offsite 0.0.62 → 0.0.63

package/apps/server/dist/main.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { appendFileSync, chmodSync, closeSync, createReadStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, watch, writeFileSync } from "node:fs";
+import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, watch, writeFileSync } from "node:fs";
 import http, { createServer } from "node:http";
 import path from "node:path";
 import zlib, { createGzip } from "node:zlib";
@@ -31,7 +31,6 @@ import { CookieJar, getPublicSuffix } from "tough-cookie";
 import { spawn as spawn$1 } from "@lydell/node-pty";
 import { once } from "node:events";
 import https from "node:https";
-import { buffer } from "node:stream/consumers";
 import { pipeline } from "node:stream/promises";
 import { defaultTreeAdapter, html, parse, serialize } from "parse5";
 import { MagicString } from "magic-string";
@@ -2777,14 +2776,63 @@ const pushSubscriptions = snakeCase.table("push_subscriptions", {
 	machine: text().notNull(),
 	server: text().notNull()
 });
+// src/storage/auth.ts
+const CODE_LIFETIME = 3e5;
+const DEVICE_LIFETIME = 2592e6;
+function addCode(name) {
+	const code = randomBytes(16).toString("base64url");
+	db.delete(pairingCodes).where(lte(pairingCodes.expiresAt, Date.now())).run();
+	db.insert(pairingCodes).values({
+		hash: hash(code),
+		name,
+		expiresAt: Date.now() + CODE_LIFETIME
+	}).run();
+	return code;
+}
+function redeemCode(code) {
+	const found = db.delete(pairingCodes).where(eq(pairingCodes.hash, hash(code))).returning().get();
+	if (found === void 0 || found.expiresAt <= Date.now()) return null;
+	const token = randomBytes(32).toString("base64url");
+	const now = Date.now();
+	db.insert(devices).values({
+		hash: hash(token),
+		name: found.name,
+		createdAt: now,
+		expiresAt: now + DEVICE_LIFETIME
+	}).run();
+	return token;
+}
+function findDevice(token) {
+	const found = db.select().from(devices).where(and(eq(devices.hash, hash(token)), gt(devices.expiresAt, Date.now()))).get();
+	return found === void 0 ? null : found.hash;
+}
+function isPaired(device) {
+	return db.select().from(devices).where(and(eq(devices.hash, device), gt(devices.expiresAt, Date.now()))).get() !== void 0;
+}
+function hasDevices() {
+	return db.select().from(devices).where(gt(devices.expiresAt, Date.now())).limit(1).get() !== void 0;
+}
+function readDevices() {
+	return db.select().from(devices).orderBy(devices.createdAt).all();
+}
+function removeDevices(hashes) {
+	db.delete(devices).where(inArray(devices.hash, hashes)).run();
+}
+function recordUse(device) {
+	db.update(devices).set({ lastUsedAt: Date.now() }).where(eq(devices.hash, device)).run();
+}
+function hash(secret) {
+	return createHash("sha256").update(secret).digest("hex");
+}
 // src/services/files.ts
 const FILE_LIMIT = 2e4;
 const SNIFF_LENGTH = 8e3;
 const OUTPUT_LIMIT$1 = 262144;
 const READ_LIMIT$1 = 1048576;
 const MEDIA_LINK_LIFETIME = 36e5;
-const browseToken = randomBytes(32).toString("base64url");
+const BROWSE_LINK_LIFETIME = 36e5;
 const mediaLinks = /* @__PURE__ */ new Map();
+const browseLinks = /* @__PURE__ */ new Map();
 const skipped = /* @__PURE__ */ new Set([
 	"node_modules",
 	".git",
@@ -2878,18 +2926,33 @@ function renameProjectEntry(cwd, file, to) {
 function deleteProjectEntry(cwd, file) {
 	rmSync(resolveProjectEntry(cwd, file), { recursive: true });
 }
-function linkProjectMedia(cwd, file) {
+function linkProjectMedia(cwd, file, device) {
 	const resolved = path.resolve(realpathSync(cwd), file);
 	if (!existsSync(resolved)) throw new Error(`${file} does not exist`);
 	const full = realpathSync(resolved);
 	const mediaType = mediaTypes.get(path.extname(full).toLowerCase());
 	if (mediaType === void 0) throw new Error(`${file} is not an image, video or audio file`);
-	return addLink(full, mediaType);
+	return addLink(full, mediaType, device);
 }
-function linkProjectDownload(cwd, file) {
+function linkProjectDownload(cwd, file, device) {
