hyperbrane 0.1.1 → 0.2.0

package/dist/sandbox/endpointProxy.js

@@ -1,701 +0,0 @@
-import { SandboxEndpointError, } from "./api.js";
-/** "host", "host:port", "[v6]:port" or a bare IPv6 address; throws SandboxEndpointError for a bad port. */
-export function parseAccessibleHost(value) {
-    const match = /^\[(.+)\]:(\d+)$/.exec(value) ?? /^([^:]+):(\d+)$/.exec(value);
-    if (!match)
-        return { host: value.replace(/^\[(.+)\]$/, "$1"), port: null };
-    const port = Number(match[2]);
-    checkPort(port);
-    return { host: match[1], port };
-}
-const BASIC_USER = "hyperbrane";
-/**
- * The default: the proxy itself checks credentials it mints per endpoint (bearer or basic). The
- * proxy speaks plain HTTP; the accessible host is assumed to terminate TLS in front of it, on the
- * same port, so clients are given https URLs.
- */
-export function proxyCredentialsAuth() {
-    return {
-        bind({ host, port: pinned }) {
-            const name = host.includes(":") ? `[${host}]` : host;
-            return {
-                firewall: true,
-                plan({ scheme, port }) {
-                    if (scheme !== "bearer" && scheme !== "basic") {
-                        throw new SandboxEndpointError(`the endpoint proxy checks bearer or basic credentials, not "${scheme}"`);
-                    }
-                    const listen = pinnedPort(pinned, port);
-                    const secret = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("base64url");
-                    const credentials = scheme === "bearer" ? { scheme, token: secret } : { scheme, username: BASIC_USER, password: secret };
-                    return {
-                        // What follows the scheme in the Authorization header.
-                        check: { scheme, credentials: scheme === "bearer" ? secret : btoa(`${BASIC_USER}:${secret}`) },
-                        ports: [listen ?? 0, listen ?? 0],
-                        publish: async (listening) => ({ url: `https://${name}:${listening}`, credentials }),
-                    };
-                },
-            };
-        },
-    };
-}
-/** The port a request must listen on: the accessible host's, or its own; null for any. */
-export function pinnedPort(pinned, requested) {
-    if (requested !== undefined)
-        checkPort(requested);
-    if (pinned !== null && requested !== undefined && requested !== pinned) {
-        throw new SandboxEndpointError(`endpoints here listen on port ${pinned} (the accessible host's), not ${requested}`);
-    }
-    return pinned ?? requested ?? null;
-}
-export function checkPort(port) {
-    if (!Number.isInteger(port) || port < 1 || port > 65535)
-        throw new SandboxEndpointError(`not a port: ${port}`);
-}
-const ID_PATTERN = /^hyb-endpoint-(\d+)-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;
-const ENDPOINT_NAME = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-/** The port an endpoint listens on and its name there, from its id; throws for anything that isn't an endpoint id. */
-export function parseEndpointId(endpointId) {
-    const match = ID_PATTERN.exec(endpointId);
-    if (!match)
-        throw new SandboxEndpointError(`not an endpoint id: "${endpointId}"`);
-    return { port: Number(match[1]), name: match[2] };
-}
-// The scripts below run on the machine. Each proxy keeps its endpoints in $B/<port>/ (made by the
-// proxy, only the user can read it): <name>.json per endpoint, and .pid, the proxy's own.
