remote-dsh 0.5.0 → 0.7.0

package/README.md

@@ -4,10 +4,11 @@ Secure remote access for [DeepSeek Harness](https://github.com/deepseek-ai/deeps
 
 ```bash
 npm install -g remote-dsh
-rdsh serve   # LAN auth gateway in front of dsh web (M1 MVP)
+rdsh host setup lan   # write ~/.rdsh/host.json (LAN gateway: pair auth)
+rdsh host serve       # run the gateway in the foreground
 ```
 
-> **v0.1.0** is a name-reservation skeleton. Commands land with the M1 MVP.
+> See `doc/overview/usage.md` for the full manual (`rdsh host setup lan|cloud`, `rdsh host join <hub>`, `rdsh hub serve`, ...).
 
 ## License
 

package/dist/bin.js

@@ -10,7 +10,6 @@
  */
 import { createInterface } from "node:readline";
 import { rm } from "node:fs/promises";
-import { hostname as osHostname } from "node:os";
 import { dirname } from "node:path";
 import { serve, join, registerJoin, findDsh, selfRevoke, readPersistedToken, clearPersistedToken, UserManager, resolveConfigPath, loadConfig, saveConfig, installService, uninstallService, serviceStatus, HOST_SERVICE_NAME, JOIN_SERVICE_NAME, HUB_SERVICE_NAME, } from "rdsh-gateway";
 import { loadHubConfig, resolveHubConfigPath, HubDb, hashPassword, serveHub, } from "rdsh-hub";
@@ -25,7 +24,8 @@ Usage:
   rdsh host leave             Unregister this machine from the hub
   rdsh host user ...          Manage gateway users (LAN/cloud password auth)
   rdsh hub serve              Start the hub server (cloud, multi-host)
-  rdsh hub user add|passwd|rm|ls
+  rdsh hub user add|passwd|rm|ls|unlock|reset-2fa|ban|unban
+  rdsh hub audit ls           Audit log (login/2FA/sharing/email events)
   rdsh hub host ls|revoke     List / revoke hosts (revoke drops the tunnel instantly)
   rdsh hub service ...        Run hub as a systemd/launchd service
 
@@ -60,7 +60,8 @@ Run the hub server or manage it.
 
 Subcommands:
   serve                 Start the hub server (TLS required)
-  user add|passwd|rm|ls Manage users (registration closed; admin creates accounts)
+  user add|passwd|rm|ls|unlock|reset-2fa|ban|unban   Manage users (admin creates accounts; unlock / reset-2fa / ban / unban)
+  audit ls [--user <n>] [--event <e>] [--since 24h|7d]   Query the audit log
   host ls|revoke        List / revoke hosts (revoke drops the tunnel instantly)
   service install|status|uninstall   Run hub as a systemd/launchd service
 