 	const full = resolveProjectFile(cwd, file);
 	if (!statSync(full).isFile()) throw new Error(`${file} is not a file`);
-	return addLink(full, "application/octet-stream");
+	return addLink(full, "application/octet-stream", device);
+}
+function linkBrowse(device, address) {
+	for (const [token, link] of browseLinks) if (link.expiresAt <= Date.now()) browseLinks.delete(token);
+	const token = randomBytes(32).toString("base64url");
+	browseLinks.set(token, {
+		device,
+		address,
+		expiresAt: Date.now() + BROWSE_LINK_LIFETIME
+	});
+	return token;
+}
+function canBrowse(token, address) {
+	const link = browseLinks.get(token);
+	if (link === void 0 || link.expiresAt <= Date.now() || link.address !== address) return false;
+	return link.device === null || isPaired(link.device);
 }
 function setBrowseHeaders(response, contentType) {
 	response.setHeader("content-type", contentType);
@@ -2903,12 +2966,50 @@ function sniffType(file) {
 	closeSync(handle);
 	return head.subarray(0, read).includes(0) ? "application/octet-stream" : "text/plain; charset=utf-8";
 }
-function addLink(file, mediaType) {
+function streamFile(file, size, request, response) {
+	response.setHeader("accept-ranges", "bytes");
+	if (request.headers.range === void 0) {
+		response.setHeader("content-length", size);
+		createReadStream(file).on("error", () => response.destroy()).pipe(response);
+		return;
+	}
+	const range = byteRange(request.headers.range, size);
+	if (range === null) {
+		response.statusCode = 416;
+		response.setHeader("content-range", `bytes */${size}`);
+		response.end();
+		return;
+	}
+	response.statusCode = 206;
+	response.setHeader("content-range", `bytes ${range.start}-${range.end}/${size}`);
+	response.setHeader("content-length", range.end - range.start + 1);
+	createReadStream(file, range).on("error", () => response.destroy()).pipe(response);
+}
+function byteRange(header, size) {
+	const match = /^bytes=(?:(\d+)-(\d*)|-(\d+))$/.exec(header);
+	if (match === null) return null;
+	if (match[3] !== void 0) {
+		if (size === 0 || Number(match[3]) === 0) return null;
+		return {
+			start: Math.max(size - Number(match[3]), 0),
+			end: size - 1
+		};
+	}
+	const start = Number(match[1]);
+	const end = match[2] === "" ? size - 1 : Math.min(Number(match[2]), size - 1);
+	if (start > end) return null;
+	return {
+		start,
+		end
+	};
+}
+function addLink(file, mediaType, device) {
 	for (const [token, link] of mediaLinks) if (link.expiresAt <= Date.now()) mediaLinks.delete(token);
 	const token = randomBytes(32).toString("base64url");
 	mediaLinks.set(token, {
 		file,
 		mediaType,
+		device,
 		expiresAt: Date.now() + MEDIA_LINK_LIFETIME
 	});
 	return token;
@@ -2917,6 +3018,7 @@ function findMediaLink(token) {
 	if (token === null) return null;
 	const link = mediaLinks.get(token);
 	if (link === void 0 || link.expiresAt <= Date.now()) return null;
+	if (link.device !== null && !isPaired(link.device)) return null;
 	return link;
 }
 function saveUpload(name, data) {
@@ -6898,6 +7000,7 @@ const active = /* @__PURE__ */ new Map();
 const terminals = /* @__PURE__ */ new Map();
 const connections = /* @__PURE__ */ new Map();
 const paused = /* @__PURE__ */ new Set();
+const held = /* @__PURE__ */ new Set();
 let nextTab = 0;
 let draining = null;
 async function terminalRequest(client, message) {
@@ -6957,6 +7060,8 @@ function attach(client) {
 		instance
 	});
 	for (const tab of tabs) forward$1(connection, tab.id, true, Buffer.concat(terminals.get(tab.id)?.history ?? []));
+	for (const pty of held) pty.resume();
+	held.clear();
 }
 function resize(connection, message) {
 	const terminal = terminals.get(message.id);
@@ -7066,9 +7171,14 @@ async function createTab(projectId) {
 	});
 	active.set(projectId ?? "global", id);
 	pty.onData((data) => output(id, terminal, Buffer.from(data)));
+	if (connections.size === 0) {
+		pty.pause();
+		held.add(pty);
+	}
 	pty.onExit(() => {
 		terminals.delete(id);
 		paused.delete(pty);
