@velor/remote-mouse 6.4.8

package/server/connection/api/server-info.router.js

@@ -0,0 +1,149 @@
+import express from 'express';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {computeTokenTtlMs} from '../../services/token-manager/token-store-utils.js';
+import {publicDir, projectRoot} from '../../utils/paths.js';
+import {getRecentLogs} from '../../application/logger.js';
+import {readPackageVersion} from '../../utils/env.js';
+
+const packageJsonPath = path.join(projectRoot, 'package.json');
+
+function redactSecrets(value, key = '') {
+  const keyLower = String(key || '').toLowerCase();
+  if (keyLower.includes('secret') || keyLower.includes('password')) {
+    return '[redacted]';
+  }
+
+  if (Array.isArray(value)) {
+    return value.map((item) => redactSecrets(item));
+  }
+
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [childKey, childValue] of Object.entries(value)) {
+      out[childKey] = redactSecrets(childValue, childKey);
+    }
+    return out;
+  }
+
+  return value;
+}
+
+function getConnectedClients(io) {
+  return Array.from(io.of('/').sockets.values()).map((socket) => ({
+    id: socket.id,
+    connectedAt: Number.isFinite(socket?.handshake?.issued)
+      ? new Date(socket.handshake.issued).toISOString()
+      : null,
+    address: socket?.handshake?.address || socket?.conn?.remoteAddress || null,
+    transport: socket?.conn?.transport?.name || 'unknown',
+  }));
+}
+
+function maskToken(token) {
+  const normalized = String(token || '').trim();
+  if (!normalized) {
+    return '[masque]';
+  }
+
+  const fingerprint = createHash('sha256')
+    .update(normalized)
+    .digest('hex')
+    .slice(0, 8);
+
+  return `[masque:${fingerprint}]`;
+}
+
+function buildTokenEntries({entries, currentToken, entryPathConfig}) {
+  const entryPath = entryPathConfig || {};
+  const graceTtlMs = computeTokenTtlMs(entryPath.graceMin);
+  const rotateTtlMs = Math.max(60_000, Number(entryPath.rotateMin || 0) * 60_000);
+  const normalizedCurrentToken = String(currentToken || '').trim();
+  let currentTokenCreatedAt = null;
+  const tokenEntries = Array.from(entries || [], ([token, createdAt]) => {
+    if (token === normalizedCurrentToken) {
+      currentTokenCreatedAt = createdAt;
+      return null;
+    }
+
+    const createdAtMs = Math.floor(Number(createdAt));
+
+    return {
+      token: maskToken(token),
+      isCurrent: false,
+      createdAt: Number.isFinite(createdAtMs) ? new Date(createdAtMs).toISOString() : null,
+      expiresAt: Number.isFinite(createdAtMs) ? new Date(createdAtMs + graceTtlMs).toISOString() : null,
+    };
+  }).filter(Boolean);
+
+  if (!normalizedCurrentToken) {
+    return tokenEntries;
+  }
+
+  const currentTokenCreatedAtMs = Math.floor(Number(currentTokenCreatedAt));
+  const currentTokenExpiresAtMs = Number.isFinite(currentTokenCreatedAtMs)
+    ? currentTokenCreatedAtMs + Math.max(graceTtlMs, rotateTtlMs)
+    : NaN;
+
+  tokenEntries.push({
+    token: maskToken(normalizedCurrentToken),
+    isCurrent: true,
+    createdAt: Number.isFinite(currentTokenCreatedAtMs) ? new Date(currentTokenCreatedAtMs).toISOString() : null,
+    expiresAt: Number.isFinite(currentTokenExpiresAtMs) ? new Date(currentTokenExpiresAtMs).toISOString() : null,
+  });
+
+  return tokenEntries;
+}
+
+export function createServerInfoRouter(services) {
+  const router = express.Router();
+
+  router.get('/', (_req, res) => {
+    res.sendFile(path.join(publicDir, 'server-info.html'));
+  });
+
+  router.get('/data', async (_req, res) => {
+    const clients = getConnectedClients(services.getServer().io);
+    const rawConfig = services.getConfig();
+    const rawSystemConfig = services.getSystemConfig();
+    const config = redactSecrets(rawConfig);
+    const sysConfig = redactSecrets(rawSystemConfig);
+    const logs = getRecentLogs(250);
+    const version = readPackageVersion(packageJsonPath);
+    const tasks = services.getTaskManager().getTasksSnapshot();
+    const tokenEntries = services.getPersistence().entryTokenDao.loadEntryTokens();
+    const restarts = services.getPersistence().restartLogDao.listRecentRestartRecords(20);
+    const currentToken = services.getTokenManager().getToken();
+    const entryPathConfig = services.getSystemConfig().entryPath;
+    const daemon = await services.getApplicationDaemonService().getInfo();
+    const system = await services.getSystem().getInfo();
+    const tokens = buildTokenEntries({
+      entries: tokenEntries,
+      currentToken,
+      entryPathConfig,
+    });
+
+    res.json({
+      version,
+      now: new Date().toISOString(),
+      onlineSince: new Date(services.getServer().serverStartedAt).toISOString(),
+      uptimeSec: Math.floor(process.uptime()),
+      clientsConnected: clients.length,
+      clients,
+      tasks,
+      tokens,
+      daemon,
+      system,
+      restarts,
+      config,
+      sysConfig,
+      logs,
+    });
+  });
+  return router;
+}
+
+export const __testables = {
+  buildTokenEntries,
+  redactSecrets,
+};

