@xopcai/xopc 0.0.230 → 0.0.232

package/dist/src/gateway/hono/routes/tunnel.js

@@ -1,22 +1,13 @@
 import { init_public_url, validatePublicUrl } from "../../../config/public-url.js";
-import { resolveGatewayEffectiveHost } from "../../../config/gateway-bind.js";
-import { loadTunnelState } from "../../../tunnel/tunnel-state.js";
-import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { extractToken } from "../../auth.js";
-import { TUNNEL_CONSENT_REQUIRED_CODE, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState } from "../../../tunnel/consent.js";
 import { TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE, TunnelRegistrationSecretError, getTunnelRegistrationSecretMeta, readTunnelRegistrationSecretFromConfigOnly, resolveTunnelBrokerUrl } from "../../../tunnel/env.js";
-import { createPairingSecret, exchangePairingSecretOnce, getCachedPairingExchange } from "../../../tunnel/pairing.js";
 import { logTunnelAudit } from "../../../tunnel/tunnel-audit.js";
 import { getTunnelService, hashGatewayToken } from "../../../tunnel/tunnel-service.js";
+import { TUNNEL_CONSENT_REQUIRED_CODE, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState } from "../../../tunnel/consent.js";
 import { configureTunnelFromGatewayConfig } from "../../../tunnel/gateway-lifecycle.js";
 import { applyTunnelConsentToConfig, mergeTunnelConfigPatch, setTunnelEnabledInConfig } from "../../../tunnel/tunnel-config.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
-import { applyLanPairingGatewayPatch } from "../../../tunnel/enable-lan-pairing.js";
 import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 import "../../../tunnel/index.js";
-import { buildMobileConnectUrlOrder, resolveMobilePairLanUrl, validateMobilePairBaseUrl } from "../../../tunnel/pair-url.js";
-import { buildMobilePairContext } from "../../../tunnel/pair-context.js";
-import { consumePairingExchangeFailLimit } from "../../../tunnel/pairing-rate-limit.js";
 import { provisionTunnelRegistrationKey } from "../../../tunnel/xopc-cloud-registration.js";
 //#region src/gateway/hono/routes/tunnel.ts
 init_public_url();
@@ -64,188 +55,17 @@ function createTunnelMutationRateLimitMiddleware() {
 		await next();
 	};
 }
-function registerTunnelPublicRoutes(app, service) {
-	app.get("/api/tunnel/pair/ping", async (c) => {
-		const config = service.currentConfig;
-		const status = getTunnelService().getStatus();
-		const context = buildMobilePairContext({
-			config,
-			tunnelPublicUrl: status.publicUrl,
-			tunnelConnected: status.state === "connected",
-			reverseProxyPublicUrl: resolveReverseProxyPublicUrl(config)
-		});
-		return c.json({
-			ok: true,
-			service: "xopc-gateway",
-			mobilePairing: true,
-			port: context.port,
-			bindMode: context.bindMode,
-			listenHost: context.listenHost,
-			pairingReady: context.pairingReady,
-			blockReason: context.blockReason ?? null,
-			tunnelConnected: status.state === "connected",
-			reverseProxyConfigured: Boolean(resolveReverseProxyPublicUrl(config)),
-			connectUrls: context.connectUrls
-		});
-	});
-	app.post("/api/tunnel/pair/validate-url", async (c) => {
-		let body;
-		try {
-			body = await c.req.json();
-		} catch {
-			return c.json({ error: "Invalid JSON body" }, 400);
-		}
-		const result = validateMobilePairBaseUrl(typeof body.baseUrl === "string" ? body.baseUrl : "");
-		if (result.ok === false) return c.json({
-			ok: false,
-			code: result.code,
-			message: result.message
-		});
-		return c.json({
-			ok: true,
-			url: result.url,
-			loopback: false,
-			probePath: "/api/tunnel/pair/ping"
-		});
-	});
-	app.post("/api/tunnel/exchange-token", async (c) => {
-		const clientIp = getClientIpFromHeaders({ get: (name) => c.req.header(name) ?? void 0 }) ?? "unknown";
-		let body;
-		try {
-			body = await c.req.json();
-		} catch {
-			return c.json({ error: "Invalid JSON body" }, 400);
-		}
-		const pairingSecret = typeof body.pairingSecret === "string" ? body.pairingSecret.trim() : "";
-		if (!pairingSecret) return c.json({ error: "pairingSecret required" }, 400);
-		const cached = getCachedPairingExchange(pairingSecret);
-		if (cached) {
-			logTunnelAudit("tunnel.exchange_token", {
-				ok: true,
-				clientIp,
-				phase: "pairing_exchange",
-				replay: true
-			}, "Pairing secret replayed (duplicate mobile exchange)");
