dsh-remote-control-plugin 0.0.0-stage → 0.3.1

package/host/fabric.js

@@ -0,0 +1,595 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
+import dgram from 'node:dgram'
+import http from 'node:http'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+
+const ANNOUNCE_KIND = 'dsh-remote/announce'
+const ANNOUNCE_INTERVAL_MS = 4000
+const PEER_TTL_MS = 15000
+const REQUEST_TTL_MS = 10 * 60 * 1000
+const CLOCK_SKEW_MS = 5 * 60 * 1000
+
+/**
+ * Peer fabric: LAN discovery, one-time approval, and the authenticated
+ * peer-to-peer control calls used by the Devices panel.
+ *
+ * Everything here is plain Node so it can be exercised without Cordis:
+ * `sessions` is a small facade over the Host's session controller.
+ */
+export function createFabric({ log, config, self, sessions, stateFile }) {
+  const peers = new Map() // deviceId -> peer record
+  const requests = new Map() // requestId -> inbound approval request
+  const outgoing = new Map() // deviceId -> { requestId, at }
+  const approvals = new Map() // deviceId -> { deviceName, secret, approvedAt }
+  const sockets = []
+  let announceTimer
+  let reaper
+  let loaded = false
+  let relay
+
+  const discoveryPort = config.discoveryPort
+  const enabled = config.discovery !== false
+
+  async function start() {
+    await loadApprovals()
+    if (!enabled) return
+
+    const socket = dgram.createSocket({ type: 'udp4', reuseAddr: true })
+    sockets.push(socket)
+    socket.on('error', (error) => log.warn(`[remote-control] discovery socket: ${error?.message || error}`))
+    socket.on('message', (buffer, rinfo) => {
+      try {
+        onAnnounce(JSON.parse(buffer.toString('utf8')), rinfo)
+      } catch { /* ignore malformed datagrams */ }
+    })
+    await new Promise((resolve) => {
+      socket.bind(discoveryPort, () => {
+        try { socket.setBroadcast(true) } catch { /* ignore */ }
+        resolve()
+      })
+    })
+
+    announceTimer = setInterval(announce, ANNOUNCE_INTERVAL_MS)
+    announceTimer.unref?.()
+    announce()
+    reaper = setInterval(reap, 5000)
+    reaper.unref?.()
+  }
+
+  function stop() {
+    clearInterval(announceTimer)
+    clearInterval(reaper)
+    for (const socket of sockets) {
+      try { socket.close() } catch { /* ignore */ }
+    }
+    sockets.length = 0
+  }
+
+  function announce() {
+    const who = self()
+    if (!who.deviceId) return
+    const payload = Buffer.from(JSON.stringify({
+      v: 1,
+      kind: ANNOUNCE_KIND,
+      deviceId: who.deviceId,
+      deviceName: who.deviceName,
+      userId: who.userId,
+      port: who.port,
+      proto: who.proto,
+      ts: Date.now(),
+    }))
+    for (const socket of sockets) {
+      try { socket.send(payload, 0, payload.length, discoveryPort, '255.255.255.255') } catch { /* ignore */ }
+      try { socket.send(payload, 0, payload.length, discoveryPort, '127.0.0.1') } catch { /* ignore */ }
+    }
+  }
+
+  function onAnnounce(message, rinfo) {
+    if (!message || message.kind !== ANNOUNCE_KIND) return
+    if (typeof message.deviceId !== 'string' || !message.deviceId) return
+    const who = self()
+    if (message.deviceId === who.deviceId) return
+
+    const existing = peers.get(message.deviceId)
+    peers.set(message.deviceId, {
+      deviceId: message.deviceId,
+      deviceName: typeof message.deviceName === 'string' ? message.deviceName : 'DSH device',
+      userId: typeof message.userId === 'string' ? message.userId : null,
+      address: rinfo.address,
+      port: Number(message.port) || 57330,
+      proto: message.proto === 'https' ? 'https' : 'http',
+      lastSeen: Date.now(),
+      approved: approvals.has(message.deviceId) || Boolean(existing?.approved),
+      secret: approvals.get(message.deviceId)?.secret ?? existing?.secret,
+    })
+  }
+
+  function reap() {
+    const now = Date.now()
+    for (const [deviceId, peer] of peers) {
+      if (peer.proto === 'relay') continue
+      if (now - peer.lastSeen > PEER_TTL_MS) peers.delete(deviceId)
+    }
+    for (const [requestId, request] of requests) {
+      if (now - request.at > REQUEST_TTL_MS) requests.delete(requestId)
+    }
+  }
+
+  /**
+   * Merge relay presence into the peer table. A directly discovered LAN peer
+   * keeps its direct route; relay presence covers devices behind NAT.
