@walkhi/code-relax 0.1.0-beta.11 → 0.1.0-beta.12

package/dist/src/self-relay/server.mjs

@@ -1,4 +1,5 @@
-import http from 'node:http';
+import http from 'node:http';
+import { isIP } from 'node:net';
 import { deviceStore, validId } from './device-store.mjs';
 import { randomUUID } from 'node:crypto';
 import { WebSocketServer } from 'ws';
@@ -6,12 +7,14 @@ import { secret, digest, matches, validSecret, send, decode } from './wire.mjs';
 import { readDebugAllowlist, debugAllowed } from './debug-allowlist.mjs';
 import { validProbeSignal } from './p2p-probe.mjs';
 import { relayAdminState } from './admin-state.mjs';
+import { openRelayMysql } from './mysql-state.mjs';
 import { adminPage } from './admin-page.mjs';
+import { openEmailAccounts } from './email-accounts.mjs';
 
 // Always loopback; a TLS reverse proxy supplies the private-trial Internet endpoint.
 export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlMs = 120000,
   maxConnections = 32, maxClientsPerHost = 16, maxPayload = 8 * 1024 * 1024, stateFile,
-  maxRelaySessions = 8, adminStateFile, publicRelayUrl = '', appDownloadUrl = '', debugAllowlistFile, log = () => {} } = {}) {
+  maxRelaySessions = 8, adminStateFile, mysqlConfigFile, accountConfigFile, publicRelayUrl = '', appDownloadUrl = '', debugAllowlistFile, log = () => {} } = {}) {
   if (!validSecret(hostKey)) throw new Error('Invalid host credential');
   if (!Number.isSafeInteger(maxClientsPerHost) || maxClientsPerHost < 1 || maxClientsPerHost > 64) throw new Error('Invalid mobile device limit');
   if (!Number.isSafeInteger(maxRelaySessions) || maxRelaySessions < 1 || maxRelaySessions > 256) throw new Error('Invalid relay session limit');
@@ -21,24 +24,34 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   const nativeOrigins = publicRelayUrl ? ['http:', 'https:'].map(protocol => `${protocol}//${new URL(publicRelayUrl).host}`) : [];
   if (appDownloadUrl && !/^https:\/\/[^\s]+$/.test(appDownloadUrl)) throw new Error('Invalid app download URL');
   const hostHash = digest(hostKey), rooms = new Map();
-  const store = deviceStore(stateFile);
+  const database = mysqlConfigFile ? await openRelayMysql(mysqlConfigFile, maxRelaySessions) : null;
+  if (accountConfigFile && !database?.schemaVersions.includes('002_email_accounts')) throw new Error('Email account schema is required');
+  const accounts = accountConfigFile ? openEmailAccounts(database.pool, accountConfigFile) : null;
+  const store = database?.devices || deviceStore(stateFile);
   const debugAllowlist = readDebugAllowlist(debugAllowlistFile);
-  const adminState = relayAdminState(adminStateFile, maxRelaySessions);
+  const adminState = database?.admin || relayAdminState(adminStateFile, maxRelaySessions);
   let activeRelaySessions = 0;
   for (const record of store.entries()) rooms.set(record.id, { ...record, durable: true, connections: new Map(), observers: new Map(), uploadClients: new Map() });
+  let commitTail = Promise.resolve();
   function commit(room, changes) {
+    const operation = commitTail.then(async () => {
+    changes = typeof changes === 'function' ? changes(room) : changes;
     const next = { ...room, ...changes, updatedAt: new Date().toISOString() };
     if (room.durable) {
       const { id, hostHash, clients, revision, status, createdAt, updatedAt, officialComputer } = next;
-      store.save({ id, hostHash, clients, revision, status, createdAt, updatedAt, ...(officialComputer ? { officialComputer } : {}) });
+      await store.save({ id, hostHash, clients, revision, status, createdAt, updatedAt, ...(officialComputer ? { officialComputer } : {}) });
     }
-    Object.assign(room, changes, { updatedAt: next.updatedAt });
+    Object.assign(room, changes, { updatedAt: next.updatedAt });
+    });
+    commitTail = operation.catch(() => {});
+    return operation;
   }
   function invitation(room) {
     const code = secret(); room.pairingHash = digest(code); room.expires = Date.now() + pairingTtlMs;
     return { code, expires: room.expires };
   }
   let listenUrl = '';
+  let adminTail = Promise.resolve();
   function relayUrl(request) {
     if (publicRelayUrl) return relayPublicAddress(publicRelayUrl);
     const host = request.headers.host || new URL(listenUrl).host;
@@ -52,7 +65,14 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
   const server = http.createServer((request, response) => {
     const target = new URL(request.url || '/', `http://${request.headers.host || 'localhost'}`);
     if (target.pathname === '/admin' || target.pathname.startsWith('/admin/')) {
-      void handleAdmin(request, response, target); return;
+      adminTail = adminTail.then(() => handleAdmin(request, response, target)).catch(() => {
+        if (!response.headersSent) adminReply(response, 500, { error: 'Admin operation failed' });
+      });
+      return;
+    }
+    if (accounts && target.pathname.startsWith('/account/')) {
+      void handleAccount(request, response, target).catch(() => accountReply(response, 500, { error: 'Account operation failed' }));
+      return;
     }
     if (request.method === 'GET' && target.pathname === '/announcement') {
       const body = JSON.stringify({ announcement: adminState.read().announcement });
