@walkhi/code-relax 0.1.0-beta.1 → 0.1.0-beta.10

package/dist/src/self-relay/server.mjs

@@ -1,17 +1,20 @@
 import http from 'node:http';
 import { deviceStore, validId } from './device-store.mjs';
-import { randomUUID } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
 import { WebSocketServer } from 'ws';
 import { secret, digest, matches, validSecret, send, decode } from './wire.mjs';
 import { readDebugAllowlist, debugAllowed } from './debug-allowlist.mjs';
 import { validProbeSignal } from './p2p-probe.mjs';
-
+import { relayAdminState } from './admin-state.mjs';
+import { adminPage } from './admin-page.mjs';
+
 // Always loopback; a TLS reverse proxy supplies the private-trial Internet endpoint.
 export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlMs = 120000,
   maxConnections = 32, maxClientsPerHost = 16, maxPayload = 8 * 1024 * 1024, stateFile,
-  publicRelayUrl = '', appDownloadUrl = '', debugAllowlistFile, log = () => {} } = {}) {
+  maxRelaySessions = 8, adminStateFile, publicRelayUrl = '', appDownloadUrl = '', debugAllowlistFile, log = () => {} } = {}) {
   if (!validSecret(hostKey)) throw new Error('Invalid host credential');
   if (!Number.isSafeInteger(maxClientsPerHost) || maxClientsPerHost < 1 || maxClientsPerHost > 64) throw new Error('Invalid mobile device limit');
+  if (!Number.isSafeInteger(maxRelaySessions) || maxRelaySessions < 1 || maxRelaySessions > 256) throw new Error('Invalid relay session limit');
   if (publicRelayUrl) relayPublicAddress(publicRelayUrl);
   // Harmony's native WebSocket supplies the endpoint Origin automatically.
   // libwebsockets can use http even for WSS; trust only the configured endpoint.
@@ -20,6 +23,8 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   const hostHash = digest(hostKey), rooms = new Map();
   const store = deviceStore(stateFile);
   const debugAllowlist = readDebugAllowlist(debugAllowlistFile);
+  const adminState = relayAdminState(adminStateFile, maxRelaySessions);
+  let activeRelaySessions = 0;
   for (const record of store.entries()) rooms.set(record.id, { ...record, durable: true, connections: new Map(), observers: new Map() });
   function commit(room, changes) {
     const next = { ...room, ...changes, updatedAt: new Date().toISOString() };
@@ -46,6 +51,13 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   }
   const server = http.createServer((request, response) => {
     const target = new URL(request.url || '/', `http://${request.headers.host || 'localhost'}`);
+    if (target.pathname === '/admin' || target.pathname.startsWith('/admin/')) {
+      void handleAdmin(request, response, target); return;
+    }
+    if (request.method === 'GET' && target.pathname === '/announcement') {
+      const body = JSON.stringify({ announcement: adminState.read().announcement });
+      response.writeHead(200, pairingHeaders('application/json; charset=utf-8', body)); response.end(body); return;
+    }
     if (request.method !== 'GET' || !['/pair', '/pair/resolve'].includes(target.pathname)) {
       response.writeHead(404, { 'Cache-Control': 'no-store' }); response.end(); return;
     }
@@ -57,7 +69,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       response.writeHead(410, pairingHeaders(json ? 'application/json; charset=utf-8' : 'text/html; charset=utf-8', body)); response.end(body); return;
     }
     if (target.pathname === '/pair/resolve' || /application\/json/i.test(request.headers.accept || '')) {
-      const body = JSON.stringify({ version: 3, relayUrl: relayUrl(request), room: room.id, expires: room.expires });
+      const body = JSON.stringify({ version: 6, relayUrl: relayUrl(request), room: room.id, expires: room.expires });
       response.writeHead(200, pairingHeaders('application/json; charset=utf-8', body)); response.end(body); return;
