repoburg 1.3.217 → 1.3.219

package/daemon/dist/remote/access-jwt.spec.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const access_jwt_1 = require("./access-jwt");
+const jose = __importStar(require("jose"));
+/**
+ * Real-crypto tests: sign actual Access-style JWTs with an injected HMAC key
+ * and verify the email-pinning logic on top of signature/iss/aud checks.
+ */
+const SECRET = new TextEncoder().encode('test-secret-for-specs-only');
+const CONFIG = { teamDomain: 'team.cloudflareaccess.com', aud: 'aud-tag' };
+const jwks = (async () => SECRET);
+async function makeAssertion(claims) {
+    return new jose.SignJWT(claims)
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuer('https://team.cloudflareaccess.com')
+        .setAudience('aud-tag')
+        .setExpirationTime('2h')
+        .sign(SECRET);
+}
+describe('verifyAccessJwt', () => {
+    it('accepts a valid token signed by the team', async () => {
+        const assertion = await makeAssertion({ common_name: 'owner@repoburg.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks })).resolves.toBeUndefined();
+    });
+    it('accepts any identity when no owner email is pinned (optional check)', async () => {
+        const assertion = await makeAssertion({ common_name: 'someone-else@evil.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks })).resolves.toBeUndefined();
+    });
+    it('rejects a wrong-email token when the owner email is pinned', async () => {
+        const assertion = await makeAssertion({ common_name: 'hacker@evil.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).rejects.toThrow(/does not match the machine owner/);
+    });
+    it('accepts the pinned owner email', async () => {
+        const assertion = await makeAssertion({ common_name: 'owner@repoburg.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).resolves.toBeUndefined();
+    });
+    it('matches the pinned owner email via the email claim (real CF Access format)', async () => {
+        // Live-verified 2026-09: CF Access JWTs carry `email`, NOT `common_name`.
+        const assertion = await makeAssertion({ email: 'owner@repoburg.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).resolves.toBeUndefined();
+    });
+    it('rejects a wrong email claim when the owner email is pinned', async () => {
+        const assertion = await makeAssertion({ email: 'hacker@evil.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).rejects.toThrow(/does not match the machine owner/);
+    });
+    it('rejects a token with neither email nor common_name when pinned', async () => {
+        const assertion = await makeAssertion({ sub: '99dd1943-5978-589e-9dd0-884f0c79e926' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(assertion, CONFIG, { jwks, ownerEmail: 'owner@repoburg.com' })).rejects.toThrow(/does not match the machine owner/);
+    });
+    it('rejects tokens with a wrong issuer or audience', async () => {
+        const wrongIss = await new jose.SignJWT({ common_name: 'owner@repoburg.com' })
+            .setProtectedHeader({ alg: 'HS256' })
+            .setIssuer('https://other-team.cloudflareaccess.com')
+            .setAudience('aud-tag')
+            .setExpirationTime('2h')
+            .sign(SECRET);
+        await expect((0, access_jwt_1.verifyAccessJwt)(wrongIss, CONFIG, { jwks })).rejects.toThrow();
+        const wrongAud = await makeAssertion({ common_name: 'owner@repoburg.com' });
+        await expect((0, access_jwt_1.verifyAccessJwt)(wrongAud, { teamDomain: 'team.cloudflareaccess.com', aud: 'other-aud' }, { jwks })).rejects.toThrow();
+    });
+});

package/daemon/dist/remote/cloudflared.js

@@ -0,0 +1,239 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultExecutor = exports.CLOUDFLARED_METRICS_PORT = void 0;
+exports.detectPlatform = detectPlatform;
+exports.assetName = assetName;
+exports.installDir = installDir;
+exports.cloudflaredBinaryPath = cloudflaredBinaryPath;
+exports.isInstalled = isInstalled;
+exports.selectChecksum = selectChecksum;
+exports.downloadCloudflared = downloadCloudflared;
+exports.cloudflaredMetricsUrl = cloudflaredMetricsUrl;
+exports.systemdUnitContent = systemdUnitContent;
+exports.launchdPlistContent = launchdPlistContent;
+exports.systemdUnitPath = systemdUnitPath;
+exports.launchdPlistPath = launchdPlistPath;
+exports.installService = installService;
+exports.removeService = removeService;
+exports.isServiceRunning = isServiceRunning;
+/**
+ * cloudflared installer + system service management (user-level, no root).
