dsh-mobile 0.3.10 → 0.3.11

package/lib/index.d.mts

@@ -535,6 +535,7 @@ declare class MobileAccessGateway {
   readonly config: ResolvedGatewayConfig;
   private readonly extensions?;
   private readonly upstreamAuthenticatedUrl?;
+  private readonly extraWebSocketPaths?;
   readonly access: AccessController;
   private readonly listenerTlsEnabled;
   private readonly tlsEnabled;
@@ -565,7 +566,9 @@ declare class MobileAccessGateway {
   private readonly removeSessionListener;
   private readonly removeExtensionContentListener;
   private readonly renewLimiter;
-  constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined);
+  constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined, extraWebSocketPaths?: {
+    has(pathname: string): boolean;
+  } | undefined);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
   private startDiscovery;
@@ -688,6 +691,32 @@ declare class FrpComponentManager {
   private enqueue;
 }
 //#endregion
+//#region src/websocket-paths.d.ts
+/** Cap the admin-approved extra WebSocket upgrade paths (exact pathnames). */
+declare const MAX_EXTRA_WEBSOCKET_PATHS = 16;
+declare const MAX_WEBSOCKET_PATH_LENGTH = 256;
+/**
+ * Validate one exact pathname for proxying. Query strings are matched at
+ * upgrade time, so only the pathname is stored. Rejects anything the
+ * gateway cannot match exactly.
+ */
+declare function validateWebSocketPath(value: unknown): string;
+/** Validate a whole replacement list all-or-nothing; duplicates collapse. */
+declare function normalizeWebSocketPaths(value: unknown): string[];
+/** File-backed store shared by every gateway instance (LAN and remote). */
+declare class WebSocketPathStore {
+  private readonly file;
+  private paths;
+  private loaded;
+  constructor(file: string);
+  /** Snapshot for the upgrade check. */
+  has(pathname: string): boolean;
+  list(): string[];
+  load(): Promise<string[]>;
+  /** Replace the whole list after validating; persists atomically. */
+  replace(paths: readonly string[]): Promise<string[]>;
+}
+//#endregion
 //#region src/frp-template.d.ts
 /** Loopback-only HTTP vhost port used between Caddy and frps. */
 declare const FRP_VHOST_HTTP_PORT = 7080;
@@ -878,5 +907,5 @@ declare const inject: string[];
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 declare function apply(ctx: Context, config: PluginConfig): Promise<void>;
 //#endregion
-export { AUTH_PREFIX, AccessController, type AccessControllerOptions, AccessError, type AuthoritySpec, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, type DeviceSnapshot, type DeviceStore, type DeviceSummary, type DisabledTlsConfig, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, type FrpComponentStatus, FrpConfigStore, type FrpConfigurationStatus, FrpController, type FrpControllerOptions, type FrpSettings, type FrpState, type FrpStatus, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, type LocalExtensionManifest, MemoryDeviceStore, type MobileAccessControlState, type MobileAccessControlStore, MobileAccessGateway, MobileAccessGatewayController, type MobileAccessService as MobileAccessRegistry, MobileAccessService, type MobileAccessRuntime, type MobileActionContext, type MobileExtensionClientEntry, type MobileExtensionDefinition, MobileExtensionError, type MobileExtensionManifest, type MobileExtensionStatus, type MobileHostAction, type MobileHostRoute, type MobileRouteRequest, type MobileRouteResponse, type PairingResult, type ParsedCidr, type PluginConfig, type ProvidedTlsConfig, type RemoteProvider, type RemoteProviderController, type RemoteProviderState, type RemoteProviderStatus, type RenewalResult, RequestTrustPolicy, type ResolvedGatewayConfig, SESSION_COOKIE, type SessionAuthorization, type StoredDevice, type TlsConfig, WS_PATHS, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken };
+export { AUTH_PREFIX, AccessController, type AccessControllerOptions, AccessError, type AuthoritySpec, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, type DeviceSnapshot, type DeviceStore, type DeviceSummary, type DisabledTlsConfig, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, type FrpComponentStatus, FrpConfigStore, type FrpConfigurationStatus, FrpController, type FrpControllerOptions, type FrpSettings, type FrpState, type FrpStatus, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, type LocalExtensionManifest, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, type MobileAccessControlState, type MobileAccessControlStore, MobileAccessGateway, MobileAccessGatewayController, type MobileAccessService as MobileAccessRegistry, MobileAccessService, type MobileAccessRuntime, type MobileActionContext, type MobileExtensionClientEntry, type MobileExtensionDefinition, MobileExtensionError, type MobileExtensionManifest, type MobileExtensionStatus, type MobileHostAction, type MobileHostRoute, type MobileRouteRequest, type MobileRouteResponse, type PairingResult, type ParsedCidr, type PluginConfig, type ProvidedTlsConfig, type RemoteProvider, type RemoteProviderController, type RemoteProviderState, type RemoteProviderStatus, type RenewalResult, RequestTrustPolicy, type ResolvedGatewayConfig, SESSION_COOKIE, type SessionAuthorization, type StoredDevice, type TlsConfig, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateWebSocketPath };
 //# sourceMappingURL=index.d.mts.map

