pipane 0.1.6 → 0.1.7

package/dist/server/server/backend-identity.js

@@ -0,0 +1,167 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify, } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { backendRegistrationPayload } from "../shared/rendezvous-protocol.js";
+import { TRUST_PROTOCOL_VERSION, backendIdentityBindingPayload, } from "../shared/trust-protocol.js";
+const BACKEND_IDENTITY_VERSION = 1;
+const BACKEND_ID_PREFIX = "b_";
+export function defaultBackendIdentityPath() {
+    const configDir = process.env.PIPANE_CONFIG_DIR || path.join(homedir(), ".config", "pipane");
+    return path.join(configDir, "backend-identity.json");
+}
+export function loadOrCreateBackendIdentity(filePath = defaultBackendIdentityPath()) {
+    try {
+        return loadBackendIdentity(filePath);
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw error;
+    }
+    mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    const { privateKey } = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+    const privateKeyDer = privateKey.export({ type: "pkcs8", format: "der" });
+    const stored = {
+        version: BACKEND_IDENTITY_VERSION,
+        algorithm: "ES256",
+        privateKey: Buffer.from(privateKeyDer).toString("base64url"),
+    };
+    try {
+        writeFileSync(filePath, `${JSON.stringify(stored, null, 2)}\n`, {
+            encoding: "utf8",
+            mode: 0o600,
+            flag: "wx",
+        });
+    }
+    catch (error) {
+        // Another pipane process may have created the identity concurrently.
+        if (error?.code !== "EEXIST")
+            throw error;
+    }
+    chmodSync(filePath, 0o600);
+    return loadBackendIdentity(filePath);
+}
+export function loadBackendIdentity(filePath) {
+    let stored;
+    try {
+        stored = JSON.parse(readFileSync(filePath, "utf8"));
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            throw error;
+        throw new Error(`Invalid backend identity file ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!isStoredBackendIdentity(stored)) {
+        throw new Error(`Invalid backend identity file ${filePath}: unsupported or malformed identity`);
+    }
+    let privateKey;
+    try {
+        privateKey = createPrivateKey({
+            key: Buffer.from(stored.privateKey, "base64url"),
+            format: "der",
+            type: "pkcs8",
+        });
+    }
+    catch (error) {
+        throw new Error(`Invalid backend identity file ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    assertP256Key(privateKey);
+    const publicKey = exportPublicKey(privateKey);
+    return {
+        backendId: deriveBackendId(publicKey),
+        algorithm: "ES256",
+        publicKey,
+        privateKey,
+        filePath,
+    };
+}
+export function deriveBackendId(publicKey) {
+    const publicKeyBytes = decodePublicKey(publicKey);
+    const key = createPublicKey({ key: publicKeyBytes, format: "der", type: "spki" });
+    assertP256Key(key);
+    return `${BACKEND_ID_PREFIX}${createHash("sha256").update(publicKeyBytes).digest("base64url")}`;
+}
+export function signBackendChallenge(identity, nonce) {
+    const signature = sign("sha256", Buffer.from(backendRegistrationPayload(nonce)), {
+        key: identity.privateKey,
+        dsaEncoding: "ieee-p1363",
+    });
+    return signature.toString("base64url");
+}
+export function verifyBackendChallenge(publicKey, nonce, signature) {
+    return verifyBackendSignature(publicKey, backendRegistrationPayload(nonce), signature);
+}
+export function signBackendIdentityBinding(identity, input) {
+    const unsigned = {
+        version: TRUST_PROTOCOL_VERSION,
+        backendId: identity.backendId,
+        publicKey: identity.publicKey,
+        connectionId: input.connectionId,
+        offerSha256: sha256Base64Url(input.offerSdp),
+        answerSha256: sha256Base64Url(input.answerSdp),
+        dtlsFingerprint: extractDtlsFingerprint(input.answerSdp),
+        expiresAt: input.expiresAt,
+    };
+    const signature = sign("sha256", Buffer.from(backendIdentityBindingPayload(unsigned)), {
+        key: identity.privateKey,
+        dsaEncoding: "ieee-p1363",
+    }).toString("base64url");
+    return { ...unsigned, signature };
+}
+export function verifyBackendIdentityBinding(binding) {
+    try {
+        if (binding.version !== TRUST_PROTOCOL_VERSION || deriveBackendId(binding.publicKey) !== binding.backendId)
+            return false;
+        const { signature, ...unsigned } = binding;
+        return verifyBackendSignature(binding.publicKey, backendIdentityBindingPayload(unsigned), signature);
+    }
+    catch {
+        return false;
+    }
+}
+export function sha256Base64Url(value) {
