pal-explorer-cli 0.4.0

package/lib/core/discoveryClient.js

@@ -0,0 +1,408 @@
+import crypto from 'crypto';
+import config from '../utils/config.js';
+import { getBootstrapServers, getServersForRole, addServerWithRoles, SERVER_ROLES, getHealthSortedServers, getWriteServers } from './serverList.js';
+
+export function isPrivateUrl(urlStr) {
+  try {
+    const parsed = new URL(urlStr);
+    const host = parsed.hostname;
+    if (host === 'localhost' || host === '0.0.0.0' || host === '[::]') return true;
+    if (host.startsWith('127.') || host.startsWith('10.') || host.startsWith('192.168.') || host.startsWith('169.254.')) return true;
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return true;
+    if (host.startsWith('[') && (host.includes('::1') || host.startsWith('[fc') || host.startsWith('[fd') || host.startsWith('[fe80'))) return true;
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+export function parseHandle(handle) {
+  const at = handle.lastIndexOf('@');
+  if (at <= 0) return { name: handle, server: null };
+  const name = handle.slice(0, at);
+  let server = handle.slice(at + 1);
+  if (!/^https?:\/\//.test(server)) server = `https://${server}`;
+  server = server.replace(/\/+$/, '');
+  return { name, server };
+}
+
+export function getServers(role) {
+  if (role) {
+    const roleServers = getServersForRole(role);
+    if (roleServers.length > 0) return roleServers;
+    // fallback: return all servers (backward compat with servers that have no roles)
+  }
+  const settings = config.get('settings') || {};
+  const servers = settings.discovery_servers;
+  if (Array.isArray(servers) && servers.length > 0) return [...servers];
+  if (typeof servers === 'string' && servers.trim()) return servers.split(',').map(s => s.trim()).filter(Boolean);
+  const single = settings.discovery_url || process.env.PAL_DISCOVERY_URL;
+  if (single) return [single];
+  return getBootstrapServers();
+}
+
+export function getPrimaryServer() {
+  return getServers()[0];
+}
+
+export function getHealthyPrimary() {
+  const sorted = getHealthSortedServers();
+  if (sorted && sorted.length > 0) return sorted[0];
+  return getPrimaryServer();
+}
+
+export function addServerRaw(url) {
+  const settings = config.get('settings') || {};
+  const servers = Array.isArray(settings.discovery_servers) ? [...settings.discovery_servers] : [];
+  const normalized = url.replace(/\/+$/, '');
+  if (servers.includes(normalized)) return servers;
+  servers.push(normalized);
+  settings.discovery_servers = servers;
+  config.set('settings', settings);
+  return servers;
+}
+
+export async function addServer(url, { skipVerify = false } = {}) {
+  const normalized = url.replace(/\/+$/, '');
+  if (skipVerify) return addServerRaw(normalized);
+
+  const result = await fetchServerKey(normalized);
+  if (!result) {
+    throw new Error(`Server at ${normalized} did not provide a public key at /server-key`);
+  }
+
+  const health = await checkServer(normalized);
+  if (!health.reachable) {
+    throw new Error(`Server at ${normalized} is not reachable (health check failed)`);
+  }
+
+  const pinned = config.get('pinnedServerKeys') || {};
+  pinned[normalized] = result.publicKey;
+  config.set('pinnedServerKeys', pinned);
+
+  return { servers: addServerRaw(normalized), fingerprint: result.fingerprint, publicKey: result.publicKey };
+}
+
+export function keyFingerprint(hexKey) {
+  const hash = crypto.createHash('sha256').update(Buffer.from(hexKey, 'hex')).digest('hex');
+  return hash.slice(0, 8).toUpperCase().match(/.{2}/g).join(':');
+}
+
+export async function fetchServerKey(serverUrl) {
+  try {
+    const res = await fetch(`${serverUrl}/server-key`, { signal: AbortSignal.timeout(5000) });
+    if (!res.ok) return null;
+    const { publicKey } = await res.json();
+    if (!publicKey) return null;
+    return { publicKey, fingerprint: keyFingerprint(publicKey) };
+  } catch {
+    return null;
+  }
+}
+
+export async function verifyServer(serverUrl) {
+  const pinned = config.get('pinnedServerKeys') || {};
+  const pinnedKey = pinned[serverUrl];
+  if (!pinnedKey) {
+    return { url: serverUrl, status: 'no-pinned-key', message: 'No pinned key found. Re-add this server to pin its key.' };
+  }
+
+  const result = await fetchServerKey(serverUrl);
+  if (!result) {
+    return { url: serverUrl, status: 'unreachable', message: 'Could not fetch server key.' };
+  }
+
+  if (result.publicKey === pinnedKey) {
+    return { url: serverUrl, status: 'ok', fingerprint: result.fingerprint };
+  }
+
+  return {
+    url: serverUrl,
+    status: 'key-changed',
+    pinnedFingerprint: keyFingerprint(pinnedKey),
+    currentFingerprint: result.fingerprint,
