homebridge-smartsystem 7.1.21 → 7.1.22

package/server/webapp.js

@@ -69,6 +69,18 @@ class Context {
         this.parseCookies();
         // can be used for sending different answers
         this.jsonrequest = !!(((_a = req.headers['content-type']) === null || _a === void 0 ? void 0 : _a.toLowerCase().indexOf('application/json')) > -1);
+        // set by the cloud proxy (server/proxy.ts + masters.duotecno.eu) when this request came in
+        // through /connect/<uniqueId>/... -- every generated link/redirect must be prefixed with it
+        // so it keeps pointing back through the tunnel instead of at the cloud server's own root.
+        // The cloud server sends this header twice (once as "X-Forwarded-Prefix", once lowercase),
+        // which Node joins into a single comma-separated value -- take just the first occurrence.
+        let forwardedPrefix = req.headers['x-forwarded-prefix'];
+        if (typeof forwardedPrefix === "string" && forwardedPrefix.includes(",")) {
+            forwardedPrefix = forwardedPrefix.split(",")[0].trim();
+        }
+        this.basePath = (typeof forwardedPrefix === "string" && forwardedPrefix.startsWith("/connect/"))
+            ? forwardedPrefix.replace(/\/+$/, "")
+            : "";
         // helpers for ejs
         this.today = new Date();
         this.year = this.today.getFullYear();
@@ -232,6 +244,18 @@ class WebApp extends base_1.Base {
         this.user = "";
         this.password = "";
         this.mdnsService = null; // mDNS service for hostname and service discovery
+        // Cache of validated "Authorization: Basic ..." header values -> expiry timestamp (ms).
+        // Used when a request comes in through the cloud proxy, where cookies don't survive the
+        // tunnel (see Context.basePath): avoids re-checking with pwOK() (which calls out to
+        // Homebridge UI) on every single request as long as the browser keeps resending the same
+        // Basic-Auth credentials. Entries expire after kBasicAuthCacheMs and are re-validated then.
+        this.authorizedBasicAuth = new Map();
+        // In-flight validations, keyed the same way, so that a burst of concurrent requests using
+        // the same not-yet-cached credentials (e.g. the handful of asset requests a single page
+        // load fires) share one pwOK()/Homebridge-login call instead of each firing their own --
+        // pwOK() also overwrites the shared this.token, so piling up parallel calls to it is not
+        // just wasteful but can stomp on other, unrelated sessions using that same token.
+        this.pendingBasicAuth = new Map();
         this.port = 80;
         (0, logger_1.log)("server", "Creating http server");
         this.files = {};
@@ -440,6 +464,19 @@ class WebApp extends base_1.Base {
             }
         }
         if (file) {
+            // layout assets (bundled CSS/JS, inline logo, favicon data URI) -- registered once at
+            // startup via addContent() under these fixed names, so any subclass that has them
+            // available gets them injected into every template automatically. Merged before the
+            // per-call objects so a call site can still override them explicitly if it ever needs to.
+            const bundleFile = this.getFile("bundle");
+            if (bundleFile)
+                context["bundleUrl"] = `${context.basePath}/files/bundle.${exports.kVersion}.js`;
+            const logoFile = this.getFile("logoWhiteInline");
+            if (logoFile)
+                context["logoWhite"] = logoFile.content;
+            const faviconFile = this.getFile("faviconDataUri");
+            if (faviconFile)
+                context["faviconDataUri"] = faviconFile.content;
             // copy objects into context
             for (const key in objects)
                 context[key] = objects[key];
@@ -468,8 +505,22 @@ class WebApp extends base_1.Base {
             try {
                 if (this.needsLogin(context)) {
                     logger.debug("webapp", "checking ticket: " + context.cookies["DTicket"] + " = " + this.token + " for " + context.request + "/" + context.action + " => " + (context.cookies["DTicket"] == this.token));
-                    // if a password is set, check if the tickets is valid, if not: redirect to login page
-                    if (!this.token || (context.cookies["DTicket"] != this.token)) {
+                    // if a password is set, check if the tickets is valid...