+		held.delete(pty);
 		if (closeTab(id)) publish();
 	});
 }
@@ -7424,10 +7534,10 @@ const handlers = {
 		deleteProjectEntry(projectPath(params.projectId), params.path);
 		return null;
 	},
-	"files.media": (params) => linkProjectMedia(projectPath(params.projectId), params.path),
-	"files.download": (params) => linkProjectDownload(projectPath(params.projectId), params.path),
+	"files.media": (params, client) => linkProjectMedia(projectPath(params.projectId), params.path, client.device),
+	"files.download": (params, client) => linkProjectDownload(projectPath(params.projectId), params.path, client.device),
 	"files.upload": (params) => saveUpload(params.name, Buffer.from(params.data, "base64")),
-	"files.browse": () => browseToken,
+	"files.browse": (_params, client) => linkBrowse(client.device, client.address),
 	"browser.open": (params) => openSite(params.url, params.fromPage),
 	"tasks.output": (params) => taskOutput(params.sessionId, params.path),
 	"git.status": (params) => gitRepos(projectPath(params.projectId)),
@@ -7484,9 +7594,11 @@ const handlers = {
 	"terminal.busy": (params) => busyTerminal(params.id),
 	"terminal.paste": (params) => savePastedImage(params.type, Buffer.from(params.data, "base64"))
 };
-function connectClient(socket) {
+function connectClient(socket, device, address) {
 	const client = {
 		socket,
+		device,
+		address,
 		heardAt: Date.now(),
 		opening: null,
 		sessionId: null,
@@ -8362,6 +8474,7 @@ const TARGET = /^(https?)\/([^/?#]+)(.*)$/;
 const SANDBOX = "sandbox allow-scripts allow-forms allow-popups allow-modals allow-downloads allow-presentation allow-pointer-lock";
 const UPSTREAM_TIMEOUT = 6e4;
 const MAX_BODY = 8388608;
+const MAX_PAGE = 33554432;
 const MAX_HEADERS = 262144;
 const REQUEST_HEADERS_DROPPED = /* @__PURE__ */ new Set([
 	"accept-encoding",
@@ -8411,6 +8524,7 @@ const RESPONSE_HEADERS_DROPPED = /* @__PURE__ */ new Set([
 	"service-worker-allowed",
 	"set-cookie",
 	"strict-transport-security",
+	"trailer",
 	"transfer-encoding",
 	"x-frame-options"
 ]);
@@ -8506,9 +8620,11 @@ async function forward(site, target, request, response) {
 	request.pipe(upstream);
 	const incoming = (await answer)[0];
 	upstream.setTimeout(0);
+	const status = incoming.statusCode;
+	if (status === void 0 || status < 200 || status > 999) throw new Error(`${target.origin} sent an invalid status`);
 	for (const cookie of incoming.headers["set-cookie"] ?? []) await site.jar.setCookie(cookie, target.href, { ignoreError: true });
 	const kind = rewriteKind(incoming, request);
-	response.statusCode = incoming.statusCode ?? 502;
+	response.statusCode = status;
 	copyHeaders(incoming, response, kind !== null);
 	const location = incoming.headers.location;
 	if (location !== void 0) {
@@ -8517,6 +8633,7 @@ async function forward(site, target, request, response) {
 		response.setHeader("location", proxiedPath(site.key, next));
 	}
 	if (kind === null) {
+		response.flushHeaders();
 		await pipeline(incoming, response);
 		return;
 	}
@@ -8616,12 +8733,26 @@ function copyHeaders(incoming, response, rewritten) {
 }
 async function readBody(incoming) {
 	const encoding = incoming.headers["content-encoding"];
-	if (encoding === void 0 || encoding === "identity") return buffer(incoming);
-	if (encoding === "gzip") return buffer(incoming.pipe(zlib.createGunzip()));
-	if (encoding === "deflate") return buffer(incoming.pipe(zlib.createInflate()));
-	if (encoding === "br") return buffer(incoming.pipe(zlib.createBrotliDecompress()));
+	if (encoding === void 0 || encoding === "identity") return readLimited(incoming, MAX_PAGE);
+	const decoder = createDecoder(encoding);
+	return (await Promise.all([readLimited(decoder, MAX_PAGE), pipeline(incoming, decoder)]))[0];
+}
+function createDecoder(encoding) {
+	if (encoding === "gzip") return zlib.createGunzip();
+	if (encoding === "deflate") return zlib.createInflate();
+	if (encoding === "br") return zlib.createBrotliDecompress();
