rdsh-gateway 0.1.0 → 0.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Liming Xie
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/auth.d.ts

@@ -0,0 +1,24 @@
+import { normalizeConfig } from "./config.ts";
+import type { AuthUser } from "./config.ts";
+/** 生成 scrypt 哈希（格式 `scrypt:$N:$r:$p:$salt:$hash`）。 */
+export declare function hashPassword(password: string): Promise<string>;
+/** 恒定时间校验密码。 */
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+/** 用户管理：读写 config.json 的 auth.users（低频管理操作，读改写即可）。 */
+export declare class UserManager {
+    private readonly configPath;
+    constructor(configPath: string);
+    private read;
+    private write;
+    add(name: string, password: string): Promise<void>;
+    /** 改密：更新哈希并使 `auth.version + 1`（全部旧会话失效）。 */
+    passwd(name: string, password: string): Promise<boolean>;
+    list(): Promise<string[]>;
+    remove(name: string): Promise<boolean>;
+    /** 校验用户名/密码；成功返回用户，失败 null。 */
+    verify(name: string, password: string): Promise<AuthUser | null>;
+    /** 当前 auth.version（会话版本校验用）。 */
+    version(): Promise<number>;
+}
+/** 测试辅助：把内存对象规范化（供单测构造）。 */
+export { normalizeConfig };

package/dist/auth.js

@@ -0,0 +1,117 @@
+/**
+ * auth.ts — 用户/密码认证（scrypt 哈希）+ UserManager。
+ *
+ * 哈希格式：`scrypt:$N:$r:$p:$saltB64:$hashB64`（每用户随机盐，恒定时间校验）。
+ * 改密（passwd）会使 `auth.version + 1` —— 会话校验绑定版本，旧会话立即失效。
+ */
+import { randomBytes, scrypt as scryptCb, timingSafeEqual } from "node:crypto";
+import { writeFile, rename } from "node:fs/promises";
+import { loadConfig, normalizeConfig } from "./config.js";
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const KEY_LEN = 64;
+function scryptAsync(password, salt, keylen, options) {
+    return new Promise((resolve, reject) => {
+        scryptCb(password, salt, keylen, options, (err, derived) => {
+            if (err)
+                reject(err);
+            else
+                resolve(derived);
+        });
+    });
+}
+/** 生成 scrypt 哈希（格式 `scrypt:$N:$r:$p:$salt:$hash`）。 */
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const derived = await scryptAsync(password, salt, KEY_LEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+    return `scrypt:${SCRYPT_N}:${SCRYPT_R}:${SCRYPT_P}:${salt.toString("base64url")}:${derived.toString("base64url")}`;
+}
+/** 恒定时间校验密码。 */
+export async function verifyPassword(password, stored) {
+    const parts = stored.split(":");
+    if (parts.length !== 6 || parts[0] !== "scrypt")
+        return false;
+    const n = Number(parts[1]);
+    const r = Number(parts[2]);
+    const p = Number(parts[3]);
+    const saltB64 = parts[4];
+    const hashB64 = parts[5];
+    if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p) || n < 1 || r < 1 || p < 1)
+        return false;
+    try {
+        const derived = await scryptAsync(password, Buffer.from(saltB64, "base64url"), KEY_LEN, { N: n, r, p });
+        return timingSafeEqual(derived, Buffer.from(hashB64, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+/** 用户管理：读写 config.json 的 auth.users（低频管理操作，读改写即可）。 */
+export class UserManager {
+    configPath;
+    constructor(configPath) {
+        this.configPath = configPath;
+    }
+    async read() {
+        return await loadConfig(this.configPath);
+    }
+    async write(config) {
+        const tmp = `${this.configPath}.tmp`;
+        await writeFile(tmp, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+        await rename(tmp, this.configPath);
+    }
+    async add(name, password) {
+        if (!/^[a-zA-Z0-9_.-]{1,64}$/.test(name)) {
+            throw new Error(`invalid username "${name}" (allowed: letters, digits, . _ -)`);
+        }
+        const config = await this.read();
+        if (config.auth.users.some((u) => u.name === name)) {
+            throw new Error(`user "${name}" already exists`);
+        }
+        config.auth.users.push({ name, passwordHash: await hashPassword(password) });
+        await this.write(config);
+    }
+    /** 改密：更新哈希并使 `auth.version + 1`（全部旧会话失效）。 */
+    async passwd(name, password) {
+        const config = await this.read();
+        const user = config.auth.users.find((u) => u.name === name);
+        if (user === undefined)
+            return false;
+        user.passwordHash = await hashPassword(password);
+        config.auth.version = (config.auth.version ?? 1) + 1;
+        await this.write(config);
+        return true;
+    }
+    async list() {
+        const config = await this.read();
+        return config.auth.users.map((u) => u.name);
+    }
+    async remove(name) {
+        const config = await this.read();
+        const before = config.auth.users.length;
+        config.auth.users = config.auth.users.filter((u) => u.name !== name);
+        if (config.auth.users.length === before)
+            return false;
+        await this.write(config);
+        return true;
+    }
+    /** 校验用户名/密码；成功返回用户，失败 null。 */
+    async verify(name, password) {
+        const config = await this.read();
+        const user = config.auth.users.find((u) => u.name === name);
+        if (user === undefined)
+            return null;
+        if (await verifyPassword(password, user.passwordHash))
+            return user;
+        return null;
+    }
+    /** 当前 auth.version（会话版本校验用）。 */
+    async version() {
+        const config = await this.read();
+        return config.auth.version ?? 1;
+    }
+}
+/** 测试辅助：把内存对象规范化（供单测构造）。 */
+export { normalizeConfig };
+//# sourceMappingURL=auth.js.map

