swayrouter 1.0.0

package/src/lib/auth/dashboardSession.js

@@ -0,0 +1,83 @@
+import { SignJWT, jwtVerify } from "jose";
+import bcrypt from "bcryptjs";
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { DATA_DIR } from "@/lib/dataDir";
+import { env } from "@/lib/env";
+import { getSettings } from "@/lib/localDb";
+
+const DEFAULT_PASSWORD = "123456";
+
+function loadJwtSecret() {
+  if (env.jwtSecret) return env.jwtSecret;
+  const file = path.join(DATA_DIR, "jwt-secret");
+  try {
+    return fs.readFileSync(file, "utf8").trim();
+  } catch {}
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  const generated = crypto.randomBytes(32).toString("hex");
+  fs.writeFileSync(file, generated, { mode: 0o600 });
+  return generated;
+}
+
+const SECRET = new TextEncoder().encode(loadJwtSecret());
+
+export function shouldUseSecureCookie(request) {
+  if (env.authCookieSecure) return true;
+  const forwardedProto = request?.headers?.get?.("x-forwarded-proto");
+  const viaTrustedProxy = request?.headers?.get?.("x-swayrouter-via-proxy") === "1";
+  const isHttpsRequest = env.trustProxy && viaTrustedProxy && forwardedProto === "https";
+  return isHttpsRequest;
+}
+
+export async function createDashboardAuthToken(claims = {}) {
+  return new SignJWT({ authenticated: true, ...claims })
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime("24h")
+    .sign(SECRET);
+}
+
+export async function verifyDashboardAuthToken(token) {
+  if (!token) return false;
+  try {
+    await jwtVerify(token, SECRET);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function getDashboardAuthSession(token) {
+  if (!token) return null;
+  try {
+    const { payload } = await jwtVerify(token, SECRET);
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+export async function setDashboardAuthCookie(cookieStore, request, claims = {}) {
+  const token = await createDashboardAuthToken(claims);
+  cookieStore.set("auth_token", token, {
+    httpOnly: true,
+    secure: shouldUseSecureCookie(request),
+    sameSite: "lax",
+    path: "/",
+  });
+}
+
+export function clearDashboardAuthCookie(cookieStore) {
+  cookieStore.delete("auth_token");
+}
+
+export async function verifyDashboardPassword(password) {
+  if (typeof password !== "string" || !password) return false;
+  const settings = await getSettings();
+  const storedHash = settings?.password;
+  if (storedHash) return bcrypt.compare(password, storedHash);
+  const initialPassword = env.initialPassword || DEFAULT_PASSWORD;
+  return password === initialPassword;
+}

package/src/lib/auth/loginLimiter.js

@@ -0,0 +1,99 @@
+import { authFailuresTotal, loginLockActive } from "@/observability/metrics.js";
+import { env } from "@/lib/env";
+
+const MAX_FAILS_BEFORE_LOCK = 5;
+const LOCK_STEPS_MS = [30_000, 120_000, 600_000, 1_800_000];
+const FAIL_WINDOW_MS = 60 * 60 * 1000;
+const MAX_TRACKED_IPS = 10_000;
+const SWEEP_INTERVAL_MS = 5 * 60 * 1000;
+
+const attempts = new Map();
+
+function now() { return Date.now(); }
+
+function getEntry(ip) {
+  const e = attempts.get(ip);
+  if (!e) return null;
+
+  if (e.lastFailAt && now() - e.lastFailAt > FAIL_WINDOW_MS && (!e.lockUntil || now() >= e.lockUntil)) {
+    attempts.delete(ip);
+    return null;
+  }
+  return e;
+}
+
+function sweepExpiredEntries(at = now()) {
+  for (const [ip, entry] of attempts) {
+    const locked = entry.lockUntil && at < entry.lockUntil;
+    const expired = entry.lastFailAt && at - entry.lastFailAt > FAIL_WINDOW_MS;
+    if (!locked && expired) attempts.delete(ip);
+  }
+}
+
+function ensureCapacity(ip) {
+  if (attempts.has(ip)) return;
+  sweepExpiredEntries();
+  if (attempts.size < MAX_TRACKED_IPS) return;
+
+  const oldest = attempts.keys().next().value;
+  if (oldest !== undefined) attempts.delete(oldest);
+}
+
+const limiterSweep = setInterval(() => sweepExpiredEntries(), SWEEP_INTERVAL_MS);
+limiterSweep.unref?.();
+
+export function checkLock(ip) {
+  const e = getEntry(ip);
+  if (!e || !e.lockUntil) return { locked: false };
+  const remaining = e.lockUntil - now();
+  if (remaining <= 0) return { locked: false };
+  return { locked: true, retryAfter: Math.ceil(remaining / 1000) };
+}
+
+export function recordFail(ip) {
+  const e = getEntry(ip) || { fails: 0, lockUntil: 0, lockLevel: 0, lastFailAt: 0 };
+  e.fails += 1;
+  e.lastFailAt = now();
+
+  try { authFailuresTotal.inc({ source: "login" }); } catch {}
+
+  let locked = false;
+  if (e.fails >= MAX_FAILS_BEFORE_LOCK) {
+    const step = LOCK_STEPS_MS[Math.min(e.lockLevel, LOCK_STEPS_MS.length - 1)];
+    e.lockUntil = now() + step;
+    e.lockLevel += 1;
+    e.fails = 0;
+    locked = true;
+    try { loginLockActive.set({}, 1); } catch {}
+
+  }
+  ensureCapacity(ip);
+  attempts.set(ip, e);
+  return { remainingBeforeLock: Math.max(0, MAX_FAILS_BEFORE_LOCK - e.fails), locked, retryAfter: locked ? Math.ceil((e.lockUntil - now()) / 1000) : undefined };
+}
+
+export function recordSuccess(ip) {
+  attempts.delete(ip);
+  try { loginLockActive.set({}, 0); } catch {}
+}
+
+export function getClientIp(request) {
+
+  const realIp = request.headers.get("x-swayrouter-real-ip");
+  if (realIp) return realIp;
+
+  if (env.trustProxy && request.headers.get("x-swayrouter-via-proxy") === "1") {
+    const xff = request.headers.get("x-forwarded-for");
+    if (xff) return xff.split(",")[0].trim();
+  }
+
+  return "unknown";
+}
+
+export function __resetLoginLimiterForTests() {
+  attempts.clear();
+}
+
+export function __getLoginLimiterSizeForTests() {
+  return attempts.size;
+}

