dsh-jace-remote 0.2.1

package/src/devices.js

@@ -0,0 +1,105 @@
+// dsh-jace-remote — 设备会话：token 签发 / 校验 / 撤销 + state.json 持久化
+import { createHash, randomBytes } from 'node:crypto'
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname } from 'node:path'
+
+const hash = (token) => createHash('sha256').update(token).digest('hex')
+
+export class DeviceStore {
+  /**
+   * @param {object} opts
+   * @param {string} opts.filePath             state.json 路径（0600）
+   * @param {number} [opts.sessionTtlHours=168] 会话有效期（滑动续期）
+   * @param {() => number} [opts.now]
+   */
+  constructor(opts) {
+    this.filePath = opts.filePath
+    this.ttlMs = (opts.sessionTtlHours ?? 168) * 3_600_000
+    this.now = opts.now ?? (() => Date.now())
+    /** @type {Array<{id:string, tokenHash:string, name:string, ip:string, createdAt:number, lastSeenAt:number, expiresAt:number}>} */
+    this.devices = []
+    this.load()
+  }
+
+  load() {
+    try {
+      if (!existsSync(this.filePath)) return
+      const raw = JSON.parse(readFileSync(this.filePath, 'utf8'))
+      if (Array.isArray(raw?.devices)) this.devices = raw.devices.filter((d) => d && typeof d.tokenHash === 'string')
+    } catch {
+      this.devices = []
+    }
+  }
+
+  save() {
+    mkdirSync(dirname(this.filePath), { recursive: true, mode: 0o700 })
+    writeFileSync(this.filePath, JSON.stringify({ version: 1, devices: this.devices }, null, 2), { mode: 0o600 })
+    try { chmodSync(this.filePath, 0o600) } catch { /* best effort */ }
+  }
+
+  /** 清理过期设备；返回被清理数量。 */
+  prune() {
+    const now = this.now()
+    const before = this.devices.length
+    this.devices = this.devices.filter((d) => d.expiresAt > now)
+    return before - this.devices.length
+  }
+
+  /**
+   * 配对成功 → 签发设备 token（只存哈希）。
+   * @returns {{token: string, device: object}}
+   */
+  issue({ name = 'device', ip = '' } = {}) {
+    const token = randomBytes(32).toString('base64url')
+    const tokenHash = hash(token)
+    const now = this.now()
+    const device = {
+      id: tokenHash.slice(0, 12),
+      tokenHash,
+      name,
+      ip,
+      createdAt: now,
+      lastSeenAt: now,
+      expiresAt: now + this.ttlMs,
+    }
+    this.devices.push(device)
+    this.save()
+    return { token, device }
+  }
+
+  /** 校验 token（滑动续期）。返回 device 或 null。 */
+  verify(token) {
+    if (typeof token !== 'string' || token.length < 20) return null
+    const tokenHash = hash(token)
+    const device = this.devices.find((d) => d.tokenHash === tokenHash)
+    if (!device) return null
+    const now = this.now()
+    if (device.expiresAt <= now) {
+      this.revoke(device.id)
+      return null
+    }
+    device.lastSeenAt = now
+    device.expiresAt = now + this.ttlMs
+    this.save()
+    return device
+  }
+
+  list() {
+    return this.devices.map(({ id, name, ip, createdAt, lastSeenAt, expiresAt }) => ({ id, name, ip, createdAt, lastSeenAt, expiresAt }))
+  }
+
+  revoke(id) {
+    const before = this.devices.length
+    this.devices = this.devices.filter((d) => d.id !== id)
+    const removed = before !== this.devices.length
+    if (removed) this.save()
+    return removed
+  }
+
+  revokeAll() {
+    const n = this.devices.length
+    this.devices = []
+    this.save()
+    return n
+  }
+}

package/src/gateway.js

@@ -0,0 +1,286 @@
+// dsh-jace-remote — 局域网网关：配对入口 + 反代 dsh web（HTTP/SSE/WebSocket）
+//
+// 设计要点见 DESIGN.md：
+//  · LAN 客户端只持我方 cookie（jace_remote）；dsh 的会话 cookie 由 UpstreamAuth 内部换出并注入
+//  · 只接受私网源地址；/__jace/* 为网关内部路由，不透传
+//  · WebSocket 走裸 TCP pipe（重写握手头），保证会话流可用
+import http from 'node:http'
+import net from 'node:net'
+import { pairPage } from './html/pair.html.js'
+
+const COOKIE_NAME = 'jace_remote'
+const HOP_BY_HOP = new Set([
+  'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+  'te', 'trailer', 'transfer-encoding', 'upgrade',
+])
+
+export function createGateway({
+  host = '0.0.0.0',
+  port = 3081,
+  upstreamPort,
+  pairing,
+  devices,