package/server/connection/api/session.middleware.js

@@ -0,0 +1,93 @@
+import express from 'express';
+import {sendUnauthorizedResponse} from './unauthorized-response.js';
+import {
+    PUBSUB_EVENT_SESSION_CREATED,
+    PUBSUB_SERVICE_SESSION
+} from '../../services/pubsub/serviceEventConstants.js';
+
+function isLocalAddress(value) {
+    const address = String(value || '').toLowerCase();
+    return (
+        address === '127.0.0.1'
+        || address === '::1'
+        || address === '::ffff:127.0.0.1'
+    );
+}
+
+function getForwardedFor(req) {
+    const raw = String(req.headers?.['x-forwarded-for'] || '').split(',')[0].trim();
+    return raw || null;
+}
+
+export const createSessionCreationMiddleware = ({
+                                                    cookieName,
+                                                    cookieMaxAgeMs,
+                                                    secureCookies = true,
+                                                }) => (req, res, next) => {
+    res.createSession = (token) => {
+        res.cookie(cookieName, token,
+            {
+                signed: true,
+                httpOnly: true,
+                secure: secureCookies,
+                sameSite: 'lax',
+                maxAge: cookieMaxAgeMs,
+                path: '/',
+            });
+    }
+    next();
+}
+
+export function createSessionGuard(services, {
+    onUnauthorized = sendUnauthorizedResponse,
+} = {}) {
+    return (req, res, next) => {
+        const tokenManager = services.getTokenManager();
+        const cookieName = services.getSystemConfig().session.cookieName;
+        const forwarded = getForwardedFor(req);
+        const clientIp = forwarded || req.ip || req.socket?.remoteAddress;
+        const allowBypass = isLocalAddress(clientIp);
+
+        const token = req.signedCookies && req.signedCookies[cookieName];
+        if (!allowBypass && !tokenManager.isValid(token)) {
+            onUnauthorized(req, res);
+            return;
+        }
+        req.sessionToken = token;
+        next();
+    }
+}
+
+export function createSessionRouter(services) {
+    const router = express.Router();
+
+    router.get('/:token', (req, res) => {
+        const tokenManager = services.getTokenManager();
+        const token = req.params.token;
+        if (!tokenManager.isValid(token)) {
+            sendUnauthorizedResponse(req, res);
+            return;
+        }
+        const forwarded = getForwardedFor(req);
+        const clientIp = forwarded || req.ip || req.socket?.remoteAddress || '';
+        services.getEvents().publishEvent(PUBSUB_SERVICE_SESSION, PUBSUB_EVENT_SESSION_CREATED, {
+            address: String(clientIp || '').trim(),
+            token,
+        });
+        res.createSession(token);
+        res.redirect('/');
+    });
+
+  // router.post('/:token', (req, res, next) => {
+  //   req.signedCookies = {
+  //     ...req.signedCookies,
+  //     [services.getSystemConfig().session.cookieName]: req.params.token,
+  //   };
+  //   next();
+  // }, postSessionGuard, (req, res) => {
+  //       res.createSession(req.params.token);
+  //       res.status(204).end();
+  //   });
+
+    return router;
+}

