nixamp 0.7.3 → 0.7.4

package/dist/admin.js

@@ -6,7 +6,7 @@
  * or against a nixamp on a different machine entirely.
  */
 import { createApp, themes } from "@profullstack/hqtui";
-import { daemonUrl, readState } from "./daemon.js";
+import { daemonUrl, isLoopbackTls, readState } from "./daemon.js";
 import { KEY_HEADER } from "./share.js";
 /** Where to point, from the flags or from the daemon that is running. */
 export function resolveTarget(argv) {
@@ -23,8 +23,13 @@ export function resolveTarget(argv) {
     if (state === null) {
         throw new Error("nixamp: no daemon is running. Start one with `nixamp daemon start`, or pass --url.");
     }
+    const url_ = daemonUrl(state);
+    // Talking to our own daemon, whose certificate names somewhere else. Nothing
+    // is in the way on loopback, so there is nothing for a certificate to prove.
+    if (isLoopbackTls(url_))
+        process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = "0";
     return {
-        url: daemonUrl(state),
+        url: url_,
         key: key ?? state.key,
         // A state file written before 0.5.3 has no list; loopback stands in.
         links: state.urls ?? [{ label: "here", url: daemonUrl(state) }],

package/dist/daemon.d.ts

@@ -48,6 +48,16 @@ export declare function status(): {
 };
 /** The URL an admin client should talk to. */
 export declare function daemonUrl(state: DaemonState): string;
+/**
+ * Whether this address is our own machine over TLS with a certificate that
+ * cannot possibly name it.
+ *
+ * A certificate proves you reached the host you asked for. Asking for loopback
+ * proves that already: nothing is in the way to impersonate. So a daemon with a
+ * certificate for some public name is still reachable at 127.0.0.1, and a
+ * client refusing to talk to it is protecting nobody from anything.
+ */
+export declare function isLoopbackTls(url: string): boolean;
 /**
  * What `nixamp daemon start` and `nixamp daemon status` print, as lines, so it
  * can be tested without starting a daemon.

package/dist/daemon.js

@@ -61,8 +61,37 @@ export function status() {
 }
 /** The URL an admin client should talk to. */
 export function daemonUrl(state) {
+    // A daemon serving https has a certificate for a name, and loopback is not
+    // that name. Asking it for https://localhost fails verification even though
+    // it is the same process on the same machine, which is how turning TLS on
+    // silently broke `nixamp admin` and `nixamp attach`. Prefer the address it
+    // was told to publish, which is the one the certificate is actually for.
+    const told = state.urls?.find((entry) => entry.label === "on the internet" && entry.url.startsWith("https://"));
+    if (told)
+        return told.url;
+    const scheme = state.urls?.[0]?.url.startsWith("https://") ? "https" : "http";
     const host = state.host === "0.0.0.0" || state.host === "::" ? "127.0.0.1" : state.host;
-    return `http://${host.includes(":") ? `[${host}]` : host}:${state.port}`;
+    return `${scheme}://${host.includes(":") ? `[${host}]` : host}:${state.port}`;
+}
+/**
+ * Whether this address is our own machine over TLS with a certificate that
+ * cannot possibly name it.
+ *
+ * A certificate proves you reached the host you asked for. Asking for loopback
+ * proves that already: nothing is in the way to impersonate. So a daemon with a
+ * certificate for some public name is still reachable at 127.0.0.1, and a
+ * client refusing to talk to it is protecting nobody from anything.
+ */
+export function isLoopbackTls(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== "https:")
+            return false;
+        return parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "::1";
+    }
+    catch {
+        return false;
+    }
 }
 /**
  * How long it has been up, as a person would say it. Written here rather than

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/admin.ts

@@ -8,7 +8,7 @@
 import { createApp, themes, type Container, type KeyEvent, type Theme } from "@profullstack/hqtui";
 import type { Color } from "@profullstack/hqtui";
 import type { Connection } from "./connections.ts";
-import { daemonUrl, readState } from "./daemon.ts";
+import { daemonUrl, isLoopbackTls, readState } from "./daemon.ts";
 import { KEY_HEADER } from "./share.ts";
 
 interface Report {
@@ -59,8 +59,12 @@ export function resolveTarget(argv: string[]): AdminOptions {
   if (state === null) {
     throw new Error("nixamp: no daemon is running. Start one with `nixamp daemon start`, or pass --url.");
   }
+  const url_ = daemonUrl(state);
+  // Talking to our own daemon, whose certificate names somewhere else. Nothing
+  // is in the way on loopback, so there is nothing for a certificate to prove.
+  if (isLoopbackTls(url_)) process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = "0";
   return {
-    url: daemonUrl(state),
+    url: url_,
     key: key ?? state.key,
     // A state file written before 0.5.3 has no list; loopback stands in.
     links: state.urls ?? [{ label: "here", url: daemonUrl(state) }],

package/src/daemon.ts

@@ -95,8 +95,38 @@ export function status(): { running: boolean; state: DaemonState | null } {
 
 /** The URL an admin client should talk to. */
 export function daemonUrl(state: DaemonState): string {
+  // A daemon serving https has a certificate for a name, and loopback is not
+  // that name. Asking it for https://localhost fails verification even though
+  // it is the same process on the same machine, which is how turning TLS on
+  // silently broke `nixamp admin` and `nixamp attach`. Prefer the address it
+  // was told to publish, which is the one the certificate is actually for.
+  const told = state.urls?.find(
+    (entry) => entry.label === "on the internet" && entry.url.startsWith("https://"),
+  );
+  if (told) return told.url;
+
+  const scheme = state.urls?.[0]?.url.startsWith("https://") ? "https" : "http";
   const host = state.host === "0.0.0.0" || state.host === "::" ? "127.0.0.1" : state.host;
-  return `http://${host.includes(":") ? `[${host}]` : host}:${state.port}`;
+  return `${scheme}://${host.includes(":") ? `[${host}]` : host}:${state.port}`;
+}
+
+/**
+ * Whether this address is our own machine over TLS with a certificate that
+ * cannot possibly name it.
+ *
+ * A certificate proves you reached the host you asked for. Asking for loopback
+ * proves that already: nothing is in the way to impersonate. So a daemon with a
+ * certificate for some public name is still reachable at 127.0.0.1, and a
+ * client refusing to talk to it is protecting nobody from anything.
+ */
+export function isLoopbackTls(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") return false;
+    return parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "::1";
+  } catch {
+    return false;
+  }
 }
 
 /**

package/web/dist/sw.js

@@ -1,5 +1,5 @@
 /* nixamp service worker — generated, do not edit */
-const CACHE = "nixamp-1788949147610";
+const CACHE = "nixamp-1788949719455";
 const PRECACHE = [
   "/",
   "/apple-touch-icon.png",