profile-manager-secure 1.0.0

package/dist/modules/tailscale/tailscale.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale.controller.js","sourceRoot":"","sources":["../../../src/modules/tailscale/tailscale.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;AAExB,0BAA0B;AAC1B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,4BAA4B;AAC5B,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iCAAiC;AACjC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,sBAAsB;AACtB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6BAA6B;AAC7B,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,eAAe,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,mCAAmC;AACnC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAClE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,wCAAwC;AACxC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC"}

package/dist/modules/tailscale/tailscale.service.d.ts

@@ -0,0 +1,96 @@
+export interface TailscaleStatus {
+    installed: boolean;
+    running: boolean;
+    backendState: string;
+    ip4?: string;
+    ip6?: string;
+    deviceName?: string;
+    tailnet?: string;
+    peersCount?: number;
+    error?: string;
+    isInstalling?: boolean;
+    installProgress?: number;
+    installStatus?: string;
+    hasCert?: boolean;
+    certDomain?: string;
+    dnsName?: string;
+    magicDNSSuffix?: string;
+}
+export declare class TailscaleService {
+    private cliPath;
+    private appDataDir;
+    private tailscaleDir;
+    private socketPath;
+    private statusCache;
+    private cacheTimestamp;
+    private cacheTTL;
+    private isRefreshingStatus;
+    private watchdogInterval;
+    private desiredStateEnabled;
+    private isInstalling;
+    private installProgress;
+    private installStatus;
+    constructor();
+    private detectCli;
+    private runCli;
+    isInstalled(): Promise<boolean>;
+    /**
+     * Get cached Tailscale status to protect Event Loop
+     */
+    getStatus(): Promise<TailscaleStatus>;
+    private refreshStatusCache;
+    /**
+     * Spawn tailscaled in userspace mode if standard daemon is unavailable
+     */
+    startUserspaceDaemon(): Promise<boolean>;
+    up(options: {
+        authKey?: string;
+        acceptDns?: boolean;
+        exitNode?: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    down(): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    logout(): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    getFunnelStatus(): Promise<{
+        funnelActive: boolean;
+        serveActive: boolean;
+        funnelUrl?: string;
+        serveUrl?: string;
+    }>;
+    toggleFunnel(active: boolean): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    toggleServe(active: boolean): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    /**
+     * Provision TLS Certificate from Tailscale for secure HTTPS API access
+     */
+    provisionCert(): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    /**
+     * Download and Install Tailscale CLI silently on Windows
+     */
+    installTailscale(): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    private downloadMsi;
+    /**
+     * Watchdog checking connection health every 30 seconds
+     */
+    private startWatchdog;
+}
+export declare const tailscaleService: TailscaleService;

package/dist/modules/tailscale/tailscale.service.js

@@ -0,0 +1,561 @@
+import { spawn } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import https from 'https';
+import { logger } from '../../utils/logger.js';
+export class TailscaleService {
+    cliPath = null;
+    appDataDir;
+    tailscaleDir;
+    socketPath = null;
+    // Cache & Watchdog variables
+    statusCache = null;
+    cacheTimestamp = 0;
+    cacheTTL = 10000; // 10 seconds
+    isRefreshingStatus = false;
+    watchdogInterval = null;
+    desiredStateEnabled = false;
+    // Installer state
+    isInstalling = false;
+    installProgress = 0;
+    installStatus = '';
+    constructor() {
+        this.appDataDir = path.join(os.homedir(), '.account-manager');
+        this.tailscaleDir = path.join(this.appDataDir, 'tailscale');
+        // Create directories if they do not exist
+        if (!fs.existsSync(this.appDataDir)) {
+            fs.mkdirSync(this.appDataDir, { recursive: true });
+        }
+        if (!fs.existsSync(this.tailscaleDir)) {
+            fs.mkdirSync(this.tailscaleDir, { recursive: true });
+        }
+        this.detectCli();
+        this.startWatchdog();
+    }
+    detectCli() {
+        const commonPaths = [
+            'C:\\Program Files\\Tailscale\\tailscale.exe',
