termdock 1.4.178 → 1.4.180

package/dist/server/entry.js

@@ -1,3 +1,5 @@
+import { setPushTargetPeerId } from './notifications/pushService.js';
+import { desktopDirectTargets } from './federation/desktopTargets.js';
 import { createOpenAccessRouter } from './federation/openAccess.js';
 import { createPasswordLoginRouter } from './federation/passwordLoginRoutes.js';
 import { apiAccessGate, isTrustedLocalRequest } from './utils/apiAccess.js';
@@ -404,27 +406,42 @@ export function startServer(options = {}) {
     const { server, scheme } = createServerForApp(app, options);
     let entrySubjectAllowed = (_subjectId) => false;
     let routeInvitations;
-    const routeAccess = new RouteAccess(path.join(homedir(), '.termdock', 'federation', 'routes.json'), Date.now, (subjectId, targetServiceId) => routeInvitations?.allows(subjectId, targetServiceId) === true);
+    let federationServiceId = '';
+    const desktopTargets = () => desktopDirectTargets(path.join(homedir(), '.termdock', 'desktop.json'), federationServiceId);
+    const routeAccess = new RouteAccess(path.join(homedir(), '.termdock', 'federation', 'routes.json'), Date.now, (subjectId, targetServiceId) => routeInvitations?.allows(subjectId, targetServiceId) === true, desktopTargets);
     const relayRouter = new RelayRouter({
         authenticate: context => context,
         allowRegister: (principal, serviceId) => routeAccess.allowRegister(principal, serviceId),
         allowRoute: (principal, serviceId) => routeAccess.allowRoute(principal, serviceId),
     });
     const dynamicDirectTargets = new Map();
-    server.once('close', () => { for (const close of dynamicDirectTargets.values())
-        close(); });
-    try {
-        const detachDirectTargets = attachRegisteredDirectTargets(relayRouter, routeAccess.configuredDirectTargets(), path.join(homedir(), '.termdock', 'federation'));
-        server.once('close', detachDirectTargets);
-    }
-    catch {
-        console.error('Configured direct routes unavailable; target access remains closed.');
-    }
+    const refreshDirectTargets = () => {
+        const desired = new Map(routeAccess.configuredDirectTargets().filter(target => target.serviceId !== federationServiceId).map(target => [target.serviceId, target]));
+        for (const [id, registered] of dynamicDirectTargets) {
+            const target = desired.get(id);
+            if (!target || registered.signature !== JSON.stringify([target.url, target.caPath, target.caFingerprint256])) {
+                registered.close();
+                dynamicDirectTargets.delete(id);
+            }
+        }
+        for (const [id, target] of desired)
+            if (!dynamicDirectTargets.has(id)) {
+                try {
+                    dynamicDirectTargets.set(id, { signature: JSON.stringify([target.url, target.caPath, target.caFingerprint256]), close: attachRegisteredDirectTargets(relayRouter, [target], path.join(homedir(), '.termdock', 'federation')) });
+                }
+                catch { /* A malformed or unavailable local route remains unusable. */ }
+            }
+    };
+    refreshDirectTargets();
+    const desktopRoutesTimer = setInterval(refreshDirectTargets, 2000);
+    desktopRoutesTimer.unref();
+    server.once('close', () => { clearInterval(desktopRoutesTimer); for (const target of dynamicDirectTargets.values())
+        target.close(); });
     server.once('close', () => relayRouter.close());
     const federation = createFederationRuntime(app, path.join(homedir(), '.termdock', 'federation'), {
         terminal: handleTerminalWebSocket, control: handleControlWebSocket,
     }, {
-        listRouteTargets: () => routeAccess.configuredTargets().map(target => ({ ...target, available: relayRouter.hasRoute(target.serviceId) })),
+        listRouteTargets: () => { refreshDirectTargets(); return routeAccess.configuredTargets().map(target => ({ ...target, available: relayRouter.hasRoute(target.serviceId) })); },
         listRouteAccess: () => routeInvitations?.list() || [],
         grantRouteAccess: async (issuerId, targetServiceId, subjectId, url) => {
             if (!routeInvitations)
@@ -438,8 +455,7 @@ export function startServer(options = {}) {
                 if (!runtime.store.authorize({ subjectId: issuerId, serviceId: runtime.serviceId, action: 'authorization.manage' }).allowed)
                     throw new Error('AUTHORIZATION_DENIED');
                 routeAccess.addDirectTarget(target);
-                if (!dynamicDirectTargets.has(targetServiceId))
-                    dynamicDirectTargets.set(targetServiceId, attachRegisteredDirectTargets(relayRouter, [target]));
+                refreshDirectTargets();
             }
             return routeInvitations.grant(issuerId, targetServiceId, subjectId);
         },
@@ -458,6 +474,9 @@ export function startServer(options = {}) {
         },
     });
     void federation.then(runtime => {
+        federationServiceId = runtime.serviceId;
+        setPushTargetPeerId(runtime.serviceId);
+        refreshDirectTargets();
         app.locals.passwordRuntime = runtime;
         entrySubjectAllowed = subjectId => runtime.store.authorize({ subjectId, serviceId: runtime.serviceId, action: 'authorization.manage' }).allowed;
         routeInvitations = new RouteInvitationStore({

