dsh-zen-remote 2.3.11 → 2.4.1

package/lib/plugin-route-intercept.js

@@ -327,11 +327,51 @@ export function installPluginRouteIntercept(options) {
             },
         };
     }
-    const { webServer, registry, relay, getServerId, getStatus, log } = options;
+    const { webServer, registry, log } = options;
     const adapters = options.adapters ?? [];
     const getCurrentSession = options.getCurrentSession;
     const getKnownRealIds = options.getKnownRealIds;
     const onMintedVirtualIds = options.onMintedVirtualIds;
+    const { relay, getServerId, getStatus } = options;
+    const { getRelayForServer, getStatusForServer, getKnownRealIdsForServer } = options;
+    // Exactly one mode, like installIntercept: the pool faces or the single
+    // row client — a wiring that passes neither would refuse every forwarded
+    // request as server-changed / not-bridged, so it is refused here instead.
+    if ((getRelayForServer === undefined && (relay === undefined || getServerId === undefined))
+        || (getStatusForServer === undefined && getStatus === undefined)) {
+        throw new Error('installPluginRouteIntercept requires either `relay` + `getServerId` + `getStatus` (single server) or `getRelayForServer` + `getStatusForServer` (pool)');
+    }
+    // The single-server facts, proven present by the guard above.
+    const singleRelay = relay;
+    const singleGetServerId = getServerId;
+    const singleGetStatus = getStatus;
+    /** MS-4: the relay client serving one server id, or `undefined` (the
+     * `server-changed` refusal). */
+    const relayOfServer = (serverId) => getRelayForServer !== undefined ? getRelayForServer(serverId) : serverId === singleGetServerId() ? singleRelay : undefined;
+    const statusesOfServer = (serverId) => getStatusForServer !== undefined ? getStatusForServer(serverId) : singleGetStatus();
+    const knownRealIdsOfServer = (serverId) => getKnownRealIdsForServer !== undefined ? getKnownRealIdsForServer(serverId) : getKnownRealIds?.();
+    /** MS-4: the one server every located virtual id of a request belongs to,
+     * with its relay client — or the refusal reason, judged id by id in hit
+     * order (the single-server walls' order). A request naming ids of two
+     * servers is refused like a foreign one: it has no single home. */
+    const serverOfHits = (hits) => {
+        let located;
+        for (const idHit of hits) {
+            const parts = fromVirtual(idHit.value);
+            if (parts === undefined || parts.id === '')
+                return 'bad-query';
+            if (located === undefined) {
+                const target = relayOfServer(parts.serverId);
+                if (target === undefined)
+                    return 'server-changed';
+                located = { serverId: parts.serverId, relay: target };
+            }
+            else if (parts.serverId !== located.serverId) {
+                return 'server-changed';
+            }
+        }
+        return located ?? 'bad-query';
+    };
     const target = webServer;
     const savedMatch = target.match;
     let installed = true;
@@ -496,7 +536,8 @@ export function installPluginRouteIntercept(options) {
             answerUnbridged(res, declared.plugin, 'bad-query');
             return;
         }
-        if (parts.serverId !== getServerId()) {
+        const targetRelay = relayOfServer(parts.serverId);
+        if (targetRelay === undefined) {
             answerUnbridged(res, declared.plugin, 'server-changed');
             return;
         }
@@ -522,7 +563,7 @@ export function installPluginRouteIntercept(options) {
             log?.('plugin request for %s refused locally: body-too-large (%s declared)', declared.path, req.headers['content-length']);
             return;
         }
-        const status = getStatus().find((entry) => entry.plugin === declared.plugin);
+        const status = statusesOfServer(parts.serverId).find((entry) => entry.plugin === declared.plugin);
         if (status === undefined || !status.bridged) {
             answerUnbridged(res, declared.plugin, status?.reason ?? 'not-on-server');
             return;
@@ -594,7 +635,7 @@ export function installPluginRouteIntercept(options) {
                 bodyStream = Readable.toWeb(gate);
                 req.pipe(gate);
             }
-            const response = await relay.pluginRequest({
+            const response = await targetRelay.pluginRequest({
                 plugin: declared.plugin,
                 version: declared.version,
                 digest: declared.digest,
@@ -628,7 +669,7 @@ export function installPluginRouteIntercept(options) {
             // known inventory, read live right here (undefined when the wiring
             // passed no getter — the scan stays request-local).