+   */
+  function syncRelayPeers() {
+    if (!relay) return
+    const present = new Set()
+    for (const item of relay.peers()) {
+      present.add(item.deviceId)
+      const existing = peers.get(item.deviceId)
+      if (existing && existing.proto !== 'relay') continue
+      peers.set(item.deviceId, {
+        deviceId: item.deviceId,
+        deviceName: item.name,
+        userId: item.userId,
+        address: 'relay',
+        port: 0,
+        proto: 'relay',
+        lastSeen: item.lastSeen,
+        approved: approvals.has(item.deviceId) || Boolean(existing?.approved),
+        secret: approvals.get(item.deviceId)?.secret ?? existing?.secret,
+      })
+    }
+    // Drop relay peers the relay no longer lists, so a device that leaves or a
+    // relay that goes away cannot leave a peer that always answers 503.
+    for (const [deviceId, peer] of peers) {
+      if (peer.proto === 'relay' && !present.has(deviceId)) peers.delete(deviceId)
+    }
+  }
+
+  async function loadApprovals() {
+    if (loaded) return
+    loaded = true
+    try {
+      const raw = JSON.parse(await readFile(stateFile, 'utf8'))
+      for (const [deviceId, entry] of Object.entries(raw?.peers ?? {})) {
+        if (entry && typeof entry.secret === 'string') {
+          approvals.set(deviceId, {
+            deviceName: entry.deviceName ?? 'DSH device',
+            secret: entry.secret,
+            approvedAt: entry.approvedAt ?? Date.now(),
+          })
+        }
+      }
+    } catch (error) {
+      if (error?.code !== 'ENOENT') log.warn(`[remote-control] could not read ${stateFile}: ${error?.message || error}`)
+    }
+  }
+
+  async function saveApprovals() {
+    const peersObject = {}
+    for (const [deviceId, entry] of approvals) peersObject[deviceId] = entry
+    try {
+      await mkdir(path.dirname(stateFile), { recursive: true })
+      await writeFile(stateFile, JSON.stringify({ version: 1, peers: peersObject }, null, 2), { mode: 0o600 })
+    } catch (error) {
+      log.warn(`[remote-control] could not persist ${stateFile}: ${error?.message || error}`)
+    }
+  }
+
+  /* ---------------- inbound: hello + approval ---------------- */
+
+  function createHello(req, res) {
+    readJson(req).then(async (body) => {
+      const deviceId = typeof body?.deviceId === 'string' ? body.deviceId.trim() : ''
+      if (!deviceId) return json(res, 400, { error: 'missing-device' })
+      if (requests.size >= 20) return json(res, 429, { error: 'too-many-requests' })
+      const requestId = randomBytes(16).toString('hex')
+      requests.set(requestId, {
+        requestId,
+        deviceId,
+        deviceName: typeof body.deviceName === 'string' ? body.deviceName : 'DSH device',
+        userId: typeof body.userId === 'string' ? body.userId : null,
+        address: req.socket?.remoteAddress ?? '',
+        at: Date.now(),
+        status: 'pending',
+      })
+      log.info(`[remote-control] approval requested by ${deviceId}`)
+      return json(res, 200, { requestId, status: 'pending' })
+    }).catch((error) => json(res, 400, { error: 'bad-request', message: String(error?.message || error) }))
+  }
+
+  function helloStatus(res, requestId) {
+    const request = requests.get(requestId)
+    if (!request) return json(res, 404, { error: 'unknown-request' })
+    if (request.status === 'approved') {
+      return json(res, 200, { status: 'approved', secret: request.secret, deviceName: self().deviceName })
+    }
+    return json(res, 200, { status: request.status })
