ocremote 1.3.0

package/lib/identity.mjs

@@ -0,0 +1,165 @@
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+import { b64, deviceIDFromPublic, exportRawPublic, generateIdentityKeys, randomBytes, unb64 } from './crypto.mjs'
+
+const PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex')
+
+export function privateKeyFromSeed(seed) {
+  return crypto.createPrivateKey({
+    key: Buffer.concat([PKCS8_PREFIX, Buffer.from(seed)]),
+    format: 'der',
+    type: 'pkcs8',
+  })
+}
+
+export class Identity {
+  constructor(dir) {
+    this.dir = dir
+    this.file = path.join(dir, 'identity.json')
+    this.pairsDir = path.join(dir, 'pairs')
+    this.identity = null
+  }
+
+  load() {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(this.file, 'utf8'))
+      this.identity = {
+        id: parsed.id,
+        name: parsed.name,
+        publicRaw: unb64(parsed.publicKey),
+        privateKey: privateKeyFromSeed(unb64(parsed.privateKey)),
+        createdAt: parsed.createdAt,
+      }
+      return this
+    } catch {
+      this.identity = null
+      return null
+    }
+  }
+
+  ensure(name) {
+    this.load()
+    if (!this.identity) {
+      const keys = generateIdentityKeys()
+      this.identity = {
+        id: deviceIDFromPublic(keys.publicRaw),
+        name,
+        publicRaw: keys.publicRaw,
+        privateKey: keys.privateKey,
+        createdAt: new Date().toISOString(),
+      }
+      this.save()
+      return this
+    }
+    if (name && this.identity.name !== name) {
+      this.identity.name = name
+      this.save()
+    }
+    return this
+  }
+
+  save() {
+    fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 })
+    const seed = this.identity.privateKey.export({ type: 'pkcs8', format: 'der' }).subarray(-32)
+    const payload = {
+      version: 2,
+      id: this.identity.id,
+      name: this.identity.name,
+      publicKey: b64(this.identity.publicRaw),
+      privateKey: b64(seed),
+      createdAt: this.identity.createdAt,
+      updatedAt: new Date().toISOString(),
+    }
+    const file = `${this.file}.tmp`
+    fs.writeFileSync(file, `${JSON.stringify(payload, null, 2)}\n`, { mode: 0o600 })
+    fs.renameSync(file, this.file)
+    try {
+      fs.chmodSync(this.file, 0o600)
+    } catch {}
+  }
+
+  sign(message) {
+    return crypto.sign(null, Buffer.from(message, 'utf8'), this.identity.privateKey)
+  }
+
+  publicRaw() {
+    return this.identity.publicRaw
+  }
+
+  publicKeyB64() {
+    return b64(exportRawPublic(crypto.createPublicKey(this.identity.privateKey)))
+  }
+
+  deviceID() {
+    return this.identity.id
+  }
+
+  name() {
+    return this.identity.name
+  }
+
+  pairFile(pairID) {
+    return path.join(this.pairsDir, `${pairID}.json`)
+  }
+
+  savePairWithKey({ pairID, clientID, clientPK, name, pairKey }) {
+    fs.mkdirSync(this.pairsDir, { recursive: true, mode: 0o700 })
+    const payload = {
+      version: 2,
+      pairID,
+      clientID,
+      clientPK,
+      name: name || '',
+      pairKey: b64(pairKey),
+      createdAt: new Date().toISOString(),
+    }
+    const file = `${this.pairFile(pairID)}.tmp`
+    fs.writeFileSync(file, `${JSON.stringify(payload, null, 2)}\n`, { mode: 0o600 })
+    fs.renameSync(file, this.pairFile(pairID))
+  }
+
+  pair(pairID) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(this.pairFile(pairID), 'utf8'))
+      return {
+        pairID: parsed.pairID,
+        clientID: parsed.clientID,
+        clientPK: parsed.clientPK,
+        name: parsed.name,
+        pairKey: unb64(parsed.pairKey),
+        createdAt: parsed.createdAt,
+      }
+    } catch {
+      return null
+    }
+  }
+
+  pairs() {
+    try {
+      return fs