package/server/connection/api/unauthorized-response.js

@@ -0,0 +1,73 @@
+function getUnauthorizedPageHtml() {
+  return `<!doctype html>
+<html lang="fr">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Acces expire</title>
+  <style>
+    :root {
+      color-scheme: dark;
+      --bg: #101417;
+      --panel: rgba(19, 27, 33, 0.92);
+      --fg: #f0f4f7;
+      --muted: rgba(240, 244, 247, 0.78);
+      --accent: #4bd4ff;
+      --danger: #ff8f8f;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      padding: 24px;
+      background: radial-gradient(circle at 20% 10%, #1f2e3a, var(--bg));
+      color: var(--fg);
+      font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+    }
+    main {
+      width: min(100%, 460px);
+      padding: 28px 24px;
+      border-radius: 18px;
+      border: 1px solid rgba(255, 255, 255, 0.14);
+      background: var(--panel);
+      box-shadow: 0 18px 48px rgba(0, 0, 0, 0.35);
+    }
+    .eyebrow {
+      margin: 0 0 12px;
+      color: var(--danger);
+      font-size: 0.82rem;
+      font-weight: 700;
+      letter-spacing: 0.08em;
+      text-transform: uppercase;
+    }
+    h1 {
+      margin: 0 0 10px;
+      font-size: clamp(1.6rem, 5vw, 2rem);
+      line-height: 1.1;
+    }
+    p {
+      margin: 0 0 12px;
+      color: var(--muted);
+      line-height: 1.5;
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>Connexion expiree</h1>
+    <p>Rescannez le code QR du serveur.</p>
+  </main>
+</body>
+</html>`;
+}
+
+export function sendUnauthorizedResponse(req, res) {
+  if (typeof req?.accepts === 'function' && req.accepts('html')) {
+    res.status(401).type('text/html').send(getUnauthorizedPageHtml());
+    return;
+  }
+
+  res.status(401).type('text/plain').send('Unauthorized');
+}

package/server/connection/socket/createConnectionRegistrar.js

@@ -0,0 +1,23 @@
+import {createLogger} from "../../application/logger.js";
+import {
+    PUBSUB_EVENT_SOCKET_CLIENT_DISCONNECTED,
+    PUBSUB_SERVICE_SOCKET
+} from "../../services/pubsub/serviceEventConstants.js";
+
+let log;
+function getModuleLog() {
+    log ??= createLogger('socket');
+    return log;
+}
+
+export function createConnectionRegistrar({events}) {
+    const log = getModuleLog();
+    return (socket) => {
+        socket.on('disconnect', () => {
+            log.info({socketId: socket.id}, 'Client déconnecté');
+            events.publishEvent(PUBSUB_SERVICE_SOCKET, PUBSUB_EVENT_SOCKET_CLIENT_DISCONNECTED, {
+                clientId: socket.id,
+            });
+        })
+    }
+}

