remote-codex 0.11.5 → 0.11.6

package/apps/relay-server/dist/index.js

@@ -6,7 +6,7 @@ import { ZodError } from "zod";
 import websocket from "@fastify/websocket";
 import Fastify from "fastify";
 import fs2 from "fs";
-import fsp2 from "fs/promises";
+import fsp from "fs/promises";
 import path2 from "path";
 import { randomUUID } from "crypto";
 import { z } from "zod";
@@ -61,43 +61,49 @@ var RelayRequestBroker = class {
 // src/relay-store.ts
 import crypto from "crypto";
 import fs from "fs";
-import fsp from "fs/promises";
 import path from "path";
+import Database from "better-sqlite3";
 var SESSION_TTL_MS = 1e3 * 60 * 60 * 24 * 14;
 var RelayStore = class _RelayStore {
-  constructor(filePath, sessionSecret, registrationEnabled) {
-    this.filePath = filePath;
+  constructor(databasePath, sessionSecret, registrationEnabled, legacyJsonPath) {
+    this.databasePath = databasePath;
     this.sessionSecret = sessionSecret;
-    this.data = this.readData(registrationEnabled);
-  }
-  filePath;
+    fs.mkdirSync(path.dirname(this.databasePath), { recursive: true });
+    this.sqlite = new Database(this.databasePath);
+    this.sqlite.pragma("journal_mode = WAL");
+    this.sqlite.pragma("foreign_keys = ON");
+    this.migrate();
+    this.importLegacyJson(legacyJsonPath);
+    this.ensureRegistrationSetting(registrationEnabled);
+  }
+  databasePath;
   sessionSecret;
-  data;
+  sqlite;
   static fromDataDir(dataDir, sessionSecret, registrationEnabled) {
+    const resolvedDataDir = path.resolve(dataDir);
     return new _RelayStore(
-      path.join(path.resolve(dataDir), "relay-store.json"),
+      path.join(resolvedDataDir, "relay-store.sqlite"),
       sessionSecret,
-      registrationEnabled
+      registrationEnabled,
+      path.join(resolvedDataDir, "relay-store.json")
     );
   }
   seedAdmin(input) {
-    const username = normalizeUsername(input.username);
-    const existing = this.data.users.find((user2) => user2.role === "admin");
+    const existing = this.getUsers().find((user2) => user2.role === "admin");
     if (existing) {
       return this.publicUser(existing);
     }
     const user = this.createStoredUser({
-      email: input.email ?? `${username}@relay.local`,
-      username,
+      email: input.email ?? `${normalizeUsername(input.username)}@relay.local`,
+      username: input.username,
       password: input.password,
       role: "admin"
     });
-    this.data.users.push(user);
-    void this.persist();
+    this.insertUser(user);
     return this.publicUser(user);
   }
   register(input) {
-    if (!this.data.registrationEnabled) {
+    if (!this.registrationEnabled()) {
       throw new RelayStoreError(403, "forbidden", "Registration is currently disabled.");
     }
     const user = this.createStoredUser({
@@ -106,15 +112,12 @@ var RelayStore = class _RelayStore {
       password: input.password,
       role: "user"
     });
-    this.data.users.push(user);
-    void this.persist();
+    this.insertUser(user);
     return this.createLoginResult(user);
   }
   login(input) {
     const normalizedIdentifier = input.identifier.trim().toLowerCase();
-    const user = this.data.users.find(
-      (entry) => entry.email.toLowerCase() === normalizedIdentifier || entry.username.toLowerCase() === normalizedIdentifier
-    );
+    const user = this.getUserByIdentifier(normalizedIdentifier);
     if (!user || !user.enabled) {
       throw new RelayStoreError(401, "unauthorized", "Invalid username or password.");
     }
@@ -131,14 +134,14 @@ var RelayStore = class _RelayStore {
     if (!payload) {
       return this.emptySession();
     }
-    const user = this.data.users.find((entry) => entry.id === payload.userId);
+    const user = this.getUser(payload.userId);
     if (!user || !user.enabled) {
       return this.emptySession();
     }
     return {
       authenticated: true,
       user: this.publicUser(user),
-      registrationEnabled: this.data.registrationEnabled
+      registrationEnabled: this.registrationEnabled()
     };
   }
   createDevice(ownerUserId, input) {
@@ -152,50 +155,51 @@ var RelayStore = class _RelayStore {
       tokenPreview: previewToken(token),
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    this.data.devices.push(device);
-    void this.persist();
