@volter/twin-world 0.1.0 → 0.1.2

package/src/redirect-proxy.ts

@@ -18,43 +18,55 @@
 // but cannot mint X.509 certs without a third-party lib). This keeps world-runtime dependency-light.
 import { spawnSync } from 'node:child_process';
 import { Socket, connect as netConnect, createServer as createNetServer } from 'node:net';
-import { createServer as createHttpsServer } from 'node:https';
-import type { Server as HttpsServer } from 'node:https';
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { request as httpRequest } from 'node:http';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { createRequire } from 'node:module';
-
-/** The slice of `@volter/twin/inject` we reuse for the host→twin table (so we never re-encode the
- * vendor host predicates here — they stay one source of truth with the Node injector). */
-type InjectModule = {
-  readMap(env: Record<string, string | undefined>): Record<string, string>;
-  resolveTwin(host: string, map: Record<string, string>): { vendor: string; origin: string } | null;
-  VENDOR_HOSTS: Record<string, (host: string) => boolean>;
-  restore(): void;
-};
-
-let injectCache: InjectModule | null = null;
-
-/** Lazily load the injector's host→twin table. Loading the CJS auto-installs its http/fetch patches
- * as a side effect; we immediately `restore()` so requiring it here is inert (we only want the data
- * + pure functions, not to patch THIS process). Not exported: no importer outside this file uses it
- * directly (external callers go through `proxyTargetFor`/`activeVendorMap`). */
-function loadInject(): InjectModule {
-  if (injectCache) return injectCache;
-  const require = createRequire(import.meta.url);
-  const mod = require('@volter/twin/inject') as InjectModule;
-  try { mod.restore(); } catch { /* nothing was installed */ }
-  injectCache = mod;
-  return mod;
+// The host→twin table is loaded through the shared inject-map module (one world-runtime home
+// for the injector's data), so this proxy, `covers`, and `up`'s inert-injectEnv warning can
+// never re-encode the vendor host predicates — they stay one source of truth with the Node
+// injector. External callers go through `proxyTargetFor`/`activeVendorMap`.
+import { loadInject } from './inject-map.ts';
+
+/**
+ * The body served when a host was MITM'd but no twin serves the PATH.
+ *
+ * Two deliberate choices, both §9 round 2 findings:
+ *  • The request path is JSON-escaped and the response is sent as `text/plain`. `req.url` may
+ *    legally carry `<` and `>`, and an untyped body is MIME-sniffable — so on a machine that has
+ *    trusted the session CA, a crafted URL could otherwise execute in the vendor's origin. The
+ *    sibling raw-socket error path already set `text/plain`; this matches it.
+ *  • It names the SITUATION, not just the miss (the Cal.com finding): this handler only runs after
+ *    the host was MITM'd, i.e. the host IS twinned in this world — so the bare "no twin for host"
+ *    sent readers hunting for a `*_TWIN_URL` that was already set. On a shared host the path may
+ *    belong to a vendor whose twin merely is not configured (youtube vs googleauth), OR to no pack
+ *    at all (Google Calendar on www.googleapis.com has no twin yet) — the message states both,
+ *    because this refusal is exactly what replaced the silent mis-route that answered Calendar
+ *    calls with plausible Google-shaped 404s from the gemini pack.
+ */
+export function noTwinMessage(host: string, path: string): string {
+  return `host ${host} is twinned in this world, but path ${JSON.stringify(path)} belongs to no twin configured here.\n`
+    + 'This host is shared between vendors, and no pack in this world serves this path. Either the\n'
+    + 'vendor that owns this path has a twin that is not configured — set its *_TWIN_URL (for\n'
+    + 'www.googleapis.com: YOUTUBE_TWIN_URL serves /youtube/v3/*, GOOGLEAUTH_TWIN_URL serves the\n'
+    + 'OAuth2 token paths) — or this API has no twin pack yet (e.g. Google Calendar /calendar/v3/*),\n'
+    + 'in which case this loud refusal is the honest outcome: the request is neither answered by the\n'
+    + 'wrong twin nor leaked to the real vendor.\n';
 }
 
