kczx-user-management 1.0.0

package/src/proxy.js

@@ -0,0 +1,474 @@
+'use strict'
+
+/**
+ * Reverse proxy from the gateway's HTTPS listener to the loopback upstream
+ * (the dsh webserver): plain HTTP requests and WebSocket upgrades.
+ *
+ * Ported from dsh-gateway (clarknu/dsh-gateway) lib/proxy.js, adapted to
+ * CommonJS. Dependency-free on purpose — node:http request + node:net
+ * upgrade socket, streaming both ways so SSE and long responses are never
+ * buffered.
+ *
+ * The crucial twist is loopback-masquerade: the client's Host/Origin are
+ * rewritten to the upstream loopback authority so the dsh `/api` browser-trust
+ * fence (which accepts loopback hosts and requires Origin.host === Host.host)
+ * passes for proxied traffic.
+ *
+ * dsh 0.1.2-rc.1+ note: dsh-client-connection now gates the `/` index.html
+ * behind a launchToken + authority-bound signed cookie (BrowserAuth). The
+ * gateway already authenticates the human at its own layer, so for index
+ * requests we mint a loopback browser cookie via the host's PUBLIC
+ * `connection.authenticatedUrl(baseUrl)` builder (the sanctioned way to obtain
+ * a token-carrying URL — BrowserAuth.launchToken itself is TS-private) and
+ * inject it upstream, letting authorizeIndex pass. On 0.1.1-rc.2 (no
+ * BrowserAuth) getAuthenticatedUrl yields null and we fall through to a plain
+ * proxy — fully backward compatible.
+ */
+
+import http from 'node:http'
+import net from 'node:net'
+import zlib from 'node:zlib'
+
+/** RFC 7230 hop-by-hop headers, never forwarded. */
+const HOP_BY_HOP = new Set([
+  'connection',
+  'keep-alive',
+  'proxy-authenticate',
+  'proxy-authorization',
+  'proxy-connection',
+  'te',
+  'trailer',
+  'transfer-encoding',
+  'upgrade',
+])
+
+/** Create a proxy target from an http upstream URL string. */
+/**
+ * @param upstream - loopback upstream origin.
+ * @param getAuthenticatedUrl - BrowserAuth cookie minter (may yield null).
+ * @param hooks - optional enforcement seam:
+ *   `rewriteResponse(req)` returns null when the response may stream through
+ *   untouched, or `{ transform, maxBytes }` when it must be rewritten first
+ *   (the caller — the gateway — owns that decision because only it knows the
+ *   account's permissions; this module owns the HTTP mechanics).
+ */
+function createProxy(upstream, getAuthenticatedUrl, hooks) {
+  const target = new URL(upstream)
+  if (target.protocol !== 'http:') {
+    throw new Error(`user-management: upstream must be plain http (loopback), got ${target.protocol}`)
+  }
+  const host = target.hostname
+  const port = Number(target.port || 80)
+  const agent = new http.Agent({ keepAlive: true, maxSockets: 64 })
+  /** Loopback authority we present upstream (rewrites the client's Host). */
+  const upstreamAuthority = port === 80 ? host : `${host}:${port}`
+  /** Origin header we present upstream, matching the rewritten Host. */
+  const upstreamOrigin = `http://${upstreamAuthority}`
+
+  // dsh-client-connection browser-session cookie for upstreamAuthority.
+  // Minted once via the host's authenticatedUrl() token exchange, reused
+  // across index requests, refreshed when the upstream answers 401 (cookie
+  // expired after its 30-day max age / dsh restarted with a new token).
+  let dshCookie = null
+
+  const forwardHeaders = (req) => {
+    const headers = {}
+    for (const [name, value] of Object.entries(req.headers || {})) {
+      if (value === undefined || HOP_BY_HOP.has(name.toLowerCase())) continue
+      headers[name] = value
+    }
+    // Loopback-masquerade mode: rewrite Host and Origin to the upstream
+    // loopback authority. The dsh trust fence accepts loopback hosts and
+    // requires Origin.host === Host.host, so both must move together.
+    headers.host = upstreamAuthority
+    if (headers.origin !== undefined) {
+      headers.origin = upstreamOrigin
+    }
+    const peer = (req.socket && req.socket.remoteAddress) || ''
+    const prior = req.headers['x-forwarded-for']
+    headers['x-forwarded-for'] = prior ? `${prior}, ${peer}` : peer
+    headers['x-forwarded-proto'] = 'https'
+    headers['x-forwarded-host'] = req.headers.host || ''
+    if (dshCookie) headers.cookie = dshCookie  // patched: all paths carry BrowserAuth cookie
+    // patched: forward the caller's um_session as a header so same-origin
+    // plugins (e.g. dsh-git-server) can resolve the acting user — the cookie
+    // itself is replaced above, so this is the only identity channel through.
