magpie-page-token-widget 0.2.0 → 0.3.3

package/lib/server.mjs

@@ -10,7 +10,8 @@ import {
   ensureState, notePairing, rotatePairing, writeState, pairingUsable,
   addDevice, verifyToken, noteAccess, revokeDevice, renameDevice, deviceList, newToken, hashToken,
 } from './state.mjs';
-import { detect, interfaces, lanCandidates, ping } from './tailnet.mjs';
+import { bindCandidates, detect, interfaces, lanCandidates, ping } from './tailnet.mjs';
+import { checkExternalURL, checkGatewayURL } from './network.mjs';
 import { applyForward, publishedFor, removeForward, serveState, forwardRecord } from './forward.mjs';
 import { dataUri } from './qr.mjs';
 
@@ -22,6 +23,26 @@ const LOCAL_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);
 // Ten wrong codes from one computer, and then the door is shut for five
 // minutes. The record of the attempts is short and is cleaned up.
 const PAIR_ATTEMPTS = 10;
+// The address the phone is told to use. The user may have a network of
+// his own (a Headscale of his own, a server of his own, a tunnel of his own),
+// and then this address is the one the phone goes to.
+//
+// The rules for such an address live in lib/network.mjs, and the installer
+// of the phone keeps the same rules: over plain HTTP only a network of the
+// user is accepted, over HTTPS any name is. The address is never resolved,
+// so a name that points somewhere else later cannot sneak past the check.
+const externalOf = (value) => {
+  const checked = checkExternalURL(value);
+  if (!checked.ok || checked.empty) return { name: '', port: 0, origin: '', secure: false };
+  return { name: checked.name, port: checked.port, origin: checked.origin, secure: checked.secure };
+};
+// The address the phone side listens on. It has to be an address of this
+// computer: the service does not listen just anywhere.
+const normalizeListenAddress = (value, candidates) => {
+  const text = String(value || '').trim();
+  if (!text) return '';
+  return candidates.some((entry) => entry.address === text) ? text : null;
+};
 // The page of the pairing code is opened more often than the door itself: a
 // phone that scans a code that has gone stale comes back here. It may be
 // tried more often before the door is shut.
@@ -129,11 +150,11 @@ const hostOf = (request) => {
   const raw = String(request.headers.host || '').trim().toLowerCase();
   if (raw.startsWith('[')) {
     const end = raw.indexOf(']');
-    return { name: raw.slice(1, end), port: Number(raw.slice(end + 2)) || 0 };
+    return { raw, name: raw.slice(1, end), port: Number(raw.slice(end + 2)) || 0 };
   }
   const index = raw.lastIndexOf(':');
-  if (index === -1) return { name: raw, port: 0 };
-  return { name: raw.slice(0, index), port: Number(raw.slice(index + 1)) || 0 };
+  if (index === -1) return { raw, name: raw, port: 0 };
+  return { raw, name: raw.slice(0, index), port: Number(raw.slice(index + 1)) || 0 };
 };
 
 const jsonBody = async (request) => {
@@ -159,11 +180,41 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
   // on a different socket than the console of this computer. The scope of a
   // request follows the socket it came in on, not the Host header it carries.
   const phonePort = Number(options.phonePort ?? port + 1);
-  const upstream = options.gatewayURL || 'http://127.0.0.1:3425';
+  // The gateway of Magpie that this plugin reads. It is Magpie itself, on
+  // this computer. An address that is not a loopback address is refused
+  // with a clear reason, and nothing is asked of it: a wrong address would
+  // only make the service send requests somewhere it should not.
+  const gateway = checkGatewayURL(options.gatewayURL);
+  const upstream = gateway.ok ? gateway.url : '';
+  const gatewayError = gateway.ok ? '' : gateway.error;
   const stateFile = path.join(dataDir, 'state.json');
   const snapshotFile = path.join(dataDir, 'snapshot.json');
 
