dsh-mesh-access 1.3.0 → 1.4.1

package/CHANGELOG.md

@@ -143,3 +143,24 @@
 - **客户端半边**：`sidebar.panellist` + `main` 两个槽位的面板（状态、开/关端口、手机地址与复制、
   首次使用星空组网的提示），每 5 秒轮询一次。
 - **没有构建步骤**：两边都是普通的 ESM / 浏览器 JS，所以发布出去的包就是源码本身。
+
+## 1.4.0 — 入口登录收进插件：密钥 / 账号密码 / 关闭
+
+- 公网地址的门锁从 nginx 挪进插件本身：服务器只做转发，零配置零账号。
+- 三种模式（面板「入口登录」卡片切换，立即生效）：
+  - **密钥（推荐，无弹窗）**：面板给一次性地址（带 `?meshkey=`），手机打开一次，
+    30 天内该设备免登录、全程没有登录框；怀疑泄露随时「重置」，旧密钥立即作废。
+  - **账号密码**：浏览器弹窗登录一次，24 小时内**仅该设备**免登录，其他设备各自登录；
+    改账号密码会把所有已登录设备踢下线。
+  - **关闭**：不加门锁，只剩 DSH 自己的 token 一层。
+- 认证状态存本机 `~/.config/frp/dsh-mesh-access.json`（侧车），密码 scrypt 哈希，密钥仅本地可见。
+- 拿不到有效凭据的请求一律 404 伪装（密钥模式）/ 401 弹窗（账号密码模式），WebSocket 升级同样先过门锁。
+- `x-forwarded-proto` 透传：https 域名下种 cookie 自动带 `Secure`。
+- frps-setup.sh 不再生成 nginx Basic 账密（认证归插件）。
+
+## 1.4.1 — 修复面板空白
+
+- 1.4.0 的 client.js 使用了未声明的 `authMsg` state（补插卡片脚本失败遗留），
+  渲染「入口登录」卡片即抛 `ReferenceError`，导致整个「组网访问」面板空白。
+  已补上 `const [authMsg, setAuthMsg] = react.useState('')`，
+  三种模式（密钥/账号密码/关闭）各完成组件树渲染冒烟验证。

package/README.en.md

@@ -52,6 +52,18 @@ Restart the profile. A **组网访问 / Mesh access** entry appears in the left
 | Public tunnel (optional) | use **your own** server as a public entry point: start/stop frpc, show the public URL, probe it for real |
 | 第一次用星空组网？ | the referral sign-up link and the member-account rule |
 
+## Entry auth (since 1.4.0)
+
+The lock on the public entry now lives in the plugin panel — the server needs zero auth config:
+
+| Mode | Experience | For |
+| --- | --- | --- |
+| Key (recommended) | One-time URL from the panel; that device stays signed in for 30 days, no popup ever | Your own devices |
+| Password | Browser popup once; that device stays signed in for 24 h | Borrowed devices |
+| Off | No lock (only DSH's own token) | Not recommended |
+
+Reset the key any time — the old key dies instantly. Changing the password kicks every signed-in device. In key mode, unauthorized requests get a plain 404.
+
 ## HTTP surface
 
 The panel is a view over two routes kept deliberately small:

package/README.md

@@ -75,6 +75,21 @@ sudo ./tools/frps-setup.sh --port 7000 --http-port 21081
 完整说明（前置条件、域名/TLS/Basic 认证、故障表、卸载）见 **[docs/VPS.md](docs/VPS.md)**。
 想让 AI 帮你配：把 **[docs/AI-SETUP.md](docs/AI-SETUP.md)** 整份丢给它，它就知道该跑什么、怎么验证。
 
+## 入口登录（1.4.0 起）
+
+公网地址的门锁做在**插件面板**里（「入口登录」卡片），服务器零配置——nginx 不再需要账密：
+
+| 模式 | 体验 | 适合 |
+| --- | --- | --- |
+| 密钥（推荐） | 面板给一次性地址，手机打开一次，**30 天内免登录、全程无弹窗** | 自己的设备 |
+| 账号密码 | 浏览器弹窗登录一次，**24 小时内仅该设备免登录**，其他设备各自登录 | 偶尔借别人设备 |
+| 关闭 | 不加门锁（只剩 DSH 自己的 token 一层） | 不推荐 |
+
+- 密钥怀疑泄露 → 面板点「重置」，旧密钥立即作废，所有设备重新认证。
+- 改账号密码 → 所有已登录设备立刻下线。
+- 密钥模式下无效请求一律返回 404，不暴露这里有个服务。
+- 认证状态存本机 `~/.config/frp/dsh-mesh-access.json`（侧车文件），密码 scrypt 哈希存储。
+
 ## HTTP 接口
 
