bdy 1.22.84 → 1.22.85-beta

package/distTs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.22.84",
+  "version": "1.22.85-beta",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",

package/distTs/src/agent/socket/client.js

@@ -139,10 +139,10 @@ class AgentSocketClient extends events_1.default {
             forceBase64: true,
             transports: ['websocket'],
             reconnection: false,
-            rejectUnauthorized: false,
+            rejectUnauthorized: !(0, utils_1.isLocalHost)(host),
             // @ts-ignore
             agent: new https_1.Agent({
-                rejectUnauthorized: false,
+                rejectUnauthorized: !(0, utils_1.isLocalHost)(host),
             }),
             maxHttpBufferSize: 3e6,
             extraHeaders: {

package/distTs/src/api/client.js

@@ -26,7 +26,7 @@ class ApiClient {
         this.clientToken = clientToken;
         this.client = new undici_1.Pool(baseUrl, {
             connect: {
-                rejectUnauthorized: false,
+                rejectUnauthorized: !(0, utils_1.isLocalHost)(baseUrl.hostname),
             },
         });
     }
@@ -706,7 +706,7 @@ class ApiClient {
                 client_name: name,
                 grant_types: ['authorization_code', 'refresh_token'],
                 response_types: ['code'],
-                token_endpoint_auth_method: 'client_secret_basic',
+                token_endpoint_auth_method: 'client_secret_post',
                 token_expires_in: 3600,
             },
             parseResponseBody: true,
@@ -732,7 +732,7 @@ class ApiClient {
             parseResponseBody: true,
         });
     }
-    async exchangeAppToken(code, clientId, clientSecret, redirectUrl) {
+    async exchangeAppToken(code, clientId, clientSecret, redirectUrl, codeVerifier) {
         return await this.request({
             method: 'POST',
             path: '/oauth2/token',
@@ -742,6 +742,7 @@ class ApiClient {
                 client_id: clientId,
                 client_secret: clientSecret,
                 redirect_uri: redirectUrl,
+                code_verifier: codeVerifier,
             },
             parseResponseBody: true,
             httpUrlEncoded: true,

package/distTs/src/command/login.js

@@ -7,6 +7,7 @@ exports.authorize = authorize;
 const cfg_1 = __importDefault(require("../tunnel/cfg"));
 const output_1 = __importDefault(require("../output"));
 const node_http_1 = __importDefault(require("node:http"));
+const node_crypto_1 = require("node:crypto");
 const texts_1 = require("../texts");
 const utils_1 = require("../utils");
 const input_1 = __importDefault(require("../input"));
@@ -37,6 +38,13 @@ const OAUTH_CLIENT_APP_SCOPES = [
 function getRedirectUrl(api) {
     return `https://${api}/oauth2/cli`;
 }
+function generatePkcePair() {
+    const codeVerifier = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    const codeChallenge = (0, node_crypto_1.createHash)('sha256')
+        .update(codeVerifier)
+        .digest('base64url');
+    return { codeVerifier, codeChallenge };
+}
 async function waitForOpen(isRegister, abortCode, seconds = 3) {
     output_1.default.normal(isRegister ? texts_1.TXT_REGISTER_OPENING : texts_1.TXT_LOGIN_OPENING);
     let star = true;
@@ -66,11 +74,12 @@ async function oauthServer(api, clientId, clientSecret, forceRegisterEmail, forc
     }, OAUTH_TIMEOUT);
     return new Promise((resolve) => {
         const state = (0, uuid_1.v4)();
+        const { codeVerifier, codeChallenge } = generatePkcePair();
         const abortCode = new AbortController();
         const exchange = async (urlCode, urlState, res) => {
             const client = new ApiClient(new URL(`https://${api}`));
             try {
-                const response = await client.exchangeAppToken(urlCode, clientId, clientSecret, redirectUrl);
+                const response = await client.exchangeAppToken(urlCode, clientId, clientSecret, redirectUrl, codeVerifier);
                 if (res)
                     res.end(urlState);
                 s.close();
@@ -111,7 +120,7 @@ async function oauthServer(api, clientId, clientSecret, forceRegisterEmail, forc
             output_1.default.exitError(texts_1.ERR_LOGIN_HTTP_SERVER_PORT_TAKEN);
         });
         s.listen(OAUTH_CLIENT_APP_PORT, OAUTH_CLIENT_APP_HOST, async () => {
-            let url = `https://${api}/oauth2/authorize?type=web_server&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUrl)}&response_type=code&scope=${encodeURIComponent(OAUTH_CLIENT_APP_SCOPES.join(' '))}&state=${encodeURIComponent(state)}`;
+            let url = `https://${api}/oauth2/authorize?type=web_server&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUrl)}&response_type=code&scope=${encodeURIComponent(OAUTH_CLIENT_APP_SCOPES.join(' '))}&state=${encodeURIComponent(state)}&code_challenge=${encodeURIComponent(codeChallenge)}&code_challenge_method=S256`;
             if (isRegister) {
                 url += `&register_email=${encodeURIComponent(forceRegisterEmail)}&register_name=${encodeURIComponent(forceRegisterName)}`;
             }