+    message: 'SERVER KEY HAS CHANGED. This could indicate a MITM attack or server migration.',
+  };
+}
+
+export async function verifyAllServers() {
+  const servers = getServers();
+  return Promise.all(servers.map(s => verifyServer(s)));
+}
+
+export function acceptServerKey(serverUrl, newKey) {
+  const pinned = config.get('pinnedServerKeys') || {};
+  pinned[serverUrl] = newKey;
+  config.set('pinnedServerKeys', pinned);
+}
+
+export function removeServer(url) {
+  const settings = config.get('settings') || {};
+  const servers = Array.isArray(settings.discovery_servers) ? [...settings.discovery_servers] : [];
+  const normalized = url.replace(/\/+$/, '');
+  const filtered = servers.filter(s => s !== normalized);
+  settings.discovery_servers = filtered;
+  config.set('settings', settings);
+  return filtered;
+}
+
+export function setPrimaryServer(url) {
+  const settings = config.get('settings') || {};
+  const servers = Array.isArray(settings.discovery_servers) ? [...settings.discovery_servers] : [];
+  const normalized = url.replace(/\/+$/, '');
+  const filtered = servers.filter(s => s !== normalized);
+  filtered.unshift(normalized);
+  settings.discovery_servers = filtered;
+  config.set('settings', settings);
+  return filtered;
+}
+
+export async function checkServer(url) {
+  try {
+    if (isPrivateUrl(url)) return { url, reachable: false, status: null, error: 'private IP blocked' };
+    const res = await fetch(`${url}/status`, { signal: AbortSignal.timeout(3000) });
+    return { url, reachable: res.ok, status: res.status };
+  } catch {
+    return { url, reachable: false, status: null };
+  }
+}
+
+export async function fetchFirst(path, opts = {}, { role, allowPrivate } = {}) {
+  const servers = getServers(role);
+  for (const server of servers) {
+    const url = `${server}${path}`;
+    if (!allowPrivate && isPrivateUrl(url)) continue;
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(5000), ...opts });
+      if (res.ok) return res;
+    } catch {
+      // try next
+    }
+  }
+  return null;
+}
+
+export async function fetchAll(path, opts = {}, { role, allowPrivate } = {}) {
+  const servers = getServers(role);
+  const filtered = allowPrivate ? servers : servers.filter(s => !isPrivateUrl(`${s}${path}`));
+  const results = await Promise.allSettled(
+    filtered.map(server =>
+      fetch(`${server}${path}`, { signal: AbortSignal.timeout(5000), ...opts })
+        .then(async res => ({ server, res, ok: res.ok }))
+    )
+  );
+  return results
+    .filter(r => r.status === 'fulfilled')
+    .map(r => r.value);
+}
+
+export async function postTo(serverUrl, path, body) {
+  const fullUrl = `${serverUrl}${path}`;
+  if (isPrivateUrl(fullUrl)) throw new Error('SSRF blocked: private/internal URL');
+  const res = await fetch(fullUrl, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  return res;
+}
+
+export async function resolveFromServer(serverUrl, handle) {
+  const res = await fetch(`${serverUrl}/resolve/${encodeURIComponent(handle)}`, {
+    signal: AbortSignal.timeout(5000),
+  });
+  if (!res.ok) return null;
+  const data = await res.json();
+  if (!data) return null;
+
+  const serverKey = await pinServerKey(serverUrl);
+  const sig = res.headers.get('x-server-signature');
+  if (serverKey && sig) {
+    const sodium = (await import('sodium-native')).default;
+    const pk = Buffer.from(serverKey, 'hex');
+    const signature = Buffer.from(sig, 'hex');
+    if (pk.length === sodium.crypto_sign_PUBLICKEYBYTES && signature.length === sodium.crypto_sign_BYTES) {
+      const valid = sodium.crypto_sign_verify_detached(signature, Buffer.from(JSON.stringify(data)), pk);
+      if (!valid) return null;
+    }
+  }
+
+  return data;
+}
+
+let turnCredCache = null;
+
+export async function fetchTurnCredentials() {
+  if (turnCredCache && turnCredCache.expiresAt > Date.now()) return turnCredCache;
+  const identity = config.get('identity');
+  const turnServers = getServers('turn');
+  const pk = identity?.publicKey || '';
+  for (const server of turnServers) {
+    try {
+      const url = `${server}/api/v1/turn-credentials${pk ? `?publicKey=${pk}` : ''}`;
+      const res = await fetch(url, { signal: AbortSignal.timeout(5000) });
+      if (!res.ok) continue;
+      const data = await res.json();
+      turnCredCache = { ...data, expiresAt: Date.now() + (data.ttl * 800) }; // refresh at 80% TTL
+      return turnCredCache;
+    } catch {
+      // try next
+    }
+  }
+  return null;
+}
+
+export async function announceShares(shares, { serveUrl } = {}) {
+  const identity = config.get('identity');
+  if (!identity?.handle) return null;
+  const device = config.get('device');