-const STATE = 'B="${B:-$HOME/.local/state/hyperbrane/endpoints}"';
-const RUNNING = `pid=$(cat "$B/$P/.pid" 2>/dev/null) && kill -0 "$pid" 2>/dev/null && ps -p "$pid" -o args= | grep -q hyb-endpoint-proxy`;
-/** Starts a proxy (argv: the PROXY source); it prints its port once it serves $B/<port>/. */
-const START_SCRIPT = `${STATE}\nexec python3 -c "$1" hyb-endpoint-proxy "$B"`;
-/** Prints endpoint $N's record (its secret included: the user's own); exit 1 if there's none. */
-const READ_SCRIPT = `${STATE}\ncat "$B/$P/$N.json" 2>/dev/null || exit 1`;
-/** Exit 0 if the proxy on $P runs. */
-const RUNNING_SCRIPT = `${STATE}\n${RUNNING}`;
-/** Records endpoint $N (stdin) with the proxy on $P, atomically. */
-const WRITE_SCRIPT = `${STATE}\numask 077\n[ -d "$B/$P" ] || exit 44\ncat > "$B/$P/.$N.tmp" && mv -f "$B/$P/.$N.tmp" "$B/$P/$N.json"`;
-/** Exit 0 if endpoint $N is recorded and its proxy on $P runs, 3 if it is recorded but the proxy doesn't, 1 if it isn't recorded. */
-const STATUS_SCRIPT = `${STATE}\n[ -e "$B/$P/$N.json" ] || exit 1\n${RUNNING} || exit 3`;
-/** Removes endpoint $N; exits 10 once that was the proxy's last, and it is stopped. */
-const REMOVE_SCRIPT = `${STATE}
-rm -f "$B/$P/$N.json"
-for other in "$B/$P"/*.json; do [ -e "$other" ] && exit 0; done
-if ${RUNNING}; then kill "$pid"; fi
-rm -rf "$B/$P"
-exit 10`;
-export function createProxyEndpoints(commands, options, where) {
-    const accessible = parseAccessibleHost(options.accessibleHost);
-    const auth = (options.auth ?? proxyCredentialsAuth()).bind(accessible);
-    const firewall = options.needsFirewall === true && auth.firewall;
-    const env = (vars) => ({
-        ...(options.stateDirectory === undefined ? {} : { B: options.stateDirectory }),
-        ...Object.fromEntries(Object.entries(vars).map(([name, value]) => [name, String(value)])),
-    });
-    const sh = (script, vars, stdin) => commands.runCommand(["sh", "-c", script], { env: env(vars), stdin });
-    async function ufw(...args) {
-        const result = await commands.runCommand(["sudo", "-n", "ufw", ...args]);
-        if (result.exitCode !== 0)
-            throw new Error(`ufw ${args.join(" ")} on ${where} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
-    }
-    async function running(port) {
-        return (await sh(RUNNING_SCRIPT, { P: port })).exitCode === 0;
-    }
-    async function stop(port) {
-        const result = await sh(REMOVE_SCRIPT, { P: port, N: "-" });
-        if (result.exitCode === 10 && firewall)
-            await ufw("delete", "allow", `${port}/tcp`);
-    }
-    /** A proxy listening as `plan` asks: the running one on a fixed port, or a new one. */
-    async function proxyFor(plan) {
-        const [low, high] = plan.ports;
-        if (low === high && low !== 0 && (await running(low)))
-            return low;
-        const port = await start(plan.ports, plan.except ?? []);
-        if (port === null)
-            throw new Error(`starting the endpoint proxy on ${where} failed: no free port in ${low}-${high}`);
-        return port;
-    }
-    /**
-     * Starts a proxy on a port of `ports` (it serves what is recorded there already) and opens the
-     * port in the firewall; null if none is free. One just started on a fixed port by someone else
-     * counts as started.
-     */
-    async function start(ports, except) {
-        const [low, high] = ports;
-        const result = await commands.runCommand(["sh", "-c", START_SCRIPT, "sh", PROXY], {
-            env: env({}),
-            stdin: `${JSON.stringify({ ports, except })}\n`,
-        });
-        const port = Number(result.stdout.trim());
-        if (result.exitCode !== 0 || !Number.isInteger(port) || port <= 0) {
-            if (low === high && low !== 0 && (await running(low)))
-                return low;
-            if (/no free port/.test(result.stderr))
-                return null;
-            throw new Error(`starting the endpoint proxy on ${where} failed (exit ${result.exitCode}): ${result.stderr.trim() || result.stdout.trim()}`);
-        }
-        if (firewall) {
-            try {
-                await ufw("allow", `${port}/tcp`);
-            }
-            catch (error) {
-                await stop(port).catch(() => { });
-                throw error;
-            }
-        }
-        return port;
-    }
-    function exposeEndpoint(request) {
-        return exposeEndpointAs(crypto.randomUUID(), request);
-    }
-    async function exposeEndpointAs(name, request) {
-        if (!ENDPOINT_NAME.test(name))
-            throw new SandboxEndpointError(`not an endpoint name: "${name}"`);
-        const { target, transport = "http", allowedOrigins = [] } = request;
-        if (transport !== "http" && transport !== "sse")
-            throw new SandboxEndpointError(`unknown transport: ${transport}`);
-        const plan = auth.plan(request);
-        const port = await proxyFor(plan);
-        const id = `hyb-endpoint-${port}-${name}`;
-        const published = await plan.publish(port);
-        // The same name exposed again for the same thing keeps its credentials: whoever holds them
-        // (another request using the endpoint right now) keeps getting through.
