dsh-mobile 0.3.12 → 0.3.13

package/lib/index.d.mts

@@ -364,6 +364,51 @@ declare class MobileAccessGatewayController {
   private enqueue;
 }
 //#endregion
+//#region src/websocket-paths.d.ts
+/** Cap the admin-approved extra WebSocket upgrade paths (exact pathnames). */
+declare const MAX_EXTRA_WEBSOCKET_PATHS = 16;
+declare const MAX_WEBSOCKET_PATH_LENGTH = 256;
+/**
+ * Validate one exact pathname for proxying. Query strings are matched at
+ * upgrade time, so only the pathname is stored. Rejects anything the
+ * gateway cannot match exactly.
+ */
+declare function validateWebSocketPath(value: unknown): string;
+/** Validate a whole replacement list all-or-nothing; duplicates collapse. */
+declare function normalizeWebSocketPaths(value: unknown): string[];
+/** Cap remembered rejected upgrade paths offered for one-click approval. */
+declare const MAX_BLOCKED_UPGRADE_PATHS = 32;
+interface BlockedUpgradePathEntry {
+  readonly path: string;
+  readonly attempts: number;
+  readonly firstSeen: number;
+  readonly lastSeen: number;
+}
+/**
+ * In-memory log of rejected third-party upgrade paths, shared by every
+ * gateway instance so the approval UI sees attempts on any listener.
+ * Bounded and newest-first; a restart clears it (attempts reappear on
+ * the next blocked handshake).
+ */
+declare class BlockedUpgradePathLog {
+  private readonly entries;
+  record(pathname: string): void;
+  report(): BlockedUpgradePathEntry[];
+}
+/** File-backed store shared by every gateway instance (LAN and remote). */
+declare class WebSocketPathStore {
+  private readonly file;
+  private paths;
+  private loaded;
+  constructor(file: string);
+  /** Snapshot for the upgrade check. */
+  has(pathname: string): boolean;
+  list(): string[];
+  load(): Promise<string[]>;
+  /** Replace the whole list after validating; persists atomically. */
+  replace(paths: readonly string[]): Promise<string[]>;
+}
+//#endregion
 //#region src/extensions.d.ts
 /** Maximum sizes enforced at the local-extension filesystem boundary. */
 declare const EXTENSION_LIMITS: Readonly<{
@@ -536,6 +581,7 @@ declare class MobileAccessGateway {
   private readonly extensions?;
   private readonly upstreamAuthenticatedUrl?;
   private readonly extraWebSocketPaths?;
+  private readonly blockedUpgradeLog?;
   readonly access: AccessController;
   private readonly listenerTlsEnabled;
   private readonly tlsEnabled;
@@ -568,7 +614,7 @@ declare class MobileAccessGateway {
   private readonly renewLimiter;
   constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined, extraWebSocketPaths?: {
     has(pathname: string): boolean;
-  } | undefined);
+  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
   private startDiscovery;
@@ -608,6 +654,8 @@ declare class MobileAccessGateway {
   private pollLegacyCustomChanges;
   private openExtensionEventStream;
   private readUpgradeResponse;
+  /** Snapshot of rejected upgrade paths for the approval UI (newest first). */
+  blockedUpgradePathReport(): BlockedUpgradePathEntry[];
   private handleUpgrade;
   /** Loopback-only DSH WebServer route for opening pairing and managing devices. */
   localAdminRoute(prefix?: string): WebRoute;
@@ -691,32 +739,6 @@ declare class FrpComponentManager {
   private enqueue;
 }
 //#endregion
-//#region src/websocket-paths.d.ts
-/** Cap the admin-approved extra WebSocket upgrade paths (exact pathnames). */
-declare const MAX_EXTRA_WEBSOCKET_PATHS = 16;
-declare const MAX_WEBSOCKET_PATH_LENGTH = 256;
-/**
- * Validate one exact pathname for proxying. Query strings are matched at
- * upgrade time, so only the pathname is stored. Rejects anything the
- * gateway cannot match exactly.
- */
-declare function validateWebSocketPath(value: unknown): string;
-/** Validate a whole replacement list all-or-nothing; duplicates collapse. */
-declare function normalizeWebSocketPaths(value: unknown): string[];
