pipane 0.1.6 → 0.1.8

package/dist/server/rendezvous/trust-store.js

@@ -0,0 +1,432 @@
+import { createHmac, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, randomUUID, sign, } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { CONNECTION_TICKET_VERSION, connectionTicketSignaturePayload, deviceChallengePayload, TRUST_PROTOCOL_VERSION, } from "../shared/trust-protocol.js";
+import { assertP256Key, deriveDeviceId, verifyConnectionTicket, verifyDeviceSignature, } from "../shared/node-trust-crypto.js";
+export { deriveDeviceId, verifyConnectionTicket, verifyDeviceSignature } from "../shared/node-trust-crypto.js";
+const STORE_VERSION = 1;
+const SIGNING_IDENTITY_VERSION = 1;
+const ACCOUNT_ID_PREFIX = "a_";
+const TICKET_ID_PREFIX = "t_";
+const CHALLENGE_ID_PREFIX = "ch_";
+const DEFAULT_CHALLENGE_TTL_MS = 2 * 60_000;
+const DEFAULT_TICKET_TTL_MS = 60_000;
+export class IceServerProvider {
+    staticServers;
+    turn;
+    now;
+    constructor(staticServers = [], turn, now = Date.now) {
+        this.staticServers = staticServers;
+        this.turn = turn;
+        this.now = now;
+    }
+    issue(subject) {
+        const result = this.staticServers.map((server) => ({
+            ...server,
+            urls: Array.isArray(server.urls) ? [...server.urls] : server.urls,
+        }));
+        if (!this.turn || this.turn.urls.length === 0)
+            return result;
+        const expiresAtSeconds = Math.floor(this.now() / 1000) + (this.turn.ttlSeconds ?? 600);
+        const username = `${expiresAtSeconds}:${subject}`;
+        const credential = createHmac("sha1", this.turn.secret).update(username).digest("base64");
+        result.push({ urls: [...this.turn.urls], username, credential });
+        return result;
+    }
+}
+export class RendezvousTrustStore {
+    ticketPublicKey;
+    now;
+    challengeTtlMs;
+    ticketTtlMs;
+    statePath;
+    signing;
+    challenges = new Map();
+    state;
+    constructor(options = {}) {
+        const dataDir = options.dataDir ?? process.env.PIPANE_RENDEZVOUS_DATA_DIR ?? path.join(homedir(), ".config", "pipane-rendezvous");
+        mkdirSync(dataDir, { recursive: true, mode: 0o700 });
+        this.now = options.now ?? Date.now;
+        this.challengeTtlMs = options.challengeTtlMs ?? DEFAULT_CHALLENGE_TTL_MS;
+        this.ticketTtlMs = options.ticketTtlMs ?? DEFAULT_TICKET_TTL_MS;
+        this.statePath = path.join(dataDir, "trust-store.json");
+        this.signing = loadOrCreateSigningIdentity(path.join(dataDir, "ticket-identity.json"));
+        this.ticketPublicKey = this.signing.publicKey;
+        this.state = loadTrustState(this.statePath);
+        this.persist();
+    }
+    createChallenge(request) {
+        this.prune();
+        this.validateChallengeContext(request);
+        const identity = this.resolveChallengeIdentity(request);
+        const challenge = {
+            version: TRUST_PROTOCOL_VERSION,
+            challengeId: `${CHALLENGE_ID_PREFIX}${randomUUID()}`,
+            nonce: randomBytes(32).toString("base64url"),
+            purpose: request.purpose,
+            deviceId: identity.deviceId,
+            devicePublicKey: identity.publicKey,
+            backendId: request.backendId,
+            connectionId: request.connectionId,
+            pairId: request.pairId,
+            targetDeviceId: request.targetDeviceId,
+            expiresAt: this.now() + this.challengeTtlMs,
+        };
+        this.challenges.set(challenge.challengeId, challenge);
+        return challenge;
+    }
+    issuePairingTicket(challengeId, signature) {
+        const challenge = this.consumeChallenge(challengeId, signature, "pair");
+        const device = this.state.devices[challenge.deviceId];
+        const claims = {
+            version: CONNECTION_TICKET_VERSION,
+            kind: "pairing",
+            ticketId: `${TICKET_ID_PREFIX}${randomUUID()}`,
+            backendId: challenge.backendId,
+            connectionId: challenge.connectionId,
+            deviceId: challenge.deviceId,
+            devicePublicKey: challenge.devicePublicKey,
+            ...(device ? { accountId: device.accountId } : {}),
+            pairId: challenge.pairId,
+            issuedAt: this.now(),
+            expiresAt: this.now() + this.ticketTtlMs,
+        };
+        return { ticket: this.signTicket(claims), claims };
+    }
+    issueConnectionTicket(challengeId, signature) {
+        const challenge = this.consumeChallenge(challengeId, signature, "connect");
+        const device = this.requireActiveDevice(challenge.deviceId);
+        if (this.state.backendOwners[challenge.backendId] !== device.accountId) {
+            throw new Error("Device account is not authorized for this backend");
+        }
