bdy 1.22.84 → 1.22.85-beta

package/distTs/src/tunnel/tunnel.js

@@ -46,283 +46,18 @@ const http_1 = __importStar(require("./http"));
 const http2_1 = __importDefault(require("./server/http2"));
 const http1_1 = __importDefault(require("./server/http1"));
 const log_1 = __importDefault(require("./http/log"));
+const auth_1 = __importDefault(require("./http/auth"));
+const config_1 = __importDefault(require("./config"));
 const format_1 = __importDefault(require("../format"));
-const node_crypto_1 = __importDefault(require("node:crypto"));
-const node_zlib_1 = __importDefault(require("node:zlib"));
 const texts_1 = require("../texts");
 const dns_1 = __importDefault(require("./dns"));
 const tunnel_1 = require("../types/tunnel");
-const CIPHER_ALG = 'aes-256-cbc';
-const CIPHER_IV = Buffer.alloc(16).fill(0);
-const COOKIE_NAME = 'jwt_token';
-const ISSUERS = {
-    'https://stage-oidc.buddyusercontent.com': `-----BEGIN CERTIFICATE-----
-MIIEwDCCAqgCFBDp9Im/iI4hjQTeypaLQbZZZs45MA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2J1ZGR5LndvcmtzMCAXDTIzMDIxNjA4MTMyOFoYDzIwNTMwMjA4
-MDgxMzI4WjAhMR8wHQYDVQQDDBYqLmJ1ZGR5dXNlcmNvbnRlbnQuY29tMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvMDTFG4ha//vRxUb/AJpnubUi4Er
-z2TLxCNZBdHPwIqWvygvMHUmTySxMU+a05D/6yHnQiaqnXI0y7nh/ZYmkTqHs985
-3hr5gN/kLmcujo3YtUIm93ZbPHsmaBSlvBSzS1sI8GFE2pqePTo3e/qSWtV6aQBI
-0MTEAMKo3JokOft/9cMbdv212eo1Z7vkHvzO0IyAJ15fm4pX/to+2Xap2aG0M78K
-zVgtYdbJAmhstsGBaYxSr15PeDE0OkirevjRXPcGfyjV501tubGk18CH/hUBO3CB
-QOiAH2q1w8Istxus5xibpWYFHoPJiuZ1BryHHV4vnzkDS2RJ3tE+dXHAfIHIN2q0
-AjyDir0KZPOHLxOr17JsZuAfboVgLcZpmFWnm7hfZ6GfRt77ih9IFNi0doMbHmPx
-9B436oaFTXXQdDdMiFSDel1DyKqe+BBiGyqfg9Dvw6Qk+pS0b6q+e/XZYwG9q8K6
-6r1A+TribcAp0bl6O5XxFRdllEwbY9vbyoRX/bB0aKzhAkoP3Cuh4oss0ueiSwZC
-5NUIGSdHMioGjhIGLNj7hv4pZfwr5cxkwPwO43Vv25qVej+AJJwdlRNXS2MSjTQg
-Z/sVVOXsgJHTDyP7ke388rqsgXjdoacoJkTXUdl0652wkRPl9UQ4InVfyNw24MVc
-9ksePMYUIyW7rI8CAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAa8I0iJ8155ihutvw
-1HEqhWbQokANxCdJ3zfdu6guTjrG9HxD7kuloB3ZyVVQsLdZlZoFfZnpMKtnFK1v
-deDtEoayPiUI6DHURtxFHWOYM/VWJd41s3nIoilApBdESpNI6RQvb7JIXuXCDndc
-pvuZ6U0zMnWTVFK7MVrbxqRDMO/mCTJUKIqNLmGo+6YYfhWy8y3HHdnC86CFUy+T
-IaMuDEuqd3HvpqljgXM8o5cTCYawnQA2PKA36XiJoc+9A00EuVQw0ILQbw3aYaIX
-/PNiq3CCyt1YIjal+zSNMxNnmNEW7H5+arxbT+I8oWDZUR+KyeZJYRjuZGzqfRGt
-hAzRj7HKN0bU4Y97a7GyWaxzMtbunWnl8U+1TsM/9cfNgjKZxMopZCb1n/TfUDMo
-/67xEjDS2B/LcGOWDUEExLXaxCoLtVwk7co+Z4FXmiMDmoJmrE6lbGcMD1Ys+6Td
-el3K5ll/6obgUFZsUMPP6xV2+nFz+LThueWphs1+7s0eD3xanVijSHXS8HF87yvE
-eiq+rBRq7FE0Eqen6spTWFpjrmdBxY5Ti0z14KKXHGJStrpC5KquegwBIj0w/wNY
-O6+HPN73rzfhtkO+A0tAG7el3XtqI0fOXiD1xot84neFJV6/qxyvnRUamJjKCgK2
-X1wqKx71Z3gigILDphu5m3d0RRU=
------END CERTIFICATE-----`,
-    'https://stageeu-oidc.buddyusercontent.com': `-----BEGIN CERTIFICATE-----
-MIIEwDCCAqgCFBDp9Im/iI4hjQTeypaLQbZZZs45MA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2J1ZGR5LndvcmtzMCAXDTIzMDIxNjA4MTMyOFoYDzIwNTMwMjA4
-MDgxMzI4WjAhMR8wHQYDVQQDDBYqLmJ1ZGR5dXNlcmNvbnRlbnQuY29tMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvMDTFG4ha//vRxUb/AJpnubUi4Er
-z2TLxCNZBdHPwIqWvygvMHUmTySxMU+a05D/6yHnQiaqnXI0y7nh/ZYmkTqHs985
-3hr5gN/kLmcujo3YtUIm93ZbPHsmaBSlvBSzS1sI8GFE2pqePTo3e/qSWtV6aQBI
-0MTEAMKo3JokOft/9cMbdv212eo1Z7vkHvzO0IyAJ15fm4pX/to+2Xap2aG0M78K
-zVgtYdbJAmhstsGBaYxSr15PeDE0OkirevjRXPcGfyjV501tubGk18CH/hUBO3CB
-QOiAH2q1w8Istxus5xibpWYFHoPJiuZ1BryHHV4vnzkDS2RJ3tE+dXHAfIHIN2q0
-AjyDir0KZPOHLxOr17JsZuAfboVgLcZpmFWnm7hfZ6GfRt77ih9IFNi0doMbHmPx
-9B436oaFTXXQdDdMiFSDel1DyKqe+BBiGyqfg9Dvw6Qk+pS0b6q+e/XZYwG9q8K6
-6r1A+TribcAp0bl6O5XxFRdllEwbY9vbyoRX/bB0aKzhAkoP3Cuh4oss0ueiSwZC
-5NUIGSdHMioGjhIGLNj7hv4pZfwr5cxkwPwO43Vv25qVej+AJJwdlRNXS2MSjTQg
-Z/sVVOXsgJHTDyP7ke388rqsgXjdoacoJkTXUdl0652wkRPl9UQ4InVfyNw24MVc
-9ksePMYUIyW7rI8CAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAa8I0iJ8155ihutvw
-1HEqhWbQokANxCdJ3zfdu6guTjrG9HxD7kuloB3ZyVVQsLdZlZoFfZnpMKtnFK1v
-deDtEoayPiUI6DHURtxFHWOYM/VWJd41s3nIoilApBdESpNI6RQvb7JIXuXCDndc
-pvuZ6U0zMnWTVFK7MVrbxqRDMO/mCTJUKIqNLmGo+6YYfhWy8y3HHdnC86CFUy+T
-IaMuDEuqd3HvpqljgXM8o5cTCYawnQA2PKA36XiJoc+9A00EuVQw0ILQbw3aYaIX
-/PNiq3CCyt1YIjal+zSNMxNnmNEW7H5+arxbT+I8oWDZUR+KyeZJYRjuZGzqfRGt
-hAzRj7HKN0bU4Y97a7GyWaxzMtbunWnl8U+1TsM/9cfNgjKZxMopZCb1n/TfUDMo
-/67xEjDS2B/LcGOWDUEExLXaxCoLtVwk7co+Z4FXmiMDmoJmrE6lbGcMD1Ys+6Td
-el3K5ll/6obgUFZsUMPP6xV2+nFz+LThueWphs1+7s0eD3xanVijSHXS8HF87yvE
-eiq+rBRq7FE0Eqen6spTWFpjrmdBxY5Ti0z14KKXHGJStrpC5KquegwBIj0w/wNY
-O6+HPN73rzfhtkO+A0tAG7el3XtqI0fOXiD1xot84neFJV6/qxyvnRUamJjKCgK2
-X1wqKx71Z3gigILDphu5m3d0RRU=
------END CERTIFICATE-----`,
-    'https://oidc.buddyusercontent.com': `-----BEGIN CERTIFICATE-----
-MIIEwDCCAqgCFCIRhplNpTZLH9WdAbZus4xHHjPXMA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2J1ZGR5LndvcmtzMCAXDTIzMDIxNjA4MTM1M1oYDzIwNTMwMjA4
-MDgxMzUzWjAhMR8wHQYDVQQDDBYqLmJ1ZGR5dXNlcmNvbnRlbnQuY29tMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuA5ulo8uVKsxLcgIDn3DtnoMdyJv
-BHHl68b1p+SAb4OEN4SlEdl33jy2LMNwr0SS6Mh7VT9tkCUAxDpmImTdsd59qhqu
-5oxCnE5slx5/RmV0/RgCZRjy0phmPIImsMAvBsFY6+c+fPZfxJGs+uWtXXRS1IgI
-LO0BXSqIF2UIst+R787vynmI6UFPaD7bKaJkM79RPanjqvma+y8VvJU2isqz3bjS
-T32842iGlwnkwzz4SfOIiVgKT8HhnZsD5YmtTMPYYghgWj1HtMxOTJ/qEuXiLWfg
-TzqPI6Z2usnUb2lJl/EtEHILLyU4hfYr113nO3VIG6iLZahRttbelqujfWbQXS0w
-nAGn0e4RD5OzG+bu/y4yYBoQ2kRGtFpIH4nXOw43PhKo0rALAllrpQi4p26KYqWk
-r27BuOoZWmB2nkVm2v7vnDa6e2CpwXMaLpIFDANeSoK8Tr+RaHCp1JNMI7zYVejN
-C9bOKL35/Q0gsxWW3BdLL/EtTrwZKGlJtovkBQdFkEmiNnK8tc4BLKDmtYFsf8HZ
-I0jYHwVD90DP9lMJG/VFZl2xUBHKq7UjX/CLgRPc1S5QiqeHFh0kWVilcrVauaTT
-nAX2cG41lxGSH/60zxtOAYqKIdEvvQdHVl3S1AHemENl/ngh9kt2oU5+1Csb/+jG
-zrE5dI3ipDCUNHMCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAuZCIfMcexrKHEcQM
-otb6PXrCEOdiVq+vQuVAQCMfC9MyGcufxLY9+QhuPSVhsyZ1ffZufF6oT+HlQY4z
