dsh-mobile 0.8.0 → 0.8.1

package/lib/index.d.mts

@@ -542,6 +542,11 @@ export declare class MobileAccessGatewayController {
   isRunning(): boolean;
   /** Start or stop the runtime and persist only a successfully committed transition. */
   setRunning(running: boolean): Promise<void>;
+  /** Change configuration with the runtime stopped, without changing its durable enabled preference. */
+  reconfigure<T>(change: () => Promise<T>, restore: () => Promise<void>): Promise<{
+    value: T;
+    running: boolean;
+  }>;
   /** Stop the runtime after earlier transitions without changing the restart preference. */
   close(): Promise<void>;
   private enable;

package/lib/index.mjs

@@ -1547,6 +1547,15 @@ var ClientModulePreferenceStore = class {
 };
 //#endregion
 //#region src/control.ts
+/** A configuration change failed; recovered distinguishes a restored runtime from an unknown configuration. */
+var MobileAccessReconfigurationError = class extends Error {
+	recovered;
+	constructor(recovered, cause) {
+		super(recovered ? "mobile access configuration restored" : "mobile access configuration requires recovery", { cause });
+		this.recovered = recovered;
+		this.name = "MobileAccessReconfigurationError";
+	}
+};
 /** Keeps one runtime aligned with a changing network selection. */
 var FollowingMobileAccessRuntime = class {
 	select;
@@ -1737,6 +1746,36 @@ var MobileAccessGatewayController = class {
 			else await this.disable();
 		});
 	}
+	/** Change configuration with the runtime stopped, without changing its durable enabled preference. */
+	reconfigure(change, restore) {
+		if (this.closing) return Promise.reject(/* @__PURE__ */ new Error("mobile-access control is closing"));
+		return this.enqueue(async () => {
+			if (!this.initialized) throw new Error("mobile-access control is not initialized");
+			const previous = this.runtime;
+			if (previous !== void 0) try {
+				await previous.close();
+			} catch (error) {
+				throw new MobileAccessReconfigurationError(false, error);
+			}
+			this.runtime = void 0;
+			try {
+				const value = await change();
+				if (previous !== void 0) this.runtime = await this.startRuntime();
+				return {
+					value,
+					running: previous !== void 0
+				};
+			} catch (error) {
+				try {
+					await restore();
+					if (previous !== void 0) this.runtime = await this.startRuntime();
+				} catch (restoreError) {
+					throw new MobileAccessReconfigurationError(false, new AggregateError([error, restoreError]));
+				}
+				throw new MobileAccessReconfigurationError(true, error);
+			}
+		});
+	}
 	/** Stop the runtime after earlier transitions without changing the restart preference. */
 	close() {
 		if (this.closeTask !== void 0) return this.closeTask;
@@ -11829,6 +11868,11 @@ async function saveManagedTrustedNetworks(setupFile, values) {
 	await restrictPrivateFile(setupFile);
 	return next;
 }
+/** Persist an existing managed setup without resetting its identity, paths or extra trusted networks. */
+async function saveManagedSetup(setupFile, setup) {
+	const validated = parseManagedSetup(setup);
+	await atomicWrite(setupFile, `${JSON.stringify(validated, null, 2)}\n`);
+}
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
 	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
@@ -17647,6 +17691,44 @@ async function uninstallVps(serverAddress, uninstall, input, options = {}) {
 	});
 }
 //#endregion
+//#region src/lan-rebind.ts
+/** An unreadable setup is rejected before stopping the listener or replacing any file. */
+var ManagedLanConfigurationError = class extends Error {
+	constructor(cause) {
+		super("managed LAN configuration is unreadable", { cause });
+		this.name = "ManagedLanConfigurationError";
+	}
+};
+/** Rebind an existing listener; callers serialize this call with all other setup-file writes. */
+async function rebindManagedLan(options) {
+	let previous;
+	try {
+		previous = parseManagedSetup(JSON.parse(await readFile(options.setupFile, "utf8")));
+		await readManagedCa(previous.tls);
+	} catch (error) {
+		throw new ManagedLanConfigurationError(error);
+	}
+	const result = await options.controller.reconfigure(async () => {
+		const next = Object.freeze({
+			...previous,
+			networkInterface: options.network.name
+		});
+		await refreshManagedServerCertificate(next, options.network.address);
+		await saveManagedSetup(options.setupFile, next);
+		options.publish(next);