+            'C:\\Program Files (x86)\\Tailscale\\tailscale.exe'
+        ];
+        for (const p of commonPaths) {
+            if (fs.existsSync(p)) {
+                this.cliPath = p;
+                logger.info(`Tailscale CLI detected at: ${p}`);
+                return;
+            }
+        }
+        this.cliPath = 'tailscale';
+    }
+    runCli(args, options = {}) {
+        return new Promise((resolve, reject) => {
+            const bin = this.cliPath || 'tailscale';
+            const finalArgs = [...args];
+            if (this.socketPath) {
+                finalArgs.unshift(`--socket=${this.socketPath}`);
+            }
+            // Mask sensitive info (like authkey) in log output
+            const loggedArgs = finalArgs.map(arg => {
+                if (arg.startsWith('--authkey=')) {
+                    return '--authkey=********';
+                }
+                return arg;
+            });
+            logger.info(`Running Tailscale CLI command: ${bin} ${loggedArgs.join(' ')}`);
+            const child = spawn(bin, finalArgs, {
+                timeout: options.timeout || 30000,
+                windowsHide: true
+            });
+            let stdout = '';
+            let stderr = '';
+            child.stdout?.on('data', (data) => {
+                stdout += data.toString();
+            });
+            child.stderr?.on('data', (data) => {
+                stderr += data.toString();
+            });
+            child.on('close', (code) => {
+                if (code === 0) {
+                    resolve({ stdout, stderr });
+                }
+                else {
+                    const error = new Error(`Command failed with exit code ${code}`);
+                    error.stdout = stdout;
+                    error.stderr = stderr;
+                    error.code = code;
+                    reject(error);
+                }
+            });
+            child.on('error', (err) => {
+                reject(err);
+            });
+        });
+    }
+    async isInstalled() {
+        try {
+            if (this.cliPath && this.cliPath !== 'tailscale') {
+                return true;
+            }
+            await new Promise((resolve, reject) => {
+                const child = spawn(this.cliPath || 'tailscale', ['--version'], { windowsHide: true });
+                child.on('close', (code) => code === 0 ? resolve() : reject());
+                child.on('error', reject);
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Get cached Tailscale status to protect Event Loop
+     */
+    async getStatus() {
+        // If installing, return installation status
+        if (this.isInstalling) {
+            return {
+                installed: false,
+                running: false,
+                backendState: 'Installing',
+                isInstalling: true,
+                installProgress: this.installProgress,
+                installStatus: this.installStatus
+            };
+        }
+        const now = Date.now();
+        const isCacheStale = now - this.cacheTimestamp > this.cacheTTL;
+        if (this.statusCache && !isCacheStale) {
+            return this.statusCache;
+        }
+        if (this.isRefreshingStatus) {
+            return this.statusCache || { installed: false, running: false, backendState: 'Querying' };
+        }
+        // Refresh cache in background or wait if no cache exists
+        if (!this.statusCache) {
+            await this.refreshStatusCache();
+        }
+        else {
+            this.refreshStatusCache().catch((err) => logger.error('Background status refresh failed:', err));
+        }
+        return this.statusCache;
+    }
+    async refreshStatusCache() {
+        this.isRefreshingStatus = true;
+        try {
+            const installed = await this.isInstalled();
+            if (!installed) {
+                this.statusCache = { installed: false, running: false, backendState: 'NotInstalled' };
+                this.cacheTimestamp = Date.now();
+                return;
+            }
+            // Check if SSL certs exist in our certs folder
+            const certsDir = path.join(this.appDataDir, 'certs');
+            let hasCert = false;
+            let certDomain = '';
+            if (fs.existsSync(certsDir)) {
+                const files = fs.readdirSync(certsDir);
+                const crtFile = files.find(f => f.endsWith('.crt'));
+                if (crtFile) {
+                    hasCert = true;
+                    certDomain = crtFile.replace('.crt', '');