+        .readdirSync(this.pairsDir)
+        .filter((file) => file.endsWith('.json'))
+        .map((file) => this.pair(file.replace(/\.json$/, '')))
+        .filter(Boolean)
+    } catch {
+      return []
+    }
+  }
+
+  removePair(pairID) {
+    try {
+      fs.rmSync(this.pairFile(pairID))
+    } catch {}
+  }
+}
+
+export function newInvite() {
+  return {
+    pairID: `p_${randomBytes(6).toString('hex')}`,
+    secret: randomBytes(32),
+    createdAt: Date.now(),
+    expiresAt: Date.now() + 5 * 60_000,
+    used: false,
+  }
+}

package/lib/relay.mjs

@@ -0,0 +1,495 @@
+import {
+  CHANNEL_OPEN,
+  CHANNEL_SEALED,
+  DIR_CLIENT,
+  DIR_COMPANION,
+  PROTOCOL_VERSION,
+  b64,
+  control,
+  frame,
+  openWire,
+  sealWire,
+  inviteSessionKey,
+  open,
+  pairKeyFromInvite,
+  parseFrame,
+  randomBytes,
+  seal,
+  sessionKey,
+  sign,
+  unb64,
+  verify,
+} from './crypto.mjs'
+
+const RECONNECT_MIN = 1500
+const RECONNECT_MAX = 30_000
+const PING_INTERVAL = 25_000
+const STALE_AFTER = 75_000
+
+export class RelayClient {
+  constructor({ relayUrl, identity, adapter, logger, invites, onEvent }) {
+    this.relayUrl = relayUrl.replace(/\/+$/, '')
+    this.httpBase = this.relayUrl.replace(/^ws/, 'http')
+    this.identity = identity
+    this.adapter = adapter
+    this.logger = logger
+    this.invites = invites
+    this.onEvent = onEvent || (() => {})
+    this.ws = null
+    this.sessions = new Map()
+    this.stopped = false
+    this.attempt = 0
+    this.lastMessageAt = 0
+    this.pingTimer = null
+    this.reconnectTimer = null
+  }
+
+  log(message) {
+    this.logger?.(message)
+  }
+
+  async api(path, { method = 'POST', body, headers = {} } = {}) {
+    const res = await fetch(`${this.httpBase}${path}`, {
+      method,
+      headers: { 'content-type': 'application/json', ...headers },
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: AbortSignal.timeout(10_000),
+    })
+    const text = await res.text()
+    let parsed = null
+    try {
+      parsed = text ? JSON.parse(text) : null
+    } catch {}
+    if (!res.ok) {
+      const error = new Error(parsed?.message || `HTTP ${res.status}`)
+      error.status = res.status
+      error.code = parsed?.error
+      throw error
+    }
+    return parsed
+  }
+
+  deviceAuth() {
+    const ts = Math.floor(Date.now() / 1000)
+    const name = this.identity.name()
+    const deviceID = this.identity.deviceID()
+    const message = `ocremote-register-v1|${deviceID}|${name}|${ts}`
+    return {
+      deviceID,
+      name,
+      pk: this.identity.publicKeyB64(),
+      ts,
+      sig: b64(this.identity.sign(message)),
+    }
+  }
+
+  async registerDevice(version) {
+    const body = { ...this.deviceAuth(), companionVersion: version }
+    return this.api('/v1/devices', { body })
+  }
+
+  async registerPair(pair) {
+    const ts = Math.floor(Date.now() / 1000)
+    const deviceID = this.identity.deviceID()
+    const message = `ocremote-pair-v1|${deviceID}|${pair.pairID}|${pair.clientID}|${ts}`
+    await this.api('/v1/pairs', {
+      body: {
+        deviceID,
+        pairID: pair.pairID,
+        clientID: pair.clientID,
+        clientPK: pair.clientPK,
+        name: pair.name,
+        ts,
+        sig: b64(this.identity.sign(message)),
+      },
+    })
+  }
+
+  async revokePair(pairID) {
+    const ts = Math.floor(Date.now() / 1000)
+    const deviceID = this.identity.deviceID()
+    const message = `ocremote-unpair-v1|${deviceID}|${pairID}|${ts}`
+    const query = new URLSearchParams({
+      ts: String(ts),
+      sig: b64(this.identity.sign(message)),
+    })
+    await this.api(`/v1/pairs/${pairID}?${query}`, { method: 'DELETE' })
+  }
+
+  async registerInvite(invite) {
