rdsh-gateway 0.1.0 → 0.2.0

package/dist/server.d.ts

@@ -1,14 +1,23 @@
 /**
- * server.ts — HTTP 服务器 + 认证中间件 + 路由。
+ * server.ts — HTTP(S) 服务器 + 认证中间件 + 路由。
  *
  * 路由：
- *   GET  /pair        → 配对页
- *   POST /pair        → 校验配对码（成功 Set-Cookie + 302 /；失败 401/429）
- *   其余路径（含 upgrade）→ 有有效会话转发 dsh；无 → 307 /pair
+ *   GET  /pair         → 配对页（auth.mode=pair）
+ *   POST /pair         → 校验配对码（成功 Set-Cookie + 302 /；失败 401/429）
+ *   GET  /login        → 登录页（auth.mode=password）
+ *   POST /login        → 校验用户名/密码（成功 Set-Cookie + 302 /；失败 401/429）
+ *   其余路径（含 upgrade）→ 有有效会话转发 dsh；无 → 307 /pair 或 /login
+ *
+ * M2：TLS（node:https）、auth.mode（pair/password/none）、IP 白名单（allowFrom）、
+ * 反代适配（behindProxy：X-Forwarded-For/Proto）、改密版本化会话（auth.version）。
  */
-import { createServer } from "node:http";
+import { createServer as createHttpServer } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
 import { SessionManager } from "./session.ts";
 import { PairManager } from "./pair.ts";
+import { UserManager } from "./auth.ts";
+import type { AuthMode } from "./config.ts";
+import type { TlsMaterial } from "./tls.ts";
 export interface GatewayOptions {
     host: string;
     port: number;
@@ -19,14 +28,30 @@ export interface GatewayOptions {
     reset?: boolean;
     /** 会话密钥目录（默认 ~/.rdsh；测试可注入临时目录） */
     keyDir?: string;
-    /** true = 跳过配对码认证（仅限完全可信网络！启动会打印警告） */
+    /** true = 跳过认证（--no-code / auth.mode=none） */
     noCode?: boolean;
+    /** M2：认证模式（pair | password | none）；默认 noCode? none : pair */
+    authMode?: AuthMode;
+    /** M2：改密版本号（会话校验绑定）；默认 1 */
+    authVersion?: number;
+    /** M2：IP 白名单（CIDR）；空 = 不限制 */
+    allowFrom?: string[];
+    /** M2：反代终止 TLS（信任 XFF，允许 password+http） */
+    behindProxy?: boolean;
+    /** M2：TLS 材料；提供则 https */
+    tlsMaterial?: TlsMaterial | null;
+    /** M2：password 模式验证用户 */
+    userManager?: UserManager;
+    /** M2：配置文件路径（fs.watch 热更新 auth.version/allowFrom） */
+    configPath?: string;
 }
 export interface RunningGateway {
-    server: ReturnType<typeof createServer>;
+    server: ReturnType<typeof createHttpServer> | ReturnType<typeof createHttpsServer>;
     sessions: SessionManager;
     pair: PairManager;
     /** 实际监听端口（port 0 → OS 分配） */
     actualPort: number;
+    /** 关闭 fs.watch 等资源 */
+    dispose(): void;
 }
 export declare function startGateway(opts: GatewayOptions): Promise<RunningGateway>;