-        const kept = await sh(READ_SCRIPT, { P: port, N: name });
-        if (kept.exitCode === 0) {
-            const record = JSON.parse(kept.stdout);
-            const same = JSON.stringify(record.target) === JSON.stringify(target) &&
-                record.transport === transport &&
-                [...record.origins].sort().join("\n") === [...allowedOrigins].sort().join("\n") &&
-                (record.check?.scheme ?? null) === (plan.check?.scheme ?? null);
-            if (same)
-                return { id, url: `${published.url}/${name}`, credentials: credentialsOf(record.check, published.credentials), allowedOrigins };
-        }
-        // The secret goes in on stdin, never on a command line other users could read.
-        const record = JSON.stringify({ target, transport, check: plan.check, origins: allowedOrigins });
-        const written = await sh(WRITE_SCRIPT, { P: port, N: name }, record);
-        if (written.exitCode !== 0) {
-            throw new Error(`recording the endpoint for ${describe(target)} on ${where} failed (exit ${written.exitCode}): ${written.stderr.trim()}`);
-        }
-        return { id, url: `${published.url}/${name}`, credentials: published.credentials, allowedOrigins };
-    }
-    async function closeEndpoint(endpointId) {
-        const { port, name } = parseEndpointId(endpointId);
-        const result = await sh(REMOVE_SCRIPT, { P: port, N: name });
-        if (result.exitCode !== 0 && result.exitCode !== 10) {
-            throw new Error(`closing endpoint ${endpointId} on ${where} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
-        }
-        if (result.exitCode === 10 && firewall)
-            await ufw("delete", "allow", `${port}/tcp`);
-    }
-    // Its record says what to serve; the proxy is started again on the port the endpoint's URL names.
-    async function ensureEndpoint(endpointId) {
-        const { port, name } = parseEndpointId(endpointId);
-        const status = await sh(STATUS_SCRIPT, { P: port, N: name });
-        if (status.exitCode === 0)
-            return true;
-        if (status.exitCode === 1)
-            return false;
-        if (status.exitCode !== 3) {
-            throw new Error(`checking endpoint ${endpointId} on ${where} failed (exit ${status.exitCode}): ${status.stderr.trim()}`);
-        }
-        if ((await start([port, port], [])) !== null)
-            return true;
-        // Its port went to something else meanwhile: the endpoint can't be served as it was given out.
-        await closeEndpoint(endpointId);
-        return false;
-    }
-    return { accessibleHost: options.accessibleHost, exposeEndpoint, exposeEndpointAs, closeEndpoint, ensureEndpoint };
-}
-/** The credentials a client presents for a recorded check; `none` when the endpoint checks nothing itself. */
-function credentialsOf(check, none) {
-    if (!check)
-        return none;
-    if (check.scheme === "bearer")
-        return { scheme: "bearer", token: check.credentials };
-    const decoded = atob(check.credentials);
-    const colon = decoded.indexOf(":");
-    return { scheme: "basic", username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };
-}
-function describe(target) {
-    return "port" in target ? `port ${target.port}` : target.unix;
-}
-/**
- * The endpoint proxy. Reads which ports it may use as a JSON line on stdin, binds one, then serves
- * the endpoints recorded in <state>/<port>/ (argv[2] is <state>), those left by a proxy that's gone
- * included; prints the port once it has detached. Each request names its endpoint by the first
- * segment of its path, whose record is read afresh, so a closed endpoint is refused at once (and its
- * streams end within a heartbeat). Each connection carries one request, checked (when the endpoint
- * has a check) before anything reaches the target; browsers' CORS preflights from the endpoint's
- * allowed origins are answered without reaching it.
- *
- * "http": the request goes on with the endpoint's segment taken off its path, its body framed here
- * and `Connection: close`, so nothing sent after it (a pipelined request) gets through unchecked;
- * only a 101 answer to an Upgrade request (a WebSocket) leaves the connection open both ways.
- *
- * "sse": `GET /<endpoint>` connects to the target and streams it back: `event: open` with the
- * connection's id, then each line it sends as a `data:` event (a `: ping` comment every 15s), and
- * `event: close` when it closes. `POST /<endpoint>/<connection>` writes the body to that connection
- * and answers 204. Lines are text, up to 16 MiB. A client that goes away takes its connection with it.
