dsh-remote-mobile 1.1.0 → 1.2.0

package/lib/routes/api.js

@@ -350,14 +350,20 @@ export function createRoutes(store) {
                     ;
                     keepAlive.unref();
                 }
-                req.on('close', () => {
+                let cleaned = false;
+                const cleanup = () => {
+                    if (cleaned)
+                        return;
+                    cleaned = true;
                     clearInterval(keepAlive);
                     store.off('device-connected', onConnected);
                     store.off('device-online', onOnline);
                     store.off('device-revoked', onRevoked);
                     store.off('ip-security-updated', onSecurityUpdated);
                     store.off('ip-security-alert', onSecurityAlert);
-                });
+                };
+                req.on('close', cleanup);
+                res.on('close', cleanup);
             },
         },
     ];

package/lib/routes/login-page.js

@@ -11,7 +11,7 @@ export function getLoginPageHtml(publicKeyPem, lang = 'zh') {
         headerDesc: isEn ? 'Enter 6-digit dynamic pairing code or persistent password' : '请输入 6 位动态配对码或长期访问密码',
         placeholder: isEn ? '6-digit code or password' : '6 位临时配对码 / 长期密码',
         submitBtn: isEn ? 'Authorize & Connect' : '立即授权连接',
-        footerSecurity: isEn ? '🔒 Protected by 2048-bit RSA-OAEP end-to-end encryption' : '🔒 全程受 2048 位 RSA-OAEP 端到端加密保护',
+        footerSecurity: isEn ? '🔒 Protected by 2048-bit RSA encryption' : '🔒 全程受 2048 位 RSA 加密保护',
         verifying: isEn ? '🔐 Encrypting & verifying...' : '🔐 正在 RSA 加密与验证...',
         success: isEn ? 'Authorization successful! Entering workspace...' : '授权成功！正在进入工作区...',
         networkErr: isEn ? 'Network connection error, please try again' : '网络连接异常，请检查网络',
@@ -191,7 +191,7 @@ export function getLoginPageHtml(publicKeyPem, lang = 'zh') {
     const statusMsg = document.getElementById('statusMsg');
     const submitBtn = document.getElementById('submitBtn');
 
-    // 解析 SPKI 格式公钥并提取 n 和 e
+    // 解析 SPKI 格式公钥并提取 n 和 e（用于纯 JS 垫片计算）
     function parseSpkiKey(pemStr) {
       const b64 = pemStr.replace(/-----BEGIN PUBLIC KEY-----/g, '').replace(/-----END PUBLIC KEY-----/g, '').replace(/\\s/g, '');
       const binary = window.atob(b64);
@@ -241,15 +241,25 @@ export function getLoginPageHtml(publicKeyPem, lang = 'zh') {
       return res;
     }
 
+    // 纯 JS RSA 垫片加密：使用 CSPRNG (crypto.getRandomValues) 填充
     function rsaEncryptPureJs(plainText, pubPem) {
       const { n, e, keyLen } = parseSpkiKey(pubPem);
       const msgBytes = new TextEncoder().encode(plainText);
       const padLen = keyLen - 3 - msgBytes.length;
-      const pad = [];
-      while (pad.length < padLen) {
-        const r = Math.floor(Math.random() * 255) + 1;
-        pad.push(r);
+      if (padLen < 8) throw new Error('Message too long');
+
+      const pad = new Uint8Array(padLen);
+      if (window.crypto && typeof window.crypto.getRandomValues === 'function') {
+        window.crypto.getRandomValues(pad);
+        for (let i = 0; i < padLen; i++) {
+          if (pad[i] === 0) pad[i] = (Math.floor(Math.random() * 254) + 1);
+        }
+      } else {
+        for (let i = 0; i < padLen; i++) {
+          pad[i] = Math.floor(Math.random() * 255) + 1;
+        }
       }
+
       const em = new Uint8Array(keyLen);
       em[0] = 0x00;
       em[1] = 0x02;
@@ -272,22 +282,54 @@ export function getLoginPageHtml(publicKeyPem, lang = 'zh') {
       return window.btoa(binary);
     }
 