+ *
+ * Download spec: latest GitHub release asset per platform, verified against
+ * the release's checksums.txt. macOS binaries are shipped as .tgz; the
+ * fallback handles both plain and archived assets.
+ */
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const exec = (0, util_1.promisify)(child_process_1.execFile);
+const RELEASE_BASE = 'https://github.com/cloudflare/cloudflared/releases/latest/download';
+function detectPlatform() {
+    const platform = os_1.default.platform();
+    const arch = os_1.default.arch();
+    if (platform !== 'linux' && platform !== 'darwin') {
+        throw new Error(`Unsupported platform for cloudflared: ${platform}`);
+    }
+    if (arch !== 'x64' && arch !== 'arm64') {
+        throw new Error(`Unsupported architecture for cloudflared: ${arch}`);
+    }
+    return { platform, arch };
+}
+/** Release asset name for a platform (plain binary). */
+function assetName({ platform, arch }) {
+    const osPart = platform === 'darwin' ? 'darwin' : 'linux';
+    const archPart = arch === 'x64' ? 'amd64' : 'arm64';
+    return `cloudflared-${osPart}-${archPart}`;
+}
+function installDir(home = os_1.default.homedir()) {
+    return path_1.default.join(home, '.repoburg', 'bin');
+}
+function cloudflaredBinaryPath(home = os_1.default.homedir()) {
+    return path_1.default.join(installDir(home), 'cloudflared');
+}
+function isInstalled(home = os_1.default.homedir()) {
+    return fs_extra_1.default.existsSync(cloudflaredBinaryPath(home));
+}
+/** Pick the sha256 from the checksums.txt content for an asset. */
+function selectChecksum(checksumsTxt, asset) {
+    const line = checksumsTxt.split('\n').find((entry) => entry.trim().endsWith(asset));
+    const match = line?.match(/^([0-9a-f]{64})\s+\S+$/);
+    return match ? match[1] : null;
+}
+async function fetchText(url) {
+    const response = await fetch(url);
+    if (!response.ok)
+        throw new Error(`Download failed (${response.status}): ${url}`);
+    return response.text();
+}
+async function fetchBuffer(url) {
+    const response = await fetch(url);
+    if (!response.ok)
+        throw new Error(`Download failed (${response.status}): ${url}`);
+    return Buffer.from(await response.arrayBuffer());
+}
+/**
+ * Download cloudflared into ~/.repoburg/bin, sha256-verified.
+ * Throws when the checksum does not match — never install an unverified binary.
+ */
+async function downloadCloudflared(options = {}) {
+    const home = options.home ?? os_1.default.homedir();
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const platformInfo = options.platform ?? detectPlatform();
+    const asset = assetName(platformInfo);
+    const checksumsTxt = await (async (url) => {
+        const response = await fetchImpl(url);
+        if (!response.ok)
+            throw new Error(`Checksums download failed (${response.status})`);
+        return response.text();
+    })(`${RELEASE_BASE}/cloudflared_checksums.txt`);
+    const expected = selectChecksum(checksumsTxt, asset);
+    if (!expected)
+        throw new Error(`No checksum found for asset ${asset}`);
+    const dir = installDir(home);
+    fs_extra_1.default.ensureDirSync(dir);
+    let binary;
+    const binaryUrl = `${RELEASE_BASE}/${asset}`;
+    const binaryResponse = await fetchImpl(binaryUrl);
+    if (binaryResponse.ok) {
+        binary = Buffer.from(await binaryResponse.arrayBuffer());
+    }
+    else if (platformInfo.platform === 'darwin') {
+        // macOS releases ship as .tgz; extract with the system tar.
