDP.');
+        }
+    }
+    async handle({ request, response }) {
+        const hostname = this.extractHostname(request);
+        const url = this.parseUrl(request);
+        const nodeId = this.extractNodeIdFromHostname(hostname);
+        // Check if this is an authentication request
+        if (this.isAuthenticationRequest(url.pathname)) {
+            await this.handleAuthenticationRequest(request, response, url);
+            return;
+        }
+        // Data request - route based on node access mode
+        await this.handleDataRequest(request, response, nodeId, url);
+    }
+    /**
+     * Handle authentication requests - always route to cluster IDP
+     */
+    async handleAuthenticationRequest(request, response, url) {
+        if (this.skipAuthRedirect) {
+            throw new community_server_2.NotImplementedHttpError('Auth routing skipped for testing.');
+        }
+        // Redirect authentication requests to cluster IDP
+        const clusterAuthUrl = new URL(url.pathname + url.search + url.hash, `https://${this.clusterIngressDomain}`);
+        this.logger.debug(`Routing auth request to cluster IDP: ${clusterAuthUrl.toString()}`);
+        response.statusCode = 307;
+        response.setHeader('Location', clusterAuthUrl.toString());
+        response.setHeader('Cache-Control', 'no-cache');
+        response.setHeader('X-Xpod-Auth-Redirect', 'cluster-idp');
+        response.end();
+    }
+    /**
+     * Handle data requests - route based on node access mode
+     */
+    async handleDataRequest(request, response, nodeId, url) {
+        try {
+            const [nodeInfo, nodeMetadata] = await Promise.all([
+                this.repository.getNodeConnectivityInfo(nodeId),
+                this.repository.getNodeMetadata(nodeId),
+            ]);
+            if (!nodeInfo) {
+                throw new community_server_2.InternalServerError(`Node ${nodeId} connectivity info not found.`);
+            }
+            const mode = this.normalizeMode(nodeInfo.accessMode);
+            if (mode === 'direct' && nodeInfo.publicIp) {
+                await this.handleDirectModeRedirect(response, nodeInfo, url);
+            }
+            else if (mode === 'proxy') {
+                await this.handleProxyModeRequest(request, response, nodeId, nodeInfo, nodeMetadata?.metadata || null, url);
+            }
+            else {
+                throw new community_server_2.InternalServerError(`Node ${nodeId} has unsupported accessMode ${nodeInfo.accessMode ?? 'unknown'}.`);
+            }
+        }
+        catch (error) {
+            if (error instanceof community_server_2.NotImplementedHttpError) {
+                throw error;
+            }
+            throw new community_server_2.InternalServerError('Failed to route data request.', { cause: error });
+        }
+    }
+    /**
+     * Handle direct mode - redirect to node's public IP
+     */
+    async handleDirectModeRedirect(response, nodeInfo, url) {
+        const port = nodeInfo.publicPort && nodeInfo.publicPort !== 443 ? `:${nodeInfo.publicPort}` : '';
+        const nodeDirectUrl = `https://${nodeInfo.publicIp}${port}${url.pathname}${url.search}${url.hash}`;
+        this.logger.debug(`Redirecting to edge node (direct mode): ${nodeDirectUrl}`);
+        response.statusCode = 307;
+        response.setHeader('Location', nodeDirectUrl);
+        response.setHeader('Cache-Control', 'no-cache');
+        response.setHeader('X-Xpod-Direct-Node', nodeInfo.nodeId);
+        response.setHeader('X-Xpod-Target-IP', nodeInfo.publicIp);
+        response.end();
+    }
+    /**
+     * Handle proxy mode - proxy the request through tunnel
+     */
+    async handleProxyModeRequest(request, response, nodeId, nodeInfo, metadata, url) {
+        // Get tunnel entrypoint from node metadata
+        const upstream = this.resolveUpstream(metadata);
+        if (!upstream) {
+            throw new community_server_2.InternalServerError(`Node ${nodeId} tunnel endpoint not ready.`);
+        }
+        const upstreamBase = new URL(upstream);
+        const target = new URL(url.pathname + url.search, upstreamBase);
+        target.hash = url.hash;
+        const body = await this.readRequestBody(request);
+        const headers = this.buildProxyHeaders(request, url, upstreamBase);
+        let upstreamResponse;
+        try {
+            upstreamResponse = await this.fetchImpl(target.toString(), {
+                method: (request.method ?? 'GET').toUpperCase(),
+                headers,
+                body: body?.length ? body : undefined,
+            });
+        }
+        catch (error) {
+            this.logger.error(`Proxy request to ${target.toString()} failed: ${String(error)}`);
+            throw new community_server_2.InternalServerError('Failed to proxy request to edge node.', { cause: error });
+        }
+        // Forward response
+        response.statusCode = upstreamResponse.status;
+        response.setHeader('X-Xpod-Proxy-Node', nodeId);
+        upstreamResponse.headers.forEach((value, key) => {
+            if (key.toLowerCase() === 'transfer-encoding' && value === 'chunked') {
+                return; // Let Node.js handle chunking
+            }
+            response.setHeader(key, value);
+        });
+        if (!upstreamResponse.body) {
+            response.end();
+            return;
+        }