package/dist/cidr.d.ts

@@ -0,0 +1,13 @@
+/**
+ * cidr.ts — IPv4 CIDR 匹配（IP 白名单，零依赖）。
+ */
+export interface Cidr {
+    base: number;
+    prefix: number;
+}
+/** 解析 `a.b.c.d/n`（prefix 缺省 = 32）；非法返回 null。 */
+export declare function parseCidr(cidr: string): Cidr | null;
+/** IPv4 字符串 → uint32；非法返回 null（IPv6 等不支持，返回 null）。 */
+export declare function ipToInt(ip: string): number | null;
+/** ip 是否命中任一 CIDR。 */
+export declare function ipInCidrs(ip: string, cidrs: string[]): boolean;

package/dist/cidr.js

@@ -0,0 +1,43 @@
+/** 解析 `a.b.c.d/n`（prefix 缺省 = 32）；非法返回 null。 */
+export function parseCidr(cidr) {
+    const slash = cidr.indexOf("/");
+    const ip = slash === -1 ? cidr : cidr.slice(0, slash);
+    const prefixStr = slash === -1 ? "32" : cidr.slice(slash + 1);
+    const prefix = Number(prefixStr);
+    if (!Number.isInteger(prefix) || prefix < 0 || prefix > 32)
+        return null;
+    const octets = ip.split(".").map(Number);
+    if (octets.length !== 4 || octets.some((o) => !Number.isInteger(o) || o < 0 || o > 255))
+        return null;
+    const base = (((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0);
+    return { base, prefix };
+}
+/** IPv4 字符串 → uint32；非法返回 null（IPv6 等不支持，返回 null）。 */
+export function ipToInt(ip) {
+    // 剥离 IPv4-mapped IPv6 前缀（::ffff:a.b.c.d）
+    let candidate = ip;
+    if (candidate.toLowerCase().startsWith("::ffff:"))
+        candidate = candidate.slice(7);
+    if (candidate.includes(":"))
+        return null;
+    const octets = candidate.split(".").map(Number);
+    if (octets.length !== 4 || octets.some((o) => !Number.isInteger(o) || o < 0 || o > 255))
+        return null;
+    return (((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0);
+}
+/** ip 是否命中任一 CIDR。 */
+export function ipInCidrs(ip, cidrs) {
+    const ipInt = ipToInt(ip);
+    if (ipInt === null)
+        return false;
+    for (const cidr of cidrs) {
+        const parsed = parseCidr(cidr);
+        if (parsed === null)
+            continue;
+        const mask = parsed.prefix === 0 ? 0 : (0xffffffff << (32 - parsed.prefix)) >>> 0;
+        if ((ipInt & mask) === (parsed.base & mask))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=cidr.js.map

package/dist/config.d.ts

@@ -0,0 +1,33 @@
+export type AuthMode = "pair" | "password" | "none";
+export interface TlsConfig {
+    cert: string;
+    key: string;
+}
+export interface AuthUser {
+    name: string;
+    passwordHash: string;
+}
+export interface AuthConfig {
+    mode: AuthMode;
+    pairCode?: string;
+    /** 改密时 +1，用于使旧会话失效 */
+    version: number;
+    users: AuthUser[];
+}
+export interface RdshConfig {
+    host: string;
+    port: number;
+    sessionTtlSeconds: number;
+    tls?: TlsConfig;
+    behindProxy: boolean;
+    allowFrom: string[];
+    auth: AuthConfig;
+    dshPath?: string;
+}
+export declare const DEFAULT_CONFIG_PATH: string;
+/** 解析配置文件路径（--config > $RDSH_CONFIG > 默认）。 */
+export declare function resolveConfigPath(cliPath?: string, env?: NodeJS.ProcessEnv): string;
+/** 加载并校验配置；文件不存在时返回默认值。 */
+export declare function loadConfig(path: string): Promise<RdshConfig>;
+/** 校验并规范化任意输入（测试/CLI 覆盖复用）。 */
+export declare function normalizeConfig(raw: unknown, source?: string): RdshConfig;

