borgmcp-server 0.1.5 → 0.1.8

package/src/debug-log.ts

@@ -21,7 +21,7 @@ export type DebugRoute =
 export type DebugEvent =
   | { readonly event: "startup"; readonly bindMode: "loopback" | "lan"; readonly port: number; readonly dataDirectory: "configured" | "tls_only" }
   | { readonly event: "lifecycle"; readonly action: "listening" | "stopped" }
-  | { readonly event: "request"; readonly route: DebugRoute; readonly method: string; readonly authentication: "not_required" | "missing" | "invalid" | "revoked" | "evicted" | "accepted"; readonly authorization: "not_checked" | "accepted" | "denied_or_not_found"; readonly principal?: Principal; readonly status: number; readonly durationMs: number }
+  | { readonly event: "request"; readonly route: DebugRoute; readonly method: string; readonly authentication: "not_required" | "missing" | "invalid" | "expired" | "revoked" | "evicted" | "rejected" | "accepted"; readonly authorization: "not_checked" | "accepted" | "denied_or_not_found"; readonly principal?: Principal; readonly status: number; readonly durationMs: number }
   | { readonly event: "activity_append"; readonly cubeId: string; readonly entryId: string; readonly principal: Principal; readonly droneId: string | null; readonly visibility: "broadcast" | "direct"; readonly recipientDroneIds: readonly string[] }
   | { readonly event: "cursor_replay"; readonly mode: "page" | "sse"; readonly cubeId: string; readonly cursorId: string | null; readonly returnedCount: number; readonly behindBy: number; readonly truncated: boolean }
   | { readonly event: "ack_write"; readonly cubeId: string; readonly entryId: string; readonly kind: "ack" | "claim"; readonly principal: Principal }
@@ -160,6 +160,6 @@ function enumValue<const T extends string>(value: unknown, allowed: readonly T[]
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
 const DEBUG_ROUTES: readonly DebugRoute[] = ["health", "protocol", "enrollment_exchange", "client_attach", "cubes", "cube", "cube_roles", "cube_role", "cube_role_section_patch", "cube_taxonomy_patch", "cube_drones", "cube_logs", "cube_acks", "cube_decisions", "cube_stream", "unknown"];
 const HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OTHER"] as const;
-const AUTH_RESULTS = ["not_required", "missing", "invalid", "revoked", "evicted", "accepted"] as const;
+const AUTH_RESULTS = ["not_required", "missing", "invalid", "expired", "revoked", "evicted", "rejected", "accepted"] as const;
 const AUTHZ_RESULTS = ["not_checked", "accepted", "denied_or_not_found"] as const;
 const CREDENTIAL_ACTIONS = ["invitation_created", "enrollment_accepted", "enrollment_rejected", "session_created", "session_revoked", "client_rotated", "client_revoked"] as const;

package/src/https-server.ts

@@ -39,7 +39,7 @@ export interface ServiceLimits {
 
 export const DEFAULT_SERVICE_LIMITS: ServiceLimits = {
   maxConnections: 100,
-  maxConnectionsPerAddress: 25,
+  maxConnectionsPerAddress: 30,
   maxRequestsPerWindow: 120,
   maxRequestsPerAddressWindow: 600,
   maxRequestsGlobalWindow: 5_000,
@@ -48,7 +48,7 @@ export const DEFAULT_SERVICE_LIMITS: ServiceLimits = {
   maxStreamsPerCredential: 8,
   maxHeaderBytes: 16_384,
   maxRequestBodyBytes: 65_536,
-  maxRequestsPerSocket: 100,
+  maxRequestsPerSocket: 0,
   requestTimeoutMs: 15_000,
   tlsHandshakeTimeoutMs: 10_000,
   headersTimeoutMs: 10_000,
@@ -63,7 +63,7 @@ export interface RequestHandlerContext {
   readonly authorizeCoordination?: (
     authorization: string | undefined,
     signal: AbortSignal,
-  ) => Promise<Principal | "missing" | "invalid" | "revoked" | "evicted">;
+  ) => Promise<Principal | "missing" | "invalid" | "expired" | "revoked" | "evicted" | "rejected">;
   readonly handleCoordination?: (request: CoordinationRequest) => Promise<CoordinationResponse>;
   readonly debugLogger: DebugLogger;
 }
@@ -82,6 +82,7 @@ export interface HttpsServerOptions {
   readonly debugLogger?: DebugLogger;
   readonly testHooks?: {
     readonly identifyRemoteAddress?: (socket: Socket) => string;
+    readonly identifyConnectionAddress?: (socket: Socket) => string;
   };
 }
 