- *
- * `GET /__hyb/return?to=<url>` redirects to `url` if its origin is allowed by an endpoint here that a
- * proxy in front checks (exe.dev's login returns there, on this port).
- */
-const PROXY = String.raw `
-import errno, hmac, json, os, random, re, secrets, socket, sys, threading, urllib.parse
-
-config = json.loads(sys.stdin.readline())
-MAX_LINE = 16 * 1024 * 1024
-HEARTBEAT = 15
-PREFLIGHT = b"Access-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: authorization, content-type\r\nAccess-Control-Max-Age: 600\r\n"
-MAX_HEAD = 65536
-HEAD_TIMEOUT = 30
-HOP_BY_HOP = {b"authorization", b"connection", b"keep-alive", b"proxy-connection", b"proxy-authorization"}
-ENDPOINT_NAME = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$")
-
-
-def listen(port):
-    if socket.has_dualstack_ipv6():
-        return socket.create_server(("", port), family=socket.AF_INET6, dualstack_ipv6=True, backlog=128)
-    return socket.create_server(("", port), backlog=128)
-
-
-low, high = config["ports"]
-candidates = [port for port in range(low, high + 1) if port not in config["except"]]
-random.shuffle(candidates)
-server = None
-for port in candidates:
-    try:
-        server = listen(port)
-        break
-    except OSError as e:
-        if e.errno != errno.EADDRINUSE:
-            raise
-if server is None:
-    sys.stderr.write("no free port in %d-%d\n" % (low, high))
-    sys.exit(1)
-PORT = server.getsockname()[1]
-
-# Endpoints recorded by a proxy that's gone (a reboot) are served again, as they were given out;
-# only that proxy's own leftovers (its pid, half-written records) go.
-os.umask(0o077)
-DIR = os.path.join(sys.argv[2], str(PORT))
-os.makedirs(DIR, mode=0o700, exist_ok=True)
-for stale in os.listdir(DIR):
-    if stale.startswith("."):
-        os.remove(os.path.join(DIR, stale))
-
-# Detached; the port is printed once the proxy's pid is recorded, so whoever started it can find it.
-ready_read, ready_write = os.pipe()
-if os.fork():
-    os.close(ready_write)
-    if os.read(ready_read, 2) != b"ok":
-        sys.exit(1)
-    sys.stdout.write("%d\n" % PORT)
-    sys.stdout.flush()
-    os._exit(0)
-os.setsid()
-if os.fork():
-    os._exit(0)
-with open(os.path.join(DIR, ".pid"), "w") as pid_file:
-    pid_file.write(str(os.getpid()))
-os.write(ready_write, b"ok")
-os.close(ready_write)
-null = os.open(os.devnull, os.O_RDWR)
-for fd in (0, 1, 2):
-    os.dup2(null, fd)
-
-
-def record_path(name):
-    return os.path.join(DIR, name + ".json")
-
-
-def load(name):
-    """The endpoint recorded under that name, or None."""
-    if not ENDPOINT_NAME.match(name):
-        return None
-    try:
-        with open(record_path(name)) as record:
-            return json.load(record)
-    except (OSError, ValueError):
-        return None
-
-
-class Reply(Exception):
-    """Answers the request with an empty body and ends the connection: a refusal, a 204, a redirect."""