+  upstreamAuth,
+  log = () => {},
+  allowPrivateOnly = true,
+  maxBodyBytes = 10 * 1024 * 1024,
+}) {
+  const upstreamOrigin = `http://127.0.0.1:${upstreamPort}`
+
+  // ───────────────────────────── HTTP ─────────────────────────────
+  const server = http.createServer((req, res) => {
+    handleHttp(req, res).catch((err) => {
+      log(`gateway error: ${err?.stack || err}`)
+      if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
+      res.end('gateway error')
+    })
+  })
+
+  async function handleHttp(req, res) {
+    const ip = normalizeIp(req.socket.remoteAddress)
+    if (allowPrivateOnly && !isPrivateIp(ip)) return deny(res, 403, 'forbidden: private network only')
+
+    const url = new URL(req.url, 'http://gateway.invalid')
+    // 设置页状态接口：只对「已配对」设备放行（未配对拿不到配对码）
+    if (url.pathname.startsWith('/__jace/remote/')) {
+      if (!authenticate(req)) {
+        res.writeHead(401, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' })
+        return res.end(pairPage())
+      }
+      const body = await readBody(req, maxBodyBytes)
+      return proxy(req, res, body, { retry: true })
+    }
+    if (url.pathname.startsWith('/__jace/')) return internalRoute(req, res, url, ip)
+
+    const device = authenticate(req)
+    if (!device) {
+      res.writeHead(401, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' })
+      return res.end(pairPage())
+    }
+    const body = await readBody(req, maxBodyBytes)
+    return proxy(req, res, body, { retry: true })
+  }
+
+  async function internalRoute(req, res, url, ip) {
+    const p = url.pathname
+    if (p === '/__jace/health') {
+      return json(res, 200, { ok: true, gateway: 'dsh-jace-remote' })
+    }
+    if (p === '/__jace/me') {
+      const device = authenticate(req)
+      return json(res, 200, { paired: Boolean(device), deviceId: device?.id ?? null })
+    }
+    if (p === '/__jace/pair' && req.method === 'GET') {
+      res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' })
+      return res.end(pairPage())
+    }
+    if (p === '/__jace/pair' && req.method === 'POST') {
+      const body = (await readBody(req, 4096)).toString('utf8')
+      const code = new URLSearchParams(body).get('code') ?? ''
+      const result = pairing.verify(code, ip)
+      if (!result.ok) {
+        const limited = result.reason === 'rate-limited'
+        log(`pair attempt rejected (${result.reason}) from ${ip}`)
+        res.writeHead(limited ? 429 : 401, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' })
+        return res.end(pairPage({
+          error: limited ? '尝试次数过多，请稍后再试。' : '配对码不正确或已过期，请看本机显示的最新码。',
+        }))
+      }
+      const { token, device } = devices.issue({ name: summarizeUa(req.headers['user-agent']), ip })
+      log(`paired new device ${device.id} from ${ip}`)
+      res.writeHead(303, {
+        location: '/',
+        'set-cookie': serializeCookie(token),
+        'cache-control': 'no-store',
+      })
+      return res.end()
+    }
+    if (p === '/__jace/unpair' && req.method === 'POST') {
+      res.writeHead(303, { location: '/', 'set-cookie': `${COOKIE_NAME}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax` })
+      return res.end()
+    }
+    return deny(res, 404, 'not found')
+  }
+
+  // ──────────────────────────── 反代 ────────────────────────────
+  async function proxy(req, res, body, { retry }) {
+    const cookie = await upstreamAuth.ensure()
+    const headers = upstreamHeaders(req.headers, cookie)
+    const upstreamReq = http.request(
+      { host: '127.0.0.1', port: upstreamPort, method: req.method, path: req.url, headers },
+      (upstreamRes) => {
+        if (upstreamRes.statusCode === 401 && retry) {
+          upstreamRes.resume()
+          upstreamAuth.refresh().then(() => proxy(req, res, body, { retry: false })).catch((err) => {
+            log(`re-auth failed: ${err?.message || err}`)
+            deny(res, 502, 'upstream re-auth failed')
+          })
