dsh-remote-mobile 1.1.0

package/lib/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * DeepSeek Hub (DSH) 移动端远程控制与网络安全门禁插件
+ *
+ * 【插件主入口】
+ * 本插件为 DSH 提供完整的远程接入与安全治理体系，包括：
+ * 1. RSA 2048 端到端传输加密与防中间人窃听；
+ * 2. 6 位一次性安全配对码与 365 天长效会话 Token；
+ * 3. 自定义高强度长期密码与加盐哈希存储；
+ * 4. Tailscale 虚拟私网与局域网 LAN 智能免密直连切换；
+ * 5. 防暴力破解限流与单 IP 异常访问熔断审计；
+ * 6. 全链路网络上下文虚拟化桥接与 @linxin666 生态无缝兼容。
+ * 7. 接入 DSH Settings 服务，配置统一持久化于 ~/.dsh/settings.yaml 的 dsh-remote-mobile 命名空间。
+ */
+import { type SessionStoreOptions } from './auth/token.js';
+/** Cordis 插件名称标识 */
+export declare const name = "dsh-remote-mobile";
+/** DSH 设置命名空间 */
+export declare const REMOTE_MOBILE_SETTINGS_NAMESPACE = "dsh-remote-mobile";
+/** Cordis 依赖注入声明：声明注入底座内置的 webServer 服务 */
+export declare const inject: string[];
+/**
+ * 插件生命周期挂载入口函数
+ *
+ * @param ctx - Cordis 应用上下文
+ * @param config - 插件持久化配置选项 (SessionStoreOptions)
+ */
+export declare function apply(ctx: any, config?: SessionStoreOptions): void;
+export * from './auth/tailscale.js';
+export * from './auth/token.js';
+export * from './auth/gate.js';
+export * from './routes/api.js';
+export * from './bridge/compat.js';