             if (declared.rewriteIds) {
-                await answerRewriteIds(res, response, idMapping, declared.rewriteFields, parts.serverId, getKnownRealIds?.(), onMintedVirtualIds);
+                await answerRewriteIds(res, response, idMapping, declared.rewriteFields, parts.serverId, knownRealIdsOfServer(parts.serverId), onMintedVirtualIds);
                 return;
             }
             const contentType = response.headers.get('content-type');
@@ -827,7 +868,6 @@ export function installPluginRouteIntercept(options) {
                 answerUnbridged(res, plugin, 'method-not-bridged');
                 return;
             }
-            const serverId = getServerId();
             // PB-22: the request's own real→virtual pairs, collected while the
             // wall validates each hit — the READ-ONLY mapping a rewriteIds
             // route's answer scan consults (`zr~` carries the real id inside, so
@@ -839,24 +879,20 @@ export function installPluginRouteIntercept(options) {
             // ONE more source beside this mapping — the known-real-session
             // inventory, read live at the answer (never copied here) and
             // consumed read-only; nothing here writes any session table.
-            const idMapping = new Map();
-            let locatedServerId;
-            for (const idHit of verdict.hits) {
-                const parts = fromVirtual(idHit.value);
-                if (parts === undefined || parts.id === '') {
-                    answerUnbridged(res, plugin, 'bad-query');
-                    return;
-                }
-                if (parts.serverId !== serverId) {
-                    answerUnbridged(res, plugin, 'server-changed');
-                    return;
-                }
-                idMapping.set(parts.id, idHit.value);
-                locatedServerId = parts.serverId;
+            // MS-4: every located id must name ONE server the wiring serves;
+            // that server's relay, verdicts and inventory carry the rest.
+            const home = serverOfHits(verdict.hits);
+            if (home === 'bad-query' || home === 'server-changed') {
+                answerUnbridged(res, plugin, home);
+                return;
             }
+            const locatedServerId = home.serverId;
+            const idMapping = new Map();
+            for (const idHit of verdict.hits)
+                idMapping.set(fromVirtual(idHit.value).id, idHit.value);
             // The bridge verdicts judged from the SAME live table the query
             // half reads.
-            const status = getStatus().find((entry) => entry.plugin === plugin);
+            const status = statusesOfServer(locatedServerId).find((entry) => entry.plugin === plugin);
             if (status === undefined || !status.bridged) {
                 answerUnbridged(res, plugin, status?.reason ?? 'not-on-server');
                 return;
@@ -919,7 +955,7 @@ export function installPluginRouteIntercept(options) {
                 if (Number.isFinite(declaredLength) && declaredLength > 0)
                     contentLength = declaredLength;
             }
-            const response = await relay.pluginRequest({
+            const response = await home.relay.pluginRequest({
                 plugin,
                 version: declared.version,
                 digest: declared.digest,
@@ -942,7 +978,7 @@ export function installPluginRouteIntercept(options) {
                 return;
             }
             if (declared.rewriteIds) {
-                await answerRewriteIds(res, response, idMapping, declared.rewriteFields, locatedServerId, getKnownRealIds?.(), onMintedVirtualIds);
+                await answerRewriteIds(res, response, idMapping, declared.rewriteFields, locatedServerId, knownRealIdsOfServer(locatedServerId), onMintedVirtualIds);
                 return;
             }
             const contentType = response.headers.get('content-type');
@@ -1143,23 +1179,18 @@ export function installPluginRouteIntercept(options) {
                 answerUnbridged(res, plugin, 'method-not-bridged');
                 return;
             }
-            const serverId = getServerId();
-            for (const idHit of verdict.hits) {
-                const parts = fromVirtual(idHit.value);
-                if (parts === undefined || parts.id === '') {
-                    answerUnbridged(res, plugin, 'bad-query');
-                    return;
-                }
-                if (parts.serverId !== serverId) {
-                    answerUnbridged(res, plugin, 'server-changed');
-                    return;
-                }
+            // MS-4: one home server for every located id.
+            const home = serverOfHits(verdict.hits);
+            if (home === 'bad-query' || home === 'server-changed') {
+                answerUnbridged(res, plugin, home);
+                return;
             }
+            const serverId = home.serverId;
             // The bridge verdicts (version skew, consent, offline…) judged from
             // the SAME live table the cooperative surrogate reads — the
             // adapter's registry entry makes the plugin indistinguishable from
             // a cooperative one here.
