dsh-mobile 0.6.17 → 0.6.18

package/lib/index.d.mts

@@ -323,6 +323,8 @@ interface PluginConfig {
   upstreamOrigin?: string;
   publicAuthorities?: string[];
   allowedCidrs?: string[];
+  /** Extra direct management peers; every non-loopback request still requires DSH authentication. */
+  adminAllowedCidrs?: string[];
   stateFile: string;
   /** Internal persisted on/off preference managed by the DSH plugin card. */
   controlFile: string;
@@ -384,6 +386,7 @@ interface ResolvedGatewayConfig {
   readonly upstreamOrigin: URL;
   readonly authorities: readonly AuthoritySpec[];
   readonly allowedCidrs: readonly ParsedCidr[];
+  readonly adminAllowedCidrs: readonly ParsedCidr[];
   readonly stateFile: string;
   /** Local extension root adjacent to the mobile-access state file. */
   readonly extensionsDir: string;

package/lib/index.mjs

@@ -958,6 +958,7 @@ const Config = z.object({
 	upstreamOrigin: z.string(),
 	publicAuthorities: z.array(String).default(void 0),
 	allowedCidrs: z.array(String).default(void 0),
+	adminAllowedCidrs: z.array(String).default([]),
 	stateFile: String,
 	controlFile: z.string().hidden().required(),
 	customCssFile: z.string().hidden(),
@@ -1111,6 +1112,11 @@ function parseGatewayConfig(raw) {
 	if (new Set(authorities.map((entry) => `${entry.hostname}:${String(entry.port ?? listenPort)}`)).size !== authorities.length) throw new Error("publicAuthorities must not contain duplicates");
 	const allowedCidrs = stringArray(value.allowedCidrs ?? (isLoopbackAddress(listenHost) ? ["127.0.0.0/8", "::1/128"] : void 0), "allowedCidrs").map(parseCidr);
 	if (new Set(allowedCidrs.map((entry) => `${String(entry.bits)}:${entry.network.toString(16)}:${String(entry.prefix)}`)).size !== allowedCidrs.length) throw new Error("allowedCidrs must not contain duplicates");
+	const adminSources = value.adminAllowedCidrs === void 0 ? [] : value.adminAllowedCidrs;
+	if (!Array.isArray(adminSources) || adminSources.length > 32 || adminSources.some((source) => typeof source !== "string")) throw new Error("adminAllowedCidrs must contain at most 32 CIDR strings");
+	const adminAllowedCidrs = adminSources.map(parseCidr);
+	if (adminAllowedCidrs.some((entry) => entry.prefix === 0)) throw new Error("adminAllowedCidrs must not allow every address");
+	if (new Set(adminAllowedCidrs.map((entry) => `${String(entry.bits)}:${entry.network.toString(16)}:${String(entry.prefix)}`)).size !== adminAllowedCidrs.length) throw new Error("adminAllowedCidrs must not contain duplicates");
 	const deviceTtlMs = integer(value.deviceTtlMs, "deviceTtlMs", 7776e6, 6e4, 316224e5);
 	const sessionTtlMs = integer(value.sessionTtlMs, "sessionTtlMs", 288e5, 3e4, 864e5);
 	if (sessionTtlMs > deviceTtlMs) throw new Error("sessionTtlMs must not exceed deviceTtlMs");
@@ -1121,6 +1127,7 @@ function parseGatewayConfig(raw) {
 		upstreamOrigin,
 		authorities: Object.freeze(authorities),
 		allowedCidrs: Object.freeze(allowedCidrs),
+		adminAllowedCidrs: Object.freeze(adminAllowedCidrs),
 		stateFile: absoluteFile(value.stateFile, "stateFile"),
 		extensionsDir: join(dirname(absoluteFile(value.stateFile, "stateFile")), "extensions"),
 		customCssFile: value.customCssFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.css") : absoluteFile(value.customCssFile, "customCssFile"),
@@ -1896,9 +1903,11 @@ function localAuthority(header) {
 		return;
 	}
 }
-/** Protect the inner management route from non-loopback and DNS-rebinding callers. */
