dsh-mobile 0.6.15 → 0.6.16

package/lib/index.d.mts

@@ -394,6 +394,8 @@ interface ResolvedGatewayConfig {
   readonly excludedClientModules: readonly string[];
   readonly websocketCompression: ResolvedWebSocketCompressionConfig;
   readonly instanceId: string;
+  /** Plugin-wide installation identity, disclosed only after native authentication. */
+  readonly installationId?: string;
   /** Identity returned only for authenticated legacy native credentials without a stored binding. */
   readonly legacyInstanceId?: string;
   readonly pairingCaFile?: string;
@@ -1093,6 +1095,8 @@ export declare class MobileAccessGateway {
   private handleRenew;
   /** CA-backed entries retain their pin; public entries project the authenticated credential's identity. */
   private nativeResponseInstanceId;
+  /** Older Apps require exact wire keys; expose this hint only to explicit opt-in clients after authentication. */
+  private nativeResponseInstallationIdentity;
   private handleNativePair;
   private handleNativeRenew;
   private handleNativeProbe;

package/lib/index.mjs

@@ -4911,6 +4911,26 @@ function renderLoginScript(locale) {
 `;
 }
 //#endregion
+//#region src/browser-ui-locale.ts
+const UI_LOCALE_COOKIE = "dsh_ma_ui_locale";
+/** Read presentation data only; malformed or ambiguous cookies keep browser negotiation. */
+function readBrowserUiLocale(cookieHeader) {
+	if (cookieHeader === void 0 || cookieHeader.length > 8192) return void 0;
+	let locale;
+	for (const part of cookieHeader.split(";")) {
+		const separator = part.indexOf("=");
+		if ((separator === -1 ? part : part.slice(0, separator)).trim() !== UI_LOCALE_COOKIE) continue;
+		const value = separator === -1 ? "" : part.slice(separator + 1).trim();
+		if (locale !== void 0 || value !== "en" && value !== "zh" && value !== "it") return void 0;
+		locale = value;
+	}
+	return locale;
+}
+/** Prefer the last DSH display language over the browser's default language. */
+function resolveBrowserUiLocale(cookieHeader, acceptLanguage) {
+	return readBrowserUiLocale(cookieHeader) ?? resolveAuthPageLocale(acceptLanguage);
+}
+//#endregion
 //#region src/gateway.ts
 const MAX_CONTROL_BODY_BYTES = 16384;
 const MAX_HEADER_BYTES = 16384;
@@ -6257,12 +6277,17 @@ var MobileAccessGateway = class {
 	nativeResponseInstanceId(result) {
 		return this.config.pairingCaFile === void 0 ? result.nativeInstanceId ?? this.config.instanceId : this.config.instanceId;
 	}
+	/** Older Apps require exact wire keys; expose this hint only to explicit opt-in clients after authentication. */
+	nativeResponseInstallationIdentity(request) {
+		return this.config.installationId === void 0 || request.headers["x-dsh-mobile-capabilities"] !== "installation-id" ? {} : { installationId: this.config.installationId };
+	}
 	async handleNativePair(request, response) {
 		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 		if (typeof body.token !== "string" || body.label !== void 0 && typeof body.label !== "string") throw new HttpError(400, "bad_request");
 		const result = await this.access.pair(request.socket.remoteAddress ?? "unknown", body.token, body.label);
 		sendJson(response, 201, {
 			instanceId: this.nativeResponseInstanceId(result),
+			...this.nativeResponseInstallationIdentity(request),
 			deviceId: result.deviceId,
 			deviceToken: result.deviceToken,
 			deviceExpiresAt: result.deviceExpiresAt,
@@ -6283,6 +6308,7 @@ var MobileAccessGateway = class {
 			const result = await this.access.renew(selected.token);
 			sendJson(response, 200, {
 				instanceId: this.nativeResponseInstanceId(result),
+				...this.nativeResponseInstallationIdentity(request),
 				deviceId: result.deviceId,
 				sessionToken: result.sessionToken,
 				csrfToken: result.csrfToken,
@@ -6302,6 +6328,7 @@ var MobileAccessGateway = class {
 			const result = await this.access.probe(selected.token);
 			sendJson(response, 200, {
 				instanceId: this.nativeResponseInstanceId(result),
+				...this.nativeResponseInstallationIdentity(request),
 				deviceId: result.deviceId,
 				deviceExpiresAt: result.deviceExpiresAt
 			}, this.tlsEnabled);
@@ -6390,9 +6417,9 @@ var MobileAccessGateway = class {
 		if (target.search === "" && request.method === "GET" && (target.decodedPathname === `/mobile-access/pair` || target.decodedPathname === `/mobile-access/pair.js`)) {
 			if (!this.access.pairingStatus().open) throw new HttpError(404, "not_found");
