bdy 1.22.84 → 1.22.85-beta

package/distTs/src/tunnel/http/auth.js

@@ -0,0 +1,404 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const utils_1 = require("../../utils");
+const logger_1 = __importDefault(require("../../logger"));
+const texts_1 = require("../../texts");
+const tunnel_1 = require("../../types/tunnel");
+const jwks_1 = __importDefault(require("./jwks"));
+const COOKIE_NAME = 'jwt_token';
+const AUTH_ME_PATH = '/.buddy/auth/me';
+const AUTH_USER_CACHE_TTL = 60 * 1000;
+const AUTH_STATE_TTL = 10 * 60 * 1000;
+class TunnelHttpAuth {
+    tunnel;
+    jwks;
+    clients;
+    userCache;
+    // OAuth `state` is an opaque random id; the sensitive url/verifier live here
+    // in-process (never leave the tunnel), keyed by that id and bounded by TTL.
+    stateStore;
+    constructor(tunnel) {
+        this.tunnel = tunnel;
+        this.jwks = new jwks_1.default();
+        this.clients = {};
+        this.userCache = {};
+        this.stateStore = {};
+    }
+    _safeEqual(a, b) {
+        // Hash both sides to a fixed length so neither the byte contents nor the
+        // input length leak through comparison timing.
+        const ah = node_crypto_1.default.createHash('sha256').update(String(a)).digest();
+        const bh = node_crypto_1.default.createHash('sha256').update(String(b)).digest();
+        return node_crypto_1.default.timingSafeEqual(ah, bh);
+    }
+    async basicAuth(req, res) {
+        if (this.tunnel.authType !== tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BASIC)
+            return true;
+        const user = require('basic-auth')(req);
+        if (user) {
+            // compute both comparisons unconditionally so neither the credentials
+            // nor which field mismatched leak through timing
+            const nameOk = this._safeEqual(user.name || '', this.tunnel.login || '');
+            const passOk = this._safeEqual(user.pass || '', this.tunnel.password || '');
+            if (nameOk && passOk) {
+                // tunnel consumed the credentials; don't leak them to the target
+                delete req.headers.authorization;
+                return true;
+            }
+        }
+        if (await this._checkPat(req, res, false)) {
+            // tunnel consumed the credentials; don't leak them to the target
+            delete req.headers.authorization;
+            return true;
+        }
+        logger_1.default.debug(texts_1.LOG_TUNNEL_HTTP_WRON_AUTH);
+        this.tunnel.httpEndFast(req, res, 401, 'Unauthorised', {
+            'WWW-Authenticate': 'Basic real="Buddy"',
+        });
+        return false;
+    }
+    async buddyAuth(req, res) {
+        if (this.tunnel.authType !== tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BUDDY)
+            return true;
+        const { searchParams, pathname, search } = new URL(req.url, 'https://abc.com');
+        const code = searchParams.get('code') || '';
+        const state = searchParams.get('state') || '';
+        const token = searchParams.get('access_token') || '';
+        const { url, verifier } = this._consumeState(state);
+        const redirectByAuthToken = this._checkTokenRedirect(req, res, code, state, token, url);
+        if (redirectByAuthToken) {
+            return false;
+        }
+        const authByToken = await this._checkToken(code, verifier || '', token, req, res);
+        if (authByToken) {
+            if (url) {
+                this.tunnel.httpEndFast(req, res, 302, 'Found', {
+                    location: url,
+                });
+                return false;
+            }
+            return true;
+        }
+        if (url && verifier && (code || token)) {
+            this.tunnel.httpEndFast(req, res, 404, 'Not found');
+            return false;
+        }
+        if (await this._checkPat(req, res, true)) {
+            return true;
+        }