+    const ts = Math.floor(Date.now() / 1000)
+    const exp = Math.floor(invite.expiresAt / 1000)
+    const deviceID = this.identity.deviceID()
+    const message = `ocremote-invite-v1|${deviceID}|${invite.pairID}|${exp}|${ts}`
+    await this.api('/v1/invites', {
+      body: {
+        deviceID,
+        pairID: invite.pairID,
+        exp,
+        ts,
+        sig: b64(this.identity.sign(message)),
+      },
+    })
+  }
+
+  async createInvite() {
+    const invite = {
+      pairID: `p_${randomBytes(6).toString('hex')}`,
+      secret: randomBytes(32),
+      createdAt: Date.now(),
+      expiresAt: Date.now() + 5 * 60_000,
+    }
+    this.invites.set(invite.pairID, invite)
+    if (this.ws && this.ws.readyState === 1) {
+      try {
+        await this.registerInvite(invite)
+      } catch (err) {
+        this.log(`could not register invite with the relay: ${err.message}`)
+      }
+    }
+    return invite
+  }
+
+  pruneInvites() {
+    const now = Date.now()
+    for (const [id, invite] of this.invites) {
+      if (invite.expiresAt < now) this.invites.delete(id)
+    }
+  }
+
+  inviteURL(invite) {
+    const payload = {
+      v: 2,
+      relay: this.relayUrl,
+      device: this.identity.deviceID(),
+      name: this.identity.name(),
+      pk: this.identity.publicKeyB64(),
+      pairID: invite.pairID,
+      secret: b64(invite.secret),
+      exp: Math.floor(invite.expiresAt / 1000),
+    }
+    return `ocremote://pair?v=2&d=${b64(Buffer.from(JSON.stringify(payload), 'utf8'))}`
+  }
+
+  start() {
+    this.stopped = false
+    this.connect()
+  }
+
+  stop() {
+    this.stopped = true
+    clearTimeout(this.reconnectTimer)
+    clearInterval(this.pingTimer)
+    for (const session of this.sessions.values()) session.close('relay_stopped')
+    this.sessions.clear()
+    if (this.ws) {
+      try {
+        this.ws.close()
+      } catch {}
+      this.ws = null
+    }
+  }
+
+  scheduleReconnect() {
+    if (this.stopped) return
+    this.attempt++
+    const base = Math.min(RECONNECT_MAX, RECONNECT_MIN * 2 ** Math.min(this.attempt - 1, 5))
+    const delay = Math.round(base * (0.7 + Math.random() * 0.6))
+    this.log(`relay reconnecting in ${delay}ms (attempt ${this.attempt})`)
+    clearTimeout(this.reconnectTimer)
+    this.reconnectTimer = setTimeout(() => this.connect(), delay)
+  }
+
+  async connect() {
+    if (this.stopped) return
+    try {
+      const challenge = await this.api('/v1/challenge', {
+        body: { deviceID: this.identity.deviceID() },
+      })
+      const role = 'companion'
+      const message = `ocremote-ws-v1|${role}|${this.identity.deviceID()}||${challenge.challenge}`
+      const url = `${this.relayUrl}/v1/ws?role=${role}&device=${this.identity.deviceID()}`
+      const ws = new WebSocket(url, {
+        headers: {
+          'X-Challenge': challenge.challenge,
+          'X-Signature': b64(this.identity.sign(message)),
+        },
+      })
+      ws.binaryType = 'arraybuffer'
+      this.ws = ws
+      ws.addEventListener('open', () => {
+        this.attempt = 0
+        this.lastMessageAt = Date.now()
+        this.log(`relay connected ${this.relayUrl} device=${this.identity.deviceID()}`)
+        this.onEvent({ type: 'relay_connected' })
+        clearInterval(this.pingTimer)
+        this.pingTimer = setInterval(() => {
+          if (Date.now() - this.lastMessageAt > STALE_AFTER) {
+            this.log('relay silent; reconnecting')
+            try {
+              ws.close()
+            } catch {}
+            return
+          }
+          this.send(control({ t: 'ping' }))
+        }, PING_INTERVAL)
+      })
+      ws.addEventListener('message', (event) => {
