@walkhi/code-relax 0.1.0-beta.65 → 0.1.0-beta.68

package/dist/src/self-relay/account-connections.mjs

@@ -1,52 +1,52 @@
-import { digest } from './wire.mjs';
-
-// Register before the asynchronous database check so logout also invalidates
-// handshakes whose successful authentication response has not arrived yet.
-export function accountConnections() {
-  const sessions = new Map();
-  return {
-    track(token, onInvalid) {
-      const key = digest(token);
-      const entries = sessions.get(key) || new Set();
-      sessions.set(key, entries);
-      let active = true, expires = Infinity, timer;
-      function dispose() {
-        active = false;
-        clearTimeout(timer);
-        entries.delete(entry);
-        if (!entries.size && sessions.get(key) === entries) sessions.delete(key);
-      }
-      function invalidate() {
-        if (!active) return;
-        dispose();
-        onInvalid();
-      }
-      function valid() {
-        if (active && Date.now() >= expires) invalidate();
-        return active;
-      }
-      function schedule() {
-        if (!valid()) return;
-        // Login lasts 30 days, longer than Node's maximum timer delay.
-        timer = setTimeout(schedule, Math.min(expires - Date.now(), 0x7fffffff));
-        timer.unref();
-      }
-      const entry = {
-        activate(expiresAt) {
-          if (!active) return false;
-          expires = Date.parse(expiresAt);
-          if (!Number.isFinite(expires)) { invalidate(); return false; }
-          schedule();
-          return active;
-        },
-        valid, dispose, invalidate,
-      };
-      entries.add(entry);
-      return entry;
-    },
-    revoke(token) {
-      const entries = sessions.get(digest(token));
-      if (entries) for (const entry of [...entries]) entry.invalidate();
-    },
-  };
-}
+import { digest } from './wire.mjs';
+
+// Register before the asynchronous database check so logout also invalidates
+// handshakes whose successful authentication response has not arrived yet.
+export function accountConnections() {
+  const sessions = new Map();
+  return {
+    track(token, onInvalid) {
+      const key = digest(token);
+      const entries = sessions.get(key) || new Set();
+      sessions.set(key, entries);
+      let active = true, expires = Infinity, timer;
+      function dispose() {
+        active = false;
+        clearTimeout(timer);
+        entries.delete(entry);
+        if (!entries.size && sessions.get(key) === entries) sessions.delete(key);
+      }
+      function invalidate() {
+        if (!active) return;
+        dispose();
+        onInvalid();
+      }
+      function valid() {
+        if (active && Date.now() >= expires) invalidate();
+        return active;
+      }
+      function schedule() {
+        if (!valid()) return;
+        // Login lasts 30 days, longer than Node's maximum timer delay.
+        timer = setTimeout(schedule, Math.min(expires - Date.now(), 0x7fffffff));
+        timer.unref();
+      }
+      const entry = {
+        activate(expiresAt) {
+          if (!active) return false;
+          expires = Date.parse(expiresAt);
+          if (!Number.isFinite(expires)) { invalidate(); return false; }
+          schedule();
+          return active;
+        },
+        valid, dispose, invalidate,
+      };
+      entries.add(entry);
+      return entry;
+    },
+    revoke(token) {
+      const entries = sessions.get(digest(token));
+      if (entries) for (const entry of [...entries]) entry.invalidate();
+    },
+  };
+}

package/dist/src/self-relay/admin-auth.mjs

@@ -1,59 +1,59 @@
-import fs from 'node:fs';
-import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
-import { promisify } from 'node:util';
-
-const derive = promisify(scrypt);
-const COOKIE = '__Host-code-relax-admin';
-const SESSION_MS = 12 * 60 * 60 * 1000;
-const cookie = (value, seconds) => `${COOKIE}=${value}; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=${seconds}`;
-
-export async function passwordRecord(password) {