+        const claims = {
+            version: CONNECTION_TICKET_VERSION,
+            kind: "connection",
+            ticketId: `${TICKET_ID_PREFIX}${randomUUID()}`,
+            backendId: challenge.backendId,
+            connectionId: challenge.connectionId,
+            deviceId: device.deviceId,
+            devicePublicKey: device.publicKey,
+            accountId: device.accountId,
+            issuedAt: this.now(),
+            expiresAt: this.now() + this.ticketTtlMs,
+        };
+        return { ticket: this.signTicket(claims), claims };
+    }
+    verifyTicket(ticket) {
+        return verifyConnectionTicket(ticket, this.ticketPublicKey, this.now());
+    }
+    consumeRouteTicket(ticket) {
+        const claims = this.verifyTicket(ticket);
+        this.prune();
+        if (this.state.usedTickets[claims.ticketId] !== undefined)
+            throw new Error("Connection ticket was already used");
+        this.state.usedTickets[claims.ticketId] = claims.expiresAt;
+        this.persist();
+        return claims;
+    }
+    confirmPairing(claims) {
+        if (claims.kind !== "pairing" || !claims.pairId)
+            throw new Error("Connection is not a pairing attempt");
+        const prior = this.state.pairingCompletions[claims.pairId];
+        if (prior) {
+            if (prior.ticketId !== claims.ticketId)
+                throw new Error("Pairing capability was already used");
+            return { accountId: prior.accountId, deviceId: prior.deviceId, backendId: prior.backendId };
+        }
+        const currentOwner = this.state.backendOwners[claims.backendId];
+        let accountId = claims.accountId ?? currentOwner;
+        if (claims.accountId && currentOwner && claims.accountId !== currentOwner) {
+            throw new Error("Backend is owned by another account");
+        }
+        const existingDevice = this.state.devices[claims.deviceId];
+        if (existingDevice?.revokedAt)
+            throw new Error("Device is revoked");
+        if (existingDevice && existingDevice.publicKey !== claims.devicePublicKey)
+            throw new Error("Device public key mismatch");
+        if (existingDevice && claims.accountId !== existingDevice.accountId)
+            throw new Error("Device account mismatch");
+        if (!accountId)
+            accountId = `${ACCOUNT_ID_PREFIX}${randomUUID()}`;
+        if (existingDevice && existingDevice.accountId !== accountId)
+            throw new Error("Device belongs to another account");
+        const account = this.state.accounts[accountId] ?? {
+            accountId,
+            deviceIds: [],
+            backendIds: [],
+            createdAt: this.now(),
+        };
+        if (!account.deviceIds.includes(claims.deviceId))
+            account.deviceIds.push(claims.deviceId);
+        if (!account.backendIds.includes(claims.backendId))
+            account.backendIds.push(claims.backendId);
+        this.state.accounts[accountId] = account;
+        this.state.devices[claims.deviceId] = existingDevice ?? {
+            deviceId: claims.deviceId,
+            publicKey: claims.devicePublicKey,
+            accountId,
+            createdAt: this.now(),
+        };
+        this.state.backendOwners[claims.backendId] = accountId;
+        delete this.state.backendRevocations[claims.backendId];
+        this.state.pairingCompletions[claims.pairId] = {
+            pairId: claims.pairId,
+            ticketId: claims.ticketId,
+            accountId,
+            deviceId: claims.deviceId,
+            backendId: claims.backendId,
+            completedAt: this.now(),
+        };
+        this.persist();
+        return { accountId, deviceId: claims.deviceId, backendId: claims.backendId };
+    }
+    listAuthorizedBackendIds(challengeId, signature) {
+        const challenge = this.consumeChallenge(challengeId, signature, "discover");
+        const device = this.requireActiveDevice(challenge.deviceId);
+        return [...this.state.accounts[device.accountId].backendIds];
+    }
+    revokeDevice(challengeId, signature) {
+        const challenge = this.consumeChallenge(challengeId, signature, "revoke_device");
+        const actor = this.requireActiveDevice(challenge.deviceId);
+        const target = this.state.devices[challenge.targetDeviceId];
+        if (!target || target.accountId !== actor.accountId)
+            throw new Error("Target device does not belong to this account");
+        target.revokedAt = this.now();
+        this.persist();
+        return { accountId: actor.accountId, deviceId: target.deviceId };
+    }
+    revokeBackend(challengeId, signature) {
+        const challenge = this.consumeChallenge(challengeId, signature, "revoke_backend");