@@ -83,6 +103,41 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
       'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'self'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'" });
     response.end(value);
   }
+  function accountReply(response, status, body) {
+    if (response.headersSent || response.destroyed) return;
+    const value = JSON.stringify(body);
+    response.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(value),
+      'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' });
+    response.end(value);
+  }
+  async function handleAccount(request, response, target) {
+    try {
+      if (target.pathname === '/account/config' && request.method === 'GET') {
+        accountReply(response, 200, { captchaAppId: accounts.captchaAppId }); return;
+      }
+      const bearer = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(request.headers.authorization || '')?.[1];
+      if (target.pathname === '/account/me' && request.method === 'GET') {
+        accountReply(response, 200, { user: await accounts.current(bearer) }); return;
+      }
+      if (target.pathname === '/account/logout' && request.method === 'POST') {
+        accountReply(response, 200, await accounts.logout(bearer)); return;
+      }
+      if (request.method !== 'POST' || request.headers['content-type'] !== 'application/json') {
+        accountReply(response, 404, { error: 'Account route not found' }); return;
+      }
+      const body = JSON.parse(await readBody(request, 4096));
+      if (!body || typeof body !== 'object' || Array.isArray(body)) { accountReply(response, 400, { error: 'Invalid request body' }); return; }
+      if (target.pathname === '/account/email/request') {
+        const ip = request.headers['x-real-ip'] || request.socket.remoteAddress || '';
+        if (typeof ip !== 'string' || !isIP(ip)) { accountReply(response, 400, { error: 'Invalid client address' }); return; }
+        accountReply(response, 202, await accounts.requestCode(body, ip));
+      } else if (target.pathname === '/account/email/verify') {
+        accountReply(response, 200, await accounts.verifyCode(body));
+      } else accountReply(response, 404, { error: 'Account route not found' });
+    } catch (failure) {
+      accountReply(response, failure.status || 503, { error: failure.status ? failure.message : 'Account service unavailable' });
+    }
+  }
   async function handleAdmin(request, response, target) {
     if (request.method === 'GET' && target.pathname === '/admin') {
       adminReply(response, 200, adminPage(), 'text/html; charset=utf-8'); return;
@@ -101,10 +156,10 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
     try {
       const body = request.method === 'DELETE' ? {} : JSON.parse(await readBody(request, 4096));
       if (target.pathname === '/admin/api/settings' && request.method === 'PUT') {
-        const state = adminState.setMaxRelaySessions(body.maxRelaySessions);
+        const state = await adminState.setMaxRelaySessions(body.maxRelaySessions);
         log({ event: 'admin-relay-limit-updated', maxRelaySessions: state.maxRelaySessions });
       } else if (target.pathname === '/admin/api/announcements' && request.method === 'PUT') {
-        const state = adminState.createAnnouncement(body.title, body.message, body.publish === true);
+        const state = await adminState.createAnnouncement(body.title, body.message, body.publish === true);
         if (body.publish === true) {
           broadcastAnnouncement(state.announcement);
           log({ event: 'admin-announcement-published', announcementId: state.announcement.id });
@@ -114,17 +169,17 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
         const id = parts[0];
         if (!/^[\w-]{16,128}$/.test(id)) { adminReply(response, 404, { error: 'Admin route not found' }); return; }
         if (parts.length === 1 && request.method === 'PUT') {
-          adminState.updateDraft(id, body.title, body.message);
+          await adminState.updateDraft(id, body.title, body.message);
           log({ event: 'admin-announcement-draft-updated', announcementId: id });
         } else if (parts.length === 1 && request.method === 'DELETE') {
-          adminState.deleteAnnouncement(id);
+          await adminState.deleteAnnouncement(id);
           log({ event: 'admin-announcement-deleted', announcementId: id });
         } else if (parts.length === 2 && parts[1] === 'publish' && request.method === 'PUT') {
-          const state = adminState.publishDraft(id, body.title, body.message);
+          const state = await adminState.publishDraft(id, body.title, body.message);
           broadcastAnnouncement(state.announcement);
           log({ event: 'admin-announcement-published', announcementId: id });
         } else if (parts.length === 2 && parts[1] === 'withdraw' && request.method === 'PUT') {
-          const state = adminState.withdraw(id);
+          const state = await adminState.withdraw(id);
           broadcastAnnouncement(state.announcement);
           log({ event: 'admin-announcement-withdrawn', announcementId: id });
         } else { adminReply(response, 404, { error: 'Admin route not found' }); return; }
@@ -214,8 +269,10 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