-5E5CE7kTw1q9Gpu4RHEtlg7ALvpAy+Hfi2sAJy6r6Tqa5hEoi/8qQFgqTn5ooFr2
-SkjK72dx3YkgRsV9P7O9TlteLgwd6POLmrbibvcGB9CiPSL/SmItT2vpASUxow0a
-JiyrbBgPQFaKPocfJJ917Zur1bigdUoCK+S0vq5tOFWrm3HXDIiz5+aB5/cW9/3W
-AXghWYdAStJH9xTIWA7dk8V4SPJjjQWhyG+GxM+oE999K4iPTOpGMjLfG/ZiLKLg
-1Z3gO3wNP2BrhotrAxVRcynvm6552nzDos9ybiq1VPbiz8qLYThNTu/tlw2JbCXw
-PWaM1jh8B2v5Q4NhRKnl3Zz03RtNHwAUYzZLahe47/ADb5/XC86H46NRLHZB3QIO
-wXYcTFrCskkdoGEZwiiqUchYjvWKb9++WHkPGGBaLhAlaCZNTgGXyt8OYJSRwIfT
-YbGYXuZMGUV3U63WZm3fOpHflQPkC9bzmK9MgFshhUlB0xk1vC1dkC2I5jOGJqa0
-3yZghw2R+f5zGZd7TusSmm7Kk8i6mCssRG8B3R8p+6a6GQFeWtqQcUV/dcJVs9sx
-ZbFKWzfs9+m8Y04W4PmzZM2ZAN8=
------END CERTIFICATE-----`,
-    'https://eu-oidc.buddyusercontent.com': `-----BEGIN CERTIFICATE-----
-MIIEwDCCAqgCFCIRhplNpTZLH9WdAbZus4xHHjPXMA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2J1ZGR5LndvcmtzMCAXDTIzMDIxNjA4MTM1M1oYDzIwNTMwMjA4
-MDgxMzUzWjAhMR8wHQYDVQQDDBYqLmJ1ZGR5dXNlcmNvbnRlbnQuY29tMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuA5ulo8uVKsxLcgIDn3DtnoMdyJv
-BHHl68b1p+SAb4OEN4SlEdl33jy2LMNwr0SS6Mh7VT9tkCUAxDpmImTdsd59qhqu
-5oxCnE5slx5/RmV0/RgCZRjy0phmPIImsMAvBsFY6+c+fPZfxJGs+uWtXXRS1IgI
-LO0BXSqIF2UIst+R787vynmI6UFPaD7bKaJkM79RPanjqvma+y8VvJU2isqz3bjS
-T32842iGlwnkwzz4SfOIiVgKT8HhnZsD5YmtTMPYYghgWj1HtMxOTJ/qEuXiLWfg
-TzqPI6Z2usnUb2lJl/EtEHILLyU4hfYr113nO3VIG6iLZahRttbelqujfWbQXS0w
-nAGn0e4RD5OzG+bu/y4yYBoQ2kRGtFpIH4nXOw43PhKo0rALAllrpQi4p26KYqWk
-r27BuOoZWmB2nkVm2v7vnDa6e2CpwXMaLpIFDANeSoK8Tr+RaHCp1JNMI7zYVejN
-C9bOKL35/Q0gsxWW3BdLL/EtTrwZKGlJtovkBQdFkEmiNnK8tc4BLKDmtYFsf8HZ
-I0jYHwVD90DP9lMJG/VFZl2xUBHKq7UjX/CLgRPc1S5QiqeHFh0kWVilcrVauaTT
-nAX2cG41lxGSH/60zxtOAYqKIdEvvQdHVl3S1AHemENl/ngh9kt2oU5+1Csb/+jG
-zrE5dI3ipDCUNHMCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAuZCIfMcexrKHEcQM
-otb6PXrCEOdiVq+vQuVAQCMfC9MyGcufxLY9+QhuPSVhsyZ1ffZufF6oT+HlQY4z
-5E5CE7kTw1q9Gpu4RHEtlg7ALvpAy+Hfi2sAJy6r6Tqa5hEoi/8qQFgqTn5ooFr2
-SkjK72dx3YkgRsV9P7O9TlteLgwd6POLmrbibvcGB9CiPSL/SmItT2vpASUxow0a
-JiyrbBgPQFaKPocfJJ917Zur1bigdUoCK+S0vq5tOFWrm3HXDIiz5+aB5/cW9/3W
-AXghWYdAStJH9xTIWA7dk8V4SPJjjQWhyG+GxM+oE999K4iPTOpGMjLfG/ZiLKLg
-1Z3gO3wNP2BrhotrAxVRcynvm6552nzDos9ybiq1VPbiz8qLYThNTu/tlw2JbCXw
-PWaM1jh8B2v5Q4NhRKnl3Zz03RtNHwAUYzZLahe47/ADb5/XC86H46NRLHZB3QIO
-wXYcTFrCskkdoGEZwiiqUchYjvWKb9++WHkPGGBaLhAlaCZNTgGXyt8OYJSRwIfT
-YbGYXuZMGUV3U63WZm3fOpHflQPkC9bzmK9MgFshhUlB0xk1vC1dkC2I5jOGJqa0
-3yZghw2R+f5zGZd7TusSmm7Kk8i6mCssRG8B3R8p+6a6GQFeWtqQcUV/dcJVs9sx
-ZbFKWzfs9+m8Y04W4PmzZM2ZAN8=
------END CERTIFICATE-----`,
-    'https://as-oidc.buddyusercontent.com': `-----BEGIN CERTIFICATE-----
-MIIEwDCCAqgCFCIRhplNpTZLH9WdAbZus4xHHjPXMA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2J1ZGR5LndvcmtzMCAXDTIzMDIxNjA4MTM1M1oYDzIwNTMwMjA4
-MDgxMzUzWjAhMR8wHQYDVQQDDBYqLmJ1ZGR5dXNlcmNvbnRlbnQuY29tMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuA5ulo8uVKsxLcgIDn3DtnoMdyJv
-BHHl68b1p+SAb4OEN4SlEdl33jy2LMNwr0SS6Mh7VT9tkCUAxDpmImTdsd59qhqu
-5oxCnE5slx5/RmV0/RgCZRjy0phmPIImsMAvBsFY6+c+fPZfxJGs+uWtXXRS1IgI
-LO0BXSqIF2UIst+R787vynmI6UFPaD7bKaJkM79RPanjqvma+y8VvJU2isqz3bjS
-T32842iGlwnkwzz4SfOIiVgKT8HhnZsD5YmtTMPYYghgWj1HtMxOTJ/qEuXiLWfg
-TzqPI6Z2usnUb2lJl/EtEHILLyU4hfYr113nO3VIG6iLZahRttbelqujfWbQXS0w
-nAGn0e4RD5OzG+bu/y4yYBoQ2kRGtFpIH4nXOw43PhKo0rALAllrpQi4p26KYqWk
-r27BuOoZWmB2nkVm2v7vnDa6e2CpwXMaLpIFDANeSoK8Tr+RaHCp1JNMI7zYVejN
-C9bOKL35/Q0gsxWW3BdLL/EtTrwZKGlJtovkBQdFkEmiNnK8tc4BLKDmtYFsf8HZ
-I0jYHwVD90DP9lMJG/VFZl2xUBHKq7UjX/CLgRPc1S5QiqeHFh0kWVilcrVauaTT
-nAX2cG41lxGSH/60zxtOAYqKIdEvvQdHVl3S1AHemENl/ngh9kt2oU5+1Csb/+jG
-zrE5dI3ipDCUNHMCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAuZCIfMcexrKHEcQM
-otb6PXrCEOdiVq+vQuVAQCMfC9MyGcufxLY9+QhuPSVhsyZ1ffZufF6oT+HlQY4z
-5E5CE7kTw1q9Gpu4RHEtlg7ALvpAy+Hfi2sAJy6r6Tqa5hEoi/8qQFgqTn5ooFr2
-SkjK72dx3YkgRsV9P7O9TlteLgwd6POLmrbibvcGB9CiPSL/SmItT2vpASUxow0a
-JiyrbBgPQFaKPocfJJ917Zur1bigdUoCK+S0vq5tOFWrm3HXDIiz5+aB5/cW9/3W
-AXghWYdAStJH9xTIWA7dk8V4SPJjjQWhyG+GxM+oE999K4iPTOpGMjLfG/ZiLKLg
-1Z3gO3wNP2BrhotrAxVRcynvm6552nzDos9ybiq1VPbiz8qLYThNTu/tlw2JbCXw
-PWaM1jh8B2v5Q4NhRKnl3Zz03RtNHwAUYzZLahe47/ADb5/XC86H46NRLHZB3QIO
-wXYcTFrCskkdoGEZwiiqUchYjvWKb9++WHkPGGBaLhAlaCZNTgGXyt8OYJSRwIfT
-YbGYXuZMGUV3U63WZm3fOpHflQPkC9bzmK9MgFshhUlB0xk1vC1dkC2I5jOGJqa0
-3yZghw2R+f5zGZd7TusSmm7Kk8i6mCssRG8B3R8p+6a6GQFeWtqQcUV/dcJVs9sx
-ZbFKWzfs9+m8Y04W4PmzZM2ZAN8=
------END CERTIFICATE-----`,
-    'https://master-oidc.buddyusercontent.com': `-----BEGIN CERTIFICATE-----
-MIIEwDCCAqgCFBDp9Im/iI4hjQTeypaLQbZZZs47MA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2J1ZGR5LndvcmtzMCAXDTIzMDIxNjA4MTM0NVoYDzIwNTMwMjA4
-MDgxMzQ1WjAhMR8wHQYDVQQDDBYqLmJ1ZGR5dXNlcmNvbnRlbnQuY29tMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAyHdEa5QrqJVIAESbgkIMw/pPAJ1R
-kIlin/BQBn43YmcIpw/uFSPol9M5S9WkVMESWhM+wk3V+byiAULOm7FQ5N1AqRMa
-msxmuFenDJQEtEZ/Ca/HQXSOqwUG0TTIE5OZxuJy0SlEIjNPE56cJhp/ojOkvhXn
-mdPtjPI8sslF4CXAHW8qTa/N9L66ro5WMEVba/XGzdySOSN3z8ycr1583ZVXPK7x
-nvo/LrskdbPIjNz8firGp2OBsM0qeINmTUBLFVkWRj4PGgcCGRd1bV4C085obtep
-0Cg/xZen3TQmoAFFsGVSO/3FP/lNv598HrzyHQKN/d2pl1d06NUl7mM7SLdHCbvi
-3zVe1Ntr01QJuQGo3Uv9v4D6j1urzN25ghSfjOzjmTJjpGIwHfKJlVy674laq7mT
-KBnkpwmOgvbPSaaYQ8ik72PuLb73IWkxIaQ4Hr0pqUw00CDLO9p1gcz/biktxhxj
-d48SzS0tQXQMTSKZYWWzfh+Q5rCwVKozzyHPHSJuLxetrtxEcnt5OQFqKu3bcCwI
-xoFLpl5BQjBTrvigOO2ElQxGz2+N7W9zu5VLOl0nCw5MQwN9KXyVHVEYYbC3Mmnq
-RSuudH/25SuYMaEkIUoQa7vgJmwPJ4uWVSExO9fnOmA0L0GM+1WbU3BgEp3FUVSw
-x4QPC1swwlhkVkkCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEApZEjwNCxWHxuAMwE
-jvlEouPs+yZsaxxIC44kKuwNacvk5pV4lC4w59pDTlZghgQwGvT7YlU0GfNrZbJi
-2mREXH2DQt2GPv0roFYJGfT+tranbmmozJXdohSqllcM6Ev2f5I5Y7AkZePX3vAE
-aY0CJzBq9WTnfEjZCOcrkuI4hSccZ53R2DMm3IU2SBfwJlY5HwFLOokwUOgbVMCN
-O5szeNqGgdJjeNGwzCN3u0GwnKNhbvz02FsL+LSe2Mj9K5y5B950DIK6Nuj79nbj
