dsh-mesh-access 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -143,3 +143,17 @@
 - **客户端半边**：`sidebar.panellist` + `main` 两个槽位的面板（状态、开/关端口、手机地址与复制、
   首次使用星空组网的提示），每 5 秒轮询一次。
 - **没有构建步骤**：两边都是普通的 ESM / 浏览器 JS，所以发布出去的包就是源码本身。
+
+## 1.4.0 — 入口登录收进插件：密钥 / 账号密码 / 关闭
+
+- 公网地址的门锁从 nginx 挪进插件本身：服务器只做转发，零配置零账号。
+- 三种模式（面板「入口登录」卡片切换，立即生效）：
+  - **密钥（推荐，无弹窗）**：面板给一次性地址（带 `?meshkey=`），手机打开一次，
+    30 天内该设备免登录、全程没有登录框；怀疑泄露随时「重置」，旧密钥立即作废。
+  - **账号密码**：浏览器弹窗登录一次，24 小时内**仅该设备**免登录，其他设备各自登录；
+    改账号密码会把所有已登录设备踢下线。
+  - **关闭**：不加门锁，只剩 DSH 自己的 token 一层。
+- 认证状态存本机 `~/.config/frp/dsh-mesh-access.json`（侧车），密码 scrypt 哈希，密钥仅本地可见。
+- 拿不到有效凭据的请求一律 404 伪装（密钥模式）/ 401 弹窗（账号密码模式），WebSocket 升级同样先过门锁。
+- `x-forwarded-proto` 透传：https 域名下种 cookie 自动带 `Secure`。
+- frps-setup.sh 不再生成 nginx Basic 账密（认证归插件）。

package/lib/client.js

@@ -67,6 +67,8 @@ window.__ModuleLoader__.load({
     const api = {
       status: () => fetchJson('/api/dsh-mesh-access/status', {}, 6000),
       tunnel: () => fetchJson('/api/dsh-mesh-access/tunnel', {}, 8000),
+      auth: () => fetchJson('/api/dsh-mesh-access/auth', {}, 8000),
+      authPost: (body) => fetchJson('/api/dsh-mesh-access/auth', { method: 'POST', body: JSON.stringify(body) }, 20000),
       tunnelAction: (action) =>
         fetchJson('/api/dsh-mesh-access/tunnel', {
           method: 'POST',
@@ -97,6 +99,10 @@ window.__ModuleLoader__.load({
     function Panel() {
       const [state, setState] = react.useState(null)
       const [tunnel, setTunnel] = react.useState(null)
+      const [auth, setAuth] = react.useState(null)
+      const [authBusy, setAuthBusy] = react.useState(false)
+      const [authErr, setAuthErr] = react.useState(null)
+      const [authForm, setAuthForm] = react.useState({ username: '', password: '' })
       const [busy, setBusy] = react.useState(false)
       const [tunnelBusy, setTunnelBusy] = react.useState(false)
       const [err, setErr] = react.useState(null)
@@ -117,6 +123,10 @@ window.__ModuleLoader__.load({
           .tunnel()
           .then((t) => setTunnel(t))
           .catch(() => {})
+        api
+          .auth()
+          .then((a) => setAuth(a))
+          .catch(() => {})
       }, [])
 
       react.useEffect(() => {
@@ -357,6 +367,79 @@ window.__ModuleLoader__.load({
             : null,
         ),
 