 面板只是两个接口的外壳，故意做得极小：
@@ -82,6 +97,8 @@ sudo ./tools/frps-setup.sh --port 7000 --http-port 21081
 ```
 GET  /api/dsh-mesh-access/status   → { ok, host:{upstream,port}, interfaces[], mesh[], proxy{...}, referral }
 POST /api/dsh-mesh-access/proxy    → { action:'start' | 'stop', port? }
+GET  /api/dsh-mesh-access/tunnel   → frpc 隧道状态（1.1.0+）
+GET  /api/dsh-mesh-access/auth     → 入口登录状态；POST 切换模式 / 改账密 / 重置密钥（1.4.0+）
 ```
 
 不开浏览器也能排查：

package/docs/AI-SETUP.md

@@ -9,7 +9,7 @@ their StarVPN/Tailscale/WireGuard network — a public entry point is optional.
 
 ## 0. Hard rules
 
-1. **Never invent credentials.** The frp token and the Basic-auth password are generated by the scripts on the
+1. **Never invent credentials.** The frp token is generated by the scripts on the
    human's machine. Do not type your own, do not reuse one from a doc example.
 2. **Only touch the human's own machines.** The server must be theirs. Do not point `frpc` at a server you cannot
    justify, and do not run these scripts on a host they have not named.
@@ -30,7 +30,7 @@ phone ──https──> their server: frps ──frp tunnel──> their comput
 ```
 
 - `tools/frps-setup.sh` — runs on the **server** (root). Installs `frps`, writes `/etc/frp/frps.toml`, systemd unit,
-  firewall rule; with `--domain` also writes the nginx reverse proxy + Let's Encrypt cert + Basic auth.
+  firewall rule; with `--domain` also writes the nginx reverse proxy + Let's Encrypt cert (auth lives in the plugin panel since 1.4.0).
 - `tools/frpc-setup.sh` — runs on the **computer** (normal user). Installs `frpc` if missing, writes
   `~/.config/frp/frpc.toml`, writes the systemd **user** unit.
 - The plugin reads `~/.config/frp/frpc.toml` and shows a "public tunnel" card: start / stop / live status / public URL.
@@ -74,7 +74,7 @@ tail -20 ~/.config/frp/frpc.log        # expect: "login to server success" + "[d
 
 # 4. end to end from outside — plain HTTP entry:
 curl -s -o /dev/null -w '%{http_code}\n' "http://<server>:21081/"          # 401 (DSH wants a token) is correct
-#    with the domain + Basic auth:
+#    with the domain (auth is configured later in the plugin panel):
 curl -s -o /dev/null -w '%{http_code}\n' -u dsh:<password> "https://<domain>/"   # 401 again, still correct
 
 # 5. WebSocket path must answer 101, not 403/404 (this is what "keeps reconnecting" looks like when broken):
@@ -98,7 +98,6 @@ the computer shows up on the phone within a second.
 | `curl http://server:21081/` times out | security group blocks 21081 | console → allow TCP 21081 (and 7000) |
 | `connection refused` on 21081 | frpc never connected | `journalctl -u frps -n 50`, check token equality |
 | 502 from nginx | nothing listening on the local port | open the port in the DSH panel; `ss -Hltn \| grep 3081` |
-| 500 from nginx | `.dsh_htpasswd` unreadable by the worker | `chown root:<nginx group>` + `chmod 640` |
 | page loads, then "reconnecting" | WebSocket not forwarded | `proxy_http_version 1.1` + `Upgrade`/`Connection` headers |
 | `start error: port already used` | two frpc on one `remotePort` | stop the systemd unit **or** the panel tunnel, keep one |
 | certbot fails | 80 blocked, or DNS not pointing here yet | check A record, open 80, rerun with `--domain` |

package/docs/VPS.md

@@ -53,7 +53,7 @@ sudo ./tools/frps-setup.sh --port 7000 --http-port 21081
 2. 写 `/etc/frp/frps.toml`：`bindPort`、`auth.token`（没给就随机生成 24 位）、日志、本机管理面板 `127.0.0.1:7500`
 3. 建 `frps.service` 并 enable + start，核对 `:7000` 真的在听
 4. firewalld / ufw 有就放行 7000
-5. 给了 `--domain` 且有 nginx：写 ACME 探针、申请 Let's Encrypt 证书、写 443 反代、加 Basic 认证（随机密码）