+    const umTok = /(?:^|;\s*)um_session=([^;]+)/.exec(String(req.headers.cookie || ''))
+    if (umTok) headers['x-um-session'] = decodeURIComponent(umTok[1])
+    return headers
+  }
+
+  const stripHop = (headers) => {
+    const out = {}
+    for (const [name, value] of Object.entries(headers || {})) {
+      if (value === undefined || HOP_BY_HOP.has(name.toLowerCase())) continue
+      out[name] = value
+    }
+    return out
+  }
+
+  /** Rewrite upstream absolute Location headers back to the public base. */
+  const rewriteLocation = (headers, clientHost) => {
+    const loc = headers.location
+    if (typeof loc === 'string' && loc.startsWith(`http://${upstreamAuthority}`)) {
+      headers.location = `https://${clientHost}${loc.slice(`http://${upstreamAuthority}`.length)}`
+    }
+    return headers
+  }
+
+  /**
+   * Mint a loopback browser cookie from the dsh launch token. The token URL
+   * comes from the host's PUBLIC `connection.authenticatedUrl(origin)` — we
+   * never touch BrowserAuth's private fields nor hardcode its query key.
+   */
+  const refreshDshCookie = () =>
+    new Promise((resolve) => {
+      let authUrl = null
+      try {
+        authUrl = typeof getAuthenticatedUrl === 'function' ? getAuthenticatedUrl(`http://${upstreamAuthority}`) : null
+      } catch {
+        authUrl = null
+      }
+      if (!authUrl) {
+        resolve(false)
+        return
+      }
+      let path = '/'
+      try {
+        const parsed = new URL(authUrl)
+        path = `${parsed.pathname}${parsed.search}` || '/'
+      } catch {
+        resolve(false)
+        return
+      }
+      const authReq = http.request(
+        {
+          host,
+          port,
+          method: 'GET',
+          path,
+          headers: { host: upstreamAuthority, origin: upstreamOrigin },
+          agent,
+        },
+        (authRes) => {
+          // authorizeIndex answers 303 + Set-Cookie on a valid token; either way
+          // we only care about the cookie header the upstream stamped in.
+          const setCookie = authRes.headers['set-cookie']
+          if (Array.isArray(setCookie) && setCookie.length) {
+            dshCookie = setCookie
+              .map((c) => c.split(';')[0].trim())
+              .filter(Boolean)
+              .join('; ')
+          }
+          authRes.resume()
+          resolve(!!dshCookie)
+        },
+      )
+      authReq.on('error', () => resolve(false))
+      authReq.end()
+    })
+
+  const ensureDshCookie = async () => {
+    if (dshCookie) return true
+    return refreshDshCookie()
+  }
+
+  const isIndexPath = (rawUrl) => {
+    const url = rawUrl || ''
+    const i = url.indexOf('?')
+    const path = i === -1 ? url : url.slice(0, i)
+    return path === '/' || path === '/index.html'
+  }
+
+  /**
+   * Serve an index (`/` or `/index.html`) request: inject the minted dsh
+   * browser cookie so authorizeIndex passes, then stream the upstream response
+   * back. Refreshes the cookie once on 401 and retries, then gives up (serves
+   * the 401 through) so a stuck token never loops.
+   */
+  async function handleIndexRequest(req, res, attempts) {
+    attempts = attempts || 0
+    await ensureDshCookie()
+    const headers = forwardHeaders(req)
+    if (dshCookie) headers.cookie = dshCookie
+    const upstreamReq = http.request(
+      {
+        host,
+        port,
+        method: req.method,
+        path: req.url,
+        headers,
+        agent,
+      },
+      (upstreamRes) => {
+        if (upstreamRes.statusCode === 401 && dshCookie && attempts < 1) {
+          upstreamRes.resume()
+          dshCookie = null
+          refreshDshCookie().then(() => handleIndexRequest(req, res, attempts + 1))
+          return
+        }
+        const outHeaders = stripHop(upstreamRes.headers)
+        // The cookie dsh stamps is authority-bound to the loopback upstream and
+        // must not leak to the public browser (wrong domain, never storable).