+        const readable = node_stream_1.Readable.from(upstreamResponse.body);
+        readable.on('error', (error) => {
+            this.logger.error(`Proxy stream error: ${String(error)}`);
+            response.destroy(error);
+        });
+        readable.pipe(response);
+    }
+    /**
+     * Resolve upstream endpoint from node metadata
+     */
+    resolveUpstream(metadata) {
+        const tunnel = metadata?.tunnel;
+        if (tunnel && typeof tunnel === 'object') {
+            const entrypoint = tunnel.entrypoint;
+            if (typeof entrypoint === 'string' && entrypoint.trim().length > 0) {
+                return entrypoint;
+            }
+        }
+        // Fallback to publicAddress if available
+        if (typeof metadata?.publicAddress === 'string') {
+            return metadata.publicAddress;
+        }
+        return undefined;
+    }
+    /**
+     * Build headers for proxy request
+     */
+    buildProxyHeaders(request, original, upstream) {
+        const headers = new Headers();
+        // Forward original headers except host
+        for (const [name, value] of Object.entries(request.headers)) {
+            if (value === undefined || name.toLowerCase() === 'host') {
+                continue;
+            }
+            if (Array.isArray(value)) {
+                headers.set(name, value.join(','));
+            }
+            else {
+                headers.set(name, value);
+            }
+        }
+        // Set proper target host
+        headers.set('host', upstream.host);
+        // Add forwarded headers for transparency
+        headers.set('x-forwarded-host', original.host);
+        headers.set('x-forwarded-proto', original.protocol.replace(/:$/u, ''));
+        const port = original.port || (original.protocol === 'https:' ? '443' : '80');
+        headers.set('x-forwarded-port', port);
+        // Add client IP if available
+        const remoteAddress = request.socket?.remoteAddress;
+        if (remoteAddress) {
+            const existing = headers.get('x-forwarded-for');
+            headers.set('x-forwarded-for', existing ? `${existing}, ${remoteAddress}` : remoteAddress);
+        }
+        return headers;
+    }
+    /**
+     * Read request body for proxy forwarding
+     */
+    readRequestBody(request) {
+        const method = (request.method ?? 'GET').toUpperCase();
+        if (['GET', 'HEAD'].includes(method)) {
+            return Promise.resolve(undefined);
+        }
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            request.on('data', (chunk) => chunks.push(chunk));
+            request.on('end', () => resolve(Buffer.concat(chunks)));
+            request.on('error', reject);
+        });
+    }
+    /**
+     * Check if request path is for authentication
+     */
+    isAuthenticationRequest(pathname) {
+        return this.authPaths.some(authPath => pathname.startsWith(authPath));
+    }
+    /**
+     * Rewrite the incoming request so downstream handlers treat it as cluster IDP traffic.
+     */
+    rewriteRequestForClusterIdp(request, originalHost) {
+        if (!request.headers['x-original-host']) {
+            request.headers['x-original-host'] = originalHost;
+        }
+        request.headers.host = this.clusterIngressDomain;
+        request.headers.Host = this.clusterIngressDomain;
+        if (!request.headers['x-forwarded-host']) {
+            request.headers['x-forwarded-host'] = originalHost;
+        }
+    }
+    /**
+     * Extract node ID from hostname
+     * e.g., "node1.cluster.example.com" -> "node1"
+     */
+    extractNodeIdFromHostname(hostname) {
+        const clusterSuffix = `.${this.clusterIngressDomain}`;
+        if (!hostname.endsWith(clusterSuffix)) {
+            return undefined;
+        }
+        const nodeId = hostname.slice(0, -clusterSuffix.length);
+        // Validate node ID format (simple validation)
+        if (!nodeId || nodeId.includes('.') || nodeId.length === 0) {
+            return undefined;
+        }
+        return nodeId;
+    }
+    /**
+     * Extract hostname from request headers
+     * Check for original host header first (set by ClusterHttpServerFactory)
+     */
+    extractHostname(request) {
+        // Check for original host header first (set by ClusterHttpServerFactory)
+        const originalHost = request.headers['x-original-host'];
+        if (originalHost && typeof originalHost === 'string') {
+            return originalHost.toLowerCase();
+        }
+        const hostHeader = request.headers.host || request.headers.Host;
+        if (Array.isArray(hostHeader)) {
+            return hostHeader[0]?.toLowerCase();
+        }
+        return typeof hostHeader === 'string' ? hostHeader.toLowerCase() : undefined;
+    }
+    /**
+     * Parse request URL
+     */
+    parseUrl(request) {
+        const hostHeader = request.headers.host ?? request.headers.Host ?? 'localhost';
+        const protoHeader = request.headers['x-forwarded-proto'] ?? request.headers['X-Forwarded-Proto'];
+        const protocol = Array.isArray(protoHeader) ? protoHeader[0] : protoHeader;
+        const scheme = typeof protocol === 'string' ? protocol.split(',')[0]?.trim() ?? 'https' : 'https';
+        const rawUrl = request.url ?? '/';
+        return new URL(rawUrl, `${scheme}://${hostHeader}`);
+    }
+    /**
+     * Normalize domain input; accept bare host or full URL.