   const { state } = await ensureState(stateFile);
+  // The address the phone is told to use, and the address the phone side
+  // listens on when the user has a network of his own.
+  let listenAddress = normalizeListenAddress(state.settings?.listenAddress, bindCandidates()) || '';
+  let extraListener = null;
+  let listenError = '';
+  if (state.settings?.listenAddress && !listenAddress) {
+    // The address of the last time is gone; the network of the office moved.
+    // It is not kept in the file any more.
+    delete state.settings.listenAddress;
+    await writeState(stateFile, state).catch(() => {});
+  }
+  // The address the phone is told to use. An address that the rules of
+  // lib/network.mjs refuse is not used: it is taken out of the file, and the
+  // console says why. The tailnet is the way in until the user writes an
+  // address that is good.
+  const storedExternal = checkExternalURL(state.settings?.externalURL);
+  let externalURL = storedExternal.ok && !storedExternal.empty ? storedExternal.url : '';
+  let external = externalOf(externalURL);
+  let externalError = '';
+  if (!storedExternal.ok && state.settings?.externalURL) {
+    externalError = `之前的地址「${state.settings.externalURL}」不能用了：${storedExternal.error}`;
+    delete state.settings.externalURL;
+    await writeState(stateFile, state).catch(() => {});
+  }
   // The temporary files of a run that was killed stay behind; they are litter
   // and nothing ever reads them.
   await sweepTemporaries(stateFile);
@@ -173,14 +224,20 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
   // is never touched while the tests run.
   const runner = options.tailscaleRunner || null;
   const collector = new Collector({
-    upstream,
+    // A gateway that was refused is never asked. The address below is one
+    // that answers nobody: it is here so that the collector always has
+    // something to work with, and it is never used for a reading.
+    upstream: upstream || 'http://127.0.0.1:1',
+    enabled: gateway.ok,
     magpieDir,
     snapshotFile,
     display: displayOptions({ ...state.settings, ...pluginSettings }),
     strategy: refreshStrategy(state.settings?.refreshStrategy),
   });
   await collector.load();
-  void collector.refresh();
+  // A gateway that was refused is never asked: nothing is sent to an address
+  // the user did not mean.
+  if (gateway.ok) void collector.refresh();
 
   let tailnet = {
     installed: false,
@@ -202,7 +259,9 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
   let consoleOpen = false;
   let phoneBound = false;
 
-  const serviceURL = () => (tailnet.tailnetIP ? `http://${tailnet.tailnetIP}:${port}` : '');
+  // The address the phone is told to use. When the user has an address of
+  // his own, that one is used; otherwise the address of the tailnet.
+  const serviceURL = () => externalURL || (tailnet.tailnetIP ? `http://${tailnet.tailnetIP}:${port}` : '');
   const pairingURL = () => (serviceURL() ? `${serviceURL()}/p/${state.pairing.code}` : '');
   // How long the pairing code is still good. The code is good for ten
   // minutes, and it is good only once.
@@ -214,14 +273,52 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
 
   // The Host header is only a guard against a name that points at this
   // computer by accident. It says nothing about who is asking.
-  const allowedHosts = (host) => {
-    if (host.port !== port) return false;
-    if (LOCAL_HOSTS.has(host.name)) return true;
-    if (tailnet.tailnetIP && host.name === tailnet.tailnetIP.toLowerCase()) return true;
-    if (tailnet.dnsName && host.name === tailnet.dnsName.toLowerCase()) return true;
+  // The phone side may be reached under the address the user gave, so that
+  // name and that port belong to it. The console side keeps the port of the
+  // plugin, and never the port of the phone.
+  const allowedHosts = (host, scope) => {
+    const name = host.name.toLowerCase();
+    // The name the user gave: the phone may come under it, with the port of
+    // the address or with the port it really arrives at (a proxy of his own
+    // may sit in front). The console keeps to the port of the plugin.
+    if (external.name && name === external.name) {
+      return scope === 'phone' || host.port === port;
+    }
+    if (scope === 'console') {
+      return host.port === port && LOCAL_HOSTS.has(name);
+    }
+    if (host.port !== port && host.port !== phonePort) return false;
+    if (LOCAL_HOSTS.has(name)) return true;
+    if (tailnet.tailnetIP && name === tailnet.tailnetIP.toLowerCase()) return true;
+    if (tailnet.dnsName && name === tailnet.dnsName.toLowerCase()) return true;
+    if (listenAddress && name === listenAddress.toLowerCase()) return true;
     return false;
   };
 