+        this.lastMessageAt = Date.now()
+        this.handleMessage(event.data)
+      })
+      ws.addEventListener('close', () => {
+        if (this.ws !== ws) return
+        clearInterval(this.pingTimer)
+        for (const session of this.sessions.values()) session.close('relay_disconnected')
+        this.sessions.clear()
+        this.ws = null
+        this.onEvent({ type: 'relay_disconnected' })
+        if (!this.stopped) this.scheduleReconnect()
+      })
+      ws.addEventListener('error', () => {
+        try {
+          ws.close()
+        } catch {}
+      })
+    } catch (err) {
+      this.log(`relay connect failed: ${err.message}`)
+      this.scheduleReconnect()
+    }
+  }
+
+  send(data) {
+    if (!this.ws || this.ws.readyState !== 1) return false
+    try {
+      this.ws.send(data)
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  handleMessage(data) {
+    const buffer = Buffer.from(data)
+    const parsed = parseFrame(buffer)
+    if (!parsed) return
+    if (parsed.channel === 0x00) {
+      this.handleControl(parsed.payload)
+      return
+    }
+    const session = this.sessions.get(parsed.session)
+    if (!session) return
+    if (parsed.channel === CHANNEL_OPEN) {
+      session.handleOpen(parsed.payload)
+    } else if (parsed.channel === CHANNEL_SEALED) {
+      session.handleSealed(parsed.payload)
+    }
+  }
+
+  handleControl(payload) {
+    let msg = null
+    try {
+      msg = JSON.parse(payload.toString('utf8'))
+    } catch {
+      return
+    }
+    if (msg.t === 'session_open') {
+      const session = new RelaySession({
+        id: msg.session,
+        clientID: msg.clientID,
+        relay: this,
+        identity: this.identity,
+        adapter: this.adapter,
+        logger: this.logger,
+      })
+      this.sessions.set(msg.session, session)
+      this.log(`session ${msg.session} opened (${msg.clientID})`)
+      this.onEvent({ type: 'session_open', session: msg.session, clientID: msg.clientID })
+      return
+    }
+    if (msg.t === 'session_close') {
+      const session = this.sessions.get(msg.session)
+      if (session) {
+        session.close('client_disconnected')
+        this.sessions.delete(msg.session)
+      }
+      this.onEvent({ type: 'session_close', session: msg.session })
+      return
+    }
+    if (msg.t === 'pong') return
+    if (msg.t === 'hello') {
+      this.log(`relay hello: ${JSON.stringify(msg.device || {})}`)
+      return
+    }
+    if (msg.t === 'error') {
+      this.log(`relay error: ${msg.code}`)
+    }
+  }
+}
+
+export class RelaySession {
+  constructor({ id, clientID, relay, identity, adapter, logger }) {
+    this.id = id
+    this.clientID = clientID
+    this.relay = relay
+    this.identity = identity
+    this.adapter = adapter
+    this.logger = logger
+    this.mode = 'awaiting'
+    this.pairID = null
+    this.key = null
+    this.clientNonce = null
+    this.serverNonce = null
+    this.sendCounter = 0
+    this.recvCounter = -1
+    this.closed = false
+    this.failures = 0
+  }
+
+  log(message) {
+    this.logger?.(message)
+  }
+
+  close(reason) {
+    if (this.closed) return
+    this.closed = true
+    this.adapter?.cancelAll(this)
+    this.log(`session ${this.id} closed (${reason})`)
+  }
+
+  sendOpen(payload) {
+    this.relay.send(frame(CHANNEL_OPEN, this.id, Buffer.from(JSON.stringify(payload), 'utf8')))
+  }
+
+  sendSealed(payload) {
+    if (!this.key || this.closed) return
+    const bytes = Buffer.from(JSON.stringify(payload), 'utf8')
+    const sealed = sealWire(this.key, DIR_COMPANION, this.sendCounter, bytes)
+    this.sendCounter++
+    this.relay.send(frame(CHANNEL_SEALED, this.id, sealed))
+  }
+