+        this._redirectToBuddyAuth(pathname, search, req, res);
+        return false;
+    }
+    async buddyAuthMe(req, res) {
+        if (this.tunnel.authType !== tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BUDDY)
+            return false;
+        const url = req.url || '';
+        if (url !== AUTH_ME_PATH && !url.startsWith(`${AUTH_ME_PATH}?`)) {
+            return false;
+        }
+        if (!this.tunnel.httpRateLimit(req, res))
+            return true;
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            this.tunnel.httpEndFastJson(req, res, 405, { error: 'Method not allowed' }, {
+                allow: 'GET, HEAD',
+            });
+            return true;
+        }
+        const data = await this._verifyCookie(req);
+        const user = data ? await this._fetchUser(data.token) : null;
+        if (!user) {
+            this.tunnel.httpEndFastJson(req, res, 401, { error: 'Unauthorised' });
+            return true;
+        }
+        this.tunnel.httpEndFastJson(req, res, 200, user);
+        return true;
+    }
+    async _checkPat(req, res, setCookie) {
+        const user = require('basic-auth')(req);
+        if (!user || !user.name || !user.pass)
+            return false;
+        const client = this._getClient();
+        let ipAddress;
+        if (req.httpVersion === '2.0') {
+            ipAddress = req.socket.stream ? req.socket.stream.remoteAddress : '::1';
+        }
+        else {
+            ipAddress = req.socket.remoteAddress;
+        }
+        try {
+            const { statusCode, body } = await client.request({
+                path: `/tunnel/auth/pat`,
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify({
+                    id: this.tunnel.id,
+                    agentId: this.tunnel.agent.id,
+                    login: user.name,
+                    password: user.pass,
+                    ipAddress,
+                }),
+            });
+            if (statusCode !== 200) {
+                await body.dump();
+                return false;
+            }
+            const result = (await body.json());
+            if (!result.success)
+                return false;
+            if (setCookie)
+                this._setAuthCookie(res, result.token);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    _getClient() {
+        const host = this.tunnel.agent.host;
+        if (!this.clients[host]) {
+            const { Pool: UndiciPool } = require('undici');
+            this.clients[host] = new UndiciPool(host, {
+                connect: {
+                    rejectUnauthorized: !(0, utils_1.isLocalHost)(host),
+                },
+            });
+        }
+        return this.clients[host];
+    }
+    async _exchangeAuthCode(code, verifier) {
+        const client = this._getClient();
+        try {
+            const r = await client.request({
+                path: `/external-api/auth/token?grant_type=authorization_code`,
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify({
+                    code,
+                    verifier,
+                }),
+            });
+            const o = (await r.body.json());
+            if (o.accessToken) {
+                return o.accessToken;
+            }
+        }
+        catch {
+            // do nothing
+        }
+        return '';
+    }
+    async _parseToken(token) {
+        const msg = 'Invalid authorization token';
+        if (!token) {
+            throw new Error(msg);
+        }
+        const decoded = require('jsonwebtoken').decode(token, {
+            complete: true,
+        });
+        const data = decoded?.payload;
+        if (!data?.iss) {
+            throw new Error(msg);
+        }
+        // Pin to the agent host's issuer when mapped; otherwise only accept a known
+        // Buddy issuer (bounds the JWKS fetch to trusted origins).