package/src/lib/cache/ttlCache.js

@@ -0,0 +1,153 @@
+import { getAdapter } from "../db/driver.js";
+
+const DEFAULT_TTL_MS = 5000;
+const DEFAULT_MAX_ENTRIES = 64;
+const VERSION_META_KEY = "configCacheVersion";
+
+if (!global._swayTtlCache) {
+  global._swayTtlCache = {
+
+    caches: new Map(),
+
+    inflight: new Map(),
+  };
+}
+const STATE = global._swayTtlCache;
+
+export function createTtlCache(opts) {
+  const name = opts.name;
+  const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+  const maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+
+  if (!STATE.caches.has(name)) STATE.caches.set(name, new Map());
+  if (!STATE.inflight.has(name)) STATE.inflight.set(name, new Map());
+
+  const entries = STATE.caches.get(name);
+  const inflight = STATE.inflight.get(name);
+
+  async function currentVersionAsync() {
+    try {
+      const db = await getAdapter();
+      const row = db.get(`SELECT value FROM _meta WHERE key = ?`, [VERSION_META_KEY]);
+      return row ? parseInt(row.value, 10) || 0 : 0;
+    } catch {
+      return 0;
+    }
+  }
+
+  async function bumpVersion() {
+    const db = await getAdapter();
+
+    let next = 0;
+    db.transaction(() => {
+      const row = db.get(`SELECT value FROM _meta WHERE key = ?`, [VERSION_META_KEY]);
+      const cur = row ? parseInt(row.value, 10) || 0 : 0;
+      next = cur + 1;
+      db.run(
+        `INSERT INTO _meta(key, value) VALUES(?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value`,
+        [VERSION_META_KEY, String(next)],
+      );
+    });
+
+    invalidateAll();
+    return next;
+  }
+
+  function invalidate(key) {
+    entries.delete(key);
+    inflight.delete(key);
+  }
+
+  function invalidateAll() {
+    entries.clear();
+    inflight.clear();
+  }
+
+  async function get(key, loader) {
+    const now = Date.now();
+    const persisted = await currentVersionAsync();
+    const hit = entries.get(key);
+    if (hit && hit.expireAt > now && hit.seenVersion === persisted) {
+      return hit.value;
+    }
+
+    let p = inflight.get(key);
+    if (!p) {
+      p = (async () => {
+        try {
+          const value = await loader();
+          set(key, value, ttlMs);
+
+          const entry = entries.get(key);
+          if (entry) entry.seenVersion = persisted;
+          return value;
+        } finally {
+          inflight.delete(key);
+        }
+      })();
+      inflight.set(key, p);
+    }
+    return p;
+  }
+
+  function set(key, value, ttlOverride) {
+    const expireAt = Date.now() + (ttlOverride ?? ttlMs);
+
+    if (!entries.has(key) && entries.size >= maxEntries) {
+      const eldestKey = entries.keys().next().value;
+      if (eldestKey !== undefined) entries.delete(eldestKey);
+    }
+    entries.set(key, { value, expireAt, seenVersion: 0 });
+  }
+
+  function size() {
+    return entries.size;
+  }
+
+  return {
+    get,
+    set,
+    invalidate,
+    invalidateAll,
+    bumpVersion,
+    currentVersion: () => 0,
+    currentVersionAsync,
+    size,
+  };
+}
+
+export function cachedRead(name, loader, opts = {}) {
+  const cache = createTtlCache({ name, ttlMs: opts.ttlMs });
+  const key = opts.key ?? "default";
+  return () => cache.get(key, loader);
+}
+
+const NAMED_CACHES = new Map();
+
+export function getConfigCache(name, opts = {}) {
+  let c = NAMED_CACHES.get(name);
+  if (c) return c;
+  c = createTtlCache({ name, ttlMs: opts.ttlMs });
+  NAMED_CACHES.set(name, c);
+  return c;
+}
+
+export async function bumpConfigCacheVersion() {
+
+  for (const c of NAMED_CACHES.values()) {
+    const v = await c.bumpVersion();
+
+    for (const other of NAMED_CACHES.values()) if (other !== c) other.invalidateAll();
+    return v;
+  }
+
+  const tmp = createTtlCache({ name: "__bootstrap", ttlMs: DEFAULT_TTL_MS });
+  NAMED_CACHES.set("__bootstrap", tmp);
+  return await tmp.bumpVersion();
+}
+
+export function __resetTtlCachesForTests() {
+  STATE.caches.clear();
+  STATE.inflight.clear();
+  NAMED_CACHES.clear();
+}