+        const tgz = Buffer.from(await (await fetchImpl(`${binaryUrl}.tgz`)).arrayBuffer());
+        const tgzPath = path_1.default.join(dir, `${asset}.tgz`);
+        fs_extra_1.default.writeFileSync(tgzPath, tgz);
+        await exec('tar', ['-xzf', tgzPath, '-C', dir]);
+        fs_extra_1.default.removeSync(tgzPath);
+        const binaryPath = cloudflaredBinaryPath(home);
+        if (!fs_extra_1.default.existsSync(binaryPath))
+            throw new Error('cloudflared extraction produced no binary');
+        return binaryPath;
+    }
+    else {
+        throw new Error(`Binary download failed (${binaryResponse.status})`);
+    }
+    const actual = crypto_1.default.createHash('sha256').update(binary).digest('hex');
+    if (actual !== expected) {
+        throw new Error(`Checksum mismatch for ${asset}: expected ${expected}, got ${actual}`);
+    }
+    const binaryPath = cloudflaredBinaryPath(home);
+    fs_extra_1.default.writeFileSync(binaryPath, binary);
+    fs_extra_1.default.chmodSync(binaryPath, 0o755);
+    return binaryPath;
+}
+// --- System service files (user-level, no root required) ---
+const SERVICE_NAME_LINUX = 'repoburg-cloudflared';
+const SERVICE_ID_DARWIN = 'com.repoburg.cloudflared';
+/** Loopback metrics endpoint (tunnel connectivity is probed from here). */
+exports.CLOUDFLARED_METRICS_PORT = 20241;
+function cloudflaredMetricsUrl() {
+    return `http://127.0.0.1:${exports.CLOUDFLARED_METRICS_PORT}/metrics`;
+}
+function systemdUnitContent(binaryPath, tunnelToken) {
+    return ` [Unit]
+Description=Repoburg remote access tunnel (cloudflared)
+After=network-online.target
+
+[Service]
+ExecStart=${binaryPath} tunnel --metrics 127.0.0.1:${exports.CLOUDFLARED_METRICS_PORT} run --token ${tunnelToken}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`.trimStart();
+}
+function launchdPlistContent(binaryPath, tunnelToken) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${SERVICE_ID_DARWIN}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${binaryPath}</string>
+    <string>tunnel</string>
+    <string>--metrics</string>
+    <string>127.0.0.1:${exports.CLOUDFLARED_METRICS_PORT}</string>
+    <string>run</string>
+    <string>--token</string>
+    <string>${tunnelToken}</string>
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${installDir()}/cloudflared.log</string>
+  <key>StandardErrorPath</key><string>${installDir()}/cloudflared.log</string>
+</dict>
+</plist>
+`;
+}
+function systemdUnitPath(home = os_1.default.homedir()) {
+    return path_1.default.join(home, '.config', 'systemd', 'user', `${SERVICE_NAME_LINUX}.service`);
+}
+function launchdPlistPath(home = os_1.default.homedir()) {
+    return path_1.default.join(home, 'Library', 'LaunchAgents', `${SERVICE_ID_DARWIN}.plist`);
+}
+exports.defaultExecutor = exec;
+/** Write the service file and enable it (idempotent). Returns the service file path. */
+async function installService(tunnelToken, options = {}) {
+    const home = options.home ?? os_1.default.homedir();
+    const platform = options.platform ?? os_1.default.platform();
+    const executor = options.executor ?? exports.defaultExecutor;
+    const binaryPath = cloudflaredBinaryPath(home);
+    if (platform === 'darwin') {
+        const plistPath = launchdPlistPath(home);
+        fs_extra_1.default.ensureDirSync(path_1.default.dirname(plistPath));
+        fs_extra_1.default.writeFileSync(plistPath, launchdPlistContent(binaryPath, tunnelToken));
+        await executor('launchctl', ['unload', plistPath]).catch(() => undefined);
+        await executor('launchctl', ['load', plistPath]);
+        return plistPath;
+    }
+    const unitPath = systemdUnitPath(home);
+    fs_extra_1.default.ensureDirSync(path_1.default.dirname(unitPath));
+    fs_extra_1.default.writeFileSync(unitPath, systemdUnitContent(binaryPath, tunnelToken));
+    await executor('systemctl', ['--user', 'daemon-reload']);
+    await executor('systemctl', ['--user', 'enable', '--now', SERVICE_NAME_LINUX]);