+        delete outHeaders['set-cookie']
+        if (outHeaders.location !== undefined) rewriteLocation(outHeaders, req.headers.host || '')
+        res.writeHead(upstreamRes.statusCode || 502, outHeaders)
+        if (req.method === 'HEAD' || upstreamRes.statusCode === 204 || upstreamRes.statusCode === 304) {
+          upstreamRes.resume()
+          res.end()
+        } else {
+          upstreamRes.pipe(res)
+        }
+      },
+    )
+    upstreamReq.on('error', (err) => {
+      if (res.headersSent) {
+        res.destroy()
+        return
+      }
+      res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
+      res.end(`user-management: upstream unreachable (${err.code || err.message})`)
+    })
+    req.on('error', () => upstreamReq.destroy())
+    req.pipe(upstreamReq)
+  }
+
+  /** Proxy one plain HTTP request (non-index paths). */
+  function proxyPlain(req, res) {
+    const upstreamReq = http.request(
+      {
+        host,
+        port,
+        method: req.method,
+        path: req.url,
+        headers: forwardHeaders(req),
+        agent,
+      },
+      (upstreamRes) => {
+        const outHeaders = stripHop(upstreamRes.headers)
+        delete outHeaders['set-cookie']
+        if (outHeaders.location !== undefined) rewriteLocation(outHeaders, req.headers.host || '')
+        res.writeHead(upstreamRes.statusCode || 502, outHeaders)
+        if (req.method === 'HEAD' || upstreamRes.statusCode === 204 || upstreamRes.statusCode === 304) {
+          upstreamRes.resume()
+          res.end()
+        } else {
+          upstreamRes.pipe(res)
+        }
+      },
+    )
+    upstreamReq.on('error', (err) => {
+      if (res.headersSent) {
+        res.destroy()
+        return
+      }
+      res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
+      res.end(`user-management: upstream unreachable (${err.code || err.message})`)
+    })
+    req.on('error', () => upstreamReq.destroy())
+    sendRequestBody(req, upstreamReq)
+  }
+
+  /**
+   * Buffered proxy for responses that must be REWRITTEN before they reach the
+   * client — today the workspace list, which has to be filtered per account.
+   *
+   * Streaming is impossible: the body has to be parsed before it can be judged.
+   * So this path buffers (with a hard cap) and **fails closed** — a body it
+   * cannot parse or rewrite becomes a 502, never an unfiltered pass-through,
+   * because passing the full list through would expose every other account's
+   * workspaces.
+   */
+  function proxyRewriteJson(req, res, transform, options) {
+    const maxBytes = Number.isFinite(options && options.maxBytes) ? options.maxBytes : 8 * 1024 * 1024
+    let settled = false
+    const failClosed = (reason) => {
+      if (settled) return
+      settled = true
+      if (res.headersSent) {
+        res.destroy()
+        return
+      }
+      res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
+      res.end(`user-management: upstream response not usable for this account (${reason})`)
+    }
+    const upstreamReq = http.request(
+      {
+        host,
+        port,
+        method: req.method,
+        path: req.url,
+        headers: forwardHeaders(req),
+        agent,
+      },
+      (upstreamRes) => {
+        const chunks = []
+        let size = 0
+        upstreamRes.on('data', (chunk) => {
+          size += chunk.length
+          if (size > maxBytes) {
+            upstreamRes.destroy()
+            failClosed('too large')
+            return
+          }
+          chunks.push(chunk)
+        })
+        upstreamRes.on('error', () => failClosed('upstream stream error'))
+        upstreamRes.on('end', () => {
+          if (settled) return
+          try {
+            const encoding = String(upstreamRes.headers['content-encoding'] || '')
+            let body = Buffer.concat(chunks)
+            if (encoding.includes('gzip')) body = zlib.gunzipSync(body)
+            const parsed = JSON.parse(body.toString('utf8'))
+            const replacement = transform(parsed, { status: upstreamRes.statusCode, headers: upstreamRes.headers })
+            let out = Buffer.from(JSON.stringify(replacement === undefined ? parsed : replacement), 'utf8')
+            const outHeaders = stripHop(upstreamRes.headers)
+            delete outHeaders['set-cookie']
+            if (outHeaders.location !== undefined) rewriteLocation(outHeaders, req.headers.host || '')
+            const acceptsGzip = /\bgzip\b/.test(String(req.headers['accept-encoding'] || ''))
+            if (encoding.includes('gzip') && acceptsGzip) {
+              out = zlib.gzipSync(out)
+              outHeaders['content-encoding'] = 'gzip'
+            } else {
+              delete outHeaders['content-encoding']
+            }
+            delete outHeaders['transfer-encoding']
+            outHeaders['content-length'] = String(out.length)
+            settled = true
+            if (!res.headersSent) res.writeHead(upstreamRes.statusCode || 200, outHeaders)
+            if (!res.writableEnded) res.end(out)
+          } catch {
+            failClosed('unprocessable')
+          }
+        })
+      },
+    )
+    upstreamReq.on('error', (err) => {
+      if (res.headersSent) {
+        res.destroy()
+        return
+      }
+      res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
+      res.end(`user-management: upstream unreachable (${err.code || err.message})`)
+    })
+    req.on('error', () => upstreamReq.destroy())
+    sendRequestBody(req, upstreamReq)
+  }
+
+  /**
+   * Send the request body upstream.