package/src/lib/consoleLogBuffer.js

@@ -0,0 +1,127 @@
+import { EventEmitter } from "events";
+import { CONSOLE_LOG_CONFIG } from "@/shared/constants/config.js";
+
+const consoleLevels = ["log", "info", "warn", "error", "debug"];
+
+if (!global._consoleLogBufferState) {
+  global._consoleLogBufferState = {
+    logs: [],
+    entries: [],
+    patched: false,
+    originals: {},
+    emitter: new EventEmitter(),
+  };
+  global._consoleLogBufferState.emitter.setMaxListeners(50);
+}
+
+const state = global._consoleLogBufferState;
+
+if (!state.emitter) {
+  state.emitter = new EventEmitter();
+  state.emitter.setMaxListeners(50);
+}
+
+if (!state.entries) state.entries = state.logs.map((line) => ({ line, ts: 0 }));
+if (!state.pendingLines) state.pendingLines = [];
+if (!state.flushTimer) state.flushTimer = null;
+
+const FLUSH_INTERVAL_MS = 100;
+const MAX_BATCH_LINES = 50;
+
+function flushPendingLines() {
+  state.flushTimer = null;
+  if (!state.pendingLines.length) return;
+
+  const lines = state.pendingLines.splice(0, state.pendingLines.length);
+  state.emitter.emit("lines", lines);
+}
+
+function scheduleFlush() {
+  if (state.flushTimer) return;
+  state.flushTimer = setTimeout(flushPendingLines, FLUSH_INTERVAL_MS);
+  state.flushTimer?.unref?.();
+}
+
+function toLogLine(level, args) {
+  return args.map(formatArg).join(" ");
+}
+
+const ANSI_RE = /\x1b\[[0-9;]*m/g;
+
+function stripAnsi(str) {
+  return str.replace(ANSI_RE, "");
+}
+
+const EMOJI_RE = /[\p{Emoji_Presentation}\p{Extended_Pictographic}�️‍]/gu;
+
+function stripDecorativeEmoji(str) {
+  return str.replace(EMOJI_RE, "").replace(/[ \t]{2,}/g, " ").trim();
+}
+
+function formatArg(arg) {
+  if (typeof arg === "string") return stripDecorativeEmoji(stripAnsi(arg));
+  if (arg instanceof Error) return stripDecorativeEmoji(stripAnsi(arg.stack || arg.message || String(arg)));
+  try {
+    return stripDecorativeEmoji(stripAnsi(JSON.stringify(arg)));
+  } catch {
+    return stripDecorativeEmoji(stripAnsi(String(arg)));
+  }
+}
+
+function appendLine(line) {
+  const entry = { line, ts: Date.now() };
+  state.logs.push(line);
+  state.entries.push(entry);
+  const maxLines = CONSOLE_LOG_CONFIG.maxLines;
+  if (state.logs.length > maxLines) {
+    state.logs = state.logs.slice(-maxLines);
+    state.entries = state.entries.slice(-maxLines);
+  }
+  state.pendingLines.push(entry);
+  if (state.pendingLines.length >= MAX_BATCH_LINES) {
+    if (state.flushTimer) {
+      clearTimeout(state.flushTimer);
+      state.flushTimer = null;
+    }
+    flushPendingLines();
+  } else {
+    scheduleFlush();
+  }
+}
+
+export function initConsoleLogCapture() {
+  if (state.patched) return;
+
+  for (const level of consoleLevels) {
+    state.originals[level] = console[level];
+    console[level] = (...args) => {
+      appendLine(toLogLine(level, args));
+      state.originals[level](...args);
+    };
+  }
+
+  state.patched = true;
+}
+
+export function getConsoleLogs() {
+  return [...state.logs];
+}
+
+export function getConsoleEntries() {
+  return state.entries.map((entry) => ({ ...entry }));
+}
+
+export function clearConsoleLogs() {
+  state.logs = [];
+  state.entries = [];
+  state.pendingLines = [];
+  if (state.flushTimer) {
+    clearTimeout(state.flushTimer);
+    state.flushTimer = null;
+  }
+  state.emitter.emit("clear");
+}
+
+export function getConsoleEmitter() {
+  return state.emitter;
+}