package/dist/config.js

@@ -0,0 +1,127 @@
+/**
+ * config.ts — 配置加载/默认/校验。持久配置唯一来源（~/.rdsh/config.json）。
+ *
+ * 优先级：CLI 参数 > config 文件 > 默认值。
+ * 路径：`--config <path>` > `$RDSH_CONFIG` > 默认 `~/.rdsh/config.json`。
+ */
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const DEFAULT_CONFIG_PATH = join(homedir(), ".rdsh", "config.json");
+const DEFAULT_AUTH = { mode: "pair", version: 1, users: [] };
+const DEFAULTS = {
+    host: "0.0.0.0",
+    port: 8443,
+    sessionTtlSeconds: 12 * 3600,
+    behindProxy: false,
+    allowFrom: [],
+    auth: DEFAULT_AUTH,
+};
+/** 解析配置文件路径（--config > $RDSH_CONFIG > 默认）。 */
+export function resolveConfigPath(cliPath, env = process.env) {
+    return cliPath ?? env.RDSH_CONFIG ?? DEFAULT_CONFIG_PATH;
+}
+/** 加载并校验配置；文件不存在时返回默认值。 */
+export async function loadConfig(path) {
+    let raw = {};
+    try {
+        raw = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT") {
+            throw new Error(`failed to read config ${path}: ${err.message}`);
+        }
+        // ENOENT → 默认配置
+    }
+    return normalizeConfig(raw, path);
+}
+/** 校验并规范化任意输入（测试/CLI 覆盖复用）。 */
+export function normalizeConfig(raw, source = "config") {
+    if (typeof raw !== "object" || raw === null) {
+        throw new Error(`${source}: expected a JSON object`);
+    }
+    const cfg = raw;
+    const out = {
+        ...DEFAULTS,
+        auth: { ...DEFAULT_AUTH, users: [] },
+    };
+    if (cfg.host !== undefined) {
+        assertString(cfg.host, "host", source);
+        out.host = cfg.host;
+    }
+    if (cfg.port !== undefined) {
+        if (!Number.isInteger(cfg.port) || cfg.port < 0 || cfg.port > 65535) {
+            throw new Error(`${source}: invalid "port" ${JSON.stringify(cfg.port)}`);
+        }
+        out.port = cfg.port;
+    }
+    if (cfg.sessionTtlSeconds !== undefined) {
+        if (!Number.isInteger(cfg.sessionTtlSeconds) || cfg.sessionTtlSeconds <= 0) {
+            throw new Error(`${source}: invalid "sessionTtlSeconds" ${JSON.stringify(cfg.sessionTtlSeconds)}`);
+        }
+        out.sessionTtlSeconds = cfg.sessionTtlSeconds;
+    }
+    if (cfg.tls !== undefined) {
+        if (typeof cfg.tls !== "object" || cfg.tls === null)
+            throw new Error(`${source}: "tls" must be an object`);
+        const tls = cfg.tls;
+        assertString(tls.cert, "tls.cert", source);
+        assertString(tls.key, "tls.key", source);
+        out.tls = { cert: tls.cert, key: tls.key };
+    }
+    if (cfg.behindProxy !== undefined) {
+        if (typeof cfg.behindProxy !== "boolean")
+            throw new Error(`${source}: "behindProxy" must be boolean`);
+        out.behindProxy = cfg.behindProxy;
+    }
+    if (cfg.allowFrom !== undefined) {
+        if (!Array.isArray(cfg.allowFrom) || cfg.allowFrom.some((x) => typeof x !== "string")) {
+            throw new Error(`${source}: "allowFrom" must be an array of CIDR strings`);
+        }
+        out.allowFrom = cfg.allowFrom;
+    }
+    if (cfg.auth !== undefined) {
+        if (typeof cfg.auth !== "object" || cfg.auth === null)
+            throw new Error(`${source}: "auth" must be an object`);
+        const auth = cfg.auth;
+        if (auth.mode !== undefined) {
+            if (auth.mode !== "pair" && auth.mode !== "password" && auth.mode !== "none") {
+                throw new Error(`${source}: "auth.mode" must be pair|password|none`);
+            }
+            out.auth.mode = auth.mode;
+        }
+        if (auth.pairCode !== undefined) {
+            assertString(auth.pairCode, "auth.pairCode", source);
+            out.auth.pairCode = auth.pairCode;
+        }
+        if (auth.version !== undefined) {
+            if (!Number.isInteger(auth.version) || auth.version < 1) {
+                throw new Error(`${source}: "auth.version" must be a positive integer`);
+            }
+            out.auth.version = auth.version;
+        }
+        if (auth.users !== undefined) {
+            if (!Array.isArray(auth.users))
+                throw new Error(`${source}: "auth.users" must be an array`);
+            out.auth.users = auth.users.map((u, i) => {
+                if (typeof u !== "object" || u === null)
+                    throw new Error(`${source}: auth.users[${i}] must be an object`);
+                const user = u;
+                assertString(user.name, `auth.users[${i}].name`, source);
+                assertString(user.passwordHash, `auth.users[${i}].passwordHash`, source);
+                return { name: user.name, passwordHash: user.passwordHash };
+            });
+        }
+    }
+    if (cfg.dshPath !== undefined) {
+        assertString(cfg.dshPath, "dshPath", source);
+        out.dshPath = cfg.dshPath;
+    }
+    return out;
+}
+function assertString(v, field, source) {
+    if (typeof v !== "string")
+        throw new Error(`${source}: "${field}" must be a string`);
+}
+//# sourceMappingURL=config.js.map