+    return unitPath;
+}
+async function removeService(options = {}) {
+    const home = options.home ?? os_1.default.homedir();
+    const platform = options.platform ?? os_1.default.platform();
+    const executor = options.executor ?? exports.defaultExecutor;
+    if (platform === 'darwin') {
+        const plistPath = launchdPlistPath(home);
+        if (fs_extra_1.default.existsSync(plistPath)) {
+            await executor('launchctl', ['unload', plistPath]).catch(() => undefined);
+            fs_extra_1.default.removeSync(plistPath);
+        }
+        return;
+    }
+    await executor('systemctl', ['--user', 'disable', '--now', SERVICE_NAME_LINUX]).catch(() => undefined);
+    fs_extra_1.default.removeSync(systemdUnitPath(home));
+}
+async function isServiceRunning(options = {}) {
+    const platform = options.platform ?? os_1.default.platform();
+    const executor = options.executor ?? exports.defaultExecutor;
+    if (platform === 'darwin') {
+        try {
+            const { stdout } = await executor('launchctl', ['list']);
+            return stdout.includes(SERVICE_ID_DARWIN);
+        }
+        catch {
+            return false;
+        }
+    }
+    try {
+        const { stdout } = await executor('systemctl', ['--user', 'is-active', SERVICE_NAME_LINUX]);
+        return stdout.trim() === 'active';
+    }
+    catch {
+        return false;
+    }
+}

package/daemon/dist/remote/cloudflared.spec.js

@@ -0,0 +1,117 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const cloudflared_1 = require("./cloudflared");
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const tmpHome = fs_extra_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'cloudflared-'));
+describe('cloudflared', () => {
+    describe('assetName', () => {
+        it('maps platforms to release asset names', () => {
+            expect((0, cloudflared_1.assetName)({ platform: 'darwin', arch: 'x64' })).toBe('cloudflared-darwin-amd64');
+            expect((0, cloudflared_1.assetName)({ platform: 'darwin', arch: 'arm64' })).toBe('cloudflared-darwin-arm64');
+            expect((0, cloudflared_1.assetName)({ platform: 'linux', arch: 'x64' })).toBe('cloudflared-linux-amd64');
+            expect((0, cloudflared_1.assetName)({ platform: 'linux', arch: 'arm64' })).toBe('cloudflared-linux-arm64');
+        });
+    });
+    describe('selectChecksum', () => {
+        it('finds the sha256 for an asset in checksums.txt', () => {
+            const txt = [
+                `${'a'.repeat(64)} cloudflared-linux-amd64`,
+                `${'b'.repeat(64)} cloudflared-darwin-arm64`,
+            ].join('\n');
+            expect((0, cloudflared_1.selectChecksum)(txt, 'cloudflared-darwin-arm64')).toBe('b'.repeat(64));
+        });
+        it('returns null for unknown assets', () => {
+            expect((0, cloudflared_1.selectChecksum)('aaa111 other-binary', 'cloudflared-linux-amd64')).toBeNull();
+        });
+    });
+    describe('service file content', () => {
+        it('builds a systemd unit running the tunnel with the token and metrics flag', () => {
+            const content = (0, cloudflared_1.systemdUnitContent)('/bin/cloudflared', 'TOKEN123');
+            // --metrics is a TUNNEL-level flag — it must come BEFORE the run
+            // subcommand (verified live: `tunnel run --metrics` is rejected).
+            expect(content).toContain('ExecStart=/bin/cloudflared tunnel --metrics 127.0.0.1:20241 run --token TOKEN123');
+            expect(content).toContain('WantedBy=default.target');
+        });
+        it('builds a launchd plist running the tunnel with the token and metrics flag', () => {
+            const content = (0, cloudflared_1.launchdPlistContent)('/bin/cloudflared', 'TOKEN123');
+            const args = content.split('\n').map((l) => l.trim()).filter((l) => l.startsWith('<string>'));
+            // Metrics flag must precede the `run` subcommand.