+        const actor = this.requireActiveDevice(challenge.deviceId);
+        if (this.state.backendOwners[challenge.backendId] !== actor.accountId) {
+            throw new Error("Backend does not belong to this account");
+        }
+        delete this.state.backendOwners[challenge.backendId];
+        this.state.backendRevocations[challenge.backendId] = { accountId: actor.accountId, revokedAt: this.now() };
+        const account = this.state.accounts[actor.accountId];
+        account.backendIds = account.backendIds.filter((backendId) => backendId !== challenge.backendId);
+        this.persist();
+        return { accountId: actor.accountId, backendId: challenge.backendId };
+    }
+    isDeviceActive(deviceId) {
+        const device = this.state.devices[deviceId];
+        return !!device && device.revokedAt === undefined;
+    }
+    getBackendOwner(backendId) {
+        return this.state.backendOwners[backendId];
+    }
+    getPendingBackendRevocation(backendId) {
+        const revocation = this.state.backendRevocations[backendId];
+        return revocation ? { accountId: revocation.accountId, backendId } : undefined;
+    }
+    consumeChallenge(challengeId, signature, expectedPurpose) {
+        const challenge = this.challenges.get(challengeId);
+        this.challenges.delete(challengeId);
+        if (!challenge || challenge.expiresAt <= this.now())
+            throw new Error("Device challenge is missing or expired");
+        if (challenge.purpose !== expectedPurpose)
+            throw new Error("Device challenge has the wrong purpose");
+        if (!verifyDeviceSignature(challenge.devicePublicKey, deviceChallengePayload(challenge), signature)) {
+            throw new Error("Invalid device challenge signature");
+        }
+        return challenge;
+    }
+    resolveChallengeIdentity(request) {
+        if (request.deviceId) {
+            const device = this.state.devices[request.deviceId];
+            if (device) {
+                if (device.revokedAt !== undefined)
+                    throw new Error("Device is unknown or revoked");
+                if (request.devicePublicKey && request.devicePublicKey !== device.publicKey)
+                    throw new Error("Device public key mismatch");
+                return { deviceId: device.deviceId, publicKey: device.publicKey };
+            }
+            if (request.purpose === "pair" && request.devicePublicKey && deriveDeviceId(request.devicePublicKey) === request.deviceId) {
+                return { deviceId: request.deviceId, publicKey: request.devicePublicKey };
+            }
+            throw new Error("Device is unknown or revoked");
+        }
+        if (request.purpose !== "pair" || !request.devicePublicKey) {
+            throw new Error("An existing device is required for this challenge");
+        }
+        return { deviceId: deriveDeviceId(request.devicePublicKey), publicKey: request.devicePublicKey };
+    }
+    validateChallengeContext(request) {
+        if (request.purpose !== "pair"
+            && request.purpose !== "connect"
+            && request.purpose !== "discover"
+            && request.purpose !== "revoke_device"
+            && request.purpose !== "revoke_backend") {
+            throw new Error("Unsupported device challenge purpose");
+        }
+        if (request.purpose !== "discover" && !request.backendId)
+            throw new Error("backendId is required");
+        if (request.purpose === "pair" || request.purpose === "connect") {
+            if (!request.connectionId)
+                throw new Error("connectionId is required");
+        }
+        if (request.purpose === "pair" && !request.pairId)
+            throw new Error("pairId is required");
+        if (request.purpose === "revoke_device" && !request.targetDeviceId)
+            throw new Error("targetDeviceId is required");
+    }
+    requireActiveDevice(deviceId) {
+        const device = this.state.devices[deviceId];
+        if (!device || device.revokedAt !== undefined)
+            throw new Error("Device is unknown or revoked");
+        return device;
+    }
+    signTicket(claims) {
+        const encodedClaims = Buffer.from(JSON.stringify(claims)).toString("base64url");
+        const signature = sign("sha256", Buffer.from(connectionTicketSignaturePayload(encodedClaims)), {
+            key: this.signing.privateKey,
+            dsaEncoding: "ieee-p1363",
+        }).toString("base64url");
+        return `${encodedClaims}.${signature}`;
+    }
+    prune() {
+        const now = this.now();
+        for (const [challengeId, challenge] of this.challenges) {
+            if (challenge.expiresAt <= now)
+                this.challenges.delete(challengeId);
+        }
+        let changed = false;
