locadot 2.0.0 → 2.1.0-beta.1

package/dist/proxy/router.js

@@ -5,10 +5,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleRequest = handleRequest;
 exports.handleUpgrade = handleUpgrade;
+const http_1 = __importDefault(require("http"));
 const template_1 = require("../constants/template");
 const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
 const urls_1 = require("../lib/urls");
+const remote_1 = require("./remote");
 const cors_1 = require("./cors");
 const options_1 = require("./options");
 const guard_1 = require("./guard");
@@ -16,7 +18,16 @@ const passthrough_1 = require("./passthrough");
 const request_1 = require("./request");
 const stats_1 = require("./stats");
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
-const resolveHost = (req, ctx) => {
+const resolveHost = (req, ctx, hub) => {
+    if (hub?.kind === "app") {
+        (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure() });
+        return hub.host;
+    }
+    if (hub?.kind === "local") {
+        const host = `localhost:${hub.port}`;
+        (0, request_1.tag)(req, { host, remote: true, secure: ctx.hub.secure() });
+        return host;
+    }
     const host = (0, request_1.hostOf)(req);
     const local = ctx.tunnelFor?.(host);
     if (local)
@@ -28,19 +39,62 @@ const passThrough = (req, entry) => Boolean(entry.cors);
 /** Same-origin only, and a tunnel visitor may only reach public hosts (see guard.ts). */
 const viaAllowed = (req, via) => (0, passthrough_1.isSameOrigin)(req) && (!(0, request_1.fromTunnel)(req) || (0, guard_1.isPublicHost)(via.host));
 const reason = (err) => err?.code || err?.message;
+const remoteGone = (entry) => `the connection to ${entry.remote.name} was removed`;
+/** Sender side: an admin peer reaching one of this machine's ports. */
+const localEntry = (port) => ({ target: `http://localhost:${port}`, createdAt: "", updatedAt: "" });
+const html = (res, status, body) => {
+    res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+    res.end(body);
+};
+/** `<port>.<domain>.localhost` on this proxy's scheme and port. */
+const portUrl = (req, domain) => {
+    const port = (req.headers.host || "").replace(/^\[[^\]]*\]|^[^:]*/, "");
+    return `${(0, request_1.isTls)(req) ? "https" : "http"}://PORT.${domain}.localhost${/^:\d{1,5}$/.test(port) ? port : ""}/`;
+};
+const loopback = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+/**
+ * `<domain>.localhost` spends this machine's admin token, so only this machine's own browser may use it: tunnels
+ * (cloudflared connects from loopback but adds Cf-* headers), hub peers and LAN clients all share the listener.
+ */
+const localTarget = (req, ctx, host, hub) => {
+    if ((hub && hub.kind !== "none") || (0, request_1.fromTunnel)(req) || !loopback.has(req.socket.remoteAddress || ""))
+        return undefined;
+    if (req.headers["cf-ray"] || req.headers["cf-connecting-ip"] || req.headers["cdn-loop"])
+        return undefined;
+    return ctx.localFor?.(host);
+};
 function handleRequest(req, res, ctx) {
-    const host = resolveHost(req, ctx);
+    const hub = ctx.hub?.classify(req);
+    if (hub?.kind === "api") {
+        ctx.hub.api(req, res);
+        return;
+    }
+    if (hub?.kind === "deny") {
+        res.writeHead(hub.status, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" });
+        res.end(`locadot: ${hub.message}\n`);
+        return;
+    }
+    const host = resolveHost(req, ctx, hub);
     try {
         if (constants_1.default.dashboardHosts.includes(host)) {
             ctx.dashboard(req, res);
             return;
         }
-        const entry = ctx.lookup(host);
+        const entry = hub?.kind === "local" ? localEntry(hub.port) : ctx.lookup(host);
         if (!entry) {
+            const local = localTarget(req, ctx, host, hub);
+            if (local) {
+                forwardLocal(req, res, ctx, host, local);
+                return;
+            }
             res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
             res.end((0, template_1.proxyNotFound)(host, dashboardUrl(req)));
             return;
         }
+        if (entry.remote) {
+            forwardRemote(req, res, ctx, host, entry);
+            return;
+        }
         // Answered here: upstreams often reject OPTIONS or don't send the headers the browser wants.