+5. 给了 `--domain` 且有 nginx：写 ACME 探针、申请 Let's Encrypt 证书、写 443 反代（认证由插件面板「入口登录」接管，服务器不再配账密）
 
 `tools/frpc-setup.sh`（你的电脑上，普通用户）：
 
@@ -66,8 +66,10 @@ sudo ./tools/frps-setup.sh --port 7000 --http-port 21081
 ## 认证是两层
 
 1. **DSH 自己的 token**：面板里「访问地址」那一行就是带 `?token=` 的完整地址，换完 cookie 30 天有效。
-2. **你加的入口认证**（推荐）：`frps-setup.sh --domain` 会顺手配好 nginx Basic 认证，浏览器打开先弹账号密码框。
-   不用 Basic 也可以只暴露 IP:端口——但那样等于把 DSH 登录页直接挂在公网，靠 token 一层兜底。
+2. **入口认证**（推荐，1.4.0+）：装好插件后，在面板「入口登录」卡片里选模式：
+   - 密钥（推荐）：面板给出带 `?meshkey=` 的一次性地址，手机打开一次，30 天内免登录、无弹窗；可随时重置。
+   - 账号密码：浏览器弹窗登录一次，24 小时内仅该设备免登录；改密码会踢掉所有已登录设备。
+   认证状态存本机侧车文件，服务器零配置。
 
 想更硬一点：把 nginx 换成 mTLS（客户端证书）或者只允许公司 IP 访问（`allow`/`deny`），这些都在 nginx 那一层做，
 插件不用改。

package/lib/client.js

@@ -67,6 +67,8 @@ window.__ModuleLoader__.load({
     const api = {
       status: () => fetchJson('/api/dsh-mesh-access/status', {}, 6000),
       tunnel: () => fetchJson('/api/dsh-mesh-access/tunnel', {}, 8000),
+      auth: () => fetchJson('/api/dsh-mesh-access/auth', {}, 8000),
+      authPost: (body) => fetchJson('/api/dsh-mesh-access/auth', { method: 'POST', body: JSON.stringify(body) }, 20000),
       tunnelAction: (action) =>
         fetchJson('/api/dsh-mesh-access/tunnel', {
           method: 'POST',
@@ -97,6 +99,11 @@ window.__ModuleLoader__.load({
     function Panel() {
       const [state, setState] = react.useState(null)
       const [tunnel, setTunnel] = react.useState(null)
+      const [auth, setAuth] = react.useState(null)
+      const [authBusy, setAuthBusy] = react.useState(false)
+      const [authErr, setAuthErr] = react.useState(null)
+      const [authForm, setAuthForm] = react.useState({ username: '', password: '' })
+      const [authMsg, setAuthMsg] = react.useState('')
       const [busy, setBusy] = react.useState(false)
       const [tunnelBusy, setTunnelBusy] = react.useState(false)
       const [err, setErr] = react.useState(null)
@@ -117,6 +124,10 @@ window.__ModuleLoader__.load({
           .tunnel()
           .then((t) => setTunnel(t))
           .catch(() => {})
+        api
+          .auth()
+          .then((a) => setAuth(a))
+          .catch(() => {})
       }, [])
 
       react.useEffect(() => {
@@ -357,6 +368,79 @@ window.__ModuleLoader__.load({
             : null,
         ),
 
+        h(
+          Card, { title: '入口登录（公网地址的门锁）' },
+          (() => {
+            const a = auth || {}
+            const runAuth = (body, okMsg) => {
+              setAuthBusy(true); setAuthErr(null); setAuthMsg(null)
+              api.authPost(body)
+                .then((r) => {
+                  setAuthBusy(false)
+                  if (r && r.ok === false) { setAuthErr(r.error || '失败'); return }
+                  setAuth(r); if (okMsg) setAuthMsg(okMsg)
+                })
+                .catch((e) => { setAuthBusy(false); setAuthErr(String(e && e.message ? e.message : e)) })
+            }
+            const setMode = (mode) => runAuth({ mode },
+              mode === 'key' ? '已切到密钥模式：手机打开下面带 meshkey 的地址一次，30 天内免登录、无弹窗'
+              : mode === 'basic' ? '已切到账号密码模式：弹窗登录一次，24 小时内该设备免登录'
+              : '已关闭入口登录：任何知道地址的人都能打开，请确认你接受')
+            const firstUrl = tn.urlPlain && a.key ? tn.urlPlain + '?meshkey=' + encodeURIComponent(a.key) : null
+            const modeBtn = (m, label) => h('button', {
+              style: (a.mode === m ? S.btnPrimary : S.btn),
+              disabled: authBusy || a.mode === m, onClick: () => setMode(m),
+            }, label)
+            return h('div', null,
+              h('div', { style: S.row },
+                modeBtn('key', '密钥（无弹窗）'),
+                modeBtn('basic', '账号密码'),
+                modeBtn('off', '关闭（危险）'),