+    return createHash("sha256").update(value).digest("base64url");
+}
+export function extractDtlsFingerprint(sdp) {
+    const match = /^a=fingerprint:(sha-(?:1|224|256|384|512)) ([A-Fa-f0-9:]+)\r?$/m.exec(sdp);
+    if (!match)
+        throw new Error("SDP answer is missing a DTLS certificate fingerprint");
+    return `${match[1].toLowerCase()} ${match[2].toUpperCase()}`;
+}
+function verifyBackendSignature(publicKey, payload, signature) {
+    try {
+        const key = createPublicKey({ key: decodePublicKey(publicKey), format: "der", type: "spki" });
+        assertP256Key(key);
+        return verify("sha256", Buffer.from(payload), { key, dsaEncoding: "ieee-p1363" }, Buffer.from(signature, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+function exportPublicKey(privateKey) {
+    const publicKey = createPublicKey(privateKey.export({ type: "pkcs8", format: "pem" }));
+    assertP256Key(publicKey);
+    return Buffer.from(publicKey.export({ type: "spki", format: "der" })).toString("base64url");
+}
+function decodePublicKey(publicKey) {
+    if (!/^[A-Za-z0-9_-]+$/.test(publicKey))
+        throw new Error("Invalid public key encoding");
+    const bytes = Buffer.from(publicKey, "base64url");
+    if (bytes.length === 0 || bytes.toString("base64url") !== publicKey)
+        throw new Error("Invalid public key encoding");
+    return bytes;
+}
+function assertP256Key(key) {
+    if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+        throw new Error("Backend identity must use a P-256 key");
+    }
+}
+function isStoredBackendIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    return record.version === BACKEND_IDENTITY_VERSION
+        && record.algorithm === "ES256"
+        && typeof record.privateKey === "string"
+        && record.privateKey.length > 0;
+}

package/dist/server/server/backend-protocol-handler.js

@@ -0,0 +1,132 @@
+import { BACKEND_PROTOCOL_VERSION, decodeBackendRequest, encodeBackendFrame, } from "../shared/backend-protocol.js";
+import { FRAME_CONNECTION_OPEN } from "./frame-connection.js";
+import { LocalBackendApiError } from "./local-backend-api.js";
+const MAX_COMPLETED_REQUESTS = 128;
+const MAX_CACHED_RESPONSE_BYTES = 256 * 1024;
+const MAX_ACTIVE_REQUESTS = 64;
+/** Device-scoped idempotent semantic dispatcher shared across carrier reconnects. */
+export class BackendProtocolHandler {
+    api;
+    completed = new Map();
+    active = new Map();
+    constructor(api) {
+        this.api = api;
+    }
+    accept(connection, deviceId = "anonymous") {
+        connection.on("message", (frame) => {
+            const raw = frame.toString();
+            const decoded = decodeBackendRequest(raw);
+            if (!decoded.ok) {
+                this.send(connection, {
+                    v: BACKEND_PROTOCOL_VERSION,
+                    kind: "response",
+                    id: decoded.requestId ?? "invalid",
+                    method: decoded.method || "unknown",
+                    success: false,
+                    error: decoded.error,
+                });
+                return;
+            }
+            const request = decoded.value;
+            const cacheKey = `${deviceId}:${request.id}`;
+            const prior = this.completed.get(cacheKey);
+            if (prior) {
+                if (connection.readyState === FRAME_CONNECTION_OPEN)
+                    connection.send(prior);
+                return;
+            }
+            let operation = this.active.get(cacheKey);
+            if (!operation) {
+                if (this.active.size >= MAX_ACTIVE_REQUESTS) {
+                    this.send(connection, failure(request, {
+                        code: "conflict",
+                        message: "Too many backend requests are active",
+                    }));
+                    return;
+                }
+                operation = this.execute(request, cacheKey);
+                this.active.set(cacheKey, operation);
+            }
+            void operation.then((encoded) => {
+                if (connection.readyState === FRAME_CONNECTION_OPEN)
+                    connection.send(encoded);
+            });
+        });
+    }
+    async execute(request, cacheKey) {
+        let response;
+        try {
+            response = {
+                v: BACKEND_PROTOCOL_VERSION,
+                kind: "response",
+                id: request.id,
+                method: request.method,
+                success: true,
+                result: await this.dispatch(request),
+            };
+        }
+        catch (error) {
+            response = failure(request, toApiError(error));
+        }
+        const encoded = encodeBackendFrame(response);
