locadot 2.3.0 → 2.4.0

package/dist/lib/host-auth.js

@@ -0,0 +1,123 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseScopes = exports.MIN_HOST_PASSWORD = exports.HOST_SESSION_TTL_SEC = exports.HOST_COOKIE = exports.SCOPES = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const constants_1 = __importDefault(require("../constants"));
+const file_1 = __importDefault(require("../utils/file"));
+exports.SCOPES = ["shared", "remote", "local"];
+exports.HOST_COOKIE = "locadot_pw";
+exports.HOST_SESSION_TTL_SEC = 7 * 24 * 3600;
+exports.MIN_HOST_PASSWORD = 8;
+const hashOf = (password, salt) => crypto_1.default.scryptSync(password, Buffer.from(salt, "base64"), 32).toString("base64");
+const sign = (secret, value) => crypto_1.default.createHmac("sha256", secret).update(value).digest("base64url");
+const safeEqual = (a, b) => {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && crypto_1.default.timingSafeEqual(x, y);
+};
+let cache;
+const readAll = () => {
+    let mtimeMs;
+    try {
+        mtimeMs = fs_1.default.statSync(constants_1.default.paths.HOST_PASSWORDS_FILE).mtimeMs;
+    }
+    catch {
+        cache = undefined;
+        return {};
+    }
+    if (!cache || cache.mtimeMs !== mtimeMs) {
+        let value = {};
+        try {
+            const data = JSON.parse(file_1.default.read("HOST_PASSWORDS_FILE") || "{}");
+            if (data && typeof data === "object")
+                value = data;
+        }
+        catch { }
+        cache = { mtimeMs, value };
+    }
+    return cache.value;
+};
+const writeAll = (all) => {
+    file_1.default.writeAtomic("HOST_PASSWORDS_FILE", JSON.stringify(all, null, 2));
+    fs_1.default.chmodSync(constants_1.default.paths.HOST_PASSWORDS_FILE, 0o600);
+    cache = undefined;
+};
+const failures = new Map();
+const FAIL_WINDOW_MS = 5 * 60000;
+const MAX_FAILURES = 10;
+const parseScopes = (value) => {
+    const list = Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : [];
+    const scopes = [...new Set(list.map((item) => String(item).trim().toLowerCase()).filter(Boolean))];
+    const bad = scopes.find((scope) => !exports.SCOPES.includes(scope));
+    if (bad)
+        throw new Error(`"${bad}" isn't a place to ask for the password; use shared, remote or local.`);
+    return exports.SCOPES.filter((scope) => scopes.includes(scope));
+};
+exports.parseScopes = parseScopes;
+class HostAuth {
+    static has(host) {
+        return Boolean(readAll()[host]);
+    }
+    static updatedAt(host) {
+        return readAll()[host]?.updatedAt;
+    }
+    static set(host, password) {
+        if (typeof password !== "string" || password.length < exports.MIN_HOST_PASSWORD) {
+            throw new Error(`The password must be at least ${exports.MIN_HOST_PASSWORD} characters.`);
+        }
+        const salt = crypto_1.default.randomBytes(16).toString("base64");
+        const entry = { salt, hash: hashOf(password, salt), secret: crypto_1.default.randomBytes(32).toString("base64"), updatedAt: new Date().toISOString() };
+        writeAll({ ...readAll(), [host]: entry });
+    }
+    static clear(host) {
+        const all = { ...readAll() };
+        if (!all[host])
+            return;
+        delete all[host];
+        writeAll(all);
+    }
+    static verify(host, password) {
+        const data = readAll()[host];
+        if (!data || typeof password !== "string" || !password)
+            return false;
+        return safeEqual(hashOf(password, data.salt), data.hash);
+    }
+    /** `<expiry>.<mac>`, bound to the host; nothing is kept server-side. */
+    static issue(host, now = Date.now()) {
+        const data = readAll()[host];
+        if (!data)
+            throw new Error(`${host} has no password.`);
+        const exp = String(Math.floor(now / 1000) + exports.HOST_SESSION_TTL_SEC);
+        return `${exp}.${sign(data.secret, `${host}|${exp}`)}`;
+    }
+    static validSession(host, value, now = Date.now()) {
+        const data = readAll()[host];
+        if (!data || !value)
+            return false;
+        const [exp, mac] = value.split(".");
+        if (!/^\d+$/.test(exp || "") || !mac || Number(exp) * 1000 < now)
+            return false;
+        return safeEqual(mac, sign(data.secret, `${host}|${exp}`));
+    }
+    static limited(key, now = Date.now()) {
+        const entry = failures.get(key);
+        if (!entry || now - entry.since > FAIL_WINDOW_MS)
+            return false;
+        return entry.count >= MAX_FAILURES;
+    }
+    static fail(key, now = Date.now()) {