+              ),
+              authMsg ? h('div', { style: { ...S.hint, color: '#7ee787', marginTop: 8 } }, authMsg) : null,
+              a.mode === 'key'
+                ? h('div', { style: { marginTop: 10 } },
+                    h('div', { style: S.hint }, '密钥（只读，可复制；怀疑泄露就点重置，旧密钥立即作废）：'),
+                    h('div', { style: S.row, marginTop: 6 },
+                      h('input', { style: { ...S.input, ...S.mono, flex: 1 }, readOnly: true, value: a.key || '', onFocus: (e) => e.target.select() }),
+                      h('button', { style: S.btn, onClick: () => copy(a.key) }, copied ? '已复制' : '复制'),
+                      h('button', { style: S.btn, disabled: authBusy, onClick: () => { if (window.confirm('重置后旧密钥立刻作废，所有用旧密钥的设备都要重新认证。继续？')) runAuth({ resetKey: true }, '已重置：用新地址重新认证各设备') } }, '重置'),
+                    ),
+                    firstUrl ? h('div', { style: { marginTop: 8 } },
+                      h('div', { style: S.hint }, '手机首次打开（认证一次，30 天内该设备免登录、无弹窗）：'),
+                      h('div', { style: S.row, marginTop: 6 },
+                        h('code', { style: { ...S.mono, wordBreak: 'break-all', flex: 1 } }, firstUrl),
+                        h('button', { style: S.btn, onClick: () => copy(firstUrl) }, copied ? '已复制' : '复制'),
+                      ),
+                    ) : null,
+                  )
+                : null,
+              a.mode === 'basic'
+                ? h('div', { style: { marginTop: 10 } },
+                    h('div', { style: S.row, gap: 10 },
+                      h('div', null, h('label', { style: S.label }, '账号'),
+                        h('input', { style: S.input, value: authForm.username, placeholder: a.username || 'dsh', onChange: (e) => setAuthForm(Object.assign({}, authForm, { username: e.target.value })) })),
+                      h('div', null, h('label', { style: S.label }, '新密码（6 位起）'),
+                        h('input', { style: S.input, type: 'password', value: authForm.password, onChange: (e) => setAuthForm(Object.assign({}, authForm, { password: e.target.value })) })),
+                    ),
+                    h('div', { style: S.row, marginTop: 8 },
+                      h('button', {
+                        style: S.btnPrimary, disabled: authBusy || !authForm.password,
+                        onClick: () => {
+                          if (authForm.password.length < 6) { setAuthErr('密码至少 6 位'); return }
+                          runAuth({ username: authForm.username || a.username, password: authForm.password }, '已保存，立即生效；所有已登录设备被踢下线')
+                          setAuthForm({ username: '', password: '' })
+                        },
+                      }, '保存（立即生效）'),
+                    ),
+                    h('div', { style: S.hint }, '弹窗输一次账密，这台设备 24 小时内免登录；其他设备仍要各自登录。改密码会把所有设备踢下线。'),
+                  )
+                : null,
+              a.mode === 'off' ? h('div', { style: { ...S.hint, marginTop: 8, color: '#f85149' } }, '入口登录已关闭：只剩 DSH 自己的 token 一层，任何拿到地址的人都能看到登录页。') : null,
+              authErr ? h('div', { style: S.err, marginTop: 8 }, authErr) : null,
+            )
+          })(),
+        ),
         h(
           Card, { title: '第一次用星空组网？' },
           h('div', { style: S.hint }, '三步走，不用记 IP，也不用改任何配置。'),

package/lib/index.js

@@ -20,6 +20,7 @@ import fs from 'node:fs'
 import http from 'node:http'
 import net from 'node:net'
 import path from 'node:path'
+import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto'
 import { spawn } from 'node:child_process'
 
 export const name = 'dsh-mesh-access'
@@ -90,7 +91,7 @@ function readBody(req, limit = 8 * 1024) {