-48uYcplsLBB7g1977QlTBnUVASy859Uajydla6RREw6ZPESVkZHXXJ7+2ek+vnnt
-5RHcbfnR+79MaKfUyVrtHmqtr5osvjhPQ9m9cmQG9UzoidKbxbYm6b6HbNRL5v79
-YNO/12X5pH5h5lc5iFc/0S5NQuOq1OT7lzZNcE0H87rvIvThW0U/X4KVqYj7XY90
-z2U1X+SDiq8ldzXtUYIJnl9J4v+I+u9iyJqYHYBBjj3Wn1NTzuE3ZDEBiwguuVUN
-aKEbQvoT3Eh8nNw3v/BVThjTpa+pMWlI6XpMi9rcN8/edLgaCbMaO059KJTwx4hq
-gUkjwZKhdE4s4pAn1BF644kkVdx2FXzdtmTfYWx1Rnsp1T0sxlzgMWltMd8wAuzS
-5cMq3aQmM1PRT/Q2XYwq7FhiiUg=
------END CERTIFICATE-----`,
-    'https://sls-oidc.buddyusercontent.com': `-----BEGIN CERTIFICATE-----
-MIIEwDCCAqgCFBDp9Im/iI4hjQTeypaLQbZZZs45MA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2J1ZGR5LndvcmtzMCAXDTIzMDIxNjA4MTMyOFoYDzIwNTMwMjA4
-MDgxMzI4WjAhMR8wHQYDVQQDDBYqLmJ1ZGR5dXNlcmNvbnRlbnQuY29tMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvMDTFG4ha//vRxUb/AJpnubUi4Er
-z2TLxCNZBdHPwIqWvygvMHUmTySxMU+a05D/6yHnQiaqnXI0y7nh/ZYmkTqHs985
-3hr5gN/kLmcujo3YtUIm93ZbPHsmaBSlvBSzS1sI8GFE2pqePTo3e/qSWtV6aQBI
-0MTEAMKo3JokOft/9cMbdv212eo1Z7vkHvzO0IyAJ15fm4pX/to+2Xap2aG0M78K
-zVgtYdbJAmhstsGBaYxSr15PeDE0OkirevjRXPcGfyjV501tubGk18CH/hUBO3CB
-QOiAH2q1w8Istxus5xibpWYFHoPJiuZ1BryHHV4vnzkDS2RJ3tE+dXHAfIHIN2q0
-AjyDir0KZPOHLxOr17JsZuAfboVgLcZpmFWnm7hfZ6GfRt77ih9IFNi0doMbHmPx
-9B436oaFTXXQdDdMiFSDel1DyKqe+BBiGyqfg9Dvw6Qk+pS0b6q+e/XZYwG9q8K6
-6r1A+TribcAp0bl6O5XxFRdllEwbY9vbyoRX/bB0aKzhAkoP3Cuh4oss0ueiSwZC
-5NUIGSdHMioGjhIGLNj7hv4pZfwr5cxkwPwO43Vv25qVej+AJJwdlRNXS2MSjTQg
-Z/sVVOXsgJHTDyP7ke388rqsgXjdoacoJkTXUdl0652wkRPl9UQ4InVfyNw24MVc
-9ksePMYUIyW7rI8CAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAa8I0iJ8155ihutvw
-1HEqhWbQokANxCdJ3zfdu6guTjrG9HxD7kuloB3ZyVVQsLdZlZoFfZnpMKtnFK1v
-deDtEoayPiUI6DHURtxFHWOYM/VWJd41s3nIoilApBdESpNI6RQvb7JIXuXCDndc
-pvuZ6U0zMnWTVFK7MVrbxqRDMO/mCTJUKIqNLmGo+6YYfhWy8y3HHdnC86CFUy+T
-IaMuDEuqd3HvpqljgXM8o5cTCYawnQA2PKA36XiJoc+9A00EuVQw0ILQbw3aYaIX
-/PNiq3CCyt1YIjal+zSNMxNnmNEW7H5+arxbT+I8oWDZUR+KyeZJYRjuZGzqfRGt
-hAzRj7HKN0bU4Y97a7GyWaxzMtbunWnl8U+1TsM/9cfNgjKZxMopZCb1n/TfUDMo
-/67xEjDS2B/LcGOWDUEExLXaxCoLtVwk7co+Z4FXmiMDmoJmrE6lbGcMD1Ys+6Td
-el3K5ll/6obgUFZsUMPP6xV2+nFz+LThueWphs1+7s0eD3xanVijSHXS8HF87yvE
-eiq+rBRq7FE0Eqen6spTWFpjrmdBxY5Ti0z14KKXHGJStrpC5KquegwBIj0w/wNY
-O6+HPN73rzfhtkO+A0tAG7el3XtqI0fOXiD1xot84neFJV6/qxyvnRUamJjKCgK2
-X1wqKx71Z3gigILDphu5m3d0RRU=
------END CERTIFICATE-----`,
-    '*': `-----BEGIN CERTIFICATE-----
-MIIEwDCCAqgCFBDp9Im/iI4hjQTeypaLQbZZZs45MA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2J1ZGR5LndvcmtzMCAXDTIzMDIxNjA4MTMyOFoYDzIwNTMwMjA4
-MDgxMzI4WjAhMR8wHQYDVQQDDBYqLmJ1ZGR5dXNlcmNvbnRlbnQuY29tMIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvMDTFG4ha//vRxUb/AJpnubUi4Er
-z2TLxCNZBdHPwIqWvygvMHUmTySxMU+a05D/6yHnQiaqnXI0y7nh/ZYmkTqHs985
-3hr5gN/kLmcujo3YtUIm93ZbPHsmaBSlvBSzS1sI8GFE2pqePTo3e/qSWtV6aQBI
-0MTEAMKo3JokOft/9cMbdv212eo1Z7vkHvzO0IyAJ15fm4pX/to+2Xap2aG0M78K
-zVgtYdbJAmhstsGBaYxSr15PeDE0OkirevjRXPcGfyjV501tubGk18CH/hUBO3CB
-QOiAH2q1w8Istxus5xibpWYFHoPJiuZ1BryHHV4vnzkDS2RJ3tE+dXHAfIHIN2q0
-AjyDir0KZPOHLxOr17JsZuAfboVgLcZpmFWnm7hfZ6GfRt77ih9IFNi0doMbHmPx
-9B436oaFTXXQdDdMiFSDel1DyKqe+BBiGyqfg9Dvw6Qk+pS0b6q+e/XZYwG9q8K6
-6r1A+TribcAp0bl6O5XxFRdllEwbY9vbyoRX/bB0aKzhAkoP3Cuh4oss0ueiSwZC
-5NUIGSdHMioGjhIGLNj7hv4pZfwr5cxkwPwO43Vv25qVej+AJJwdlRNXS2MSjTQg
-Z/sVVOXsgJHTDyP7ke388rqsgXjdoacoJkTXUdl0652wkRPl9UQ4InVfyNw24MVc
-9ksePMYUIyW7rI8CAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAa8I0iJ8155ihutvw
-1HEqhWbQokANxCdJ3zfdu6guTjrG9HxD7kuloB3ZyVVQsLdZlZoFfZnpMKtnFK1v
-deDtEoayPiUI6DHURtxFHWOYM/VWJd41s3nIoilApBdESpNI6RQvb7JIXuXCDndc
-pvuZ6U0zMnWTVFK7MVrbxqRDMO/mCTJUKIqNLmGo+6YYfhWy8y3HHdnC86CFUy+T
-IaMuDEuqd3HvpqljgXM8o5cTCYawnQA2PKA36XiJoc+9A00EuVQw0ILQbw3aYaIX
-/PNiq3CCyt1YIjal+zSNMxNnmNEW7H5+arxbT+I8oWDZUR+KyeZJYRjuZGzqfRGt
-hAzRj7HKN0bU4Y97a7GyWaxzMtbunWnl8U+1TsM/9cfNgjKZxMopZCb1n/TfUDMo
-/67xEjDS2B/LcGOWDUEExLXaxCoLtVwk7co+Z4FXmiMDmoJmrE6lbGcMD1Ys+6Td
-el3K5ll/6obgUFZsUMPP6xV2+nFz+LThueWphs1+7s0eD3xanVijSHXS8HF87yvE
-eiq+rBRq7FE0Eqen6spTWFpjrmdBxY5Ti0z14KKXHGJStrpC5KquegwBIj0w/wNY
-O6+HPN73rzfhtkO+A0tAG7el3XtqI0fOXiD1xot84neFJV6/qxyvnRUamJjKCgK2
-X1wqKx71Z3gigILDphu5m3d0RRU=
------END CERTIFICATE-----`,
-};
 class Tunnel extends events_1.default {
     agent;
     id;
-    cipherKey;
     sshHostKey;
-    type;
-    region;
-    target;
-    whitelist;
-    domain;
-    subdomain;
-    name;
-    timeout;
-    useragents;
-    headers;
-    responseHeaders;
-    terminate;
-    key;
-    cert;
-    ca;
-    host;
-    login;
-    password;
-    authType;
-    serve;
-    circuitBreaker;
-    log;
-    verify;
-    compression;
-    http2;
-    sshIp;
-    sshId;
-    sshPort;
-    sshUser;
-    sshPassword;
-    sshForwardPort;
-    sshClientUser;
-    sshClientPassword;
-    targetProto;
-    targetHost;
-    targetPort;
-    targetAuth;
+    config;
+    auth;
     totalConnections;
     status;
     connections;
@@ -337,128 +72,129 @@ class Tunnel extends events_1.default {
     sshServer;
     ssh;
     started;
-    httpAuthClient;
-    constructor({ agent, id, type, target, region, timeout, domain, name, subdomain, whitelist, tlsSettings, httpSettings, sshSettings, sshHostKey, }) {
+    constructor({ agent, id, sshHostKey, ...options }) {
         super();
-        this.httpAuthClient = {};
         if (!sshHostKey)
             sshHostKey = require('../sshKeygen').createSshHostKey();
         this.agent = agent;
         this.id = id;
-        this.cipherKey = node_crypto_1.default
-            .createHash('sha512')
-            .update(this.id)
-            .digest('hex')
-            .substring(0, 32);
         this.sshHostKey = sshHostKey;
-        this.create({
-            type,
-            target,
-            region,
-            timeout,