package/dist/server.js

@@ -1,17 +1,30 @@
 /**
- * server.ts — HTTP 服务器 + 认证中间件 + 路由。
+ * server.ts — HTTP(S) 服务器 + 认证中间件 + 路由。
  *
  * 路由：
- *   GET  /pair        → 配对页
- *   POST /pair        → 校验配对码（成功 Set-Cookie + 302 /；失败 401/429）
- *   其余路径（含 upgrade）→ 有有效会话转发 dsh；无 → 307 /pair
+ *   GET  /pair         → 配对页（auth.mode=pair）
+ *   POST /pair         → 校验配对码（成功 Set-Cookie + 302 /；失败 401/429）
+ *   GET  /login        → 登录页（auth.mode=password）
+ *   POST /login        → 校验用户名/密码（成功 Set-Cookie + 302 /；失败 401/429）
+ *   其余路径（含 upgrade）→ 有有效会话转发 dsh；无 → 307 /pair 或 /login
+ *
+ * M2：TLS（node:https）、auth.mode（pair/password/none）、IP 白名单（allowFrom）、
+ * 反代适配（behindProxy：X-Forwarded-For/Proto）、改密版本化会话（auth.version）。
  */
-import { createServer } from "node:http";
+import { createServer as createHttpServer } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
+import { watch } from "node:fs";
+import { basename, dirname } from "node:path";
 import { SessionManager, sessionTokenFromCookie } from "./session.js";
 import { PairManager } from "./pair.js";
 import { createUpgradeProxy, forwardHttp } from "./proxy.js";
 import { pairPageHtml } from "./pair-page.js";
+import { loginPageHtml } from "./login-page.js";
 import { SECURE_CONTEXT_POLYFILL } from "./secure-context-polyfill.js";
+import { loadConfig } from "./config.js";
+import { ipInCidrs } from "./cidr.js";
+const MAX_LOGIN_FAILS = 5;
+const LOGIN_LOCK_MS = 10 * 60 * 1000;
 export async function startGateway(opts) {
     const sessions = new SessionManager(opts.keyDir);
     if (opts.reset) {
@@ -22,24 +35,58 @@ export async function startGateway(opts) {
     }
     const pair = new PairManager(opts.pairCode);
     const target = { host: "127.0.0.1", port: opts.dshPort };
-    const upgradeProxy = createUpgradeProxy(target);
+    const authMode = opts.noCode ? "none" : (opts.authMode ?? "pair");
+    const behindProxy = opts.behindProxy === true;
+    // 安全硬约束：password 模式必须 TLS（反代除外）
+    if (authMode === "password" && !behindProxy && (opts.tlsMaterial === undefined || opts.tlsMaterial === null)) {
+        throw new Error('auth.mode=password requires TLS. Set tls.cert/key in config, or use behind_proxy with a reverse proxy.');
+    }
+    // 可变状态：config 热更新（改密版本 / IP 白名单）
+    let currentVersion = opts.authVersion ?? 1;
+    let currentAllowFrom = opts.allowFrom ?? [];
+    let configWatcher;
+    if (opts.configPath !== undefined) {
+        const configPath = opts.configPath;
+        const reload = () => {
+            void loadConfig(configPath).then((cfg) => {
+                currentVersion = cfg.auth.version;
+                currentAllowFrom = cfg.allowFrom;
+            }).catch(() => {
+                /* 配置暂不可读，保持旧值 */
+            });
+        };
+        // 监听目录而非文件：`rdsh user passwd` 用 tmp+rename 原子替换 config，
+        // 文件级 watch 会跟丢（macOS kqueue 盯的是旧 inode）。目录 vnode 稳定。
+        configWatcher = watch(dirname(configPath), (_event, filename) => {
+            if (filename === basename(configPath) || filename === null)
+                reload();
+        });
+    }
     const ctx = {
         sessions,
         pair,
         target,
         sessionTtlSeconds: opts.sessionTtlSeconds,
-        noCode: opts.noCode === true,
+        authMode,
+        behindProxy,
+        getVersion: () => currentVersion,
+        isAllowed: (ip) => currentAllowFrom.length === 0 || ipInCidrs(ip, currentAllowFrom),
+        userManager: opts.userManager,
     };
-    const server = createServer((req, res) => {
-        void handleHttp(req, res, ctx).catch(() => {
+    const loginLimiter = createLoginLimiter();
+    const requestHandler = (req, res) => {
+        void handleHttp(req, res, ctx, loginLimiter).catch(() => {
             if (!res.headersSent)
                 res.writeHead(500);
             res.end();
         });
-    });
+    };
+    const server = opts.tlsMaterial === undefined || opts.tlsMaterial === null
+        ? createHttpServer(requestHandler)
+        : createHttpsServer({ key: opts.tlsMaterial.key, cert: opts.tlsMaterial.cert }, requestHandler);
     server.on("upgrade", (req, socket, head) => {