package/lib/index.js

@@ -0,0 +1,117 @@
+/**
+ * DeepSeek Hub (DSH) 移动端远程控制与网络安全门禁插件
+ *
+ * 【插件主入口】
+ * 本插件为 DSH 提供完整的远程接入与安全治理体系，包括：
+ * 1. RSA 2048 端到端传输加密与防中间人窃听；
+ * 2. 6 位一次性安全配对码与 365 天长效会话 Token；
+ * 3. 自定义高强度长期密码与加盐哈希存储；
+ * 4. Tailscale 虚拟私网与局域网 LAN 智能免密直连切换；
+ * 5. 防暴力破解限流与单 IP 异常访问熔断审计；
+ * 6. 全链路网络上下文虚拟化桥接与 @linxin666 生态无缝兼容。
+ * 7. 接入 DSH Settings 服务，配置统一持久化于 ~/.dsh/settings.yaml 的 dsh-remote-mobile 命名空间。
+ */
+import { SessionStore } from './auth/token.js';
+import { createGlobalAuthGate } from './auth/gate.js';
+import { createRoutes } from './routes/api.js';
+import { getLocalTailscaleIp } from './auth/tailscale.js';
+import { patchHttpServerWithVirtualizer, mountIndexInjections, registerRemoteWebUiPairingBridge, } from './bridge/compat.js';
+/** Cordis 插件名称标识 */
+export const name = 'dsh-remote-mobile';
+/** DSH 设置命名空间 */
+export const REMOTE_MOBILE_SETTINGS_NAMESPACE = 'dsh-remote-mobile';
+/** Cordis 依赖注入声明：声明注入底座内置的 webServer 服务 */
+export const inject = ['webServer'];
+/**
+ * 注册并绑定 DSH Settings 服务（若存在）
+ */
+function bindDshSettings(ctx, store) {
+    try {
+        let settingsService = null;
+        if (typeof ctx.get === 'function') {
+            settingsService = ctx.get('settings');
+        }
+        if (!settingsService?.register)
+            return;
+        const ns = REMOTE_MOBILE_SETTINGS_NAMESPACE;
+        const scope = settingsService.register(ns, undefined, {
+            base: store.getOptions(),
+        });
+        if (scope) {
+            // 1. 同步 settings.yaml 中的最新配置到 SessionStore
+            const initialVal = scope.get?.();
+            if (initialVal && typeof initialVal === 'object') {
+                store.updateOptions(initialVal, false);
+            }
+            // 2. 监听 settings.yaml 或 Web UI 配置变更
+            scope.watch?.(() => {
+                const updated = scope.get?.();
+                if (updated && typeof updated === 'object') {
+                    store.updateOptions(updated, false);
+                }
+            });
+            // 3. 绑定反向写入钩子：当插件 API 修改配置时同步写回 settings.yaml
+            store.setSettingsMutator((patch) => {
+                try {
+                    const ops = Object.entries(patch).map(([field, value]) => ({
+                        op: 'set',
+                        path: [field],
+                        value,
+                    }));
+                    settingsService.mutate?.(ns, ops);
+                }
+                catch { }
+            });
+        }
+    }
+    catch { }
+}
+/**
+ * 插件生命周期挂载入口函数
+ *
+ * @param ctx - Cordis 应用上下文
+ * @param config - 插件持久化配置选项 (SessionStoreOptions)
+ */
+export function apply(ctx, config = {}) {
+    // 1. 初始化会话与令牌持久化管理器
+    const store = new SessionStore(config);
+    const gateMiddleware = createGlobalAuthGate(store);
+    // 2. 接入 DSH Settings 服务 (命名空间: dsh-remote-mobile)
+    bindDshSettings(ctx, store);
+    // 3. 挂载底座 WebServer 相关的门禁拦截与路由注册
+    if (ctx.webServer) {
+        if (ctx.webServer.server) {
+            patchHttpServerWithVirtualizer(ctx.webServer.server, gateMiddleware, store);
+        }
+        // 挂载 HTML 模板层的 Crypto Polyfill 注入钩子
+        mountIndexInjections(ctx);
+        // 注册插件专属的 HTTP & SSE API 路由
+        if (typeof ctx.webServer.register === 'function') {
+            const routes = createRoutes(store);
+            for (const route of routes) {
+                ctx.webServer.register(route);
+            }
+        }
+    }
+    // 4. 向 Cordis 容器桥接注册 remoteWebUiPairing 服务
+    // 完美兼容 @linxin666 生态插件（如 dsh-pet 宠物、任务看板等），实现免登信任自动共享
+    registerRemoteWebUiPairingBridge(ctx, store);
+    // 5. 延迟补丁与服务启动日志输出
+    setTimeout(() => {
+        if (ctx.webServer && ctx.webServer.server) {
+            patchHttpServerWithVirtualizer(ctx.webServer.server, gateMiddleware, store);
+        }
+        const tsIp = getLocalTailscaleIp();
+        const opts = store.getOptions();
+        ctx.logger?.info?.(`[dsh-remote-mobile] 移动端远程控制与安全门禁已激活 (上下文虚拟化桥接就绪)`);
+        if (tsIp) {
+            ctx.logger?.info?.(`[dsh-remote-mobile] Tailscale 地址: http://${tsIp}:3080 (免密直连: ${opts.allowTailscale ? '已开启' : '已关闭'})`);
+        }
+    }, 300);
+}
+// 导出所有子模块类型与核心工具
+export * from './auth/tailscale.js';
+export * from './auth/token.js';
+export * from './auth/gate.js';
+export * from './routes/api.js';
+export * from './bridge/compat.js';

package/lib/routes/api.d.ts

@@ -0,0 +1,11 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type SessionStore } from '../auth/token.js';
+export declare function createRoutes(store: SessionStore): ({
+    method: string;
+    path: string;
+    handler: (_req: IncomingMessage, res: ServerResponse) => Promise<void>;
+} | {
+    method: string;
+    path: string;
+    handler: (req: IncomingMessage, res: ServerResponse) => Promise<ServerResponse<IncomingMessage> | undefined>;
+})[];