+  // The origin of a request is the page it comes from. Only the origins that
+  // belong to this service are let in.
+  //
+  // The address the user gave is one of them, exactly as it was given: an
+  // https proxy in front is never taken for an http one, and a page that was
+  // loaded over http may not read the answers of an https service. The
+  // addresses of this computer are the others: the phone reaches the service
+  // there directly, over plain http.
+  //
+  // The headers of a proxy are never believed: X-Forwarded-Proto and
+  // X-Forwarded-Host are written by whoever sends the request.
+  const originAllowed = (origin, host) => {
+    // A request that carries no origin is not a request from a page of
+    // another site.
+    if (!origin) return true;
+    // A page in a frame with no origin of its own (the window of Magpie).
+    if (origin === 'null') return true;
+    if (external.origin && origin === external.origin) return true;
+    // Under the name of the user the service is only reached through the
+    // address the user gave. Any other scheme there is refused.
+    if (external.name && host.name === external.name) return false;
+    return origin === `http://${host.raw}`;
+  };
+
   const readToken = (request) => {
     const header = request.headers[TOKEN_HEADER];
     if (typeof header === 'string' && header) return header;
@@ -231,9 +328,8 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
   };
 
   // Two doors of their own. The console of this computer is opened by its own
-  // token; the phone is opened by the token of its own device. The old shared
-  // token stays the token of the legacy device, so the phones that were
-  // paired before keep working.
+  // token; the phone is opened by the token of its own device, and one phone
+  // never opens the door of another.
   const phoneAuthorized = (request) => {
     const device = verifyToken(state, readToken(request));
     if (!device) return false;
@@ -254,7 +350,8 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
     plugin: PLUGIN,
     port,
     phonePort,
-    upstream,
+    upstream: upstream,
+    upstreamError: gatewayError,
     serviceURL: serviceURL(),
     pairingURL: pairingURL(),
     pairingCode: state.pairing.code,
@@ -262,7 +359,6 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
     pairingExpiresIn: pairingExpiresIn(),
     // How long the door is still shut after too many wrong tries.
     pairingBlocked: budget.until > Date.now() ? Math.ceil((budget.until - Date.now()) / 1000) : 0,
-    token: state.token,
     qr: pairingURL() ? dataUri(pairingURL()) : '',
     tailnet: {
       installed: tailnet.installed,
@@ -278,6 +374,20 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
       interfaces: interfaces(),
       lan: lanCandidates(),
     },
+    // The network of the user, when Tailscale is not wanted.
+    external: {
+      url: externalURL,
+      listenAddress,
+      candidates: bindCandidates(),
+      error: externalError || listenError,
+      listenError,
+      // How the phone is let in: through the tailnet, through an address of
+      // the user, or through the address of this computer on the own
+      // network.
+      mode: externalURL
+        ? (external.secure ? 'https' : 'own-address')
+        : (listenAddress ? 'lan' : 'tailscale'),
+    },
     paired: state.paired,
     devices: deviceList(state),
     forward: {
@@ -300,9 +410,26 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
   // forwarding of an older version of this plugin points at the console of
   // this computer, and it is moved to the phone side as well. A forwarding
   // that belongs to somebody else is left alone.
-  const settleForward = async () => {
-    if (options.forward === false) {
-      forward = { ready: false, port, phonePort, error: '这次没有建尾网转发，手机直接连尾网地址。' };
+  const settleForwardOnce = async () => {
+    if (options.forward === false || externalURL) {
+      forward = {
+        ready: false,
+        port,
+        phonePort,
+        error: options.forward === false
+          ? '这次没有建尾网转发，手机直接连尾网地址。'
+          : '已经填了自己的地址，没有建尾网转发。',
+      };
+      // When the user has an address of his own, the forwarding of the
+      // tailnet is taken away, if it is ours to take. Otherwise the tailnet
+      // would keep a door open that the user has closed.
+      if (externalURL && state.forward) {
+        const removed = await removeForward(port, phonePort, runner, state.forward);
+        if (removed?.ok) {
+          state.forward = null;
+          await writeState(stateFile, state).catch(() => {});
+        }
+      }
       // Even when no forwarding is wanted, the console of this computer must
       // not be reachable from the tailnet. A rule that an older version left
       // behind can still point the published port at the console, so the
@@ -347,6 +474,14 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
     consoleOpen = !now || now.TCPForward !== `127.0.0.1:${port}`;
   };
 