-function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDesktop = () => false) {
-	if (request.socket.remoteAddress === void 0 || !isLoopbackAddress(request.socket.remoteAddress)) throw new HttpError(403, "forbidden");
+/** Protect management with direct-peer, Host, browser-source and optional authenticated-network admission. */
+function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDesktop = () => false, adminAllowedCidrs = []) {
+	const peer = request.socket.remoteAddress;
+	const loopback = peer !== void 0 && isLoopbackAddress(peer);
+	if (!loopback && !addressAllowed(peer, adminAllowedCidrs)) throw new HttpError(403, "forbidden");
 	const host = localAuthority(request.headers.host);
 	if (host === void 0 || !isLocalAdminHostname(host.hostname)) throw new HttpError(403, "forbidden");
 	if (request.method === "OPTIONS") throw new HttpError(403, "forbidden");
@@ -1917,6 +1926,7 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 	const webRequest = request.method === "POST" && (site === void 0 || site === "same-origin") && request.headers["x-dsh-mobile-web-admin"] === "same-origin-json" && request.headers["x-dsh-mobile-desktop-admin"] === void 0 && typeof contentType === "string" && contentType.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
 	if (requireBrowserOrigin && origin === void 0 && !webRequest && !(desktopForward && authenticateDesktop())) throw new HttpError(403, "forbidden");
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
+	if (!loopback && !authenticateDesktop()) throw new HttpError(401, "admin_authentication_required");
 }
 //#endregion
 //#region src/browser-auth-cookies.ts
@@ -3111,6 +3121,52 @@ async function listWorkspaceDirectories(path, signal) {
 		truncated
 	});
 }
+/**
+* Resolve exactly one child name without drive-relative or reserved Win32 spellings.
+* @param path - Fully qualified parent without a home/current-drive fallback.
+* @param name - Single non-blank path segment.
+* @param platform - Host path rules, explicit for portable parser tests.
+* @returns The child path whose immediate parent is the normalized requested directory.
+*/
+function workspaceDirectoryChildPath(path, name, platform = process.platform) {
+	if (typeof path !== "string" || path.length === 0) throw new HttpError(400, "directory_create_invalid");
+	if (typeof name !== "string" || name.length === 0 || name.length > 255 || name.trim() === "" || name === "." || name === ".." || name.includes("/") || name.includes("\\") || name.includes("\0") || isAbsolute(name) || platform === "win32" && (/[<>:"|?*\u0000-\u001f]/u.test(name) || /[. ]$/u.test(name) || /^(?:CON|PRN|AUX|NUL|COM[1-9¹²³]|LPT[1-9¹²³])(?:\.|$)/iu.test(name))) throw new HttpError(400, "directory_create_invalid");
+	const paths = platform === "win32" ? win32 : posix;
+	const parent = resolveWorkspaceDirectoryPath(path, platform);
+	const child = paths.resolve(parent, name);
+	if (paths.dirname(child) !== parent) throw new HttpError(400, "directory_create_invalid");
+	return child;
+}
+/**
+* Create one child directory under an explicitly confirmed existing parent.
+* @param path - Fully qualified existing parent; no home/default fallback is used.
+* @param name - One non-blank segment accepted by the Host filesystem rules.
+* @param signal - Cancellation withdraws admission/results, never a completed mkdir.
+* @returns The created directory's absolute path after filesystem work settles.