-
-    def __init__(self, status, extra=b""):
-        self.status = status
-        self.extra = extra
-
-
-class Reader:
-    def __init__(self, conn):
-        self.conn = conn
-        self.buffer = b""
-
-    def fill(self):
-        data = self.conn.recv(65536)
-        if not data:
-            raise Reply(b"400 Bad Request")
-        self.buffer += data
-
-    def until(self, marker, limit):
-        while marker not in self.buffer:
-            if len(self.buffer) > limit:
-                raise Reply(b"431 Request Header Fields Too Large")
-            self.fill()
-        found, self.buffer = self.buffer.split(marker, 1)
-        return found
-
-    def exactly(self, size):
-        while len(self.buffer) < size:
-            self.fill()
-        found, self.buffer = self.buffer[:size], self.buffer[size:]
-        return found
-
-
-def parse(head):
-    lines = head.split(b"\r\n")
-    if any(c in line for line in lines for c in (b"\r", b"\n", b"\0")):
-        raise Reply(b"400 Bad Request")
-    method, sep, rest = lines[0].partition(b" ")
-    path, sep2, version = rest.partition(b" ")
-    if not (sep and sep2 and method and path.startswith(b"/")) or version not in (b"HTTP/1.1", b"HTTP/1.0"):
-        raise Reply(b"400 Bad Request")
-    headers = []
-    for line in lines[1:]:
-        name, sep, value = line.partition(b":")
-        if not sep or not name or any(c in name for c in b" \t"):
-            raise Reply(b"400 Bad Request")
-        headers.append((name, value.strip()))
-    return method, path, version, headers
-
-
-def header(headers, name):
-    for n, v in headers:
-        if n.lower() == name:
-            return v
-    return None
-
-
-def authorized(headers, check):
-    values = [v for n, v in headers if n.lower() == b"authorization"]
-    if len(values) != 1:
-        return False
-    scheme, _, credentials = values[0].partition(b" ")
-    return scheme.lower() == check["scheme"].encode() and hmac.compare_digest(credentials.strip(), check["credentials"].encode())
-
-
-def challenge(check):
-    if check["scheme"] == "basic":
-        return b'WWW-Authenticate: Basic realm="hyperbrane", charset="UTF-8"\r\n'
-    return b"WWW-Authenticate: Bearer\r\n"
-
-
-def cors_headers(origin, endpoint):
-    if origin is None or origin.decode("latin-1") not in endpoint["origins"]:
-        return b""
-    return b"Access-Control-Allow-Origin: " + origin + b"\r\nAccess-Control-Allow-Credentials: true\r\nVary: Origin\r\n"
-
-
-def framing(headers):
-    lengths = [v for n, v in headers if n.lower() == b"content-length"]
-    encodings = [v for n, v in headers if n.lower() == b"transfer-encoding"]
-    if encodings:
-        if lengths or len(encodings) != 1 or encodings[0].lower() != b"chunked":
-            raise Reply(b"400 Bad Request")
-        return "chunked"
-    if len(lengths) > 1 or (lengths and not lengths[0].isdigit()):
-        raise Reply(b"400 Bad Request")
-    return int(lengths[0]) if lengths else 0
-
-
-def forward_body(reader, up, body):
-    if body == "chunked":
-        while True:
-            line = reader.until(b"\r\n", 4096)
-            size_text = line.split(b";", 1)[0].strip()
-            if not size_text or any(c not in b"0123456789abcdefABCDEF" for c in size_text):
-                raise Reply(b"400 Bad Request")
-            size = int(size_text, 16)
-            if size == 0:
-                # Trailers are dropped: read up to the blank line that ends them.
-                while reader.until(b"\r\n", MAX_HEAD):
-                    pass
-                up.sendall(b"0\r\n\r\n")
-                return
-            data = reader.exactly(size)
-            if reader.exactly(2) != b"\r\n":
-                raise Reply(b"400 Bad Request")
-            up.sendall(b"%x\r\n" % size + data + b"\r\n")
-    remaining = body
-    while remaining:
-        data = reader.exactly(min(remaining, 65536))
-        up.sendall(data)
-        remaining -= len(data)
-
-
-def tune(sock):
-    # Streams (an agent's, as SSE) go out event by event, and a peer that vanished without closing
-    # is noticed within a couple of minutes instead of holding its connection forever.
-    sock.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
-    if sock.family == socket.AF_UNIX:
-        return
-    sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
-    for name, value in (("TCP_KEEPIDLE", 60), ("TCP_KEEPINTVL", 15), ("TCP_KEEPCNT", 4)):
-        if hasattr(socket, name):
-            sock.setsockopt(socket.IPPROTO_TCP, getattr(socket, name), value)
-
-
-def connect_target(target):
-    if "unix" in target:
-        up = socket.socket(socket.AF_UNIX)
-        up.connect(target["unix"])
-    else:
-        up = socket.create_connection(("localhost", target["port"]))
-    tune(up)
-    return up
-
-
-def hang_up(sock):
-    # shutdown, not just close: it also wakes a thread blocked reading the socket.
-    if sock is None:
-        return
-    try:
-        sock.shutdown(socket.SHUT_RDWR)
-    except OSError:
-        pass
-    try:
-        sock.close()
-    except OSError:
-        pass
-
-
-def pump_response(up, conn, decided, state):
-    """Copies the target's side to the client until either end goes away, then closes the client's."""