package/dist/server/federation/desktopTargets.js

@@ -0,0 +1,64 @@
+import { readFileSync, statSync } from 'node:fs';
+const peer = (value) => typeof value === 'string' && /^[a-zA-Z0-9_.:-]{1,160}$/.test(value);
+const fingerprint = (value) => typeof value === 'string' && /^(?:[\da-f]{2}:){31}[\da-f]{2}$/i.test(value);
+function origin(value) {
+    if (typeof value !== 'string' || value.length > 2048)
+        return;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname !== '/')
+            return;
+        return url.origin;
+    }
+    catch {
+        return;
+    }
+}
+/** Read only this OS user's Desktop directory. The local service must itself
+ * have been pinned there before its administrator can discover other entries.
+ * This supplies addresses, never the Desktop client's device authorization.
+ */
+export function desktopDirectTargets(file, localServiceId) {
+    if (!localServiceId)
+        return [];
+    try {
+        if (statSync(file).size > 1024 * 1024)
+            return [];
+        const data = JSON.parse(readFileSync(file, 'utf8'));
+        if (data?.version !== 1 || !Array.isArray(data.connections) || data.connections.length > 256)
+            return [];
+        const removed = new Set(Array.isArray(data.removedServiceKeys) ? data.removedServiceKeys : []);
+        const connections = data.connections.filter((item) => item && ![item.id, item.targetPeerId, item.serviceOrigin || item.url].some(key => removed.has(key)));
+        if (!connections.some((item) => item.targetPeerId === localServiceId))
+            return [];
+        const trusts = new Map();
+        if (Array.isArray(data.trustedCertificateAuthorities))
+            for (const trust of data.trustedCertificateAuthorities.slice(0, 256)) {
+                const url = origin(trust?.origin);
+                if (url && fingerprint(trust.fingerprint256))
+                    trusts.set(url, trust.fingerprint256.toUpperCase());
+            }
+        const targets = new Map();
+        for (const item of connections) {
+            if (!peer(item.targetPeerId) || item.targetPeerId === localServiceId)
+                continue;
+            const url = origin(item.serviceOrigin || item.url);
+            if (!url)
+                continue;
+            // An entry-only bookmark does not supply a direct address for its target.
+            if ((!item.serviceOrigin && item.entryServiceId && item.entryServiceId !== item.targetPeerId)
+                || (Array.isArray(item.routes) && item.routes.some((route) => route && route.targetPeerId !== item.targetPeerId && origin(route.url) === url)))
+                continue;
+            const caFingerprint256 = trusts.get(url);
+            targets.set(item.targetPeerId, { serviceId: item.targetPeerId, url,
+                ...(typeof item.label === 'string' && item.label.trim() ? { label: item.label.trim().slice(0, 120) } : {}),
+                ...(caFingerprint256 ? { caFingerprint256 } : {}) });
+            if (targets.size >= 64)
+                break;
+        }
+        return [...targets.values()];
+    }
+    catch {
+        return [];
+    }
+}