+*/
+async function createWorkspaceDirectory(path, name, signal) {
+	signal?.throwIfAborted();
+	const created = workspaceDirectoryChildPath(path, name);
+	const parent = resolveWorkspaceDirectoryPath(path);
+	let stats;
+	try {
+		stats = await stat(parent);
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
+		throw new HttpError(404, "directory_unavailable");
+	}
+	if (!stats.isDirectory()) throw new HttpError(400, "directory_create_invalid");
+	signal?.throwIfAborted();
+	try {
+		await mkdir(created);
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
+		if (error.code === "EEXIST") throw new HttpError(409, "directory_exists");
+		throw new HttpError(400, "directory_create_failed");
+	}
+	signal?.throwIfAborted();
+	return Object.freeze({ path: created });
+}
 /** Read one bounded regular image file selected by an authenticated device. */
 async function readComputerImage(path, signal) {
 	signal?.throwIfAborted();
@@ -6735,7 +6791,7 @@ var MobileAccessGateway = class {
 		}
 		const computerImages = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-images`;
 		const computerImage = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-image`;
-		const workspaceDirectories = request.method === "GET" && target.decodedPathname === `/mobile-access/workspace-directories`;
+		const workspaceDirectories = (request.method === "GET" || request.method === "POST") && target.decodedPathname === `/mobile-access/workspace-directories`;
 		const clientModules = target.decodedPathname === `${AUTH_PREFIX}/client-modules`;
 		const requestedExtension = extensionTarget(target.decodedPathname);
 		const requestedMobileBootBatch = mobileBootBatchKey(target.decodedPathname);
@@ -6898,10 +6954,18 @@ var MobileAccessGateway = class {
 			response.once("close", onClose);
 			const task = (async () => {
 				try {
-					const query = new URL(target.raw, this.address().origin).searchParams;
-					const listing = await listWorkspaceDirectories(query.get("path"), operation.signal);
-					operation.signal.throwIfAborted();
-					sendJson(response, 200, listing, this.tlsEnabled);
+					if (request.method === "POST") {
+						const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+						if (typeof body.path !== "string" || body.path.length === 0 || typeof body.name !== "string") throw new HttpError(400, "directory_create_invalid");
+						const created = await createWorkspaceDirectory(body.path, body.name, operation.signal);
+						operation.signal.throwIfAborted();
+						sendJson(response, 201, created, this.tlsEnabled);
+					} else {
+						const query = new URL(target.raw, this.address().origin).searchParams;
+						const listing = await listWorkspaceDirectories(query.get("path"), operation.signal);
+						operation.signal.throwIfAborted();
+						sendJson(response, 200, listing, this.tlsEnabled);
+					}
 				} catch (error) {
 					if (operation.signal.aborted && error === operation.signal.reason) return;
 					throw error;
@@ -7617,8 +7681,7 @@ var MobileAccessGateway = class {
 			let body;
 			if (stockFrontend) body = Buffer.from(ensureMobileGatewayMarker(index.html));
 			else {
-				const preference = await this.clientModulePreferences.read(authorization.deviceId);
-				const excludedClientModules = preference.excludedClientModules;
+				const excludedClientModules = (await this.clientModulePreferences.read(authorization.deviceId)).excludedClientModules;
 				try {
 					const html = index.html;
 					const plan = parseMobileBootPlan(html, excludedClientModules);
@@ -7645,22 +7708,15 @@ var MobileAccessGateway = class {
 							this.lastModuleExclusionError = detail;
 							process.emitWarning(detail, { code: "DSH_MOBILE_MODULE_EXCLUSION_INVALID" });
 						}
-						if (preference.source === "device" || preference.source === "computer") {
-							operation.signal.throwIfAborted();
-							const locale = resolveAuthPageLocale(headerValue(request.headers, "accept-language"));
-							const recovery = Buffer.from(renderClientModuleRecoveryPage(locale));
-							setSecurityHeaders(response, this.tlsEnabled);
-							response.writeHead(200, {
-								"Content-Type": "text/html; charset=utf-8",
-								"Content-Length": recovery.byteLength
-							});
-							response.end(recovery);
-							return;
-						}
-						sendJson(response, 409, {
-							error: "excluded_client_modules_invalid",
-							detail
-						}, this.tlsEnabled);
+						operation.signal.throwIfAborted();
+						const locale = resolveAuthPageLocale(headerValue(request.headers, "accept-language"));
+						const recovery = Buffer.from(renderClientModuleRecoveryPage(locale));
+						setSecurityHeaders(response, this.tlsEnabled);
+						response.writeHead(200, {
+							"Content-Type": "text/html; charset=utf-8",
+							"Content-Length": recovery.byteLength
+						});
+						response.end(recovery);
 						return;
 					}
 					throw new HttpError(502, "upstream_unavailable");
@@ -11255,6 +11311,31 @@ function parseAdditionalTrustedNetworks(value) {
 	}
 	return Object.freeze(entries);
 }
+/**
+* Refresh the legacy `upstreamOrigin` snapshot to the DSH port actually in use.
