locadot 2.4.0 → 2.6.0

package/dist/index.js

@@ -38,6 +38,7 @@ const destinationOptions = (command) => command
     .option("-k, --insecure", "Don't verify the TLS certificate of an https target")
     .option("--cors", "Send Origin/Referer as the target's own and let any origin call this domain")
     .option("--no-cors", "Turn --cors off again (update)")
+    .option("--https-redirect <mode>", "Send plain http to https: on, off, or default (follow `locadot https:redirect`)")
     .option("--no-start", "Only save the mapping; don't start the proxy");
 program
     .name("locadot")
@@ -106,6 +107,10 @@ const portOptions = (command) => command
 portOptions(program.command("start").description("Start the central proxy")).action(run((options) => commands_1.default.start(options)));
 program.command("stop").description("Stop the central proxy (keeps hosts and logs)").action(run(() => commands_1.default.stop()));
 portOptions(program.command("restart").description("Restart the central proxy")).action(run((options) => commands_1.default.restart(options)));
+program
+    .command("https:redirect [onOrOff]")
+    .description("Redirect plain http to https for every domain and the dashboard (on/off); shows the setting without an argument")
+    .action(run((value) => commands_1.default.httpsRedirect(value)));
 program.command("kill").description("Stop the proxy, remove all hosts and clear logs").action(run(() => commands_1.default.kill()));
 program.command("trust").description("Install the locadot CA in the system trust store (sudo)").action(run(() => commands_1.default.trust()));
 program.command("untrust").description("Remove the locadot CA from the system trust store (sudo)").action(run(() => commands_1.default.untrust()));

package/dist/lib/config.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const constants_1 = __importDefault(require("../constants"));
+const file_1 = __importDefault(require("../utils/file"));
+let cached;
+class ConfigStore {
+    /** The file as-is, tolerating a missing or corrupt one. */
+    static read() {
+        try {
+            const raw = JSON.parse(fs_1.default.readFileSync(constants_1.default.paths.CONFIG_FILE, "utf8"));
+            return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+        }
+        catch {
+            return {};
+        }
+    }
+    /** Merges into the file, so saving the ports keeps the other settings and the other way round. */
+    static write(patch) {
+        file_1.default.ensureDir();
+        const next = { ...ConfigStore.read(), ...patch };
+        for (const key of Object.keys(next))
+            if (next[key] === undefined)
+                delete next[key];
+        fs_1.default.writeFileSync(constants_1.default.paths.CONFIG_FILE, JSON.stringify(next, null, 2) + "\n");
+        cached = undefined;
+    }
+    /** For the request path: re-reads only when the file changed. */
+    static readCached() {
+        let mtimeMs = -1;
+        try {
+            mtimeMs = fs_1.default.statSync(constants_1.default.paths.CONFIG_FILE).mtimeMs;
+        }
+        catch { }
+        if (cached?.mtimeMs !== mtimeMs)
+            cached = { mtimeMs, config: mtimeMs < 0 ? {} : ConfigStore.read() };
+        return cached.config;
+    }
+    static httpsRedirect() {
+        return ConfigStore.readCached().httpsRedirect === true;
+    }
+}
+exports.default = ConfigStore;

package/dist/lib/hosts.js

@@ -79,7 +79,7 @@ class HostOps {
             if (existing) {
                 throw new ConflictError(`❌ ${host} is already mapped to ${existing.target}. Use \`locadot update --host ${host} ...\` instead.`);
             }
-            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, allow: allow.length ? allow : undefined, createdAt: now, updatedAt: now };
+            registry.hosts[host] = { target, insecure: input.insecure || undefined, cors: input.cors || undefined, allow: allow.length ? allow : undefined, httpsRedirect: input.httpsRedirect ?? undefined, createdAt: now, updatedAt: now };
             return registry.hosts[host];
         });
         return { host, entry };
@@ -101,12 +101,24 @@ class HostOps {
                 insecure: insecure || undefined,
                 cors: cors || undefined,
                 allow: list?.length ? list : undefined,
+                httpsRedirect: input.httpsRedirect === undefined ? existing.httpsRedirect : input.httpsRedirect ?? undefined,
                 updatedAt: new Date().toISOString(),
             };
             return registry.hosts[host];
         });
         return { host, entry };
     }
+    static async setHttpsRedirect(input) {
+        const host = localhost_1.default.requireHost(input.host);
+        const entry = await registry_1.default.mutate((registry) => {
+            const existing = registry.hosts[host];
+            if (!existing)
+                throw new NotFoundError(`${constants_1.default.proxyInfo.hostNotFound} (${host})`);
+            registry.hosts[host] = { ...existing, httpsRedirect: input.httpsRedirect ?? undefined, updatedAt: new Date().toISOString() };
+            return registry.hosts[host];
+        });
+        return { host, entry };
+    }
     /** Sharing on: `domain` shares on that hostname, none on a random trycloudflare.com URL. Sharing off keeps the hostname for next time. */
     static async setTunnel(input) {
         const host = localhost_1.default.requireHost(input.host);

