termbridge 0.1.0 → 0.2.0

package/README.md

@@ -17,10 +17,14 @@ npx termbridge
 
 Scan the QR code and open the URL on your phone. The CLI stays running while the tunnel is active.
 
+## Documentation
+
+Visit `https://termbridge.dev` for the full docs, architecture notes, and troubleshooting.
+
 ## CLI usage
 
 ```bash
-termbridge --port 7000 --session dev --kill-on-exit --no-qr --tunnel cloudflare
+termbridge --port 8080 --session dev --kill-on-exit --no-qr --tunnel cloudflare
 ```
 
 Flags:

package/dist/bin.js

@@ -2089,6 +2089,7 @@ import { randomBytes, createHash } from "crypto";
 var SESSION_COOKIE_NAME = "termbridge_session";
 var hashToken = (token) => createHash("sha256").update(token).digest("hex");
 var createSessionId = () => randomBytes(18).toString("base64url");
+var createCsrfToken = () => randomBytes(24).toString("base64url");
 var parseCookies = (cookieHeader) => {
   const cookies = {};
   if (!cookieHeader) {
@@ -2136,6 +2137,7 @@ var createAuth = ({
     record.consumed = true;
     const session = {
       id: createSessionId(),
+      csrfToken: createCsrfToken(),
       createdAt: clock(),
       lastSeen: clock()
     };
@@ -2179,12 +2181,20 @@ var createAuth = ({
     }
     return parts.join("; ");
   };
+  const verifyCsrfToken = (sessionId, csrfToken) => {
+    const session = sessions.get(sessionId);
+    if (!session) {
+      return false;
+    }
+    return session.csrfToken === csrfToken;
+  };
   return {
     issueToken,
     redeemToken,
     getSession,
     getSessionFromRequest,
-    createSessionCookie
+    createSessionCookie,
+    verifyCsrfToken
   };
 };
 
@@ -2303,6 +2313,9 @@ var createStaticHandler = (uiDistPath, basePath) => {
 };
 
 // src/server/server.ts
+var MAX_HTTP_BODY_SIZE = 64 * 1024;
+var MAX_WS_MESSAGE_SIZE = 1024 * 1024;
+var MAX_INPUT_LENGTH = 64 * 1024;
 var jsonResponse = (response, status, payload) => {
   const body = JSON.stringify(payload);
   response.statusCode = status;
@@ -2312,7 +2325,12 @@ var jsonResponse = (response, status, payload) => {
 };
 var readJsonBody = async (request) => {
   const chunks = [];
+  let totalSize = 0;
   for await (const chunk of request) {
+    totalSize += chunk.length;
+    if (totalSize > MAX_HTTP_BODY_SIZE) {
+      return "too_large";
+    }
     chunks.push(chunk);
   }
   const body = Buffer.concat(chunks).toString("utf8").trim();
@@ -2338,21 +2356,28 @@ var isAllowedOrigin = (origin, host) => {
 };
 var allowedControlKeys = new Set(TERMINAL_CONTROL_KEYS);
 var parseClientMessage = (payload) => {
+  const size = typeof payload === "string" ? payload.length : payload.byteLength;
+  if (size > MAX_WS_MESSAGE_SIZE) {
+    return { ok: false, error: "too_large" };
+  }
   const text = typeof payload === "string" ? payload : payload.toString();
   try {
     const parsed = JSON.parse(text);
     if (parsed.type === "input" && typeof parsed.data === "string") {
-      return parsed;
+      if (parsed.data.length > MAX_INPUT_LENGTH) {
+        return { ok: false, error: "too_large" };
+      }
+      return { ok: true, message: parsed };
     }
     if (parsed.type === "resize" && typeof parsed.cols === "number" && typeof parsed.rows === "number") {
-      return parsed;
+      return { ok: true, message: parsed };
     }
     if (parsed.type === "control" && allowedControlKeys.has(parsed.key)) {
-      return parsed;
+      return { ok: true, message: parsed };
     }
-    return null;
+    return { ok: false, error: "invalid" };
   } catch {
-    return null;
+    return { ok: false, error: "invalid" };
   }
 };
 var sendWsMessage = (socket, message) => {
@@ -2396,6 +2421,21 @@ var createAppServer = (deps) => {
       response.end();
       return;
     }
+    if (url.pathname === "/api/csrf") {
+      const session = deps.auth.getSessionFromRequest(request);
+      if (!session) {
+        response.statusCode = 401;
+        response.end("unauthorized");
+        return;
+      }
+      if (request.method === "GET") {
+        jsonResponse(response, 200, { csrfToken: session.csrfToken });
+        return;
+      }
+      response.statusCode = 404;
+      response.end("not found");
+      return;
+    }
     if (url.pathname === "/api/terminals") {
       const session = deps.auth.getSessionFromRequest(request);
       if (!session) {
@@ -2410,6 +2450,11 @@ var createAppServer = (deps) => {
       }
       if (request.method === "POST") {
         const body = await readJsonBody(request);
+        if (body === "too_large") {
+          response.statusCode = 413;
+          response.end("request body too large");
+          return;
+        }
         if (body && typeof body !== "object") {
           response.statusCode = 400;
           response.end("invalid body");
@@ -2453,6 +2498,11 @@ var createAppServer = (deps) => {
       socket.destroy();
       return;
     }
+    const csrfToken = url.searchParams.get("csrf");
+    if (!csrfToken || !deps.auth.verifyCsrfToken(session.id, csrfToken)) {
+      socket.destroy();
+      return;
+    }
     const record = deps.terminalRegistry.get(terminalId);
     if (!record) {
       socket.destroy();
@@ -2470,15 +2520,16 @@ var createAppServer = (deps) => {
       sendWsMessage(socket, { type: "output", data });
     });
     socket.on("message", (payload) => {
-      const message = parseClientMessage(payload);
-      if (!message) {
+      const result = parseClientMessage(payload);
+      if (!result.ok) {
         sendWsMessage(socket, {
           type: "status",
           state: "error",
-          message: "invalid payload"
+          message: result.error === "too_large" ? "message too large" : "invalid payload"
         });
         return;
       }
+      const message = result.message;
       if (message.type === "input") {
         void deps.terminalBackend.write(info.sessionName, message.data);
         return;