-  if (typeof password !== 'string' || password.length < 10 || Buffer.byteLength(password) > 256) {
-    throw new Error('Admin password must have at least 10 characters and at most 256 bytes');
-  }
-  const salt = randomBytes(16).toString('hex');
-  return { salt, hash: (await derive(password, salt, 64)).toString('hex') };
-}
-
-export function createAdminAuth(passwordFile) {
-  const { salt, hash } = JSON.parse(fs.readFileSync(passwordFile, 'utf8'));
-  if (!/^[a-f0-9]{32}$/.test(salt) || !/^[a-f0-9]{128}$/.test(hash)) throw new Error('Invalid admin password record');
-  const expected = Buffer.from(hash, 'hex');
-  const sessions = new Map();
-  let windowStart = 0, attempts = 0, verifying = false;
-  const token = request => (request.headers.cookie || '').split(';').map(value => value.trim())
-    .find(value => value.startsWith(`${COOKIE}=`))?.slice(COOKIE.length + 1);
-  function purge() {
-    for (const [id, expires] of sessions) if (expires <= Date.now()) sessions.delete(id);
-  }
-  return {
-    authenticated(request) { purge(); return sessions.has(token(request)); },
-    async login(password, request, response) {
-      const now = Date.now();
-      if (now - windowStart >= 60000) { windowStart = now; attempts = 0; }
-      // This is a single-owner console: bound both guessing and concurrent scrypt memory.
-      if (attempts >= 10 || verifying) {
-        response.setHeader('Retry-After', '60');
-        return { status: 429, error: '尝试过于频繁，请一分钟后重试' };
-      }
-      attempts++;
-      if (typeof password !== 'string' || Buffer.byteLength(password) > 256) return { status: 400, error: '请输入有效密码' };
-      verifying = true;
-      try {
-        const actual = await derive(password, salt, 64);
-        if (!timingSafeEqual(actual, expected)) return { status: 401, error: '密码不正确' };
-        purge();
-        sessions.delete(token(request));
-        if (sessions.size >= 32) sessions.delete(sessions.keys().next().value);
-        const id = randomBytes(32).toString('base64url');
-        sessions.set(id, Date.now() + SESSION_MS);
-        response.setHeader('Set-Cookie', cookie(id, SESSION_MS / 1000));
-        return { status: 200 };
-      } finally { verifying = false; }
-    },
-    logout(request, response) {
-      sessions.delete(token(request));
-      response.setHeader('Set-Cookie', cookie('', 0));
-    },
-  };
-}
+import fs from 'node:fs';
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+
+const derive = promisify(scrypt);
+const COOKIE = '__Host-code-relax-admin';
+const SESSION_MS = 12 * 60 * 60 * 1000;
+const cookie = (value, seconds) => `${COOKIE}=${value}; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=${seconds}`;
+
+export async function passwordRecord(password) {
+  if (typeof password !== 'string' || password.length < 10 || Buffer.byteLength(password) > 256) {
+    throw new Error('Admin password must have at least 10 characters and at most 256 bytes');
+  }
+  const salt = randomBytes(16).toString('hex');
+  return { salt, hash: (await derive(password, salt, 64)).toString('hex') };
+}
+
+export function createAdminAuth(passwordFile) {
+  const { salt, hash } = JSON.parse(fs.readFileSync(passwordFile, 'utf8'));
+  if (!/^[a-f0-9]{32}$/.test(salt) || !/^[a-f0-9]{128}$/.test(hash)) throw new Error('Invalid admin password record');
+  const expected = Buffer.from(hash, 'hex');
+  const sessions = new Map();
+  let windowStart = 0, attempts = 0, verifying = false;
+  const token = request => (request.headers.cookie || '').split(';').map(value => value.trim())
+    .find(value => value.startsWith(`${COOKIE}=`))?.slice(COOKIE.length + 1);
+  function purge() {
+    for (const [id, expires] of sessions) if (expires <= Date.now()) sessions.delete(id);
+  }
+  return {
+    authenticated(request) { purge(); return sessions.has(token(request)); },
+    async login(password, request, response) {
+      const now = Date.now();
+      if (now - windowStart >= 60000) { windowStart = now; attempts = 0; }
+      // This is a single-owner console: bound both guessing and concurrent scrypt memory.