+                    let authorized = !!this.token && (context.cookies["DTicket"] === this.token);
+                    // the DTicket cookie never survives the cloud proxy (masters.duotecno.eu strips
+                    // cookies on every forwarded request), so fall back to HTTP Basic-Auth there instead.
+                    if (!authorized)
+                        authorized = yield this.checkBasicAuth(context);
+                    if (!authorized) {
+                        if (context.basePath) {
+                            // ask the browser natively for credentials instead of our own cookie-based
+                            // /login page, since that page can't establish a session through the tunnel
+                            return {
+                                status: 401, type: "text/html",
+                                header: { "WWW-Authenticate": 'Basic realm="Duotecno Gateway"' },
+                                data: "<html><head><title>Login required</title></head><body>Login required</body></html>"
+                            };
+                        }
                         context.request = "login";
                         context.action = "";
                     }
@@ -513,10 +564,11 @@ class WebApp extends base_1.Base {
             data: "<html><head><title>File " + filename + " not found</title></head><body>These are not the droids your are looking for</body></html>"
         };
     }
-    redirect(url, header = {}) {
+    redirect(context, url, header = {}) {
+        const target = url.startsWith("http") ? url : context.basePath + url;
         return {
-            status: 303, type: "text/html", header: Object.assign({ "Location": url }, header),
-            data: "<html><head><meta http-equiv=\"Refresh\" content=\"0; URL=" + url + "\"></head></html>"
+            status: 303, type: "text/html", header: Object.assign({ "Location": target }, header),
+            data: "<html><head><meta http-equiv=\"Refresh\" content=\"0; URL=" + target + "\"></head></html>"
         };
     }
     error(context, msg = "", json = false) {
@@ -534,6 +586,43 @@ class WebApp extends base_1.Base {
             return true;
         });
     }
+    // Validates (and caches for kBasicAuthCacheMs) an "Authorization: Basic ..." header via
+    // pwOK(). Used as the login fallback for requests coming in through the cloud proxy.
+    checkBasicAuth(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const authHeader = context.req.headers.authorization;
+            if (!authHeader || !authHeader.startsWith("Basic "))
+                return false;
+            const cachedUntil = this.authorizedBasicAuth.get(authHeader);
+            if (cachedUntil && (cachedUntil > Date.now()))
+                return true;
+            // collapse concurrent requests bearing the same (not-yet-cached) credentials onto one
+            // in-flight validation instead of each calling pwOK() independently
+            let pending = this.pendingBasicAuth.get(authHeader);
+            if (!pending) {
+                pending = this.validateBasicAuth(context, authHeader);
+                this.pendingBasicAuth.set(authHeader, pending);
+                pending.finally(() => this.pendingBasicAuth.delete(authHeader));
+            }
+            return pending;
+        });
+    }
+    validateBasicAuth(context, authHeader) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const decoded = Buffer.from(authHeader.slice(6), "base64").toString("utf-8");
+            const sep = decoded.indexOf(":");
+            if (sep < 0)
+                return false;
+            const user = decoded.slice(0, sep);
+            const pw = decoded.slice(sep + 1);
+            if (yield this.pwOK(context, user, pw)) {
+                this.authorizedBasicAuth.set(authHeader, Date.now() + WebApp.kBasicAuthCacheMs);
+                return true;
+            }
+            this.authorizedBasicAuth.delete(authHeader);
+            return false;
+        });
+    }
     doLogin(context) {