+  const writeServers = getWriteServers();
+  const servers = writeServers.length > 0 ? writeServers : getServers('discovery');
+  const body = JSON.stringify({
+    handle: identity.handle,
+    deviceId: device?.id || null,
+    serveUrl: serveUrl || null,
+    shares: shares.map(s => ({
+      id: s.id,
+      name: s.name,
+      magnet: s.magnet,
+      visibility: s.visibility || 'global',
+      createdAt: s.createdAt,
+      size: s.size || undefined,
+      type: s.type || undefined,
+      extension: s.extension || undefined,
+      modifiedAt: s.modifiedAt || undefined,
+      files: Array.isArray(s.files) ? s.files.slice(0, 5000) : undefined,
+    })),
+  });
+  const results = await Promise.allSettled(
+    servers.map(server =>
+      fetch(`${server}/api/v1/shares/announce`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body,
+        signal: AbortSignal.timeout(10000),
+      }).then(res => res.ok ? res.json() : null)
+    )
+  );
+  const first = results.find(r => r.status === 'fulfilled' && r.value);
+  return first?.value || null;
+}
+
+export async function announceGroups(groups) {
+  const identity = config.get('identity');
+  if (!identity?.publicKey) return null;
+  const publicGroups = groups.filter(g => g.visibility === 'public');
+  if (publicGroups.length === 0) return { success: true, count: 0 };
+
+  const writeServers = getWriteServers();
+  const servers = writeServers.length > 0 ? writeServers : getServers('discovery');
+  const body = JSON.stringify({
+    ownerPublicKey: identity.publicKey,
+    groups: publicGroups.map(g => ({
+      id: g.id,
+      name: g.name,
+      description: g.description,
+      visibility: g.visibility,
+      memberCount: (g.members || []).length,
+      createdAt: g.createdAt
+    }))
+  });
+  const results = await Promise.allSettled(
+    servers.map(server =>
+      fetch(`${server}/api/v1/groups/announce`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body,
+        signal: AbortSignal.timeout(10000),
+      }).then(res => res.ok ? res.json() : null)
+    )
+  );
+  const first = results.find(r => r.status === 'fulfilled' && r.value);
+  return first?.value || null;
+}
+
+export async function fetchSeeders(infohash) {
+  const res = await fetchFirst(`/api/v1/seeders/${infohash}`, {}, { role: 'discovery' });
+  if (!res) return [];
+  try {
+    const data = await res.json();
+    return Array.isArray(data.peers) ? data.peers : [];
+  } catch {
+    return [];
+  }
+}
+
+export async function addUserServer(url, roles = [], { trustWrites = false } = {}) {
+  const normalized = url.replace(/\/+$/, '');
+  const result = await addServerWithRoles(normalized, roles, { trustWrites });
+  addServerRaw(normalized);
+  return result;
+}
+
+// ── Offline queue ──
+
+export function getOfflineQueue() {
+  return config.get('offlineQueue') || [];
+}
+
+export function queueOfflineCall(path, opts) {
+  const queue = getOfflineQueue();
+  queue.push({ path, opts, queuedAt: new Date().toISOString() });
+  config.set('offlineQueue', queue);
+}
+
+export async function replayOfflineQueue() {
+  const queue = getOfflineQueue();
+  if (queue.length === 0) return 0;
+  const server = getPrimaryServer();
+  let replayed = 0;
+  const remaining = [];
+  for (const item of queue) {
+    try {
+      const res = await fetch(`${server}${item.path}`, {
+        signal: AbortSignal.timeout(5000),
+        ...item.opts,
+      });
+      if (res.ok) replayed++;
+      else remaining.push(item);
+    } catch {
+      remaining.push(item);
+    }
+  }
+  config.set('offlineQueue', remaining);
+  return replayed;
+}
+
+export async function pinServerKey(serverUrl) {
+  const pinned = config.get('pinnedServerKeys') || {};
+  const existing = pinned[serverUrl];
+
+  try {
+    const res = await fetch(`${serverUrl}/server-key`, { signal: AbortSignal.timeout(3000) });
+    if (!res.ok) return existing || null;
+    const { publicKey } = await res.json();
+    if (!publicKey) return existing || null;
+
+    if (existing && existing !== publicKey) {
+      const err = new Error(
+        `Server key changed for ${serverUrl}! ` +
+        `Pinned: ${keyFingerprint(existing)}, Current: ${keyFingerprint(publicKey)}. ` +
+        `Run 'pe server verify' to inspect and accept the new key.`
+      );
+      err.code = 'SERVER_KEY_CHANGED';
+      err.pinnedKey = existing;
+      err.currentKey = publicKey;
+      throw err;
+    }
+
+    if (!existing) {
+      pinned[serverUrl] = publicKey;
+      config.set('pinnedServerKeys', pinned);
+    }
+    return publicKey;
+  } catch (e) {
+    if (e.code === 'SERVER_KEY_CHANGED') throw e;
+    return existing || null;
+  }
+}