         if (entry.cors && (0, cors_1.isPreflight)(req)) {
             res.writeHead(204, (0, cors_1.preflightHeaders)(req));
@@ -87,15 +141,82 @@ function handleRequest(req, res, ctx) {
         res.end();
     }
 }
+/** Receiver side: the sender does the routing, cors and rewriting; we only add the credentials. */
+function forwardRemote(req, res, ctx, host, entry) {
+    const remote = ctx.remoteFor?.(entry.remote.name);
+    if (!remote) {
+        res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+        res.end((0, template_1.upstreamDown)(host, entry.target, remoteGone(entry), dashboardUrl(req)));
+        return;
+    }
+    const started = Date.now();
+    res.once("finish", () => (0, stats_1.record)(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500));
+    ctx.proxy.web(req, res, (0, remote_1.remoteOptions)(req, entry, remote), (err) => {
+        logger_1.default.warn(`${host} → ${remote.name} (${remote.url}): ${reason(err)}`);
+        if (res.headersSent) {
+            res.destroy();
+            return;
+        }
+        res.writeHead(502, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+        res.end((0, template_1.upstreamDown)(host, `${remote.name}: ${entry.remote.host}`, reason(err) || "error", dashboardUrl(req)));
+    });
+}
+/** Receiver side: the sender checks the role again and proxies to its own localhost:<port>. */
+function forwardLocal(req, res, ctx, host, local) {
+    const { remote, domain, port } = local;
+    const allowed = (0, remote_1.canReachLocalhost)(remote);
+    if (!port || !allowed) {
+        const hosts = (ctx.remoteHosts?.(remote.name) || []).map((h) => ({ local: h, url: `${(0, urls_1.urlFor)(h, (0, request_1.isTls)(req))}/` }));
+        const body = (0, template_1.remoteLocalhost)({ domain, name: remote.name, sender: remote.sender.hostname, allowed, hosts, portUrl: portUrl(req, domain), dashboardUrl: dashboardUrl(req) });
+        html(res, port ? 403 : 200, body);
+        return;
+    }
+    const started = Date.now();
+    res.once("finish", () => (0, stats_1.record)(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500));
+    ctx.proxy.web(req, res, (0, remote_1.localOptions)(req, remote, port), (err) => {
+        logger_1.default.warn(`${host} → ${remote.name} localhost:${port}: ${reason(err)}`);
+        if (res.headersSent) {
+            res.destroy();
+            return;
+        }
+        html(res, 502, (0, template_1.upstreamDown)(host, `${remote.name}: localhost:${port}`, reason(err) || "error", dashboardUrl(req)));
+    });
+}
 function handleUpgrade(req, socket, head, ctx) {
-    const host = resolveHost(req, ctx);
     socket.on("error", () => socket.destroy());
+    const hub = ctx.hub?.classify(req);
+    if (hub?.kind === "api" || hub?.kind === "deny") {
+        const status = hub.kind === "deny" ? hub.status : 400;
+        socket.end(`HTTP/1.1 ${status} ${http_1.default.STATUS_CODES[status] || "Error"}\r\nConnection: close\r\n\r\n`);
+        return;
+    }
+    const host = resolveHost(req, ctx, hub);
     try {
-        const entry = ctx.lookup(host);
+        const entry = hub?.kind === "local" ? localEntry(hub.port) : ctx.lookup(host);
         if (!entry) {
+            const local = localTarget(req, ctx, host, hub);
+            if (local?.port && (0, remote_1.canReachLocalhost)(local.remote)) {
+                ctx.proxy.ws(req, socket, head, (0, remote_1.localOptions)(req, local.remote, local.port), (err) => {
+                    logger_1.default.warn(`${host} WebSocket → ${local.remote.name} localhost:${local.port}: ${reason(err)}`);
+                    socket.destroy();
+                });
+                return;
+            }
             socket.end("HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n");
             return;
         }
+        if (entry.remote) {
+            const remote = ctx.remoteFor?.(entry.remote.name);
+            if (!remote) {
+                socket.end("HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n");
+                return;
+            }
+            ctx.proxy.ws(req, socket, head, (0, remote_1.remoteOptions)(req, entry, remote), (err) => {
+                logger_1.default.warn(`${host} WebSocket → ${remote.name}: ${reason(err)}`);