+  // Only one settling at a time.
+  let settling = null;
+  const settleForward = () => {
+    if (settling) return settling;
+    settling = settleForwardOnce().finally(() => { settling = null; });
+    return settling;
+  };
+
   // Is the published port already taken by a forwarding of Tailscale? Then
   // Tailscale itself holds the tailnet address of that port.
   const portPublished = async () => {
@@ -550,10 +685,18 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
     if (stripped) pathname = stripped[1] || '/';
 
     const host = hostOf(request);
-    if (!allowedHosts(host)) return json(response, 403, { error: 'Invalid host.' });
+    if (!allowedHosts(host, scope)) return json(response, 403, { error: 'Invalid host.' });
 
+    // The origin of the request. Only the origins that belong to this
+    // service are let in. The address the user gave is one of them, exactly
+    // as it was given: an https proxy is never taken for an http one. The
+    // addresses of this computer are the others: the phone reaches the
+    // service there directly, over plain http.
+    //
+    // The headers of a proxy are never believed: X-Forwarded-Proto and
+    // X-Forwarded-Host are written by whoever sends the request.
     const origin = request.headers.origin;
-    if (origin && origin !== 'null' && origin !== `http://${request.headers.host}`) {
+    if (!originAllowed(origin, host)) {
       return json(response, 403, { error: 'Invalid origin.' });
     }
 
@@ -561,6 +704,19 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
     const method = request.method || 'GET';
     const allowOrigin = { 'Access-Control-Allow-Origin': origin || `http://${request.headers.host}`, Vary: 'Origin' };
 
+    // The question a browser asks before it sends a request that carries a
+    // token. It has no token of its own, so it is answered before the door
+    // of the token is looked at.
+    if (method === 'OPTIONS') {
+      response.writeHead(204, {
+        ...allowOrigin,
+        'Access-Control-Allow-Headers': `Content-Type, ${TOKEN_HEADER}, Authorization`,
+        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+        'Access-Control-Max-Age': '600',
+      });
+      return response.end();
+    }
+
     if (pathname === '/health') {
       return json(response, 200, {
         ok: true,
@@ -569,7 +725,7 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
         phonePort,
         tailnetIP: tailnet.tailnetIP,
         connected: tailnet.connected,
-      });
+      }, allowOrigin);
     }
 