@@ -100,6 +101,15 @@ export async function startHttpsServer(options: HttpsServerOptions): Promise<Run
   validateLimits(limits);
   validateTlsCertificate(options.tls.cert, bind.host, bind.mode, options.tls.ca);
   const handlerContext = createRequestHandlerContext(options);
+  const identifyRemoteAddress = options.testHooks?.identifyRemoteAddress ??
+    ((socket: Socket) => socket.remoteAddress ?? "unknown");
+  const identifyConnectionAddress = options.testHooks?.identifyConnectionAddress ??
+    ((socket: Socket) => socket.remoteAddress ?? "unknown");
+  const addressConnectionLimiter = new AddressConnectionLimiter(
+    limits.maxConnectionsPerAddress,
+    limits.maxConnections,
+    identifyConnectionAddress,
+  );
 
   const server = createServer(
     {
@@ -112,11 +122,19 @@ export async function startHttpsServer(options: HttpsServerOptions): Promise<Run
       headersTimeout: limits.headersTimeoutMs,
       keepAliveTimeout: limits.keepAliveTimeoutMs,
     },
-    createRequestListener(handlerContext, limits, options.testHooks?.identifyRemoteAddress),
+    createRequestListener(
+      handlerContext,
+      limits,
+      identifyRemoteAddress,
+      (socket) => addressConnectionLimiter.isRejected(socket),
+    ),
   );
 
-  const acceptedSockets = applyServerLimits(server, limits);
-  server.on("secureConnection", (socket) => socket.disableRenegotiation());
+  const acceptedSockets = applyServerLimits(server, limits, addressConnectionLimiter);
+  server.on("secureConnection", (socket) => {
+    socket.disableRenegotiation();
+    addressConnectionLimiter.admit(socket);
+  });
   server.on("tlsClientError", (_error, socket) => {
     handlerContext.debugLogger.emit({ event: "transport_rejection", reason: "tls_client_error" });
     socket.destroy();
@@ -173,6 +191,7 @@ function createRequestListener(
   context: RequestHandlerContext,
   limits: ServiceLimits,
   identifyRemoteAddress: (socket: Socket) => string = (socket) => socket.remoteAddress ?? "unknown",
+  isConnectionRejected: (socket: Socket) => boolean = () => false,
 ): (request: IncomingMessage, response: ServerResponse) => void {
   const admissionLimiter = new PreAuthAdmissionLimiter(limits);
   const credentialRateLimiter = new RequestRateLimiter(limits, limits.maxRequestsPerWindow);
@@ -204,6 +223,11 @@ function createRequestListener(
     };
     response.once("finish", emitDebug);
     response.once("close", emitDebug);
+    if (isConnectionRejected(request.socket)) {
+      request.resume();
+      sendRateLimited(response, 1);
+      return;
+    }
     const controller = new AbortController();
     response.once("close", () => controller.abort());
     let timer: NodeJS.Timeout | undefined;
@@ -343,16 +367,16 @@ async function handleRequest(
         sendJson(response, 410, protocolError(ErrorCode.DRONE_EVICTED, "Authentication failed."));
         return;
       }
-      const code = authentication === "revoked"
-        ? "SESSION_REVOKED"
+      const code = authentication === "expired"
+        ? ErrorCode.AUTH_EXPIRED
+        : authentication === "revoked" ? ErrorCode.SESSION_REVOKED
+        : authentication === "rejected" ? ErrorCode.SESSION_REJECTED
         : authentication === "missing" || authorization === undefined ? "AUTH_MISSING" : "AUTH_INVALID";
       sendJson(response, 401, protocolError(code, "Authentication failed."));
       return;
     }
     trace.principal = authentication;
-    const clientIdentity = `client:${authentication.kind === "drone-session"
-      ? authentication.clientId
-      : authentication.id}`;
+    const clientIdentity = credentialRateLimitIdentity(authentication, request.method, path);
     const credentialRetry = credentialRateLimiter.consume(clientIdentity);
     if (credentialRetry !== null) return sendRateLimited(response, credentialRetry);
     const query = parseCoordinationQuery(request.url, path);
@@ -393,7 +417,7 @@ async function handleRequest(
 interface RequestTrace {
   readonly route: DebugRoute;
   readonly method: string;
-  authentication: "not_required" | "missing" | "invalid" | "revoked" | "evicted" | "accepted";
+  authentication: "not_required" | "missing" | "invalid" | "expired" | "revoked" | "evicted" | "rejected" | "accepted";
   principal?: Principal;
 }
 
@@ -592,7 +616,24 @@ function isCoordinationPath(path: string | null): path is string {
     path?.startsWith("/api/cubes/") === true;
 }
 