+     */
+    normalizeDomain(domain) {
+        if (domain.includes('://')) {
+            try {
+                return new URL(domain).hostname.toLowerCase();
+            }
+            catch {
+                return domain.toLowerCase();
+            }
+        }
+        return domain.toLowerCase();
+    }
+    /**
+     * Normalize boolean values from string/boolean
+     */
+    normalizeBoolean(value) {
+        if (typeof value === 'boolean') {
+            return value;
+        }
+        if (typeof value === 'string') {
+            const normalized = value.trim().toLowerCase();
+            return normalized === 'true' || normalized === '1' || normalized === 'yes' || normalized === 'on';
+        }
+        return false;
+    }
+    normalizeMode(mode) {
+        if (!mode) {
+            return undefined;
+        }
+        const normalized = mode.trim().toLowerCase();
+        // Backward compatibility for 'redirect' -> 'direct'
+        if (normalized === 'redirect' || normalized === 'direct') {
+            return 'direct';
+        }
+        if (normalized === 'proxy') {
+            return 'proxy';
+        }
+        return undefined;
+    }
+}
+exports.ClusterIngressRouter = ClusterIngressRouter;
+//# sourceMappingURL=ClusterIngressRouter.js.map

package/dist/http/ClusterIngressRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterIngressRouter.js","sourceRoot":"","sources":["../../src/http/ClusterIngressRouter.ts"],"names":[],"mappings":";;;AACA,iEAAqD;AACrD,6CAAuC;AACvC,8DAAsD;AAEtD,8DAIiC;AACjC,+CAA6D;AAC7D,+EAA4E;AAW5E;;;;;;;;;GASG;AACH,MAAa,oBAAqB,SAAQ,8BAAW;IAiBnD,YAAmB,OAAoC;QACrD,KAAK,EAAE,CAAC;QAjBS,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAO/C,+DAA+D;QAC9C,cAAS,GAAG;YAC3B,OAAO;YACP,mCAAmC;YACnC,yCAAyC;YACzC,QAAQ;YACR,SAAS;SACV,CAAC;QAIA,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,uCAAkB,CAAC,IAAA,wBAAmB,EAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC/D,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/E,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC9C,CAAC;IAEe,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,MAAM,IAAI,0CAAuB,CAAC,kCAAkC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,0CAAuB,CAAC,sBAAsB,CAAC,CAAC;QAC5D,CAAC;QAED,yEAAyE;QACzE,IAAI,QAAQ,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC3C,MAAM,IAAI,0CAAuB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QAED,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,0CAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,CAAC;QAED,yBAAyB;QACzB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,0CAAuB,CAAC,QAAQ,MAAM,kBAAkB,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,0CAAuB,CAAC,uCAAuC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAEe,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAoB;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAE,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAE,CAAC;QAEzD,6CAA6C;QAC7C,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,2BAA2B,CACvC,OAAwB,EACxB,QAAsB,EACtB,GAAQ;QAER,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,mCAAmC,CAAC,CAAC;QACzE,CAAC;QAED,kDAAkD;QAClD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAE7G,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEvF,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC;QAC1D,QAAQ,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAC7B,OAAwB,EACxB,QAAsB,EACtB,MAAc,EACd,GAAQ;QAER,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACjD,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,MAAM,CAAC;gBAC/C,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC;aACxC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,sCAAmB,CAAC,QAAQ,MAAM,+BAA+B,CAAC,CAAC;YAC/E,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAC3C,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9G,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,sCAAmB,CAAC,QAAQ,MAAM,+BAA+B,QAAQ,CAAC,UAAU,IAAI,SAAS,GAAG,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,KAAK,YAAY,0CAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,sCAAmB,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,wBAAwB,CACpC,QAAsB,EACtB,QAAyF,EACzF,GAAQ;QAER,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,MAAM,aAAa,GAAG,WAAW,QAAQ,CAAC,QAAQ,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAEnG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,aAAa,EAAE,CAAC,CAAC;QAE9E,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC9C,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAS,CAAC,CAAC;QAC3D,QAAQ,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAClC,OAAwB,EACxB,QAAsB,EACtB,MAAc,EACd,QAAyF,EACzF,QAAwC,EACxC,GAAQ;QAER,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,sCAAmB,CAAC,QAAQ,MAAM,6BAA6B,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAEnE,IAAI,gBAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,gBAAgB