+		return next;
+	}, async () => {
+		await saveManagedSetup(options.setupFile, previous);
+		options.publish(previous);
+		const network = options.selectPrevious?.(previous) ?? selectLanNetwork(void 0, previous.networkInterface);
+		await refreshManagedServerCertificate(previous, network.address);
+	});
+	return {
+		setup: result.value,
+		running: result.running
+	};
+}
+//#endregion
 //#region src/funnel.ts
 const MAX_PROTOCOL_LINE_BYTES = 16384;
 const FUNNEL_START_TIMEOUT_MS = 45e3;
@@ -23614,6 +23696,9 @@ function locateIrohCompanionRoots(importMetaUrl, environment = process.env) {
 async function apply(ctx, config) {
 	const dshVersion = installedDshVersion();
 	const loaded = await loadSetup(config);
+	/** Rebind overrides the managed setup at runtime; the file on disk is the source of truth on restart. */
+	let managedSetupOverride;
+	let lanRebindRecoveryRequired = false;
 	const mobileAccess = createMobileAccessService(ctx);
 	const baseTemplate = loopbackTemplate(loaded, ctx.webServer.port);
 	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, baseTemplate.upstreamOrigin);
@@ -23910,8 +23995,17 @@ async function apply(ctx, config) {
 	let lanGateway;
 	let preparedLanSetup;
 	let trustedNetworksRestartRequired = false;
-	let trustedNetworksWrite = Promise.resolve();
+	let lanConfigurationWork = Promise.resolve();
 	let adminClosing = false;
+	const mutateLan = (operation) => {
+		if (adminClosing) return Promise.reject(new HttpError(503, "unavailable"));
+		const run = lanConfigurationWork.then(() => {
+			if (adminClosing) throw new HttpError(503, "unavailable");
+			return operation();
+		});
+		lanConfigurationWork = run.then(() => {}, () => {});
+		return run;
+	};
 	const startGateway = async (candidateConfig) => {
 		const resolved = withInstallationIdentity(parseGatewayConfig({
 			...candidateConfig,
@@ -23941,12 +24035,13 @@ async function apply(ctx, config) {
 		if (loaded.kind === "unconfigured") throw new Error(preparedLanSetup === void 0 ? "lan_setup_required" : "lan_setup_restart_required");
 		if (loaded.kind === "fixed") return startGateway(loaded.config);
 		const following = new FollowingMobileAccessRuntime(async () => {
-			const network = selectLanNetwork(void 0, loaded.setup.networkInterface);
+			const setup = managedSetupOverride ?? loaded.setup;
+			const network = selectLanNetwork(void 0, setup.networkInterface);
 			return {
 				key: `${network.name}\0${network.address}\0${network.cidr}`,
 				start: async () => startGateway({
 					...loaded.config,
-					...await materializeManagedSetup(loaded.setup)
+					...await materializeManagedSetup(setup)
 				})
 			};
 		}, (error) => {
@@ -24194,6 +24289,8 @@ async function apply(ctx, config) {
 			restartRequired: preparedLanSetup !== void 0
 		} : {},
 		running: lanController.isRunning(),
+		rebindSupported: loaded.kind === "managed",
+		...lanRebindRecoveryRequired ? { recoveryRequired: true } : {},
 		origin: lanGateway?.address().origin,
 		...preparedLanSetup === void 0 ? {} : { pendingOrigin: preparedLanSetup.origin },
 		...lanGateway === void 0 ? {} : { extensions: lanGateway.extensionStatus() }
@@ -24356,13 +24453,10 @@ async function apply(ctx, config) {
 					} catch {
 						throw new HttpError(400, "lan_trusted_networks_invalid");
 					}
-					const write = trustedNetworksWrite.then(async () => {
-						if (adminClosing) throw new HttpError(503, "unavailable");
+					await mutateLan(async () => {
 						await saveManagedTrustedNetworks(loaded.setupFile, values);
 						trustedNetworksRestartRequired = true;
 					});
-					trustedNetworksWrite = write.catch(() => void 0);
-					await write;
 					sendJson(response, 200, await trustedNetworksPayload(), false);
 					return;
 				}
@@ -24391,10 +24485,13 @@ async function apply(ctx, config) {
 					return;
 				}
 				if (request.method === "POST" && lanControl) {
-					const body = await readJsonObject(request, 4096);
-					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
-					if (body.running && loaded.kind === "unconfigured") throw new HttpError(409, preparedLanSetup === void 0 ? "lan_setup_required" : "lan_setup_restart_required");
-					await lanController.setRunning(body.running);
+					const running = (await readJsonObject(request, 4096)).running;
+					if (typeof running !== "boolean") throw new HttpError(400, "bad_request");