package/server/connection/socket/createSocketSessionAuthMiddleware.js

@@ -0,0 +1,49 @@
+function isLocalAddress(value) {
+    const address = String(value || '').toLowerCase();
+    return (
+        address === '127.0.0.1'
+        || address === '::1'
+        || address === '::ffff:127.0.0.1'
+    );
+}
+
+function getForwardedFor(request) {
+    const raw = String(request?.headers?.['x-forwarded-for'] || '').split(',')[0].trim();
+    return raw || null;
+}
+
+export function createSocketSessionAuthMiddleware(services) {
+    function createUnauthorizedError() {
+        const error = new Error('unauthorized');
+        error.data = {
+            code: 'ENTRY_TOKEN_INVALID',
+            message: 'Rescannez le code QR du serveur.',
+        };
+        return error;
+    }
+
+    function authorizeSocket(socket, next) {
+        const forwarded = getForwardedFor(socket.request);
+        const remoteAddress = forwarded || socket.request?.socket?.remoteAddress;
+        if (isLocalAddress(remoteAddress)) {
+            next();
+            return;
+        }
+
+        const systemConfig = services.getSystemConfig();
+        const tokenManager = services.getTokenManager();
+        const cookieName = systemConfig.session.cookieName;
+
+        const token = socket.request?.signedCookies?.[cookieName];
+        if (!tokenManager?.isValid?.(token)) {
+            next(createUnauthorizedError());
+            return;
+        }
+
+        socket.sessionToken = token;
+        next();
+    }
+
+
+    return authorizeSocket;
+}

package/server/connection/socket/socket-action-responder.js

@@ -0,0 +1,12 @@
+import { REMOTE_EVENT_ADMIN_RESULT } from '../../../utils/remoteCommands.js';
+
+export function createSocketActionResponder({ socket, eventName = REMOTE_EVENT_ADMIN_RESULT }) {
+  return function respondAction(action, result = {}) {
+    socket.emit(eventName, {
+      action,
+      ok: Boolean(result.ok),
+      message: result.message,
+      openUrl: result.openUrl,
+    });
+  };
+}

package/server/connection/socket/socket.timestamp-middleware.js

@@ -0,0 +1,51 @@
+import {createLogger} from '../../application/logger.js';
+
+let log;
+function getModuleLog() {
+  log ??= createLogger('socket:timestamp');
+  return log;
+}
+
+export function socketTimestampGuardMiddleware({
+  maxEventAgeMs = 1200,
+  maxClockSkewMs = 5 * 60 * 1000,
+  socketId,
+} = {}) {
+  const log = getModuleLog();
+  let observedClockOffsetMs = null;
+
+  return function enforceSocketEventTimestamp(packet, next) {
+    const [, payload] = packet;
+    const ts = payload && typeof payload === 'object'
+      ? Number(payload.ts)
+      : NaN;
+
+    if (!Number.isFinite(ts)) {
+      log.warn({ socketId, event: packet[0] }, 'Message socket sans timestamp');
+      next(new Error('missing_timestamp'));
+      return;
+    }
+
+    const rawDeltaMs = Date.now() - ts;
+    if (observedClockOffsetMs == null && Math.abs(rawDeltaMs) <= maxClockSkewMs) {
+      observedClockOffsetMs = rawDeltaMs;
+      log.info({ socketId, event: packet[0], observedClockOffsetMs }, 'Calibration horloge socket');
+    }
+
+    const ageMs = rawDeltaMs - (observedClockOffsetMs || 0);
+    if (ageMs > maxEventAgeMs) {
+      log.warn({
+        socketId,
+        event: packet[0],
+        ageMs,
+        rawDeltaMs,
+        observedClockOffsetMs,
+        maxEventAgeMs,
+      }, 'Message socket expiré');
+      next(new Error('stale_event'));
+      return;
+    }
+
+    next();
+  };
+}