     }
     const secure = request.socket.encrypted || request.headers['x-forwarded-proto'] === 'https';
@@ -65,6 +77,84 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
     const body = pairingPage({ deepLink: `codex-remote://pair?url=${encodeURIComponent(current.href)}`, expires: room.expires, appDownloadUrl });
     response.writeHead(200, pairingHeaders('text/html; charset=utf-8', body)); response.end(body);
   });
+  function adminReply(response, status, body, type = 'application/json; charset=utf-8') {
+    const value = typeof body === 'string' ? body : JSON.stringify(body);
+    response.writeHead(status, { 'Content-Type': type, 'Content-Length': Buffer.byteLength(value), 'Cache-Control': 'no-store',
+      'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'self'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'" });
+    response.end(value);
+  }
+  async function handleAdmin(request, response, target) {
+    if (request.method === 'GET' && target.pathname === '/admin') {
+      adminReply(response, 200, adminPage(), 'text/html; charset=utf-8'); return;
+    }
+    if (request.method === 'GET' && target.pathname === '/admin/api/status') {
+      const state = adminState.read();
+      adminReply(response, 200, { maxRelaySessions: state.maxRelaySessions, activeRelaySessions,
+        activeExemptRelaySessions: [...rooms.values()].reduce((sum, room) => sum + [...room.connections.values()].filter(connection => connection.relayExempt).length, 0),
+        websocketConnections: wss.clients.size, onlineComputers: [...rooms.values()].filter(room => room.host).length,
+        activePhones: [...rooms.values()].reduce((sum, room) => sum + room.connections.size, 0),
+        processRssBytes: process.memoryUsage().rss, processUptimeSeconds: process.uptime(),
+        announcement: state.announcement, announcements: state.announcements }); return;
+    }
+    if (!['PUT', 'DELETE'].includes(request.method || '') || request.headers['content-type'] !== 'application/json' ||
+        request.headers['x-code-relax-admin'] !== '1') { adminReply(response, 405, { error: 'Unsupported admin request' }); return; }
+    try {
+      const body = request.method === 'DELETE' ? {} : JSON.parse(await readBody(request, 4096));
+      if (target.pathname === '/admin/api/settings' && request.method === 'PUT') {
+        const state = adminState.setMaxRelaySessions(body.maxRelaySessions);
+        log({ event: 'admin-relay-limit-updated', maxRelaySessions: state.maxRelaySessions });
+      } else if (target.pathname === '/admin/api/announcements' && request.method === 'PUT') {
+        const state = adminState.createAnnouncement(body.title, body.message, body.publish === true);
+        if (body.publish === true) {
+          broadcastAnnouncement(state.announcement);
+          log({ event: 'admin-announcement-published', announcementId: state.announcement.id });
+        } else log({ event: 'admin-announcement-draft-created', announcementId: state.announcements[0].id });
+      } else if (target.pathname.startsWith('/admin/api/announcements/')) {
+        const parts = target.pathname.slice('/admin/api/announcements/'.length).split('/');
+        const id = parts[0];
+        if (!/^[\w-]{16,128}$/.test(id)) { adminReply(response, 404, { error: 'Admin route not found' }); return; }
+        if (parts.length === 1 && request.method === 'PUT') {
+          adminState.updateDraft(id, body.title, body.message);
+          log({ event: 'admin-announcement-draft-updated', announcementId: id });
+        } else if (parts.length === 1 && request.method === 'DELETE') {
+          adminState.deleteAnnouncement(id);
+          log({ event: 'admin-announcement-deleted', announcementId: id });