+        const entry = failures.get(key);
+        if (!entry || now - entry.since > FAIL_WINDOW_MS)
+            failures.set(key, { count: 1, since: now });
+        else
+            entry.count++;
+    }
+    static succeed(key) {
+        failures.delete(key);
+    }
+}
+exports.default = HostAuth;

package/dist/lib/hosts.js

@@ -42,6 +42,7 @@ const localhost_1 = __importStar(require("./localhost"));
 const registry_1 = __importDefault(require("./registry"));
 const allow_1 = require("./allow");
 const hub_config_1 = __importDefault(require("./hub-config"));
+const host_auth_1 = __importStar(require("./host-auth"));
 class NotFoundError extends localhost_1.InputError {
 }
 exports.NotFoundError = NotFoundError;
@@ -141,6 +142,57 @@ class HostOps {
         });
         return { host, entry };
     }
+    /**
+     * Password protection: `scopes` picks where it's asked for (at least one). `password` is needed the first time;
+     * leaving it out keeps the current one. `off` removes the protection and the password.
+     */
+    static async setProtect(input) {
+        const host = localhost_1.default.requireHost(input.host);
+        const existing = registry_1.default.read().hosts[host];
+        if (!existing)
+            throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+        if (existing.remote)
+            throw new localhost_1.InputError(`❌ ${host} is a remote's mapping; protect it on that machine.`);
+        if (input.off) {
+            const entry = await registry_1.default.mutate((registry) => {
+                const current = registry.hosts[host];
+                if (!current)
+                    throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+                registry.hosts[host] = { ...current, protect: undefined, updatedAt: new Date().toISOString() };
+                return registry.hosts[host];
+            });
+            host_auth_1.default.clear(host);
+            return { host, entry };
+        }
+        let scopes;
+        try {
+            scopes = (0, host_auth_1.parseScopes)(input.scopes);
+        }
+        catch (error) {
+            throw new localhost_1.InputError(`❌ ${error.message}`);
+        }
+        if (!scopes.length)
+            throw new localhost_1.InputError("❌ Pick at least one place to ask for the password: shared, remote or local.");
+        const password = input.password === undefined || input.password === null || input.password === "" ? undefined : input.password;
+        if (password === undefined && !host_auth_1.default.has(host))
+            throw new localhost_1.InputError(`❌ Set a password to protect ${host}.`);
+        if (password !== undefined) {
+            try {
+                host_auth_1.default.set(host, String(password));
+            }
+            catch (error) {
+                throw new localhost_1.InputError(`❌ ${error.message}`);
+            }
+        }
+        const entry = await registry_1.default.mutate((registry) => {
+            const current = registry.hosts[host];
+            if (!current)
+                throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+            registry.hosts[host] = { ...current, protect: { scopes }, updatedAt: new Date().toISOString() };
+            return registry.hosts[host];
+        });
+        return { host, entry };
+    }
     static async remove(input) {
         const host = localhost_1.default.requireHost(input.host);
         await registry_1.default.mutate((registry) => {
@@ -148,6 +200,7 @@ class HostOps {
                 throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
             delete registry.hosts[host];
         });
+        host_auth_1.default.clear(host);
         return { host };
     }
 }

package/dist/proxy/cloudflare-logins.js

@@ -0,0 +1,197 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCapture = exports.loggedInZones = exports.covers = void 0;
+exports.setupDomainTunnel = setupDomainTunnel;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const constants_1 = __importDefault(require("../constants"));
+const logger_1 = __importDefault(require("../utils/logger"));
+const tunnel_1 = require("./tunnel");
+/**
+ * Cloudflare logins for custom-domain sharing. `cloudflared tunnel login` authorizes a single zone,
+ * so each login is kept as <state>/cloudflare/<zone>.pem and the one whose zone covers a hostname
+ * is used; ~/.cloudflared/cert.pem counts as one but is never written. A cert's zone is looked up
+ * with the API token inside it.