-            const status = getStatus().find((entry) => entry.plugin === plugin);
+            const status = statusesOfServer(serverId).find((entry) => entry.plugin === plugin);
             if (status === undefined || !status.bridged) {
                 answerUnbridged(res, plugin, status?.reason ?? 'not-on-server');
                 return;
@@ -1218,7 +1249,7 @@ export function installPluginRouteIntercept(options) {
                 bodyStream = Readable.toWeb(gate);
                 req.pipe(gate);
             }
-            const response = await relay.pluginRequest({
+            const response = await home.relay.pluginRequest({
                 plugin,
                 version: adapter.declaration.version,
                 digest: adapter.digest,
@@ -1322,7 +1353,7 @@ export function installPluginRouteIntercept(options) {
                     pathname,
                     body: JSON.parse(text),
                     virtualize: (id) => {
-                        const virtualId = toVirtual(serverId ?? '', id);
+                        const virtualId = toVirtual(serverId, id);
                         if (isVirtual(virtualId))
                             minted.add(virtualId);
                         return virtualId;
@@ -1571,6 +1602,9 @@ export function installPluginRouteIntercept(options) {
         };
         // ---- the remote pipe: the PB-10 tunnel, frame by frame -------------
         let tunnelHandle;
+        // MS-4: the server the tunnel was opened on — set together with
+        // tunnelHandle, the relay every later send and the close travel.
+        let tunnelServer;
         // The connection-wide real→virtual mapping the rewriteIds deep scan
         // consults: EVERY validated remote frame's ids merge in (a watch list
         // that grows mid-connection makes the later answers rewritable too —
@@ -1591,7 +1625,7 @@ export function installPluginRouteIntercept(options) {
          * never a silent broken flag: that would leak `tunnelsCurrent` and
          * leave the browser hanging on a dead tunnel. */
         const sendTextUpstream = async (frame, parsedJson, hits) => {
-            if (upstreamBroken || tunnelHandle === undefined)
+            if (upstreamBroken || tunnelHandle === undefined || tunnelServer === undefined)
                 return;
             const rewrite = hits.length > 0
                 ? rewriteAdapterRequest(declared.view, declared.path, new URLSearchParams(), parsedJson, hits, (virtualId) => fromVirtual(virtualId).id)
@@ -1600,7 +1634,7 @@ export function installPluginRouteIntercept(options) {
             const seq = upstreamSeq;
             upstreamSeq += 1;
             try {
-                await relay.pluginTunnelSend(tunnelHandle.tunnel, seq, encodeRfc6455Frame(0x1, payload, true, frame.fin));
+                await tunnelServer.relay.pluginTunnelSend(tunnelHandle.tunnel, seq, encodeRfc6455Frame(0x1, payload, true, frame.fin));
             }
             catch {
                 killExchange();
@@ -1652,7 +1686,7 @@ export function installPluginRouteIntercept(options) {
                                     hooked = true;
                                 }
                                 else if (declared.rewriteIds) {
-                                    const scanned = deepRewriteIds(parsedJson, idMapping, getKnownRealIds?.(), serverId);
+                                    const scanned = deepRewriteIds(parsedJson, idMapping, knownRealIdsOfServer(serverId), serverId);
                                     if (declared.rewriteFields !== undefined)
                                         rewriteIdsAtFields(scanned, declared.rewriteFields, serverId);
                                     outPayload = Buffer.from(JSON.stringify(scanned), 'utf8');
@@ -1761,25 +1795,19 @@ export function installPluginRouteIntercept(options) {
                 }
                 return;
             }
-            const serverId = getServerId();
-            if (serverId === undefined) {
+            // MS-4: the frame's ids name one served server, and once the tunnel
+            // is open every later frame must name the tunnel's own server.
+            const home = serverOfHits(verdict.hits);
+            if (home === 'bad-query' || home === 'server-changed' || (tunnelServer !== undefined && home.serverId !== tunnelServer.serverId)) {
                 refuseAndDie('server-changed');
                 return;
             }
-            const mapping = new Map();
-            for (const idHit of verdict.hits) {
-                const parts = fromVirtual(idHit.value);
-                if (parts === undefined || parts.id === '' || parts.serverId !== serverId) {
-                    refuseAndDie('server-changed');
-                    return;
-                }
-                mapping.set(parts.id, idHit.value);
-            }
+            const serverId = home.serverId;
             // This frame's ids join the connection-wide mapping (see idMapping).