package/lib/index.mjs

@@ -2693,6 +2693,7 @@ var MobileAccessGateway = class {
 	config;
 	extensions;
 	upstreamAuthenticatedUrl;
+	extraWebSocketPaths;
 	access;
 	listenerTlsEnabled;
 	tlsEnabled;
@@ -2723,10 +2724,11 @@ var MobileAccessGateway = class {
 	removeSessionListener;
 	removeExtensionContentListener;
 	renewLimiter;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl) {
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
+		this.extraWebSocketPaths = extraWebSocketPaths;
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
 		this.access = new AccessController(store, {
@@ -3915,7 +3917,7 @@ var MobileAccessGateway = class {
 		const policy = this.requirePolicy();
 		assertExternalTrust(request, policy, false);
 		if (!policy.acceptsOrigin(request.headers.origin)) throw new HttpError(403, "forbidden");
-		if (target.search !== "" || !WS_PATHS.has(target.decodedPathname)) throw new HttpError(404, "not_found");
+		if (!(WS_PATHS.has(target.decodedPathname) || (this.extraWebSocketPaths?.has(target.decodedPathname) ?? false))) throw new HttpError(404, "not_found");
 		if (request.method !== "GET" || headerValue(request.headers, "upgrade")?.toLowerCase() !== "websocket" || !hasToken(headerValue(request.headers, "connection"), "upgrade")) throw new HttpError(400, "bad_request");
 		const key = headerValue(request.headers, "sec-websocket-key");
 		if (key === void 0 || headerValue(request.headers, "sec-websocket-version") !== "13") throw new HttpError(400, "bad_request");
@@ -4598,6 +4600,76 @@ var FrpComponentManager = class {
 	}
 };
 //#endregion
+//#region src/websocket-paths.ts
+/** Cap the admin-approved extra WebSocket upgrade paths (exact pathnames). */
+const MAX_EXTRA_WEBSOCKET_PATHS = 16;
+const MAX_WEBSOCKET_PATH_LENGTH = 256;
+function fail(code) {
+	throw new Error(code);
+}
+/**
+* Validate one exact pathname for proxying. Query strings are matched at
+* upgrade time, so only the pathname is stored. Rejects anything the
+* gateway cannot match exactly.
+*/
+function validateWebSocketPath(value) {
+	if (typeof value !== "string") fail("websocket_path_invalid");
+	const path = value;
+	if (path.length === 0 || path.length > 256) fail("websocket_path_invalid");
+	if (!path.startsWith("/")) fail("websocket_path_invalid");
+	if (/[\s\u0000-\u001f\u007f#?]/u.test(path)) fail("websocket_path_invalid");
+	if (path.includes("..")) fail("websocket_path_invalid");
+	return path;
+}
+/** Validate a whole replacement list all-or-nothing; duplicates collapse. */
+function normalizeWebSocketPaths(value) {
+	if (!Array.isArray(value)) fail("websocket_paths_invalid");
+	if (value.length > 16) fail("websocket_paths_invalid");
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		const path = validateWebSocketPath(entry);
+		seen.add(path);
+	}
+	return [...seen];
+}
+/** File-backed store shared by every gateway instance (LAN and remote). */
+var WebSocketPathStore = class {
+	file;
+	paths = /* @__PURE__ */ new Set();
+	loaded = false;
+	constructor(file) {
+		this.file = file;
+	}
+	/** Snapshot for the upgrade check. */
+	has(pathname) {
+		return this.paths.has(pathname);
+	}
+	list() {
+		return [...this.paths];
+	}
+	async load() {
+		if (!this.loaded) {
+			try {
+				const raw = JSON.parse(await readFile(this.file, "utf8"));
+				this.paths = new Set(normalizeWebSocketPaths(raw.paths ?? []));
+			} catch {
+				this.paths = /* @__PURE__ */ new Set();
+			}
+			this.loaded = true;
+		}
+		return this.list();
+	}
+	/** Replace the whole list after validating; persists atomically. */
+	async replace(paths) {
+		const next = normalizeWebSocketPaths([...paths]);
+		await mkdir(dirname(this.file), { recursive: true });
+		await writeFile(this.file, `${JSON.stringify({ paths: next })}\n`, "utf8");
+		this.paths = new Set(next);
+		this.loaded = true;
+		return this.list();
+	}
+};
+//#endregion
 //#region src/frp-template.ts
 /** Loopback-only HTTP vhost port used between Caddy and frps. */
 const FRP_VHOST_HTTP_PORT = 7080;
@@ -8661,10 +8733,12 @@ async function apply(ctx, config) {
 			}
 		}]
 	});
+	const webSocketPaths = new WebSocketPathStore(join(stateDirectory, "websocket-paths.json"));
+	await webSocketPaths.load();
 	let lanGateway;
 	const startGateway = async (candidateConfig) => {
 		const resolved = parseGatewayConfig(candidateConfig);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths);
 		await candidate.start();
 		lanGateway = candidate;
 		return { close: async () => {
@@ -8704,7 +8778,7 @@ async function apply(ctx, config) {
 	}
 	const createRemoteGateway = async (publicOrigin, listenPort = 0) => {
 		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, instanceId, listenPort);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths);
 		await candidate.start();
 		return candidate;
 	};
@@ -8866,6 +8940,18 @@ async function apply(ctx, config) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/remote/websocket-paths`) {
+					sendJson(response, 200, { paths: webSocketPaths.list() }, false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/websocket-paths`) {
+					const body = await readJsonObject(request, 4096);
+					if (!Array.isArray(body.paths)) throw new HttpError(400, "bad_request");
+					const paths = await webSocketPaths.replace(body.paths);
+					logger.info("websocket upgrade paths updated count=%d paths=%o", paths.length, paths);
+					sendJson(response, 200, { paths }, false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/vps/host-keys`) {
 					const body = await readJsonObject(request, 8192);
 					const serverAddress = typeof body.serverAddress === "string" ? body.serverAddress : "";
@@ -9091,6 +9177,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, WS_PATHS, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken };
+export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateWebSocketPath };
 
 //# sourceMappingURL=index.mjs.map