+            expect(args.indexOf('<string>tunnel</string>')).toBeLessThan(args.indexOf('<string>run</string>'));
+            expect(content).toContain('<string>--metrics</string>');
+            expect(content).toContain('<string>127.0.0.1:20241</string>');
+            expect(content).toContain('<string>--token</string>');
+            expect(content).toContain('<string>TOKEN123</string>');
+            expect(content).toContain('<key>KeepAlive</key><true/>');
+        });
+        it('exposes the metrics URL on loopback', () => {
+            expect((0, cloudflared_1.cloudflaredMetricsUrl)()).toBe('http://127.0.0.1:20241/metrics');
+        });
+    });
+    describe('downloadCloudflared', () => {
+        const linux = { platform: 'linux', arch: 'x64' };
+        const makeFetch = (sha) => jest.fn(async (url) => {
+            const href = String(url);
+            if (href.endsWith('cloudflared_checksums.txt')) {
+                return { ok: true, text: async () => `${sha} cloudflared-linux-amd64`, status: 200 };
+            }
+            return { ok: true, arrayBuffer: async () => new Uint8Array([1, 2, 3, 4]), status: 200 };
+        });
+        it('downloads, verifies the checksum, and writes the binary', async () => {
+            const sha = require('crypto').createHash('sha256').update(Buffer.from([1, 2, 3, 4])).digest('hex');
+            const binaryPath = await (0, cloudflared_1.downloadCloudflared)({ home: tmpHome, platform: linux, fetchImpl: makeFetch(sha) });
+            expect(binaryPath).toBe((0, cloudflared_1.cloudflaredBinaryPath)(tmpHome));
+            expect(fs_extra_1.default.existsSync(binaryPath)).toBe(true);
+        });
+        it('rejects a binary whose checksum does not match', async () => {
+            await expect((0, cloudflared_1.downloadCloudflared)({ home: tmpHome, platform: linux, fetchImpl: makeFetch('0'.repeat(64)) })).rejects.toThrow(/Checksum mismatch/);
+        });
+    });
+    describe('system service', () => {
+        const calls = [];
+        const executor = jest.fn(async (cmd, args) => {
+            calls.push([cmd, ...args]);
+            return { stdout: 'active\n' };
+        });
+        beforeEach(() => {
+            calls.length = 0;
+            executor.mockClear();
+        });
+        it('writes a systemd unit and enables it on linux', async () => {
+            const unitPath = await (0, cloudflared_1.installService)('TOKEN', {
+                home: tmpHome,
+                platform: 'linux',
+                executor: executor,
+            });
+            expect(unitPath).toBe((0, cloudflared_1.systemdUnitPath)(tmpHome));
+            expect(fs_extra_1.default.existsSync(unitPath)).toBe(true);
+            expect(calls[0]).toEqual(['systemctl', '--user', 'daemon-reload']);
+            expect(calls[1]).toEqual(['systemctl', '--user', 'enable', '--now', 'repoburg-cloudflared']);
+        });
+        it('writes a launchd plist and loads it on darwin', async () => {
+            const plistPath = await (0, cloudflared_1.installService)('TOKEN', {
+                home: tmpHome,
+                platform: 'darwin',
+                executor: executor,
+            });
+            expect(plistPath).toBe((0, cloudflared_1.launchdPlistPath)(tmpHome));
+            expect(fs_extra_1.default.existsSync(plistPath)).toBe(true);
+            expect(calls.at(-1)).toEqual(['launchctl', 'load', plistPath]);
+        });
+        it('reports the systemd service as running when active', async () => {
+            executor.mockResolvedValue({ stdout: 'active\n' });
+            await expect((0, cloudflared_1.isServiceRunning)({ platform: 'linux', executor: executor })).resolves.toBe(true);
+            executor.mockResolvedValue({ stdout: 'inactive\n' });
+            await expect((0, cloudflared_1.isServiceRunning)({ platform: 'linux', executor: executor })).resolves.toBe(false);
+        });
+        it('removes the systemd unit on linux', async () => {
+            await (0, cloudflared_1.installService)('TOKEN', { home: tmpHome, platform: 'linux', executor: executor });
+            await (0, cloudflared_1.removeService)({ home: tmpHome, platform: 'linux', executor: executor });
+            expect(fs_extra_1.default.existsSync((0, cloudflared_1.systemdUnitPath)(tmpHome))).toBe(false);
+        });
+    });
+});