+  }
+
+  async function approveRequest(requestId) {
+    const request = requests.get(requestId)
+    if (!request) return { ok: false, error: 'unknown-request' }
+    const secret = randomBytes(32).toString('hex')
+    request.status = 'approved'
+    request.secret = secret
+    approvals.set(request.deviceId, { deviceName: request.deviceName, secret, approvedAt: Date.now() })
+    await saveApprovals()
+    const peer = peers.get(request.deviceId)
+    if (peer) { peer.approved = true; peer.secret = secret }
+    log.info(`[remote-control] approved ${request.deviceName} (${request.deviceId})`)
+    return { ok: true }
+  }
+
+  function denyRequest(requestId) {
+    const request = requests.get(requestId)
+    if (!request) return { ok: false, error: 'unknown-request' }
+    request.status = 'denied'
+    return { ok: true }
+  }
+
+  /* ---------------- outbound: connect to a peer ---------------- */
+
+  async function connect(deviceId) {
+    syncRelayPeers()
+    const peer = peers.get(deviceId)
+    if (!peer) return { ok: false, error: 'unknown-peer' }
+    if (approvals.has(deviceId)) return { ok: true, approved: true }
+
+    const who = self()
+    const reply = await peerCall(peer, 'POST', '/peer/hello', {
+      deviceId: who.deviceId,
+      deviceName: who.deviceName,
+      userId: who.userId,
+    })
+    if (!reply.ok || typeof reply.json?.requestId !== 'string') {
+      return { ok: false, error: reply.json?.error || reply.error || 'hello-failed' }
+    }
+    outgoing.set(deviceId, { requestId: reply.json.requestId, at: Date.now() })
+
+    // Poll in the background; the target approves in its own Devices panel.
+    pollApproval(peer, reply.json.requestId).catch(() => {})
+    return { ok: true, approved: false, requestId: reply.json.requestId }
+  }
+
+  async function pollApproval(peer, requestId) {
+    for (let attempt = 0; attempt < 300; attempt += 1) {
+      await delay(1000)
+      if (!outgoing.has(peer.deviceId)) return
+      const reply = await peerCall(peer, 'GET', `/peer/hello/${requestId}`)
+      const status = reply.json?.status
+      if (status === 'approved' && typeof reply.json.secret === 'string') {
+        approvals.set(peer.deviceId, { deviceName: peer.deviceName, secret: reply.json.secret, approvedAt: Date.now() })
+        await saveApprovals()
+        peer.approved = true
+        peer.secret = reply.json.secret
+        outgoing.delete(peer.deviceId)
+        log.info(`[remote-control] ${peer.deviceName} approved this device`)
+        return
+      }
+      if (status === 'denied') {
+        outgoing.delete(peer.deviceId)
+        return
+      }
+    }
+    outgoing.delete(peer.deviceId)
+  }
+
+  /* ---------------- inbound: authenticated peer calls ---------------- */
+
+  async function handlePeer(req, res, url) {
+    const pathname = url.pathname
+    if (pathname === '/peer/hello' && req.method === 'POST') return createHello(req, res)
+    const helloMatch = pathname.match(/^\/peer\/hello\/([0-9a-f]{32})$/)
+    if (helloMatch && req.method === 'GET') return helloStatus(res, helloMatch[1])
+
+    const verdict = verifyPeer(req, url)
+    if (!verdict.ok) return json(res, 403, { error: verdict.error })
+
+    if (pathname === '/peer/sessions' && req.method === 'GET') {
+      const value = await sessions.list()
+      return json(res, 200, { items: value.map((item) => ({ ...item, title: item.title })) })
+    }
+    if (pathname === '/peer/stream' && req.method === 'GET') {