-			return c.json(cached);
-		}
-		const token = service.getAuthToken();
-		if (!token) return c.json({ error: "Gateway token not configured" }, 500);
-		const persisted = loadTunnelState();
-		const config = service.currentConfig;
-		const tunnelUrl = persisted?.publicUrl?.trim() || null;
-		const reverseProxyUrl = resolveReverseProxyPublicUrl(config);
-		const lanUrl = resolveMobilePairLanUrl(config);
-		const connectUrls = buildMobileConnectUrlOrder({
-			reverseProxyUrl,
-			baseUrl: reverseProxyUrl ?? tunnelUrl,
-			lanUrl,
-			tunnelUrl
-		});
-		const advertisedBaseUrl = reverseProxyUrl ?? tunnelUrl;
-		const payload = await exchangePairingSecretOnce(pairingSecret, () => ({
-			token,
-			baseUrl: advertisedBaseUrl,
-			lanUrl,
-			connectUrls
-		}));
-		if (!payload) {
-			const limited = consumePairingExchangeFailLimit(clientIp);
-			if (!limited.allowed) c.header("Retry-After", String(Math.ceil(limited.retryAfterMs / 1e3)));
-			logTunnelAudit("tunnel.exchange_token", {
-				ok: false,
-				clientIp,
-				phase: "pairing_exchange"
-			}, "Pairing exchange denied: invalid or expired secret");
-			return c.json({
-				error: "Invalid or expired pairing secret",
-				code: "PAIRING_INVALID"
-			}, 401);
-		}
-		logTunnelAudit("tunnel.exchange_token", {
-			ok: true,
-			clientIp,
-			subdomain: persisted?.subdomain ?? null,
-			phase: "pairing_exchange"
-		}, "Pairing secret exchanged for gateway token");
-		return c.json(payload);
-	});
-}
 function registerTunnelRoutes(authenticated, deps) {
 	const { strictRateLimitMiddleware } = deps;
 	const tunnel = getTunnelService();
 	const tunnelMutationLimit = createTunnelMutationRateLimitMiddleware();
-	authenticated.get("/api/tunnel/pair/context", async (c) => {
-		const config = deps.service.currentConfig;
-		const status = tunnel.getStatus();
-		const context = buildMobilePairContext({
-			config,
-			tunnelPublicUrl: status.publicUrl,
-			tunnelConnected: status.state === "connected",
-			reverseProxyPublicUrl: resolveReverseProxyPublicUrl(config)
-		});
-		return c.json(context);
-	});
-	authenticated.post("/api/tunnel/pair/enable-lan", tunnelMutationLimit, async (c) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
-		const config = deps.service.currentConfig;
-		const patchResult = applyLanPairingGatewayPatch(config);
-		if (patchResult.ok === false) return c.json({
-			ok: false,
-			error: {
-				message: patchResult.message,
-				code: "LAN_PAIRING_CONFIG"
-			}
-		}, 400);
-		if (patchResult.changed) {
-			const saveResult = await deps.service.saveConfig(config);
-			if (!saveResult.saved) return c.json({
-				ok: false,
-				error: {
-					message: saveResult.error ?? "Failed to save config",
-					code: "SAVE_FAILED"
-				}
-			}, 500);
-			logTunnelAudit("tunnel.enable_lan_pairing", { gatewayTokenHash: hashGatewayToken(token).slice(0, 12) }, "Gateway bind switched to LAN for mobile pairing");
-		}
-		const status = tunnel.getStatus();
-		let context = buildMobilePairContext({
-			config: deps.service.currentConfig,
-			tunnelPublicUrl: status.publicUrl,
-			tunnelConnected: status.state === "connected",
-			reverseProxyPublicUrl: resolveReverseProxyPublicUrl(deps.service.currentConfig)
-		});
-		if (patchResult.changed) context = {
-			...context,
-			pairingReady: false,
-			blockReason: "GATEWAY_LOOPBACK_ONLY"
-		};
-		return c.json({
-			ok: true,
-			requiresRestart: patchResult.changed,
-			context
-		});
-	});
-	authenticated.post("/api/tunnel/pair", tunnelMutationLimit, async (c) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
-		const { secret, expiresAt } = createPairingSecret();
-		logTunnelAudit("tunnel.pair", {
-			expiresAt: expiresAt.toISOString(),
-			gatewayTokenHash: hashGatewayToken(token).slice(0, 12)
-		}, "Mobile pairing session created");
-		return c.json({
-			pairingSecret: secret,
-			expiresAt: expiresAt.toISOString()
-		});
-	});
 	/**
 	* Probe a candidate reverse-proxy URL before persisting it. The check round-trips
-	* a `GET /api/tunnel/pair/ping` and validates the response identifies as
+	* a `GET /api/health` and validates the response identifies as
 	* `service: 'xopc-gateway'`. Surface-area errors are mapped to stable codes so
 	* the UI can render targeted hints (TLS / DNS / wrong service / blocked path).