package/dist/index.d.ts

@@ -12,6 +12,16 @@ export { startGateway } from "./server.ts";
 export type { GatewayOptions, RunningGateway } from "./server.ts";
 export { findDsh, spawnDsh } from "./spawn-dsh.ts";
 export type { SpawnedDsh } from "./spawn-dsh.ts";
-export { forwardHttp, createUpgradeProxy } from "./proxy.ts";
+export { forwardHttp, createUpgradeProxy, rewriteHeadersForDsh } from "./proxy.ts";
 export type { ProxyTarget } from "./proxy.ts";
+export { loadConfig, normalizeConfig, resolveConfigPath, DEFAULT_CONFIG_PATH } from "./config.ts";
+export type { RdshConfig, AuthMode, AuthUser, AuthConfig, TlsConfig } from "./config.ts";
+export { hashPassword, verifyPassword, UserManager } from "./auth.ts";
+export { ipInCidrs, parseCidr, ipToInt } from "./cidr.ts";
+export { loadTls } from "./tls.ts";
+export type { TlsMaterial } from "./tls.ts";
+export { loginPageHtml } from "./login-page.ts";
+export { installService, uninstallService, serviceStatus, systemdUnit, launchdPlist } from "./service.ts";
 export declare const NAME = "rdsh-gateway";
+export { join } from "./join.ts";
+export type { JoinOptions } from "./join.ts";

package/dist/index.js

@@ -8,6 +8,13 @@ export { SessionManager, SESSION_COOKIE, sessionTokenFromCookie } from "./sessio
 export { PairManager } from "./pair.js";
 export { startGateway } from "./server.js";
 export { findDsh, spawnDsh } from "./spawn-dsh.js";
-export { forwardHttp, createUpgradeProxy } from "./proxy.js";
+export { forwardHttp, createUpgradeProxy, rewriteHeadersForDsh } from "./proxy.js";
+export { loadConfig, normalizeConfig, resolveConfigPath, DEFAULT_CONFIG_PATH } from "./config.js";
+export { hashPassword, verifyPassword, UserManager } from "./auth.js";
+export { ipInCidrs, parseCidr, ipToInt } from "./cidr.js";
+export { loadTls } from "./tls.js";
+export { loginPageHtml } from "./login-page.js";
+export { installService, uninstallService, serviceStatus, systemdUnit, launchdPlist } from "./service.js";
 export const NAME = "rdsh-gateway";
+export { join } from "./join.js";
 //# sourceMappingURL=index.js.map

package/dist/join.d.ts

@@ -0,0 +1,9 @@
+export interface JoinOptions {
+    hubUrl: string;
+    /** 直填 host token（跳过配对码绑定流程） */
+    token?: string;
+    dshPath?: string;
+    /** 跳过 TLS 证书校验（自签 hub 用；正式证书无需） */
+    insecure?: boolean;
+}
+export declare function join(opts: JoinOptions): Promise<void>;