+        remember(this.completed, cacheKey, encoded);
+        this.active.delete(cacheKey);
+        return encoded;
+    }
+    async dispatch(request) {
+        switch (request.method) {
+            case "backend.capabilities":
+                if (!this.api.getCapabilities)
+                    throw new Error("Backend capabilities are unavailable");
+                return this.api.getCapabilities();
+            case "sessions.list": return this.api.listSessions();
+            case "sessions.delete": return this.api.deleteSession(request.params.sessionPath).then(() => ({}));
+            case "sessions.forkMessages": return this.api.listForkMessages(request.params.sessionPath);
+            case "sessions.raw": return this.api.getRawSession(request.params.sessionPath);
+            case "files.read": return this.api.getFileContent(request.params.sessionPath, request.params.path);
+            case "files.upload.create": return this.api.createFileUpload(request.params);
+            case "files.upload.append": return this.api.appendFileUpload(request.params);
+            case "files.upload.complete": return this.api.completeFileUpload(request.params.uploadId);
+            case "host.browse": return this.api.browseDirectory(request.params.path);
+            case "host.mkdir": return this.api.createDirectory(request.params.parentPath, request.params.name);
+            case "settings.get": return this.api.getLocalSettings();
+            case "settings.validate": return this.api.validateLocalSettings(request.params.content);
+            case "settings.patch": return this.api.patchLocalSettings(request.params.patch);
+            case "settings.save": return this.api.saveLocalSettings(request.params.content);
+            case "updates.get": return this.api.getUpdates();
+            case "updates.run": return this.api.runUpdate(request.params.target);
+        }
+    }
+    send(connection, response) {
+        if (connection.readyState === FRAME_CONNECTION_OPEN)
+            connection.send(encodeBackendFrame(response));
+    }
+}
+function failure(request, error) {
+    return {
+        v: BACKEND_PROTOCOL_VERSION,
+        kind: "response",
+        id: request.id,
+        method: request.method,
+        success: false,
+        error,
+    };
+}
+function toApiError(error) {
+    if (error instanceof LocalBackendApiError)
+        return { code: error.code, message: error.message };
+    return {
+        code: "internal_error",
+        message: error instanceof Error ? error.message : String(error),
+    };
+}
+function remember(cache, id, response) {
+    if (Buffer.byteLength(response) > MAX_CACHED_RESPONSE_BYTES)
+        return;
+    cache.set(id, response);
+    if (cache.size <= MAX_COMPLETED_REQUESTS)
+        return;
+    const oldest = cache.keys().next().value;
+    if (oldest)
+        cache.delete(oldest);
+}

package/dist/server/server/backend-trust-store.js

@@ -0,0 +1,157 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+const BACKEND_TRUST_VERSION = 1;
+const DEFAULT_PAIRING_TTL_MS = 5 * 60_000;
+const MAX_PAIRING_TTL_MS = 15 * 60_000;
+export function defaultBackendTrustPath() {
+    const configDir = process.env.PIPANE_CONFIG_DIR || path.join(homedir(), ".config", "pipane");
+    return path.join(configDir, "backend-trust.json");
+}
+export class BackendTrustStore {
+    filePath;
+    now;
+    state;
+    constructor(options = {}) {
+        this.filePath = options.filePath ?? defaultBackendTrustPath();
+        this.now = options.now ?? Date.now;
+        mkdirSync(path.dirname(this.filePath), { recursive: true, mode: 0o700 });
+        this.state = loadState(this.filePath);
+        this.persist();
+    }
+    get ownerAccountId() {
+        return this.state.ownerAccountId;
+    }
+    createPairing(ttlMs = DEFAULT_PAIRING_TTL_MS) {
+        if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_PAIRING_TTL_MS) {
+            throw new Error("Pairing lifetime is outside the allowed range");
+        }
+        this.prune();
+        const secret = randomBytes(32).toString("base64url");
+        const pairing = {
+            pairId: `pair_${randomUUID()}`,
+            secretHash: hashSecret(secret),
+            expiresAt: this.now() + ttlMs,
+        };
+        this.state.pairings[pairing.pairId] = pairing;
+        this.persist();
+        return { pairId: pairing.pairId, secret, expiresAt: pairing.expiresAt };
+    }
+    listActivePairings() {
+        this.prune();
+        return Object.values(this.state.pairings)
+            .filter((pairing) => pairing.usedAt === undefined && pairing.expiresAt > this.now())