package/dist/proxy/https-redirect.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redirectToHttps = exports.wantsHttps = void 0;
+const net_1 = __importDefault(require("net"));
+const constants_1 = __importDefault(require("../constants"));
+const urls_1 = require("../lib/urls");
+const request_1 = require("./request");
+/** The CLI and scripts talk to the dashboard's API and health check over plain http. */
+const dashboardExempt = (url) => {
+    const path = url.split("?")[0];
+    return path === "/healthz" || path === "/api" || path.startsWith("/api/");
+};
+/** Whether this request should be sent to https: the mapping's own choice, else the global setting. */
+const wantsHttps = (req, ctx, host, hub) => {
+    // Tunnels, the hub and peers reach the http port on purpose and are already https on their public side.
+    if ((0, request_1.isTls)(req) || (hub && hub.kind !== "none") || (0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req))
+        return false;
+    if (req.headers["cf-ray"] || req.headers["cf-connecting-ip"] || req.headers["cdn-loop"])
+        return false;
+    const global = ctx.httpsRedirect?.() === true;
+    if (constants_1.default.dashboardHosts.includes(host))
+        return global && !dashboardExempt(req.url || "/");
+    const entry = ctx.lookup(host);
+    if (entry)
+        return entry.httpsRedirect ?? global;
+    return global && Boolean(ctx.localFor?.(host));
+};
+exports.wantsHttps = wantsHttps;
+/** 307 keeps the method and body, and isn't cached, so turning the setting off takes effect straight away. */
+const redirectToHttps = (req, res, ctx) => {
+    const name = (0, request_1.hostOf)(req);
+    const origin = (0, urls_1.formatUrl)(net_1.default.isIPv6(name) ? `[${name}]` : name, true, ctx.httpsPort?.() ?? constants_1.default.server.httpsPort);
+    const path = req.url?.startsWith("/") ? req.url : "/";
+    res.writeHead(307, { Location: origin + path, "Cache-Control": "no-store", "Content-Type": "text/plain; charset=utf-8" });
+    res.end(`Redirecting to ${origin}${path}\n`);
+};
+exports.redirectToHttps = redirectToHttps;

package/dist/proxy/router.js

@@ -20,6 +20,7 @@ const passthrough_1 = require("./passthrough");
 const request_1 = require("./request");
 const stats_1 = require("./stats");
 const protect_1 = require("./protect");
+const https_redirect_1 = require("./https-redirect");
 // Cloudflare swaps an origin's 502/504 for its own "bad gateway" page, so through a tunnel say 503 and the page survives.
 const downStatus = (req) => ((0, request_1.fromTunnel)(req) || (0, request_1.fromRemote)(req) ? 503 : 502);
 /** Resolves a tunnel's public host to its mapping and tags the request, before any routing. */
@@ -123,6 +124,10 @@ function handleRequest(req, res, ctx) {
     }
     const host = resolveHost(req, ctx, hub);
     try {
+        if ((0, https_redirect_1.wantsHttps)(req, ctx, host, hub)) {
+            (0, https_redirect_1.redirectToHttps)(req, res, ctx);
+            return;
+        }
         if (constants_1.default.dashboardHosts.includes(host)) {
             ctx.dashboard(req, res);
             return;

package/dist/server/index.js

@@ -17,6 +17,7 @@ const hub_tunnel_1 = require("../proxy/hub-tunnel");
 const hub_1 = require("../proxy/hub");
 const remote_1 = require("../proxy/remote");
 const hub_config_1 = __importDefault(require("../lib/hub-config"));
+const config_1 = __importDefault(require("../lib/config"));
 const file_1 = __importDefault(require("../utils/file"));
 const logger_1 = __importDefault(require("../utils/logger"));
 const certs_1 = require("../utils/certs");
@@ -68,6 +69,8 @@ async function startCentralProxy() {
         lookup: (host) => registry.get().hosts[tunnels.hostFor(host) ?? host],
         tunnelFor: (host) => tunnels.hostFor(host),
         ownPorts: () => [info.httpPort, info.httpsPort],
+        httpsRedirect: () => config_1.default.httpsRedirect(),
+        httpsPort: () => info.httpsPort,
         remoteFor: remote_1.remoteFor,
         localFor: remote_1.localFor,
         remoteHosts: (name) => Object.entries(registry.get().hosts)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",