@wenbin_wb/dsh-bridge 2.4.0 → 2.5.0

package/lib/index.js

@@ -22,6 +22,8 @@ import { WechatService } from './wechat/index.js';
 import { QqService } from './qq/index.js';
 import { FeishuService } from './feishu/index.js';
 import { TelegramService } from './telegram/index.js';
+import { AuthManager } from './auth/manager.js';
+import { renderLoginPage } from './auth/login-template.js';
 
 const name = 'dsh-bridge';
 // 微信 Bot 会话桥依赖 DSH 提供的会话/agent/审批/工作区/持久化服务，需显式 inject
@@ -127,14 +129,15 @@ function loopbackHeaders(headers, targetPort) {
 }
 
 /**
- * HTTP + WebSocket 代理服务器
+ * HTTP + WebSocket 代理服务器（带安全认证守门）
  * 关键：改写 Host + Origin，注入 crypto.randomUUID polyfill
- * 否则手机通过局域网访问时 DSH 会把它当未登录的外部请求处理
+ * 并在未授权时拦截并展示 DSH 风格登录页，阻止未授权 WebSocket 与 API 调用
  */
 class ProxyServer {
-  constructor({ localPort, targetPort, logger }) {
+  constructor({ localPort, targetPort, authManager, logger }) {
     this.localPort = localPort;
     this.targetPort = targetPort;
+    this.authManager = authManager;
     this.logger = logger;
     this.server = null;
     this.clientSockets = new Set();
@@ -145,6 +148,101 @@ class ProxyServer {
     if (this.server) return;
 
     this.server = createServer((req, res) => {
+      // 1. 处理登录 API: POST /__dsh_bridge__/login
+      if (req.url === '/__dsh_bridge__/login' && req.method === 'POST') {
+        const chunks = [];
+        req.on('data', (c) => chunks.push(c));
+        req.on('end', () => {
+          try {
+            const body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+            const clientIp = req.socket?.remoteAddress || '';
+            const verify = this.authManager?.verifyPassword(body.password, clientIp);
+            if (verify?.success) {
+              const sessionToken = this.authManager.createSession();
+              res.writeHead(200, {
+                'Content-Type': 'application/json; charset=utf-8',
+                'Set-Cookie': `dsh_bridge_auth=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`,
+              });
+              res.end(JSON.stringify({ ok: true }));
+            } else {
+              res.writeHead(401, { 'Content-Type': 'application/json; charset=utf-8' });
+              res.end(JSON.stringify({ ok: false, error: verify?.error || '访问密码错误' }));
+            }
+          } catch (e) {
+            res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8' });
+            res.end(JSON.stringify({ ok: false, error: '无效请求' }));
+          }
+        });
+        return;
+      }
+
+      // 2. 处理登出 API: POST /__dsh_bridge__/logout
+      if (req.url === '/__dsh_bridge__/logout' && req.method === 'POST') {
+        res.writeHead(200, {
+          'Content-Type': 'application/json; charset=utf-8',
+          'Set-Cookie': 'dsh_bridge_auth=; Path=/; HttpOnly; Max-Age=0',
+        });
+        res.end(JSON.stringify({ ok: true }));
+        return;
+      }
+
+      // 3. 处理鉴权状态 API: GET /__dsh_bridge__/auth-status
+      if (req.url === '/__dsh_bridge__/auth-status' && req.method === 'GET') {
+        res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+        res.end(JSON.stringify(this.authManager?.getStatus() ?? { enabled: false }));
+        return;
+      }
+
+      // 4. 核心鉴权拦截
+      const auth = this.authManager?.verifyRequest(req) ?? { authenticated: true };
+
+      // 4.1 若从 URL Token 认证通过：下发 Cookie 并 302 重定向到干净 URL (去掉 ?auth=)
+      if (auth.fromToken) {
+        const sessionToken = this.authManager.createSession();
+        try {
+          const urlObj = new URL(req.url, 'http://localhost');
+          urlObj.searchParams.delete('auth');
+          urlObj.searchParams.delete('token');
+          const cleanPath = (urlObj.pathname || '/') + (urlObj.search || '');
+          res.writeHead(302, {
+            'Location': cleanPath,
+            'Set-Cookie': `dsh_bridge_auth=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`,
+          });
+          res.end();
+          return;
+        } catch {
+          res.writeHead(302, {
+            'Location': '/',
+            'Set-Cookie': `dsh_bridge_auth=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`,
+          });
+          res.end();
+          return;
+        }
+      }
+
+      // 4.2 若未通过认证：根据请求类型渲染 DSH 登录页或返回 401 JSON
+      if (!auth.authenticated) {
+        const accept = String(req.headers['accept'] || '');
+        const isHtml = accept.includes('text/html') || (!req.url.startsWith('/api/') && !req.url.includes('.'));
+        if (isHtml) {
+          const clientIp = req.socket?.remoteAddress || '';
+          const isLocked = this.authManager?.isIpBlocked(clientIp);
+          const html = renderLoginPage({
+            hasPassword: this.authManager?.hasPassword,
+            locked: isLocked,
+            error: isLocked ? '尝试次数过多，请 60 秒后再试' : '',
+          });
+          res.writeHead(401, { 'Content-Type': 'text/html; charset=utf-8' });
+          res.end(html);
+          return;
+        } else {
+          res.writeHead(401, { 'Content-Type': 'application/json; charset=utf-8' });
+          res.end(JSON.stringify({ error: 'unauthorized', message: '需要访问认证，请先登录' }));
+          return;
+        }
+      }
+
+      // 5. 认证通过：正常执行反向代理转发
       const headers = loopbackHeaders(req.headers, this.targetPort);
       const proxyReq = httpRequest(
         { host: '127.0.0.1', port: this.targetPort, method: req.method, path: req.url, headers, agent: false },
@@ -185,8 +283,15 @@ class ProxyServer {
       req.pipe(proxyReq);
     });
 