+          return
+        }
+        const outHeaders = { ...upstreamRes.headers }
+        for (const h of HOP_BY_HOP) delete outHeaders[h]
+        delete outHeaders['set-cookie'] // 不把 dsh 的 authority 绑定 cookie 泄给 LAN 客户端
+        res.writeHead(upstreamRes.statusCode ?? 502, outHeaders)
+        upstreamRes.pipe(res)
+      },
+    )
+    upstreamReq.on('error', (err) => {
+      log(`upstream error: ${err?.message || err}`)
+      if (!res.headersSent) deny(res, 502, 'upstream unreachable')
+      else res.end()
+    })
+    if (body.length > 0) upstreamReq.write(body)
+    upstreamReq.end()
+  }
+
+  function upstreamHeaders(clientHeaders, cookie) {
+    const headers = {}
+    for (const [k, v] of Object.entries(clientHeaders)) {
+      const key = k.toLowerCase()
+      if (HOP_BY_HOP.has(key) || key === 'host' || key === 'cookie' || key === 'origin' || key === 'referer') continue
+      headers[k] = v
+    }
+    headers.host = `127.0.0.1:${upstreamPort}`
+    headers.origin = upstreamOrigin
+    if (clientHeaders.referer) headers.referer = upstreamOrigin + '/'
+    if (cookie) headers.cookie = cookie
+    return headers
+  }
+
+  // WebSocket 握手：必须保留 Upgrade / Connection / Sec-WebSocket-* （它们是协议本体，不是 hop-by-hop）
+  function upstreamUpgradeHeaders(clientHeaders, cookie) {
+    const headers = {}
+    for (const [k, v] of Object.entries(clientHeaders)) {
+      const key = k.toLowerCase()
+      if (key === 'host' || key === 'cookie' || key === 'origin' || key === 'referer') continue
+      headers[key] = v
+    }
+    headers.host = `127.0.0.1:${upstreamPort}`
+    headers.origin = upstreamOrigin
+    if (cookie) headers.cookie = cookie
+    return headers
+  }
+
+  // ─────────────────────────── WebSocket ───────────────────────────
+  server.on('upgrade', (req, socket, head) => {
+    const ip = normalizeIp(socket.remoteAddress)
+    if (allowPrivateOnly && !isPrivateIp(ip)) return socket.destroy()
+    if (!authenticate(req)) {
+      socket.write('HTTP/1.1 401 Unauthorized\r\nconnection: close\r\n\r\n')
+      return socket.destroy()
+    }
+    upstreamAuth.ensure().then((cookie) => {
+      const upstream = net.connect(upstreamPort, '127.0.0.1', () => {
+        const lines = [`${req.method} ${req.url} HTTP/1.1`]
+        for (const [k, v] of Object.entries(upstreamUpgradeHeaders(req.headers, cookie))) {
+          for (const item of Array.isArray(v) ? v : [v]) lines.push(`${k}: ${item}`)
+        }
+        upstream.write(lines.join('\r\n') + '\r\n\r\n')
+        if (head?.length) upstream.write(head)
+        upstream.pipe(socket)
+        socket.pipe(upstream)
+      })
+      const bail = () => { upstream.destroy(); socket.destroy() }
+      upstream.on('error', bail)
+      socket.on('error', bail)
+    }).catch((err) => {
+      log(`ws auth failed: ${err?.message || err}`)
+      socket.destroy()
+    })
+  })
+
+  // ──────────────────────────── 工具 ────────────────────────────
+  function authenticate(req) {
+    const cookies = parseCookies(req.headers.cookie)
+    const token = cookies[COOKIE_NAME]
+    return token ? devices.verify(token) : null
+  }
+
+  return {
+    get port() { return server.address()?.port ?? port },
+    start() {
+      return new Promise((resolve, reject) => {
+        server.once('error', reject)
+        server.listen(port, host, () => {
+          server.off('error', reject)
+          log(`gateway listening on ${host}:${server.address().port} → 127.0.0.1:${upstreamPort}`)
+          resolve({ host, port: server.address().port })
+        })
+      })
+    },
+    stop() {
+      return new Promise((resolve) => {
+        server.closeAllConnections?.()
+        server.close(() => resolve())
+      })
+    },
+  }
+}
+
+// ───────────────────────────── 辅助 ─────────────────────────────
+function readBody(req, limit) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    let size = 0
+    req.on('data', (c) => {
+      size += c.length