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;gBACzD,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;gBAC/C,OAAO;gBACP,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aACtC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,QAAQ,EAAE,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpF,MAAM,IAAI,sCAAmB,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,mBAAmB;QACnB,QAAQ,CAAC,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAC9C,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAEhD,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,mBAAmB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACrE,OAAO,CAAC,8BAA8B;YACxC,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAC3B,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,sBAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAW,CAAC,CAAC;QAC7D,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1D,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,QAAyC;QAC/D,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;QAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,UAAU,GAAI,MAAkC,CAAC,UAAU,CAAC;YAClE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnE,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,OAAO,QAAQ,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,QAAQ,CAAC,aAAa,CAAC;QAChC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,OAAwB,EAAE,QAAa,EAAE,QAAa;QAC9E,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAE9B,uCAAuC;QACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEnC,yCAAyC;QACzC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAEvE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAEtC,6BAA6B;QAC7B,MAAM,aAAa,GAAI,OAAO,CAAC,MAAc,EAAE,aAAa,CAAC;QAC7D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC7F,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAwB;QAC9C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,uBAAuB,CAAC,QAAgB;QAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACK,2BAA2B,CAAC,OAAwB,EAAE,YAAoB;QAChF,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,YAAY,CAAC;QACpD,CAAC;QAED,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACjD,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAEjD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC;QACrD,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,yBAAyB,CAAC,QAAgB;QAChD,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACxD,8CAA8C;QAC9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,OAAwB;QAC9C,yEAAyE;QACzE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACxD,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAChE,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,OAAwB;QACvC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;QAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3E,MAAM,MAAM,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAClG,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;QAClC,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,MAAM,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,MAAc;QACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,KAAwB;QAC/C,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC9C,OAAO,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,IAAI,CAAC;QACpG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,IAAwB;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,oDAAoD;QACpD,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAtZD,oDAsZC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport { Readable } from 'node:stream';\nimport { HttpHandler } from '@solid/community-server';\nimport type { HttpHandlerInput, HttpResponse } from '@solid/community-server';\nimport {\n  NotImplementedHttpError,\n  InternalServerError,\n  \n} from '@solid/community-server';\nimport { getIdentityDatabase } from '../identity/drizzle/db';\nimport { EdgeNodeRepository } from '../identity/drizzle/EdgeNodeRepository';\n\ninterface ClusterIngressRouterOptions {\n  identityDbUrl: string;\n  edgeNodesEnabled?: string | boolean;\n  repository?: EdgeNodeRepository;\n  clusterIngressDomain: string; // cluster.example.com\n  skipAuthRedirect?: boolean; // For testing\n  fetchImpl?: any;\n}\n\n/**\n * Cluster Ingress Router - 集群统一入口路由器\n * \n * 实现我们设计的混合路由策略：\n * 1. 所有节点子域名DNS都指向集群入口\n * 2. 认证请求路由到集群IDP  \n * 3. 