         return __awaiter(this, void 0, void 0, function* () {
             if (context.action === "logout") {
@@ -553,7 +642,7 @@ class WebApp extends base_1.Base {
             const user = context.getParam({ name: "user", type: "string" });
             if (yield this.pwOK(context, user, pw)) {
                 const path = context.getCookie("DPath") || "/";
-                return this.redirect(path, { "Set-Cookie": "DTicket=" + this.token });
+                return this.redirect(context, path, { "Set-Cookie": "DTicket=" + this.token });
             }
             else {
                 return this.ejs("login", context, { message: "authentication failed", user }, { "Set-Cookie": "DTicket=x" });
@@ -563,7 +652,8 @@ class WebApp extends base_1.Base {
     doLogout(context) {
         return __awaiter(this, void 0, void 0, function* () {
             this.token = "";
-            return this.redirect("/", { "Set-Cookie": "DTicket=x" });
+            this.authorizedBasicAuth.clear();
+            return this.redirect(context, "/", { "Set-Cookie": "DTicket=x" });
         });
     }
     doRestart(json) {
@@ -622,4 +712,5 @@ class WebApp extends base_1.Base {
     }
 }
 exports.WebApp = WebApp;
+WebApp.kBasicAuthCacheMs = 2 * 60 * 1000;
 //# sourceMappingURL=webapp.js.map

package/server/views/style.ejs

@@ -1,65 +0,0 @@
-<style> 
-  /* Page layout with sticky footer */
-  html, body { height: 100%; margin: 0; display: flex; flex-direction: column } 
-  body { min-height: 100vh }
-  
-  /* Main content area - grows to fill space */
-  body > *:not(nav):not(.page-footer) { flex: 1 0 auto }
-  
-  form { padding-left: 7px; padding-right: 9px; padding-bottom: 20px }
-  form:last-of-type { padding-bottom: 80px }
-  
-  nav, nav .nav-wrapper { height: 64px !important; line-height: 64px !important; flex-shrink: 0 }
-  nav .brand-logo { left: 10px !important; -webkit-transform: none !important; transform: none !important }
-
-  h1 { font-size: 30px }
-  h1.btn { margin-top: 18px }
-  h1 .btn { margin-left: 10px }
-  a span { margin-bottom: 7px; display: inline-block }
-  
-  /* Sticky footer */
-  .page-footer { position: fixed; bottom: 0; left: 0; right: 0; width: 100%; flex-shrink: 0; z-index: 100; }
-  .page-footer p { text-align: right; padding-bottom: 4px; margin-right: 6px }
-  .page-footer a { float: left; margin-left: 10px; color: white; }
-  .page-footer  { padding-top: 5px; padding-right: 6px }
-  .range-field { margin-bottom: -1em }
-  b { color: #ee6e73 }
-  .btn-small i { font-size: 1.1rem }
-  small { font-size: 70% }
-  .btn-floating.btn-small { width: 32px; height: 31px }
-  .rules p { display: inline-block; margin-bottom: 0px }
-  div.select-wrapper { max-width: 212px }
-  div.select-wrapper input.select-dropdown { font-size: 16px !important; height: 3rem !important; }
-  span.used { color: darkgrey }
-  .message { margin-left: 10px; font-size: 15px }
-
-  
-  /* Hamburger menu icon - positioned on right side */
-  nav .sidenav-trigger {
-    position: absolute; right: 10px; top: 0;
-    height: 64px; line-height: 64px; padding: 0 15px; margin: 0;
-  }
-  nav .sidenav-trigger i { line-height: 64px; font-size: 2rem }
-  
-  /* Hide hamburger on desktop, show desktop menu */
-  @media only screen and (min-width: 993px) {
-    nav .sidenav-trigger { display: none !important; }
-  }
-  
-  /* Show hamburger on mobile, hide desktop menu */
-  @media only screen and (max-width: 992px) {
-    nav .sidenav-trigger { display: block !important; }
-  }
-  
-  /* Desktop navigation active state */
-  nav ul li.active { background-color: rgba(0, 0, 0, 0.1) }
-  
-  /* Sidenav styling */
-  .sidenav { width: 280px; }
-  .sidenav .user-view { padding: 1px 32px 16px 16px }
-  .sidenav .user-view .name { font-size: 18px; font-weight: 500; margin-top: 16px; display: block; }
-  .sidenav li > a { height: auto; line-height: 1px; padding: 14px 32px; }
-  .sidenav .divider { margin: 8px 0; }
-  .sidenav li.active { background-color: rgba(0,0,0,0.05); }
-
-</style>