+        h(
+          Card, { title: '入口登录（公网地址的门锁）' },
+          (() => {
+            const a = auth || {}
+            const runAuth = (body, okMsg) => {
+              setAuthBusy(true); setAuthErr(null); setAuthMsg(null)
+              api.authPost(body)
+                .then((r) => {
+                  setAuthBusy(false)
+                  if (r && r.ok === false) { setAuthErr(r.error || '失败'); return }
+                  setAuth(r); if (okMsg) setAuthMsg(okMsg)
+                })
+                .catch((e) => { setAuthBusy(false); setAuthErr(String(e && e.message ? e.message : e)) })
+            }
+            const setMode = (mode) => runAuth({ mode },
+              mode === 'key' ? '已切到密钥模式：手机打开下面带 meshkey 的地址一次，30 天内免登录、无弹窗'
+              : mode === 'basic' ? '已切到账号密码模式：弹窗登录一次，24 小时内该设备免登录'
+              : '已关闭入口登录：任何知道地址的人都能打开，请确认你接受')
+            const firstUrl = tn.urlPlain && a.key ? tn.urlPlain + '?meshkey=' + encodeURIComponent(a.key) : null
+            const modeBtn = (m, label) => h('button', {
+              style: (a.mode === m ? S.btnPrimary : S.btn),
+              disabled: authBusy || a.mode === m, onClick: () => setMode(m),
+            }, label)
+            return h('div', null,
+              h('div', { style: S.row },
+                modeBtn('key', '密钥（无弹窗）'),
+                modeBtn('basic', '账号密码'),
+                modeBtn('off', '关闭（危险）'),
+              ),
+              authMsg ? h('div', { style: { ...S.hint, color: '#7ee787', marginTop: 8 } }, authMsg) : null,
+              a.mode === 'key'
+                ? h('div', { style: { marginTop: 10 } },
+                    h('div', { style: S.hint }, '密钥（只读，可复制；怀疑泄露就点重置，旧密钥立即作废）：'),
+                    h('div', { style: S.row, marginTop: 6 },
+                      h('input', { style: { ...S.input, ...S.mono, flex: 1 }, readOnly: true, value: a.key || '', onFocus: (e) => e.target.select() }),
+                      h('button', { style: S.btn, onClick: () => copy(a.key) }, copied ? '已复制' : '复制'),
+                      h('button', { style: S.btn, disabled: authBusy, onClick: () => { if (window.confirm('重置后旧密钥立刻作废，所有用旧密钥的设备都要重新认证。继续？')) runAuth({ resetKey: true }, '已重置：用新地址重新认证各设备') } }, '重置'),
+                    ),
+                    firstUrl ? h('div', { style: { marginTop: 8 } },
+                      h('div', { style: S.hint }, '手机首次打开（认证一次，30 天内该设备免登录、无弹窗）：'),
+                      h('div', { style: S.row, marginTop: 6 },
+                        h('code', { style: { ...S.mono, wordBreak: 'break-all', flex: 1 } }, firstUrl),
+                        h('button', { style: S.btn, onClick: () => copy(firstUrl) }, copied ? '已复制' : '复制'),
+                      ),
+                    ) : null,
+                  )
+                : null,
+              a.mode === 'basic'
+                ? h('div', { style: { marginTop: 10 } },
+                    h('div', { style: S.row, gap: 10 },
+                      h('div', null, h('label', { style: S.label }, '账号'),
+                        h('input', { style: S.input, value: authForm.username, placeholder: a.username || 'dsh', onChange: (e) => setAuthForm(Object.assign({}, authForm, { username: e.target.value })) })),
+                      h('div', null, h('label', { style: S.label }, '新密码（6 位起）'),
+                        h('input', { style: S.input, type: 'password', value: authForm.password, onChange: (e) => setAuthForm(Object.assign({}, authForm, { password: e.target.value })) })),
+                    ),
+                    h('div', { style: S.row, marginTop: 8 },
+                      h('button', {
+                        style: S.btnPrimary, disabled: authBusy || !authForm.password,
+                        onClick: () => {
+                          if (authForm.password.length < 6) { setAuthErr('密码至少 6 位'); return }
+                          runAuth({ username: authForm.username || a.username, password: authForm.password }, '已保存，立即生效；所有已登录设备被踢下线')
+                          setAuthForm({ username: '', password: '' })
+                        },
+                      }, '保存（立即生效）'),
+                    ),
+                    h('div', { style: S.hint }, '弹窗输一次账密，这台设备 24 小时内免登录；其他设备仍要各自登录。改密码会把所有设备踢下线。'),
+                  )
+                : null,
+              a.mode === 'off' ? h('div', { style: { ...S.hint, marginTop: 8, color: '#f85149' } }, '入口登录已关闭：只剩 DSH 自己的 token 一层，任何拿到地址的人都能看到登录页。') : null,
+              authErr ? h('div', { style: S.err, marginTop: 8 }, authErr) : null,
+            )
+          })(),
+        ),
         h(
           Card, { title: '第一次用星空组网？' },
           h('div', { style: S.hint }, '三步走，不用记 IP，也不用改任何配置。'),