package/server/index.js

@@ -0,0 +1,12 @@
+import {createServicesRegistry} from './services/createServicesRegistry.js';
+import {
+    bootstrapLogger,
+} from './application/logger.js';
+import {createApplicationLifecycle} from './application/createApplicationLifecycle.js';
+
+export async function startServer() {
+    const services = await createServicesRegistry();
+    bootstrapLogger();
+    const lifecycle = createApplicationLifecycle(services);
+    return lifecycle.start();
+}

package/server/init/bootstrapApi.js

@@ -0,0 +1,87 @@
+import {createStaticShareRouter} from '../connection/api/client.router.js';
+import path from 'node:path';
+import {
+    clientDir,
+    projectRoot,
+    publicDir,
+    sharedUtilsDir
+} from '../utils/paths.js';
+import {
+    createSessionCreationMiddleware,
+    createSessionGuard,
+    createSessionRouter,
+} from '../connection/api/session.middleware.js';
+import {createQrPageHandler} from '../connection/api/qr-page.handler.js';
+import {createAdminUiRouter} from "./createAdminUiRouter.js";
+import {createAdminApiRouter} from "./createAdminApiRouter.js";
+import { createRemotesRouter } from '../connection/api/remotes.router.js';
+import {readPackageVersion} from '../utils/env.js';
+import {createLogger} from '../application/logger.js';
+
+const packageJsonPath = path.join(projectRoot, 'package.json');
+
+export function bootstrapApi(services) {
+    const {
+        getTokenManager,
+        getSystemConfig,
+        getServer,
+    } = services;
+
+    const {
+        app,
+        cookieParser
+    } = getServer();
+
+    const systemConfig = getSystemConfig();
+    const log = createLogger('createApp');
+
+    log.debug({
+        httpsEnabled: Boolean(systemConfig.https.enabled),
+        cookieName: systemConfig.session.cookieName,
+        entryPathEnabled: Boolean(systemConfig.entryPath.enabled),
+    }, 'Initialisation API Express');
+
+    if (!systemConfig.https.enabled) {
+        log.warn('HTTPS=false: cookie session envoyé sans attribut Secure (moins sécuritaire).');
+    }
+    app.set('trust proxy', 'loopback');
+    
+    app.use(cookieParser);
+
+    app.use(createSessionCreationMiddleware({
+        cookieName: systemConfig.session.cookieName,
+        cookieMaxAgeMs: Math.max(1, systemConfig.session.cookieMaxAgeDays) * 24 * 60 * 60 * 1000,
+        secureCookies: systemConfig.https.enabled,
+    }));
+
+    app.use('/api/sessions', createSessionRouter(services));
+
+
+    app.use(createSessionGuard(services));
+    
+    app.get('/', (req, res, next) => {
+        if (req.sessionToken) {
+            res.createSession(getTokenManager().getToken());
+        }
+        next();
+    });
+
+    app.use(createStaticShareRouter({
+        publicDir,
+        clientDir,
+        sharedUtilsDir
+    }));
+    
+    app.get('/qr', createQrPageHandler(services));
+    app.use('/api/remotes', createRemotesRouter(services));
+    app.use('/api/admin', createAdminApiRouter(services));
+    app.use('/ui/admin', createAdminUiRouter(services));
+    log.trace('Routes API enregistrees');
+
+    app.get('/health', (_req, res) => {
+        res.json({
+            ok: true,
+            version: readPackageVersion(packageJsonPath),
+        });
+    });
+}