package/dist/server/federation/directRoutes.js

@@ -1,11 +1,14 @@
+import { readPinnedCertificateAuthority } from './trustedCa.js';
 import { createIdentity, secureConnection } from './secureProtocol.js';
 import { socketDuplex } from './socketDuplex.js';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import WebSocket from 'ws';
 function endpoint(config) {
-    if (!config || typeof config !== 'object' || Object.keys(config).some(key => !['serviceId', 'url', 'caPath'].includes(key)) || !/^[a-zA-Z0-9_.:-]{1,160}$/.test(config.serviceId) || typeof config.url !== 'string' || (config.caPath !== undefined && typeof config.caPath !== 'string'))
+    if (!config || typeof config !== 'object' || Object.keys(config).some(key => !['serviceId', 'url', 'caPath', 'caFingerprint256', 'label'].includes(key)) || !/^[a-zA-Z0-9_.:-]{1,160}$/.test(config.serviceId) || typeof config.url !== 'string' || (config.caPath !== undefined && typeof config.caPath !== 'string'))
         throw new Error('Invalid direct target configuration');
+    if ((config.caFingerprint256 !== undefined && (typeof config.caFingerprint256 !== 'string' || !/^(?:[\da-f]{2}:){31}[\da-f]{2}$/i.test(config.caFingerprint256))) || (config.caPath && config.caFingerprint256) || (config.label !== undefined && (typeof config.label !== 'string' || config.label.length > 120)))
+        throw new Error('Invalid direct target metadata');
     const url = new URL(config.url);
     if (!['https:', 'wss:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || !['/', '/api/federation/secure'].includes(url.pathname))
         throw new Error('Direct targets require a verified HTTPS/WSS origin');
@@ -24,7 +27,7 @@ export function attachRegisteredDirectTargets(router, configs, baseDir = process
         if (ids.has(config.serviceId))
             throw new Error('Duplicate direct target');
         ids.add(config.serviceId);
-        return { serviceId: config.serviceId, url, ca: config.caPath ? readFileSync(resolve(baseDir, config.caPath)) : undefined };
+        return { serviceId: config.serviceId, url, caFingerprint256: config.caFingerprint256, ca: config.caPath ? readFileSync(resolve(baseDir, config.caPath)) : undefined };
     });
     let stopped = false;
     const sockets = new Set();
@@ -34,22 +37,25 @@ export function attachRegisteredDirectTargets(router, configs, baseDir = process
         ws.terminate(); };
     try {
         for (const target of targets)
-            cleanups.push(router.registerDirect(target.serviceId, () => new Promise((accept, reject) => {
-                if (stopped) {
-                    reject(new Error('Direct target stopped'));
-                    return;
-                }
-                const ws = new WebSocket(target.url, { ca: target.ca, rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 10000, maxPayload: 256 * 1024 });
-                sockets.add(ws);
-                ws.once('close', () => sockets.delete(ws));
-                const failed = () => { reject(new Error('Direct target unavailable')); ws.terminate(); };
-                ws.once('error', failed);
-                ws.once('close', failed);
-                ws.once('open', () => { ws.off('error', failed); ws.off('close', failed); ws.on('error', () => ws.terminate()); if (stopped)
-                    failed();
-                else
-                    accept(ws); });
-            })));
+            cleanups.push(router.registerDirect(target.serviceId, async () => {
+                const ca = target.caFingerprint256 ? await readPinnedCertificateAuthority(target.url.replace(/^wss:/, 'https:'), target.caFingerprint256) : target.ca;
+                return new Promise((accept, reject) => {
+                    if (stopped) {
+                        reject(new Error('Direct target stopped'));
+                        return;
+                    }
+                    const ws = new WebSocket(target.url, { ca, rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 10000, maxPayload: 256 * 1024 });
+                    sockets.add(ws);
+                    ws.once('close', () => sockets.delete(ws));
+                    const failed = () => { reject(new Error('Direct target unavailable')); ws.terminate(); };
+                    ws.once('error', failed);
+                    ws.once('close', failed);
+                    ws.once('open', () => { ws.off('error', failed); ws.off('close', failed); ws.on('error', () => ws.terminate()); if (stopped)
+                        failed();
+                    else
+                        accept(ws); });
+                });
+            }));
     }
     catch (error) {
         cleanup();
@@ -60,7 +66,9 @@ export function attachRegisteredDirectTargets(router, configs, baseDir = process
 /** An administrator enabling a new backup first proves the target's pinned
  * identity; HTTPS validation remains enabled throughout. */
 export async function verifyDirectTarget(config) {
-    const ws = new WebSocket(endpoint(config), { rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 5000, maxPayload: 256 * 1024 });
+    const url = endpoint(config);
+    const ca = config.caFingerprint256 ? await readPinnedCertificateAuthority(url.replace(/^wss:/, 'https:'), config.caFingerprint256) : config.caPath ? readFileSync(config.caPath) : undefined;
+    const ws = new WebSocket(url, { ca, rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 5000, maxPayload: 256 * 1024 });
     const duplex = socketDuplex(ws);
     try {
         await new Promise((resolve, reject) => { ws.once('open', resolve); ws.once('error', reject); ws.once('close', () => reject(new Error('Target closed'))); });

package/dist/server/federation/requestContext.js

@@ -1,4 +1,10 @@
 // Object identity is deliberately used instead of a remotely forgeable header.
 const verified = new WeakSet();
-export function markEncryptedRequest(request) { verified.add(request); }
+const subjects = new WeakMap();
+export function markEncryptedRequest(request, subjectId) {
+    verified.add(request);
+    if (subjectId)
+        subjects.set(request, subjectId);
+}
 export function isEncryptedRequest(request) { return verified.has(request); }
+export function encryptedRequestSubject(request) { return subjects.get(request); }