数据请求根据节点模式智能路由（307重定向 vs 代理）\n * \n * Note: WebSocket 代理由 ClusterWebSocketConfigurator 处理\n */\nexport class ClusterIngressRouter extends HttpHandler {\n  protected readonly logger = getLoggerFor(this);\n  private readonly repository: EdgeNodeRepository;\n  private readonly enabled: boolean;\n  private readonly clusterIngressDomain: string;\n  private readonly skipAuthRedirect: boolean;\n  private readonly fetchImpl: any;\n\n  // Authentication paths that should always route to cluster IDP\n  private readonly authPaths = [\n    '/idp/',\n    '/.well-known/openid-configuration',\n    '/.well-known/oauth-authorization-server', \n    '/login',\n    '/logout'\n  ];\n\n  public constructor(options: ClusterIngressRouterOptions) {\n    super();\n    this.repository = options.repository ?? new EdgeNodeRepository(getIdentityDatabase(options.identityDbUrl));\n    this.enabled = this.normalizeBoolean(options.edgeNodesEnabled);\n    this.clusterIngressDomain = this.normalizeDomain(options.clusterIngressDomain);\n    this.skipAuthRedirect = options.skipAuthRedirect ?? false;\n    this.fetchImpl = options.fetchImpl ?? fetch;\n  }\n\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    this.logger.debug('ClusterIngressRouter.canHandle called');\n    if (!this.enabled) {\n      this.logger.debug('ClusterIngressRouter disabled');\n      throw new NotImplementedHttpError('Cluster ingress router disabled.');\n    }\n\n    const hostname = this.extractHostname(request);\n    if (!hostname) {\n      throw new NotImplementedHttpError('Missing Host header.');\n    }\n\n    // Only handle requests to node subdomains, not the cluster domain itself\n    if (hostname === this.clusterIngressDomain) {\n      throw new NotImplementedHttpError('Request to cluster domain, not a node subdomain.');\n    }\n\n    // Check if this is a valid node subdomain\n    const nodeId = this.extractNodeIdFromHostname(hostname);\n    if (!nodeId) {\n      throw new NotImplementedHttpError('Not a node subdomain pattern.');\n    }\n\n    // Verify the node exists\n    const nodeSecret = await this.repository.getNodeSecret(nodeId);\n    if (!nodeSecret) {\n      throw new NotImplementedHttpError(`Node ${nodeId} not registered.`);\n    }\n\n    const url = this.parseUrl(request);\n    if (this.isAuthenticationRequest(url.pathname)) {\n      this.rewriteRequestForClusterIdp(request, hostname);\n      throw new NotImplementedHttpError('Authentication routed to cluster IDP.');\n    }\n  }\n\n  public override async handle({ request, response }: HttpHandlerInput): Promise<void> {\n    const hostname = this.extractHostname(request)!;\n    const url = this.parseUrl(request);\n    const nodeId = this.extractNodeIdFromHostname(hostname)!;\n    \n    // Check if this is an authentication request\n    if (this.isAuthenticationRequest(url.pathname)) {\n      await this.handleAuthenticationRequest(request, response, url);\n      return;\n    }\n\n    // Data request - route based on node access mode\n    await this.handleDataRequest(request, response, nodeId, url);\n  }\n\n  /**\n   * Handle authentication requests - always route to cluster IDP\n   */\n  private async handleAuthenticationRequest(\n    request: IncomingMessage, \n    response: HttpResponse, \n    url: URL\n  ): Promise<void> {\n    if (this.skipAuthRedirect) {\n      throw new NotImplementedHttpError('Auth routing skipped for testing.');\n    }\n\n    // Redirect authentication requests to cluster IDP\n    const clusterAuthUrl = new URL(url.pathname + url.search + url.hash, `https://${this.clusterIngressDomain}`);\n    \n    this.logger.debug(`Routing auth request to cluster IDP: ${clusterAuthUrl.toString()}`);\n    \n    response.statusCode = 307;\n    response.setHeader('Location', clusterAuthUrl.toString());\n    response.setHeader('Cache-Control', 'no-cache');\n    response.setHeader('X-Xpod-Auth-Redirect', 'cluster-idp');\n    response.end();\n  }\n\n  /**\n   * Handle data requests - route based on node access mode\n   */\n  private async handleDataRequest(\n    request: IncomingMessage,\n    response: HttpResponse, \n    nodeId: string,\n    url: URL\n  ): Promise<void> {\n    try {\n      const [nodeInfo, nodeMetadata] = await Promise.all([\n        this.repository.getNodeConnectivityInfo(nodeId),\n        this.repository.getNodeMetadata(nodeId),\n      ]);\n      \n      if (!nodeInfo) {\n        throw new InternalServerError(`Node ${nodeId} connectivity info not found.`);\n      }\n\n      const mode = this.normalizeMode(nodeInfo.accessMode);\n      if (mode === 'direct' && nodeInfo.publicIp) {\n        await this.handleDirectModeRedirect(response, nodeInfo, url);\n      } else if (mode === 'proxy') {\n        await this.handleProxyModeRequest(request, response, nodeId, nodeInfo, nodeMetadata?.metadata || null, url);\n      } else {\n        throw new InternalServerError(`Node ${nodeId} has unsupported accessMode ${nodeInfo.accessMode ?? 'unknown'}.`);\n      }\n    } catch (error: unknown) {\n      if (error instanceof NotImplementedHttpError) {\n        throw error;\n      }\n      throw new InternalServerError('Failed to route data request.', { cause: error });\n    }\n  }\n\n  /**\n   * Handle direct mode - redirect to node's public IP\n   */\n  private async handleDirectModeRedirect(\n    response: HttpResponse,\n    nodeInfo: NonNullable<Awaited<ReturnType<EdgeNodeRepository['getNodeConnectivityInfo']>>>,\n    url: URL\n  ): Promise<void> {\n    const port = nodeInfo.publicPort && nodeInfo.publicPort !