  * Host 改写成上游 authority —— dsh 的 /api 信任栅栏比对的是 Host，
  * 而 cookie 里的 authority 也按这个 Host 签发，两边一致才不会互相打架。
  */
-function createProxy({ listenAddress, listenPort, upstream, upstreamPort }) {
+function createProxy({ listenAddress, listenPort, upstream, upstreamPort, authGate }) {
   const target = `${upstream}:${upstreamPort}`
   // DSH 会校验 Origin 与 Host 是否一致（不一致直接 403），所以我们转发时把 Host 改写成
   // 上游地址，就必须把 Origin 一起改写成上游的 origin；否则浏览器的 WebSocket 升级
@@ -104,12 +105,19 @@ function createProxy({ listenAddress, listenPort, upstream, upstreamPort }) {
     const incomingHost = headers.host ?? ''
     h.host = target
     h['x-forwarded-host'] = incomingHost
-    h['x-forwarded-proto'] = 'http'
+    h['x-forwarded-proto'] = headers['x-forwarded-proto'] || 'http'
     if (headers.origin) h.origin = upstreamOrigin
     return h
   }
 
   const server = http.createServer((req, res) => {
+    const gate = authGate(req)
+    if (gate && gate.status) {
+      res.writeHead(gate.status, gate.headers)
+      res.end(gate.body || '')
+      return
+    }
+    const extra = gate && gate.extraHeaders
     const up = http.request(
       { host: upstream, port: upstreamPort, method: req.method, path: req.url, headers: rewrite(req.headers) },
       (r) => {
@@ -119,6 +127,14 @@ function createProxy({ listenAddress, listenPort, upstream, upstreamPort }) {
         if (r.statusCode === 200 && CACHEABLE.test(req.url || '')) {
           headers['cache-control'] = 'public, max-age=31536000, immutable'
         }
+        if (extra) {
+          for (const [k, v] of Object.entries(extra)) {
+            if (k.toLowerCase() === 'set-cookie') {
+              const prev = headers['set-cookie']
+              headers['set-cookie'] = prev ? [].concat(prev, v) : v
+            } else headers[k] = v
+          }
+        }
         res.writeHead(r.statusCode ?? 502, headers)
         r.pipe(res)
       },
@@ -132,6 +148,13 @@ function createProxy({ listenAddress, listenPort, upstream, upstreamPort }) {
 
   // WebSocket / HTTP upgrade：裸 socket 双向转发（DSH 的实时通道靠它）
   server.on('upgrade', (req, socket, head) => {
+    const gate = authGate(req)
+    if (gate && gate.status) {
+      socket.write(`HTTP/1.1 ${gate.status} ${gate.status === 404 ? 'Not Found' : 'Unauthorized'}\r\n` +
+        Object.entries(gate.headers).map(([k, v]) => `${k}: ${v}`).join('\r\n') + '\r\nConnection: close\r\n\r\n')
+      socket.destroy()
+      return
+    }
     socket.setNoDelay(true)
     socket.setKeepAlive(true, 30_000)
     const up = net.connect(upstreamPort, upstream, () => {
@@ -560,6 +583,101 @@ transport.useEncryption = true
     }
   }
 
+  // ===== 公网入口认证（1.4.0）：关 / 账号密码 / 密钥，全在本机，面板改完即生效 =====
+  const genKey = () => randomBytes(32).toString('base64url')
+  const hashPassword = (pass) => {
+    const salt = randomBytes(16).toString('hex')
+    return 'scrypt:' + salt + ':' + scryptSync(String(pass), salt, 32).toString('hex')
+  }
+  const verifyPassword = (pass, stored) => {
+    try {
+      const [scheme, salt, hex] = String(stored).split(':')
+      if (scheme !== 'scrypt' || !salt || !hex) return false
+      const want = Buffer.from(hex, 'hex')
+      const got = scryptSync(String(pass), salt, want.length)
+      return want.length === got.length && timingSafeEqual(want, got)
+    } catch {
+      return false
+    }
+  }
+  const readAuth = () => {
+    const side = readSidecar()
+    if (side && side.auth && side.auth.key) return side.auth
+    const fresh = {
+      mode: 'key',
+      username: 'dsh',
+      passwordHash: hashPassword(randomBytes(9).toString('base64url')),