+ */
+const DIR = path_1.default.join(constants_1.default.paths.HOME, "cloudflare");
+const ZONES_FILE = path_1.default.join(DIR, "zones.json");
+const LOGIN_WAIT_MS = 10 * 60000;
+const API = () => process.env.LOCADOT_CLOUDFLARE_API || "https://api.cloudflare.com/client/v4";
+const defaultCert = () => path_1.default.join(os_1.default.homedir(), ".cloudflared", "cert.pem");
+const readToken = (file) => {
+    try {
+        const body = fs_1.default.readFileSync(file, "utf8").match(/-----BEGIN ARGO TUNNEL TOKEN-----([\s\S]*?)-----END/)?.[1];
+        const token = body && JSON.parse(Buffer.from(body.replace(/\s/g, ""), "base64").toString("utf8"));
+        return token?.zoneID ? token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/** zoneID → zone name, learned from the API or from where cloudflared put a DNS record. */
+const readZones = () => {
+    try {
+        return JSON.parse(fs_1.default.readFileSync(ZONES_FILE, "utf8"));
+    }
+    catch {
+        return {};
+    }
+};
+const rememberZone = (zoneID, zone) => {
+    fs_1.default.mkdirSync(DIR, { recursive: true });
+    fs_1.default.writeFileSync(ZONES_FILE, JSON.stringify({ ...readZones(), [zoneID]: zone }, null, 2));
+};
+const certFiles = () => {
+    const stored = fs_1.default.existsSync(DIR) ? fs_1.default.readdirSync(DIR).filter((f) => f.endsWith(".pem")).map((f) => path_1.default.join(DIR, f)) : [];
+    return [defaultCert(), ...stored].filter((file) => fs_1.default.existsSync(file));
+};
+const covers = (zone, hostname) => hostname === zone || hostname.endsWith(`.${zone}`);
+exports.covers = covers;
+/** Zones there's a login for, as far as they're known (no network). */
+const loggedInZones = () => {
+    const zones = readZones();
+    return [...new Set(certFiles().map((file) => zones[readToken(file)?.zoneID || ""]).filter(Boolean))].sort();
+};
+exports.loggedInZones = loggedInZones;
+const zoneOf = async (file) => {
+    const token = readToken(file);
+    if (!token)
+        return undefined;
+    const known = readZones()[token.zoneID];
+    if (known)
+        return known;
+    try {
+        const res = await fetch(`${API()}/zones/${token.zoneID}`, {
+            headers: { Authorization: `Bearer ${token.apiToken}` },
+            signal: AbortSignal.timeout(10000),
+        });
+        const name = (await res.json())?.result?.name;
+        if (res.ok && typeof name === "string") {
+            rememberZone(token.zoneID, name);
+            return name;
+        }
+        logger_1.default.warn(`🌍 couldn't look up the zone of a Cloudflare login: HTTP ${res.status}`);
+    }
+    catch (error) {
+        logger_1.default.warn(`🌍 couldn't look up the zone of a Cloudflare login: ${error?.cause?.message || error?.message || error}`);
+    }
+    return undefined;
+};
+const runCapture = (file, args, opts = {}) => new Promise((resolve, reject) => {
+    const child = (0, child_process_1.spawn)(file, args, { stdio: ["ignore", "pipe", "pipe"], windowsHide: true, env: opts.env, signal: opts.signal });
+    let output = "";
+    let done = false;
+    const finish = (fn) => {
+        if (done)
+            return;
+        done = true;
+        if (timer)
+            clearTimeout(timer);
+        fn();
+    };
+    const timer = opts.timeoutMs
+        ? setTimeout(() => finish(() => (child.kill(), reject(new Error(`${args.join(" ")} timed out`)))), opts.timeoutMs)
+        : undefined;
+    const read = (chunk) => {
+        const text = chunk.toString("utf8");
+        output += text;
+        opts.onData?.(text);
+    };
+    child.stdout?.on("data", read);
+    child.stderr?.on("data", read);
+    child.on("error", (error) => finish(() => reject(error)));
+    child.on("exit", (code) => finish(() => resolve({ code, output })));
+});
+exports.runCapture = runCapture;
+/** Runs `cloudflared tunnel login` against a scratch home so the new cert never replaces an existing one. */
+const signIn = async (file, onLoginUrl, signal) => {