+        } else if (parts.length === 2 && parts[1] === 'publish' && request.method === 'PUT') {
+          const state = adminState.publishDraft(id, body.title, body.message);
+          broadcastAnnouncement(state.announcement);
+          log({ event: 'admin-announcement-published', announcementId: id });
+        } else if (parts.length === 2 && parts[1] === 'withdraw' && request.method === 'PUT') {
+          const state = adminState.withdraw(id);
+          broadcastAnnouncement(state.announcement);
+          log({ event: 'admin-announcement-withdrawn', announcementId: id });
+        } else { adminReply(response, 404, { error: 'Admin route not found' }); return; }
+      } else { adminReply(response, 404, { error: 'Admin route not found' }); return; }
+      adminReply(response, 200, { ok: true });
+    } catch (error) { adminReply(response, 400, { error: error.message }); }
+  }
+  function broadcastAnnouncement(announcement) {
+    for (const room of rooms.values()) {
+      for (const observer of room.observers.values()) send(observer.ws, { type: 'announcement', announcement });
+      for (const connection of room.connections.values()) send(connection.ws, { type: 'announcement', announcement });
+    }
+  }
+  function releaseRelay(connection) {
+    if (!connection?.relayAdmitted) return;
+    connection.relayAdmitted = false; activeRelaySessions = Math.max(0, activeRelaySessions - 1);
+  }
+  function admitRelay(connection, room) {
+    if (connection.relayAdmitted || connection.relayExempt) return true;
+    if (connection.capacityExempt) {
+      connection.relayExempt = true;
+      log({ event: 'relay-capacity-exempt', device: room.id }); return true;
+    }
+    const limit = adminState.read().maxRelaySessions;
+    if (activeRelaySessions >= limit) {
+      log({ event: 'relay-capacity-rejected', device: room.id, activeRelaySessions, maxRelaySessions: limit }); return false;
+    }
+    connection.relayAdmitted = true; activeRelaySessions++;
+    log({ event: 'relay-capacity-admitted', device: room.id, activeRelaySessions, maxRelaySessions: limit }); return true;
+  }
   const wss = new WebSocketServer({ noServer: true, maxPayload, perMessageDeflate: {
     serverNoContextTakeover: true, clientNoContextTakeover: true,
     threshold: 1024, concurrencyLimit: 4, zlibDeflateOptions: { level: 3 },
@@ -81,12 +171,24 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
     }
     wss.handleUpgrade(request, socket, head, ws => wss.emit('connection', ws));
   });
-  wss.on('connection', ws => {
+  wss.on('connection', ws => {
     let role, room, session, clientId, alive = true;
     const authTimer = setTimeout(() => ws.close(1008, 'Authentication timeout'), 5000);
     ws.on('pong', () => { alive = true; });
     const heartbeat = setInterval(() => { if (!alive) ws.terminate(); else { alive = false; ws.ping(); } }, 30000);
-    const fail = (code = 4401, reason = 'Device authorization rejected') => ws.close(code, reason);
+    const fail = (code = 4401, reason = 'Device authorization rejected') => ws.close(code, reason);
+    const queueClientMessage = (connection, message, pause = 0) => {
+      const bytes = Buffer.byteLength(JSON.stringify(message));
+      connection.queuedBytes = (connection.queuedBytes || 0) + bytes;
+      if (connection.queuedBytes > 40 * 1024 * 1024) {
+        connection.ws.close(1013, 'Receiver too slow'); return;
+      }
+      connection.outbound = (connection.outbound || Promise.resolve()).then(async () => {
+        if (pause > 0) await new Promise(resolve => setTimeout(resolve, pause));
+        connection.queuedBytes -= bytes;
+        send(connection.ws, message);
+      }).catch(() => connection.ws.close(1011, 'Relay delivery failed'));
+    };
     ws.on('error', () => {}); // close owns routing cleanup.