package/lib/routes/api.js

@@ -0,0 +1,364 @@
+import { AUTH_COOKIE_NAME, readGlobalLocale } from '../auth/token.js';
+import { getLocalTailscaleIp, getLocalLanIp, getAllNetworkIps, getClientIp, isTailscaleIp, isLanIp } from '../auth/tailscale.js';
+import { getPublicKeyPem, decryptWithPrivateKey, validateSecretStrength, RSA_KEY_FILE } from '../auth/crypto.js';
+import { getLoginPageHtml } from './login-page.js';
+function jsonResponse(res, status, data) {
+    res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Cache-Control': 'no-cache, no-store, must-revalidate',
+    });
+    res.end(JSON.stringify(data));
+}
+function getRealClientIp(req) {
+    const real = req.headers['x-dsh-real-ip'];
+    if (typeof real === 'string' && real)
+        return real;
+    return getClientIp(req);
+}
+function parseJsonBody(req) {
+    return new Promise((resolve) => {
+        let body = '';
+        req.on('data', (chunk) => {
+            body += chunk;
+            if (body.length > 1e5)
+                req.destroy();
+        });
+        req.on('end', () => {
+            try {
+                resolve(JSON.parse(body || '{}'));
+            }
+            catch {
+                resolve({});
+            }
+        });
+        req.on('error', () => resolve({}));
+    });
+}
+export function createRoutes(store) {
+    return [
+        // 0. RSA 公钥获取接口 (RSA-OAEP-SHA256)
+        {
+            method: 'GET',
+            path: '/api/remote-mobile/public-key',
+            handler: async (_req, res) => {
+                jsonResponse(res, 200, {
+                    success: true,
+                    publicKey: getPublicKeyPem(),
+                    algorithm: 'RSA-OAEP-SHA256',
+                });
+            },
+        },
+        // 1. 状态查询接口 (返回 Tailscale IP、局域网 LAN IP 与 IP 防暴破安全统计)
+        {
+            method: 'GET',
+            path: '/api/remote-mobile/status',
+            handler: async (_req, res) => {
+                const opts = store.getOptions();
+                const tsIp = getLocalTailscaleIp();
+                const lanIp = getLocalLanIp();
+                const ips = getAllNetworkIps();
+                const sessionStats = store.getSessionsList();
+                const ipSecurityStats = store.getIpSecurityStats();
+                jsonResponse(res, 200, {
+                    success: true,
+                    locale: readGlobalLocale(),
+                    tailscaleIp: tsIp,
+                    lanIp,
+                    networkIps: ips,
+                    allowTailscale: opts.allowTailscale,
+                    allowLan: opts.allowLan,
+                    hasSecret: Boolean(opts.secretHash || opts.secret),
+                    maxVisitsPerMinute: opts.maxVisitsPerMinute,
+                    maxFailedAttempts: opts.maxFailedAttempts,
+                    lockDurationMs: opts.lockDurationMs,
+                    devicesCount: sessionStats.count,
+                    devices: sessionStats.devices,
+                    ipSecurityStats,
+                    persistPath: store.persistPath,
+                    rsaKeyPath: RSA_KEY_FILE,
+                    publicKey: getPublicKeyPem(),
+                });
+            },
+        },
+        // 2. 生成 6 位短期配对码
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/generate-code',
+            handler: async (_req, res) => {
+                const info = store.generateShortCode();
+                jsonResponse(res, 200, {
+                    success: true,
+                    code: info.code,
+                    expiresAt: info.expiresAt,
+                });
+            },
+        },
+        // 3. 手机端验证与换取长效 Cookie (支持 RSA-OAEP 密文解密 + 防暴力破解 429 拦截)
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/verify',
+            handler: async (req, res) => {
+                const body = await parseJsonBody(req);
+                let credential = '';
+                if (body.encryptedCredential) {
+                    const decrypted = decryptWithPrivateKey(body.encryptedCredential);
+                    credential = (decrypted || body.credential || '').trim();
+                }
+                else if (body.credential) {
+                    credential = String(body.credential).trim();
+                }
+                const ua = req.headers['user-agent'];
+                const ip = getRealClientIp(req);
+                const result = store.verify(credential, ua, ip);
+                if (result.success && result.token) {
+                    const maxAge = 365 * 24 * 60 * 60;
+                    const cookieVal = `${AUTH_COOKIE_NAME}=${result.token}; Path=/; Max-Age=${maxAge}; HttpOnly; SameSite=Lax`;
+                    res.writeHead(200, {
+                        'Content-Type': 'application/json; charset=utf-8',
+                        'Set-Cookie': cookieVal,
+                    });
+                    res.end(JSON.stringify({ success: true, token: result.token }));
+                }
+                else if (result.locked) {
+                    jsonResponse(res, 429, {
+                        success: false,
+                        locked: true,
+                        remainingSeconds: result.remainingSeconds,
+                        reason: result.reason || '连续尝试错误过多，IP已被安全锁定',
+                    });
+                }
+                else {