+    const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "locadot-cf-login-"));
+    try {
+        let announced = false;
+        const login = await (0, exports.runCapture)(file, ["tunnel", "login"], {
+            timeoutMs: LOGIN_WAIT_MS,
+            signal,
+            env: { ...process.env, HOME: home, USERPROFILE: home },
+            onData: (text) => {
+                const url = !announced && text.match(/https:\/\/\S+/)?.[0];
+                if (url) {
+                    announced = true;
+                    onLoginUrl(url);
+                }
+            },
+        }).catch((error) => {
+            throw new Error(/timed out/.test(error.message) ? "The Cloudflare sign-in wasn't finished within 10 minutes." : error.message);
+        });
+        const cert = path_1.default.join(home, ".cloudflared", "cert.pem");
+        const token = readToken(cert);
+        if (login.code !== 0 || !token)
+            throw new Error(`Cloudflare sign-in failed: ${login.output.trim().slice(-300) || `cloudflared exited (${login.code})`}`);
+        fs_1.default.mkdirSync(DIR, { recursive: true });
+        const staged = path_1.default.join(DIR, `${token.zoneID}.pem`);
+        fs_1.default.copyFileSync(cert, staged);
+        fs_1.default.chmodSync(staged, 0o600);
+        const zone = await zoneOf(staged);
+        if (!zone)
+            return staged;
+        const named = path_1.default.join(DIR, `${zone}.pem`);
+        fs_1.default.renameSync(staged, named);
+        return named;
+    }
+    finally {
+        fs_1.default.rmSync(home, { recursive: true, force: true });
+    }
+};
+const notAuthorized = (domain, zone) => new Error(`Your Cloudflare sign-in authorized ${zone}, which doesn't include ${domain}. Share again and pick the zone ${domain} belongs to, or add that domain to your Cloudflare account first.`);
+/**
+ * Makes `name` a named tunnel serving `domain`: uses the login whose zone covers it, or signs in
+ * (reporting the URL through onLoginUrl), creates the tunnel and routes the DNS record.
+ * Throws a readable error when no login covers the domain.
+ */
+async function setupDomainTunnel(domain, name, onLoginUrl, signal) {
+    const file = (0, tunnel_1.cloudflaredPath)();
+    if (!file)
+        throw new Error("cloudflared is not installed. Run `locadot tunnel:install`.");
+    let cert;
+    const unknown = [];
+    for (const candidate of certFiles()) {
+        const zone = await zoneOf(candidate);
+        if (zone && (0, exports.covers)(zone, domain)) {
+            cert = candidate;
+            break;
+        }
+        if (!zone)
+            unknown.push(candidate);
+    }
+    // A login whose zone couldn't be looked up is tried; route dns shows which zone it's for.
+    cert || (cert = unknown[0]);
+    if (!cert) {
+        cert = await signIn(file, onLoginUrl, signal);
+        const zone = await zoneOf(cert);
+        if (zone && !(0, exports.covers)(zone, domain))
+            throw notAuthorized(domain, zone);
+    }
+    const token = readToken(cert);
+    const credentials = path_1.default.join(DIR, "tunnels", token.accountID, `${name}.json`);
+    fs_1.default.mkdirSync(path_1.default.dirname(credentials), { recursive: true });
+    const create = await (0, exports.runCapture)(file, ["tunnel", "--origincert", cert, "create", "--credentials-file", credentials, name], { signal });
+    if (create.code !== 0 && !/already exists/i.test(create.output)) {
+        throw new Error(`cloudflared tunnel create failed: ${create.output.trim().slice(-500)}`);
+    }
+    const route = await (0, exports.runCapture)(file, ["tunnel", "--origincert", cert, "route", "dns", "--overwrite-dns", name, domain], { signal });
+    if (route.code !== 0)
+        throw new Error(`cloudflared tunnel route dns failed: ${route.output.trim().slice(-500)}`);
+    // Outside the login's zone, cloudflared appends the zone and "succeeds" with <domain>.<zone>.