+  handleOpen(payload) {
+    let msg = null
+    try {
+      msg = JSON.parse(payload.toString('utf8'))
+    } catch {
+      return
+    }
+    if (msg.t !== 'hs1' || msg.v !== PROTOCOL_VERSION) return
+    this.clientNonce = unb64(msg.nonce)
+    if (this.clientNonce.length !== 32) {
+      this.close('bad_nonce')
+      return
+    }
+    this.serverNonce = randomBytes(32)
+    this.sendCounter = 0
+    this.recvCounter = -1
+    this.failures = 0
+    this.sendOpen({ t: 'hs2', v: PROTOCOL_VERSION, nonce: b64(this.serverNonce) })
+
+    const pair = this.identity.pair(msg.pair)
+    if (pair) {
+      this.mode = 'paired'
+      this.pairID = pair.pairID
+      this.clientID = pair.clientID
+      this.key = sessionKey(pair.pairKey, this.clientNonce, this.serverNonce, pair.pairID)
+      this.log(`session ${this.id} handshake ok (paired ${pair.clientID})`)
+      return
+    }
+
+    const invite = this.relay.invites.get(msg.pair)
+    if (!invite || Date.now() > invite.expiresAt) {
+      this.log(`session ${this.id} rejected: unknown or expired invite`)
+      this.close('invite_invalid')
+      return
+    }
+    this.mode = 'pairing'
+    this.pairID = invite.pairID
+    this.key = inviteSessionKey(invite.secret, this.clientNonce, this.serverNonce)
+    this.log(`session ${this.id} handshake ok (pairing invite ${invite.pairID})`)
+  }
+
+  handleSealed(payload) {
+    if (!this.key || this.closed) return
+    let opened = null
+    try {
+      opened = openWire(this.key, DIR_CLIENT, payload, BigInt(this.recvCounter))
+    } catch (err) {
+      this.failures++
+      this.log(`session ${this.id} sealed rejected: ${err.message} (${this.failures}/3)`)
+      if (this.failures >= 3) this.close('sealed_rejected')
+      return
+    }
+    this.recvCounter = opened.counter
+    this.failures = 0
+    let msg = null
+    try {
+      msg = JSON.parse(opened.plaintext.toString('utf8'))
+    } catch {
+      return
+    }
+    this.handleMessage(msg)
+  }
+
+  handleMessage(msg) {
+    if (msg.t === 'pair' && this.mode === 'pairing') {
+      this.completePairing(msg)
+      return
+    }
+    if (msg.t === 'ping') {
+      this.sendSealed({ t: 'pong' })
+      return
+    }
+    if (msg.t === 'req') {
+      this.adapter?.handle(this, msg)
+      return
+    }
+    if (msg.t === 'cancel') {
+      this.adapter?.cancel(this, msg.id)
+    }
+  }
+
+  async completePairing(msg) {
+    const invite = this.relay.invites.get(this.pairID)
+    if (!invite) {
+      this.close('invite_missing')
+      return
+    }
+    if (typeof msg.clientID !== 'string' || typeof msg.clientPK !== 'string') {
+      this.close('bad_pair_request')
+      return
+    }
+    const pairKey = pairKeyFromInvite(invite.secret, this.clientNonce, this.serverNonce)
+    this.relay.invites.delete(this.pairID)
+    this.identity.savePairWithKey({
+      pairID: this.pairID,
+      clientID: msg.clientID,
+      clientPK: msg.clientPK,
+      name: msg.name,
+      pairKey,
+    })
+    try {
+      await this.relay.registerPair({
+        pairID: this.pairID,
+        clientID: msg.clientID,
+        clientPK: msg.clientPK,
+        name: msg.name,
+      })
+    } catch (err) {
+      this.log(`pair registration failed: ${err.message}`)
+    }
+    this.mode = 'paired'
+    this.clientID = msg.clientID
+    this.sendSealed({
+      t: 'paired',
+      v: PROTOCOL_VERSION,
+      deviceID: this.identity.deviceID(),
+      pairID: this.pairID,
+      clientID: msg.clientID,
+    })
+    this.log(`paired with ${msg.clientID} (${msg.name || 'device'})`)
+    this.relay.onEvent({ type: 'paired', pairID: this.pairID, clientID: msg.clientID, name: msg.name })
+  }
+}
+
+export { verify }