+    this.insertDevice(device);
     return {
       device: this.publicDevice(device, null),
       token
     };
   }
   deleteDevice(userId, deviceId) {
-    const index = this.data.devices.findIndex(
-      (device) => device.id === deviceId && device.ownerUserId === userId
-    );
-    if (index < 0) {
+    const result = this.sqlite.prepare("DELETE FROM relay_devices WHERE id = ? AND owner_user_id = ?").run(deviceId, userId);
+    if (result.changes < 1) {
       throw new RelayStoreError(404, "not_found", "Device was not found.");
     }
-    this.data.devices.splice(index, 1);
-    this.data.shares = this.data.shares.filter((share) => share.deviceId !== deviceId);
-    void this.persist();
   }
   verifyDeviceToken(token) {
     if (!token) {
       return null;
     }
     const tokenHash = sha256(token);
-    return this.data.devices.find((device) => device.tokenHash === tokenHash) ?? null;
+    return this.rowToDevice(
+      this.sqlite.prepare("SELECT * FROM relay_devices WHERE token_hash = ?").get(tokenHash)
+    );
   }
   createShare(ownerUserId, input) {
     const owner = this.requireUser(ownerUserId);
-    const device = this.data.devices.find(
-      (entry) => entry.id === input.deviceId && entry.ownerUserId === ownerUserId
-    );
-    if (!device) {
+    const device = this.getDevice(input.deviceId);
+    if (!device || device.ownerUserId !== ownerUserId) {
       throw new RelayStoreError(404, "not_found", "Device was not found.");
     }
-    const target = this.data.users.find(
-      (entry) => entry.username.toLowerCase() === input.targetUsername.trim().toLowerCase()
-    );
+    const target = this.getUserByUsername(input.targetUsername);
     if (!target || !target.enabled) {
       throw new RelayStoreError(404, "not_found", "Target user was not found.");
     }
     if (target.id === ownerUserId) {
       throw new RelayStoreError(400, "bad_request", "You cannot share a session with yourself.");
     }
-    const existing = this.data.shares.find(
-      (share2) => share2.ownerUserId === ownerUserId && share2.targetUserId === target.id && share2.deviceId === input.deviceId && share2.threadId === input.threadId && !share2.revokedAt
+    const existing = this.rowToShare(
+      this.sqlite.prepare(
+        `
+            SELECT * FROM relay_shares
+            WHERE owner_user_id = ?
+              AND target_user_id = ?
+              AND device_id = ?
+              AND thread_id = ?
+              AND revoked_at IS NULL
+          `
+      ).get(ownerUserId, target.id, input.deviceId, input.threadId)
     );
     if (existing) {
       return existing;
@@ -213,60 +217,63 @@ var RelayStore = class _RelayStore {
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       revokedAt: null
     };
-    this.data.shares.push(share);
-    void this.persist();
+    this.insertShare(share);
     return share;
   }
   revokeShare(userId, shareId) {
-    const share = this.data.shares.find(
-      (entry) => entry.id === shareId && entry.ownerUserId === userId
+    const share = this.rowToShare(
+      this.sqlite.prepare("SELECT * FROM relay_shares WHERE id = ? AND owner_user_id = ?").get(shareId, userId)
     );
     if (!share) {
       throw new RelayStoreError(404, "not_found", "Share was not found.");
     }
-    share.revokedAt = (/* @__PURE__ */ new Date()).toISOString();
-    void this.persist();
-    return share;
+    const revokedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.sqlite.prepare("UPDATE relay_shares SET revoked_at = ? WHERE id = ?").run(revokedAt, shareId);
+    return { ...share, revokedAt };
   }
   canAccessDevice(userId, deviceId, threadId) {
-    const owned = this.data.devices.some(
-      (device) => device.id === deviceId && device.ownerUserId === userId
-    );
+    const owned = this.sqlite.prepare("SELECT 1 FROM relay_devices WHERE id = ? AND owner_user_id = ?").get(deviceId, userId);
     if (owned) {
       return true;
     }
     if (!threadId) {
       return false;
     }
-    return this.data.shares.some(
-      (share) => share.targetUserId === userId && share.deviceId === deviceId && !share.revokedAt && share.threadId === threadId
+    return Boolean(
+      this.sqlite.prepare(
+        `
+            SELECT 1 FROM relay_shares
+            WHERE target_user_id = ?