-            for (const [key, value] of mapping)
-                idMapping.set(key, value);
+            for (const idHit of verdict.hits)
+                idMapping.set(fromVirtual(idHit.value).id, idHit.value);
             if (tunnelHandle === undefined) {
-                const status = getStatus().find((entry) => entry.plugin === plugin);
+                const status = statusesOfServer(serverId).find((entry) => entry.plugin === plugin);
                 if (status === undefined || !status.bridged) {
                     refuseAndDie(status?.reason ?? 'not-on-server');
                     return;
@@ -1789,7 +1817,7 @@ export function installPluginRouteIntercept(options) {
                 let opened;
                 try {
                     log?.('opening tunnel for %s', declared.path);
-                    opened = await relay.pluginTunnelOpen({
+                    opened = await home.relay.pluginTunnelOpen({
                         plugin,
                         version: declared.version,
                         digest: declared.digest,
@@ -1805,6 +1833,7 @@ export function installPluginRouteIntercept(options) {
                 }
                 tunnelsCurrent += 1;
                 tunnelsOpened += 1;
+                tunnelServer = home;
                 tunnelHandle = opened;
                 log?.('tunnel open for %s: %s', declared.path, opened.tunnel);
                 teardownTunnel = () => {
@@ -1813,7 +1842,7 @@ export function installPluginRouteIntercept(options) {
                     upstreamBroken = true;
                     tunnelsCurrent -= 1;
                     tunnelsClosed += 1;
-                    void relay.pluginTunnelClose(opened.tunnel).catch(() => { });
+                    void home.relay.pluginTunnelClose(opened.tunnel).catch(() => { });
                 };
                 socket.on('close', teardownTunnel);
                 socket.on('error', teardownTunnel);
@@ -1832,11 +1861,11 @@ export function installPluginRouteIntercept(options) {
                     localSocket.push(frame.raw);
                     return;
                 }
-                if (tunnelHandle !== undefined && !upstreamBroken) {
+                if (tunnelHandle !== undefined && tunnelServer !== undefined && !upstreamBroken) {
                     const seq = upstreamSeq;
                     upstreamSeq += 1;
                     try {
-                        await relay.pluginTunnelSend(tunnelHandle.tunnel, seq, frame.raw);
+                        await tunnelServer.relay.pluginTunnelSend(tunnelHandle.tunnel, seq, frame.raw);
                     }
                     catch {
                         // The send died: tear the exchange down COMPLETELY — the
@@ -1948,7 +1977,8 @@ export function installPluginRouteIntercept(options) {
                     answerUnbridgedSocket(socket, declared.plugin, 'bad-query');
                     return;
                 }
-                if (parts.serverId !== getServerId()) {
+                const tunnelRelay = relayOfServer(parts.serverId);
+                if (tunnelRelay === undefined) {
                     answerUnbridgedSocket(socket, declared.plugin, 'server-changed');
                     return;
                 }
@@ -1956,7 +1986,7 @@ export function installPluginRouteIntercept(options) {
                 // the tunnel opens only for a plugin bridged RIGHT NOW — an absent
                 // or unbridged status refuses with its own reason, and the local
                 // plugin handler is never reached.
-                const bridgeStatus = getStatus().find((entry) => entry.plugin === declared.plugin);
+                const bridgeStatus = statusesOfServer(parts.serverId).find((entry) => entry.plugin === declared.plugin);
                 if (bridgeStatus === undefined || !bridgeStatus.bridged) {
                     answerUnbridgedSocket(socket, declared.plugin, bridgeStatus?.reason ?? 'not-on-server');
                     return;
@@ -1977,7 +2007,7 @@ export function installPluginRouteIntercept(options) {
                 let tunnel;
                 try {
                     log?.('opening tunnel for %s', declared.path);
-                    tunnel = await relay.pluginTunnelOpen({
+                    tunnel = await tunnelRelay.pluginTunnelOpen({
                         plugin: declared.plugin,
                         version: declared.version,
                         digest: declared.digest,
@@ -2058,7 +2088,7 @@ export function installPluginRouteIntercept(options) {
                             if (upstreamBroken)
                                 return;
                             try {
-                                await relay.pluginTunnelSend(tunnel.tunnel, seq, bytes, controller.signal);
+                                await tunnelRelay.pluginTunnelSend(tunnel.tunnel, seq, bytes, controller.signal);
                             }
                             catch {
                                 upstreamBroken = true;
@@ -2070,7 +2100,7 @@ export function installPluginRouteIntercept(options) {
                     upstreamBroken = true;
                     tunnelsCurrent -= 1;
                     tunnelsClosed += 1;
-                    void relay.pluginTunnelClose(tunnel.tunnel).catch(() => { });
+                    void tunnelRelay.pluginTunnelClose(tunnel.tunnel).catch(() => { });
                 };
                 socket.on('close', teardownTunnel);
                 socket.on('error', teardownTunnel);