package/lib/index.js

@@ -20,6 +20,7 @@ import fs from 'node:fs'
 import http from 'node:http'
 import net from 'node:net'
 import path from 'node:path'
+import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto'
 import { spawn } from 'node:child_process'
 
 export const name = 'dsh-mesh-access'
@@ -90,7 +91,7 @@ function readBody(req, limit = 8 * 1024) {
  * Host 改写成上游 authority —— dsh 的 /api 信任栅栏比对的是 Host，
  * 而 cookie 里的 authority 也按这个 Host 签发，两边一致才不会互相打架。
  */
-function createProxy({ listenAddress, listenPort, upstream, upstreamPort }) {
+function createProxy({ listenAddress, listenPort, upstream, upstreamPort, authGate }) {
   const target = `${upstream}:${upstreamPort}`
   // DSH 会校验 Origin 与 Host 是否一致（不一致直接 403），所以我们转发时把 Host 改写成
   // 上游地址，就必须把 Origin 一起改写成上游的 origin；否则浏览器的 WebSocket 升级
@@ -104,12 +105,19 @@ function createProxy({ listenAddress, listenPort, upstream, upstreamPort }) {
     const incomingHost = headers.host ?? ''
     h.host = target
     h['x-forwarded-host'] = incomingHost
-    h['x-forwarded-proto'] = 'http'
+    h['x-forwarded-proto'] = headers['x-forwarded-proto'] || 'http'
     if (headers.origin) h.origin = upstreamOrigin
     return h
   }
 
   const server = http.createServer((req, res) => {
+    const gate = authGate(req)
+    if (gate && gate.status) {
+      res.writeHead(gate.status, gate.headers)
+      res.end(gate.body || '')
+      return
+    }
+    const extra = gate && gate.extraHeaders
     const up = http.request(
       { host: upstream, port: upstreamPort, method: req.method, path: req.url, headers: rewrite(req.headers) },
       (r) => {
@@ -119,6 +127,14 @@ function createProxy({ listenAddress, listenPort, upstream, upstreamPort }) {
         if (r.statusCode === 200 && CACHEABLE.test(req.url || '')) {
           headers['cache-control'] = 'public, max-age=31536000, immutable'
         }
+        if (extra) {
+          for (const [k, v] of Object.entries(extra)) {
+            if (k.toLowerCase() === 'set-cookie') {
+              const prev = headers['set-cookie']
+              headers['set-cookie'] = prev ? [].concat(prev, v) : v
+            } else headers[k] = v
+          }
+        }
         res.writeHead(r.statusCode ?? 502, headers)
         r.pipe(res)
       },
@@ -132,6 +148,13 @@ function createProxy({ listenAddress, listenPort, upstream, upstreamPort }) {
 
   // WebSocket / HTTP upgrade：裸 socket 双向转发（DSH 的实时通道靠它）
   server.on('upgrade', (req, socket, head) => {
+    const gate = authGate(req)
+    if (gate && gate.status) {
+      socket.write(`HTTP/1.1 ${gate.status} ${gate.status === 404 ? 'Not Found' : 'Unauthorized'}\r\n` +
+        Object.entries(gate.headers).map(([k, v]) => `${k}: ${v}`).join('\r\n') + '\r\nConnection: close\r\n\r\n')
+      socket.destroy()
+      return
+    }
     socket.setNoDelay(true)
     socket.setKeepAlive(true, 30_000)
     const up = net.connect(upstreamPort, upstream, () => {
@@ -560,6 +583,101 @@ transport.useEncryption = true
     }
   }
 