-        if (!ctx.noCode && !hasValidSession(req, sessions)) {
-            socket.write("HTTP/1.1 307 Temporary Redirect\r\nLocation: /pair\r\n\r\n");
+        if (ctx.authMode !== "none" && !hasValidSession(req, ctx)) {
+            socket.write(`HTTP/1.1 307 Temporary Redirect\r\nLocation: ${pairOrLogin(ctx)}\r\n\r\n`);
             socket.destroy();
             return;
         }
@@ -51,25 +98,68 @@ export async function startGateway(opts) {
     });
     const address = server.address();
     const actualPort = typeof address === "object" && address !== null ? address.port : opts.port;
-    return { server, sessions, pair, actualPort };
+    const upgradeProxy = createUpgradeProxy(target);
+    return {
+        server,
+        sessions,
+        pair,
+        actualPort,
+        dispose: () => {
+            configWatcher?.close();
+        },
+    };
+}
+function pairOrLogin(ctx) {
+    return ctx.authMode === "password" ? "/login" : "/pair";
 }
-function hasValidSession(req, sessions) {
+function hasValidSession(req, ctx) {
     const token = sessionTokenFromCookie(req.headers.cookie);
-    return token !== null && sessions.verify(token) !== null;
+    return token !== null && ctx.sessions.verify(token, ctx.getVersion()) !== null;
+}
+/** 客户端真实 IP（behindProxy 时取 XFF，仅当连接来自回环 —— 防伪造）。 */
+function clientIp(req, ctx) {
+    const remote = req.socket.remoteAddress ?? "unknown";
+    if (ctx.behindProxy && (remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1")) {
+        const xff = req.headers["x-forwarded-for"];
+        if (typeof xff === "string" && xff.length > 0) {
+            return xff.split(",")[0].trim();
+        }
+    }
+    return remote;
 }
-async function handleHttp(req, res, ctx) {
+async function handleHttp(req, res, ctx, loginLimiter) {
+    // IP 白名单（认证前）
+    if (!ctx.isAllowed(clientIp(req, ctx))) {
+        res.writeHead(403, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: { code: "FORBIDDEN", message: "source IP not allowed" } }));
+        return;
+    }
     const pathname = new URL(req.url ?? "/", "http://rdsh.local").pathname;
-    if (req.method === "GET" && pathname === "/pair") {
+    const isLoginMode = ctx.authMode === "password";
+    if (req.method === "GET" && pathname === "/pair" && !isLoginMode) {
         res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
         res.end(pairPageHtml());
         return;
     }
-    if (req.method === "POST" && pathname === "/pair") {
+    if (req.method === "POST" && pathname === "/pair" && !isLoginMode) {
         await handlePairPost(req, res, ctx);
         return;
     }
-    if (!ctx.noCode && !hasValidSession(req, ctx.sessions)) {
-        res.writeHead(307, { location: "/pair" });
+    if (req.method === "GET" && pathname === "/login" && isLoginMode) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+        res.end(loginPageHtml());
+        return;
+    }
+    if (req.method === "POST" && pathname === "/login" && isLoginMode) {
+        await handleLoginPost(req, res, ctx, loginLimiter);
+        return;
+    }
+    if (ctx.authMode === "none") {
+        forwardHttp(req, res, ctx.target, { htmlInject: SECURE_CONTEXT_POLYFILL });
+        return;
+    }
+    if (!hasValidSession(req, ctx)) {
+        res.writeHead(307, { location: pairOrLogin(ctx) });
         res.end();
         return;
     }
@@ -77,24 +167,13 @@ async function handleHttp(req, res, ctx) {
 }
 async function handlePairPost(req, res, ctx) {
     const ip = req.socket.remoteAddress ?? "unknown";
-    let body = "";
-    for await (const chunk of req) {
-        body += chunk;
-        if (body.length > 1024) {
-            res.writeHead(413, { "content-type": "application/json" });
-            res.end(JSON.stringify({ error: { code: "TOO_LARGE", message: "body too large" } }));
-            return;
-        }
-    }
-    let code;
-    try {
-        code = JSON.parse(body).code;
-    }
-    catch {
+    const body = await readJsonBody(req);
+    if (body === null) {
         res.writeHead(400, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "invalid body" } }));
         return;