 /** Resolve which twin origin (if any) a vendor host maps to, given the world env (which carries the
- * `*_TWIN_URL` vars). Returns null for hosts the world doesn't twin — those are tunneled untouched. */
-export function proxyTargetFor(hostname: string, env: Record<string, string | undefined>): { vendor: string; origin: string } | null {
+ * `*_TWIN_URL` vars). Returns null for hosts the world doesn't twin — those are tunneled untouched.
+ *
+ * `pathname` is optional and matters only for hosts TWO vendors share (see `VENDOR_HOSTS` in
+ * inject.cjs — `www.googleapis.com` is served by both `googleauth` and `youtube`, split by path).
+ * At CONNECT time there is no path yet, so it is omitted and the answer is host-level candidacy:
+ * "MITM this host". Once TLS is terminated and the real request line is readable, the caller
+ * re-resolves WITH the path so each request reaches the twin that actually serves it. */
+export function proxyTargetFor(
+  hostname: string,
+  env: Record<string, string | undefined>,
+  pathname?: string,
+): { vendor: string; origin: string } | null {
   const inject = loadInject();
-  return inject.resolveTwin(hostname, inject.readMap(env));
+  return inject.resolveTwin(hostname, inject.readMap(env), pathname);
 }
 
 /** The vendor→twin map this world actively redirects (for diagnostics / activate output). */
@@ -128,6 +140,11 @@ export function ensureCa(tlsDir: string): CaPaths {
     'req', '-x509', '-new', '-nodes', '-key', paths.caKey,
     '-sha256', '-days', '3650', '-out', paths.caCert,
     '-subj', '/CN=volter-world session CA/O=volter-world',
+    // A CA cert without keyUsage is refused by OpenSSL 3 (Python, curl on Debian 13: "CA cert does not
+    // include key usage extension"), so the CA states what a CA is for.
+    '-addext', 'basicConstraints=critical,CA:TRUE',
+    '-addext', 'keyUsage=critical,keyCertSign,cRLSign',
+    '-addext', 'subjectKeyIdentifier=hash',
   ]);
   return paths;
 }
@@ -194,36 +211,6 @@ type RedirectProxyHandle = {
   close(): Promise<void>;
 };
 
-/** Forward a single decrypted (or plain-HTTP) request to the resolved twin origin and pipe the
- * response back. The twin speaks plain HTTP locally, so we strip TLS here and re-issue http. */
-function forwardToTwin(origin: string, clientReq: IncomingMessage, clientRes: ServerResponse): void {
-  let target: URL;
-  try {
-    target = new URL(origin);
-  } catch {
-    clientRes.writeHead(502); clientRes.end('bad twin origin'); return;
-  }
-  const headers = { ...clientReq.headers };
-  delete headers['proxy-connection'];
-  delete headers['accept-encoding'];
-  const upstream = httpRequest(
-    {
-      protocol: 'http:',
-      hostname: target.hostname,
-      port: target.port || 80,
-      method: clientReq.method,
-      path: clientReq.url,
-      headers,
-    },
-    (upRes) => {
-      clientRes.writeHead(upRes.statusCode ?? 502, upRes.headers);
-      upRes.pipe(clientRes);
-    },
-  );
-  upstream.on('error', (err) => { clientRes.writeHead(502); clientRes.end(`twin unreachable: ${err.message}`); });
-  clientReq.pipe(upstream);
-}
-
 /** Start the ambient redirect proxy. Returns a handle with the listen port + the env to export.
  * - Plain `http://` proxied requests to a vendor host → forwarded to the twin.
  * - `CONNECT host:443` to a vendor host → MITM-terminated with a session-signed leaf, decrypted, and
@@ -236,31 +223,63 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
   // or real upstream would otherwise keep the server from closing).
   const openSockets = new Set<Socket>();
 