+                    jsonResponse(res, 401, { success: false, reason: result.reason || '验证失败' });
+                }
+            },
+        },
+        // 3.1 手动解除某个 IP 的防暴破锁定
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/unlock-ip',
+            handler: async (req, res) => {
+                const body = await parseJsonBody(req);
+                const ip = (body.ip || '').trim();
+                const ok = store.unlockIp(ip);
+                jsonResponse(res, 200, { success: ok, ip });
+            },
+        },
+        // 3.2 一键清空所有 IP 访问与安全审计日志
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/clear-ip-stats',
+            handler: async (_req, res) => {
+                store.clearAllIpSecurityStats();
+                jsonResponse(res, 200, { success: true });
+            },
+        },
+        // 4. 切换 Tailscale / 局域网免密直连开关
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/toggle-bypass',
+            handler: async (req, res) => {
+                const body = await parseJsonBody(req);
+                const updates = {};
+                if (typeof body.allowTailscale === 'boolean') {
+                    updates.allowTailscale = body.allowTailscale;
+                }
+                if (typeof body.allowLan === 'boolean') {
+                    updates.allowLan = body.allowLan;
+                }
+                if (typeof body.enabled === 'boolean') {
+                    updates.allowTailscale = body.enabled;
+                }
+                store.updateOptions(updates);
+                const opts = store.getOptions();
+                jsonResponse(res, 200, {
+                    success: true,
+                    allowTailscale: opts.allowTailscale,
+                    allowLan: opts.allowLan,
+                });
+            },
+        },
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/update-options',
+            handler: async (req, res) => {
+                const body = await parseJsonBody(req);
+                const updates = {};
+                if (typeof body.allowTailscale === 'boolean') {
+                    updates.allowTailscale = body.allowTailscale;
+                }
+                if (typeof body.allowLan === 'boolean') {
+                    updates.allowLan = body.allowLan;
+                }
+                if (typeof body.enabled === 'boolean') {
+                    updates.allowTailscale = body.enabled;
+                }
+                if (typeof body.maxVisitsPerMinute === 'number' && body.maxVisitsPerMinute > 0) {
+                    updates.maxVisitsPerMinute = Math.floor(body.maxVisitsPerMinute);
+                }
+                if (typeof body.maxFailedAttempts === 'number' && body.maxFailedAttempts > 0) {
+                    updates.maxFailedAttempts = Math.floor(body.maxFailedAttempts);
+                }
+                if (typeof body.lockDurationMs === 'number' && body.lockDurationMs > 0) {
+                    updates.lockDurationMs = Math.floor(body.lockDurationMs);
+                }
+                store.updateOptions(updates);
+                const opts = store.getOptions();
+                jsonResponse(res, 200, {
+                    success: true,
+                    allowTailscale: opts.allowTailscale,
+                    allowLan: opts.allowLan,
+                    maxVisitsPerMinute: opts.maxVisitsPerMinute,
+                    maxFailedAttempts: opts.maxFailedAttempts,
+                    lockDurationMs: opts.lockDurationMs,
+                });
+            },
+        },
+        // 5. 设置并持久化长期访问密码 (支持 RSA 密文 + 6位以上字母数字复杂度校验)
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/set-secret',
+            handler: async (req, res) => {
+                const body = await parseJsonBody(req);
+                let secret = '';
+                if (body.encryptedSecret) {
+                    secret = decryptWithPrivateKey(body.encryptedSecret).trim();
+                }
+                else if (typeof body.secret === 'string') {
+                    secret = body.secret.trim();
+                }
+                // 校验密码复杂度
+                const check = validateSecretStrength(secret);
+                if (!check.valid) {
+                    return jsonResponse(res, 400, {
+                        success: false,
+                        reason: check.reason || '密码不满足强度要求',
+                    });
+                }
+                store.updateOptions({ secret });
+                jsonResponse(res, 200, { success: true, hasSecret: Boolean(secret) });
+            },
+        },
+        // 5.1 清除长期访问密码
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/clear-secret',
+            handler: async (_req, res) => {
+                store.updateOptions({ secret: '', secretHash: '' });
+                jsonResponse(res, 200, { success: true, hasSecret: false });
+            },
+        },
+        // 6. 撤销单个设备授权
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/revoke-device',
+            handler: async (req, res) => {
+                const body = await parseJsonBody(req);
+                const token = body.token || '';
+                const ok = store.revokeDevice(token);
+                jsonResponse(res, 200, { success: ok });
+            },
+        },
+        // 7. 一键撤销所有设备
+        {
+            method: 'POST',
+            path: '/api/remote-mobile/revoke-all',