@@ -284,7 +285,7 @@ async function handleHostJoin(args, configPath) {
     const config = await loadConfig(target);
     config.mode = "join";
     config.hub = hubUrl;
-    config.name = opts.name ?? osHostname();
+    config.name = outcome.name;
     config.insecure = outcome.insecure;
     config.dshPath = opts.dshPath ?? findDsh() ?? config.dshPath;
     await saveConfig(target, config);
@@ -356,7 +357,7 @@ async function maybeRegisterForServiceInstall(args, target) {
     const cfg = await loadConfig(target);
     cfg.mode = "join";
     cfg.hub = maybeHub;
-    cfg.name = joinOpts.name ?? osHostname();
+    cfg.name = outcome.name;
     cfg.insecure = outcome.insecure;
     cfg.dshPath = joinOpts.dshPath ?? findDsh() ?? cfg.dshPath;
     await saveConfig(target, cfg);
@@ -436,6 +437,56 @@ async function openHubDb(configPath) {
     const config = await loadHubConfig(hubConfigPath);
     return new HubDb(config.dbPath);
 }
+/** `rdsh hub audit ls [--user <name>] [--event <e>] [--since 24h|7d]`。 */
+async function handleHubAudit(args, configPath) {
+    const db = await openHubDb(configPath);
+    try {
+        // 兼容 `audit ls` 与 `audit`（ls 为可选位置参数）
+        const opts = args[0] === "ls" ? args.slice(1) : args;
+        const filter = {};
+        for (let i = 0; i < opts.length; i++) {
+            const flag = opts[i];
+            if (flag === "--user") {
+                const name = opts[++i];
+                if (name === undefined)
+                    throw new Error("missing value for --user");
+                const u = db.getUserByName(name);
+                if (u === null)
+                    throw new Error(`user '${name}' not found`);
+                filter.userId = u.id;
+            }
+            else if (flag === "--event") {
+                filter.event = opts[++i];
+                if (filter.event === undefined)
+                    throw new Error("missing value for --event");
+            }
+            else if (flag === "--since") {
+                const v = opts[++i];
+                if (v === undefined)
+                    throw new Error("missing value for --since");
+                const m = /^(\d+)([hd])$/.exec(v);
+                if (m === null)
+                    throw new Error(`invalid --since '${v}' (use like 24h or 7d)`);
+                filter.since = Date.now() - Number(m[1]) * (m[2] === "h" ? 3_600_000 : 86_400_000);
+            }
+            else {
+                throw new Error(`unknown option '${flag}'`);
+            }
+        }
+        const events = db.listAudit(filter);
+        if (events.length === 0) {
+            console.log("(no events)");
+            return;
+        }
+        for (const e of events) {
+            const user = e.userId !== null ? db.getUserById(e.userId) : null;
+            console.log(`${new Date(e.createdAt).toISOString()}  ${user?.name ?? "-"}  ${e.event}  ip=${e.ip}  ${e.detailJson}`);
+        }
+    }
+    finally {
+        db.close();
+    }
+}
 async function handleHub(args, configPath) {
     const sub = args[0];
     const rest = args.slice(1);
@@ -457,6 +508,10 @@ async function handleHub(args, configPath) {
             await handleHubHost(rest, configPath);
             return;
         }
+        case "audit": {
+            await handleHubAudit(rest, configPath);
+            return;
+        }
         case "service": {
             const action = rest[0];
             const hubConfigPath = resolveHubConfigPath(configPath);
@@ -476,7 +531,7 @@ async function handleHub(args, configPath) {
             }
         }
         default:
-            throw new Error("usage: rdsh hub serve|user|host|service");
+            throw new Error("usage: rdsh hub serve|user|host|audit|service");
     }
 }
 function parseHubServeArgs(args, configPath) {
@@ -528,20 +583,21 @@ async function handleHubUser(args, configPath) {
             case "add": {
                 const name = args[1];
                 if (name === undefined)
-                    throw new Error("usage: rdsh hub user add <name> [--no-password]");
+                    throw new Error("usage: rdsh hub user add <name> [--no-password] [--role <user|readonly|operator|admin>]");
                 const noPassword = args.includes("--no-password");
+                const roleIdx = args.indexOf("--role");
+                const role = roleIdx >= 0 && args[roleIdx + 1] !== undefined ? args[roleIdx + 1] : "user";
+                if (!["user", "readonly", "operator", "admin"].includes(role))
+                    throw new Error(`invalid role '${role}' (user|readonly|operator|admin)`);
                 const hubConfigPath = resolveHubConfigPath(configPath);
                 if (db.getUserByName(name) !== null)
                     throw new Error(`user '${name}' already exists`);
-                if (noPassword) {
-                    db.createUser(name, "scrypt:disabled", new Date().toISOString(), true);
-                    console.log(`rdsh: user '${name}' created — they must set a password on first sign-in (${hubConfigPath})`);
-                }
-                else {
-                    const password = await promptPasswordTwice(`password for ${name}: `);
-                    db.createUser(name, await hashPassword(password));
-                    console.log(`rdsh: user '${name}' created (hub db: ${db.path})`);
-                }
+                const user = noPassword
+                    ? db.createUser(name, "scrypt:disabled", new Date().toISOString(), true)
+                    : db.createUser(name, await hashPassword(await promptPasswordTwice(`password for ${name}: `)));
+                if (role !== "user")
+                    db.setRole(user.id, role);
+                console.log(`rdsh: user '${name}' created (role: ${role}${noPassword ? " — must set password on first sign-in" : ""})`);
                 return;
             }
             case "passwd": {
@@ -558,7 +614,7 @@ async function handleHubUser(args, configPath) {
             }
             case "ls": {
                 const users = db.listUsers();
-                console.log(users.length > 0 ? users.map((u) => u.name).join("\n") : "(no users)");
+                console.log(users.length > 0 ? users.map((u) => `${u.name}\t${u.role}`).join("\n") : "(no users)");
                 return;
             }
             case "rm": {
@@ -572,8 +628,53 @@ async function handleHubUser(args, configPath) {
                 console.log(`rdsh: user '${name}' removed (their hosts removed)`);
                 return;
             }
+            case "unlock": {
+                const name = args[1];
+                if (name === undefined)
+                    throw new Error("usage: rdsh hub user unlock <name>");
+                const user = db.getUserByName(name);
+                if (user === null)
+                    throw new Error(`user '${name}' not found`);
+                db.unlockAccount(user.id);
+                console.log(`rdsh: user '${name}' unlocked`);
+                return;
+            }
+            case "reset-2fa": {
+                const name = args[1];
+                if (name === undefined)
+                    throw new Error("usage: rdsh hub user reset-2fa <name>");
+                const user = db.getUserByName(name);
+                if (user === null)
+                    throw new Error(`user '${name}' not found`);
+                db.clearTotpSecret(user.id);
+                db.bumpVersion(user.id);
+                console.log(`rdsh: 2FA reset for '${name}' (their sessions revoked)`);
+                return;
+            }
+            case "ban": {
+                const name = args[1];
+                if (name === undefined)
+                    throw new Error("usage: rdsh hub user ban <name>");
+                const user = db.getUserByName(name);
+                if (user === null)
+                    throw new Error(`user '${name}' not found`);
+                db.setAccountStatus(user.id, "banned");
+                console.log(`rdsh: user '${name}' banned (login + host access blocked)`);
+                return;
+            }
+            case "unban": {
+                const name = args[1];
+                if (name === undefined)
+                    throw new Error("usage: rdsh hub user unban <name>");
+                const user = db.getUserByName(name);
+                if (user === null)
+                    throw new Error(`user '${name}' not found`);
+                db.setAccountStatus(user.id, "active");
+                console.log(`rdsh: user '${name}' unbanned (plan restored)`);
+                return;
+            }
             default:
-                throw new Error("usage: rdsh hub user add|passwd|ls|rm");
+                throw new Error("usage: rdsh hub user add|passwd|ls|rm|unlock|reset-2fa|ban|unban");
         }
     }
     finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "remote-dsh",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Secure remote access for DeepSeek Harness: rdsh serve / rdsh join / rdsh hub",
   "license": "MIT",
   "type": "module",
@@ -23,8 +23,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    "rdsh-gateway": "0.3.0",
-    "rdsh-hub": "0.3.0"
+    "rdsh-gateway": "0.5.0",
+    "rdsh-hub": "0.5.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",