-  // The MITM TLS endpoint(s): a REAL listening https server PER vendor host (loopback, ephemeral
-  // port), each pinned to that host's leaf cert as its default cert. On CONNECT to a vendor host we
-  // tunnel the client's raw bytes to the matching per-host server, which terminates TLS and forwards
-  // the decrypted request to the resolved twin. (A single SNICallback server is the textbook design,
-  // but Node-compatible SNICallback isn't honored on Bun — so we bind one server per host instead,
-  // which works on both runtimes. Hosts are few and known from the world's vendor map.)
-  const tlsServers = new Map<string, HttpsServer>();
+  // The MITM TLS endpoint(s): a REAL listening TLS server PER vendor host (loopback, ephemeral port), each pinned
+  // to that host's leaf cert. On CONNECT to a vendor host we tunnel the client's raw bytes to the matching per-host
+  // server, which terminates TLS and forwards the decrypted request to the resolved twin. (One server per host
+  // rather than SNI: hosts are few and known from the world's vendor map.)
+  // Bun-native (Bun.serve with tls): Bun's node:http never emits `upgrade`, and a websocket on a twinned host —
+  // discord.py's gateway at wss://gateway.discord.gg/ — must reach the twin. HTTP is forwarded with fetch; a
+  // websocket is relayed message by message to the twin's own websocket at the same path.
+  type Relay = { target: string; up?: WebSocket; ready: boolean; queue: Array<string | ArrayBuffer | Uint8Array> };
+  const tlsServers = new Map<string, ReturnType<typeof Bun.serve>>();
   const tlsPorts = new Map<string, number>();
   const ensureHostServer = async (vendorHost: string): Promise<number> => {
     const existing = tlsPorts.get(vendorHost);
     if (existing) return existing;
     const leaf = leafCertFor(vendorHost, ca);
-    const hostServer = createHttpsServer(
-      { key: leaf.key, cert: leaf.cert },
-      (req: IncomingMessage, res: ServerResponse) => {
-        const hostHeader = (req.headers.host ?? vendorHost).split(':')[0] ?? vendorHost;
+    const hostServer = Bun.serve<Relay>({
+      hostname: '127.0.0.1',
+      port: 0,
+      tls: { key: leaf.key, cert: leaf.cert },
+      async fetch(req, server) {
+        const u = new URL(req.url);
+        const hostHeader = (req.headers.get('host') ?? vendorHost).split(':')[0] ?? vendorHost;
         const env = currentEnv();
-        const twin = proxyTargetFor(hostHeader, env) ?? proxyTargetFor(vendorHost, env);
-        if (!twin) { res.writeHead(502); res.end('no twin for host'); return; }
-        forwardToTwin(twin.origin, req, res);
+        // The request line is readable now, so resolve WITH the path: this is the point where a host two vendors
+        // share (www.googleapis.com → googleauth vs youtube) gets split correctly; on a shared host there IS a twin
+        // for the host and merely not for this path, and the bare message sends the next reader hunting.
+        const twin = proxyTargetFor(hostHeader, env, u.pathname) ?? proxyTargetFor(vendorHost, env, u.pathname);
+        if (!twin) return new Response(noTwinMessage(hostHeader, u.pathname), { status: 502, headers: { 'content-type': 'text/plain; charset=utf-8' } });
+        const origin = new URL(twin.origin);
+        if (req.headers.get('upgrade')?.toLowerCase() === 'websocket') {
+          const target = `${origin.protocol === 'https:' ? 'wss' : 'ws'}://${origin.host}${u.pathname}${u.search}`;
+          return server.upgrade(req, { data: { target, ready: false, queue: [] } }) ? undefined : new Response('websocket upgrade failed', { status: 500 });
+        }
+        const headers = new Headers(req.headers);
+        for (const h of ['proxy-connection', 'accept-encoding', 'host', 'connection']) headers.delete(h);
+        try {
+          const upRes = await fetch(new URL(u.pathname + u.search, origin), { method: req.method, headers, body: req.method === 'GET' || req.method === 'HEAD' ? undefined : req.body, redirect: 'manual' });