-function applyServerLimits(server: HttpsServer, limits: ServiceLimits): Set<Socket> {
+function credentialRateLimitIdentity(
+  principal: Principal,
+  method: string | undefined,
+  path: string,
+): string {
+  const routineRead = (method === "GET" && !path.endsWith("/stream")) ||
+    (method === "PUT" && (path.endsWith("/logs") || path.endsWith("/decisions")));
+  if (principal.kind === "drone-session" && routineRead) {
+    return `drone-session:${principal.id}`;
+  }
+  return `client:${principal.kind === "drone-session" ? principal.clientId : principal.id}`;
+}
+
+function applyServerLimits(
+  server: HttpsServer,
+  limits: ServiceLimits,
+  addressConnectionLimiter: AddressConnectionLimiter,
+): Set<Socket> {
   server.maxConnections = limits.maxConnections;
   server.maxRequestsPerSocket = limits.maxRequestsPerSocket;
   server.requestTimeout = limits.requestTimeoutMs;
@@ -602,27 +643,63 @@ function applyServerLimits(server: HttpsServer, limits: ServiceLimits): Set<Sock
     Math.min(limits.handlerTimeoutMs * 2, 2_147_483_647),
     (socket) => socket.destroy(),
   );
-  const addressConnections = new ConcurrentQuota(limits.maxConnectionsPerAddress);
   const acceptedSockets = new Set<Socket>();
   server.on("connection", (socket) => {
     const tracked = socket as Socket;
     acceptedSockets.add(tracked);
     tracked.once("close", () => acceptedSockets.delete(tracked));
-    const identity = tracked.remoteAddress ?? "unknown";
-    const release = addressConnections.acquire(identity);
+    addressConnectionLimiter.admitRaw(tracked);
+  });
+  return acceptedSockets;
+}
+
+class AddressConnectionLimiter {
+  readonly #rawConnections: ConcurrentQuota;
+  readonly #connections: ConcurrentQuota;
+  readonly #rejected = new WeakSet<Socket>();
+  readonly #identifyRemoteAddress: (socket: Socket) => string;
+
+  constructor(
+    limit: number,
+    globalLimit: number,
+    identifyRemoteAddress: (socket: Socket) => string,
+  ) {
+    // Keep exactly one per-address raw socket available beyond normal secure
+    // admission so it can receive a controlled HTTP 429 after TLS. All later
+    // raw sockets are rejected before they can consume the global pool.
+    this.#rawConnections = new ConcurrentQuota(Math.min(limit + 1, globalLimit));
+    this.#connections = new ConcurrentQuota(limit);
+    this.#identifyRemoteAddress = identifyRemoteAddress;
+  }
+
+  admitRaw(socket: Socket): void {
+    const release = this.#rawConnections.acquire(this.#identifyRemoteAddress(socket));
     if (release === null) {
       socket.destroy();
       return;
     }
     socket.once("close", release);
-  });
-  return acceptedSockets;
+  }
+
+  admit(socket: Socket): void {
+    const release = this.#connections.acquire(this.#identifyRemoteAddress(socket));
+    if (release === null) {
+      this.#rejected.add(socket);
+      return;
+    }
+    socket.once("close", release);
+  }
+
+  isRejected(socket: Socket): boolean {
+    return this.#rejected.has(socket);
+  }
 }
 
 function validateLimits(limits: ServiceLimits): void {
   for (const [name, value] of Object.entries(limits)) {
-    if (!Number.isSafeInteger(value) || value <= 0) {
-      throw new Error(`${name} must be a positive safe integer.`);
+    if (!Number.isSafeInteger(value) || value < 0 || (value === 0 && name !== "maxRequestsPerSocket")) {
+      const range = name === "maxRequestsPerSocket" ? "non-negative" : "positive";
+      throw new Error(`${name} must be a ${range} safe integer.`);
     }
   }
   if (limits.headersTimeoutMs > limits.requestTimeoutMs) {

package/src/migrations.ts

@@ -378,6 +378,29 @@ export const STORE_MIGRATIONS: readonly Migration[] = Object.freeze([
       ) STRICT;
     `,
   },
+  {
+    version: 12,
+    name: "drone_session_supersession",
+    sql: `
+      ALTER TABLE drone_sessions ADD COLUMN superseded_at TEXT;
+
+      WITH lineage AS (
+        SELECT rowid AS session_rowid,
+               LEAD(created_at) OVER (
+                 PARTITION BY client_id, cube_id, drone_id
+                 ORDER BY created_at, rowid
+               ) AS successor_at
+        FROM drone_sessions
+      )
+      UPDATE drone_sessions
+      SET superseded_at = (
+        SELECT successor_at FROM lineage WHERE session_rowid = drone_sessions.rowid
+      )
+      WHERE rowid IN (
+        SELECT session_rowid FROM lineage WHERE successor_at IS NOT NULL
+      );
+    `,
+  },
 ]);
 
 interface AppliedMigrationRow {