+    const routed = route.output.match(/Added CNAME (\S+)/i)?.[1] || route.output.match(/(\S+) is already configured to route/i)?.[1];
+    if (routed && routed.toLowerCase().replace(/\.$/, "") !== domain) {
+        const zone = routed.toLowerCase().startsWith(`${domain}.`) ? routed.slice(domain.length + 1) : undefined;
+        if (zone)
+            rememberZone(token.zoneID, zone);
+        throw new Error(`${domain} isn't in the Cloudflare zone this login is for${zone ? ` (${zone})` : ""}; cloudflared created ${routed} instead. Delete that record in Cloudflare, then share again to sign in for ${domain}'s zone.`);
+    }
+    return { cert, credentials: fs_1.default.existsSync(credentials) ? credentials : undefined };
+}

package/dist/proxy/protect.js

@@ -0,0 +1,215 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scopeOf = exports.LOGIN_PATH = void 0;
+exports.guard = guard;
+exports.guardUpgrade = guardUpgrade;
+const crypto_1 = __importDefault(require("crypto"));
+const logger_1 = __importDefault(require("../utils/logger"));
+const escape_1 = require("../dashboard/escape");
+const host_auth_1 = __importStar(require("../lib/host-auth"));
+const ui_auth_1 = require("../lib/ui-auth");
+const passthrough_1 = require("./passthrough");
+const request_1 = require("./request");
+const hub_1 = require("./hub");
+/**
+ * Password protection for a mapping (`protect`), on the paths in it was picked for. Visitors get a sign-in page and,
+ * with the password, a cookie signed for that host; the cookie is taken off before the request goes upstream.
+ */
+exports.LOGIN_PATH = `${passthrough_1.PREFIX}login`;
+const MAX_BODY = 4096;
+const scopeOf = (req) => ((0, request_1.fromTunnel)(req) ? "shared" : (0, request_1.fromRemote)(req) ? "remote" : "local");
+exports.scopeOf = scopeOf;
+const protectedHere = (req, entry) => Boolean(entry.protect?.scopes.includes((0, exports.scopeOf)(req)));
+const signedIn = (req, host) => host_auth_1.default.validSession(host, (0, ui_auth_1.cookieOf)(req.headers.cookie, host_auth_1.HOST_COOKIE));
+const stripCookie = (req) => {
+    const header = req.headers.cookie;
+    if (!header)
+        return;
+    const rest = header.split(";").filter((part) => part.split("=")[0].trim() !== host_auth_1.HOST_COOKIE).join(";").trim();
+    if (rest)
+        req.headers.cookie = rest;
+    else
+        delete req.headers.cookie;
+};
+// Visitors on a tunnel or remote access all arrive from cloudflared, so count their failures by their own IP.
