dscs-server 0.0.0-stage → 0.0.1

package/README.md

@@ -1,3 +1,26 @@
-# Temporary Holding Version
+# dscs-server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+DSH Session CloudSync 的自部署服务端。
+
+## 安装
+
+```sh
+npm i -g dscs-server
+dscs-server serve --data-dir /var/lib/dscs --host 127.0.0.1 --port 8787
+```
+
+首次启动会在控制台打印一次性初始化密钥，同时写入数据目录的 `onboarding-code.json`。打开 `http://127.0.0.1:8787/admin` 完成管理密码、配额和设备初始化。
+
+Linux/macOS 也可以使用仓库的 `scripts/install.sh`；Windows 使用 `scripts/install.ps1`。安装脚本会把版本装到独立目录，并可选注册 systemd 或计划任务。
+
+## 要求
+
+- Node.js >= 24；
+- 默认只监听 `127.0.0.1`，公网部署请放在 TLS 反代后；
+- 数据目录包含 SQLite 与 blob 文件，升级前请备份；
+- 服务端不持有明文会话内容，只存不透明密文；
+- 协议说明见仓库 `docs/architecture/PROTOCOL.md`。
+
+## 许可证
+
+AGPL-3.0-only。

package/dist/blobs.js

@@ -0,0 +1,50 @@
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+export function blobPath(dataDir, sha256) {
+    return join(dataDir, 'blobs', sha256.slice(0, 2), sha256);
+}
+export async function putBlob(dataDir, bytes) {
+    const sha256 = createHash('sha256').update(bytes).digest('hex');
+    const target = blobPath(dataDir, sha256);
+    try {
+        await stat(target);
+        return {
+            sha256,
+            bytes: bytes.length
+        };
+    } catch  {}
+    await mkdir(dirname(target), {
+        recursive: true
+    });
+    const temp = `${target}.tmp-${process.pid}-${Date.now()}`;
+    await writeFile(temp, bytes);
+    try {
+        await rename(temp, target);
+    } catch (error) {
+        await unlink(temp).catch(()=>undefined);
+        try {
+            await stat(target);
+        } catch  {
+            throw error;
+        }
+    }
+    return {
+        sha256,
+        bytes: bytes.length
+    };
+}
+export async function hasBlob(dataDir, sha256) {
+    try {
+        await stat(blobPath(dataDir, sha256));
+        return true;
+    } catch  {
+        return false;
+    }
+}
+export async function readBlob(dataDir, sha256) {
+    return readFile(blobPath(dataDir, sha256));
+}
+
+
+//# sourceURL=blobs.ts