+      return streamSession(req, res, url)
+    }
+    if (pathname === '/peer/prompt' && req.method === 'POST') {
+      const body = await readJson(req)
+      const sessionId = typeof body?.sessionId === 'string' ? body.sessionId : ''
+      const text = typeof body?.text === 'string' ? body.text : ''
+      if (!sessionId || !text.trim()) return json(res, 400, { error: 'bad-request' })
+      const value = await sessions.prompt(sessionId, text)
+      return json(res, 200, value)
+    }
+    if (pathname === '/peer/cancel' && req.method === 'POST') {
+      const body = await readJson(req)
+      const sessionId = typeof body?.sessionId === 'string' ? body.sessionId : ''
+      if (!sessionId) return json(res, 400, { error: 'bad-request' })
+      return json(res, 200, sessions.cancel(sessionId))
+    }
+    return json(res, 404, { error: 'not-found' })
+  }
+
+  function verifyPeer(req, url) {
+    const deviceId = String(req.headers['x-dsh-peer-id'] || '')
+    const timestamp = String(req.headers['x-dsh-peer-ts'] || '')
+    const signature = String(req.headers['x-dsh-peer-sig'] || '')
+    if (!deviceId || !timestamp || !signature) return { ok: false, error: 'missing-signature' }
+    const approval = approvals.get(deviceId)
+    if (!approval) return { ok: false, error: 'unapproved-device' }
+    if (!/^\d{1,16}$/.test(timestamp) || Math.abs(Date.now() - Number(timestamp)) > CLOCK_SKEW_MS) {
+      return { ok: false, error: 'stale-signature' }
+    }
+    const expected = sign(approval.secret, deviceId, req.method || 'GET', url.pathname + url.search, timestamp, '')
+    const actual = Buffer.from(signature, 'hex')
+    const wanted = Buffer.from(expected, 'hex')
+    if (actual.length !== wanted.length || !timingSafeEqual(actual, wanted)) return { ok: false, error: 'bad-signature' }
+    return { ok: true }
+  }
+
+  async function streamSession(req, res, url) {
+    const sessionId = String(url.searchParams.get('sessionId') || '')
+    if (!sessionId) return json(res, 400, { error: 'missing-session' })
+    const controller = new AbortController()
+    res.writeHead(200, {
+      'content-type': 'text/event-stream; charset=utf-8',
+      'cache-control': 'no-store, no-transform',
+      connection: 'keep-alive',
+      'x-accel-buffering': 'no',
+    })
+    res.write(': connected\n\n')
+    const heartbeat = setInterval(() => { try { res.write(': ping\n\n') } catch { /* ignore */ } }, 15000)
+    heartbeat.unref?.()
+    let closed = false
+    const cleanup = () => {
+      if (closed) return
+      closed = true
+      clearInterval(heartbeat)
+      try { controller.abort() } catch { /* ignore */ }
+      try { res.end() } catch { /* ignore */ }
+    }
+    req.on('close', cleanup)
+    req.on('aborted', cleanup)
+    try {
+      for await (const frame of sessions.follow(sessionId, controller.signal)) {
+        if (res.writableEnded || res.destroyed) break
+        res.write(`data: ${JSON.stringify(frame)}\n\n`)
+      }
+    } catch (error) {
+      if (!controller.signal.aborted) {
+        try {
+          res.write(`data: ${JSON.stringify({ type: 'remote-error', code: error?.code ?? 'error', message: error?.message ?? String(error) })}\n\n`)
+        } catch { /* ignore */ }
+      }
+    } finally {
+      cleanup()
+    }
+  }
+
+  /* ---------------- outbound: control a peer ---------------- */
+
+  /**
+   * One signed call to a peer over whichever transport reaches it: the relay
+   * when the peer was discovered there, direct HTTP for a LAN peer.