+*
+* The runtime deliberately follows the WebServer port instead of this field (a Desktop
+* profile can start with `--port 0`), but a stale snapshot is indistinguishable from a
+* stale gateway to whoever reads the file while diagnosing a restart — #273 became a
+* manual edit because of it. Rewriting it keeps the file honest without changing which
+* upstream the gateway uses.
+*
+* @param setupFile - Existing managed setup file.
+* @param setup - The setup as it was read.
+* @param webServerPort - The port the active DSH WebServer bound.
+* @returns Whether the file needed rewriting.
+*/
+async function refreshManagedUpstreamOrigin(setupFile, setup, webServerPort) {
+	if (!Number.isInteger(webServerPort) || webServerPort <= 0) return false;
+	const upstreamOrigin = `http://127.0.0.1:${String(webServerPort)}`;
+	if (setup.upstreamOrigin === upstreamOrigin) return false;
+	const next = Object.freeze({
+		...setup,
+		upstreamOrigin
+	});
+	await atomicWrite(setupFile, `${JSON.stringify(next, null, 2)}\n`);
+	return true;
+}
 /** Save extra trusted networks without replacing the interface or pairing identity.
 * @param setupFile - Existing managed setup file.
 * @param values - Explicitly selected additional networks.
@@ -18632,11 +18713,18 @@ async function apply(ctx, config) {
 	const mobileAccess = createMobileAccessService(ctx);
 	const baseTemplate = loopbackTemplate(loaded, ctx.webServer.port);
 	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, baseTemplate.upstreamOrigin);
+	const adminLogin = upstreamLoginUrl === void 0 ? void 0 : new URL(upstreamLoginUrl);
+	const supportsRemoteAdminAuthentication = adminLogin !== void 0 && adminLogin.origin === baseTemplate.upstreamOrigin.origin && adminLogin.pathname === "/" && adminLogin.username === "" && adminLogin.password === "" && adminLogin.hash === "" && (adminLogin.searchParams.get("token")?.length ?? 0) > 0;
 	const instanceId = await stableInstanceId(loaded, baseTemplate);
 	const stateDirectory = dirname(baseTemplate.stateFile);
 	const logFile = await installMobileFileLogger(ctx, stateDirectory);
 	const logger = ctx.logger("dsh-mobile");
 	logger.info("logging initialized file=%s", logFile);
+	if (loaded.kind === "managed" && typeof ctx.webServer.port === "number") try {
+		if (await refreshManagedUpstreamOrigin(loaded.setupFile, loaded.setup, ctx.webServer.port)) logger.info("dsh-mobile: refreshed the managed setup upstream snapshot to the active DSH port");
+	} catch (error) {
+		logger.warn("dsh-mobile: could not refresh the managed setup upstream snapshot: %s", error instanceof Error ? error.message : String(error));
+	}
 	const taskEventHub = new TaskEventHub();
 	const disposeTaskEvents = watchTaskCompletions(ctx, {
 		onTaskCompleted: (event) => taskEventHub.broadcast(event),
@@ -19030,7 +19118,7 @@ async function apply(ctx, config) {
 		handler: async (request, response) => {
 			try {
 				const target = parseRequestTarget(request.url);
-				assertLocalAdminTrust(request, request.method === "POST", () => authenticateDesktopAdmin(request));
+				assertLocalAdminTrust(request, request.method === "POST", () => (isLoopbackAddress(request.socket.remoteAddress ?? "") || supportsRemoteAdminAuthentication) && authenticateDesktopAdmin(request), baseTemplate.adminAllowedCidrs);
 				if (adminClosing) throw new HttpError(503, "unavailable");
 				if (target.search !== "") throw new HttpError(400, "bad_request");
 				const lanControl = target.decodedPathname === `/api/mobile-access/control` || target.decodedPathname === `/api/mobile-access/lan/control`;