-            domain,
-            subdomain,
-            name,
-            whitelist,
-            tlsSettings,
-            httpSettings,
-            sshSettings,
-        });
+        this.auth = new auth_1.default(this);
+        this.config = new config_1.default(options);
+        this.resetState();
     }
-    create({ type, target, region, timeout, domain, subdomain, name, whitelist, tlsSettings, httpSettings, sshSettings, }) {
-        this.type = type;
-        this.region = region;
-        this.target = target;
-        this.whitelist = whitelist || [];
-        this.domain = domain;
-        this.subdomain = subdomain;
-        this.name = name;
-        this.timeout = timeout || utils_1.DEFAULT_TIMEOUT;
-        this.useragents = [];
-        this.headers = [];
-        this.responseHeaders = [];
-        if (tlsSettings) {
-            this.terminate = tlsSettings.terminate;
-            this.key = tlsSettings.key;
-            this.cert = tlsSettings.cert;
-            this.ca = tlsSettings.ca;
-        }
-        if (httpSettings) {
-            this.host = httpSettings.host;
-            if (httpSettings.authType) {
-                this.authType = httpSettings.authType;
-                if (this.authType === tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BASIC) {
-                    this.login = httpSettings.login || '';
-                    this.password = httpSettings.password || '';
-                }
-            }
-            else if (httpSettings.login || httpSettings.password) {
-                this.authType = tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BASIC;
-                this.login = httpSettings.login || '';
-                this.password = httpSettings.password || '';
-            }
-            else {
-                this.authType = tunnel_1.TUNNEL_HTTP_AUTH_TYPE.NONE;
-            }
-            this.ca = httpSettings.ca;
-            this.serve = httpSettings.serve;
-            this.useragents = httpSettings.userAgents || [];
-            this.headers = httpSettings.headers || [];
-            this.responseHeaders = httpSettings.responseHeaders || [];
-            this.circuitBreaker = httpSettings.circuitBreaker;
-            this.log = httpSettings.log;
-            this.verify = httpSettings.verify;
-            this.compression = httpSettings.compression;
-            this.http2 = httpSettings.http2;
-        }
-        if (sshSettings) {
-            this.sshIp = sshSettings.ip;
-            this.sshId = sshSettings.sshId;
-            this.sshPort = sshSettings.port;
-            this.sshUser = sshSettings.user;
-            this.sshPassword = sshSettings.password;
-            this.sshForwardPort = sshSettings.forwardPort;
-            this.sshClientUser = sshSettings.clientUser;
-            this.sshClientPassword = sshSettings.clientPassword;
-        }
-        this.targetProto = 'http';
-        this.targetHost = 'localhost';
-        this.targetPort = 80;
-        this.targetAuth = null;
-        if (this.type === tunnel_1.TUNNEL_TYPE.HTTP) {
-            let m = this.target.match(utils_1.TARGET_ONLY_PORT_REGEX);
-            if (m) {
-                this.targetPort = parseInt(m[0], 10);
-            }
-            else {
-                m = this.target.match(utils_1.TARGET_HTTP_REGEX);
-                if (m) {
-                    if (m[2])
-                        this.targetProto = m[2];
-                    if (m[6])
-                        this.targetPort = parseInt(m[6], 10);
-                    else if (this.targetProto === 'https')
-                        this.targetPort = 443;
-                    if (m[4])
-                        this.targetHost = m[4];
-                    if (m[3])
-                        this.targetAuth = m[3].replace(/@$/, '');
-                }
-            }
-        }
-        else if (this.type === tunnel_1.TUNNEL_TYPE.SSH) {
-            this.targetHost = 'localhost';
-            this.targetProto = 'ssh://';
-            this.targetPort = 22;
-        }
-        else {
-            const m = this.target.match(utils_1.TARGET_TCP_TLS_REGEX);
-            if (m) {
-                this.targetPort = parseInt(m[3], 10);
-                if (m[2])
-                    this.targetHost = m[2];
-            }
-        }
+    get type() {
+        return this.config.type;
+    }
+    get region() {
+        return this.config.region;
+    }
+    get target() {
+        return this.config.target;
+    }
+    get whitelist() {
+        return this.config.whitelist;
+    }
+    get domain() {
+        return this.config.domain;
+    }
+    get subdomain() {
+        return this.config.subdomain;
+    }
+    get name() {
+        return this.config.name;
+    }
+    get timeout() {
+        return this.config.timeout;
+    }
+    get useragents() {
+        return this.config.useragents;
+    }
+    get headers() {
+        return this.config.headers;
+    }
+    get responseHeaders() {
+        return this.config.responseHeaders;
+    }
+    get terminate() {
+        return this.config.terminate;
+    }
+    get key() {
+        return this.config.key;
+    }
+    get cert() {
+        return this.config.cert;
+    }
+    get ca() {
+        return this.config.ca;
+    }
+    get host() {
+        return this.config.host;
+    }
+    get login() {
+        return this.config.login;
+    }
+    get password() {
+        return this.config.password;
+    }
+    get authType() {
+        return this.config.authType;
+    }
+    get serve() {
+        return this.config.serve;
+    }
+    get circuitBreaker() {
+        return this.config.circuitBreaker;
+    }
+    get log() {