package/distTs/src/tunnel/api/buddy.js

@@ -26,7 +26,7 @@ const makeRequest = async (host, path, body, method = 'POST', respAsJson = true,
             headers: body ? { 'Content-Type': 'application/json' } : undefined,
             method,
             signal: c.signal,
-            dispatcher: output_1.default.getUndiciUnauthorizedAgent(),
+            dispatcher: (0, utils_1.isLocalHost)(host) ? output_1.default.getUndiciUnauthorizedAgent() : undefined,
         });
         if (respAsJson)
             data = await response.json();

package/distTs/src/tunnel/config.js

@@ -0,0 +1,241 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../utils");
+const logger_1 = __importDefault(require("../logger"));
+const tunnel_1 = require("../types/tunnel");
+class TunnelConfig {
+    type;
+    region;
+    target;
+    whitelist;
+    domain;
+    subdomain;
+    name;
+    timeout;
+    useragents;
+    headers;
+    responseHeaders;
+    terminate;
+    key;
+    cert;
+    ca;
+    host;
+    login;
+    password;
+    authType;
+    serve;
+    circuitBreaker;
+    log;
+    verify;
+    compression;
+    http2;
+    sshIp;
+    sshId;
+    sshPort;
+    sshUser;
+    sshPassword;
+    sshForwardPort;
+    sshClientUser;
+    sshClientPassword;
+    targetProto;
+    targetHost;
+    targetPort;
+    targetAuth;
+    constructor({ type, target, region, timeout, domain, subdomain, name, whitelist, tlsSettings, httpSettings, sshSettings, }) {
+        this.type = type;
+        this.region = region;
+        this.target = target;
+        this.whitelist = whitelist || [];
+        this.domain = domain;
+        this.subdomain = subdomain;
+        this.name = name;
+        this.timeout = timeout || utils_1.DEFAULT_TIMEOUT;
+        this.useragents = [];
+        this.headers = [];
+        this.responseHeaders = [];
+        if (tlsSettings) {
+            this.terminate = tlsSettings.terminate;
+            this.key = tlsSettings.key;
+            this.cert = tlsSettings.cert;
+            this.ca = tlsSettings.ca;
+        }
+        if (httpSettings) {
+            this.host = httpSettings.host;
+            if (httpSettings.authType) {
+                this.authType = httpSettings.authType;
+                if (this.authType === tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BASIC) {
+                    this.login = httpSettings.login || '';
+                    this.password = httpSettings.password || '';
+                }
+            }
+            else if (httpSettings.login || httpSettings.password) {
+                this.authType = tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BASIC;
+                this.login = httpSettings.login || '';
+                this.password = httpSettings.password || '';
+            }
+            else {
+                this.authType = tunnel_1.TUNNEL_HTTP_AUTH_TYPE.NONE;
+            }
+            this.ca = httpSettings.ca;
+            this.serve = httpSettings.serve;
+            this.useragents = httpSettings.userAgents || [];
+            this.headers = httpSettings.headers || [];
+            this.responseHeaders = httpSettings.responseHeaders || [];
+            this.circuitBreaker = httpSettings.circuitBreaker;
+            this.log = httpSettings.log;
+            this.verify = httpSettings.verify;
+            this.compression = httpSettings.compression;
+            this.http2 = httpSettings.http2;
+        }
+        if (sshSettings) {
+            this.sshIp = sshSettings.ip;
+            this.sshId = sshSettings.sshId;
+            this.sshPort = sshSettings.port;
+            this.sshUser = sshSettings.user;
+            this.sshPassword = sshSettings.password;
+            this.sshForwardPort = sshSettings.forwardPort;
+            this.sshClientUser = sshSettings.clientUser;
+            this.sshClientPassword = sshSettings.clientPassword;
+        }
+        this.targetProto = 'http';
+        this.targetHost = 'localhost';
+        this.targetPort = 80;
+        this.targetAuth = null;
+        if (this.type === tunnel_1.TUNNEL_TYPE.HTTP) {
+            let m = this.target.match(utils_1.TARGET_ONLY_PORT_REGEX);
+            if (m) {
+                this.targetPort = parseInt(m[0], 10);
+            }
+            else {
+                m = this.target.match(utils_1.TARGET_HTTP_REGEX);
+                if (m) {
+                    if (m[2])
+                        this.targetProto = m[2];
+                    if (m[6])
+                        this.targetPort = parseInt(m[6], 10);
+                    else if (this.targetProto === 'https')
+                        this.targetPort = 443;
+                    if (m[4])
+                        this.targetHost = m[4];
+                    if (m[3])
+                        this.targetAuth = m[3].replace(/@$/, '');
+                }
+            }
+        }
+        else if (this.type === tunnel_1.TUNNEL_TYPE.SSH) {
+            this.targetHost = 'localhost';
+            this.targetProto = 'ssh://';
+            this.targetPort = 22;
+        }
+        else {
+            const m = this.target.match(utils_1.TARGET_TCP_TLS_REGEX);
+            if (m) {
+                this.targetPort = parseInt(m[3], 10);
+                if (m[2])
+                    this.targetHost = m[2];