+              AND device_id = ?
+              AND thread_id = ?
+              AND revoked_at IS NULL
+          `
+      ).get(userId, deviceId, threadId)
     );
   }
   portalSummary(userId, connectedDevices) {
     const user = this.requireUser(userId);
+    const devices = this.getDevicesByOwner(userId);
+    const sharedWithMe = this.getSharesByTarget(userId);
+    const sharedByMe = this.getSharesByOwner(userId);
     return {
       user: this.publicUser(user),
-      devices: this.data.devices.filter((device) => device.ownerUserId === userId).map((device) => this.publicDevice(device, connectedDevices.get(device.id) ?? null)),
-      sharedWithMe: this.data.shares.filter(
-        (share) => share.targetUserId === userId && !share.revokedAt
-      ).map((share) => this.publicShare(share)),
-      sharedByMe: this.data.shares.filter(
-        (share) => share.ownerUserId === userId && !share.revokedAt
-      ).map((share) => this.publicShare(share))
+      devices: devices.map((device) => this.publicDevice(device, connectedDevices.get(device.id) ?? null)),
+      sharedWithMe: sharedWithMe.map((share) => this.publicShare(share)),
+      sharedByMe: sharedByMe.map((share) => this.publicShare(share))
     };
   }
   adminSummary(connectedDevices) {
     return {
-      users: this.data.users.map((user) => this.publicUser(user)),
-      devices: this.data.devices.map(
+      users: this.getUsers().map((user) => this.publicUser(user)),
+      devices: this.getDevices().map(
         (device) => this.publicDevice(device, connectedDevices.get(device.id) ?? null)
       ),
-      registrationEnabled: this.data.registrationEnabled
+      registrationEnabled: this.registrationEnabled()
     };
   }
   setRegistrationEnabled(enabled) {
-    this.data.registrationEnabled = enabled;
-    void this.persist();
+    this.setSetting("registrationEnabled", enabled ? "true" : "false");
     return enabled;
   }
   setUserEnabled(userId, enabled) {
@@ -274,15 +281,14 @@ var RelayStore = class _RelayStore {
     if (user.role === "admin" && !enabled) {
       throw new RelayStoreError(400, "bad_request", "The admin user cannot be disabled.");
     }
-    user.enabled = enabled;
-    void this.persist();
-    return this.publicUser(user);
+    this.sqlite.prepare("UPDATE relay_users SET enabled = ? WHERE id = ?").run(enabled ? 1 : 0, userId);
+    return this.publicUser({ ...user, enabled });
   }
   emptySession() {
     return {
       authenticated: false,
       user: null,
-      registrationEnabled: this.data.registrationEnabled
+      registrationEnabled: this.registrationEnabled()
     };
   }
   publicDevice(device, status) {
@@ -298,9 +304,9 @@ var RelayStore = class _RelayStore {
     };
   }
   publicShare(share) {
-    const owner = this.data.users.find((user) => user.id === share.ownerUserId);
-    const target = this.data.users.find((user) => user.id === share.targetUserId);
-    const device = this.data.devices.find((entry) => entry.id === share.deviceId);
+    const owner = this.getUser(share.ownerUserId);
+    const target = this.getUser(share.targetUserId);
+    const device = this.getDevice(share.deviceId);
     return {
       ...share,
       ownerUsername: share.ownerUsername ?? owner?.username ?? "unknown",
@@ -308,6 +314,100 @@ var RelayStore = class _RelayStore {
       deviceName: share.deviceName ?? device?.name ?? "Remote Codex device"
     };
   }
+  migrate() {
+    this.sqlite.exec(`
+      CREATE TABLE IF NOT EXISTS relay_settings (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS relay_users (
+        id TEXT PRIMARY KEY,
+        email TEXT NOT NULL UNIQUE,
+        username TEXT NOT NULL UNIQUE,