-    // WebSocket upgrade（DSH 的 /api/events.mux 等流式通道）
+    // WebSocket upgrade 鉴权与代理
     this.server.on('upgrade', (req, socket, head) => {
+      const auth = this.authManager?.verifyRequest(req) ?? { authenticated: true };
+      if (!auth.authenticated) {
+        socket.write('HTTP/1.1 401 Unauthorized\r\nContent-Type: text/plain\r\n\r\nUnauthorized\r\n');
+        socket.destroy();
+        return;
+      }
+
       const headers = loopbackHeaders(req.headers, this.targetPort);
       const proxyReq = httpRequest({
         host: '127.0.0.1', port: this.targetPort, method: req.method, path: req.url, headers, agent: false,
@@ -259,11 +364,12 @@ class ProxyServer {
  * Bridge Service
  */
 class BridgeService {
-  constructor({ dshPort, proxyPort, home, customTunnelConfig, logger }) {
+  constructor({ dshPort, proxyPort, home, customTunnelConfig, authManager, logger }) {
     this.dshPort = dshPort;
     this.proxyPort = proxyPort;
     this.home = home;
     this.customTunnelConfig = customTunnelConfig ?? null;
+    this.authManager = authManager ?? null;
     this.logger = logger;
 
     this.qrCache = new QrCache();
@@ -282,6 +388,7 @@ class BridgeService {
     this.proxy = new ProxyServer({
       localPort: this.proxyPort,
       targetPort: this.dshPort,
+      authManager: this.authManager,
       logger: this.logger,
     });
 
@@ -291,11 +398,38 @@ class BridgeService {
 
   async getStatus() {
     const lanIp = selectLanIPv4();
-    const lanUrl = lanIp ? `http://${lanIp}:${this.proxyPort}` : null;
+    const token = this.authManager?.secretToken;
+    const isAuthEnabled = Boolean(this.authManager?.enabled && this.authManager?.mode !== 'password_only' && token);
+
+    const isLanProtected = isAuthEnabled && this.authManager?.scope !== 'public_only';
+    const isPublicProtected = isAuthEnabled && this.authManager?.scope !== 'lan_only';
+
+    const appendToken = (url, shouldAppend) => {
+      if (!url || !shouldAppend || !token) return url;
+      try {
+        const u = new URL(url);
+        u.searchParams.set('auth', token);
+        return u.toString();
+      } catch {
+        const sep = url.includes('?') ? '&' : '?';
+        return `${url}${sep}auth=${encodeURIComponent(token)}`;
+      }
+    };
+
+    const baseLanUrl = lanIp ? `http://${lanIp}:${this.proxyPort}` : null;
+    const lanUrl = appendToken(baseLanUrl, isLanProtected);
+
+    const baseCloudflaredUrl = this.cloudflared?.url || null;
+    const cloudflaredUrl = appendToken(baseCloudflaredUrl, isPublicProtected);
+
+    const baseCustomUrl = this.customTunnel?.publicUrl || null;
+    const customUrl = appendToken(baseCustomUrl, isPublicProtected);
 
     return {
       version: VERSION,
 
+      auth: this.authManager?.getStatus() ?? { enabled: false },
+
       proxy: {
         running: !!this.proxy,
         port: this.proxyPort,
@@ -305,14 +439,16 @@ class BridgeService {
       lan: {
         ip: lanIp,
         url: lanUrl,
+        rawUrl: baseLanUrl,
         qr: lanUrl ? await this.qrCache.get(lanUrl) : null,
       },
 