+      key: genKey(),
+    }
+    writeSidecar({ ...side, auth: fresh, authInitAt: new Date().toISOString() })
+    return fresh
+  }
+  const writeAuth = (patch) => {
+    const side = readSidecar()
+    const next = { ...(side.auth || {}), ...patch }
+    writeSidecar({ ...side, auth: next, authUpdatedAt: new Date().toISOString() })
+    return next
+  }
+  const COOKIE = 'dshmeshkey'
+  const SESSION_COOKIE = 'dshsession'
+  const SESSION_TTL = 24 * 3600 * 1000
+  const sessions = new Map() // sid -> expiresAt(ms)，进程内存；重启后各设备重登一次
+  const sweepSessions = () => {
+    const now = Date.now()
+    for (const [sid, exp] of sessions) if (exp < now) sessions.delete(sid)
+  }
+  const bakeCookie = (key, secure) =>
+    `${COOKIE}=${key}; Max-Age=2592000; Path=/; HttpOnly; SameSite=Strict${secure ? '; Secure' : ''}`
+  const parseCookies = (req) => {
+    const out = {}
+    for (const part of String(req.headers.cookie || '').split(';')) {
+      const i = part.indexOf('=')
+      if (i > 0) out[part.slice(0, i).trim()] = part.slice(i + 1).trim()
+    }
+    return out
+  }
+  // null=放行；{status,headers,body}=拦截
+  const authGate = (req) => {
+    const a = readAuth()
+    if (!a.mode || a.mode === 'off') return null
+    if (a.mode === 'basic') {
+      const viaHttps = String(req.headers['x-forwarded-proto'] || '').includes('https')
+      // 已有 24h 会话的设备直接放行（仅该设备；改密码或换模式会清空全部会话）
+      sweepSessions()
+      const sid = parseCookies(req)[SESSION_COOKIE]
+      if (sid && sessions.has(sid)) return null
+      const m = /^Basic\s+(.+)$/i.exec(String(req.headers.authorization || ''))
+      if (m) {
+        const [u, ...rest] = Buffer.from(m[1], 'base64').toString('utf8').split(':')
+        if (u === a.username && verifyPassword(rest.join(':'), a.passwordHash)) {
+          const newSid = randomBytes(24).toString('base64url')
+          sessions.set(newSid, Date.now() + SESSION_TTL)
+          return {
+            pass: true,
+            extraHeaders: { 'set-cookie': `${SESSION_COOKIE}=${newSid}; Max-Age=86400; Path=/; HttpOnly; SameSite=Strict${viaHttps ? '; Secure' : ''}` },
+          }
+        }
+      }
+      return { status: 401, headers: { 'www-authenticate': 'Basic realm="DSH"', 'content-type': 'text/plain; charset=utf-8' }, body: '401 unauthorized\n' }
+    }
+    // key 模式：?meshkey= 一次性换 cookie + 顺手注入 DSH token；cookie 常驻放行；其余 404 伪装成不存在
+    const url = new URL(req.url, 'http://x')
+    const viaHttps = String(req.headers['x-forwarded-proto'] || '').includes('https')
+    const fromParam = url.searchParams.get('meshkey')
+    const fromCookie = parseCookies(req)[COOKIE]
+    if (fromCookie && fromCookie === a.key && !fromParam) return null
+    if (fromParam && fromParam === a.key) {
+      const base = `http://${req.headers.host || 'localhost'}${url.pathname}`
+      const redirect = new URL(signed(base))
+      redirect.searchParams.delete('meshkey')
+      return {
+        status: 302,
+        headers: { location: redirect.pathname + (redirect.search || ''), 'set-cookie': bakeCookie(a.key, viaHttps) },
+      }
+    }
+    return { status: 404, headers: { 'content-type': 'text/plain; charset=utf-8' }, body: 'Not Found\n' }
+  }
+
   let starting = null
   async function run(listenPort, mesh, target) {
     if (state.server) {
@@ -569,7 +687,7 @@ transport.useEncryption = true
     }
     const address = mesh[0].address
     try {
-      state.server = await createProxy({ listenAddress: address, listenPort, upstream: cfg.upstream, upstreamPort: target })
+      state.server = await createProxy({ listenAddress: address, listenPort, upstream: cfg.upstream, upstreamPort: target, authGate })