+                }
+            }
+            try {
+                const { stdout } = await this.runCli(['status', '--json'], { timeout: 4000 });
+                const statusData = JSON.parse(stdout);
+                const self = statusData.Self;
+                const backendState = statusData.BackendState;
+                // If running, mark desired state as enabled to let watchdog keep it alive
+                if (backendState === 'Running') {
+                    this.desiredStateEnabled = true;
+                }
+                this.statusCache = {
+                    installed: true,
+                    running: true,
+                    backendState,
+                    ip4: self?.TailscaleIPs?.[0] || undefined,
+                    ip6: self?.TailscaleIPs?.[1] || undefined,
+                    deviceName: self?.HostName || undefined,
+                    tailnet: statusData.CurrentTailnet?.Name || undefined,
+                    dnsName: self?.DNSName ? self.DNSName.replace(/\.$/, '') : undefined,
+                    magicDNSSuffix: statusData.MagicDNSSuffix || statusData.CurrentTailnet?.MagicDNSSuffix || undefined,
+                    peersCount: statusData.Peer ? Object.keys(statusData.Peer).length : 0,
+                    hasCert,
+                    certDomain
+                };
+            }
+            catch (error) {
+                const errMsg = error.message || '';
+                // Handle case where tailscaled daemon is not running
+                if (errMsg.includes('connect') || errMsg.includes('daemon') || errMsg.includes('tailscaled')) {
+                    this.statusCache = {
+                        installed: true,
+                        running: false,
+                        backendState: 'Stopped',
+                        error: 'Tailscale daemon is not running.',
+                        hasCert,
+                        certDomain
+                    };
+                    return;
+                }
+                // Try reading output if tailscale status failed but returned json (e.g. logged out state)
+                try {
+                    if (error.stdout) {
+                        const statusData = JSON.parse(error.stdout);
+                        const self = statusData.Self;
+                        this.statusCache = {
+                            installed: true,
+                            running: true,
+                            backendState: statusData.BackendState || 'NeedsLogin',
+                            ip4: self?.TailscaleIPs?.[0] || undefined,
+                            ip6: self?.TailscaleIPs?.[1] || undefined,
+                            deviceName: self?.HostName || undefined,
+                            tailnet: statusData.CurrentTailnet?.Name || undefined,
+                            dnsName: self?.DNSName ? self.DNSName.replace(/\.$/, '') : undefined,
+                            magicDNSSuffix: statusData.MagicDNSSuffix || statusData.CurrentTailnet?.MagicDNSSuffix || undefined,
+                            hasCert,
+                            certDomain
+                        };
+                        return;
+                    }
+                }
+                catch { }
+                this.statusCache = {
+                    installed: true,
+                    running: true,
+                    backendState: 'NeedsLogin',
+                    error: errMsg || 'Tailscale requires authentication.',
+                    hasCert,
+                    certDomain
+                };
+            }
+        }
+        finally {
+            this.cacheTimestamp = Date.now();
+            this.isRefreshingStatus = false;
+        }
+    }
+    /**
+     * Spawn tailscaled in userspace mode if standard daemon is unavailable
+     */
+    async startUserspaceDaemon() {
+        if (os.platform() !== 'win32')
+            return false; // Windows focus
+        const binPath = this.cliPath && this.cliPath !== 'tailscale'
+            ? path.join(path.dirname(this.cliPath), 'tailscaled.exe')
+            : 'tailscaled';
+        this.socketPath = path.join(this.tailscaleDir, 'tailscaled.sock');
+        logger.info(`Starting local Userspace Tailscale daemon: ${binPath}`);
+        // Kill any existing userspace tailscaled processes first
+        try {
+            await new Promise((resolve) => {
+                const child = spawn('taskkill', ['/f', '/im', 'tailscaled.exe'], { windowsHide: true });
+                child.on('close', () => resolve());