+const limitKey = (req, host) => `${host}|${(0, exports.scopeOf)(req) === "local" ? req.socket.remoteAddress || "" : (0, hub_1.clientIp)(req)}`;
+/** A path on this site to go back to after signing in; anything else goes to /. */
+const safeNext = (value) => (typeof value === "string" && /^\/(?![/\\])/.test(value) ? value : "/");
+const shownHost = (req) => (req.headers.host || "").replace(/:\d+$/, "") || "this site";
+const page = (nonce, host, next, error) => `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="dark light">
+<meta name="robots" content="noindex">
+<title>Password required · ${(0, escape_1.escapeHtml)(host)}</title>
+<style nonce="${nonce}">
+:root { --bg: #f6f7f9; --surface: #fff; --border: #e3e6eb; --fg: #111827; --muted: #6b7280; --accent: #2563eb; --accent-bg: #eff4ff; --down: #dc2626; --down-bg: #fef2f2; }
+@media (prefers-color-scheme: dark) { :root { --bg: #0d1117; --surface: #161b22; --border: #30363d; --fg: #e6edf3; --muted: #8b949e; --accent: #3b82f6; --accent-bg: #172554; --down: #f87171; --down-bg: #2a1215; } }
+* { box-sizing: border-box; }
+body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 16px; background: var(--bg); color: var(--fg); font: 14px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
+form { width: 100%; max-width: 360px; background: var(--surface); border: 1px solid var(--border); border-radius: 14px; padding: 32px 28px 24px; display: flex; flex-direction: column; gap: 16px; box-shadow: 0 10px 30px rgba(0, 0, 0, 0.06); }
+.icon { width: 44px; height: 44px; border-radius: 12px; display: grid; place-items: center; background: var(--accent-bg); color: var(--accent); }
+.icon svg { width: 22px; height: 22px; fill: none; stroke: currentColor; stroke-width: 2; stroke-linecap: round; stroke-linejoin: round; }
+h1 { margin: 0; font-size: 18px; }
+p { margin: 0; color: var(--muted); }
+.host { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; color: var(--fg); overflow-wrap: anywhere; }
+label { display: block; font-weight: 600; font-size: 13px; margin-bottom: 6px; }
+input { width: 100%; padding: 10px 12px; border-radius: 8px; border: 1px solid var(--border); background: var(--bg); color: var(--fg); font: inherit; }
+input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px var(--accent-bg); }
+button { padding: 10px; border: 0; border-radius: 8px; background: var(--accent); color: #fff; font: inherit; font-weight: 600; cursor: pointer; }
+button:hover { filter: brightness(1.05); }
+.error { color: var(--down); background: var(--down-bg); border-radius: 8px; padding: 8px 10px; font-size: 13px; }
+.foot { font-size: 12px; text-align: center; }
+.sr { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); }
+</style>
+</head>
+<body>
+<form method="post" action="${exports.LOGIN_PATH}">
+  <div class="icon" aria-hidden="true"><svg viewBox="0 0 24 24"><rect x="5" y="11" width="14" height="10" rx="2"/><path d="M8 11V8a4 4 0 0 1 8 0v3"/></svg></div>
+  <div>
+    <h1>Password required</h1>
+    <p><span class="host">${(0, escape_1.escapeHtml)(host)}</span> is protected. Enter the password to continue.</p>
+  </div>
+  <input type="hidden" name="next" value="${(0, escape_1.escapeHtml)(next)}">
+  <input class="sr" type="text" name="username" value="${(0, escape_1.escapeHtml)(host)}" autocomplete="username" tabindex="-1" aria-hidden="true" readonly>
+  <div><label for="password">Password</label>
+  <input id="password" name="password" type="password" autocomplete="current-password" required autofocus></div>
+  ${error ? `<div class="error" role="alert">${(0, escape_1.escapeHtml)(error)}</div>` : ""}
+  <button type="submit">Continue</button>
+  <p class="foot">Protected by locadot</p>
+</form>
+</body>
+</html>
+`;
+const sendPage = (req, res, status, next, error) => {
+    const nonce = crypto_1.default.randomBytes(16).toString("base64");
+    res.writeHead(status, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Content-Security-Policy": `default-src 'none'; style-src 'nonce-${nonce}'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,
+        "X-Robots-Tag": "noindex",
+    });
+    res.end(req.method === "HEAD" ? undefined : page(nonce, shownHost(req), next, error));
+};
+const readForm = (req) => new Promise((resolve, reject) => {
+    let size = 0;
+    const chunks = [];
+    req.on("data", (chunk) => {
+        size += chunk.length;
+        if (size <= MAX_BODY)
+            chunks.push(chunk);
+    });
+    req.on("error", reject);
+    req.on("end", () => resolve(new URLSearchParams(size > MAX_BODY ? "" : Buffer.concat(chunks).toString("utf8"))));
+});
+// Tunnel visitors are on https even though cloudflared talks plain http to us.