+        return this.config.log;
+    }
+    get verify() {
+        return this.config.verify;
+    }
+    get compression() {
+        return this.config.compression;
+    }
+    get http2() {
+        return this.config.http2;
+    }
+    get sshIp() {
+        return this.config.sshIp;
+    }
+    get sshId() {
+        return this.config.sshId;
+    }
+    get sshPort() {
+        return this.config.sshPort;
+    }
+    get sshUser() {
+        return this.config.sshUser;
+    }
+    get sshPassword() {
+        return this.config.sshPassword;
+    }
+    get sshForwardPort() {
+        return this.config.sshForwardPort;
+    }
+    get sshClientUser() {
+        return this.config.sshClientUser;
+    }
+    get sshClientPassword() {
+        return this.config.sshClientPassword;
+    }
+    get targetProto() {
+        return this.config.targetProto;
+    }
+    get targetHost() {
+        return this.config.targetHost;
+    }
+    get targetPort() {
+        return this.config.targetPort;
+    }
+    get targetAuth() {
+        return this.config.targetAuth;
+    }
+    resetState() {
         this.connections = {};
         this.totalConnections = 0;
         this.status = tunnel_1.TUNNEL_STATUS.CLOSED;
@@ -474,134 +210,16 @@ class Tunnel extends events_1.default {
         this.ssh = null;
         this.started = false;
     }
-    recreate({ type, target, region, timeout, domain, subdomain, name, whitelist, tlsSettings, httpSettings, sshSettings, }) {
+    recreate(options) {
         const started = this.started;
         this.stop(false);
-        this.create({
-            type,
-            target,
-            region,
-            timeout,
-            domain,
-            subdomain,
-            name,
-            whitelist,
-            tlsSettings,
-            httpSettings,
-            sshSettings,
-        });
+        this.config = new config_1.default(options);
+        this.resetState();
         if (started)
             this.start();
     }
     hasChanged(data) {
-        const tunnel = new Tunnel({
-            ...data,
-            sshHostKey: this.sshHostKey,
-        });
-        const diff = (field, a, b) => {
-            logger_1.default.debug(`Tunnel '${this.id}' hasChanged: ${field} (running=${JSON.stringify(a)} incoming=${JSON.stringify(b)})`);
-            return true;
-        };
-        if (this.type !== tunnel.type)
-            return diff('type', this.type, tunnel.type);
-        if (this.target !== tunnel.target)
-            return diff('target', this.target, tunnel.target);
-        if (this.region !== tunnel.region)
-            return diff('region', this.region, tunnel.region);
-        if (this.timeout !== tunnel.timeout)
-            return diff('timeout', this.timeout, tunnel.timeout);
-        if (this.domain !== tunnel.domain)
-            return diff('domain', this.domain, tunnel.domain);
-        if (this.subdomain !== tunnel.subdomain)
-            return diff('subdomain', this.subdomain, tunnel.subdomain);
-        if (this.terminate !== tunnel.terminate)
-            return diff('terminate', this.terminate, tunnel.terminate);
-        if (this.key !== tunnel.key)
-            return diff('key', this.key, tunnel.key);
-        if (this.cert !== tunnel.cert)
-            return diff('cert', this.cert, tunnel.cert);
-        if (this.ca !== tunnel.ca)
-            return diff('ca', this.ca, tunnel.ca);
-        if (this.host !== tunnel.host)
-            return diff('host', this.host, tunnel.host);
-        if (this.login !== tunnel.login)
-            return diff('login', this.login, tunnel.login);
-        if (this.password !== tunnel.password)
-            return diff('password', this.password, tunnel.password);
-        if (this.serve !== tunnel.serve)
-            return diff('serve', this.serve, tunnel.serve);
-        if (this.circuitBreaker !== tunnel.circuitBreaker)
-            return diff('circuitBreaker', this.circuitBreaker, tunnel.circuitBreaker);
-        if (this.log !== tunnel.log)
-            return diff('log', this.log, tunnel.log);
-        if (this.verify !== tunnel.verify)
-            return diff('verify', this.verify, tunnel.verify);
-        if (this.http2 !== tunnel.http2)
-            return diff('http2', this.http2, tunnel.http2);
-        if (this.compression !== tunnel.compression)
-            return diff('compression', this.compression, tunnel.compression);
-        if (this.sshIp !== tunnel.sshIp)
-            return diff('sshIp', this.sshIp, tunnel.sshIp);
-        if (this.sshId !== tunnel.sshId)
-            return diff('sshId', this.sshId, tunnel.sshId);
-        if (this.sshPort !== tunnel.sshPort)
-            return diff('sshPort', this.sshPort, tunnel.sshPort);
-        if (this.sshUser !== tunnel.sshUser)
-            return diff('sshUser', this.sshUser, tunnel.sshUser);
-        if (this.sshPassword !== tunnel.sshPassword)
-            return diff('sshPassword', this.sshPassword, tunnel.sshPassword);
-        if (this.sshForwardPort !== tunnel.sshForwardPort)
-            return diff('sshForwardPort', this.sshForwardPort, tunnel.sshForwardPort);
-        if (this.sshClientPassword !== tunnel.sshClientPassword)
-            return diff('sshClientPassword', this.sshClientPassword, tunnel.sshClientPassword);
-        if (this.sshClientUser !== tunnel.sshClientUser)
-            return diff('sshClientUser', this.sshClientUser, tunnel.sshClientUser);
-        if (this.whitelist?.length !== tunnel.whitelist?.length)
-            return diff('whitelist.length', this.whitelist, tunnel.whitelist);
-        if (this.whitelist && tunnel.whitelist) {
-            this.whitelist.sort();