package/src/lib/dataDir.js

@@ -0,0 +1,45 @@
+import fs from "node:fs";
+import path from "path";
+import os from "os";
+import { env } from "./env.ts";
+
+const APP_NAME = ".swayrouter";
+
+function defaultDir() {
+  const base = process.platform === "win32"
+    ? (process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"))
+    : os.homedir();
+  return path.join(base, APP_NAME);
+}
+
+function secureDirectory(dir) {
+  try {
+    if (process.platform !== "win32") fs.chmodSync(dir, 0o700);
+  } catch (error) {
+    if (process.env.NODE_ENV === "production") throw error;
+  }
+  return dir;
+}
+
+export function getDataDir() {
+  const configured = env.dataDir;
+  if (!configured) return secureDirectory(defaultDir());
+
+  if (process.platform === "win32" && /^\//.test(configured)) {
+    console.warn(`[DATA_DIR] '${configured}' is a Unix path on Windows → fallback to default`);
+    return defaultDir();
+  }
+
+  try {
+    fs.mkdirSync(configured, { recursive: true });
+    return secureDirectory(configured);
+  } catch (e) {
+    if (e?.code === "EACCES" || e?.code === "EPERM") {
+      console.warn(`[DATA_DIR] '${configured}' not writable → fallback to the platform default data directory`);
+      return defaultDir();
+    }
+    throw e;
+  }
+}
+
+export const DATA_DIR = getDataDir();

package/src/lib/db/adapters/betterSqliteAdapter.js

@@ -0,0 +1,36 @@
+import Database from "better-sqlite3";
+import { PRAGMA_SQL } from "../schema.js";
+import { createStatementCache, startPeriodicTask } from "./runtimeHelpers.js";
+
+const CHECKPOINT_INTERVAL_MS = 60 * 1000;
+
+export function createBetterSqliteAdapter(filePath) {
+  const db = new Database(filePath);
+  db.exec(PRAGMA_SQL);
+
+  const statements = createStatementCache((sql) => db.prepare(sql));
+  const stopCheckpoint = startPeriodicTask(() => {
+    try { db.pragma("wal_checkpoint(PASSIVE)"); } catch {}
+  }, CHECKPOINT_INTERVAL_MS);
+
+  function gracefulClose() {
+    try { db.pragma("wal_checkpoint(TRUNCATE)"); } catch {}
+    try { statements.clear(); } catch {}
+    try { db.close(); } catch {}
+  }
+
+  return {
+    driver: "better-sqlite3",
+    run(sql, params = []) { return statements.get(sql).run(...params); },
+    get(sql, params = []) { return statements.get(sql).get(...params); },
+    all(sql, params = []) { return statements.get(sql).all(...params); },
+    exec(sql) { return db.exec(sql); },
+    transaction(fn) { return db.transaction(fn)(); },
+    checkpoint() { try { db.pragma("wal_checkpoint(TRUNCATE)"); } catch {} },
+    close() {
+      stopCheckpoint();
+      gracefulClose();
+    },
+    raw: db,
+  };
+}

