rdsh-gateway 0.2.2 → 0.2.3

package/dist/join.d.ts

@@ -2,6 +2,8 @@ export interface JoinOptions {
     hubUrl: string;
     /** 直填 host token（跳过配对码绑定流程） */
     token?: string;
+    /** 清除持久化 token 并强制重新配对 */
+    reset?: boolean;
     dshPath?: string;
     /** 跳过 TLS 证书校验（自签 hub 用；正式证书无需） */
     insecure?: boolean;

package/dist/join.js

@@ -12,6 +12,7 @@ import { WebSocket } from "ws";
 import { FrameParser, FRAME_TYPE, encodeFrame, jsonPayload, parseJsonPayload } from "rdsh-tunnel";
 import { findDsh, spawnDsh } from "./spawn-dsh.js";
 import { rewriteHeadersForDsh } from "./proxy.js";
+import { clearPersistedToken, persistToken, readPersistedToken } from "./token-store.js";
 const PENDING_POLL_MS = 5_000;
 const BIND_TIMEOUT_MS = 10 * 60 * 1000; // 配对码 10 分钟
 const HEARTBEAT_MS = 30_000;
@@ -81,7 +82,25 @@ export async function join(opts) {
     }
     const dsh = await spawnDsh(foundDsh);
     const target = { host: "127.0.0.1", port: dsh.port };
-    const token = opts.token ?? (await bind(opts.hubUrl, opts.insecure === true));
+    // token 来源优先级：--token 直填 > 持久化复用 > 配对码绑定（绑定成功后落盘）。
+    // 进程重启后复用已绑定 token，避免重复配对；被吊销时（401）自动回退重配对。
+    let token;
+    if (opts.token !== undefined) {
+        token = opts.token;
+    }
+    else {
+        if (opts.reset === true)
+            clearPersistedToken(opts.hubUrl);
+        const persisted = readPersistedToken(opts.hubUrl);
+        if (persisted !== null) {
+            token = persisted;
+            console.log("rdsh join: reusing persisted host token");
+        }
+        else {
+            token = await bind(opts.hubUrl, opts.insecure === true);
+            persistToken(opts.hubUrl, token);
+        }
+    }
     console.log(`rdsh join: dsh web on 127.0.0.1:${dsh.port}`);
     console.log(`rdsh join: connecting to ${opts.hubUrl}...`);
     const parser = new FrameParser();
@@ -92,15 +111,16 @@ export async function join(opts) {
     let shuttingDown = false;
     let reconnectDelay = RECONNECT_BASE_MS;
     let heartbeat;
-    const shutdown = async (signal) => {
+    const shutdown = async (signal, code = 0) => {
         if (shuttingDown)
             return;
         shuttingDown = true;
-        console.log(`\nrdsh: received ${signal}, shutting down...`);
+        if (signal !== "")
+            console.log(`\nrdsh: received ${signal}, shutting down...`);
         if (heartbeat !== undefined)
             clearInterval(heartbeat);
         await dsh.stop();
-        process.exit(0);
+        process.exit(code);
     };
     process.on("SIGINT", () => void shutdown("SIGINT"));
     process.on("SIGTERM", () => void shutdown("SIGTERM"));
@@ -265,11 +285,41 @@ export async function join(opts) {
         upstream.on("close", cleanup);
         upstream.on("error", cleanup);
     }
+    /** 持久化 token 被 hub 拒绝（吊销/重置）→ 删旧文件 → 重新配对 → 重连。 */
+    async function rebindAndReconnect() {
+        clearPersistedToken(opts.hubUrl);
+        console.log("rdsh join: host token rejected (revoked?) — re-pairing...");
+        try {
+            token = await bind(opts.hubUrl, opts.insecure === true);
+            persistToken(opts.hubUrl, token);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`rdsh join: re-pairing failed (${msg}); retrying in ${RECONNECT_BASE_MS / 1000}s...`);
+            setTimeout(() => void rebindAndReconnect(), RECONNECT_BASE_MS);
+            return;
+        }
+        reconnectDelay = RECONNECT_BASE_MS;
+        connect();
+    }
     function connect() {
         if (shuttingDown)
             return;
         const url = `${hubWsBase}/tunnel?token=${encodeURIComponent(token)}`;
         const client = new WebSocket(url, { rejectUnauthorized: opts.insecure !== true });
+        // 401/403 = token 被拒（吊销/不存在）。监听此事件后 ws 不再自动 abort，
+        // 需手动 terminate → 触发 close → 决定「重配对」还是「普通重连」。
+        let tokenRejected = false;
+        client.on("unexpected-response", (_req, res) => {
+            if (res.statusCode === 401 || res.statusCode === 403)
+                tokenRejected = true;
+            try {
+                client.terminate();
+            }
+            catch {
+                /* 已关闭 */
+            }
+        });
         client.on("open", () => {
             reconnectDelay = RECONNECT_BASE_MS;
             console.log("rdsh join: tunnel established (heartbeat 30s)");
@@ -325,6 +375,18 @@ export async function join(opts) {
             wsStreams.clear();
             if (shuttingDown)
                 return;
+            if (tokenRejected) {
+                if (opts.token === undefined) {
+                    // 持久化 token 被拒 → 删旧文件 + 回退配对码
+                    void rebindAndReconnect();
+                    return;
+                }
+                // 显式 --token 被拒 = 永久失败（token 不会再变有效）→ fail-fast，
+                // 让脚本/systemd 拿到非零退出码与明确报错，而非静默无限重连
+                console.error("rdsh join: host token rejected by hub (revoked or removed); exiting.");
+                void shutdown("", 1);
+                return;
+            }
             console.log(`rdsh join: tunnel lost — reconnecting in ${Math.round(reconnectDelay / 1000)}s...`);
             setTimeout(connect, reconnectDelay + Math.random() * 500);
             reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);