+  // ===== 公网入口认证（1.4.0）：关 / 账号密码 / 密钥，全在本机，面板改完即生效 =====
+  const genKey = () => randomBytes(32).toString('base64url')
+  const hashPassword = (pass) => {
+    const salt = randomBytes(16).toString('hex')
+    return 'scrypt:' + salt + ':' + scryptSync(String(pass), salt, 32).toString('hex')
+  }
+  const verifyPassword = (pass, stored) => {
+    try {
+      const [scheme, salt, hex] = String(stored).split(':')
+      if (scheme !== 'scrypt' || !salt || !hex) return false
+      const want = Buffer.from(hex, 'hex')
+      const got = scryptSync(String(pass), salt, want.length)
+      return want.length === got.length && timingSafeEqual(want, got)
+    } catch {
+      return false
+    }
+  }
+  const readAuth = () => {
+    const side = readSidecar()
+    if (side && side.auth && side.auth.key) return side.auth
+    const fresh = {
+      mode: 'key',
+      username: 'dsh',
+      passwordHash: hashPassword(randomBytes(9).toString('base64url')),
+      key: genKey(),
+    }
+    writeSidecar({ ...side, auth: fresh, authInitAt: new Date().toISOString() })
+    return fresh
+  }
+  const writeAuth = (patch) => {
+    const side = readSidecar()
+    const next = { ...(side.auth || {}), ...patch }
+    writeSidecar({ ...side, auth: next, authUpdatedAt: new Date().toISOString() })
+    return next
+  }
+  const COOKIE = 'dshmeshkey'
+  const SESSION_COOKIE = 'dshsession'
+  const SESSION_TTL = 24 * 3600 * 1000
+  const sessions = new Map() // sid -> expiresAt(ms)，进程内存；重启后各设备重登一次
+  const sweepSessions = () => {
+    const now = Date.now()
+    for (const [sid, exp] of sessions) if (exp < now) sessions.delete(sid)
+  }
+  const bakeCookie = (key, secure) =>
+    `${COOKIE}=${key}; Max-Age=2592000; Path=/; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`
+  const parseCookies = (req) => {
+    const out = {}
+    for (const part of String(req.headers.cookie || '').split(';')) {
+      const i = part.indexOf('=')
+      if (i > 0) out[part.slice(0, i).trim()] = part.slice(i + 1).trim()
+    }
+    return out
+  }
+  // null=放行；{status,headers,body}=拦截
+  const authGate = (req) => {
+    const a = readAuth()
+    if (!a.mode || a.mode === 'off') return null
+    if (a.mode === 'basic') {
+      const viaHttps = String(req.headers['x-forwarded-proto'] || '').includes('https')
+      // 已有 24h 会话的设备直接放行（仅该设备；改密码或换模式会清空全部会话）
+      sweepSessions()
+      const sid = parseCookies(req)[SESSION_COOKIE]
+      if (sid && sessions.has(sid)) return null
+      const m = /^Basic\s+(.+)$/i.exec(String(req.headers.authorization || ''))
+      if (m) {
+        const [u, ...rest] = Buffer.from(m[1], 'base64').toString('utf8').split(':')
+        if (u === a.username && verifyPassword(rest.join(':'), a.passwordHash)) {
+          const newSid = randomBytes(24).toString('base64url')
+          sessions.set(newSid, Date.now() + SESSION_TTL)
+          return {
+            pass: true,
+            extraHeaders: { 'set-cookie': `${SESSION_COOKIE}=${newSid}; Max-Age=86400; Path=/; HttpOnly; SameSite=Strict${viaHttps ? '; Secure' : ''}` },
+          }
+        }
+      }
+      return { status: 401, headers: { 'www-authenticate': 'Basic realm="DSH"', 'content-type': 'text/plain; charset=utf-8' }, body: '401 unauthorized\n' }
+    }
+    // key 模式：?meshkey= 一次性换 cookie + 顺手注入 DSH token；cookie 常驻放行；其余 404 伪装成不存在
+    const url = new URL(req.url, 'http://x')
+    const viaHttps = String(req.headers['x-forwarded-proto'] || '').includes('https')
+    const fromParam = url.searchParams.get('meshkey')
+    const fromCookie = parseCookies(req)[COOKIE]
+    if (fromCookie && fromCookie === a.key && !fromParam) return null
+    if (fromParam && fromParam === a.key) {
+      const base = `http://${req.headers.host || 'localhost'}${url.pathname}`
+      const redirect = new URL(signed(base))
+      redirect.searchParams.delete('meshkey')
+      return {
+        status: 302,
+        headers: { location: redirect.pathname + (redirect.search || ''), 'set-cookie': bakeCookie(a.key, viaHttps) },
+      }
+    }
+    return { status: 404, headers: { 'content-type': 'text/plain; charset=utf-8' }, body: 'Not Found\n' }