+   *
+   * A body the gateway already consumed for a permission check is replayed from
+   * its buffer: by then the socket stream is spent, and piping it would send an
+   * empty body upstream (the request would look bodyless — a silently broken
+   * session.create rather than a denial).
+   */
+  function sendRequestBody(req, upstreamReq) {
+    if (Buffer.isBuffer(req.umReplayBody)) {
+      upstreamReq.end(req.umReplayBody)
+      return
+    }
+    req.pipe(upstreamReq)
+  }
+
+  /** Route index paths through the auth-injecting handler, everything else plain. */
+  async function handleRequest(req, res) {
+    await ensureDshCookie()
+    if (isIndexPath(req.url)) {
+      handleIndexRequest(req, res)
+      return
+    }
+    if (hooks && typeof hooks.rewriteResponse === 'function') {
+      const plan = hooks.rewriteResponse(req)
+      if (plan && typeof plan.transform === 'function') {
+        proxyRewriteJson(req, res, plan.transform, plan)
+        return
+      }
+    }
+    proxyPlain(req, res)
+  }
+
+  /** Build the raw HTTP/1.1 upgrade request line + headers for upstream. */
+  const buildUpgradeRequest = (req) => {
+    const headers = {}
+    for (const [name, value] of Object.entries(forwardHeaders(req))) {
+      headers[name] = value
+    }
+    headers.connection = req.headers.connection || 'Upgrade'
+    headers.upgrade = req.headers.upgrade || 'websocket'
+    let line = `${req.method} ${req.url} HTTP/1.1\r\n`
+    for (const [name, value] of Object.entries(headers)) {
+      line += `${name}: ${value}\r\n`
+    }
+    line += '\r\n'
+    return line
+  }
+
+  /**
+   * Proxy one WebSocket (or other protocol) upgrade. Ensures the dsh
+   * BrowserAuth cookie is minted before forwarding (the HTTP path does
+   * this in handleRequest; without it dsh 0.1.2-rc.1+ rejects the upgrade
+   * at the BrowserAuth fence — "Remote stream WebSocket closed"). If the
+   * upstream rejects the upgrade (non-101, e.g. cookie expired after a
+   * dsh restart), refreshes the cookie and retries once — mirrors the
+   * HTTP 401-retry in handleIndexRequest.
+   */
+  function handleUpgrade(req, socket, head, attempts) {
+    attempts = attempts || 0
+    ensureDshCookie().then(() => {
+      const upstreamSocket = net.connect(port, host, () => {
+        upstreamSocket.write(buildUpgradeRequest(req))
+        if (head && head.length > 0) upstreamSocket.write(head)
+      })
+      // Peek at the upstream's first response line: 101 = upgrade accepted,
+      // anything else (401/403/500) = rejected, likely an expired cookie.
+      // Refresh + retry once; on second failure destroy so the browser
+      // reconnects (HTTP traffic will have re-minted by then).
+      let upgraded = false
+      upstreamSocket.once('data', (chunk) => {
+        const statusLine = chunk.toString('utf8', 0, Math.min(chunk.length, 64)).split('\r\n')[0]
+        if (statusLine.includes(' 101 ')) {
+          upgraded = true
+          socket.write(chunk)
+          upstreamSocket.pipe(socket)
+          socket.pipe(upstreamSocket)
+        } else if (attempts < 1) {
+          upstreamSocket.destroy()
+          dshCookie = null
+          refreshDshCookie().then(() => handleUpgrade(req, socket, head, attempts + 1))
+        } else {
+          upstreamSocket.destroy()
+          if (!socket.destroyed) socket.destroy()
+        }
+      })
+      upstreamSocket.on('error', () => {
+        if (!upgraded && !socket.destroyed) {
+          socket.end('HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\nConnection: close\r\n\r\n')
+        }
+      })
+      upstreamSocket.on('close', () => {
+        if (!upgraded && !socket.destroyed) socket.destroy()
+      })
+      socket.on('error', () => upstreamSocket.destroy())
+      socket.on('close', () => upstreamSocket.destroy())
+    }).catch(() => {
+      if (!socket.destroyed) socket.destroy()
+    })
+  }
+
+  return {
+    upstream,
+    handleRequest,
+    handleUpgrade,
+    /** Exposed so the gateway (and its tests) can drive the rewrite path. */
+    proxyRewriteJson,
+    /** @returns {string|null} the minted dsh browser cookie (for tests). */
+    getDshCookie: () => dshCookie,
+    close() {
+      agent.destroy()
+    },
+  }
+}
+
+export { createProxy }