package/dist/db.js

@@ -0,0 +1,262 @@
+import { randomBytes } from 'node:crypto';
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+export const DEFAULT_DATASET = 'default';
+export const SERVER_SCHEMA_VERSION = 3;
+const SCHEMA_VERSION = SERVER_SCHEMA_VERSION;
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS meta (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS devices (
+  dataset TEXT NOT NULL,
+  device_id TEXT NOT NULL,
+  label TEXT NOT NULL,
+  token_hash TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  last_seen_at INTEGER,
+  revoked_at INTEGER,
+  PRIMARY KEY (dataset, device_id)
+);
+
+CREATE TABLE IF NOT EXISTS sessions (
+  dataset TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  format_version INTEGER NOT NULL,
+  last_seq INTEGER NOT NULL,
+  frame_count INTEGER NOT NULL,
+  head_chain_hash TEXT NOT NULL,
+  manifest_json TEXT NOT NULL,
+  manifest_digest TEXT NOT NULL,
+  revision INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  deleted_at INTEGER,
+  PRIMARY KEY (dataset, session_id)
+);
+
+CREATE TABLE IF NOT EXISTS blobs (
+  sha256 TEXT PRIMARY KEY,
+  bytes INTEGER NOT NULL,
+  kind TEXT NOT NULL,
+  created_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS leases (
+  dataset TEXT NOT NULL,
+  resource TEXT NOT NULL,
+  device_id TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  lease_until INTEGER NOT NULL,
+  PRIMARY KEY (dataset, resource)
+);
+
+CREATE TABLE IF NOT EXISTS vault_records (
+  dataset TEXT NOT NULL,
+  writer TEXT NOT NULL,
+  seq INTEGER NOT NULL,
+  prev_hash TEXT,
+  blob_sha256 TEXT NOT NULL,
+  bytes INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  sealed_json TEXT NOT NULL,
+  record_hash TEXT NOT NULL,
+  revision INTEGER NOT NULL,
+  PRIMARY KEY (dataset, writer, seq)
+);
+
+CREATE INDEX IF NOT EXISTS vault_records_revision ON vault_records (dataset, revision);
+
+CREATE TABLE IF NOT EXISTS tombstones (
+  dataset TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  deleted_at INTEGER NOT NULL,
+  deleted_by TEXT NOT NULL,
+  PRIMARY KEY (dataset, session_id, created_at)
+);
+`;
+function tableExists(handle, table) {
+    const row = handle.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+    return row !== undefined;
+}
+function tableColumns(handle, table) {
+    const rows = handle.prepare(`PRAGMA table_info(${table})`).all();
+    return new Set(rows.map((row)=>row.name).filter((name)=>typeof name === 'string'));
+}
+function anyUserTable(handle) {
+    const row = handle.prepare("SELECT count(*) AS count FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").get();
+    return Number(row?.count ?? 0) > 0;
+}
+function assertV2Sessions(handle) {
+    const columns = tableColumns(handle, 'sessions');
+    const required = [
+        'created_at',
+        'format_version',
+        'last_seq',
+        'frame_count',
+        'head_chain_hash',
+        'manifest_json',
+        'manifest_digest',
+        'revision',
+        'updated_at'
+    ];
+    const missing = required.filter((column)=>!columns.has(column));
+    if (missing.length > 0) {
+        throw new Error(`不支持的旧数据库：sessions 缺少 ${missing.join(', ')}；请先导出现有数据，再用新数据目录重建。`);
+    }
+}
+function backupBeforeMigration(handle, dataDir, version) {
+    const target = join(dataDir, `db.sqlite.bak-v${version}-${Date.now()}`);
+    handle.exec(`VACUUM INTO '${target.replaceAll("'", "''")}'`);
+}
+function migrateDatabase(handle, dataDir, version) {
+    if (version > SCHEMA_VERSION) {
+        throw new Error(`数据库结构版本 ${version} 高于服务端支持的 ${SCHEMA_VERSION}；请升级服务端，不要降级覆盖。`);
+    }
+    if (version === SCHEMA_VERSION) {
+        handle.exec(SCHEMA);
+        return;
+    }
+    let sourceVersion = version;
+    if (version === 0) {
+        if (!anyUserTable(handle)) {
+            handle.exec(SCHEMA);
+            handle.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+            return;
+        }
+        if (tableExists(handle, 'frames') || tableExists(handle, 'session_frames')) {
+            throw new Error('检测到未版本化的旧帧结构（frames/session_frames）；该结构未作为发布版本支持，拒绝自动迁移。请导出数据后重建。');
+        }
+        if (!tableExists(handle, 'sessions')) {
+            handle.exec(SCHEMA);
+            handle.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+            return;
+        }
+        sourceVersion = 2;
+    }