+      if (attempts >= 10 || verifying) {
+        response.setHeader('Retry-After', '60');
+        return { status: 429, error: '尝试过于频繁，请一分钟后重试' };
+      }
+      attempts++;
+      if (typeof password !== 'string' || Buffer.byteLength(password) > 256) return { status: 400, error: '请输入有效密码' };
+      verifying = true;
+      try {
+        const actual = await derive(password, salt, 64);
+        if (!timingSafeEqual(actual, expected)) return { status: 401, error: '密码不正确' };
+        purge();
+        sessions.delete(token(request));
+        if (sessions.size >= 32) sessions.delete(sessions.keys().next().value);
+        const id = randomBytes(32).toString('base64url');
+        sessions.set(id, Date.now() + SESSION_MS);
+        response.setHeader('Set-Cookie', cookie(id, SESSION_MS / 1000));
+        return { status: 200 };
+      } finally { verifying = false; }
+    },
+    logout(request, response) {
+      sessions.delete(token(request));
+      response.setHeader('Set-Cookie', cookie('', 0));
+    },
+  };
+}

package/dist/src/self-relay/admin-cloud.mjs

@@ -1,101 +1,101 @@
-import fs from 'node:fs';
-import tencentcloud from 'tencentcloud-sdk-nodejs-common';
-
-const INSTANCE_ID = 'lhins-byrs7n8o';
-const REGION = 'ap-beijing';
-const { CommonClient } = tencentcloud;
-const METRICS = [
-  ['LighthouseOutratio', 'outRatioPercent', 10],
-  ['LighthouseOuttraffic', 'outMbps', 10],
-  ['LighthouseIntraffic', 'inMbps', 10],
-  ['CpuUsage', 'cpuPercent', 10],
-  ['MemUsage', 'memoryPercent', 10],
-  ['DiskUsage', 'diskPercent', 60],
-  ['CpuLoad1', 'cpuLoad1', 10],
-];
-
-function latestPoint(result) {
-  const point = result?.DataPoints?.[0];
-  if (!point?.Values?.length || !point?.Timestamps?.length) return null;
-  const index = point.Values.length - 1;
-  const value = Number(point.Values[index]);
-  const timestamp = Number(point.Timestamps[index]);
-  return Number.isFinite(value) && Number.isFinite(timestamp)
-    ? { value, sampledAt: new Date(timestamp * 1000).toISOString() } : null;
-}
-
-export function startAdminCloud({ credentialFile = process.env.CREDENTIALS_DIRECTORY
-  ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : null,
-  metricIntervalMs = 60000, trafficIntervalMs = 300000 } = {}) {
-  if (!credentialFile) return { read: () => ({ configured: false }), close() {} };
-  const { secretId, secretKey } = JSON.parse(fs.readFileSync(credentialFile, 'utf8'));
-  if (!secretId || !secretKey) throw new Error('Tencent monitor credentials are incomplete');
-  const credential = { secretId, secretKey };
-  const profile = { httpProfile: { reqTimeout: 8 } };
-  const monitor = new CommonClient('monitor.tencentcloudapi.com', '2018-07-24',
-    { credential, region: REGION, profile });
-  const lighthouse = new CommonClient('lighthouse.tencentcloudapi.com', '2020-03-24',
-    { credential, region: REGION, profile });
-  let closed = false;
-  let metricBusy = false;
-  let trafficBusy = false;
-  const current = { configured: true, metricAvailable: false, trafficAvailable: false,
-    outRatioPercent: null, outMbps: null, inMbps: null, metricSampledAt: null,
-    cpuPercent: null, memoryPercent: null, diskPercent: null, cpuLoad1: null,
-    trafficUsedBytes: null, trafficTotalBytes: null, trafficRemainingBytes: null,
-    trafficStartAt: null, trafficEndAt: null, trafficSampledAt: null };
-
-  async function sampleMetrics() {
-    if (metricBusy || closed) return;
-    metricBusy = true;
-    const end = new Date();