+            .map(({ pairId, expiresAt }) => ({ pairId, expiresAt }));
+    }
+    consumePairing(pairId, secret) {
+        const pairing = this.state.pairings[pairId];
+        if (!pairing || pairing.expiresAt <= this.now() || pairing.usedAt !== undefined) {
+            throw new Error("Pairing capability is missing, expired, or already used");
+        }
+        const actual = Buffer.from(hashSecret(secret));
+        const expected = Buffer.from(pairing.secretHash);
+        if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+            throw new Error("Invalid pairing secret");
+        pairing.usedAt = this.now();
+        this.persist();
+    }
+    authorizeTicket(claims) {
+        this.prune();
+        if (this.state.usedTickets[claims.ticketId] !== undefined)
+            throw new Error("Connection ticket was already used by this backend");
+        if (claims.kind === "connection") {
+            if (!claims.accountId || claims.accountId !== this.state.ownerAccountId) {
+                throw new Error("Connection ticket account does not own this backend");
+            }
+            if (this.state.revokedDevices[claims.deviceId] !== undefined)
+                throw new Error("Device authorization is revoked");
+        }
+    }
+    markTicketUsed(claims) {
+        if (this.state.usedTickets[claims.ticketId] !== undefined)
+            throw new Error("Connection ticket was already used by this backend");
+        this.state.usedTickets[claims.ticketId] = claims.expiresAt;
+        this.persist();
+    }
+    completePairing(accountId) {
+        if (this.state.ownerAccountId && this.state.ownerAccountId !== accountId) {
+            throw new Error("Backend is already owned by another account");
+        }
+        this.state.ownerAccountId = accountId;
+        this.persist();
+    }
+    applyRevocation(accountId, deviceId) {
+        if (this.state.ownerAccountId !== accountId)
+            return;
+        if (deviceId)
+            this.state.revokedDevices[deviceId] = this.now();
+        else
+            this.state.ownerAccountId = undefined;
+        this.persist();
+    }
+    prune() {
+        const now = this.now();
+        let changed = false;
+        for (const [pairId, pairing] of Object.entries(this.state.pairings)) {
+            if (pairing.expiresAt > now)
+                continue;
+            delete this.state.pairings[pairId];
+            changed = true;
+        }
+        for (const [ticketId, expiresAt] of Object.entries(this.state.usedTickets)) {
+            if (expiresAt > now)
+                continue;
+            delete this.state.usedTickets[ticketId];
+            changed = true;
+        }
+        if (changed)
+            this.persist();
+    }
+    persist() {
+        const temporaryPath = `${this.filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+        writeFileSync(temporaryPath, `${JSON.stringify(this.state, null, 2)}\n`, { mode: 0o600 });
+        renameSync(temporaryPath, this.filePath);
+        chmodSync(this.filePath, 0o600);
+    }
+}
+function loadState(filePath) {
+    try {
+        const value = JSON.parse(readFileSync(filePath, "utf8"));
+        if (!isStoredBackendTrust(value))
+            throw new Error("unsupported or malformed state");
+        return value;
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw new Error(`Invalid backend trust store: ${error instanceof Error ? error.message : String(error)}`);
+        return { version: BACKEND_TRUST_VERSION, pairings: {}, usedTickets: {}, revokedDevices: {} };
+    }
+}
+function isStoredBackendTrust(value) {
+    if (!isRecord(value) || value.version !== BACKEND_TRUST_VERSION)
+        return false;
+    return (value.ownerAccountId === undefined || isNonEmptyString(value.ownerAccountId))
+        && isRecordOf(value.pairings, (pairing, key) => isRecord(pairing)
+            && pairing.pairId === key
+            && isNonEmptyString(pairing.secretHash)
+            && isNonNegativeInteger(pairing.expiresAt)
+            && (pairing.usedAt === undefined || isNonNegativeInteger(pairing.usedAt)))
+        && isRecordOf(value.usedTickets, isNonNegativeInteger)
+        && isRecordOf(value.revokedDevices, isNonNegativeInteger);
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isRecordOf(value, predicate) {
+    return isRecord(value) && Object.entries(value).every(([key, entry]) => predicate(entry, key));
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function isNonNegativeInteger(value) {
+    return Number.isSafeInteger(value) && value >= 0;
+}
+function hashSecret(secret) {
+    return createHash("sha256").update(`pipane-pairing-secret-v1\n${secret}`).digest("base64url");
+}