dsh-remote-mobile 1.1.0

package/lib/auth/tailscale.d.ts

@@ -0,0 +1,36 @@
+/**
+ * 判断 IP 是否为 Tailscale 官方虚拟私网 IP (CGNAT 网段 100.64.0.0/10)
+ * 范围: 100.64.0.0 ~ 100.127.255.255
+ */
+export declare function isTailscaleIp(rawIp?: string): boolean;
+/**
+ * 判断 IP 是否为局域网私有 IP (RFC 1918 规范: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
+ */
+export declare function isLanIp(rawIp?: string): boolean;
+/**
+ * 提取请求的客户端真实 IP（基于底层 Socket 连接，防止外部伪造 X-Forwarded-For，且兼容虚拟化场景）
+ */
+export declare function getClientIp(req: {
+    socket?: {
+        remoteAddress?: string;
+        __dsh_real_remote_address__?: string;
+    };
+    headers?: Record<string, string | string[] | undefined>;
+}): string;
+/**
+ * 获取当前本机的 Tailscale IP
+ */
+export declare function getLocalTailscaleIp(): string | null;
+/**
+ * 获取当前本机局域网 IP (优先常见 en0 / eth0 / wlan0 等)
+ */
+export declare function getLocalLanIp(): string | null;
+/**
+ * 获取本机所有可用的网络 IP
+ */
+export declare function getAllNetworkIps(): {
+    name: string;
+    ip: string;
+    isTailscale: boolean;
+    isLan: boolean;
+}[];

package/lib/auth/tailscale.js

@@ -0,0 +1,128 @@
+import { execSync } from 'node:child_process';
+import { networkInterfaces } from 'node:os';
+/**
+ * 判断 IP 是否为 Tailscale 官方虚拟私网 IP (CGNAT 网段 100.64.0.0/10)
+ * 范围: 100.64.0.0 ~ 100.127.255.255
+ */
+export function isTailscaleIp(rawIp) {
+    if (!rawIp)
+        return false;
+    // 规范化 IPv4 (处理 ::ffff:100.x.y.z 格式)
+    const ip = rawIp.replace(/^::ffff:/, '').trim();
+    if (!ip.startsWith('100.'))
+        return false;
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return false;
+    const second = parseInt(parts[1], 10);
+    return second >= 64 && second <= 127;
+}
+/**
+ * 判断 IP 是否为局域网私有 IP (RFC 1918 规范: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
+ */
+export function isLanIp(rawIp) {
+    if (!rawIp)
+        return false;
+    const ip = rawIp.replace(/^::ffff:/, '').trim();
+    if (ip === '127.0.0.1' || ip === '::1' || ip === 'localhost' || isTailscaleIp(ip))
+        return false;
+    const parts = ip.split('.').map((p) => parseInt(p, 10));
+    if (parts.length !== 4 || parts.some((p) => isNaN(p) || p < 0 || p > 255))
+        return false;
+    const [a, b] = parts;
+    // 10.0.0.0/8
+    if (a === 10)
+        return true;
+    // 172.16.0.0/12
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    // 192.168.0.0/16
+    if (a === 192 && b === 168)
+        return true;
+    return false;
+}
+/**
+ * 提取请求的客户端真实 IP（基于底层 Socket 连接，防止外部伪造 X-Forwarded-For，且兼容虚拟化场景）
+ */
+export function getClientIp(req) {
+    const realAddress = req.socket?.__dsh_real_remote_address__ || req.socket?.remoteAddress;
+    return realAddress?.replace(/^::ffff:/, '') || '127.0.0.1';
+}
+/**
+ * 获取当前本机的 Tailscale IP
+ */
+export function getLocalTailscaleIp() {
+    // 1. 尝试通过 CLI 快速获取
+    try {
+        const out = execSync('tailscale ip -4', { encoding: 'utf8', timeout: 800, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        if (out && isTailscaleIp(out)) {
+            return out;
+        }
+    }
+    catch {
+        // CLI 不可用或未在 PATH 中，回退到网卡扫描
+    }
+    // 2. 扫描系统网卡
+    try {
+        const interfaces = networkInterfaces();
+        for (const name of Object.keys(interfaces)) {
+            for (const info of interfaces[name] || []) {
+                if (info.family === 'IPv4' && !info.internal && isTailscaleIp(info.address)) {
+                    return info.address;
+                }
+            }
+        }
+    }
+    catch { }
+    return null;
+}
+/**
+ * 获取当前本机局域网 IP (优先常见 en0 / eth0 / wlan0 等)
+ */
+export function getLocalLanIp() {
+    try {
+        const interfaces = networkInterfaces();
+        // 优先匹配局域网常规网卡名
+        const preferredOrder = ['en0', 'eth0', 'wlan0', 'Wi-Fi', 'en1', 'eth1'];
+        for (const name of preferredOrder) {
+            for (const info of interfaces[name] || []) {
+                if (info.family === 'IPv4' && !info.internal && isLanIp(info.address)) {
+                    return info.address;
+                }
+            }
+        }
+        // 遍历所有其他可用网卡
+        for (const name of Object.keys(interfaces)) {
+            for (const info of interfaces[name] || []) {
+                if (info.family === 'IPv4' && !info.internal && isLanIp(info.address)) {
+                    return info.address;
+                }
+            }
+        }
+    }
+    catch { }
+    return null;
+}
+/**
+ * 获取本机所有可用的网络 IP
+ */
+export function getAllNetworkIps() {
+    const list = [];
+    try {
+        const interfaces = networkInterfaces();
+        for (const name of Object.keys(interfaces)) {
+            for (const info of interfaces[name] || []) {
+                if (info.family === 'IPv4' && !info.internal) {
+                    list.push({
+                        name,
+                        ip: info.address,
+                        isTailscale: isTailscaleIp(info.address),
+                        isLan: isLanIp(info.address),
+                    });
+                }
+            }
+        }
+    }
+    catch { }
+    return list;
+}