+                socket.destroy();
+            });
+            return;
+        }
         const via = passThrough(req, entry) ? (0, passthrough_1.parseVia)(req.url) : undefined;
         if (via && !viaAllowed(req, via)) {
             socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");

package/dist/server/index.js

@@ -13,6 +13,10 @@ const localhost_1 = __importDefault(require("../lib/localhost"));
 const router_1 = require("../proxy/router");
 const response_1 = require("../proxy/response");
 const tunnel_1 = require("../proxy/tunnel");
+const hub_tunnel_1 = require("../proxy/hub-tunnel");
+const hub_1 = require("../proxy/hub");
+const remote_1 = require("../proxy/remote");
+const hub_config_1 = __importDefault(require("../lib/hub-config"));
 const file_1 = __importDefault(require("../utils/file"));
 const logger_1 = __importDefault(require("../utils/logger"));
 const certs_1 = require("../utils/certs");
@@ -24,10 +28,20 @@ const lifecycle_1 = require("./lifecycle");
 const state_1 = require("./state");
 const token_1 = require("./token");
 async function startCentralProxy() {
-    const tunnels = new tunnel_1.TunnelManager(() => {
+    const origin = () => {
         const host = constants_1.default.server.bind.find((address) => !address.includes(":")) ? "127.0.0.1" : "[::1]";
         return `http://${host}:${constants_1.default.server.httpPort}`;
-    });
+    };
+    const tunnels = new tunnel_1.TunnelManager(origin);
+    const hub = new hub_tunnel_1.HubTunnel(origin);
+    const reloadHub = () => {
+        try {
+            hub.sync(hub_config_1.default.read());
+        }
+        catch (error) {
+            logger_1.default.error(error);
+        }
+    };
     const registry = (0, state_1.createRegistryState)((hosts) => tunnels.sync(hosts));
     registry.reload();
     const stats = new Map();
@@ -53,6 +67,27 @@ async function startCentralProxy() {
         stats,
         lookup: (host) => registry.get().hosts[tunnels.hostFor(host) ?? host],
         tunnelFor: (host) => tunnels.hostFor(host),
+        remoteFor: remote_1.remoteFor,
+        localFor: remote_1.localFor,
+        remoteHosts: (name) => Object.entries(registry.get().hosts)
+            .filter(([, entry]) => entry.remote?.name === name)
+            .map(([host]) => host)
+            .sort(),
+        hub: {
+            classify: (req) => (0, hub_1.classify)(req, hub.publicHost(), registry.get().hosts, {
+                localhost: hub_config_1.default.readCached()?.localhost !== false,
+                blockedPorts: [info.httpPort, info.httpsPort],
+            }),
+            api: (req, res) => {
+                (0, hub_1.handleHubApi)(req, res, { getRegistry: registry.get, reload: registry.reload, retryTunnels: () => tunnels.sync(registry.get().hosts, true) }).catch((error) => {
+                    logger_1.default.error(error);
+                    if (!res.headersSent)
+                        res.writeHead(500);
+                    res.end();
+                });
+            },
+            secure: () => hub.state().url?.startsWith("https:") ?? false,
+        },
         dashboard: (req, res) => (0, dashboard_1.handleDashboardRequest)(req, res, {
             getRegistry: registry.get,
             getStats: () => Object.fromEntries(stats),
@@ -67,6 +102,11 @@ async function startCentralProxy() {
             shutdown: (reason) => shutdown(reason),
             tunnel: (host) => tunnels.state(host),
             retryTunnels: () => tunnels.sync(registry.get().hosts, true),
+            hub: () => hub.state(),
+            reloadHub,
+            setupNamedHub: (domain, tunnel) => {
+                hub.setupNamed(domain, tunnel).catch((error) => logger_1.default.warn(`hub setup for ${domain}: ${error?.message || error}`));
+            },
         }),
     };
     const tls = { ...(await (0, certs_1.defaultContext)()), SNICallback: (0, certs_1.createSNICallback)() };
@@ -78,9 +118,17 @@ async function startCentralProxy() {
         return server;
     }, info);
     const watcher = file_1.default.watch("REGISTRY_FILE", registry.reload);
+    // After binding, so the hub tunnel points at the port we actually got.