+      if (size > limit) { reject(new Error('request body too large')); req.destroy(); return }
+      chunks.push(c)
+    })
+    req.on('end', () => resolve(Buffer.concat(chunks)))
+    req.on('error', reject)
+  })
+}
+
+function parseCookies(header) {
+  const out = {}
+  if (typeof header !== 'string') return out
+  for (const part of header.split(';')) {
+    const i = part.indexOf('=')
+    if (i < 0) continue
+    out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim())
+  }
+  return out
+}
+
+function serializeCookie(value) {
+  const maxAge = 7 * 24 * 3600
+  return `${COOKIE_NAME}=${encodeURIComponent(value)}; Path=/; Max-Age=${maxAge}; HttpOnly; SameSite=Lax`
+}
+
+function normalizeIp(addr) {
+  if (!addr) return ''
+  return addr.startsWith('::ffff:') ? addr.slice(7) : addr
+}
+
+export function isPrivateIp(ip) {
+  if (ip === '127.0.0.1' || ip === '::1') return true
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip)
+  if (!m) return /^f[cd][0-9a-f]{2}:/i.test(ip) // fc00::/7（ULA）
+  const [a, b] = [Number(m[1]), Number(m[2])]
+  if (a === 10 || a === 127) return true
+  if (a === 192 && b === 168) return true
+  if (a === 172 && b >= 16 && b <= 31) return true
+  if (a === 169 && b === 254) return true
+  return false
+}
+
+function summarizeUa(ua) {
+  if (typeof ua !== 'string' || ua === '') return 'device'
+  if (/iPhone/i.test(ua)) return 'iPhone'
+  if (/iPad/i.test(ua)) return 'iPad'
+  if (/Android/i.test(ua)) return 'Android'
+  if (/Macintosh/i.test(ua)) return 'Mac'
+  if (/Windows/i.test(ua)) return 'Windows'
+  return 'device'
+}
+
+function json(res, status, payload) {
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+  res.end(JSON.stringify(payload))
+}
+
+function deny(res, status, message) {
+  res.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' })
+  res.end(message)
+}

package/src/html/pair.html.js

@@ -0,0 +1,45 @@
+// dsh-jace-remote — 配对页（零依赖，内联样式；配对码绝不出现在本页）
+export function pairPage({ error = '' } = {}) {
+  const err = error
+    ? `<p class="err">${error}</p>`
+    : ''
+  return `<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1">
+<title>dsh-jace-remote · 配对</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  body { margin:0; min-height:100vh; display:flex; align-items:center; justify-content:center;
+         background:#0b0f19; color:#e6e9ef; font:16px/1.5 -apple-system,BlinkMacSystemFont,"PingFang SC",sans-serif; padding:24px; }
+  .card { width:100%; max-width:360px; background:#141a29; border:1px solid #232b3f; border-radius:16px; padding:28px 24px; }
+  h1 { margin:0 0 6px; font-size:18px; }
+  p.sub { margin:0 0 22px; color:#8b94a8; font-size:13px; }
+  label { display:block; font-size:13px; color:#8b94a8; margin-bottom:8px; }
+  input { width:100%; padding:14px 16px; font-size:28px; letter-spacing:12px; text-align:center;
+          background:#0b0f19; color:#fff; border:1px solid #2c3550; border-radius:12px; outline:none; }
+  input:focus { border-color:#4c7dff; }
+  button { width:100%; margin-top:16px; padding:14px; font-size:16px; font-weight:600; color:#fff;
+           background:#4c7dff; border:0; border-radius:12px; }
+  button:active { transform:translateY(1px); }
+  .err { margin:0 0 16px; padding:10px 12px; font-size:13px; color:#ffb4b4; background:#3a1d22;
+         border:1px solid #5a2a33; border-radius:10px; }
+  .hint { margin-top:18px; font-size:12px; color:#6b7488; }
+</style>
+</head>
+<body>
+  <form class="card" method="POST" action="/__jace/pair" autocomplete="off">
+    <h1>🃏 dsh-jace-remote</h1>
+    <p class="sub">输入本机显示的 4 位配对码</p>
+    ${err}
+    <label for="code">配对码</label>
+    <input id="code" name="code" inputmode="numeric" pattern="[0-9]{4}" maxlength="4"
+           autocomplete="one-time-code" autofocus required placeholder="0000">
+    <button type="submit">配对</button>
+    <p class="hint">配对码会过期并自动更换；配对成功后此设备可在局域网内直接访问。</p>
+  </form>
+</body>
+</html>`
+}