package/lib/auth/token.d.ts

@@ -0,0 +1,130 @@
+import { EventEmitter } from 'node:events';
+import type { IncomingMessage } from 'node:http';
+export declare const AUTH_COOKIE_NAME = "dsh_mobile_token";
+export declare const DEFAULT_PERSIST_FILE: string;
+export declare const GLOBAL_SETTINGS_FILE: string;
+/**
+ * 从 ~/.dsh/settings.yaml 中安全读取 dsh-remote-mobile 命名空间的最新配置
+ */
+export declare function readFromSettingsYaml(filePath?: string): Partial<SessionStoreOptions>;
+/**
+ * 从 ~/.dsh/settings.yaml 中读取全局语言偏好 (locale.preference)
+ */
+export declare function readGlobalLocale(filePath?: string): 'zh' | 'en';
+/**
+ * 将最新的插件配置安全写回 ~/.dsh/settings.yaml 中的 dsh-remote-mobile 命名空间
+ */
+export declare function writeBackToSettingsYaml(options: SessionStoreOptions, filePath?: string): boolean;
+export interface SessionRecord {
+    token: string;
+    createdAt: number;
+    lastSeenAt: number;
+    ip?: string;
+    deviceName?: string;
+    userAgent?: string;
+    authType?: string;
+    isBypass?: boolean;
+}
+export interface ShortCodeRecord {
+    code: string;
+    token: string;
+    createdAt: number;
+    expiresAt: number;
+}
+export interface IpSecurityStat {
+    ip: string;
+    authVisits: number;
+    authVisitsInWindow: number;
+    windowStart: number;
+    failedAttempts: number;
+    totalAttempts: number;
+    lockedUntil: number;
+    lastAttemptAt: number;
+    lastSeenAt: number;
+    authType?: string;
+    deviceName?: string;
+    userAgent?: string;
+}
+export interface SessionStoreOptions {
+    allowTailscale?: boolean;
+    allowLan?: boolean;
+    secret?: string;
+    secretHash?: string;
+    devicesFile?: string;
+    maxFailedAttempts?: number;
+    lockDurationMs?: number;
+    maxVisitsPerMinute?: number;
+}
+/**
+ * 将 User-Agent 字符串解析为人类友好的设备名称
+ */
+export declare function parseDeviceName(ua?: string): string;
+export declare class SessionStore extends EventEmitter {
+    private sessions;
+    private shortCodes;
+    private ipStats;
+    private options;
+    private settingsMutator?;
+    readonly persistPath: string;
+    readonly settingsFilePath: string | null;
+    constructor(options?: SessionStoreOptions);
+    getOptions(): Required<SessionStoreOptions>;
+    hasSecret(): boolean;
+    setSettingsMutator(mutator: (patch: Partial<SessionStoreOptions>) => void): void;
+    updateOptions(newOpts: Partial<SessionStoreOptions>, syncToSettings?: boolean): void;
+    /**
+     * 记录 IP 打开 /auth 页面的计数并进行限频判定与设备指纹解析
+     */
+    recordAuthVisit(ip: string, userAgent?: string): {
+        allowed: boolean;
+        lockedUntil?: number;
+        reason?: string;
+    };
+    /**
+     * 检查 IP 是否被防暴力破解锁定
+     */
+    isIpLocked(ip: string): {
+        locked: boolean;
+        lockedUntil?: number;
+        remainingSeconds?: number;
+    };
+    /**
+     * 获取所有 IP 的安全审计统计数据
+     */
+    getIpSecurityStats(): IpSecurityStat[];
+    /**
+     * 管理员手动解锁某个 IP
+     */
+    unlockIp(ip: string): boolean;
+    generateShortCode(): {
+        code: string;
+        token: string;
+        expiresAt: number;
+    };
+    verify(credential: string, userAgent?: string, clientIp?: string): {
+        success: boolean;
+        token?: string;
+        reason?: string;
+        locked?: boolean;
+        remainingSeconds?: number;
+    };
+    private handleFailedAttempt;
+    validateToken(token: string, clientIp?: string): boolean;
+    extractTokenFromRequest(req: IncomingMessage): string | null;
+    /**
+     * 自动登记并归因免密直连设备（Tailscale / LAN）
+     */
+    registerBypassDevice(ip: string, userAgent: string | undefined, type: 'Tailscale' | 'LAN'): SessionRecord;
+    getSessionsList(): {
+        count: number;
+        devices: Array<Omit<SessionRecord, 'userAgent'>>;
+    };
+    revokeDevice(token: string): boolean;
+    revokeAllSessions(): void;
+    /**
+     * 清空所有 IP 安全审计与防暴破统计记录
+     */
+    clearAllIpSecurityStats(): void;
+    loadPersistedData(): void;
+    savePersistedData(): void;
+}