 	*/
-	authenticated.post("/api/tunnel/pair/probe-public", tunnelMutationLimit, async (c) => {
+	authenticated.post("/api/tunnel/probe-public", tunnelMutationLimit, async (c) => {
 		if (!requireGatewayToken(c)) return c.json({ error: "Gateway token required" }, 401);
 		let body;
 		try {
@@ -263,7 +83,7 @@ function registerTunnelRoutes(authenticated, deps) {
 			code: validation.code,
 			message: validation.message
 		});
-		const pingUrl = `${validation.url}/api/tunnel/pair/ping`;
+		const pingUrl = `${validation.url}/api/health`;
 		const startedAt = Date.now();
 		let response;
 		try {
@@ -305,7 +125,7 @@ function registerTunnelRoutes(authenticated, deps) {
 				message: "Response was not JSON"
 			});
 		}
-		if (!parsed || parsed.service !== "xopc-gateway") return c.json({
+		if (!parsed || parsed.status !== "ok" && parsed.status !== "starting") return c.json({
 			ok: false,
 			code: "NOT_XOPC_GATEWAY",
 			message: "Endpoint did not identify as an xopc gateway"
@@ -314,7 +134,7 @@ function registerTunnelRoutes(authenticated, deps) {
 			ok: true,
 			url: validation.url,
 			latencyMs: Date.now() - startedAt,
-			mobilePairing: parsed.mobilePairing === true
+			gatewayReady: true
 		});
 	});
 	authenticated.get("/api/tunnel/status", async (c) => {
@@ -391,7 +211,7 @@ function registerTunnelRoutes(authenticated, deps) {
 		}
 		const port = config.gateway.port ?? 18790;
 		try {
-			const qr = await tunnel.start(port, token);
+			await tunnel.start(port, token);
 			setTunnelEnabledInConfig(config, true);
 			const saved = await deps.service.saveConfig(config);
 			if (!saved.saved) {
@@ -401,10 +221,8 @@ function registerTunnelRoutes(authenticated, deps) {
 			}
 			const status = tunnel.getStatus();
 			return c.json({
-				publicUrl: qr.publicUrl,
-				subdomain: status.subdomain,
-				qrPayload: qr.qrPayload,
-				lanUrl: qr.lanUrl
+				publicUrl: status.publicUrl,
+				subdomain: status.subdomain
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
@@ -436,13 +254,6 @@ function registerTunnelRoutes(authenticated, deps) {
 			released
 		});
 	});
-	authenticated.get("/api/tunnel/qr", async (c) => {
-		const port = deps.service.currentConfig.gateway.port ?? 18790;
-		const host = resolveGatewayEffectiveHost(deps.service.currentConfig);
-		if (!requireGatewayToken(c)) return c.json({ error: "Gateway token required" }, 401);
-		const qr = await tunnel.buildQr(port, host);
-		return c.json(qr);
-	});
 	authenticated.get("/api/tunnel/transport-status", async (c) => {
 		return c.json({ transport: { tls: "broker_terminated" } });
 	});
@@ -462,4 +273,4 @@ function registerTunnelRoutes(authenticated, deps) {
 	});
 }
 //#endregion
-export { registerTunnelPublicRoutes, registerTunnelRoutes };
+export { registerTunnelRoutes };

package/dist/src/gateway/hono/routes/voice.js

@@ -14,8 +14,8 @@ import "../../../voice/stt/index.js";
 import { listSttProvidersForApi } from "../../../voice/stt/list-providers.js";
 import "../../../voice/tts/index.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
-import { listTtsProvidersForApi } from "../../../voice/tts/list-providers.js";
 import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
+import { listTtsProvidersForApi } from "../../../voice/tts/list-providers.js";
 //#region src/gateway/hono/routes/voice.ts
 init_providers();
 const log = createGatewayRouteLogger("Voice");