-            tunnel.whitelist.sort();
-            for (let i = 0; i < this.whitelist.length; i += 1) {
-                if (this.whitelist[i] !== tunnel.whitelist[i])
-                    return diff('whitelist', this.whitelist, tunnel.whitelist);
-            }
-        }
-        if (this.useragents?.length !== tunnel.useragents?.length)
-            return diff('useragents.length', this.useragents, tunnel.useragents);
-        if (this.useragents && tunnel.useragents) {
-            this.useragents.sort();
-            tunnel.useragents.sort();
-            for (let i = 0; i < this.useragents.length; i += 1) {
-                if (this.useragents[i] !== tunnel.useragents[i])
-                    return diff('useragents', this.useragents, tunnel.useragents);
-            }
-        }
-        const sortHeaders = (a, b) => a.name.localeCompare(b.name);
-        if (this.headers?.length !== tunnel.headers?.length)
-            return diff('headers.length', this.headers, tunnel.headers);
-        if (this.headers && tunnel.headers) {
-            this.headers.sort(sortHeaders);
-            tunnel.headers.sort(sortHeaders);
-            for (let i = 0; i < this.headers.length; i += 1) {
-                const thisH = this.headers[i];
-                const tunnelH = tunnel.headers[i];
-                if (thisH.name !== tunnelH.name || thisH.value !== tunnelH.value)
-                    return diff('headers', this.headers, tunnel.headers);
-            }
-        }
-        if (this.responseHeaders?.length !== tunnel.responseHeaders?.length)
-            return diff('responseHeaders.length', this.responseHeaders, tunnel.responseHeaders);
-        if (this.responseHeaders && tunnel.responseHeaders) {
-            this.responseHeaders.sort(sortHeaders);
-            tunnel.responseHeaders.sort(sortHeaders);
-            for (let i = 0; i < this.responseHeaders.length; i += 1) {
-                const thisRH = this.responseHeaders[i];
-                const tunnelRH = tunnel.responseHeaders[i];
-                if (thisRH.name !== tunnelRH.name || thisRH.value !== tunnelRH.value)
-                    return diff('responseHeaders', this.responseHeaders, tunnel.responseHeaders);
-            }
-        }
-        return false;
+        return this.config.changed(new config_1.default(data), this.id);
     }
     async sshConnected() {
         try {
@@ -631,7 +249,7 @@ class Tunnel extends events_1.default {
         if (!this.totalConnections)
             this.totalConnections = 0;
         this.totalConnections += 1;
-        const tcp = new tcp_1.default(this.targetHost || '', this.targetPort || 0, stream);
+        const tcp = new tcp_1.default(this.targetHost, this.targetPort, stream);
         if (!this.connections)
             this.connections = {};
         this.connections[tcp.id] = tcp;
@@ -663,319 +281,13 @@ class Tunnel extends events_1.default {
         }
         this.emit(tunnel_1.TUNNEL_EVENT.HTTP_CLOSED, this);
     }
-    async httpBasicAuth(req, res) {
-        if (this.authType === tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BASIC) {
-            const user = require('basic-auth')(req);
-            if (user && user.name === this.login && user.pass === this.password) {
-                // tunnel consumed the credentials; don't leak them to the target
-                delete req.headers.authorization;
-                return true;
-            }
-            const authorized = await this._checkHttpPat(req, res, false);
-            if (authorized) {
-                // tunnel consumed the credentials; don't leak them to the target
-                delete req.headers.authorization;
-                return true;
-            }
-            logger_1.default.debug(texts_1.LOG_TUNNEL_HTTP_WRON_AUTH);
-            this.httpEndFast(req, res, 401, 'Unauthorised', {
-                'WWW-Authenticate': 'Basic real="Buddy"',
-            });
-            return false;
-        }
-        return true;
-    }
-    async _checkHttpPat(req, res, setCookie) {
-        const user = require('basic-auth')(req);
-        if (!user || !user.name || !user.pass)
-            return false;
-        const client = this._getHttpAuthClient();
-        let ipAddress;
-        if (req.httpVersion === '2.0') {
-            ipAddress = req.socket.stream ? req.socket.stream.remoteAddress : '::1';
-        }
-        else {
-            ipAddress = req.socket.remoteAddress;
-        }
-        try {
-            const { statusCode, body } = await client.request({
-                path: `/tunnel/auth/pat`,
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                },
-                body: JSON.stringify({
-                    id: this.id,
-                    agentId: this.agent.id,
-                    login: user.name,
-                    password: user.pass,
-                    ipAddress,
-                }),
-            });
-            if (statusCode !== 200) {
-                await body.dump();
-                return false;
-            }
-            const result = (await body.json());
-            if (!result.success)
-                return false;
-            if (setCookie)
-                this._httpSetAuthCookie(res, result.token);
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
-    _getHttpAuthClient() {
-        const host = this.agent.host;
-        if (!this.httpAuthClient[host]) {
-            const { Pool: UndiciPool } = require('undici');
-            this.httpAuthClient[host] = new UndiciPool(host, {
-                connect: {
-                    rejectUnauthorized: false,
-                },
-            });
-        }
-        return this.httpAuthClient[host];