== 443 ? `:${nodeInfo.publicPort}` : '';\n    const nodeDirectUrl = `https://${nodeInfo.publicIp}${port}${url.pathname}${url.search}${url.hash}`;\n    \n    this.logger.debug(`Redirecting to edge node (direct mode): ${nodeDirectUrl}`);\n    \n    response.statusCode = 307;\n    response.setHeader('Location', nodeDirectUrl);\n    response.setHeader('Cache-Control', 'no-cache');\n    response.setHeader('X-Xpod-Direct-Node', nodeInfo.nodeId);\n    response.setHeader('X-Xpod-Target-IP', nodeInfo.publicIp!);\n    response.end();\n  }\n\n  /**\n   * Handle proxy mode - proxy the request through tunnel\n   */\n  private async handleProxyModeRequest(\n    request: IncomingMessage,\n    response: HttpResponse,\n    nodeId: string,\n    nodeInfo: NonNullable<Awaited<ReturnType<EdgeNodeRepository['getNodeConnectivityInfo']>>>,\n    metadata: Record<string, unknown> | null,\n    url: URL\n  ): Promise<void> {\n    // Get tunnel entrypoint from node metadata\n    const upstream = this.resolveUpstream(metadata);\n    if (!upstream) {\n      throw new InternalServerError(`Node ${nodeId} tunnel endpoint not ready.`);\n    }\n\n    const upstreamBase = new URL(upstream);\n    const target = new URL(url.pathname + url.search, upstreamBase);\n    target.hash = url.hash;\n\n    const body = await this.readRequestBody(request);\n    const headers = this.buildProxyHeaders(request, url, upstreamBase);\n\n    let upstreamResponse: Response;\n    try {\n      upstreamResponse = await this.fetchImpl(target.toString(), {\n        method: (request.method ?? 'GET').toUpperCase(),\n        headers,\n        body: body?.length ? body : undefined,\n      });\n    } catch (error: unknown) {\n      this.logger.error(`Proxy request to ${target.toString()} failed: ${String(error)}`);\n      throw new InternalServerError('Failed to proxy request to edge node.', { cause: error });\n    }\n\n    // Forward response\n    response.statusCode = upstreamResponse.status;\n    response.setHeader('X-Xpod-Proxy-Node', nodeId);\n    \n    upstreamResponse.headers.forEach((value, key) => {\n      if (key.toLowerCase() === 'transfer-encoding' && value === 'chunked') {\n        return; // Let Node.js handle chunking\n      }\n      response.setHeader(key, value);\n    });\n\n    if (!upstreamResponse.body) {\n      response.end();\n      return;\n    }\n\n    const readable = Readable.from(upstreamResponse.body as any);\n    readable.on('error', (error) => {\n      this.logger.error(`Proxy stream error: ${String(error)}`);\n      response.destroy(error);\n    });\n    readable.pipe(response);\n  }\n\n  /**\n   * Resolve upstream endpoint from node metadata\n   */\n  private resolveUpstream(metadata?: Record<string, unknown> | null): string | undefined {\n    const tunnel = metadata?.tunnel;\n    if (tunnel && typeof tunnel === 'object') {\n      const entrypoint = (tunnel as Record<string, unknown>).entrypoint;\n      if (typeof entrypoint === 'string' && entrypoint.trim().length > 0) {\n        return entrypoint;\n      }\n    }\n    \n    // Fallback to publicAddress if available\n    if (typeof metadata?.publicAddress === 'string') {\n      return metadata.publicAddress;\n    }\n    \n    return undefined;\n  }\n\n  /**\n   * Build headers for proxy request\n   */\n  private buildProxyHeaders(request: IncomingMessage, original: URL, upstream: URL): Headers {\n    const headers = new Headers();\n    \n    // Forward original headers except host\n    for (const [name, value] of Object.entries(request.headers)) {\n      if (value === undefined || name.toLowerCase() === 'host') {\n        continue;\n      }\n      if (Array.isArray(value)) {\n        headers.set(name, value.join(','));\n      } else {\n        headers.set(name, value);\n      }\n    }\n    \n    // Set proper target host\n    headers.set('host', upstream.host);\n    \n    // Add forwarded headers for transparency\n    headers.set('x-forwarded-host', original.host);\n    headers.set('x-forwarded-proto', original.protocol.replace(/:$/u, ''));\n    \n    const port = original.port || (original.protocol === 'https:' ? '443' : '80');\n    headers.set('x-forwarded-port', port);\n    \n    // Add client IP if available\n    const remoteAddress = (request.socket as any)?.remoteAddress;\n    if (remoteAddress) {\n      const existing = headers.get('x-forwarded-for');\n      headers.set('x-forwarded-for', existing ? `${existing}, ${remoteAddress}` : remoteAddress);\n    }\n    \n    return headers;\n  }\n\n  /**\n   * Read request body for proxy forwarding\n   */\n  private readRequestBody(request: IncomingMessage): Promise<Buffer | undefined> {\n    const method = (request.method ?? 