package/src/lib/db/adapters/bunSqliteAdapter.js

@@ -0,0 +1,47 @@
+import { PRAGMA_SQL } from "../schema.js";
+import { createStatementCache, startPeriodicTask } from "./runtimeHelpers.js";
+
+const CHECKPOINT_INTERVAL_MS = 60 * 1000;
+
+export async function createBunSqliteAdapter(filePath) {
+
+  const { Database } = await import("bun:sqlite");
+  const db = new Database(filePath, { create: true });
+  db.exec(PRAGMA_SQL);
+
+  const statements = createStatementCache((sql) => db.prepare(sql));
+  const stopCheckpoint = startPeriodicTask(() => {
+    try { db.exec("PRAGMA wal_checkpoint(PASSIVE)"); } catch {}
+  }, CHECKPOINT_INTERVAL_MS);
+
+  function gracefulClose() {
+    try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
+    try { statements.clear(); } catch {}
+    try { db.close(); } catch {}
+  }
+  return {
+    driver: "bun:sqlite",
+    run(sql, params = []) {
+      const r = statements.get(sql).run(...params);
+      return { changes: Number(r.changes ?? 0), lastInsertRowid: Number(r.lastInsertRowid ?? 0) };
+    },
+    get(sql, params = []) {
+      return statements.get(sql).get(...params);
+    },
+    all(sql, params = []) {
+      return statements.get(sql).all(...params);
+    },
+    exec(sql) { return db.exec(sql); },
+    transaction(fn) {
+
+      const tx = db.transaction(fn);
+      return tx();
+    },
+    checkpoint() { try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {} },
+    close() {
+      stopCheckpoint();
+      gracefulClose();
+    },
+    raw: db,
+  };
+}

package/src/lib/db/adapters/nodeSqliteAdapter.js

@@ -0,0 +1,65 @@
+import { PRAGMA_SQL } from "../schema.js";
+import { createStatementCache, startPeriodicTask } from "./runtimeHelpers.js";
+
+const CHECKPOINT_INTERVAL_MS = 60 * 1000;
+
+export async function createNodeSqliteAdapter(filePath) {
+
+  const origEmit = process.emit;
+  process.emit = function (name, data, ...rest) {
+    if (name === "warning" && data?.name === "ExperimentalWarning" && /SQLite/i.test(data.message || "")) {
+      return false;
+    }
+    return origEmit.call(process, name, data, ...rest);
+  };
+
+  const sqlite = await import("node:sqlite");
+  const Database = sqlite.DatabaseSync;
+  const db = new Database(filePath);
+
+  db.exec(PRAGMA_SQL);
+
+  const statements = createStatementCache((sql) => db.prepare(sql));
+  const stopCheckpoint = startPeriodicTask(() => {
+    try { db.exec("PRAGMA wal_checkpoint(PASSIVE)"); } catch {}
+  }, CHECKPOINT_INTERVAL_MS);
+
+  function gracefulClose() {
+    try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
+    try { statements.clear(); } catch {}
+    try { db.close(); } catch {}
+  }
+  return {
+    driver: "node:sqlite",
+    run(sql, params = []) {
+      const r = statements.get(sql).run(...params);
+      return { changes: Number(r.changes ?? 0), lastInsertRowid: Number(r.lastInsertRowid ?? 0) };
+    },
+    get(sql, params = []) {
+      return statements.get(sql).get(...params);
+    },
+    all(sql, params = []) {
+      return statements.get(sql).all(...params);
+    },
+    exec(sql) { return db.exec(sql); },
+    transaction(fn) {
+
+      const sp = `sp_${Math.random().toString(36).slice(2)}`;
+      db.exec(`SAVEPOINT ${sp}`);
+      try {
+        const r = fn();
+        db.exec(`RELEASE ${sp}`);
+        return r;
+      } catch (e) {
+        try { db.exec(`ROLLBACK TO ${sp}`); db.exec(`RELEASE ${sp}`); } catch {}
+        throw e;
+      }
+    },
+    checkpoint() { try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {} },
+    close() {
+      stopCheckpoint();
+      gracefulClose();
+    },
+    raw: db,
+  };
+}

package/src/lib/db/adapters/runtimeHelpers.js

@@ -0,0 +1,23 @@
+export function createStatementCache(prepareStatement) {
+  const entries = new Map();
+
+  return {
+    get(sql) {
+      let statement = entries.get(sql);
+      if (!statement) {
+        statement = prepareStatement(sql);
+        entries.set(sql, statement);
+      }
+      return statement;
+    },
+    clear() {
+      entries.clear();
+    },
+  };
+}
+
+export function startPeriodicTask(task, intervalMs) {
+  const timer = setInterval(task, intervalMs);
+  if (typeof timer.unref === "function") timer.unref();
+  return () => clearInterval(timer);
+}