-    first = b""
-    try:
-        while True:
-            data = up.recv(65536)
-            if not data:
-                break
-            if not decided.is_set():
-                first += data
-                if b"\r\n" in first or len(first) > 64:
-                    state["upgraded"] = first.startswith((b"HTTP/1.1 101", b"HTTP/1.0 101"))
-                    decided.set()
-            conn.sendall(data)
-    except OSError:
-        pass
-    finally:
-        decided.set()
-        hang_up(conn)
-
-
-class Collect:
-    """forward_body's destination for a body kept here (a POST to an "sse" connection)."""
-
-    def __init__(self):
-        self.data = b""
-
-    def sendall(self, data):
-        self.data += data
-        if len(self.data) > MAX_LINE:
-            raise Reply(b"413 Content Too Large")
-
-
-class Connection:
-    """An "sse" connection to an endpoint's target; POSTs write to it, one at a time."""
-
-    def __init__(self, endpoint_name, sock):
-        self.endpoint_name = endpoint_name
-        self.sock = sock
-        self.lock = threading.Lock()
-
-    def write(self, data):
-        with self.lock:
-            self.sock.sendall(data)
-
-
-CONNECTIONS = {}
-CONNECTIONS_LOCK = threading.Lock()
-
-
-def serve_sse(conn, reader, method, rest, body, cors, name, endpoint):
-    if rest in (b"", b"/"):
-        if method != b"GET":
-            raise Reply(b"405 Method Not Allowed", b"Allow: GET\r\n" + cors)
-        return stream_target(conn, cors, name, endpoint)
-    if method != b"POST" or rest.count(b"/") != 1:
-        raise Reply(b"404 Not Found", cors)
-    with CONNECTIONS_LOCK:
-        target = CONNECTIONS.get(rest[1:].decode("ascii", "replace"))
-    if target is None or target.endpoint_name != name:
-        raise Reply(b"404 Not Found", cors)
-    collected = Collect()
-    forward_body(reader, collected, body)
-    try:
-        target.write(collected.data)
-    except OSError:
-        raise Reply(b"404 Not Found", cors)
-    raise Reply(b"204 No Content", cors)
-
-
-def watch_client(conn, up):
-    # Anything the client sends after its request is dropped; its leaving ends the connection.
-    try:
-        while conn.recv(65536):
-            pass
-    except OSError:
-        pass
-    hang_up(up)
-
-
-def heartbeat(send, stop, name, up):
-    while not stop.wait(HEARTBEAT):
-        # A closed endpoint takes its streams with it.
-        if not os.path.exists(record_path(name)):
-            hang_up(up)
-            return
-        try:
-            send(b": ping\n\n")
-        except OSError:
-            return
-
-
-def stream_target(conn, cors, name, endpoint):
-    try:
-        up = connect_target(endpoint["target"])
-    except OSError:
-        raise Reply(b"502 Bad Gateway", cors)
-    connection_id = secrets.token_hex(16)
-    lock = threading.Lock()
-
-    def send(data):
-        with lock:
-            conn.sendall(data)
-
-    stop = threading.Event()
-    with CONNECTIONS_LOCK:
-        CONNECTIONS[connection_id] = Connection(name, up)
-    try:
-        conn.settimeout(None)
-        send(b"HTTP/1.1 200 OK\r\nContent-Type: text/event-stream\r\nCache-Control: no-cache, no-transform\r\nX-Accel-Buffering: no\r\nConnection: close\r\n" + cors + b"\r\n")
-        send(b"event: open\ndata: " + json.dumps({"connection": connection_id}).encode() + b"\n\n")
-        threading.Thread(target=heartbeat, args=(send, stop, name, up), daemon=True).start()
-        threading.Thread(target=watch_client, args=(conn, up), daemon=True).start()
-        pending = b""
-        while True:
-            data = up.recv(65536)
-            if not data:
-                break
-            *lines, pending = (pending + data).split(b"\n")
-            for line in lines:
-                if line.endswith(b"\r"):
-                    line = line[:-1]
-                # A bare CR would end the event early on the client: the line can't go as SSE.