       state.address = address
       state.port = listenPort
       state.startedAt = Date.now()
@@ -617,6 +735,40 @@ transport.useEncryption = true
           return json(res, 400, { ok: false, error: "action 只能是 'start' 或 'stop'" })
         },
       },
+      {
+        kind: 'exact',
+        path: '/api/dsh-mesh-access/auth',
+        handler: async (req, res) => {
+          if (req.method === 'GET') {
+            const a = readAuth()
+            return json(res, 200, { ok: true, mode: a.mode || 'off', username: a.username || '', key: a.key || '', hasPassword: Boolean(a.passwordHash) })
+          }
+          if (req.method !== 'POST') return json(res, 405, { ok: false, error: 'GET or POST only' })
+          let body = {}
+          try { body = JSON.parse(await readBody(req) || '{}') } catch { return json(res, 400, { ok: false, error: 'body 不是合法 JSON' }) }
+          const patch = {}
+          const mode = String(body.mode ?? '')
+          if (mode) {
+            if (!['off', 'basic', 'key'].includes(mode)) return json(res, 400, { ok: false, error: 'mode 只能是 off / basic / key' })
+            patch.mode = mode
+          }
+          if (body.username !== undefined) {
+            const u = String(body.username).trim()
+            if (!/^[A-Za-z0-9._-]{1,32}$/.test(u)) return json(res, 400, { ok: false, error: '账号只能字母数字点下划线连字符，1–32 位' })
+            patch.username = u
+          }
+          if (body.password !== undefined) {
+            const pw = String(body.password)
+            if (pw.length < 6 || pw.length > 128) return json(res, 400, { ok: false, error: '密码 6–128 位' })
+            patch.passwordHash = hashPassword(pw)
+          }
+          if (body.resetKey) patch.key = genKey()
+          if (!Object.keys(patch).length) return json(res, 400, { ok: false, error: '没给任何要改的字段' })
+          const next = writeAuth(patch)
+          sessions.clear()
+          return json(res, 200, { ok: true, mode: next.mode, username: next.username, key: next.key, hasPassword: Boolean(next.passwordHash) })
+        },
+      },
       {
         kind: 'exact',
         path: '/api/dsh-mesh-access/tunnel',
@@ -650,6 +802,14 @@ transport.useEncryption = true
           const action = String(body.action ?? '')
           if (action === 'start') return json(res, 200, await startTunnel())
           if (action === 'stop') return json(res, 200, await stopTunnel())
+          if (action === 'auth') {
+            try {
+              const out = await setWebAuth(body)
+              return json(res, out.ok ? 200 : 400, { ...out, action: 'auth' })
+            } catch (e) {
+              return json(res, 400, { ok: false, error: String(e?.message ?? e) })
+            }
+          }
           if (action === 'config') {
             try {
               writeTunnelConfig(body)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mesh-access",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "Control your DSH from your phone: opens a port on the mesh/VPN interface from inside the running server process, so a phone browser gets the same instance and the same session list — no SSH, no second dsh. Also reachable from another PC, a GUI NAS, or a TV box.",
   "type": "module",
   "main": "lib/index.js",

package/tools/frps-setup.sh

@@ -175,8 +175,8 @@ server {
     ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
 
     # 浏览器弹窗式登录：挡掉所有没带账号密码的请求
-    auth_basic "DSH";
-    auth_basic_user_file /etc/nginx/.dsh_htpasswd;
+    # auth_basic 已由 dsh-mesh-access 插件面板接管（1.4.0+），服务器只做转发
+    # 认证配置见插件面板「入口登录」
 
     client_max_body_size 64m;