+   */
+  async function peerCall(peer, method, pathname, body, secret) {
+    if (peer.proto !== 'relay') {
+      return callRaw(peer, method, pathname, body, secret, self().deviceId)
+    }
+    if (!relay) return { ok: false, status: 503, json: { error: 'relay-offline' } }
+    const callerId = self().deviceId
+    const timestamp = String(Date.now())
+    const headers = { accept: 'application/json' }
+    if (secret) {
+      headers['x-dsh-peer-id'] = callerId
+      headers['x-dsh-peer-ts'] = timestamp
+      headers['x-dsh-peer-sig'] = sign(secret, callerId, method, pathname, timestamp, '')
+    }
+    if (body !== undefined) headers['content-type'] = 'application/json'
+    let reply
+    try {
+      reply = await relay.request(peer.deviceId, {
+        method,
+        path: pathname,
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+      })
+    } catch (error) {
+      return { ok: false, status: 502, json: { error: 'relay-failed', message: error?.message ?? String(error) } }
+    }
+    let parsed
+    try { parsed = reply.body ? JSON.parse(reply.body) : {} } catch { parsed = {} }
+    return { ok: reply.status >= 200 && reply.status < 300, status: reply.status, json: parsed }
+  }
+
+  async function callPeer(deviceId, method, pathname, body) {
+    syncRelayPeers()
+    const peer = peers.get(deviceId)
+    if (!peer) return { ok: false, status: 404, json: { error: 'unknown-peer' } }
+    const approval = approvals.get(deviceId)
+    if (!approval) return { ok: false, status: 403, json: { error: 'not-approved' } }
+    return peerCall(peer, method, pathname, body, approval.secret)
+  }
+
+  /** Relay one peer's SSE transcript to a local response (Devices panel). */
+  function proxyStream(deviceId, sessionId, res) {
+    syncRelayPeers()
+    const peer = peers.get(deviceId)
+    const approval = approvals.get(deviceId)
+    if (!peer || !approval) {
+      json(res, 404, { error: 'unknown-peer' })
+      return
+    }
+    const target = `/peer/stream?sessionId=${encodeURIComponent(sessionId)}`
+    const timestamp = String(Date.now())
+    const callerId = self().deviceId
+    if (peer.proto === 'relay') {
+      if (!relay) {
+        json(res, 503, { error: 'relay-offline' })
+        return
+      }
+      relay.stream(peer.deviceId, {
+        path: target,
+        headers: {
+          accept: 'text/event-stream',
+          'x-dsh-peer-id': callerId,
+          'x-dsh-peer-ts': timestamp,
+          'x-dsh-peer-sig': sign(approval.secret, callerId, 'GET', target, timestamp, ''),
+        },
+      }, res)
+      return
+    }
+    const upstream = http.request({
+      host: peer.address,
+      port: peer.port,
+      path: target,
+      method: 'GET',
+      headers: {
+        accept: 'text/event-stream',
+        'x-dsh-peer-id': callerId,
+        'x-dsh-peer-ts': timestamp,
+        'x-dsh-peer-sig': sign(approval.secret, callerId, 'GET', target, timestamp, ''),
+      },
+    }, (response) => {
+      res.writeHead(response.statusCode ?? 502, {
+        'content-type': response.headers['content-type'] || 'text/event-stream; charset=utf-8',
+        'cache-control': 'no-store, no-transform',
+        connection: 'keep-alive',
+        'x-accel-buffering': 'no',
+      })
+      response.pipe(res)
+      response.on('end', () => { try { res.end() } catch { /* ignore */ } })
+    })
+    upstream.on('error', () => {
+      try { json(res, 502, { error: 'peer-unreachable' }) } catch { /* ignore */ }
+    })
+    res.on('close', () => { try { upstream.destroy() } catch { /* ignore */ } })
+    upstream.end()
+  }
+
+  return {
+    start,
+    stop,
+    connect,
+    approveRequest,
+    denyRequest,
+    callPeer,
+    proxyStream,
+    handlePeer,
+    setRelay(link) {
+      relay = link
+      if (!link) {
+        // Without a relay every relay-only peer is unreachable; keeping it
+        // would make each call fail with a misleading 503.