+                child.on('error', () => resolve());
+            }).catch(() => { });
+        }
+        catch { }
+        const daemonArgs = [
+            `--socket=${this.socketPath}`,
+            `--statedir=${this.tailscaleDir}`,
+            `--no-tun`
+        ];
+        const child = spawn(binPath, daemonArgs, {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true
+        });
+        child.unref();
+        // Wait 2 seconds for socket initialization
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+        // Verify it started by checking status
+        try {
+            const status = await this.getStatus();
+            return status.running;
+        }
+        catch {
+            return false;
+        }
+    }
+    async up(options) {
+        try {
+            this.desiredStateEnabled = true;
+            let status = await this.getStatus();
+            // If daemon is not running, try starting in userspace mode
+            if (!status.running) {
+                const daemonStarted = await this.startUserspaceDaemon();
+                if (!daemonStarted) {
+                    return { success: false, message: 'Không thể khởi động dịch vụ Tailscale. Hãy đảm bảo bạn đã chạy app hoặc cài đặt dịch vụ.' };
+                }
+            }
+            const cmdArgs = ['up'];
+            if (options.authKey) {
+                cmdArgs.push(`--authkey=${options.authKey}`);
+            }
+            if (options.acceptDns !== undefined) {
+                cmdArgs.push(`--accept-dns=${options.acceptDns}`);
+            }
+            if (options.exitNode) {
+                cmdArgs.push(`--exit-node=${options.exitNode}`);
+            }
+            cmdArgs.push('--reset');
+            await this.runCli(cmdArgs, { timeout: 30000 });
+            this.cacheTimestamp = 0; // Invalidate cache
+            return { success: true, message: 'Connected to Tailscale successfully' };
+        }
+        catch (error) {
+            logger.error('Failed to connect Tailscale:', error);
+            return { success: false, message: error.message || 'Failed to connect' };
+        }
+    }
+    async down() {
+        try {
+            this.desiredStateEnabled = false;
+            await this.runCli(['down']);
+            this.cacheTimestamp = 0; // Invalidate cache
+            return { success: true, message: 'Disconnected from Tailscale' };
+        }
+        catch (error) {
+            logger.error('Failed to disconnect Tailscale:', error);
+            return { success: false, message: error.message || 'Failed to disconnect' };
+        }
+    }
+    async logout() {
+        try {
+            this.desiredStateEnabled = false;
+            await this.runCli(['logout']);
+            // Clean up userspace socket if running
+            if (this.socketPath && fs.existsSync(this.socketPath)) {
+                try {
+                    fs.unlinkSync(this.socketPath);
+                }
+                catch { }
+                this.socketPath = null;
+            }
+            this.cacheTimestamp = 0; // Invalidate cache
+            return { success: true, message: 'Logged out of Tailscale' };
+        }
+        catch (error) {
+            logger.error('Failed to logout Tailscale:', error);
+            return { success: false, message: error.message || 'Failed to logout' };
+        }
+    }
+    async getFunnelStatus() {
+        try {
+            const installed = await this.isInstalled();
+            if (!installed) {
+                return { funnelActive: false, serveActive: false };
+            }
+            // 1. Run tailscale serve status --json
+            const { stdout: serveStdout } = await this.runCli(['serve', 'status', '--json']).catch(() => ({ stdout: '{}' }));
+            const serveData = JSON.parse(serveStdout || '{}');
+            // 2. Run tailscale funnel status --json
+            const { stdout: funnelStdout } = await this.runCli(['funnel', 'status', '--json']).catch(() => ({ stdout: '{}' }));
+            const funnelData = JSON.parse(funnelStdout || '{}');
+            // Fetch DNSName from status to get stable URL (avoids suffix conflicts)
+            const status = await this.getStatus();
+            const host = status.dnsName || (status.ip4 ? (status.deviceName + '.' + (status.tailnet || '')).replace(/\.$/, '') : '');
+            const serveActive = serveData.Web && Object.keys(serveData.Web).length > 0;
+            const funnelActive = funnelData.AllowFunnel && Object.keys(funnelData.AllowFunnel).length > 0;
+            return {