     }
+    const code = body.code;
     if (typeof code !== "string" || code.length > 16) {
         res.writeHead(400, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "invalid code" } }));
@@ -104,21 +183,101 @@ async function handlePairPost(req, res, ctx) {
     if (result.ok) {
         res.writeHead(302, {
             location: "/",
-            "set-cookie": ctx.sessions.cookieHeader(ctx.sessionTtlSeconds),
+            "set-cookie": ctx.sessions.cookieHeader(ctx.sessionTtlSeconds, ctx.getVersion()),
         });
         res.end();
         return;
     }
     if (result.locked) {
         const retryAfter = Math.max(1, Math.ceil(result.retryAfterMs / 1000));
-        res.writeHead(429, {
-            "content-type": "application/json",
-            "retry-after": String(retryAfter),
-        });
+        res.writeHead(429, { "content-type": "application/json", "retry-after": String(retryAfter) });
         res.end(JSON.stringify({ error: { code: "RATE_LIMITED", message: "too many attempts" } }));
         return;
     }
     res.writeHead(401, { "content-type": "application/json" });
     res.end(JSON.stringify({ error: { code: "BAD_CODE", message: "invalid pair code" } }));
 }
+async function handleLoginPost(req, res, ctx, loginLimiter) {
+    const ip = clientIp(req, ctx);
+    const lockedMs = loginLimiter.allow(ip);
+    if (lockedMs > 0) {
+        res.writeHead(429, { "content-type": "application/json", "retry-after": String(Math.ceil(lockedMs / 1000)) });
+        res.end(JSON.stringify({ error: { code: "RATE_LIMITED", message: "too many attempts" } }));
+        return;
+    }
+    const body = await readJsonBody(req);
+    if (body === null || typeof body.name !== "string" || typeof body.password !== "string") {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "invalid body" } }));
+        return;
+    }
+    if (ctx.userManager === undefined) {
+        res.writeHead(500, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: { code: "NO_USERS", message: "no user manager configured" } }));
+        return;
+    }
+    const user = await ctx.userManager.verify(body.name, body.password);
+    if (user === null) {
+        const locked = loginLimiter.fail(ip);
+        if (locked > 0) {
+            res.writeHead(429, { "content-type": "application/json", "retry-after": String(Math.ceil(locked / 1000)) });
+            res.end(JSON.stringify({ error: { code: "RATE_LIMITED", message: "too many attempts" } }));
+            return;
+        }
+        res.writeHead(401, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: { code: "BAD_CREDENTIALS", message: "invalid username or password" } }));
+        return;
+    }
+    loginLimiter.clear(ip);
+    res.writeHead(302, {
+        location: "/",
+        "set-cookie": ctx.sessions.cookieHeader(ctx.sessionTtlSeconds, ctx.getVersion()),
+    });
+    res.end();
+}
+async function readJsonBody(req) {
+    let body = "";
+    for await (const chunk of req) {
+        body += chunk;
+        if (body.length > 4096)
+            return null;
+    }
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed !== "object" || parsed === null)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** 登录失败限流（按 IP，5 次/10 分钟）。 */
+function createLoginLimiter() {
+    const locks = new Map();
+    return {
+        /** 剩余锁定毫秒（0 = 允许）。 */
+        allow(ip) {
+            const s = locks.get(ip);
+            if (s === undefined)
+                return 0;
+            const remain = s.lockedUntil - Date.now();
+            return remain > 0 ? remain : 0;
+        },
+        /** 记录失败；返回新锁定毫秒（>0 表示已锁定）。 */
+        fail(ip) {
+            const s = locks.get(ip) ?? { fails: 0, lockedUntil: 0 };
+            s.fails += 1;
+            if (s.fails >= MAX_LOGIN_FAILS) {
+                s.fails = 0;
+                s.lockedUntil = Date.now() + LOGIN_LOCK_MS;
+            }
+            locks.set(ip, s);
+            return s.lockedUntil > Date.now() ? s.lockedUntil - Date.now() : 0;
+        },
+        clear(ip) {
+            locks.delete(ip);
+        },
+    };
+}
 //# sourceMappingURL=server.js.map