'GET').toUpperCase();\n    if (['GET', 'HEAD'].includes(method)) {\n      return Promise.resolve(undefined);\n    }\n    \n    return new Promise((resolve, reject) => {\n      const chunks: Buffer[] = [];\n      request.on('data', (chunk: Buffer) => chunks.push(chunk));\n      request.on('end', () => resolve(Buffer.concat(chunks)));\n      request.on('error', reject);\n    });\n  }\n\n  /**\n   * Check if request path is for authentication\n   */\n  private isAuthenticationRequest(pathname: string): boolean {\n    return this.authPaths.some(authPath => pathname.startsWith(authPath));\n  }\n\n  /**\n   * Rewrite the incoming request so downstream handlers treat it as cluster IDP traffic.\n   */\n  private rewriteRequestForClusterIdp(request: IncomingMessage, originalHost: string): void {\n    if (!request.headers['x-original-host']) {\n      request.headers['x-original-host'] = originalHost;\n    }\n\n    request.headers.host = this.clusterIngressDomain;\n    request.headers.Host = this.clusterIngressDomain;\n\n    if (!request.headers['x-forwarded-host']) {\n      request.headers['x-forwarded-host'] = originalHost;\n    }\n  }\n\n  /**\n   * Extract node ID from hostname\n   * e.g., \"node1.cluster.example.com\" -> \"node1\"\n   */\n  private extractNodeIdFromHostname(hostname: string): string | undefined {\n    const clusterSuffix = `.${this.clusterIngressDomain}`;\n    if (!hostname.endsWith(clusterSuffix)) {\n      return undefined;\n    }\n    \n    const nodeId = hostname.slice(0, -clusterSuffix.length);\n    // Validate node ID format (simple validation)\n    if (!nodeId || nodeId.includes('.') || nodeId.length === 0) {\n      return undefined;\n    }\n    \n    return nodeId;\n  }\n\n  /**\n   * Extract hostname from request headers\n   * Check for original host header first (set by ClusterHttpServerFactory)\n   */\n  private extractHostname(request: IncomingMessage): string | undefined {\n    // Check for original host header first (set by ClusterHttpServerFactory)\n    const originalHost = request.headers['x-original-host'];\n    if (originalHost && typeof originalHost === 'string') {\n      return originalHost.toLowerCase();\n    }\n    \n    const hostHeader = request.headers.host || request.headers.Host;\n    if (Array.isArray(hostHeader)) {\n      return hostHeader[0]?.toLowerCase();\n    }\n    return typeof hostHeader === 'string' ? hostHeader.toLowerCase() : undefined;\n  }\n\n  /**\n   * Parse request URL\n   */\n  private parseUrl(request: IncomingMessage): URL {\n    const hostHeader = request.headers.host ?? request.headers.Host ?? 'localhost';\n    const protoHeader = request.headers['x-forwarded-proto'] ?? request.headers['X-Forwarded-Proto'];\n    const protocol = Array.isArray(protoHeader) ? protoHeader[0] : protoHeader;\n    const scheme = typeof protocol === 'string' ? protocol.split(',')[0]?.trim() ?? 'https' : 'https';\n    const rawUrl = request.url ?? '/';\n    return new URL(rawUrl, `${scheme}://${hostHeader}`);\n  }\n\n  /**\n   * Normalize domain input; accept bare host or full URL.\n   */\n  private normalizeDomain(domain: string): string {\n    if (domain.includes('://')) {\n      try {\n        return new URL(domain).hostname.toLowerCase();\n      } catch {\n        return domain.toLowerCase();\n      }\n    }\n    return domain.toLowerCase();\n  }\n\n  /**\n   * Normalize boolean values from string/boolean\n   */\n  private normalizeBoolean(value?: string | boolean): boolean {\n    if (typeof value === 'boolean') {\n      return value;\n    }\n    if (typeof value === 'string') {\n      const normalized = value.trim().toLowerCase();\n      return normalized === 'true' || normalized === '1' || normalized === 'yes' || normalized === 'on';\n    }\n    return false;\n  }\n\n  private normalizeMode(mode: string | undefined): 'direct' | 'proxy' | undefined {\n    if (!mode) {\n      return undefined;\n    }\n    const normalized = mode.trim().toLowerCase();\n    // Backward compatibility for 'redirect' -> 'direct'\n    if (normalized === 'redirect' || normalized === 'direct') {\n      return 'direct';\n    }\n    if (normalized === 'proxy') {\n      return 'proxy';\n    }\n    return undefined;\n  }\n}\n"]}

package/dist/http/ClusterIngressRouter.jsonld

@@ -0,0 +1,227 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter",
+      "@type": "Class",
+      "requireElement": "ClusterIngressRouter",
+      "extends": [
+        "css:dist/server/HttpHandler.jsonld#HttpHandler"
+      ],
+      "comment": "Cluster Ingress Router - 集群统一入口路由器  实现我们设计的混合路由策略： 1. 所有节点子域名DNS都指向集群入口 2. 认证请求路由到集群IDP 3. 数据请求根据节点模式智能路由（307重定向 vs 代理）  Note: WebSocket 代理由 ClusterWebSocketConfigurator 处理",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_identityDbUrl",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_edgeNodesEnabled",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              "xsd:boolean",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_repository",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "undefineds:dist/identity/drizzle/EdgeNodeRepository.jsonld#EdgeNodeRepository",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_clusterIngressDomain",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_skipAuthRedirect",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:boolean",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_fetchImpl",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              {