-                if b"\r" in line:
-                    return
-                send(b"data: " + line + b"\n\n")
-            if len(pending) > MAX_LINE:
-                return
-        send(b"event: close\ndata: {}\n\n")
-    except OSError:
-        pass
-    finally:
-        stop.set()
-        with CONNECTIONS_LOCK:
-            CONNECTIONS.pop(connection_id, None)
-        hang_up(up)
-        hang_up(conn)
-
-
-def return_to(method, query):
-    if method != b"GET":
-        raise Reply(b"405 Method Not Allowed", b"Allow: GET\r\n")
-    to = urllib.parse.parse_qs(query.decode("latin-1")).get("to", [""])[0]
-    parts = urllib.parse.urlsplit(to)
-    if parts.scheme not in ("http", "https") or not parts.netloc or any(ord(c) < 0x21 or ord(c) > 0x7E for c in to):
-        raise Reply(b"400 Bad Request")
-    origin = parts.scheme + "://" + parts.netloc
-    for entry in os.listdir(DIR):
-        endpoint = load(entry[:-5]) if entry.endswith(".json") else None
-        if endpoint is not None and endpoint["check"] is None and origin in endpoint["origins"]:
-            raise Reply(b"302 Found", b"Location: " + to.encode() + b"\r\nCache-Control: no-store\r\n")
-    raise Reply(b"400 Bad Request")
-
-
-def handle(conn):
-    up = None
-    try:
-        conn.settimeout(HEAD_TIMEOUT)
-        reader = Reader(conn)
-        method, path, version, headers = parse(reader.until(b"\r\n\r\n", MAX_HEAD))
-        route, _, query = path.partition(b"?")
-        if route == b"/__hyb/return":
-            return_to(method, query)
-        name_bytes, slash, rest = route[1:].partition(b"/")
-        name = name_bytes.decode("ascii", "replace")
-        endpoint = load(name)
-        if endpoint is None:
-            raise Reply(b"404 Not Found")
-        cors = cors_headers(header(headers, b"origin"), endpoint)
-        # A browser's preflight carries no credentials; it is answered here and never reaches the target.
-        if method == b"OPTIONS" and header(headers, b"access-control-request-method") is not None:
-            raise Reply(b"204 No Content", cors + PREFLIGHT) if cors else Reply(b"403 Forbidden")
-        check = endpoint["check"]
-        if check and not authorized(headers, check):
-            raise Reply(b"401 Unauthorized", challenge(check) + cors)
-        body = framing(headers)
-        if endpoint["transport"] == "sse":
-            return serve_sse(conn, reader, method, slash + rest, body, cors, name, endpoint)
-        upgrade = any(n.lower() == b"upgrade" for n, _ in headers)
-        try:
-            up = connect_target(endpoint["target"])
-        except OSError:
-            raise Reply(b"502 Bad Gateway", cors)
-        target_path = slash + rest if slash else b"/"
-        if query:
-            target_path += b"?" + query
-        kept = [n + b": " + v for n, v in headers if n.lower() not in HOP_BY_HOP]
-        kept.append(b"Connection: Upgrade" if upgrade else b"Connection: close")
-        up.sendall(method + b" " + target_path + b" " + version + b"\r\n" + b"\r\n".join(kept) + b"\r\n\r\n")
-        decided = threading.Event()
-        state = {"upgraded": False}
-        # The request is done once the response is: the client side closes with it.
-        pump = threading.Thread(target=pump_response, args=(up, conn, decided, state), daemon=True)
-        pump.start()
-        forward_body(reader, up, body)
-        conn.settimeout(None)
-        if upgrade:
-            decided.wait()
-        if upgrade and state["upgraded"]:
-            if reader.buffer:
-                up.sendall(reader.buffer)
-            while True:
-                data = conn.recv(65536)
-                if not data:
-                    break
-                up.sendall(data)
-        else:
-            # Anything more from the client is dropped: it would reach the target unchecked.
-            while conn.recv(65536):
-                pass
-        # The client is gone (or the response ended and closed it): a stream it was reading stops too.
-        hang_up(up)
-        pump.join()
-    except Reply as reply:
-        try:
-            conn.sendall(b"HTTP/1.1 " + reply.status + b"\r\nContent-Length: 0\r\nConnection: close\r\n" + reply.extra + b"\r\n")
-        except OSError:
-            pass
-    except (OSError, ValueError):
-        pass
-    finally:
-        hang_up(up)
-        hang_up(conn)
-
-
-while True:
-    conn, _ = server.accept()
-    tune(conn)
-    threading.Thread(target=handle, args=(conn,), daemon=True).start()
-`;