+const cookie = (req, value) => `${host_auth_1.HOST_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${host_auth_1.HOST_SESSION_TTL_SEC}${(0, request_1.isTls)(req) || (0, request_1.fromTunnel)(req) ? "; Secure" : ""}`;
+function login(req, res, host, url) {
+    if (req.method === "GET" || req.method === "HEAD") {
+        sendPage(req, res, 200, safeNext(url.searchParams.get("next")));
+        return;
+    }
+    if (req.method !== "POST") {
+        res.writeHead(405, { Allow: "GET, POST" });
+        res.end();
+        return;
+    }
+    const site = req.headers["sec-fetch-site"];
+    if (site && site !== "same-origin" && site !== "none") {
+        sendPage(req, res, 403, "/", "Sign in from this site's own page.");
+        return;
+    }
+    const key = limitKey(req, host);
+    if (host_auth_1.default.limited(key)) {
+        sendPage(req, res, 429, "/", "Too many wrong passwords. Wait a few minutes and try again.");
+        return;
+    }
+    readForm(req)
+        .then((form) => {
+        const next = safeNext(form.get("next"));
+        if (!host_auth_1.default.verify(host, form.get("password"))) {
+            host_auth_1.default.fail(key);
+            logger_1.default.warn(`🔒 ${host}: wrong password from ${key.split("|")[1]}`);
+            return sendPage(req, res, 401, next, "Wrong password.");
+        }
+        host_auth_1.default.succeed(key);
+        res.writeHead(303, { Location: next, "Set-Cookie": cookie(req, host_auth_1.default.issue(host)), "Cache-Control": "no-store" });
+        res.end();
+    })
+        .catch(() => sendPage(req, res, 400, "/", "Couldn't read the form."));
+}
+/** Answers the request itself (sign-in page, 401) unless it may go through; returns whether it did. */
+function guard(req, res, host, entry) {
+    if (!protectedHere(req, entry))
+        return false;
+    const url = new URL(req.url || "/", "http://host.invalid");
+    if (!host_auth_1.default.has(host)) {
+        res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" });
+        res.end(`locadot: ${host} is password protected but has no password set. Set one: locadot protect --host ${host}\n`);
+        return true;
+    }
+    if (url.pathname === exports.LOGIN_PATH) {
+        login(req, res, host, url);
+        return true;
+    }
+    if (signedIn(req, host)) {
+        stripCookie(req);
+        return false;
+    }
+    const html = (req.method === "GET" || req.method === "HEAD") && /text\/html|\*\/\*/.test(String(req.headers.accept || ""));
+    if (html) {
+        sendPage(req, res, 401, safeNext(req.url));
+        return true;
+    }
+    res.writeHead(401, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" });
+    res.end(`locadot: ${shownHost(req)} is password protected. Open it in a browser to sign in.\n`);
+    return true;
+}
+function guardUpgrade(req, socket, host, entry) {
+    if (!protectedHere(req, entry))
+        return false;
+    if (host_auth_1.default.has(host) && signedIn(req, host)) {
+        stripCookie(req);
+        return false;
+    }
+    socket.end("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+    return true;
+}

package/dist/proxy/router.js

@@ -19,6 +19,7 @@ const allow_1 = require("../lib/allow");
 const passthrough_1 = require("./passthrough");
 const request_1 = require("./request");
 const stats_1 = require("./stats");
+const protect_1 = require("./protect");
 // Cloudflare swaps an origin's 502/504 for its own "bad gateway" page, so through a tunnel say 503 and the page survives.
 const downStatus = (req) => ((0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req) ? 503 : 502);
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
@@ -152,6 +153,8 @@ function handleRequest(req, res, ctx) {
             res.end(passthrough_1.shimScript);
             return;
         }
+        if ((0, protect_1.guard)(req, res, host, entry))
+            return;
         const via = passThrough(req, entry) ? (0, passthrough_1.parseVia)(req.url) : undefined;
         const allowed = via && listed(req, ctx, entry, via);
         if (via && !viaAllowed(req, via, allowed)) {
@@ -270,6 +273,8 @@ function handleUpgrade(req, socket, head, ctx) {
             });
             return;
         }
+        if ((0, protect_1.guardUpgrade)(req, socket, host, entry))
+            return;
         const via = passThrough(req, entry) ? (0, passthrough_1.parseVia)(req.url) : undefined;
         const allowed = via && listed(req, ctx, entry, via);
         if (via && !viaAllowed(req, via, allowed)) {