     ws.on('close', (code, reason) => {
       log({ event: 'closed', role: role || 'unauthenticated', device: room?.id, code, reason: reason.toString() });
@@ -97,6 +199,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
         if (!room.durable) rooms.delete(room.id);
         for (const connection of room.connections.values()) connection.ws.close(4410, 'Computer offline; authorization retained');
       } else if (role === 'client' && room?.connections.get(clientId)?.ws === ws) {
+        releaseRelay(room.connections.get(clientId));
         room.connections.delete(clientId);
         if (room.host) send(room.host, { type: 'detach', session });
       } else if (role === 'observer' && room?.observers.get(clientId)?.ws === ws) {
@@ -117,11 +220,13 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
               hostName = normalizeHostName(message.hostName);
             }
             catch { return fail(1008, 'Invalid LAN candidates'); }
-            room = durable ? rooms.get(message.deviceId) : undefined;
-            if (room && (room.status !== 'active' || !matches(message.deviceSecret, room.hostHash))) return fail();
-            if (!room) {
-              if (!matches(message.key, hostHash)) return fail();
-              if (rooms.size >= 256) return fail(4429, 'Device limit reached');
+            room = durable ? rooms.get(message.deviceId) : undefined;
+            if (room && (room.status !== 'active' || !matches(message.deviceSecret, room.hostHash))) return fail();
+            if (!room) {
+              // Durable computers prove future ownership with their generated device secret.
+              // The legacy deployment key remains accepted, but is no longer required for first registration.
+              if (!durable && !matches(message.key, hostHash)) return fail();
+              if (rooms.size >= 256) return fail(4429, 'Device limit reached');
               const now = new Date().toISOString();
               room = { id: durable ? message.deviceId : randomUUID(), durable,
                 revision: 0, status: 'active', clients: [], connections: new Map(), observers: new Map(), createdAt: now, updatedAt: now,
@@ -143,7 +248,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
               send(observer.ws, { type: 'lan-candidates', candidates: room.lanCandidates });
             }
             const invite = room.clients.length ? {} : invitation(room);
-            send(ws, { type: 'registered', protocolVersion: 3, room: room.id, paired: room.clients.length > 0,
+            send(ws, { type: 'registered', protocolVersion: 7, room: room.id, paired: room.clients.length > 0,
               clientCount: room.clients.length, clients: room.clients, revision: room.revision, ...invite }); return;
           }
           room = rooms.get(message.room);
@@ -177,6 +282,8 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             room.observers.set(clientId, { ws });
             send(ws, { type: 'observing', online: Boolean(room.host) });
             send(ws, { type: 'debug-permissions', enabled: debugAllowed(debugAllowlist, room.id, room.clients.find(client => client.id === clientId)) });
+            const announcement = adminState.read().announcement;
+            if (announcement) send(ws, { type: 'announcement', announcement });
             if (room.hostName) send(ws, { type: 'computer-info', hostName: room.hostName });
             if (room.lanCandidates?.length) send(ws, { type: 'lan-candidates', candidates: room.lanCandidates });
             if (room.officialComputer) send(ws, { type: 'official-computer', computer: room.officialComputer });
@@ -186,14 +293,19 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           const oldConnection = room.connections.get(clientId);
           role = 'client'; clearTimeout(authTimer); session = randomUUID();
           if (oldConnection?.ws && oldConnection.ws !== ws) {
+            releaseRelay(oldConnection);
             send(room.host, { type: 'detach', session: oldConnection.session });
             oldConnection.ws.close(4409, 'Phone connection replaced by same identity');
           }
           room.connections.set(clientId, { ws, session, p2pProbe: room.p2pProbe && message.p2pProbe === 1,
-            repeat: room.p2pProbeRepeat, signals: 0, probeStarted: 0 });
-          send(ws, { type: 'paired', protocolVersion: 3, room: room.id, clientId, revision: room.revision, ...(credential ? { credential } : {}) });
+            repeat: room.p2pProbeRepeat, signals: 0, probeStarted: 0, outbound: Promise.resolve(), queuedBytes: 0,
+            relayAdmitted: false, relayExempt: false,
+            capacityExempt: debugAllowed(debugAllowlist, room.id, room.clients.find(client => client.id === clientId)) });
+          send(ws, { type: 'paired', protocolVersion: 7, room: room.id, clientId, revision: room.revision, ...(credential ? { credential } : {}) });
           send(ws, { type: 'computer-info', hostName: room.hostName });
           if (room.lanCandidates?.length) send(ws, { type: 'lan-candidates', candidates: room.lanCandidates });
+          const announcement = adminState.read().announcement;
+          if (announcement) send(ws, { type: 'announcement', announcement });
           send(room.host, { type: 'attach', session, clientId, p2pProbe: room.connections.get(clientId).p2pProbe ? 1 : 0 }); return;
         }
         if (role === 'host') {
@@ -214,6 +326,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             commit(room, { clients: [], revision: room.revision + 1 });
             room.pairingHash = undefined;
             for (const connection of room.connections.values()) {
+              releaseRelay(connection);
               send(ws, { type: 'detach', session: connection.session });
               connection.ws.close(4401, 'Device authorization revoked');
             }
@@ -225,8 +338,8 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           }
           const connection = [...room.connections.values()].find(item => item.session === message.session);
           if (!connection) return; // Late frames from an ended session.