+        role TEXT NOT NULL CHECK (role IN ('admin', 'user')),
+        enabled INTEGER NOT NULL DEFAULT 1,
+        created_at TEXT NOT NULL,
+        password_salt TEXT NOT NULL,
+        password_hash TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS relay_devices (
+        id TEXT PRIMARY KEY,
+        owner_user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        token_hash TEXT NOT NULL UNIQUE,
+        token_preview TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS relay_devices_owner_idx ON relay_devices(owner_user_id);
+
+      CREATE TABLE IF NOT EXISTS relay_shares (
+        id TEXT PRIMARY KEY,
+        owner_user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
+        owner_username TEXT,
+        target_user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
+        target_username TEXT,
+        device_id TEXT NOT NULL REFERENCES relay_devices(id) ON DELETE CASCADE,
+        device_name TEXT,
+        thread_id TEXT NOT NULL,
+        label TEXT,
+        created_at TEXT NOT NULL,
+        revoked_at TEXT
+      );
+
+      CREATE INDEX IF NOT EXISTS relay_shares_owner_idx ON relay_shares(owner_user_id);
+      CREATE INDEX IF NOT EXISTS relay_shares_target_idx ON relay_shares(target_user_id);
+      CREATE INDEX IF NOT EXISTS relay_shares_device_thread_idx ON relay_shares(device_id, thread_id);
+    `);
+  }
+  importLegacyJson(legacyJsonPath) {
+    if (!legacyJsonPath || !fs.existsSync(legacyJsonPath)) {
+      return;
+    }
+    const existingUsers = this.sqlite.prepare("SELECT COUNT(*) AS count FROM relay_users").get();
+    const imported = this.getSetting("legacyJsonImported");
+    if (existingUsers.count > 0 || imported === legacyJsonPath) {
+      return;
+    }
+    const parsed = JSON.parse(fs.readFileSync(legacyJsonPath, "utf8"));
+    const data = {
+      registrationEnabled: typeof parsed.registrationEnabled === "boolean" ? parsed.registrationEnabled : true,
+      users: Array.isArray(parsed.users) ? parsed.users : [],
+      devices: Array.isArray(parsed.devices) ? parsed.devices : [],
+      shares: Array.isArray(parsed.shares) ? parsed.shares : []
+    };
+    const importData = this.sqlite.transaction(() => {
+      this.setSetting("registrationEnabled", data.registrationEnabled ? "true" : "false");
+      for (const user of data.users) {
+        this.insertUser(user);
+      }
+      for (const device of data.devices) {
+        this.insertDevice(device);
+      }
+      for (const share of data.shares) {
+        this.insertShare(share);
+      }
+      this.setSetting("legacyJsonImported", legacyJsonPath);
+    });
+    importData();
+  }
+  ensureRegistrationSetting(registrationEnabled) {
+    if (this.getSetting("registrationEnabled") === null) {
+      this.setSetting("registrationEnabled", registrationEnabled ? "true" : "false");
+    }
+  }
+  registrationEnabled() {
+    return this.getSetting("registrationEnabled") !== "false";
+  }
+  getSetting(key) {
+    const row = this.sqlite.prepare("SELECT value FROM relay_settings WHERE key = ?").get(key);
+    return row?.value ?? null;
+  }
+  setSetting(key, value) {
+    this.sqlite.prepare("INSERT INTO relay_settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
+  }
   createStoredUser(input) {
     const email = input.email.trim().toLowerCase();
     const username = normalizeUsername(input.username);
@@ -320,9 +420,7 @@ var RelayStore = class _RelayStore {
     if (input.password.length < 8) {
       throw new RelayStoreError(400, "bad_request", "Password must be at least 8 characters.");
     }
-    if (this.data.users.some(
-      (user) => user.email.toLowerCase() === email || user.username.toLowerCase() === username