+        for (const [deviceId, peer] of peers) {
+          if (peer.proto === 'relay') peers.delete(deviceId)
+        }
+      }
+    },
+
+    snapshot() {
+      syncRelayPeers()
+      const who = self()
+      return {
+        self: who,
+        peers: [...peers.values()].map((peer) => ({
+          deviceId: peer.deviceId,
+          deviceName: peer.deviceName,
+          userId: peer.userId,
+          address: peer.address,
+          port: peer.port,
+          lastSeen: peer.lastSeen,
+          approved: approvals.has(peer.deviceId),
+          connecting: outgoing.has(peer.deviceId),
+          transport: peer.proto === 'relay' ? 'relay' : 'lan',
+        })),
+        requests: [...requests.values()]
+          .filter((request) => request.status === 'pending')
+          .map((request) => ({
+            requestId: request.requestId,
+            deviceId: request.deviceId,
+            deviceName: request.deviceName,
+            userId: request.userId,
+            at: request.at,
+          })),
+      }
+    },
+  }
+}
+
+/* ---------------- HTTP helpers ---------------- */
+
+function sign(secret, deviceId, method, pathname, timestamp, body) {
+  return createHmac('sha256', secret)
+    .update(`${deviceId}\n${method}\n${pathname}\n${timestamp}\n${body}`)
+    .digest('hex')
+}
+
+function callRaw(peer, method, pathname, body, secret, callerId) {
+  return new Promise((resolve) => {
+    const text = body === undefined ? '' : JSON.stringify(body)
+    const headers = { accept: 'application/json' }
+    if (text) {
+      headers['content-type'] = 'application/json'
+      headers['content-length'] = Buffer.byteLength(text)
+    }
+    if (secret && callerId) {
+      const timestamp = String(Date.now())
+      headers['x-dsh-peer-id'] = callerId
+      headers['x-dsh-peer-ts'] = timestamp
+      headers['x-dsh-peer-sig'] = sign(secret, callerId, method, pathname, timestamp, '')
+    }
+    const transport = peer.proto === 'https' ? null : http
+    if (!transport) return resolve({ ok: false, error: 'tls-unsupported', json: { error: 'tls-unsupported' } })
+    const req = transport.request({
+      host: peer.address,
+      port: peer.port,
+      path: pathname,
+      method,
+      headers,
+      timeout: 15000,
+    }, (res) => {
+      let data = ''
+      res.on('data', (chunk) => { data += chunk })
+      res.on('end', () => {
+        let parsed
+        try { parsed = data ? JSON.parse(data) : {} } catch { parsed = {} }
+        resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode, json: parsed })
+      })
+    })
+    req.on('timeout', () => { req.destroy(new Error('timeout')) })
+    req.on('error', (error) => resolve({ ok: false, error: error?.message || 'request-failed', json: {} }))
+    req.end(text || undefined)
+  })
+}
+
+function readJson(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    let size = 0
+    req.on('data', (chunk) => {
+      size += chunk.length
+      if (size > 1024 * 1024) { reject(new Error('too large')); req.destroy(); return }
+      chunks.push(chunk)
+    })
+    req.on('end', () => {
+      if (chunks.length === 0) return resolve({})
+      try { resolve(JSON.parse(Buffer.concat(chunks).toString('utf8'))) } catch (error) { reject(error) }
+    })
+    req.on('error', reject)
+  })
+}
+
+function json(res, status, value) {
+  const body = JSON.stringify(value)
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'content-length': Buffer.byteLength(body),
+    'cache-control': 'no-store',
+  })
+  res.end(body)
+}
+
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}