-    const base = { Namespace: 'QCE/LIGHTHOUSE',
-      StartTime: new Date(end.getTime() - 180000).toISOString(), EndTime: end.toISOString(),
-      Instances: [{ Dimensions: [{ Name: 'InstanceId', Value: INSTANCE_ID }] }] };
-    try {
-      const values = await Promise.allSettled(METRICS.map(([MetricName, , Period]) =>
-        monitor.request('GetMonitorData', { ...base, MetricName, Period })));
-      if (closed) return;
-      const samples = values.map(result => result.status === 'fulfilled' ? latestPoint(result.value) : null);
-      for (let index = 0; index < METRICS.length; index++) {
-        const [, field] = METRICS[index];
-        const value = samples[index]?.value ?? null;
-        current[field] = value !== null && (field === 'outMbps' || field === 'inMbps') ? value * 8 : value;
-      }
-      current.metricSampledAt = samples.reduce((latest, sample) => sample?.sampledAt > latest
-        ? sample.sampledAt : latest, '') || null;
-      current.metricAvailable = Boolean(current.metricSampledAt);
-    } catch {
-      current.metricAvailable = false;
-    } finally { metricBusy = false; }
-  }
-
-  async function sampleTraffic() {
-    if (trafficBusy || closed) return;
-    trafficBusy = true;
-    try {
-      const data = await lighthouse.request('DescribeInstancesTrafficPackages', { InstanceIds: [INSTANCE_ID] });
-      if (closed) return;
-      const packages = data?.InstanceTrafficPackageSet?.find(item => item.InstanceId === INSTANCE_ID)?.TrafficPackageSet || [];
-      const active = packages.find(item => Date.parse(item.StartTime) <= Date.now()
-        && Date.parse(item.EndTime) >= Date.now()) || packages[0];
-      current.trafficUsedBytes = active?.TrafficUsed ?? null;
-      current.trafficTotalBytes = active?.TrafficPackageTotal ?? null;
-      current.trafficRemainingBytes = active?.TrafficPackageRemaining ?? null;
-      current.trafficStartAt = active?.StartTime ?? null;
-      current.trafficEndAt = active?.EndTime ?? null;
-      current.trafficSampledAt = active ? new Date().toISOString() : null;
-      current.trafficAvailable = Boolean(active);
-    } catch {
-      current.trafficAvailable = false;
-    } finally { trafficBusy = false; }
-  }
-
-  void sampleMetrics();
-  void sampleTraffic();
-  const metricTimer = setInterval(sampleMetrics, metricIntervalMs);
-  const trafficTimer = setInterval(sampleTraffic, trafficIntervalMs);
-  metricTimer.unref();
-  trafficTimer.unref();
-  return { read: () => ({ ...current }), close() { closed = true; clearInterval(metricTimer); clearInterval(trafficTimer); } };
-}
+import fs from 'node:fs';
+import tencentcloud from 'tencentcloud-sdk-nodejs-common';
+
+const INSTANCE_ID = 'lhins-byrs7n8o';
+const REGION = 'ap-beijing';
+const { CommonClient } = tencentcloud;
+const METRICS = [
+  ['LighthouseOutratio', 'outRatioPercent', 10],
+  ['LighthouseOuttraffic', 'outMbps', 10],
+  ['LighthouseIntraffic', 'inMbps', 10],
+  ['CpuUsage', 'cpuPercent', 10],
+  ['MemUsage', 'memoryPercent', 10],
+  ['DiskUsage', 'diskPercent', 60],
+  ['CpuLoad1', 'cpuLoad1', 10],
+];
+
+function latestPoint(result) {
+  const point = result?.DataPoints?.[0];
+  if (!point?.Values?.length || !point?.Timestamps?.length) return null;
+  const index = point.Values.length - 1;
+  const value = Number(point.Values[index]);
+  const timestamp = Number(point.Timestamps[index]);
+  return Number.isFinite(value) && Number.isFinite(timestamp)