-    )) {
+    if (this.getUserByIdentifier(email) || this.getUserByUsername(username)) {
       throw new RelayStoreError(409, "conflict", "A user with that email or username already exists.");
     }
     const passwordSalt = crypto.randomBytes(16).toString("base64url");
@@ -344,7 +442,7 @@ var RelayStore = class _RelayStore {
       session: {
         authenticated: true,
         user: this.publicUser(user),
-        registrationEnabled: this.data.registrationEnabled
+        registrationEnabled: this.registrationEnabled()
       }
     };
   }
@@ -378,7 +476,7 @@ var RelayStore = class _RelayStore {
     }
   }
   requireUser(userId) {
-    const user = this.data.users.find((entry) => entry.id === userId);
+    const user = this.getUser(userId);
     if (!user) {
       throw new RelayStoreError(404, "not_found", "User was not found.");
     }
@@ -394,28 +492,132 @@ var RelayStore = class _RelayStore {
       createdAt: user.createdAt
     };
   }
-  readData(registrationEnabled) {
-    try {
-      const parsed = JSON.parse(fs.readFileSync(this.filePath, "utf8"));
-      return {
-        registrationEnabled: typeof parsed.registrationEnabled === "boolean" ? parsed.registrationEnabled : registrationEnabled,
-        users: Array.isArray(parsed.users) ? parsed.users : [],
-        devices: Array.isArray(parsed.devices) ? parsed.devices : [],
-        shares: Array.isArray(parsed.shares) ? parsed.shares : []
-      };
-    } catch {
-      return {
-        registrationEnabled,
-        users: [],
-        devices: [],
-        shares: []
-      };
-    }
+  insertUser(user) {
+    this.sqlite.prepare(
+      `
+          INSERT INTO relay_users (
+            id, email, username, role, enabled, created_at, password_salt, password_hash
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        `
+    ).run(
+      user.id,
+      user.email,
+      user.username,
+      user.role,
+      user.enabled ? 1 : 0,
+      user.createdAt,
+      user.passwordSalt,
+      user.passwordHash
+    );
   }
-  async persist() {
-    await fsp.mkdir(path.dirname(this.filePath), { recursive: true });
-    await fsp.writeFile(this.filePath, `${JSON.stringify(this.data, null, 2)}
-`, "utf8");
+  insertDevice(device) {
+    this.sqlite.prepare(
+      `
+          INSERT INTO relay_devices (
+            id, owner_user_id, name, token_hash, token_preview, created_at
+          ) VALUES (?, ?, ?, ?, ?, ?)
+        `
+    ).run(
+      device.id,
+      device.ownerUserId,
+      device.name,
+      device.tokenHash,
+      device.tokenPreview,
+      device.createdAt
+    );
+  }
+  insertShare(share) {
+    this.sqlite.prepare(
+      `
+          INSERT INTO relay_shares (
+            id, owner_user_id, owner_username, target_user_id, target_username,
+            device_id, device_name, thread_id, label, created_at, revoked_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `
+    ).run(
+      share.id,
+      share.ownerUserId,
+      share.ownerUsername,
+      share.targetUserId,
+      share.targetUsername,
+      share.deviceId,
+      share.deviceName,
+      share.threadId,
+      share.label,
+      share.createdAt,
+      share.revokedAt
+    );
+  }
+  getUser(id) {
+    return this.rowToUser(this.sqlite.prepare("SELECT * FROM relay_users WHERE id = ?").get(id));
+  }
+  getUserByIdentifier(identifier) {
+    return this.rowToUser(
+      this.sqlite.prepare("SELECT * FROM relay_users WHERE email = ? OR username = ?").get(identifier.toLowerCase(), identifier.toLowerCase())
+    );
+  }
+  getUserByUsername(username) {
+    return this.rowToUser(
+      this.sqlite.prepare("SELECT * FROM relay_users WHERE username = ?").get(normalizeUsername(username))