+        const expectedIssuer = (0, utils_1.getOidcIssuerByAppHost)(this.tunnel.agent.host);
+        if (expectedIssuer) {
+            if (data.iss !== expectedIssuer) {
+                throw new Error(msg);
+            }
+        }
+        else if (!(0, utils_1.isKnownOidcIssuer)(data.iss)) {
+            throw new Error(msg);
+        }
+        const issuer = expectedIssuer || data.iss;
+        const cert = await this.jwks.getKey(issuer, decoded.header?.kid);
+        if (!cert) {
+            throw new Error(msg);
+        }
+        return new Promise((resolve, reject) => {
+            require('jsonwebtoken').verify(token, cert, {
+                complete: true,
+                algorithms: ['RS256'],
+                issuer,
+                audience: 'tunnels',
+                subject: 'tunnel_read',
+            }, (err, data) => {
+                if (err || !data) {
+                    reject(new Error(msg));
+                    return;
+                }
+                const payload = data.payload;
+                if (!payload.tunnelId || !payload.userId) {
+                    reject(new Error(msg));
+                    return;
+                }
+                resolve({
+                    tunnelId: payload.tunnelId,
+                    userId: payload.userId,
+                    token,
+                });
+            });
+        });
+    }
+    _setAuthCookie(res, token) {
+        res.setHeader('set-cookie', require('cookie').serialize(COOKIE_NAME, token, {
+            maxAge: 3600,
+            path: '/',
+            secure: true,
+            httpOnly: true,
+            sameSite: 'lax',
+        }));
+    }
+    _checkTokenRedirect(req, res, code, state, accessToken, url) {
+        if ((code || accessToken) && state && url) {
+            const currentHost = req.headers['x-forwarded-host'] ||
+                req.headers.host ||
+                req.headers[':authority'] ||
+                '';
+            const originalHost = new URL(url).host;
+            if (originalHost !== currentHost) {
+                const location = new URL(`https://${originalHost}`);
+                location.searchParams.set('state', state);
+                if (code)
+                    location.searchParams.set('code', code);
+                else if (accessToken)
+                    location.searchParams.set('access_token', accessToken);
+                this.tunnel.httpEndFast(req, res, 302, 'Found', {
+                    location: location.href,
+                });
+                return true;
+            }
+        }
+        return false;
+    }
+    async _verifyToken(token) {
+        if (!token)
+            return null;
+        try {
+            const data = await this._parseToken(token);
+            if (data.tunnelId !== this.tunnel.id || !data.userId)
+                return null;
+            return data;
+        }
+        catch {
+            return null;
+        }
+    }
+    async _verifyCookie(req) {
+        const cookies = require('cookie').parse(req.headers.cookie || '');
+        return this._verifyToken(cookies[COOKIE_NAME] || '');
+    }
+    async _checkToken(code, verifier, token, req, res) {
+        if (code && verifier && !token) {
+            token = await this._exchangeAuthCode(code, verifier);
+        }
+        if (!token) {
+            return !!(await this._verifyCookie(req));
+        }
+        if (!(await this._verifyToken(token))) {
+            return false;
+        }
+        this._setAuthCookie(res, token);
+        return true;
+    }
+    _sweepExpired(map, now) {
+        Object.keys(map).forEach((k) => {
+            if (map[k].expiresAt <= now)
+                delete map[k];
+        });
+    }
+    _createState(url, verifier) {
+        const now = Date.now();
+        this._sweepExpired(this.stateStore, now);
+        const id = node_crypto_1.default.randomBytes(24).toString('base64url');
+        this.stateStore[id] = { url, verifier, expiresAt: now + AUTH_STATE_TTL };
+        return id;
+    }
+    _consumeState(state) {
+        if (state) {
+            const entry = this.stateStore[state];
+            // Not deleted on read: the wrong-host redirect in _checkTokenRedirect
+            // re-enters with the same state, so validity is bounded by TTL instead.
+            if (entry && entry.expiresAt > Date.now()) {
+                return { url: entry.url, verifier: entry.verifier };
+            }
+        }
+        return { url: null, verifier: null };
+    }
+    _redirectToBuddyAuth(pathname, search, req, res) {
+        let host = this.tunnel.agent.host;
+        if (/^https:\/\/\d+\.\d+\.\d+\.\d+$/.test(host)) {
+            host = 'https://app.local.io';
+        }
+        const verifier = require('uuid').v4();
+        const challenge = node_crypto_1.default
+            .createHash('sha256')
+            .update(verifier)
+            .digest('hex');