+					if (running && loaded.kind === "unconfigured") throw new HttpError(409, preparedLanSetup === void 0 ? "lan_setup_required" : "lan_setup_restart_required");
+					await mutateLan(async () => {
+						if (running && lanRebindRecoveryRequired) throw new HttpError(409, "lan_rebind_recovery_required");
+						await lanController.setRunning(running);
+					});
 					sendJson(response, 200, lanPayload(), false);
 					return;
 				}
@@ -24424,6 +24521,74 @@ async function apply(ctx, config) {
 					sendJson(response, 200, await lanSetupPayload(), false);
 					return;
 				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/lan/networks`) {
+					await lanConfigurationWork;
+					const networks = availableLanNetworks();
+					const preferred = await preferredLanInterfaceNames();
+					let recommendedAddress;
+					try {
+						recommendedAddress = selectLanNetwork(void 0, void 0, void 0, preferred).address;
+					} catch {}
+					const currentInterface = loaded.kind === "managed" ? (managedSetupOverride ?? loaded.setup).networkInterface : void 0;
+					sendJson(response, 200, {
+						supported: loaded.kind === "managed",
+						currentInterface,
+						listenPort: loaded.kind === "managed" ? loaded.setup.listenPort : 3443,
+						platform: process.platform,
+						networks: networks.map((network) => ({
+							name: network.name,
+							address: network.address,
+							cidr: network.cidr,
+							current: network.name === currentInterface,
+							recommended: network.address === recommendedAddress
+						}))
+					}, false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/lan/rebind`) {
+					if (loaded.kind !== "managed") throw new HttpError(409, "lan_rebind_unsupported");
+					const body = await readJsonObject(request, 4096);
+					const networkInterface = typeof body.networkInterface === "string" ? body.networkInterface : "";
+					if (networkInterface === "" || Object.keys(body).some((key) => key !== "networkInterface")) throw new HttpError(400, "bad_request");
+					sendJson(response, 200, await mutateLan(async () => {
+						let network;
+						try {
+							network = selectLanNetwork(void 0, networkInterface);
+						} catch {
+							throw new HttpError(409, "lan_rebind_network_unavailable");
+						}
+						const current = managedSetupOverride ?? loaded.setup;
+						if (!lanRebindRecoveryRequired && current.networkInterface === networkInterface) throw new HttpError(409, "lan_rebind_unchanged");
+						const previousOrigin = lanGateway?.address().origin;
+						try {
+							const result = await rebindManagedLan({
+								setupFile: loaded.setupFile,
+								controller: lanController,
+								network,
+								publish: (setup) => {
+									managedSetupOverride = setup;
+								}
+							});
+							trustedNetworksRestartRequired = false;
+							lanRebindRecoveryRequired = false;
+							return {
+								origin: lanGateway?.address().origin ?? `https://${network.address}:${String(result.setup.listenPort)}`,
+								previousOrigin,
+								restartRequired: false,
+								disconnected: result.running,
+								ready: lanGateway !== void 0
+							};
+						} catch (error) {
+							if (error instanceof ManagedLanConfigurationError) throw new HttpError(409, "lan_rebind_configuration_invalid");
+							if (!(error instanceof MobileAccessReconfigurationError)) throw new HttpError(503, "lan_rebind_unavailable");
+							const recovered = error.recovered;
+							if (!recovered) lanRebindRecoveryRequired = true;
+							logger.error("managed LAN rebind failed; prior configuration restored: %s", String(recovered));
+							throw new HttpError(500, recovered ? "lan_rebind_failed" : "lan_rebind_recovery_required");
+						}
+					}), false);
+					return;
+				}
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/remote/control`) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
@@ -24942,7 +25107,7 @@ async function apply(ctx, config) {
 					stopAdmin,
 					drainRemoteWork,
 					() => releaseManager.dispose(),
-					() => trustedNetworksWrite,
+					() => lanConfigurationWork,
 					disposeMobileCommand,
 					disposeTaskEvents,
 					async () => {
@@ -24965,7 +25130,7 @@ async function apply(ctx, config) {
 				stopAdmin,
 				drainRemoteWork,
 				() => releaseManager.dispose(),
-				() => trustedNetworksWrite,
+				() => lanConfigurationWork,
 				disposeMobileCommand,
 				disposeTaskEvents,
 				async () => {