package/server/init/bootstrapSocket.js

@@ -0,0 +1,79 @@
+import {createSocketSessionAuthMiddleware} from '../connection/socket/createSocketSessionAuthMiddleware.js';
+import {createSocketActionRegistrars} from './createSocketActionRegistrars.js';
+import {socketTimestampGuardMiddleware} from "../connection/socket/socket.timestamp-middleware.js";
+import { hasRecentRestart } from '../remotes/admin/notifyIfRestarted.js';
+import {
+    PUBSUB_EVENT_SOCKET_CLIENT_CONNECTED,
+    PUBSUB_SERVICE_SOCKET
+} from "../services/pubsub/serviceEventConstants.js";
+import { REMOTE_EVENT_SYSTEM_RELOAD } from '../../utils/remoteCommands.js';
+import {createLogger} from '../application/logger.js';
+
+function broadcast(...functions) {
+    return (...args) => functions.flatMap(f => f).map(f => f(...args));
+}
+
+function createNotificationHandler(services) {
+    const events = services.getEvents();
+    const log = createLogger('socket:timestamp');
+
+    return socket => {
+        log.info({socketId: socket.id}, 'Client connecté');
+        events.publishEvent(PUBSUB_SERVICE_SOCKET, PUBSUB_EVENT_SOCKET_CLIENT_CONNECTED, {
+            clientId: socket.id,
+        });
+        if (hasRecentRestart()) {
+            socket.emit(REMOTE_EVENT_SYSTEM_RELOAD, {
+                reason: 'service-restarted',
+            });
+        }
+    }
+}
+
+function createSocketGuardMiddleware(services) {
+    const {
+        getSystemConfig,
+    } = services;
+
+    const maxEventAgeMs = getSystemConfig().session.socketEventMaxAgeMs;
+
+    return (socket, next) => {
+        socket.use(socketTimestampGuardMiddleware({
+            maxEventAgeMs,
+            socketId: socket.id,
+        }));
+        
+        // ... other guards here
+        
+        next();
+    }
+}
+
+function createActionHandlers(services) {
+    const socketActionRegistrars = createSocketActionRegistrars(services);
+    return socket => {
+        for (let register of socketActionRegistrars) {
+            register(socket);
+        }
+    };
+}
+
+export function bootstrapSocket(services) {
+    const {getServer} = services;
+    const log = createLogger('socket:bootstrap');
+
+    const {io, cookieParser} = getServer();
+    log.debug('Initialisation Socket.IO');
+
+    io.engine.use((...args) => cookieParser(...args));
+    
+    io.use(createSocketSessionAuthMiddleware(services));
+    io.use(createSocketGuardMiddleware(services));
+    log.trace('Middlewares Socket.IO enregistres');
+
+    io.on('connection', broadcast(
+        createNotificationHandler(services),
+        createActionHandlers(services)
+    ));
+    log.debug('Handlers Socket.IO enregistres');
+}

package/server/init/createAdminApiRouter.js

@@ -0,0 +1,22 @@
+import express from "express";
+import {createServerInfoRouter} from "../connection/api/server-info.router.js";
+import {createAdminConfigsRouter} from "../connection/api/admin-configs.router.js";
+import {createAdminConfigActionsRouter} from "../connection/api/admin-actions.router.js";
+import {createAdminSubsRouter} from "../connection/api/admin-subs.router.js";
+import {createAdminRemotesRouter} from '../connection/api/admin-remotes.router.js';
+
+export function createAdminApiRouter(services) {
+    const router = express.Router();
+
+    router.use('/server-info', createServerInfoRouter(services));
+
+    router.use('/configs', createAdminConfigsRouter(services));
+    
+    router.use('/remotes', createAdminRemotesRouter(services));
+
+    router.use('/subs', createAdminSubsRouter(services));
+
+    router.use('/', createAdminConfigActionsRouter(services));
+
+    return router;
+}

package/server/init/createAdminUiRouter.js

@@ -0,0 +1,21 @@
+import express from "express";
+import path from "node:path";
+import {publicDir} from "../utils/paths.js";
+
+export function createAdminUiRouter(_services) {
+    const router = express.Router();
+
+    router.get('/config', (_req, res) => {
+        res.sendFile(path.join(publicDir, 'admin-config.html'));
+    });
+    
+    router.get('/server-info', (_req, res) => {
+        res.sendFile(path.join(publicDir, 'server-info.html'));
+    });
+
+    router.get('/preferences', (_req, res) => {
+        res.sendFile(path.join(publicDir, 'preferences.html'));
+    });
+
+    return router;
+}