 	throw new Error(`the site sent unknown compression: ${encoding}`);
 }
+async function readLimited(source, limit) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of source) {
+		size += chunk.length;
+		if (size > limit) throw new Error("This page is too large");
+		chunks.push(chunk);
+	}
+	return Buffer.concat(chunks);
+}
 function decodeBody(body, incoming) {
 	const declared = /charset=["']?([\w-]+)/i.exec(incoming.headers["content-type"] ?? "")?.[1] ?? /<meta[^>]+charset=["']?([\w-]+)/i.exec(body.subarray(0, 1024).toString("latin1"))?.[1] ?? "utf-8";
 	try {
@@ -8652,11 +8783,7 @@ async function savePageData(site, kind, request, response) {
 		fail(response, 405, "use POST");
 		return;
 	}
-	const body = await buffer(request);
-	if (body.length > MAX_BODY) {
-		fail(response, 413, "too much page data");
-		return;
-	}
+	const body = await readLimited(request, MAX_BODY);
 	const data = JSON.parse(body.toString());
 	if (kind === "cookie") {
 		const write = pageWrite.parse(data);
@@ -8681,54 +8808,6 @@ function fail(response, status, message) {
 	response.setHeader("content-type", "text/plain; charset=utf-8");
 	response.end(message);
 }
-// src/storage/auth.ts
-const CODE_LIFETIME = 3e5;
-const DEVICE_LIFETIME = 2592e6;
-function addCode(name) {
-	const code = randomBytes(16).toString("base64url");
-	db.delete(pairingCodes).where(lte(pairingCodes.expiresAt, Date.now())).run();
-	db.insert(pairingCodes).values({
-		hash: hash(code),
-		name,
-		expiresAt: Date.now() + CODE_LIFETIME
-	}).run();
-	return code;
-}
-function redeemCode(code) {
-	const found = db.delete(pairingCodes).where(eq(pairingCodes.hash, hash(code))).returning().get();
-	if (found === void 0 || found.expiresAt <= Date.now()) return null;
-	const token = randomBytes(32).toString("base64url");
-	const now = Date.now();
-	db.insert(devices).values({
-		hash: hash(token),
-		name: found.name,
-		createdAt: now,
-		expiresAt: now + DEVICE_LIFETIME
-	}).run();
-	return token;
-}
-function findDevice(token) {
-	const found = db.select().from(devices).where(and(eq(devices.hash, hash(token)), gt(devices.expiresAt, Date.now()))).get();
-	return found === void 0 ? null : found.hash;
-}
-function isPaired(device) {
-	return db.select().from(devices).where(and(eq(devices.hash, device), gt(devices.expiresAt, Date.now()))).get() !== void 0;
-}
-function hasDevices() {
-	return db.select().from(devices).where(gt(devices.expiresAt, Date.now())).limit(1).get() !== void 0;
-}
-function readDevices() {
-	return db.select().from(devices).orderBy(devices.createdAt).all();
-}
-function removeDevices(hashes) {
-	db.delete(devices).where(inArray(devices.hash, hashes)).run();
-}
-function recordUse(device) {
-	db.update(devices).set({ lastUsedAt: Date.now() }).where(eq(devices.hash, device)).run();
-}
-function hash(secret) {
-	return createHash("sha256").update(secret).digest("hex");
-}
 // src/main.ts
 const UNPAIR_CHECK = 5e3;
 const TICKET_LIFETIME = 6e4;
@@ -8794,7 +8873,25 @@ const publicDir = path.join(import.meta.dirname, "..", "..", "client", "dist");
 const code = args.auth && args.pair && !hasDevices() ? addCode(null) : null;
 const tickets = /* @__PURE__ */ new Map();
 const server = createServer((request, response) => {
-	const url = new URL(request.url ?? "/", "http://localhost");
+	try {
+		answerRequest(request, response);
+	} catch (error) {
+		console.warn(`a request failed: ${error}`);
+		if (response.headersSent) {
+			response.destroy();
+			return;
+		}
+		response.statusCode = 500;
+		response.end("request failed");
+	}
+});
+function answerRequest(request, response) {
+	const url = URL.parse(request.url ?? "/", "http://localhost");
+	if (url === null) {
+		response.statusCode = 400;
+		response.end("bad url");
+		return;
+	}
 	if (url.pathname === "/api/media") {
 		serveMedia(url.searchParams.get("token"), request, response);
 		return;
@@ -8821,25 +8918,30 @@ const server = createServer((request, response) => {
 		return;
 	}
 	serveFile(url.pathname, request, response);