-    }
-    async _httpExchangeAuthCode(code, verifier) {
-        const client = this._getHttpAuthClient();
-        try {
-            const r = await client.request({
-                path: `/external-api/auth/token?grant_type=authorization_code`,
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                },
-                body: JSON.stringify({
-                    code,
-                    verifier,
-                }),
-            });
-            const o = (await r.body.json());
-            if (o.accessToken) {
-                return o.accessToken;
-            }
-        }
-        catch {
-            // do nothing
-        }
-        return '';
-    }
-    async _httpParseAuthToken(token) {
-        return new Promise((resolve, reject) => {
-            const msg = 'Invalid authorization token';
-            if (!token) {
-                reject(new Error(msg));
-                return;
-            }
-            const data = require('jsonwebtoken').decode(token);
-            if (!data || !data.iss) {
-                reject(new Error(msg));
-                return;
-            }
-            let cert;
-            if (ISSUERS[data.iss])
-                cert = ISSUERS[data.iss];
-            else
-                cert = ISSUERS['*'];
-            require('jsonwebtoken').verify(token, cert, {
-                complete: true,
-                issuer: data.iss,
-            }, (err, data) => {
-                if (err || !data) {
-                    reject(new Error(msg));
-                    return;
-                }
-                const payload = data.payload;
-                if (!payload.tunnelId ||
-                    !payload.userId ||
-                    payload.aud !== 'tunnels' ||
-                    payload.sub !== 'tunnel_read') {
-                    reject(new Error(msg));
-                    return;
-                }
-                resolve({
-                    tunnelId: payload.tunnelId,
-                    userId: payload.userId,
-                    token,
-                });
-            });
-        });
-    }
-    _httpSetAuthCookie(res, token) {
-        res.setHeader('set-cookie', require('cookie').serialize(COOKIE_NAME, token, {
-            maxAge: 3600,
-            path: '/',
-            secure: true,
-            httpOnly: true,
-            sameSite: 'lax',
-        }));
-    }
-    _checkHttpAuthTokenRedirect(req, res, code, state, accessToken, url) {
-        if ((code || accessToken) && state && url) {
-            const u2 = new URL(url);
-            const currentHost = req.headers['x-forwarded-host'] || req.headers.host || req.headers[':authority'] || '';
-            const currentUrl = `https://${currentHost}`;
-            const originalUrl = `https://${u2.host}`;
-            if (currentUrl !== originalUrl) {
-                let newUrl = `${originalUrl}?state=${encodeURIComponent(state)}`;
-                if (code)
-                    newUrl += `&code=${encodeURIComponent(code)}`;
-                else if (accessToken)
-                    newUrl += `&access_token=${encodeURIComponent(accessToken)}`;
-                this.httpEndFast(req, res, 302, 'Found', {
-                    location: newUrl,
-                });
-                return true;
-            }
-        }
-        return false;
-    }
-    async _checkHttpAuthToken(code, verifier, token, req, res) {
-        let fromCookie = false;
-        if (code && verifier && !token) {
-            token = await this._httpExchangeAuthCode(code, verifier);
-        }
-        if (!token) {
-            const cookies = require('cookie').parse(req.headers.cookie || '');
-            token = cookies[COOKIE_NAME] || '';
-            fromCookie = true;
-        }
-        if (!token) {
-            return false;
-        }
-        try {
-            const data = await this._httpParseAuthToken(token);
-            if (data.tunnelId !== this.id) {
-                return false;
-            }
-            if (!data.userId) {
-                return false;
-            }
-            if (fromCookie) {
-                return true;
-            }
-            this._httpSetAuthCookie(res, token);
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
-    _httpEncryptState(url, verifier) {
-        try {
-            const cipher = node_crypto_1.default.createCipheriv(CIPHER_ALG, Buffer.from(this.cipherKey), Buffer.from(CIPHER_IV));
-            const compressed = node_zlib_1.default.deflateRawSync(JSON.stringify({ url, verifier }));
-            const enc = Buffer.concat([cipher.update(compressed), cipher.final()]);
-            return enc.toString('base64url');
-        }
-        catch {
-            // do nothing
-        }
-        return '';
-    }
-    _httpDecryptState(state) {
-        let url = null;
-        let verifier = null;
-        if (state) {
-            try {
-                const decipher = node_crypto_1.default.createDecipheriv(CIPHER_ALG, Buffer.from(this.cipherKey), Buffer.from(CIPHER_IV));
-                const dec = Buffer.concat([decipher.update(Buffer.from(state, 'base64url')), decipher.final()]);
-                const json = JSON.parse(node_zlib_1.default.inflateRawSync(dec).toString('utf8'));
-                if (json) {
-                    if (json.url)
-                        url = json.url;
-                    if (json.verifier)
-                        verifier = json.verifier;
-                }
-            }
-            catch {
-                // do nothing
-            }
-        }
-        return {
-            url,
-            verifier,
-        };
-    }
     _requiresAuthCacheControl() {