+          const out = new Headers(upRes.headers);
+          for (const h of ['content-encoding', 'content-length', 'transfer-encoding']) out.delete(h);
+          return new Response(upRes.body, { status: upRes.status, headers: out });
+        } catch (err) {
+          return new Response(`twin unreachable: ${(err as Error).message}`, { status: 502 });
+        }
+      },
+      websocket: {
+        open(ws) {
+          const up = new WebSocket(ws.data.target);
+          ws.data.up = up;
+          up.onopen = () => { ws.data.ready = true; for (const m of ws.data.queue) up.send(m); ws.data.queue = []; };
+          up.onmessage = (e) => { try { ws.send(e.data as string | ArrayBuffer | Uint8Array); } catch { /* the client went away */ } };
+          up.onclose = (e) => { try { ws.close(e.code, e.reason); } catch { /* already closed */ } };
+          up.onerror = () => { try { ws.close(1011, 'twin websocket error'); } catch { /* already closed */ } };
+        },
+        message(ws, m) { if (ws.data.ready && ws.data.up) ws.data.up.send(m); else ws.data.queue.push(m); },
+        close(ws, code, reason) { try { ws.data.up?.close(code, reason); } catch { /* already closed */ } },
       },
-    );
-    await new Promise<void>((r, reject) => { hostServer.once('error', reject); hostServer.listen(0, '127.0.0.1', () => r()); });
-    const a = hostServer.address();
-    const p = typeof a === 'object' && a ? a.port : 0;
+    });
+    const p = hostServer.port ?? 0;
     tlsServers.set(vendorHost, hostServer);
     tlsPorts.set(vendorHost, p);
     return p;
@@ -341,13 +360,20 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
   ): void => {
     try {
       const u = new URL(urlStr);
-      const twin = proxyTargetFor(u.hostname, currentEnv());
+      const twin = proxyTargetFor(u.hostname, currentEnv(), u.pathname);
       const path = u.pathname + u.search;
       if (twin) {
         const target = new URL(twin.origin);
         forwardRawHttp(target, method, path, version, headers, socket, head);
         return;
       }
+      // No twin claims this PATH — but if the HOST is twinned (host-level candidacy), the path is
+      // an unclaimed slice of a shared, virtualized host: refuse loudly (same rule as the MITM
+      // handler's noTwinMessage), never pass through to the real vendor.
+      if (proxyTargetFor(u.hostname, currentEnv())) {
+        writeResponse(socket, 'HTTP/1.1 502 Bad Gateway', noTwinMessage(u.hostname, u.pathname));
+        return;
+      }
       if (shouldBlockUntwinned(u.hostname, currentEnv())) {
         writeResponse(socket, 'HTTP/1.1 502 Bad Gateway', `blocked untwinned external request to ${u.hostname}\n`);
         return;
@@ -360,7 +386,8 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
   };
 
   const handleConnect = (urlStr: string, clientSocket: Socket, head: Buffer): void => {
-    const [connectHost, connectPortRaw] = urlStr.split(':');
+    const [connectHostRaw, connectPortRaw] = urlStr.split(':');
+    const connectHost = connectHostRaw?.toLowerCase(); // hostnames are case-insensitive; the host rules are lowercase
     const connectPort = Number(connectPortRaw || 443);
     const twin = connectHost ? proxyTargetFor(connectHost, currentEnv()) : null;
     const tunnel = (destPort: number, destHost: string): void => {
@@ -408,10 +435,7 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
         // tunnel to a slow/real upstream.
         for (const s of openSockets) { try { s.destroy(); } catch { /* ignore */ } }
         openSockets.clear();
-        for (const hostServer of tlsServers.values()) {
-          try { (hostServer as unknown as { closeAllConnections?: () => void }).closeAllConnections?.(); } catch { /* ignore */ }
-          try { hostServer.close(); } catch { /* ignore */ }
-        }
+        for (const hostServer of tlsServers.values()) { try { hostServer.stop(true); } catch { /* ignore */ } }
         server.close(() => resolveClose());
       }),
   };