-/** File-backed store shared by every gateway instance (LAN and remote). */
-declare class WebSocketPathStore {
-  private readonly file;
-  private paths;
-  private loaded;
-  constructor(file: string);
-  /** Snapshot for the upgrade check. */
-  has(pathname: string): boolean;
-  list(): string[];
-  load(): Promise<string[]>;
-  /** Replace the whole list after validating; persists atomically. */
-  replace(paths: readonly string[]): Promise<string[]>;
-}
-//#endregion
 //#region src/frp-template.d.ts
 /** Loopback-only HTTP vhost port used between Caddy and frps. */
 declare const FRP_VHOST_HTTP_PORT = 7080;
@@ -907,5 +929,5 @@ declare const inject: string[];
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 declare function apply(ctx: Context, config: PluginConfig): Promise<void>;
 //#endregion
-export { AUTH_PREFIX, AccessController, type AccessControllerOptions, AccessError, type AuthoritySpec, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, type DeviceSnapshot, type DeviceStore, type DeviceSummary, type DisabledTlsConfig, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, type FrpComponentStatus, FrpConfigStore, type FrpConfigurationStatus, FrpController, type FrpControllerOptions, type FrpSettings, type FrpState, type FrpStatus, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, type LocalExtensionManifest, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, type MobileAccessControlState, type MobileAccessControlStore, MobileAccessGateway, MobileAccessGatewayController, type MobileAccessService as MobileAccessRegistry, MobileAccessService, type MobileAccessRuntime, type MobileActionContext, type MobileExtensionClientEntry, type MobileExtensionDefinition, MobileExtensionError, type MobileExtensionManifest, type MobileExtensionStatus, type MobileHostAction, type MobileHostRoute, type MobileRouteRequest, type MobileRouteResponse, type PairingResult, type ParsedCidr, type PluginConfig, type ProvidedTlsConfig, type RemoteProvider, type RemoteProviderController, type RemoteProviderState, type RemoteProviderStatus, type RenewalResult, RequestTrustPolicy, type ResolvedGatewayConfig, SESSION_COOKIE, type SessionAuthorization, type StoredDevice, type TlsConfig, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateWebSocketPath };
+export { AUTH_PREFIX, AccessController, type AccessControllerOptions, AccessError, type AuthoritySpec, type BlockedUpgradePathEntry, BlockedUpgradePathLog, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, type DeviceSnapshot, type DeviceStore, type DeviceSummary, type DisabledTlsConfig, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, type FrpComponentStatus, FrpConfigStore, type FrpConfigurationStatus, FrpController, type FrpControllerOptions, type FrpSettings, type FrpState, type FrpStatus, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, type LocalExtensionManifest, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, type MobileAccessControlState, type MobileAccessControlStore, MobileAccessGateway, MobileAccessGatewayController, type MobileAccessService as MobileAccessRegistry, MobileAccessService, type MobileAccessRuntime, type MobileActionContext, type MobileExtensionClientEntry, type MobileExtensionDefinition, MobileExtensionError, type MobileExtensionManifest, type MobileExtensionStatus, type MobileHostAction, type MobileHostRoute, type MobileRouteRequest, type MobileRouteResponse, type PairingResult, type ParsedCidr, type PluginConfig, type ProvidedTlsConfig, type RemoteProvider, type RemoteProviderController, type RemoteProviderState, type RemoteProviderStatus, type RenewalResult, RequestTrustPolicy, type ResolvedGatewayConfig, SESSION_COOKIE, type SessionAuthorization, type StoredDevice, type TlsConfig, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateWebSocketPath };
 //# sourceMappingURL=index.d.mts.map