+    if (sourceVersion !== 2 && sourceVersion !== 3) {
+        throw new Error(`不支持的数据库结构版本 ${sourceVersion}；请使用对应版本的服务端迁移。`);
+    }
+    assertV2Sessions(handle);
+    backupBeforeMigration(handle, dataDir, sourceVersion);
+    handle.exec('BEGIN IMMEDIATE');
+    try {
+        const leaseColumns = tableColumns(handle, 'leases');
+        if (!leaseColumns.has('resource') || !leaseColumns.has('client_id')) {
+            handle.exec('DROP TABLE IF EXISTS leases');
+        }
+        handle.exec(SCHEMA);
+        handle.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+        handle.exec('COMMIT');
+    } catch (error) {
+        handle.exec('ROLLBACK');
+        throw error;
+    }
+}
+export function openDatabase(dataDir) {
+    mkdirSync(dataDir, {
+        recursive: true
+    });
+    const handle = new DatabaseSync(join(dataDir, 'db.sqlite'));
+    try {
+        handle.exec('PRAGMA journal_mode = WAL');
+        handle.exec('PRAGMA foreign_keys = ON');
+        const versionRow = handle.prepare('PRAGMA user_version').get();
+        migrateDatabase(handle, dataDir, Number(versionRow?.user_version ?? 0));
+        return {
+            handle,
+            close: ()=>handle.close()
+        };
+    } catch (error) {
+        handle.close();
+        throw error;
+    }
+}
+export function readMeta(db, key) {
+    const row = db.handle.prepare('SELECT value FROM meta WHERE key = ?').get(key);
+    return row?.value;
+}
+export function writeMeta(db, key, value) {
+    db.handle.prepare('INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(key, value);
+}
+export function ensureSetupToken(db) {
+    const existing = readMeta(db, 'setup_token');
+    if (existing !== undefined) return {
+        token: existing,
+        created: false
+    };
+    const token = randomBytes(32).toString('base64url');
+    writeMeta(db, 'setup_token', token);
+    return {
+        token,
+        created: true
+    };
+}
+export function isAdminInitialized(db) {
+    return readMeta(db, 'admin_initialized') === 'true';
+}
+export function markAdminInitialized(db) {
+    writeMeta(db, 'admin_initialized', 'true');
+}
+export function adminPassword(db) {
+    const hash = readMeta(db, 'admin_password_hash');
+    const salt = readMeta(db, 'admin_password_salt');
+    return hash === undefined || salt === undefined ? undefined : {
+        hash,
+        salt
+    };
+}
+export function setAdminPassword(db, hash, salt) {
+    writeMeta(db, 'admin_password_hash', hash);
+    writeMeta(db, 'admin_password_salt', salt);
+}
+export function clearAdminPassword(db) {
+    db.handle.prepare("DELETE FROM meta WHERE key IN ('admin_password_hash', 'admin_password_salt', 'admin_initialized')").run();
+}
+export function readMaxBytes(db, fallback) {
+    const value = readMeta(db, 'max_bytes');
+    const parsed = Number(value);
+    return value !== undefined && Number.isSafeInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+export function writeMaxBytes(db, maxBytes) {
+    writeMeta(db, 'max_bytes', String(maxBytes));
+}
+export function readRevision(db) {
+    return Number(readMeta(db, 'revision') ?? '0');
+}
+export function bumpRevision(db) {
+    const row = db.handle.prepare("INSERT INTO meta (key, value) VALUES ('revision', '1') ON CONFLICT(key) DO UPDATE SET value = CAST(CAST(meta.value AS INTEGER) + 1 AS TEXT) RETURNING CAST(value AS INTEGER) AS revision").get();
+    return Number(row?.revision ?? 1);
+}
+export function usedBlobBytes(db) {
+    const row = db.handle.prepare('SELECT COALESCE(SUM(bytes), 0) AS total FROM blobs').get();
+    return Number(row?.total ?? 0);
+}
+export function withTransaction(db, fn) {
+    db.handle.exec('BEGIN IMMEDIATE');
+    try {
+        const result = fn();
+        db.handle.exec('COMMIT');
+        return result;
+    } catch (error) {
+        db.handle.exec('ROLLBACK');
+        throw error;
+    }
+}
+export function blobRecord(db, sha256) {
+    const row = db.handle.prepare('SELECT bytes, kind FROM blobs WHERE sha256 = ?').get(sha256);
+    return row === undefined ? undefined : {
+        bytes: Number(row.bytes),
+        kind: String(row.kind)
+    };
+}
+export function recordBlob(db, sha256, bytes, kind) {
+    db.handle.prepare('INSERT OR IGNORE INTO blobs (sha256, bytes, kind, created_at) VALUES (?, ?, ?, ?)').run(sha256, bytes, kind, Date.now());
+}
+
+
+//# sourceURL=db.ts