+                "@type": "ParameterRangeWildcard"
+              },
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_logger",
+          "memberFieldName": "logger",
+          "range": {
+            "@type": "ParameterRangeWildcard"
+          }
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_repository",
+          "memberFieldName": "repository"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_enabled",
+          "memberFieldName": "enabled"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_clusterIngressDomain",
+          "memberFieldName": "clusterIngressDomain"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_skipAuthRedirect",
+          "memberFieldName": "skipAuthRedirect"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_fetchImpl",
+          "memberFieldName": "fetchImpl"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_authPaths",
+          "memberFieldName": "authPaths"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_canHandle",
+          "memberFieldName": "canHandle"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_handle",
+          "memberFieldName": "handle"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_handleAuthenticationRequest",
+          "memberFieldName": "handleAuthenticationRequest"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_handleDataRequest",
+          "memberFieldName": "handleDataRequest"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_handleDirectModeRedirect",
+          "memberFieldName": "handleDirectModeRedirect"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_handleProxyModeRequest",
+          "memberFieldName": "handleProxyModeRequest"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_resolveUpstream",
+          "memberFieldName": "resolveUpstream"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_buildProxyHeaders",
+          "memberFieldName": "buildProxyHeaders"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_readRequestBody",
+          "memberFieldName": "readRequestBody"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_isAuthenticationRequest",
+          "memberFieldName": "isAuthenticationRequest"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_rewriteRequestForClusterIdp",
+          "memberFieldName": "rewriteRequestForClusterIdp"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_extractNodeIdFromHostname",
+          "memberFieldName": "extractNodeIdFromHostname"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_extractHostname",
+          "memberFieldName": "extractHostname"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_parseUrl",
+          "memberFieldName": "parseUrl"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_normalizeDomain",
+          "memberFieldName": "normalizeDomain"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_normalizeBoolean",
+          "memberFieldName": "normalizeBoolean"
+        },
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter__member_normalizeMode",
+          "memberFieldName": "normalizeMode"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options__constructorArgument",
+          "fields": [
+            {
+              "keyRaw": "identityDbUrl",
+              "value": {
+                "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_identityDbUrl"
+              }
+            },
+            {
+              "keyRaw": "edgeNodesEnabled",
+              "value": {
+                "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_edgeNodesEnabled"
+              }
+            },
+            {
+              "keyRaw": "repository",
+              "value": {
+                "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_repository"
+              }
+            },
+            {
+              "keyRaw": "clusterIngressDomain",
+              "value": {
+                "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_clusterIngressDomain"
+              }
+            },
+            {
+              "keyRaw": "skipAuthRedirect",
+              "value": {
+                "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_skipAuthRedirect"
+              }
+            },
+            {
+              "keyRaw": "fetchImpl",
+              "value": {
+                "@id": "undefineds:dist/http/ClusterIngressRouter.jsonld#ClusterIngressRouter_options_fetchImpl"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}