         if (room.uploadHost) send(room.uploadHost, { type: 'file-close', session });
       }
     });
-    ws.on('message', (bytes, binary) => {
-      try {
+    let messageTail = Promise.resolve();
+    ws.on('message', (bytes, binary) => {
+      messageTail = messageTail.then(async () => {
+      try {
         const message = decode(bytes, binary);
         if (!role) {
           if (message.type === 'file-host') {
@@ -262,7 +319,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
               room = { id: durable ? message.deviceId : randomUUID(), durable,
                 revision: 0, status: 'active', clients: [], connections: new Map(), observers: new Map(), uploadClients: new Map(), createdAt: now, updatedAt: now,
                 ...(durable ? { hostHash: digest(message.deviceSecret) } : {}) };
-              commit(room, {}); rooms.set(room.id, room);
+              await commit(room, {}); rooms.set(room.id, room);
             }
             const oldHost = room.host;
             room.observers ||= new Map();
@@ -286,7 +343,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           room = rooms.get(message.room);
           if (!room || room.status !== 'active') return fail();
           let credential;
-          if (message.type === 'pair' && room.pairingHash && Date.now() < room.expires && matches(message.code, room.pairingHash)) {
+          if (message.type === 'pair' && !room.pairingInProgress && room.pairingHash && Date.now() < room.expires && matches(message.code, room.pairingHash)) {
             if (!room.host) return fail(4410, 'Computer offline; authorization retained');
             credential = message.credential || secret();
             clientId = message.clientId || (!room.durable ? randomUUID() : undefined);
@@ -295,8 +352,11 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             if (!existing && room.clients.length >= maxClientsPerHost) return fail(4429, 'Mobile device limit reached');
             const now = new Date().toISOString();
             const client = { id: clientId, hash: digest(credential), createdAt: existing?.createdAt || now, updatedAt: now };
-            commit(room, { clients: [...room.clients.filter(item => item.id !== clientId), client], revision: room.revision + 1 });
-            room.pairingHash = undefined;
+            room.pairingInProgress = true;
+            try {
+              await commit(room, current => ({ clients: [...current.clients.filter(item => item.id !== clientId), client], revision: current.revision + 1 }));
+              room.pairingHash = undefined;
+            } finally { room.pairingInProgress = false; }
             send(room.host, { type: 'authorization-changed', clients: room.clients, revision: room.revision });
           } else {
             clientId = message.clientId;
@@ -355,7 +415,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
             send(ws, { type: 'pair-code', commandId: message.commandId, room: room.id, ...invitation(room) }); return;
           }
           if (message.type === 'revoke') {
-            commit(room, { clients: [], revision: room.revision + 1 });
+            await commit(room, current => ({ clients: [], revision: current.revision + 1 }));
             room.pairingHash = undefined;
             for (const connection of room.connections.values()) {
               releaseRelay(connection);
@@ -398,7 +458,7 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           send(room.uploadHost, { type: 'file-frame', session, payload: message.payload });
         } else if (role === 'observer' && room.observers.get(clientId)?.ws === ws && message.type === 'official-computer') {
           const computer = normalizeOfficialComputer(message);
-          commit(room, { officialComputer: computer });
+          await commit(room, { officialComputer: computer });
           send(ws, { type: 'official-computer-saved', computer });
         } else if (role === 'client' && room.connections.get(clientId)?.ws === ws && message.type === 'p2p-probe') {
           const connection = room.connections.get(clientId);
@@ -428,17 +488,19 @@ export async function startSelfRelay({ port = 0, hostKey = secret(), pairingTtlM
           }
           send(room.host, { type: 'data', session, payload: message.payload });
         } else fail();
-      } catch (error) { log({ event: 'request-error', role, message: 'Relay operation failed' }); ws.close(1011, 'Relay operation failed'); }
-    });
+      } catch (error) { log({ event: 'request-error', role, message: 'Relay operation failed' }); ws.close(1011, 'Relay operation failed'); }
+      }).catch(() => ws.close(1011, 'Relay operation failed'));
+    });
   });
   await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });
   listenUrl = `ws://127.0.0.1:${server.address().port}/relay`;
   return {
     url: listenUrl, hostKey,
     async close() {
-      for (const ws of wss.clients) ws.terminate();
-      await new Promise(resolve => wss.close(resolve));
-      await new Promise(resolve => server.close(resolve));
+      for (const ws of wss.clients) ws.terminate();
+      await new Promise(resolve => wss.close(resolve));
+      await new Promise(resolve => server.close(resolve));
+      if (database) await database.close();
     },
   };
 }