     if (pathname.startsWith('/api/v1/console/')) {
@@ -607,17 +763,77 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
       if (pathname === '/api/v1/console/options' && method === 'POST') {
         const body = await jsonBody(request);
         if (!body) return json(response, 400, { error: 'Bad request.' }, allowOrigin);
+        // The address of the phone and the address the phone side listens
+        // on are checked before anything is written. The address the phone
+        // is told to use is checked here and in the installer of the phone,
+        // and the two keep the same rules.
+        let chosenExternal = null;
+        if (body.externalURL !== undefined) {
+          const checked = checkExternalURL(body.externalURL);
+          if (!checked.ok) {
+            return json(response, 400, { error: checked.error }, allowOrigin);
+          }
+          chosenExternal = checked.empty ? '' : checked.url;
+        }
+        let chosenListen = null;
+        if (body.listenAddress !== undefined) {
+          chosenListen = normalizeListenAddress(body.listenAddress, bindCandidates());
+          if (chosenListen === null) {
+            return json(response, 400, { error: 'That is not an address of this computer.' }, allowOrigin);
+          }
+        }
         const next = displayOptions({ ...state.settings, ...body });
         state.settings = { ...state.settings, ...next };
         if (body.refreshStrategy !== undefined) {
           state.settings.refreshStrategy = refreshStrategy(body.refreshStrategy);
         }
+        if (chosenExternal !== null) {
+          externalURL = chosenExternal;
+          external = externalOf(chosenExternal);
+          externalError = '';
+          if (chosenExternal) state.settings.externalURL = chosenExternal;
+          else delete state.settings.externalURL;
+        }
+        if (chosenListen !== null) {
+          listenAddress = chosenListen;
+          if (chosenListen) state.settings.listenAddress = chosenListen;
+          else delete state.settings.listenAddress;
+          await openExtraListener(listenAddress);
+          if (listenError) {
+            // The port did not open. Nothing is written down, so the file
+            // does not remember an address that is not listening.
+            delete state.settings.listenAddress;
+            listenAddress = '';
+            await writeState(stateFile, state).catch(() => {});
+            return json(response, 400, { error: listenError, external: consoleState().external }, allowOrigin);
+          }
+        }
         await writeState(stateFile, state);
+        // The forwarding of the tailnet follows the address the phone uses:
+        // with an address of his own there is no forwarding to build.
+        void settleForward();
         collector.setDisplay(displayOptions({ ...state.settings, ...pluginSettings }));
         // The rhythm of the reading changes at once. The service does not have
         // to be started again for that.
         collector.setStrategy(state.settings.refreshStrategy);
-        return json(response, 200, { display: collector.display, refresh: consoleState().refresh }, allowOrigin);
+        return json(response, 200, {
+          display: collector.display,
+          refresh: consoleState().refresh,
+          external: consoleState().external,
+        }, allowOrigin);
+      }
+      if (pathname === '/api/v1/console/network/reset' && method === 'POST') {
+        // The way back to the default: the tailnet. Everything the user set
+        // for a network of his own is taken away, and the port that was
+        // opened on the own network is closed for real.
+        const result = await resetNetwork();
+        if (!result.ok) {
+          return json(response, 500, { error: result.error, external: consoleState().external }, allowOrigin);
+        }
+        return json(response, 200, {
+          ...consoleState(),
+          network: { restored: true, wasListening: result.wasListening, mode: consoleState().external.mode },
+        }, allowOrigin);
       }
       if (pathname === '/api/v1/console/device' && method === 'POST') {
         const body = await jsonBody(request);
@@ -706,7 +922,19 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
         });
         // The port of this service is written into the script, so the phone
         // does not have to guess it.
-        return response.end(body.replace('const DEFAULT_PORT = 8790;', `const DEFAULT_PORT = ${port};`));
+        // The phone is told the port of the address it is given: in the mode
+        // of an address of the user's own that is the port of the phone side.
+        let servicePort = port;
+        try {
+          const address = serviceURL();
+          if (address) {
+            const parsed = new URL(address);
+            servicePort = Number(parsed.port) || (parsed.protocol === 'https:' ? 443 : 80);
+          }
+        } catch {
+          servicePort = port;
+        }
+        return response.end(body.replace('const DEFAULT_PORT = 8790;', `const DEFAULT_PORT = ${servicePort};`));
       } catch {
         return text(response, 404, 'Not found');
       }
@@ -768,6 +996,9 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
     if (pathname === '/app.js' && method === 'GET') {
       return serveUi(response, 'app.js', 'text/javascript; charset=utf-8', port);
     }
+    if (pathname === '/timing.mjs' && method === 'GET') {
+      return serveUi(response, 'timing.mjs', 'text/javascript; charset=utf-8', port);
+    }
     if (pathname === '/style.css' && method === 'GET') {
       return serveUi(response, 'style.css', 'text/css; charset=utf-8', port);
     }
@@ -828,6 +1059,70 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
     phoneServer.close(() => {});
   }
 