       cloudflared: {
         running: !!this.cloudflared,
-        url: this.cloudflared?.url || null,
-        qr: this.cloudflared?.url
-          ? await this.qrCache.get(this.cloudflared.url)
+        url: cloudflaredUrl,
+        rawUrl: baseCloudflaredUrl,
+        qr: cloudflaredUrl
+          ? await this.qrCache.get(cloudflaredUrl)
           : null,
         state: this.cloudflaredState,
       },
@@ -321,9 +457,10 @@ class BridgeService {
         configured: !!(this.customTunnelConfig?.serverUrl && this.customTunnelConfig?.accessToken),
         serverUrl: this.customTunnelConfig?.serverUrl ?? '',
         running: !!this.customTunnel?.connected,
-        url: this.customTunnel?.publicUrl || null,
-        qr: this.customTunnel?.publicUrl
-          ? await this.qrCache.get(this.customTunnel.publicUrl)
+        url: customUrl,
+        rawUrl: baseCustomUrl,
+        qr: customUrl
+          ? await this.qrCache.get(customUrl)
           : null,
         state: this.customTunnelState,
       },
@@ -495,6 +632,7 @@ function apply(ctx, config = {}) {
   const proxyPort = config.port ?? 3082;
   const dshHome = process.env.DSH_HOME ?? join(homedir(), '.dsh');
   const configFile = join(dshHome, 'dsh-bridge', 'config.json');
+  const emergencyResetFile = join(dshHome, 'dsh-bridge', 'reset-auth');
 
   // 从 JSON 文件读取持久化配置
   async function loadConfig() {
@@ -512,11 +650,60 @@ function apply(ctx, config = {}) {
     await writeFile(configFile, JSON.stringify(data, null, 2), 'utf8');
   }
 
+  // 访问安全认证管理器
+  const authManager = new AuthManager({
+    config: config.auth ?? {},
+    logger,
+    onPersist: async (patch) => {
+      const stored = await loadConfig();
+      stored.auth = { ...(stored.auth ?? {}), ...patch };
+      await saveConfig(stored);
+    },
+  });
+
+  // 保命救急检查：检测到 reset-auth 文件时自动重置全量密码与安全策略
+  async function checkEmergencyReset() {
+    try {
+      await unlink(emergencyResetFile);
+      authManager.enabled = false;
+      authManager.passwordHash = '';
+      authManager.passwordSalt = '';
+      authManager.adminPasswordHash = '';
+      authManager.adminPasswordSalt = '';
+      authManager.adminPolicy = 'password_unlock';
+      authManager.mode = 'token_and_password';
+      authManager.sessions.clear();
+      authManager.adminSessions.clear();
+      const stored = await loadConfig();
+      delete stored.auth;
+      await saveConfig(stored);
+      logger.warn('dsh-bridge: [保命救急] 检测到 reset-auth 标记文件，已成功重置所有访问密码与安全策略！');
+    } catch {}
+  }
+
+  // 启动时读取已保存的 auth 配置并执行保命标记检查
+  checkEmergencyReset().then(() => loadConfig()).then((stored) => {
+    if (stored?.auth) {
+      if (stored.auth.enabled != null) authManager.enabled = Boolean(stored.auth.enabled);
+      if (stored.auth.mode) authManager.mode = stored.auth.mode;
+      if (stored.auth.scope) authManager.scope = stored.auth.scope;
+      if (stored.auth.adminPolicy) authManager.adminPolicy = stored.auth.adminPolicy;
+      if (stored.auth.passwordHash) authManager.passwordHash = stored.auth.passwordHash;
+      if (stored.auth.passwordSalt) authManager.passwordSalt = stored.auth.passwordSalt;
+      if (stored.auth.adminPasswordHash) authManager.adminPasswordHash = stored.auth.adminPasswordHash;
+      if (stored.auth.adminPasswordSalt) authManager.adminPasswordSalt = stored.auth.adminPasswordSalt;
+      if (stored.auth.secretToken) authManager.secretToken = stored.auth.secretToken;
+      if (stored.auth.allowLoopback != null) authManager.allowLoopback = Boolean(stored.auth.allowLoopback);
+      logger.info('dsh-bridge: loaded saved auth config (enabled=%s, mode=%s, adminPolicy=%s)', authManager.enabled, authManager.mode, authManager.adminPolicy);
+    }
+  }).catch(() => {});
+
   const service = new BridgeService({
     dshPort,
     proxyPort,
     home: config.home,
     customTunnelConfig: config.customTunnel ?? null,
+    authManager,
     logger,
   });
 
@@ -735,6 +922,7 @@ function apply(ctx, config = {}) {
 
   const disposeRpc = installBridgeRpc(ctx, {
     service,
+    authManager,
     wechat,
     qq,
     feishu,
@@ -761,8 +949,9 @@ function apply(ctx, config = {}) {
     await feishu.destroy();
     await telegram.destroy();
     platformManager.dispose();
+    authManager.dispose();
     await service.dispose();
-  }, 'dsh-bridge: stop wechat, qq, feishu, telegram, proxy and tunnels');
+  }, 'dsh-bridge: stop wechat, qq, feishu, telegram, proxy, auth and tunnels');
 }
 
-export { name, inject, apply };
+export { name, inject, apply, ProxyServer, BridgeService, selectLanIPv4 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
   "type": "module",
   "main": "lib/index.js",