package/lib/index.mjs

@@ -2694,6 +2694,7 @@ var MobileAccessGateway = class {
 	extensions;
 	upstreamAuthenticatedUrl;
 	extraWebSocketPaths;
+	blockedUpgradeLog;
 	access;
 	listenerTlsEnabled;
 	tlsEnabled;
@@ -2724,11 +2725,12 @@ var MobileAccessGateway = class {
 	removeSessionListener;
 	removeExtensionContentListener;
 	renewLimiter;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths) {
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
 		this.extraWebSocketPaths = extraWebSocketPaths;
+		this.blockedUpgradeLog = blockedUpgradeLog;
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
 		this.access = new AccessController(store, {
@@ -3912,12 +3914,19 @@ var MobileAccessGateway = class {
 			upstream.once("close", closed);
 		});
 	}
+	/** Snapshot of rejected upgrade paths for the approval UI (newest first). */
+	blockedUpgradePathReport() {
+		return this.blockedUpgradeLog?.report() ?? [];
+	}
 	async handleUpgrade(request, client, head) {
 		const target = parseRequestTarget(request.url);
 		const policy = this.requirePolicy();
 		assertExternalTrust(request, policy, false);
 		if (!policy.acceptsOrigin(request.headers.origin)) throw new HttpError(403, "forbidden");
-		if (!(WS_PATHS.has(target.decodedPathname) || (this.extraWebSocketPaths?.has(target.decodedPathname) ?? false))) throw new HttpError(404, "not_found");
+		if (!(WS_PATHS.has(target.decodedPathname) || (this.extraWebSocketPaths?.has(target.decodedPathname) ?? false))) {
+			this.blockedUpgradeLog?.record(target.decodedPathname);
+			throw new HttpError(404, "not_found");
+		}
 		if (request.method !== "GET" || headerValue(request.headers, "upgrade")?.toLowerCase() !== "websocket" || !hasToken(headerValue(request.headers, "connection"), "upgrade")) throw new HttpError(400, "bad_request");
 		const key = headerValue(request.headers, "sec-websocket-key");
 		if (key === void 0 || headerValue(request.headers, "sec-websocket-version") !== "13") throw new HttpError(400, "bad_request");
@@ -4632,6 +4641,42 @@ function normalizeWebSocketPaths(value) {
 	}
 	return [...seen];
 }
+/** Cap remembered rejected upgrade paths offered for one-click approval. */
+const MAX_BLOCKED_UPGRADE_PATHS = 32;
+/**
+* In-memory log of rejected third-party upgrade paths, shared by every
+* gateway instance so the approval UI sees attempts on any listener.
+* Bounded and newest-first; a restart clears it (attempts reappear on
+* the next blocked handshake).
+*/
+var BlockedUpgradePathLog = class {
+	entries = /* @__PURE__ */ new Map();
+	record(pathname) {
+		const now = Date.now();
+		const stats = this.entries.get(pathname);
+		if (stats === void 0) {
+			if (this.entries.size >= 32) {
+				let oldest;
+				for (const [path, entry] of this.entries) if (oldest === void 0 || entry.lastSeen < (this.entries.get(oldest)?.lastSeen ?? 0)) oldest = path;
+				if (oldest !== void 0) this.entries.delete(oldest);
+			}
+			this.entries.set(pathname, {
+				attempts: 1,
+				firstSeen: now,
+				lastSeen: now
+			});
+			return;
+		}
+		stats.attempts += 1;
+		stats.lastSeen = now;
+	}
+	report() {
+		return [...this.entries].map(([path, stats]) => ({
+			path,
+			...stats
+		})).sort((a, b) => b.lastSeen - a.lastSeen);
+	}
+};
 /** File-backed store shared by every gateway instance (LAN and remote). */
 var WebSocketPathStore = class {
 	file;
@@ -8735,10 +8780,11 @@ async function apply(ctx, config) {
 	});
 	const webSocketPaths = new WebSocketPathStore(join(stateDirectory, "websocket-paths.json"));
 	await webSocketPaths.load();
+	const blockedUpgradePaths = new BlockedUpgradePathLog();
 	let lanGateway;
 	const startGateway = async (candidateConfig) => {
 		const resolved = parseGatewayConfig(candidateConfig);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
 		await candidate.start();
 		lanGateway = candidate;
 		return { close: async () => {
@@ -8778,7 +8824,7 @@ async function apply(ctx, config) {
 	}
 	const createRemoteGateway = async (publicOrigin, listenPort = 0) => {
 		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, instanceId, listenPort);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
 		await candidate.start();
 		return candidate;
 	};
@@ -8944,6 +8990,10 @@ async function apply(ctx, config) {
 					sendJson(response, 200, { paths: webSocketPaths.list() }, false);
 					return;
 				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/remote/websocket-paths/blocked`) {
+					sendJson(response, 200, { blocked: blockedUpgradePaths.report() }, false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/websocket-paths`) {
 					const body = await readJsonObject(request, 4096);
 					if (!Array.isArray(body.paths)) throw new HttpError(400, "bad_request");
@@ -9177,6 +9227,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateWebSocketPath };
+export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateWebSocketPath };
 
 //# sourceMappingURL=index.mjs.map