+        for (const [ticketId, expiresAt] of Object.entries(this.state.usedTickets)) {
+            if (expiresAt > now)
+                continue;
+            delete this.state.usedTickets[ticketId];
+            changed = true;
+        }
+        if (changed)
+            this.persist();
+    }
+    persist() {
+        const temporaryPath = `${this.statePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+        writeFileSync(temporaryPath, `${JSON.stringify(this.state, null, 2)}\n`, { mode: 0o600 });
+        renameSync(temporaryPath, this.statePath);
+        chmodSync(this.statePath, 0o600);
+    }
+}
+function loadOrCreateSigningIdentity(filePath) {
+    let stored;
+    try {
+        stored = JSON.parse(readFileSync(filePath, "utf8"));
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw new Error(`Invalid rendezvous signing identity: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!stored) {
+        const { privateKey } = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+        stored = {
+            version: SIGNING_IDENTITY_VERSION,
+            algorithm: "ES256",
+            privateKey: Buffer.from(privateKey.export({ type: "pkcs8", format: "der" })).toString("base64url"),
+        };
+        writeFileSync(filePath, `${JSON.stringify(stored, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    }
+    if (stored.version !== SIGNING_IDENTITY_VERSION || stored.algorithm !== "ES256" || typeof stored.privateKey !== "string") {
+        throw new Error("Invalid rendezvous signing identity");
+    }
+    chmodSync(filePath, 0o600);
+    const privateKey = createPrivateKey({ key: Buffer.from(stored.privateKey, "base64url"), format: "der", type: "pkcs8" });
+    assertP256Key(privateKey);
+    const publicKeyObject = createPublicKey(privateKey.export({ type: "pkcs8", format: "pem" }));
+    assertP256Key(publicKeyObject);
+    return {
+        privateKey,
+        publicKey: Buffer.from(publicKeyObject.export({ type: "spki", format: "der" })).toString("base64url"),
+    };
+}
+function loadTrustState(filePath) {
+    try {
+        const value = JSON.parse(readFileSync(filePath, "utf8"));
+        if (!isTrustState(value))
+            throw new Error("unsupported or malformed state");
+        value.backendRevocations ??= {};
+        if (!hasConsistentReferences(value))
+            throw new Error("unsupported or malformed state");
+        return value;
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw new Error(`Invalid rendezvous trust store: ${error instanceof Error ? error.message : String(error)}`);
+        return {
+            version: STORE_VERSION,
+            accounts: {},
+            devices: {},
+            backendOwners: {},
+            backendRevocations: {},
+            pairingCompletions: {},
+            usedTickets: {},
+        };
+    }
+}
+function isTrustState(value) {
+    if (!isRecord(value) || value.version !== STORE_VERSION)
+        return false;
+    return isRecordOf(value.accounts, (account, key) => isRecord(account)
+        && account.accountId === key
+        && isStringArray(account.deviceIds)
+        && isStringArray(account.backendIds)
+        && isNonNegativeInteger(account.createdAt))
+        && isRecordOf(value.devices, (device, key) => isRecord(device)
+            && device.deviceId === key
+            && isNonEmptyString(device.publicKey)
+            && isNonEmptyString(device.accountId)
+            && isNonNegativeInteger(device.createdAt)
+            && (device.revokedAt === undefined || isNonNegativeInteger(device.revokedAt)))
+        && isRecordOf(value.backendOwners, (accountId) => isNonEmptyString(accountId))
+        && (value.backendRevocations === undefined || isRecordOf(value.backendRevocations, (revocation) => isRecord(revocation)
+            && isNonEmptyString(revocation.accountId)
+            && isNonNegativeInteger(revocation.revokedAt)))
+        && isRecordOf(value.pairingCompletions, (completion, key) => isRecord(completion)
+            && completion.pairId === key
+            && isNonEmptyString(completion.ticketId)
+            && isNonEmptyString(completion.accountId)
+            && isNonEmptyString(completion.deviceId)
+            && isNonEmptyString(completion.backendId)
+            && isNonNegativeInteger(completion.completedAt))
+        && isRecordOf(value.usedTickets, (expiresAt) => isNonNegativeInteger(expiresAt));
+}
+function hasConsistentReferences(state) {
+    try {
+        for (const device of Object.values(state.devices)) {
+            if (deriveDeviceId(device.publicKey) !== device.deviceId)
+                return false;
+            const account = state.accounts[device.accountId];
+            if (!account?.deviceIds.includes(device.deviceId))