 			const languageHeader = request.headers["accept-language"];
-			const locale = resolveAuthPageLocale(typeof languageHeader === "string" ? languageHeader : void 0);
+			const locale = resolveBrowserUiLocale(request.headers.cookie, typeof languageHeader === "string" ? languageHeader : void 0);
 			setSecurityHeaders(response, this.tlsEnabled);
-			response.setHeader("Vary", "Accept-Language");
+			response.setHeader("Vary", "Accept-Language, Cookie");
 			const body = target.decodedPathname.endsWith(".js") ? renderPairScript(locale) : renderPairPage(locale);
 			response.writeHead(200, {
 				"Content-Type": target.decodedPathname.endsWith(".js") ? "text/javascript; charset=utf-8" : "text/html; charset=utf-8",
@@ -6404,9 +6431,9 @@ var MobileAccessGateway = class {
 		if (request.method === "GET" && (target.decodedPathname === `/mobile-access/login` || target.decodedPathname === `/mobile-access/login.js`)) {
 			if (target.decodedPathname.endsWith(".js") && target.search !== "") throw new HttpError(400, "bad_request");
 			const languageHeader = request.headers["accept-language"];
-			const locale = resolveAuthPageLocale(typeof languageHeader === "string" ? languageHeader : void 0);
+			const locale = resolveBrowserUiLocale(request.headers.cookie, typeof languageHeader === "string" ? languageHeader : void 0);
 			setSecurityHeaders(response, this.tlsEnabled);
-			response.setHeader("Vary", "Accept-Language");
+			response.setHeader("Vary", "Accept-Language, Cookie");
 			const body = target.decodedPathname.endsWith(".js") ? renderLoginScript(locale) : renderLoginPage(locale);
 			response.writeHead(200, {
 				"Content-Type": target.decodedPathname.endsWith(".js") ? "text/javascript; charset=utf-8" : "text/html; charset=utf-8",
@@ -17670,16 +17697,20 @@ async function loadOrCreateInstallationId(file) {
 //#endregion
 //#region src/gateway-identity.ts
 /**
-* Use the persisted installation identity for an unpinned, automatically identified entry.
+* Attach the authenticated installation identity while retaining existing entry identity rules.
 * @param config - Validated gateway configuration containing the legacy identity.
 * @param installationId - Confirmed random identity read from this installation's state.
 * @param explicitIdentity - Whether the operator supplied the gateway identity.
 * @returns Configuration retaining certificate/operator identities or the new and legacy public identities.
 */
 function withInstallationIdentity(config, installationId, explicitIdentity) {
-	if (config.pairingCaFile !== void 0 || explicitIdentity) return config;
+	if (config.pairingCaFile !== void 0 || explicitIdentity) return Object.freeze({
+		...config,
+		installationId
+	});
 	return Object.freeze({
 		...config,
+		installationId,
 		instanceId: installationId,
 		legacyInstanceId: config.instanceId
 	});
@@ -18065,10 +18096,10 @@ async function apply(ctx, config) {
 	const dshVersion = installedDshVersion();
 	const loaded = await loadSetup(config);
 	const mobileAccess = createMobileAccessService(ctx);
-	const template = loopbackTemplate(loaded, ctx.webServer.port);
-	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, template.upstreamOrigin);
-	const instanceId = await stableInstanceId(loaded, template);
-	const stateDirectory = dirname(template.stateFile);
+	const baseTemplate = loopbackTemplate(loaded, ctx.webServer.port);
+	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, baseTemplate.upstreamOrigin);
+	const instanceId = await stableInstanceId(loaded, baseTemplate);
+	const stateDirectory = dirname(baseTemplate.stateFile);
 	const logFile = await installMobileFileLogger(ctx, stateDirectory);
 	const logger = ctx.logger("dsh-mobile");
 	logger.info("logging initialized file=%s", logFile);
@@ -18091,6 +18122,10 @@ async function apply(ctx, config) {
 	const frpComponent = new FrpComponentManager({ stateDirectory });
 	await frpComponent.initialize();
 	const frpIdentity = await loadOrCreateInstallationId(join(stateDirectory, "installation-id"));
+	const template = Object.freeze({
+		...baseTemplate,
+		installationId: frpIdentity
+	});
 	const remoteInstanceId = loaded.kind === "managed" ? frpIdentity : loaded.config.instanceId ?? frpIdentity;
 	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"), frpProxyName(frpIdentity), stateDirectory);
 	await frpConfig.initialize();