+            handler: async (_req, res) => {
+                store.revokeAllSessions();
+                jsonResponse(res, 200, { success: true });
+            },
+        },
+        // 8. 独立手机登录引导页面（已授权或 Tailscale/局域网免密设备访问时自动 302 跳转回工作区，支持 IP 访问计数与限频）
+        {
+            method: 'GET',
+            path: '/auth',
+            handler: async (req, res) => {
+                const clientIp = getRealClientIp(req);
+                const opts = store.getOptions();
+                const isTs = isTailscaleIp(clientIp);
+                const isLan = isLanIp(clientIp);
+                const token = store.extractTokenFromRequest(req);
+                const ua = req.headers['user-agent'] || '';
+                const hasValidToken = token ? store.validateToken(token, clientIp) : false;
+                // 如果开启了免密直连（Tailscale 或 局域网）或者已持有有效 Token，直接放行直跳根目录
+                if ((opts.allowTailscale && isTs) || (opts.allowLan && isLan) || hasValidToken) {
+                    res.writeHead(302, { Location: '/' });
+                    return res.end();
+                }
+                // 记录 IP 访问计数并进行防高频刷量限频与设备型号解析
+                const visitCheck = store.recordAuthVisit(clientIp, ua);
+                if (!visitCheck.allowed) {
+                    res.writeHead(429, { 'Content-Type': 'text/html; charset=utf-8' });
+                    return res.end(`
+            <!DOCTYPE html>
+            <html>
+            <head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>安全限制 - DSH</title>
+            <style>body{background:#0f172a;color:#fff;font-family:-apple-system,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;padding:20px;box-sizing:border-box;text-align:center;}
+            .card{background:rgba(255,255,255,0.06);border:1px solid rgba(239,68,68,0.4);border-radius:16px;padding:28px 20px;max-width:380px;box-shadow:0 8px 32px rgba(0,0,0,0.4);}
+            h2{color:#ef4444;margin:0 0 10px 0;font-size:20px;}p{color:#94a3b8;font-size:14px;line-height:1.6;margin:0;}</style>
+            </head>
+            <body><div class="card"><h2>⚠️ 访问限制 (429)</h2><p>${visitCheck.reason || '当前 IP 请求过于频繁或已被临时锁定，请稍后刷新重试。'}</p></div></body>
+            </html>
+          `);
+                }
+                const acceptLang = req.headers['accept-language'] || '';
+                const reqLocale = acceptLang.toLowerCase().startsWith('en') ? 'en' : readGlobalLocale();
+                const html = getLoginPageHtml(undefined, reqLocale);
+                res.writeHead(200, {
+                    'Content-Type': 'text/html; charset=utf-8',
+                    'Cache-Control': 'no-cache',
+                });
+                res.end(html);
+            },
+        },
+        // 9. SSE 实时事件监听通道 (Server-Sent Events 0延时推送，彻底告别轮询)
+        {
+            method: 'GET',
+            path: '/api/remote-mobile/events',
+            handler: async (req, res) => {
+                res.writeHead(200, {
+                    'Content-Type': 'text/event-stream',
+                    'Cache-Control': 'no-cache, no-transform',
+                    'Connection': 'keep-alive',
+                    'Access-Control-Allow-Origin': '*',
+                });
+                res.write(': connected\n\n');
+                const onConnected = (device) => {
+                    res.write(`data: ${JSON.stringify({ type: 'device-connected', device })}\n\n`);
+                };
+                const onOnline = (device) => {
+                    res.write(`data: ${JSON.stringify({ type: 'device-online', device })}\n\n`);
+                };
+                const onRevoked = (data) => {
+                    res.write(`data: ${JSON.stringify({ type: 'device-revoked', data })}\n\n`);
+                };
+                const onSecurityUpdated = (data) => {
+                    res.write(`data: ${JSON.stringify({ type: 'ip-security-updated', ...data })}\n\n`);
+                };
+                const onSecurityAlert = (data) => {
+                    res.write(`data: ${JSON.stringify({ type: 'ip-security-alert', ...data })}\n\n`);
+                };
+                store.on('device-connected', onConnected);
+                store.on('device-online', onOnline);
+                store.on('device-revoked', onRevoked);
+                store.on('ip-security-updated', onSecurityUpdated);
+                store.on('ip-security-alert', onSecurityAlert);
+                // 心跳定时器 (每 25 秒维持连接)
+                const keepAlive = setInterval(() => {
+                    res.write(': ping\n\n');
+                }, 25000);
+                if (typeof keepAlive.unref === 'function') {
+                    ;
+                    keepAlive.unref();
+                }
+                req.on('close', () => {
+                    clearInterval(keepAlive);
+                    store.off('device-connected', onConnected);
+                    store.off('device-online', onOnline);
+                    store.off('device-revoked', onRevoked);
+                    store.off('ip-security-updated', onSecurityUpdated);
+                    store.off('ip-security-alert', onSecurityAlert);
+                });
+            },
+        },
+    ];
+}

package/lib/routes/login-page.d.ts

@@ -0,0 +1,4 @@
+/**
+ * 手机端授权与登录页面 HTML
+ */
+export declare function getLoginPageHtml(publicKeyPem?: string, lang?: 'zh' | 'en'): string;