package/dist/service.d.ts

@@ -0,0 +1,11 @@
+export declare const SERVICE_NAME = "rdsh";
+/** systemd 用户级 unit 模板。subcommandArgs 默认 ["serve"]（hub 用 ["hub","serve"]）。 */
+export declare function systemdUnit(execStart: string, configPath: string, subcommandArgs?: string[]): string;
+/** launchd plist 模板。 */
+export declare function launchdPlist(execStart: string, configPath: string, subcommandArgs?: string[]): string;
+/** 安装并启动服务（用户级）。subcommandArgs 默认 ["serve"]（hub 用 ["hub","serve"]）。 */
+export declare function installService(configPath: string, subcommandArgs?: string[]): Promise<string>;
+/** 服务状态。 */
+export declare function serviceStatus(): Promise<string>;
+/** 停止并移除服务。 */
+export declare function uninstallService(): Promise<string>;

package/dist/service.js

@@ -0,0 +1,123 @@
+/**
+ * service.ts — 服务化：生成并安装 systemd unit（Linux）/ launchd plist（macOS）。
+ *
+ * 设计（roadmap M2）：不自带 fork 后台 —— 交给系统进程管理器托管 rdsh（连带其
+ * spawn 的 dsh）；用户级安装（~/.config/systemd/user / ~/Library/LaunchAgents），
+ * 无需 sudo；开机自启 + 崩溃重启（Restart=on-failure / KeepAlive）。
+ */
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileP = promisify(execFile);
+export const SERVICE_NAME = "rdsh";
+const SYSTEMD_DIR = join(homedir(), ".config", "systemd", "user");
+const SYSTEMD_UNIT = join(SYSTEMD_DIR, "rdsh.service");
+const LAUNCHD_DIR = join(homedir(), "Library", "LaunchAgents");
+const LAUNCHD_PLIST = join(LAUNCHD_DIR, "com.rdsh.plist");
+function isLinux() {
+    return process.platform === "linux";
+}
+function serviceLogPath() {
+    return join(homedir(), ".rdsh", "service.log");
+}
+/** systemd 用户级 unit 模板。subcommandArgs 默认 ["serve"]（hub 用 ["hub","serve"]）。 */
+export function systemdUnit(execStart, configPath, subcommandArgs = ["serve"]) {
+    const args = [...subcommandArgs, "--config", configPath].join(" ");
+    return `[Unit]
+Description=rdsh — remote access for DeepSeek Harness
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=${execStart} ${args}
+Restart=on-failure
+RestartSec=3
+
+[Install]
+WantedBy=default.target
+`;
+}
+/** launchd plist 模板。 */
+export function launchdPlist(execStart, configPath, subcommandArgs = ["serve"]) {
+    const args = [...subcommandArgs, "--config", configPath].map((a) => `    <string>${a}</string>`).join("\n");
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>com.rdsh</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${execStart}</string>
+${args}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${serviceLogPath()}</string>
+  <key>StandardErrorPath</key>
+  <string>${serviceLogPath()}</string>
+</dict>
+</plist>
+`;
+}
+async function run(cmd, args) {
+    try {
+        const { stdout } = await execFileP(cmd, args);
+        return String(stdout).trim();
+    }
+    catch (err) {
+        throw new Error(`${cmd} ${args.join(" ")} failed: ${err.message}`);
+    }
+}
+/** 安装并启动服务（用户级）。subcommandArgs 默认 ["serve"]（hub 用 ["hub","serve"]）。 */
+export async function installService(configPath, subcommandArgs = ["serve"]) {
+    const execStart = `${process.execPath} ${process.argv[1]}`;
+    if (isLinux()) {
+        await mkdir(SYSTEMD_DIR, { recursive: true });
+        await writeFile(SYSTEMD_UNIT, systemdUnit(execStart, configPath, subcommandArgs), { mode: 0o600 });
+        await run("systemctl", ["--user", "daemon-reload"]);
+        await run("systemctl", ["--user", "enable", "--now", SERVICE_NAME]);
+        return `installed systemd user unit: ${SYSTEMD_UNIT}`;
+    }
+    await mkdir(LAUNCHD_DIR, { recursive: true });
+    await writeFile(LAUNCHD_PLIST, launchdPlist(execStart, configPath, subcommandArgs), { mode: 0o600 });
+    await run("launchctl", ["load", LAUNCHD_PLIST]);
+    return `installed launchd plist: ${LAUNCHD_PLIST}`;
+}
+/** 服务状态。 */
+export async function serviceStatus() {
+    if (isLinux()) {
+        try {
+            const active = await run("systemctl", ["--user", "is-active", SERVICE_NAME]);
+            return `active: ${active}`;
+        }
+        catch {
+            return "inactive";
+        }
+    }
+    try {
+        await run("launchctl", ["print", "com.rdsh"]);
+        return "active";
+    }
+    catch {
+        return "unloaded";
+    }
+}
+/** 停止并移除服务。 */
+export async function uninstallService() {
+    if (isLinux()) {
+        await run("systemctl", ["--user", "disable", "--now", SERVICE_NAME]).catch(() => undefined);
+        await rm(SYSTEMD_UNIT, { force: true });
+        await run("systemctl", ["--user", "daemon-reload"]).catch(() => undefined);
+        return `removed ${SYSTEMD_UNIT}`;
+    }
+    await run("launchctl", ["unload", LAUNCHD_PLIST]).catch(() => undefined);
+    await rm(LAUNCHD_PLIST, { force: true });
+    return `removed ${LAUNCHD_PLIST}`;
+}
+//# sourceMappingURL=service.js.map