+            }
+        }
+    }
+    changed(incoming, tunnelId) {
+        const diff = (field, a, b) => {
+            logger_1.default.debug(`Tunnel '${tunnelId}' hasChanged: ${field} (running=${JSON.stringify(a)} incoming=${JSON.stringify(b)})`);
+            return true;
+        };
+        if (this.type !== incoming.type)
+            return diff('type', this.type, incoming.type);
+        if (this.target !== incoming.target)
+            return diff('target', this.target, incoming.target);
+        if (this.region !== incoming.region)
+            return diff('region', this.region, incoming.region);
+        if (this.timeout !== incoming.timeout)
+            return diff('timeout', this.timeout, incoming.timeout);
+        if (this.domain !== incoming.domain)
+            return diff('domain', this.domain, incoming.domain);
+        if (this.subdomain !== incoming.subdomain)
+            return diff('subdomain', this.subdomain, incoming.subdomain);
+        if (this.terminate !== incoming.terminate)
+            return diff('terminate', this.terminate, incoming.terminate);
+        if (this.key !== incoming.key)
+            return diff('key', this.key, incoming.key);
+        if (this.cert !== incoming.cert)
+            return diff('cert', this.cert, incoming.cert);
+        if (this.ca !== incoming.ca)
+            return diff('ca', this.ca, incoming.ca);
+        if (this.host !== incoming.host)
+            return diff('host', this.host, incoming.host);
+        if (this.login !== incoming.login)
+            return diff('login', this.login, incoming.login);
+        if (this.password !== incoming.password)
+            return diff('password', this.password, incoming.password);
+        if (this.authType !== incoming.authType)
+            return diff('authType', this.authType, incoming.authType);
+        if (this.serve !== incoming.serve)
+            return diff('serve', this.serve, incoming.serve);
+        if (this.circuitBreaker !== incoming.circuitBreaker)
+            return diff('circuitBreaker', this.circuitBreaker, incoming.circuitBreaker);
+        if (this.log !== incoming.log)
+            return diff('log', this.log, incoming.log);
+        if (this.verify !== incoming.verify)
+            return diff('verify', this.verify, incoming.verify);
+        if (this.http2 !== incoming.http2)
+            return diff('http2', this.http2, incoming.http2);
+        if (this.compression !== incoming.compression)
+            return diff('compression', this.compression, incoming.compression);
+        if (this.sshIp !== incoming.sshIp)
+            return diff('sshIp', this.sshIp, incoming.sshIp);
+        if (this.sshId !== incoming.sshId)
+            return diff('sshId', this.sshId, incoming.sshId);
+        if (this.sshPort !== incoming.sshPort)
+            return diff('sshPort', this.sshPort, incoming.sshPort);
+        if (this.sshUser !== incoming.sshUser)
+            return diff('sshUser', this.sshUser, incoming.sshUser);
+        if (this.sshPassword !== incoming.sshPassword)
+            return diff('sshPassword', this.sshPassword, incoming.sshPassword);
+        if (this.sshForwardPort !== incoming.sshForwardPort)
+            return diff('sshForwardPort', this.sshForwardPort, incoming.sshForwardPort);
+        if (this.sshClientPassword !== incoming.sshClientPassword)
+            return diff('sshClientPassword', this.sshClientPassword, incoming.sshClientPassword);
+        if (this.sshClientUser !== incoming.sshClientUser)
+            return diff('sshClientUser', this.sshClientUser, incoming.sshClientUser);
+        if (this._stringListChanged('whitelist', this.whitelist, incoming.whitelist, diff))
+            return true;
+        if (this._stringListChanged('useragents', this.useragents, incoming.useragents, diff))
+            return true;
+        if (this._headerListChanged('headers', this.headers, incoming.headers, diff))
+            return true;
+        if (this._headerListChanged('responseHeaders', this.responseHeaders, incoming.responseHeaders, diff))
+            return true;
+        return false;
+    }
+    _stringListChanged(field, running, incoming, diff) {
+        if (running?.length !== incoming?.length)
+            return diff(`${field}.length`, running, incoming);
+        if (running && incoming) {
+            const a = [...running].sort();
+            const b = [...incoming].sort();
+            for (let i = 0; i < a.length; i += 1) {
+                if (a[i] !== b[i])
+                    return diff(field, running, incoming);
+            }
+        }
+        return false;
+    }
+    _headerListChanged(field, running, incoming, diff) {
+        if (running?.length !== incoming?.length)
+            return diff(`${field}.length`, running, incoming);
+        if (running && incoming) {
+            const sortHeaders = (a, b) => a.name.localeCompare(b.name);
+            const a = [...running].sort(sortHeaders);
+            const b = [...incoming].sort(sortHeaders);
+            for (let i = 0; i < a.length; i += 1) {
+                if (a[i].name !== b[i].name || a[i].value !== b[i].value)
+                    return diff(field, running, incoming);
+            }
+        }
+        return false;
+    }
+}
+exports.default = TunnelConfig;