package/dist/token-store.d.ts

@@ -0,0 +1,8 @@
+/** token 文件路径：join-<hostname>[-<port>].token（按 hub URL 区分，端口非默认时带端口）。 */
+export declare function tokenFilePath(hubUrl: string, dir?: string): string;
+/** 读取持久化 token；不存在/损坏/过短 → null。 */
+export declare function readPersistedToken(hubUrl: string, dir?: string): string | null;
+/** 写入 token（目录 0700、文件 0600）。 */
+export declare function persistToken(hubUrl: string, token: string, dir?: string): void;
+/** 删除持久化 token（吊销/被拒后清理）。 */
+export declare function clearPersistedToken(hubUrl: string, dir?: string): void;

package/dist/token-store.js

@@ -0,0 +1,50 @@
+/**
+ * token-store.ts — `rdsh join` host token 持久化（~/.rdsh/join-<host>[-<port>].token，0600）。
+ *
+ * 目的：进程重启/崩溃恢复后复用已绑定的 host token，避免每次重新配对；
+ * 被 hub 拒绝（吊销/重置）时由 join 删除该文件并回退到配对码流程。
+ *
+ * 安全：明文 token 只落 gateway 本地（0600），hub 侧仍只存 SHA-256 摘要。
+ */
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const RDSH_DIR = join(homedir(), ".rdsh");
+/** host token 最小长度（与 hub server.ts handleTunnelUpgrade 的 `token.length < 16` 一致）。 */
+const MIN_TOKEN_LEN = 16;
+/** token 文件路径：join-<hostname>[-<port>].token（按 hub URL 区分，端口非默认时带端口）。 */
+export function tokenFilePath(hubUrl, dir = RDSH_DIR) {
+    const u = new URL(hubUrl);
+    const host = u.hostname.replace(/[^a-zA-Z0-9.-]/g, "_");
+    const port = u.port === "" ? "" : `-${u.port}`;
+    return join(dir, `join-${host}${port}.token`);
+}
+/** 读取持久化 token；不存在/损坏/过短 → null。 */
+export function readPersistedToken(hubUrl, dir = RDSH_DIR) {
+    try {
+        const p = tokenFilePath(hubUrl, dir);
+        if (!existsSync(p))
+            return null;
+        const t = readFileSync(p, "utf8").trim();
+        return t.length >= MIN_TOKEN_LEN ? t : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** 写入 token（目录 0700、文件 0600）。 */
+export function persistToken(hubUrl, token, dir = RDSH_DIR) {
+    const p = tokenFilePath(hubUrl, dir);
+    mkdirSync(dirname(p), { recursive: true, mode: 0o700 });
+    writeFileSync(p, token, { mode: 0o600 });
+}
+/** 删除持久化 token（吊销/被拒后清理）。 */
+export function clearPersistedToken(hubUrl, dir = RDSH_DIR) {
+    try {
+        rmSync(tokenFilePath(hubUrl, dir), { force: true });
+    }
+    catch {
+        /* 文件不存在等，忽略 */
+    }
+}
+//# sourceMappingURL=token-store.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rdsh-gateway",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "rdsh host-side component: LAN auth gateway + outbound tunnel endpoint (spawns dsh web)",
   "license": "MIT",
   "type": "module",
@@ -28,6 +28,6 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "node --test test/"
+    "test": "node --test \"test/*.test.ts\""
   }
 }