+  // The phone side may also listen on an address of the own network of the
+  // user, so a phone that is not on the tailnet can reach it. Only the phone
+  // side listens there; the console of this computer never does.
+  async function openExtraListener(address) {
+    if (extraListener) {
+      const old = extraListener;
+      extraListener = null;
+      // The connections are closed right away; the socket does not have to
+      // wait for them before the new one opens. A port that is closed for
+      // good must not keep a phone hanging on it.
+      if (typeof old.closeAllConnections === 'function') old.closeAllConnections();
+      else if (typeof old.closeIdleConnections === 'function') old.closeIdleConnections();
+      await new Promise((resolve) => old.close(resolve));
+    }
+    listenError = '';
+    if (!address) return;
+    const listener = makeServer('phone');
+    try {
+      await new Promise((resolve, reject) => {
+        listener.once('error', reject);
+        listener.listen(phonePort, address, resolve);
+      });
+      extraListener = listener;
+    } catch (error) {
+      listenError = `手机那一侧的端口没有在 ${address} 上打开：${error.message}`;
+      listener.close(() => {});
+    }
+  }
+  await openExtraListener(listenAddress);
+
+  // The way back to the default connection, which is the tailnet.
+  //
+  // Everything the user set for a network of his own is taken away: the
+  // address the phone was told to use, the address the phone side listened
+  // on, and what is written down about it. The port that was opened on the
+  // own network is closed for real, and only then is the forwarding of the
+  // tailnet built again.
+  //
+  // The order matters. The forwarding follows the address of the phone: a
+  // forwarding is only built when the phone does not have an address of his
+  // own. And the port has to be shut before the console says that the
+  // service is back on the tailnet, or the user would believe that the LAN
+  // port is closed while it is still open.
+  const resetNetwork = async () => {
+    const wasListening = Boolean(extraListener);
+    await openExtraListener('');
+    if (extraListener) {
+      // The socket did not go. The console says so instead of pretending
+      // that everything is back the way it was.
+      listenError = '手机那一侧的端口没有关上，关掉它之后再来试一次。';
+      return { ok: false, error: listenError };
+    }
+    listenAddress = '';
+    externalURL = '';
+    external = externalOf('');
+    externalError = '';
+    delete state.settings.listenAddress;
+    delete state.settings.externalURL;
+    await writeState(stateFile, state).catch(() => {});
+    // The forwarding of the tailnet comes back.
+    await settleForward();
+    return { ok: true, wasListening };
+  };
+
   const tailnetListener = makeServer('phone');
   const timers = [];
 
@@ -847,8 +1142,9 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
   void background();
 
   // The rhythm of the reading is kept by the collector itself: it knows when
-  // somebody is looking and when nobody is.
-  collector.start();
+  // somebody is looking and when nobody is. A gateway that was refused is
+  // never asked, so there is nothing to keep up.
+  if (gateway.ok) collector.start();
 
   // The state of the tailnet is looked at every five minutes, and not once a
   // minute for nothing: the command of Tailscale is not free. When it fails,
@@ -895,6 +1191,7 @@ export async function startServer({ root, dataDir, magpieDir, options = {} }) {
       await stopping;
       await new Promise((resolve) => server.close(resolve));
       await new Promise((resolve) => phoneServer.close(resolve));
+      if (extraListener) await new Promise((resolve) => extraListener.close(resolve));
       await new Promise((resolve) => tailnetListener.close(resolve));
     },
   };

package/lib/state.mjs

@@ -3,8 +3,9 @@ import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import path from 'node:path';
 import { writeAtomic } from './atomic.mjs';
 
-// The shape of the file does not change: an older file stays readable, so the
-// phones that are already paired keep working when the plugin is updated.
+// The shape of the file does not change: it holds the token of the console of
+// this computer, the devices of the phones, the pairing code and the settings.
+// A file of the older version is cleaned up when it is read (see migrate).
 const VERSION = 1;
 
 // A pairing code is a door key that is opened once: it lives ten minutes at
@@ -50,14 +51,26 @@ export const sameSecret = (a, b) => {
 export async function readState(file) {
   try {
     const saved = JSON.parse(await readFile(file, 'utf8'));
-    if (saved && saved.version === VERSION && typeof saved.token === 'string') return saved;
+    if (saved && saved.version === VERSION && typeof saved.consoleToken === 'string') return saved;
   } catch { /* A missing or damaged file must not stop the service. */ }
   return null;
 }
 