+    reloadHub();
+    const hubWatcher = file_1.default.watch("HUB_FILE", reloadHub);
     await refreshTrust();
     setInterval(refreshTrust, 5 * 60000).unref();
     locadot_file_1.default.writeProxyInfo(info);
-    shutdown = (0, lifecycle_1.installShutdown)({ watcher, servers, stopTunnels: () => tunnels.stopAll() });
+    shutdown = (0, lifecycle_1.installShutdown)({ watcher, servers, stopTunnels: () => {
+            tunnels.stopAll();
+            hub.stop();
+            hubWatcher.close();
+        },
+    });
     logger_1.default.info(`☑️ locadot ${package_json_1.version} ready (pid ${process.pid})`);
 }

package/dist/utils/startup.js

@@ -33,7 +33,7 @@ const launchArgs = () => {
  * and node hidden too. cmd also appends the output to the log, like the cron line does.
  */
 const windowsLauncherScript = (command, args) => {
-    const env = `set LOCADOT_HTTP_PORT=${constants_1.default.server.httpPort}&& set LOCADOT_HTTPS_PORT=${constants_1.default.server.httpsPort}&&`;
+    const env = `set LOCADOT_HTTP_PORT=${constants_1.default.server.httpPort}&& set LOCADOT_HTTPS_PORT=${constants_1.default.server.httpsPort}&& set LOCADOT_USER_PORTS=${constants_1.default.userPortEnv()}&&`;
     const line = `cmd /d /c ${env} ${[command, ...args].map((a) => `"${a}"`).join(" ")} >> "${constants_1.default.paths.LOGS}" 2>&1`;
     return `CreateObject("WScript.Shell").Run "${line.replace(/"/g, '""')}", 0, False\r\n`;
 };
@@ -88,7 +88,7 @@ class Startup {
                 break;
             }
             case "linux": {
-                const env = `LOCADOT_HOME=${quote(constants_1.default.paths.HOME)} LOCADOT_HTTP_PORT=${constants_1.default.server.httpPort} LOCADOT_HTTPS_PORT=${constants_1.default.server.httpsPort}`;
+                const env = `LOCADOT_HOME=${quote(constants_1.default.paths.HOME)} LOCADOT_HTTP_PORT=${constants_1.default.server.httpPort} LOCADOT_HTTPS_PORT=${constants_1.default.server.httpsPort} LOCADOT_USER_PORTS=${constants_1.default.userPortEnv()}`;
                 const line = `@reboot ${env} ${[command, ...args].map(quote).join(" ")} >> ${quote(constants_1.default.paths.LOGS)} 2>&1 ${CRON_MARK}`;
                 const edit = cronEdit(line);
                 if (linuxNeedsRoot()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.0.0",
+  "version": "2.1.0-beta.1",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",