+                funnelActive: !!funnelActive,
+                serveActive: !!serveActive,
+                funnelUrl: funnelActive && host ? `https://${host}` : undefined,
+                serveUrl: serveActive && host ? `https://${host}` : undefined
+            };
+        }
+        catch (error) {
+            logger.error('Failed to get funnel/serve status:', error);
+            return { funnelActive: false, serveActive: false };
+        }
+    }
+    async toggleFunnel(active) {
+        try {
+            if (active) {
+                // Expose port 18823 in the background
+                await this.runCli(['funnel', '--bg', '--yes', '18823']);
+                return { success: true, message: 'Public Tunnel (Tailscale Funnel) enabled' };
+            }
+            else {
+                await this.runCli(['funnel', 'reset']);
+                return { success: true, message: 'Public Tunnel disabled' };
+            }
+        }
+        catch (error) {
+            logger.error('Failed to toggle Funnel:', error);
+            return { success: false, message: error.message || 'Failed to toggle Funnel' };
+        }
+    }
+    async toggleServe(active) {
+        try {
+            if (active) {
+                // Expose port 18823 in the background inside Tailnet
+                await this.runCli(['serve', '--bg', '--yes', '18823']);
+                return { success: true, message: 'Tailnet HTTPS Serve enabled' };
+            }
+            else {
+                await this.runCli(['serve', 'reset']);
+                return { success: true, message: 'Tailnet HTTPS Serve disabled' };
+            }
+        }
+        catch (error) {
+            logger.error('Failed to toggle Serve:', error);
+            return { success: false, message: error.message || 'Failed to toggle Serve' };
+        }
+    }
+    /**
+     * Provision TLS Certificate from Tailscale for secure HTTPS API access
+     */
+    async provisionCert() {
+        const status = await this.getStatus();
+        const domain = status.dnsName || (status.deviceName && status.magicDNSSuffix ? `${status.deviceName}.${status.magicDNSSuffix}` : '');
+        if (!status.running || !domain) {
+            return { success: false, message: 'Tailscale VPN phải hoạt động và có tên miền hợp lệ để cấp chứng chỉ TLS.' };
+        }
+        const certsDir = path.join(this.appDataDir, 'certs');
+        if (!fs.existsSync(certsDir)) {
+            fs.mkdirSync(certsDir, { recursive: true });
+        }
+        const certFile = path.join(certsDir, `${domain}.crt`);
+        const keyFile = path.join(certsDir, `${domain}.key`);
+        try {
+            logger.info(`Provisioning TLS cert for ${domain}...`);
+            await this.runCli(['cert', '--cert-file', certFile, '--key-file', keyFile, domain], { timeout: 45000 });
+            this.cacheTimestamp = 0; // Invalidate cache
+            return { success: true, message: `Cấp chứng chỉ TLS thành công cho tên miền: ${domain}` };
+        }
+        catch (error) {
+            logger.error('Failed to provision TLS certificate:', error);
+            return { success: false, message: `Lỗi cấp chứng chỉ: ${error.message || 'Unknown error'}` };
+        }
+    }
+    /**
+     * Download and Install Tailscale CLI silently on Windows
+     */
+    async installTailscale() {
+        if (this.isInstalling) {
+            return { success: false, message: 'Quá trình cài đặt đang diễn ra.' };
+        }
+        if (os.platform() !== 'win32') {
+            return { success: false, message: 'Tính năng cài đặt tự động hiện tại chỉ khả dụng trên Windows.' };
+        }
+        this.isInstalling = true;
+        this.installProgress = 0;
+        this.installStatus = 'Đang chuẩn bị tải xuống...';
+        const msiUrl = 'https://pkgs.tailscale.com/stable/tailscale-setup-latest-amd64.msi';
+        const msiPath = path.join(os.tmpdir(), 'tailscale-setup.msi');
+        // Run async install process
+        (async () => {
+            try {
+                this.installStatus = 'Đang tải bộ cài đặt Tailscale MSI (khoảng 30MB)...';
+                await this.downloadMsi(msiUrl, msiPath, (pct) => {
+                    this.installProgress = Math.round(pct * 0.7); // 70% progress for downloading
+                });
+                this.installStatus = 'Đang thực thi cài đặt ngầm. Vui lòng cấp quyền Administrator (UAC) nếu được hỏi...';
+                this.installProgress = 80;
+                const msiArgs = `'/i','${msiPath}','TS_NOLAUNCH=true','/quiet','/norestart'`;