+    ? { value, sampledAt: new Date(timestamp * 1000).toISOString() } : null;
+}
+
+export function startAdminCloud({ credentialFile = process.env.CREDENTIALS_DIRECTORY
+  ? `${process.env.CREDENTIALS_DIRECTORY}/tencent-monitor.json` : null,
+  metricIntervalMs = 60000, trafficIntervalMs = 300000 } = {}) {
+  if (!credentialFile) return { read: () => ({ configured: false }), close() {} };
+  const { secretId, secretKey } = JSON.parse(fs.readFileSync(credentialFile, 'utf8'));
+  if (!secretId || !secretKey) throw new Error('Tencent monitor credentials are incomplete');
+  const credential = { secretId, secretKey };
+  const profile = { httpProfile: { reqTimeout: 8 } };
+  const monitor = new CommonClient('monitor.tencentcloudapi.com', '2018-07-24',
+    { credential, region: REGION, profile });
+  const lighthouse = new CommonClient('lighthouse.tencentcloudapi.com', '2020-03-24',
+    { credential, region: REGION, profile });
+  let closed = false;
+  let metricBusy = false;
+  let trafficBusy = false;
+  const current = { configured: true, metricAvailable: false, trafficAvailable: false,
+    outRatioPercent: null, outMbps: null, inMbps: null, metricSampledAt: null,
+    cpuPercent: null, memoryPercent: null, diskPercent: null, cpuLoad1: null,
+    trafficUsedBytes: null, trafficTotalBytes: null, trafficRemainingBytes: null,
+    trafficStartAt: null, trafficEndAt: null, trafficSampledAt: null };
+
+  async function sampleMetrics() {
+    if (metricBusy || closed) return;
+    metricBusy = true;
+    const end = new Date();
+    const base = { Namespace: 'QCE/LIGHTHOUSE',
+      StartTime: new Date(end.getTime() - 180000).toISOString(), EndTime: end.toISOString(),
+      Instances: [{ Dimensions: [{ Name: 'InstanceId', Value: INSTANCE_ID }] }] };
+    try {
+      const values = await Promise.allSettled(METRICS.map(([MetricName, , Period]) =>
+        monitor.request('GetMonitorData', { ...base, MetricName, Period })));
+      if (closed) return;
+      const samples = values.map(result => result.status === 'fulfilled' ? latestPoint(result.value) : null);
+      for (let index = 0; index < METRICS.length; index++) {
+        const [, field] = METRICS[index];
+        const value = samples[index]?.value ?? null;
+        current[field] = value !== null && (field === 'outMbps' || field === 'inMbps') ? value * 8 : value;
+      }
+      current.metricSampledAt = samples.reduce((latest, sample) => sample?.sampledAt > latest
+        ? sample.sampledAt : latest, '') || null;
+      current.metricAvailable = Boolean(current.metricSampledAt);
+    } catch {
+      current.metricAvailable = false;
+    } finally { metricBusy = false; }
+  }
+
+  async function sampleTraffic() {
+    if (trafficBusy || closed) return;
+    trafficBusy = true;
+    try {
+      const data = await lighthouse.request('DescribeInstancesTrafficPackages', { InstanceIds: [INSTANCE_ID] });
+      if (closed) return;
+      const packages = data?.InstanceTrafficPackageSet?.find(item => item.InstanceId === INSTANCE_ID)?.TrafficPackageSet || [];
+      const active = packages.find(item => Date.parse(item.StartTime) <= Date.now()
+        && Date.parse(item.EndTime) >= Date.now()) || packages[0];
+      current.trafficUsedBytes = active?.TrafficUsed ?? null;
+      current.trafficTotalBytes = active?.TrafficPackageTotal ?? null;
+      current.trafficRemainingBytes = active?.TrafficPackageRemaining ?? null;
+      current.trafficStartAt = active?.StartTime ?? null;
+      current.trafficEndAt = active?.EndTime ?? null;