+                return false;
+        }
+        for (const account of Object.values(state.accounts)) {
+            if (account.deviceIds.some((deviceId) => state.devices[deviceId]?.accountId !== account.accountId))
+                return false;
+            if (account.backendIds.some((backendId) => state.backendOwners[backendId] !== account.accountId))
+                return false;
+        }
+        for (const [backendId, accountId] of Object.entries(state.backendOwners)) {
+            if (!state.accounts[accountId]?.backendIds.includes(backendId))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isRecordOf(value, predicate) {
+    return isRecord(value) && Object.entries(value).every(([key, entry]) => predicate(entry, key));
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every(isNonEmptyString);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function isNonNegativeInteger(value) {
+    return Number.isSafeInteger(value) && value >= 0;
+}

package/dist/server/server/auth-guard.js

@@ -0,0 +1,61 @@
+const AUTH_COOKIE_NAME = "pipane_auth";
+export class AuthGuard {
+    token;
+    disableLocalBypass;
+    secureCookie;
+    constructor(options) {
+        this.token = options.token;
+        this.disableLocalBypass = options.disableLocalBypass ?? false;
+        this.secureCookie = options.secureCookie ?? false;
+    }
+    parseCookies(header) {
+        const cookies = {};
+        if (!header)
+            return cookies;
+        for (const part of header.split(";")) {
+            const separator = part.indexOf("=");
+            if (separator <= 0)
+                continue;
+            const key = part.slice(0, separator).trim();
+            const value = part.slice(separator + 1).trim();
+            cookies[key] = decodeURIComponent(value);
+        }
+        return cookies;
+    }
+    isLocalRequest(req) {
+        if (this.disableLocalBypass)
+            return false;
+        const address = req.socket.remoteAddress;
+        return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+    }
+    setAuthCookie(res) {
+        const secure = this.secureCookie ? "; Secure" : "";
+        const maxAgeSeconds = 60 * 60 * 24 * 30;
+        res.setHeader("Set-Cookie", `${AUTH_COOKIE_NAME}=${encodeURIComponent(this.token)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSeconds}${secure}`);
+    }
+    isAuthorizedRequest(req) {
+        if (this.isLocalRequest(req))
+            return true;
+        return this.parseCookies(req.headers.cookie)[AUTH_COOKIE_NAME] === this.token;
+    }
+    register(app) {
+        app.get("/auth", (req, res) => {
+            const token = typeof req.query.token === "string" ? req.query.token : undefined;
+            if (this.isLocalRequest(req) || token === this.token) {
+                this.setAuthCookie(res);
+                res.redirect("/");
+                return;
+            }
+            res.status(401).type("html").send("<h3>Unauthorized</h3><p>Invalid auth token.</p>");
+        });
+        app.use((req, res, next) => {
+            if (this.isAuthorizedRequest(req)) {
+                if (this.isLocalRequest(req))
+                    this.setAuthCookie(res);
+                next();
+                return;
+            }
+            res.status(401).type("html").send("<h3>Unauthorized</h3><p>Open the one-time auth URL shown in the pipane terminal.</p>");
+        });
+    }
+}

package/dist/server/server/backend-connection-authorizer.js

@@ -0,0 +1,29 @@
+export class BackendConnectionAuthorizer {
+    trustStore;
+    signaling;
+    constructor(trustStore, signaling) {
+        this.trustStore = trustStore;
+        this.signaling = signaling;
+    }
+    async authorize(context) {
+        const { claims } = context;
+        this.trustStore.authorizeTicket(claims);
+        let accountId;
+        if (claims.kind === "pairing") {
+            if (!claims.pairId || !context.pairingSecret)
+                throw new Error("Pairing secret is required");
+            this.trustStore.consumePairing(claims.pairId, context.pairingSecret);
+            const confirmation = await this.signaling.confirmPairing(claims.connectionId);
+            if (confirmation.pairId !== claims.pairId || confirmation.deviceId !== claims.deviceId) {
+                throw new Error("Rendezvous pairing confirmation does not match the connection ticket");
+            }
+            this.trustStore.completePairing(confirmation.accountId);
+            accountId = confirmation.accountId;
+        }
+        else {
+            accountId = claims.accountId;
+        }
+        this.trustStore.markTicketUsed(claims);
+        return { accountId, deviceId: claims.deviceId };
+    }
+}