-    function encryptCredential(plainText) {
+    // 尝试使用 Web Crypto API 原生 RSA-OAEP SHA-256 加密（安全上下文可用）
+    async function trySubtleEncrypt(plainText, pubPem) {
+      if (!window.crypto || !window.crypto.subtle) return null;
+      const b64 = pubPem.replace(/-----BEGIN PUBLIC KEY-----/g, '').replace(/-----END PUBLIC KEY-----/g, '').replace(/\\s/g, '');
+      const binary = window.atob(b64);
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+
+      const cryptoKey = await window.crypto.subtle.importKey(
+        'spki',
+        bytes.buffer,
+        { name: 'RSA-OAEP', hash: 'SHA-256' },
+        false,
+        ['encrypt']
+      );
+
+      const encBuffer = await window.crypto.subtle.encrypt(
+        { name: 'RSA-OAEP' },
+        cryptoKey,
+        new TextEncoder().encode(plainText)
+      );
+
+      const encBytes = new Uint8Array(encBuffer);
+      let binaryEnc = '';
+      for (let i = 0; i < encBytes.length; i++) binaryEnc += String.fromCharCode(encBytes[i]);
+      return window.btoa(binaryEnc);
+    }
+
+    async function encryptCredential(plainText) {
+      try {
+        const subtleB64 = await trySubtleEncrypt(plainText, SERVER_RSA_KEY);
+        if (subtleB64) return { encryptedCredential: subtleB64 };
+      } catch (e) {}
+
       try {
-        const encryptedB64 = rsaEncryptPureJs(plainText, SERVER_RSA_KEY);
-        return { encryptedCredential: encryptedB64 };
+        const pureB64 = rsaEncryptPureJs(plainText, SERVER_RSA_KEY);
+        return { encryptedCredential: pureB64 };
       } catch (err) {
         console.error('RSA encrypt error:', err);
         return { credential: plainText };
       }
     }
 
-    // 自动检测 URL 参数里的 token 快速登录
+    // 检测 URL 参数里的 token，仅回填输入框，不自动触发验证
     const urlParams = new URLSearchParams(window.location.search);
     const queryToken = urlParams.get('token');
     if (queryToken) {
       input.value = queryToken;
-      doVerify(queryToken);
     }
 
     form.addEventListener('submit', (e) => {
@@ -304,7 +346,7 @@ export function getLoginPageHtml(publicKeyPem, lang = 'zh') {
       statusMsg.style.display = 'none';
 
       try {
-        const payload = encryptCredential(credential);
+        const payload = await encryptCredential(credential);
         const res = await fetch('/api/remote-mobile/verify', {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-remote-mobile",
-  "version": "1.1.0",
-  "description": "DeepSeek Hub (DSH) Mobile & Remote Access Security Guard Plugin: Tailscale & LAN bypass, QR scan auth, RSA encryption, brute-force protection, and realtime SSE push.",
+  "version": "1.2.0",
+  "description": "DeepSeek Hub 移动端与远程访问安全网关插件 | DeepSeek Hub (DSH) Mobile & Remote Access Security Guard Plugin: Tailscale & LAN bypass, QR scan auth, RSA encryption, brute-force protection, and realtime SSE push.",
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -23,8 +23,11 @@
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
+  "engines": {
+    "node": ">=18.0.0"
+  },
   "scripts": {
-    "build": "tsc && node scripts/build-client.js",
+    "build": "rm -rf lib && tsc && node scripts/build-client.js",
     "build:server": "tsc",
     "build:client": "node scripts/build-client.js",
     "typecheck": "tsc --noEmit",
@@ -66,6 +69,7 @@
     "cordis.patch.yml",
     "README.md",
     "README_EN.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "license": "MIT",

package/lib/types/auth.d.ts

@@ -1,49 +0,0 @@
-/**
- * 移动端与远程访问安全认证 - 核心类型定义
- */
-export interface PluginConfig {
-    allowTailscale?: boolean;
-    allowLan?: boolean;
-    secret?: string;
-    secretHash?: string;
-    maxVisitsPerMinute?: number;
-    maxFailedAttempts?: number;
-    lockDurationMs?: number;
-}
-export interface SessionInfo {
-    token: string;
-    ip: string;
-    createdAt: number;
-    lastSeenAt: number;
-    userAgent?: string;
-    deviceName?: string;
-    authType: string;
-    isBypass?: boolean;
-}
-export interface ShortCodeInfo {
-    code: string;
-    token: string;
-    createdAt: number;
-    expiresAt: number;
-}
-export interface IpSecurityStat {
-    ip: string;
-    authVisits: number;
-    firstSeenAt: number;
-    lastSeenAt: number;
-    failedAttempts: number;
-    totalAttempts: number;
-    lockedUntil?: number;
-    lockCount: number;
-    authType?: string;
-    deviceName?: string;
-    userAgent?: string;
-}
-export type DeviceEventType = 'device-connected' | 'device-online' | 'device-revoked' | 'ip-security-alert' | 'ip-security-updated';
-export interface DeviceEventPayload {
-    type: DeviceEventType;
-    device?: SessionInfo;
-    ip?: string;
-    reason?: string;
-    stat?: IpSecurityStat;
-}

package/lib/types/auth.js

@@ -1,4 +0,0 @@
-/**
- * 移动端与远程访问安全认证 - 核心类型定义
- */
-export {};