package/dist/session.d.ts

@@ -3,6 +3,8 @@ export interface SessionPayload {
     sid: string;
     /** 过期时刻（epoch 秒） */
     exp: number;
+    /** auth.version（M2 改密版本；不匹配 → 会话无效） */
+    v: number;
 }
 export declare class SessionManager {
     private key;
@@ -14,12 +16,12 @@ export declare class SessionManager {
     init(): Promise<void>;
     /** 删除密钥并重建 —— 全部已签发会话立即失效。 */
     reset(): Promise<void>;
-    /** 签发一个有效期 ttlSeconds 的会话 token。 */
-    sign(ttlSeconds: number): string;
-    /** 校验 token；无效/过期/被篡改 → null。 */
-    verify(token: string): SessionPayload | null;
+    /** 签发一个有效期 ttlSeconds 的会话 token（携带 auth 版本号）。 */
+    sign(ttlSeconds: number, version?: number): string;
+    /** 校验 token；无效/过期/被篡改/版本不匹配 → null。 */
+    verify(token: string, version?: number): SessionPayload | null;
     /** 生成 Set-Cookie 头（HttpOnly + SameSite=Lax）。 */
-    cookieHeader(ttlSeconds: number): string;
+    cookieHeader(ttlSeconds: number, version?: number): string;
     private requireKey;
 }
 /** 从请求 Cookie 头解析出会话 token（无 → null）。 */