+        const callback = `https://${this.tunnel.subdomain}.${(this.tunnel.region || '').toLowerCase()}-${this.tunnel.sshId}.${this.tunnel.domain}`;
+        let redirect;
+        if (req.headers['x-forwarded-host']) {
+            if (req.headers['x-forwarded-proto'] === 'http') {
+                redirect = 'http://';
+            }
+            else {
+                redirect = 'https://';
+            }
+            redirect += req.headers['x-forwarded-host'];
+        }
+        else {
+            redirect = callback;
+        }
+        redirect += pathname;
+        if (search)
+            redirect += search;
+        const stateId = this._createState(redirect, verifier);
+        let url = `${host}/tunnel/auth?redirect_url=${encodeURIComponent(callback)}&id=${encodeURIComponent(this.tunnel.id)}&agentId=${encodeURIComponent(this.tunnel.agent.id)}&challenge=${encodeURIComponent(challenge)}&state=${encodeURIComponent(stateId)}`;
+        if (/app\.local\.io/.test(host)) {
+            url += '&response_type=token';
+        }
+        this.tunnel.httpEndFast(req, res, 302, 'Found', {
+            location: url,
+        });
+    }
+    async _fetchUser(token) {
+        const key = node_crypto_1.default.createHash('sha256').update(token).digest('hex');
+        const cached = this.userCache[key];
+        if (cached && cached.expiresAt > Date.now())
+            return cached.user;
+        const client = this._getClient();
+        try {
+            const { statusCode, body } = await client.request({
+                path: `/external-api/tunnel/user`,
+                method: 'GET',
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            });
+            if (statusCode !== 200) {
+                await body.dump();
+                return null;
+            }
+            const user = (await body.json());
+            const now = Date.now();
+            this._sweepExpired(this.userCache, now);
+            this.userCache[key] = {
+                user,
+                expiresAt: now + AUTH_USER_CACHE_TTL,
+            };
+            return user;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.default = TunnelHttpAuth;

package/distTs/src/tunnel/http/jwks.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const JWKS_PATH = '/.well-known/jwks';
+// Keys rotate rarely and a rotation ships a new kid (which triggers an
+// out-of-band refetch bounded by JWKS_RETRY_TTL), so the success TTL can be
+// long. JWKS_RETRY_TTL also throttles refetch on fetch failure / unknown kid.
+const JWKS_CACHE_TTL = 24 * 60 * 60 * 1000;
+const JWKS_RETRY_TTL = 60 * 1000;
+class JwksCache {
+    cache;
+    constructor() {
+        this.cache = {};
+    }
+    async getKey(issuer, kid) {
+        const now = Date.now();
+        const refresh = async (fallbackKeys) => {
+            const jwks = await this._fetch(issuer);
+            const e = {
+                keys: jwks ? jwks.keys : fallbackKeys,
+                keyObjects: {},
+                fetchedAt: now,
+                expiresAt: now + (jwks ? JWKS_CACHE_TTL : JWKS_RETRY_TTL),
+            };
+            this.cache[issuer] = e;
+            return e;
+        };
+        let entry = this.cache[issuer];
+        if (!entry || entry.expiresAt <= now) {
+            entry = await refresh([]);
+        }
+        const keyObject = entry.keyObjects[kid || ''];
+        if (keyObject)
+            return keyObject;
+        let jwk = this._select(entry.keys, kid);
+        if (!jwk && now - entry.fetchedAt > JWKS_RETRY_TTL) {
+            // unknown kid - keys may have rotated; refetch at most once per JWKS_RETRY_TTL
+            entry = await refresh(entry.keys);
+            jwk = this._select(entry.keys, kid);
+        }
+        if (!jwk)
+            return null;
+        try {
+            const key = node_crypto_1.default.createPublicKey({ key: jwk, format: 'jwk' });
+            entry.keyObjects[kid || ''] = key;
+            return key;
+        }
+        catch {
+            return null;
+        }
+    }
+    async _fetch(issuer) {
+        try {
+            const { request } = require('undici');
+            const { statusCode, body } = await request(`${issuer}${JWKS_PATH}`, {
+                headers: {
+                    accept: 'application/json',
+                },
+            });
+            if (statusCode !== 200) {
+                await body.dump();
+                return null;
+            }
+            const o = (await body.json());
+            if (!o || !Array.isArray(o.keys))
+                return null;
+            return o;
+        }
+        catch {
+            return null;
+        }
+    }
+    _select(keys, kid) {
+        if (!keys || !keys.length)
+            return null;
+        if (kid)
+            return keys.find((k) => k.kid === kid) || null;
+        return keys.find((k) => k.use === 'sig') || keys[0];
+    }
+}
+exports.default = JwksCache;