+    );
+  }
+  getUsers() {
+    return this.sqlite.prepare("SELECT * FROM relay_users ORDER BY created_at ASC").all().map((row) => this.rowToUser(row)).filter((user) => Boolean(user));
+  }
+  getDevice(id) {
+    return this.rowToDevice(this.sqlite.prepare("SELECT * FROM relay_devices WHERE id = ?").get(id));
+  }
+  getDevices() {
+    return this.sqlite.prepare("SELECT * FROM relay_devices ORDER BY created_at ASC").all().map((row) => this.rowToDevice(row)).filter((device) => Boolean(device));
+  }
+  getDevicesByOwner(ownerUserId) {
+    return this.sqlite.prepare("SELECT * FROM relay_devices WHERE owner_user_id = ? ORDER BY created_at ASC").all(ownerUserId).map((row) => this.rowToDevice(row)).filter((device) => Boolean(device));
+  }
+  getSharesByOwner(ownerUserId) {
+    return this.sqlite.prepare("SELECT * FROM relay_shares WHERE owner_user_id = ? AND revoked_at IS NULL ORDER BY created_at ASC").all(ownerUserId).map((row) => this.rowToShare(row)).filter((share) => Boolean(share));
+  }
+  getSharesByTarget(targetUserId) {
+    return this.sqlite.prepare("SELECT * FROM relay_shares WHERE target_user_id = ? AND revoked_at IS NULL ORDER BY created_at ASC").all(targetUserId).map((row) => this.rowToShare(row)).filter((share) => Boolean(share));
+  }
+  rowToUser(row) {
+    if (!row) return null;
+    return {
+      id: row.id,
+      email: row.email,
+      username: row.username,
+      role: row.role,
+      enabled: Boolean(row.enabled),
+      createdAt: row.created_at,
+      passwordSalt: row.password_salt,
+      passwordHash: row.password_hash
+    };
+  }
+  rowToDevice(row) {
+    if (!row) return null;
+    return {
+      id: row.id,
+      ownerUserId: row.owner_user_id,
+      name: row.name,
+      tokenHash: row.token_hash,
+      tokenPreview: row.token_preview,
+      createdAt: row.created_at
+    };
+  }
+  rowToShare(row) {
+    if (!row) return null;
+    return {
+      id: row.id,
+      ownerUserId: row.owner_user_id,
+      ownerUsername: row.owner_username ?? "unknown",
+      targetUserId: row.target_user_id,
+      targetUsername: row.target_username ?? "unknown",
+      deviceId: row.device_id,
+      deviceName: row.device_name ?? "Remote Codex device",
+      threadId: row.thread_id,
+      label: row.label,
+      createdAt: row.created_at,
+      revokedAt: row.revoked_at
+    };
   }
 };
 var RelayStoreError = class extends Error {
@@ -935,12 +1137,12 @@ function registerRelayWebApp(app2, distDirInput) {
       return;
     }
     if (assetPath === indexFile) {
-      const html = await fsp2.readFile(indexFile, "utf8");
+      const html = await fsp.readFile(indexFile, "utf8");
       const payload = injectRelayBootstrap(html);
       reply.header("cache-control", "no-cache").header("content-length", Buffer.byteLength(payload)).type("text/html; charset=utf-8");
       return reply.send(payload);
     }
-    const stat = await fsp2.stat(assetPath);
+    const stat = await fsp.stat(assetPath);
     reply.header("cache-control", "public, max-age=31536000, immutable").header("content-length", stat.size).type(mimeTypes.get(path2.extname(assetPath).toLowerCase()) ?? "application/octet-stream");
     return reply.send(fs2.createReadStream(assetPath));
   });
@@ -1152,7 +1354,7 @@ function escapeRegExp(value) {
 }
 async function safeStat(filePath) {
   try {
-    return await fsp2.stat(filePath);
+    return await fsp.stat(filePath);
   } catch {
     return null;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "remote-codex",
-  "version": "0.11.5",
+  "version": "0.11.6",
   "description": "Local web supervisor for Codex workspaces and threads.",
   "license": "MIT",
   "type": "module",