         return (this.authType === tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BASIC ||
             this.authType === tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BUDDY);
     }
-    _redirectHttpToBuddyAuth(pathname, search, req, res) {
-        let host = this.agent.host;
-        if (/^https:\/\/\d+\.\d+\.\d+\.\d+$/.test(host)) {
-            host = 'https://app.local.io';
-        }
-        const verifier = require('uuid').v4();
-        const challenge = node_crypto_1.default
-            .createHash('sha256')
-            .update(verifier)
-            .digest('hex');
-        const callback = `https://${this.subdomain}.${(this.region || '').toLowerCase()}-${this.sshId}.${this.domain}`;
-        let redirect;
-        if (req.headers['x-forwarded-host']) {
-            if (req.headers['x-forwarded-proto'] === 'http') {
-                redirect = 'http://';
-            }
-            else {
-                redirect = 'https://';
-            }
-            redirect += req.headers['x-forwarded-host'];
-        }
-        else {
-            redirect = callback;
-        }
-        redirect += pathname;
-        if (search)
-            redirect += search;
-        const enc = this._httpEncryptState(redirect, verifier);
-        let url = `${host}/tunnel/auth?redirect_url=${encodeURIComponent(callback)}&id=${encodeURIComponent(this.id)}&agentId=${encodeURIComponent(this.agent.id)}&challenge=${encodeURIComponent(challenge)}&state=${encodeURIComponent(enc)}`;
-        if (/app\.local\.io/.test(host)) {
-            url += '&response_type=token';
-        }
-        this.httpEndFast(req, res, 302, 'Found', {
-            location: url,
-        });
-    }
-    async httpBuddyAuth(req, res) {
-        if (this.authType === tunnel_1.TUNNEL_HTTP_AUTH_TYPE.BUDDY) {
-            const { searchParams, pathname, search } = new URL(req.url, 'https://abc.com');
-            const code = searchParams.get('code') || '';
-            const state = searchParams.get('state') || '';
-            const token = searchParams.get('access_token') || '';
-            const { url, verifier } = this._httpDecryptState(state);
-            const redirectByAuthToken = this._checkHttpAuthTokenRedirect(req, res, code, state, token, url);
-            if (redirectByAuthToken) {
-                return false;
-            }
-            const authByToken = await this._checkHttpAuthToken(code, verifier || '', token, req, res);
-            if (authByToken) {
-                if (url) {
-                    this.httpEndFast(req, res, 302, 'Found', {
-                        location: url,
-                    });
-                    return false;
-                }
-                return true;
-            }
-            if (url && verifier && (code || token)) {
-                this.httpEndFast(req, res, 404, 'Not found');
-                return false;
-            }
-            const auth = require('basic-auth')(req);
-            if (auth) {
-                const authorized = await this._checkHttpPat(req, res, true);
-                if (authorized) {
-                    return true;
-                }
-            }
-            this._redirectHttpToBuddyAuth(pathname, search, req, res);
-            return false;
-        }
-        return true;
+    httpEndFastJson(req, res, statusCode, obj, headers = {}) {
+        headers['content-type'] = 'application/json';
+        this.httpEndFast(req, res, statusCode, JSON.stringify(obj), headers);
     }
     httpEndFast(req, res, statusCode, msg, headers = {}) {
         if (this._requiresAuthCacheControl() && !headers['cache-control']) {
@@ -1074,8 +386,10 @@ class Tunnel extends events_1.default {
         }
     }
     async httpRequest(req, res) {
-        const isAuth = (await this.httpBasicAuth(req, res)) &&
-            (await this.httpBuddyAuth(req, res)) &&
+        if (await this.auth.buddyAuthMe(req, res))
+            return;
+        const isAuth = (await this.auth.basicAuth(req, res)) &&
+            (await this.auth.buddyAuth(req, res)) &&
             this.httpUserAgent(req, res) &&
             this.httpRateLimit(req, res) &&
             this.httpCircuitBreaker(req, res);
@@ -1229,7 +543,7 @@ class Tunnel extends events_1.default {
         this.regionLatency.startChecking();
         // target latency
         if (!this.serve && this.type !== tunnel_1.TUNNEL_TYPE.SSH) {
-            this.targetLatency = new latency_1.default(this.targetHost || '', this.targetPort || 0);
+            this.targetLatency = new latency_1.default(this.targetHost, this.targetPort);
             this.targetLatency.on(tunnel_1.TUNNEL_EVENT_LATENCY.RECONNECTED, () => this.targetReconnected());
             this.targetLatency.startChecking();
         }
@@ -1249,7 +563,7 @@ class Tunnel extends events_1.default {
             this.httpLog = new log_1.default(this.log, this.circuitBreaker);
             this.httpLog.on(tunnel_1.TUNNEL_EVENT_HTTP.NEW_REQUEST, (logRequest) => this.httpLogRequest(logRequest));
             this.httpLog.on(tunnel_1.TUNNEL_EVENT_HTTP.NEW_RESPONSE, (logRequest) => this.httpLogResponse(logRequest));
-            this.identify = new identification_1.default(this.targetProto || '', this.targetHost || '', this.targetPort || 0, this.http2 || !!this.serve);
+            this.identify = new identification_1.default(this.targetProto, this.targetHost, this.targetPort, this.http2 || !!this.serve);
             this.identify.on(tunnel_1.TUNNEL_EVENT.IDENTIFIED, (type) => this.httpIdentified(type));
             const host = format_1.default.entryHostEncoded(this);
             this.http2server = new http2_1.default(host);