+  }
+
   let starting = null
   async function run(listenPort, mesh, target) {
     if (state.server) {
@@ -569,7 +687,7 @@ transport.useEncryption = true
     }
     const address = mesh[0].address
     try {
-      state.server = await createProxy({ listenAddress: address, listenPort, upstream: cfg.upstream, upstreamPort: target })
+      state.server = await createProxy({ listenAddress: address, listenPort, upstream: cfg.upstream, upstreamPort: target, authGate })
       state.address = address
       state.port = listenPort
       state.startedAt = Date.now()
@@ -617,6 +735,40 @@ transport.useEncryption = true
           return json(res, 400, { ok: false, error: "action 只能是 'start' 或 'stop'" })
         },
       },
+      {
+        kind: 'exact',
+        path: '/api/dsh-mesh-access/auth',
+        handler: async (req, res) => {
+          if (req.method === 'GET') {
+            const a = readAuth()
+            return json(res, 200, { ok: true, mode: a.mode || 'off', username: a.username || '', key: a.key || '', hasPassword: Boolean(a.passwordHash) })
+          }
+          if (req.method !== 'POST') return json(res, 405, { ok: false, error: 'GET or POST only' })
+          let body = {}
+          try { body = JSON.parse(await readBody(req) || '{}') } catch { return json(res, 400, { ok: false, error: 'body 不是合法 JSON' }) }
+          const patch = {}
+          const mode = String(body.mode ?? '')
+          if (mode) {
+            if (!['off', 'basic', 'key'].includes(mode)) return json(res, 400, { ok: false, error: 'mode 只能是 off / basic / key' })
+            patch.mode = mode
+          }
+          if (body.username !== undefined) {
+            const u = String(body.username).trim()
+            if (!/^[A-Za-z0-9._-]{1,32}$/.test(u)) return json(res, 400, { ok: false, error: '账号只能字母数字点下划线连字符，1–32 位' })
+            patch.username = u
+          }
+          if (body.password !== undefined) {
+            const pw = String(body.password)
+            if (pw.length < 6 || pw.length > 128) return json(res, 400, { ok: false, error: '密码 6–128 位' })
+            patch.passwordHash = hashPassword(pw)
+          }
+          if (body.resetKey) patch.key = genKey()
+          if (!Object.keys(patch).length) return json(res, 400, { ok: false, error: '没给任何要改的字段' })
+          const next = writeAuth(patch)
+          sessions.clear()
+          return json(res, 200, { ok: true, mode: next.mode, username: next.username, key: next.key, hasPassword: Boolean(next.passwordHash) })
+        },
+      },
       {
         kind: 'exact',
         path: '/api/dsh-mesh-access/tunnel',
@@ -650,6 +802,14 @@ transport.useEncryption = true
           const action = String(body.action ?? '')
           if (action === 'start') return json(res, 200, await startTunnel())
           if (action === 'stop') return json(res, 200, await stopTunnel())
+          if (action === 'auth') {
+            try {
+              const out = await setWebAuth(body)
+              return json(res, out.ok ? 200 : 400, { ...out, action: 'auth' })
+            } catch (e) {
+              return json(res, 400, { ok: false, error: String(e?.message ?? e) })
+            }
+          }
           if (action === 'config') {
             try {
               writeTunnelConfig(body)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mesh-access",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Control your DSH from your phone: opens a port on the mesh/VPN interface from inside the running server process, so a phone browser gets the same instance and the same session list — no SSH, no second dsh. Also reachable from another PC, a GUI NAS, or a TV box.",
   "type": "module",
   "main": "lib/index.js",

package/tools/frps-setup.sh

@@ -175,8 +175,8 @@ server {
     ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
 
     # 浏览器弹窗式登录：挡掉所有没带账号密码的请求
-    auth_basic "DSH";
-    auth_basic_user_file /etc/nginx/.dsh_htpasswd;
+    # auth_basic 已由 dsh-mesh-access 插件面板接管（1.4.0+），服务器只做转发
+    # 认证配置见插件面板「入口登录」
 
     client_max_body_size 64m;