+      current.trafficSampledAt = active ? new Date().toISOString() : null;
+      current.trafficAvailable = Boolean(active);
+    } catch {
+      current.trafficAvailable = false;
+    } finally { trafficBusy = false; }
+  }
+
+  void sampleMetrics();
+  void sampleTraffic();
+  const metricTimer = setInterval(sampleMetrics, metricIntervalMs);
+  const trafficTimer = setInterval(sampleTraffic, trafficIntervalMs);
+  metricTimer.unref();
+  trafficTimer.unref();
+  return { read: () => ({ ...current }), close() { closed = true; clearInterval(metricTimer); clearInterval(trafficTimer); } };
+}

package/dist/src/self-relay/admin-login-page.mjs

@@ -1,7 +1,7 @@
-import { adminUiTokens, adminFooterStyles, adminAuthStyles } from './admin-style.mjs';
-
-export function adminLoginPage() {
-  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>登录 · Code Relax 管理</title><style>${adminUiTokens}${adminFooterStyles}${adminAuthStyles}</style></head>
-<body class="admin-login"><main><form id="login" class="login-card"><h1>Code Relax 管理</h1><p>输入管理密码，进入后台。</p><label for="password">管理密码</label><input id="password" name="password" type="password" autocomplete="current-password" required maxlength="256" autofocus><button id="submit" type="submit">登录</button><p id="result" role="alert" aria-live="polite"></p></form></main><footer class="admin-footer">京ICP备2026027643号-2</footer>
-<script>const form=document.getElementById('login'),button=document.getElementById('submit'),result=document.getElementById('result');form.addEventListener('submit',async event=>{event.preventDefault();if(button.disabled)return;button.disabled=true;result.textContent='正在登录…';try{const response=await fetch('/admin/login',{method:'POST',headers:{'Content-Type':'application/json','X-Code-Relax-Admin':'1'},body:JSON.stringify({password:form.password.value})});const body=await response.json();if(!response.ok)throw new Error(body.error||'登录失败');form.reset();location.replace('/')}catch(error){result.textContent=error.message}finally{button.disabled=false}});</script></body></html>`;
-}
+import { adminUiTokens, adminFooterStyles, adminAuthStyles } from './admin-style.mjs';
+
+export function adminLoginPage() {
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>登录 · Code Relax 管理</title><style>${adminUiTokens}${adminFooterStyles}${adminAuthStyles}</style></head>
+<body class="admin-login"><main><form id="login" class="login-card"><h1>Code Relax 管理</h1><p>输入管理密码，进入后台。</p><label for="password">管理密码</label><input id="password" name="password" type="password" autocomplete="current-password" required maxlength="256" autofocus><button id="submit" type="submit">登录</button><p id="result" role="alert" aria-live="polite"></p></form></main><footer class="admin-footer">京ICP备2026027643号-2</footer>
+<script>const form=document.getElementById('login'),button=document.getElementById('submit'),result=document.getElementById('result');form.addEventListener('submit',async event=>{event.preventDefault();if(button.disabled)return;button.disabled=true;result.textContent='正在登录…';try{const response=await fetch('/admin/login',{method:'POST',headers:{'Content-Type':'application/json','X-Code-Relax-Admin':'1'},body:JSON.stringify({password:form.password.value})});const body=await response.json();if(!response.ok)throw new Error(body.error||'登录失败');form.reset();location.replace('/')}catch(error){result.textContent=error.message}finally{button.disabled=false}});</script></body></html>`;
+}