package/dist/session.js

@@ -33,19 +33,20 @@ export class SessionManager {
         await rm(this.keyFile, { force: true });
         this.key = await loadOrCreateKey(this.keyFile);
     }
-    /** 签发一个有效期 ttlSeconds 的会话 token。 */
-    sign(ttlSeconds) {
+    /** 签发一个有效期 ttlSeconds 的会话 token（携带 auth 版本号）。 */
+    sign(ttlSeconds, version = 1) {
         const key = this.requireKey();
         const payload = {
             sid: randomUUID(),
             exp: Math.floor(Date.now() / 1000) + ttlSeconds,
+            v: version,
         };
         const body = Buffer.from(JSON.stringify(payload));
         const mac = createHmac("sha256", key).update(body).digest("base64url");
         return `${mac}.${body.toString("base64url")}`;
     }
-    /** 校验 token；无效/过期/被篡改 → null。 */
-    verify(token) {
+    /** 校验 token；无效/过期/被篡改/版本不匹配 → null。 */
+    verify(token, version) {
         const key = this.requireKey();
         const dot = token.indexOf(".");
         if (dot <= 0)
@@ -64,13 +65,15 @@ export class SessionManager {
             return null;
         try {
             const payload = JSON.parse(bodyBytes.toString("utf8"));
-            if (typeof payload.sid !== "string" || typeof payload.exp !== "number")
+            if (typeof payload.sid !== "string" || typeof payload.exp !== "number" || typeof payload.v !== "number")
                 return null;
             const now = Math.floor(Date.now() / 1000);
             if (payload.exp <= now)
                 return null;
             if (payload.exp > now + MAX_EXP_FUTURE_SECONDS)
                 return null;
+            if (version !== undefined && payload.v !== version)
+                return null;
             return payload;
         }
         catch {
@@ -78,8 +81,8 @@ export class SessionManager {
         }
     }
     /** 生成 Set-Cookie 头（HttpOnly + SameSite=Lax）。 */
-    cookieHeader(ttlSeconds) {
-        const token = this.sign(ttlSeconds);
+    cookieHeader(ttlSeconds, version = 1) {
+        const token = this.sign(ttlSeconds, version);
         return `${SESSION_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}`;
     }
     requireKey() {

package/dist/tls.d.ts

@@ -0,0 +1,13 @@
+export interface TlsMaterial {
+    key: string;
+    cert: string;
+}
+/**
+ * 解析 TLS 材料。
+ * @param tls config.tls（cert/key 路径）
+ * @param behindProxy 反代终止 TLS 时返回 null
+ */
+export declare function loadTls(tls?: {
+    cert: string;
+    key: string;
+}, behindProxy?: boolean): Promise<TlsMaterial | null>;

package/dist/tls.js

@@ -0,0 +1,26 @@
+/**
+ * tls.ts — TLS 证书材料加载。
+ *
+ * - 有 `tls.cert/key`（任意 PEM：acme.sh / Let's Encrypt / 云厂商）→ 读取返回；
+ * - 无 → 返回 null（网关跑 http；`auth.mode=password` 且非反代时由
+ *   server.ts 的安全约束拒绝启动）；
+ * - `behindProxy`（反代终止 TLS）→ 返回 null。
+ *
+ * 注：不内置自签证书生成 —— 无证书即 http；需要 https 请自行提供证书
+ * （acme.sh / Let's Encrypt / 云厂商 / openssl 手动生成）。
+ */
+import { readFile } from "node:fs/promises";
+/**
+ * 解析 TLS 材料。
+ * @param tls config.tls（cert/key 路径）
+ * @param behindProxy 反代终止 TLS 时返回 null
+ */
+export async function loadTls(tls, behindProxy = false) {
+    if (behindProxy)
+        return null;
+    if (!tls)
+        return null;
+    const [cert, key] = await Promise.all([readFile(tls.cert, "utf8"), readFile(tls.key, "utf8")]);
+    return { cert, key };
+}
+//# sourceMappingURL=tls.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rdsh-gateway",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "rdsh host-side component: LAN auth gateway + outbound tunnel endpoint (spawns dsh web)",
   "license": "MIT",
   "type": "module",
@@ -20,7 +20,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    "ws": "^8.18.0"
+    "ws": "^8.18.0",
+    "rdsh-tunnel": "0.1.0"
   },
   "devDependencies": {
     "@types/ws": "^8.5.0"
@@ -29,4 +30,4 @@
     "build": "tsc -p tsconfig.json",
     "test": "node --test test/"
   }
-}
+}