-export async function writeState(file, state) {
-  await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-  await writeAtomic(file, JSON.stringify(state, null, 2), { mode: 0o600 });
+// The writes of one file go one after another. Two writes that follow each
+// other (the last visit of a phone and a new pairing code, for instance) would
+// otherwise race: the older one could be written to the disk after the newer
+// one and put an old pairing code back into the file.
+const writeQueues = new Map();
+
+export function writeState(file, state) {
+  const previous = writeQueues.get(file) || Promise.resolve();
+  const next = previous.then(async () => {
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    await writeAtomic(file, JSON.stringify(state, null, 2), { mode: 0o600 });
+  });
+  // The queue keeps going even when one write fails.
+  writeQueues.set(file, next.catch(() => {}));
+  return next;
 }
 
 export async function ensureState(file) {
@@ -71,8 +84,6 @@ export async function ensureState(file) {
     version: VERSION,
     // The token of the console of this computer. It never leaves the console.
     consoleToken: newToken(),
-    // The shared token of the phones that were paired before this version.
-    token: newToken(),
     pairing: { code: newPairingCode(), createdAt: new Date().toISOString() },
     settings: {},
     paired: [],
@@ -83,10 +94,10 @@ export async function ensureState(file) {
   return { state, created: true };
 }
 
-// An older file knows nothing of devices and of the token of the console. The
-// shared token it holds becomes the authorization of one legacy device, so the
-// phones that carry it keep working, and every new phone gets a token of its
-// own.
+// A file of the older version still carries the shared token of the phones and
+// the device that held it. Nobody paired a phone with that version, so both are
+// taken away here. The token of the console of this computer is kept, so that
+// the console stays open across the update.
 export function migrate(state, now = Date.now()) {
   let changed = false;
   if (typeof state.consoleToken !== 'string' || !state.consoleToken) {
@@ -97,16 +108,12 @@ export function migrate(state, now = Date.now()) {
     state.devices = [];
     changed = true;
   }
-  if (!state.devices.some(device => device?.legacy)) {
-    state.devices.push({
-      id: 'legacy',
-      name: '旧版共享令牌',
-      hash: hashToken(state.token || ''),
-      createdAt: new Date(now).toISOString(),
-      lastAccessAt: null,
-      revokedAt: null,
-      legacy: true,
-    });
+  if (state.token) {
+    delete state.token;
+    changed = true;
+  }
+  if (state.devices.some(device => device?.legacy)) {
+    state.devices = state.devices.filter(device => !device?.legacy);
     changed = true;
   }
   if (!state.pairing || typeof state.pairing.code !== 'string') {
@@ -180,24 +187,19 @@ export function addDevice(state, { name, token, now = Date.now() }) {
     createdAt: new Date(now).toISOString(),
     lastAccessAt: null,
     revokedAt: null,
-    legacy: false,
   };
   state.devices.push(device);
   return device;
 }
 
 // The token of a phone is checked against every device that was not revoked.
-// The shared token of the old version is the legacy device.
 export function verifyToken(state, token, now = Date.now()) {
   if (typeof token !== 'string' || !token) return null;
   const devices = Array.isArray(state.devices) ? state.devices : [];
+  const wanted = hashToken(token);
   for (const device of devices) {
     if (!device || device.revokedAt) continue;
-    if (device.legacy) {
-      if (state.token && sameSecret(state.token, token)) return device;
-      continue;
-    }
-    if (device.hash && sameSecret(device.hash, hashToken(token))) return device;
+    if (device.hash && sameSecret(device.hash, wanted)) return device;
   }
   return null;
 }
@@ -212,14 +214,12 @@ export function noteAccess(device, now = Date.now()) {
   return true;
 }
 
-// One device is taken away on its own. The legacy device is the shared token
-// of the old version: taking it away stops every phone that was paired before
-// this version at once.
+// One device is taken away on its own. The phone that carries it stops at
+// once; the other phones keep reading.
 export function revokeDevice(state, id) {
   const device = (state.devices || []).find(entry => entry?.id === id);
   if (!device) return null;
   if (!device.revokedAt) device.revokedAt = new Date().toISOString();
-  if (device.legacy) state.token = '';
   return device;
 }
 
@@ -236,7 +236,6 @@ export function deviceList(state) {
   return (state.devices || []).map(device => ({
     id: device.id,
     name: device.name,
-    legacy: device.legacy === true,
     createdAt: device.createdAt || null,
     lastAccessAt: device.lastAccessAt || null,
     revokedAt: device.revokedAt || null,