+                const cmd = `Start-Process msiexec -ArgumentList ${msiArgs} -Verb RunAs -Wait`;
+                await new Promise((resolve, reject) => {
+                    const child = spawn('powershell', ['-NoProfile', '-NonInteractive', '-Command', cmd], {
+                        timeout: 60000,
+                        windowsHide: true
+                    });
+                    let stderr = '';
+                    child.stderr?.on('data', (d) => stderr += d.toString());
+                    child.on('close', (code) => {
+                        if (code === 0)
+                            resolve();
+                        else
+                            reject(new Error(`Powershell installation exited with code ${code}. Stderr: ${stderr}`));
+                    });
+                    child.on('error', reject);
+                });
+                this.installStatus = 'Đang kiểm tra kết quả cài đặt...';
+                this.installProgress = 95;
+                // Poll for 5 seconds to wait for file system update
+                let found = false;
+                for (let i = 0; i < 5; i++) {
+                    this.detectCli();
+                    if (this.cliPath && this.cliPath !== 'tailscale') {
+                        found = true;
+                        break;
+                    }
+                    await new Promise((r) => setTimeout(r, 1000));
+                }
+                if (!found) {
+                    throw new Error('Đã cài đặt xong nhưng không tìm thấy file tailscale.exe');
+                }
+                this.installProgress = 100;
+                this.installStatus = 'Cài đặt Tailscale hoàn tất thành công!';
+                logger.info('Tailscale silent install completed successfully.');
+            }
+            catch (error) {
+                logger.error('Tailscale silent install failed:', error);
+                this.installStatus = `Cài đặt thất bại: ${error.message || 'Unknown error'}`;
+            }
+            finally {
+                this.isInstalling = false;
+                try {
+                    if (fs.existsSync(msiPath)) {
+                        fs.unlinkSync(msiPath);
+                    }
+                }
+                catch { }
+            }
+        })();
+        return { success: true, message: 'Bắt đầu quá trình tải và cài đặt Tailscale ngầm.' };
+    }
+    downloadMsi(url, dest, onProgress) {
+        return new Promise((resolve, reject) => {
+            const file = fs.createWriteStream(dest);
+            https.get(url, (res) => {
+                if (res.statusCode !== 200) {
+                    reject(new Error(`Tải xuống thất bại với HTTP code: ${res.statusCode}`));
+                    return;
+                }
+                const total = parseInt(res.headers['content-length'] || '0', 10);
+                let downloaded = 0;
+                res.on('data', (chunk) => {
+                    downloaded += chunk.length;
+                    if (total > 0) {
+                        onProgress((downloaded / total) * 100);
+                    }
+                });
+                res.pipe(file);
+                file.on('finish', () => {
+                    file.close();
+                    resolve();
+                });
+            }).on('error', (err) => {
+                fs.unlink(dest, () => { });
+                reject(err);
+            });
+        });
+    }
+    /**
+     * Watchdog checking connection health every 30 seconds
+     */
+    startWatchdog() {
+        if (this.watchdogInterval)
+            return;
+        this.watchdogInterval = setInterval(async () => {
+            if (!this.desiredStateEnabled || this.isInstalling)
+                return;
+            try {
+                const status = await this.getStatus();
+                // If it is stopped unexpectedly, try to bring it up in userspace
+                if (status.installed && status.backendState === 'Stopped') {
+                    logger.warn('[Tailscale Watchdog] Service stopped unexpectedly, attempting self-healing...');
+                    await this.up({ acceptDns: true });
+                }
+            }
+            catch (err) {
+                logger.error('[Tailscale Watchdog] Error checking connection state:', err);
+            }
+        }, 30000);
+        // Make sure interval doesn't hold the process open
+        this.watchdogInterval.unref();
+    }
+}
+export const tailscaleService = new TailscaleService();
+//# sourceMappingURL=tailscale.service.js.map