-});
+}
 const sockets = new WebSocketServer({
 	noServer: true,
 	perMessageDeflate: true
 });
 const paired = /* @__PURE__ */ new Map();
 server.on("upgrade", (request, socket, head) => {
-	const url = new URL(request.url ?? "/", "http://localhost");
+	const url = URL.parse(request.url ?? "/", "http://localhost");
+	if (url === null) {
+		socket.destroy();
+		return;
+	}
 	if (url.pathname.startsWith("/api/proxy/")) {
 		proxySocket(request, socket, head);
 		return;
 	}
 	const device = args.auth ? redeemTicket(url.searchParams.get("ticket")) : null;
-	if (url.pathname !== "/ws" || args.auth && device === null) {
+	const remoteAddress = request.socket.remoteAddress;
+	if (url.pathname !== "/ws" || remoteAddress === void 0 || args.auth && device === null) {
 		socket.destroy();
 		return;
 	}
 	sockets.handleUpgrade(request, socket, head, (client) => {
-		connectClient(client);
+		connectClient(client, device, remoteAddress);
 		if (device === null) return;
 		paired.set(client, device);
 		client.on("close", () => paired.delete(client));
@@ -8948,7 +9050,7 @@ function serveBrowse(pathname, request, response) {
 	}
 	const rest = pathname.slice(12);
 	const slash = rest.indexOf("/");
-	if (slash === -1 || rest.slice(0, slash) !== browseToken) {
+	if (slash === -1 || !canBrowse(rest.slice(0, slash), request.socket.remoteAddress)) {
 		response.statusCode = 404;
 		response.end("This browser link expired");
 		return;
@@ -8961,13 +9063,23 @@ function serveBrowse(pathname, request, response) {
 		response.end("bad path");
 		return;
 	}
-	const stats = statSync(file, { throwIfNoEntry: false });
-	if (stats === void 0 || !stats.isFile()) {
-		response.statusCode = 404;
-		response.end(`${file} is not a file`);
+	let stats;
+	let contentType;
+	try {
+		stats = statSync(file, { throwIfNoEntry: false });
+		if (stats === void 0 || !stats.isFile()) {
+			response.statusCode = 404;
+			response.end(`${file} is not a file`);
+			return;
+		}
+		accessSync(file, constants.R_OK);
+		contentType = browseTypes.get(path.extname(file).toLowerCase()) ?? sniffType(file);
+	} catch (error) {
+		response.statusCode = 500;
+		response.end(`Could not read ${file}: ${error}`);
 		return;
 	}
-	setBrowseHeaders(response, browseTypes.get(path.extname(file).toLowerCase()) ?? sniffType(file));
+	setBrowseHeaders(response, contentType);
 	streamFile(file, stats.size, request, response);
 }
 async function answerOpen(request, response) {
@@ -8998,43 +9110,6 @@ async function answerOpen(request, response) {
 	response.statusCode = 204;
 	response.end();
 }
-function streamFile(file, size, request, response) {
-	response.setHeader("accept-ranges", "bytes");
-	if (request.headers.range === void 0) {
-		response.setHeader("content-length", size);
-		createReadStream(file).on("error", () => response.destroy()).pipe(response);
-		return;
-	}
-	const range = byteRange(request.headers.range, size);
-	if (range === null) {
-		response.statusCode = 416;
-		response.setHeader("content-range", `bytes */${size}`);
-		response.end();
-		return;
-	}
-	response.statusCode = 206;
-	response.setHeader("content-range", `bytes ${range.start}-${range.end}/${size}`);
-	response.setHeader("content-length", range.end - range.start + 1);
-	createReadStream(file, range).on("error", () => response.destroy()).pipe(response);
-}
-function byteRange(header, size) {
-	const match = /^bytes=(?:(\d+)-(\d*)|-(\d+))$/.exec(header);
-	if (match === null) return null;
-	if (match[3] !== void 0) {
-		if (size === 0 || Number(match[3]) === 0) return null;
-		return {
-			start: Math.max(size - Number(match[3]), 0),
-			end: size - 1
-		};
-	}
-	const start = Number(match[1]);
-	const end = match[2] === "" ? size - 1 : Math.min(Number(match[2]), size - 1);
-	if (start > end) return null;
-	return {
-		start,
-		end
-	};
-}
 function answerJson(response, body) {
 	response.setHeader("content-type", "application/json");
 	response.end(JSON.stringify(body));