-          if (message.type === 'data' && typeof message.payload === 'string') send(connection.ws, { type: 'data', payload: message.payload });
-          else if (message.type === 'ready') send(connection.ws, { type: 'ready', p2pProbe: connection.p2pProbe ? 1 : 0,
+          if (message.type === 'data' && typeof message.payload === 'string') queueClientMessage(connection, { type: 'data', payload: message.payload });
+          else if (message.type === 'ready') queueClientMessage(connection, { type: 'ready', p2pProbe: connection.p2pProbe ? 1 : 0,
             p2pProbeRepeat: connection.p2pProbe && connection.repeat });
           else if (message.type === 'p2p-probe' && connection.p2pProbe && validProbeSignal(message)) {
             if (connection.probeId !== message.probeId) return;
@@ -251,7 +364,13 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           if (connection.probeId !== message.probeId) return;
           if (++connection.signals > 150) return fail(1008, 'Probe signal limit');
           send(room.host, { ...message, session });
+        } else if (room.connections.get(clientId)?.ws === ws && message.type === 'p2p-route' && message.direct === 1) {
+          releaseRelay(room.connections.get(clientId));
         } else if (room.connections.get(clientId)?.ws === ws && message.type === 'data' && typeof message.payload === 'string') {
+          const connection = room.connections.get(clientId);
+          if (!controlPayload(message.payload) && !admitRelay(connection, room)) {
+            ws.close(4428, 'Server busy'); return;
+          }
           send(room.host, { type: 'data', session, payload: message.payload });
         } else fail();
       } catch (error) { log({ event: 'request-error', role, message: 'Relay operation failed' }); ws.close(1011, 'Relay operation failed'); }
@@ -261,7 +380,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   listenUrl = `ws://127.0.0.1:${server.address().port}/relay`;
   return {
     url: listenUrl, hostKey,
-    async close() {
+    async close() {
       for (const ws of wss.clients) ws.terminate();
       await new Promise(resolve => wss.close(resolve));
       await new Promise(resolve => server.close(resolve));
@@ -338,3 +457,24 @@ function plainLabel(value) {
 function plainText(value, limit, empty) {
   return typeof value === 'string' && (empty || value.trim().length > 0) && value.trim().length <= limit && !/[\u0000-\u001f\u007f]/.test(value);
 }
+
+function controlPayload(value) {
+  try {
+    const message = JSON.parse(value);
+    if (message.type === 'unsubscribe') return true;
+    return ['request', 'subscribe'].includes(message.type) && typeof message.path === 'string' &&
+      (message.path === '/api/health' || message.path.startsWith('/api/shared-recovery'));
+  } catch { return false; }
+}
+
+function readBody(request, limit) {
+  return new Promise((resolve, reject) => {
+    let value = '';
+    request.setEncoding('utf8');
+    request.on('data', chunk => {
+      value += chunk;
+      if (Buffer.byteLength(value) > limit) { reject(new Error('Admin request too large')); request.destroy(); }
+    });
+    request.on('end', () => resolve(value)); request.on('error', reject);
+  });
+}