package/dist/server/federation/routeAccess.js

@@ -8,11 +8,13 @@ export class RouteAccess {
     filePath;
     now;
     canRouteSubject;
+    additionalTargets;
     tickets = new Map();
-    constructor(filePath, now = Date.now, canRouteSubject = () => false) {
+    constructor(filePath, now = Date.now, canRouteSubject = () => false, additionalTargets = () => []) {
         this.filePath = filePath;
         this.now = now;
         this.canRouteSubject = canRouteSubject;
+        this.additionalTargets = additionalTargets;
     }
     registry() {
         const empty = { relays: [], directTargets: [] };
@@ -32,8 +34,8 @@ export class RouteAccess {
             }
             const targetIds = new Set();
             for (const target of directTargets) {
-                if (!target || typeof target !== 'object' || Array.isArray(target) || Object.keys(target).some(key => !['serviceId', 'url', 'caPath'].includes(key))
-                    || !validId(target.serviceId) || targetIds.has(target.serviceId) || typeof target.url !== 'string' || (target.caPath !== undefined && typeof target.caPath !== 'string'))
+                if (!target || typeof target !== 'object' || Array.isArray(target) || Object.keys(target).some(key => !['serviceId', 'url', 'caPath', 'label'].includes(key))
+                    || (target.label !== undefined && (typeof target.label !== 'string' || target.label.length > 120)) || !validId(target.serviceId) || targetIds.has(target.serviceId) || typeof target.url !== 'string' || (target.caPath !== undefined && typeof target.caPath !== 'string'))
                     return empty;
                 const url = new URL(target.url);
                 if (!['https:', 'wss:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || !['/', '/api/federation/secure'].includes(url.pathname))
@@ -90,7 +92,7 @@ export class RouteAccess {
         if (!validId(serviceId))
             return false;
         const registry = this.registry();
-        return registry.relays.some(relay => relay.targets.includes(serviceId)) || registry.directTargets.some(target => target.serviceId === serviceId);
+        return registry.relays.some(relay => relay.targets.includes(serviceId)) || registry.directTargets.some(target => target.serviceId === serviceId) || this.additionalTargets().some(target => target.serviceId === serviceId);
     }
     addDirectTarget(target) {
         const url = new URL(target.url);
@@ -120,17 +122,22 @@ export class RouteAccess {
         writeFileSync(temporary, JSON.stringify(data, null, 2), { mode: 0o600 });
         renameSync(temporary, this.filePath);
     }
-    configuredDirectTargets() { return this.registry().directTargets; }
+    configuredDirectTargets() {
+        const targets = new Map(this.additionalTargets().map(target => [target.serviceId, target]));
+        for (const target of this.registry().directTargets)
+            targets.set(target.serviceId, target);
+        return [...targets.values()];
+    }
     configuredTargets() {
         const registry = this.registry();
         const targets = new Map();
         for (const relay of registry.relays)
             for (const serviceId of relay.targets)
                 targets.set(serviceId, { serviceId });
-        for (const target of registry.directTargets) {
+        for (const target of this.configuredDirectTargets()) {
             const url = new URL(target.url);
             url.protocol = 'https:';
-            targets.set(target.serviceId, { serviceId: target.serviceId, url: url.origin });
+            targets.set(target.serviceId, { serviceId: target.serviceId, url: url.origin, ...(target.label ? { label: target.label } : {}) });
         }
         return [...targets.values()];
     }

package/dist/server/federation/runtime.js

@@ -95,7 +95,9 @@ export async function createFederationRuntime(app, directory, handlers, options
             return;
         }
         delete request.headers['x-termdock-inner'];
-        markEncryptedRequest(request);
+        const subject = request.headers['x-termdock-device'];
+        delete request.headers['x-termdock-device'];
+        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined);
         app(request, response);
     });
     await new Promise((resolve, reject) => { internal.once('error', reject); internal.listen(0, '127.0.0.1', resolve); });
@@ -152,7 +154,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                 };
                 try {
                     httpAllowed(operation.head);
-                    const headers = new Headers({ 'x-termdock-inner': internalToken });
+                    const headers = new Headers({ 'x-termdock-inner': internalToken, 'x-termdock-device': subjectId });
                     const supplied = operation.head.headers;
                     if (supplied && typeof supplied === 'object')
                         for (const [name, value] of Object.entries(supplied)) {
@@ -482,7 +484,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                         send({ type: 'ws-ready', id: packet.id });
                         if (match)
                             handlers.terminal(logical, match[1], randomUUID(), {
-                                sinceSeq: Math.max(0, Number(url.searchParams.get('since')) || 0), streamEpoch: url.searchParams.get('epoch') ?? undefined,
+                                pushClientId: `device:${subjectId}`, sinceSeq: Math.max(0, Number(url.searchParams.get('since')) || 0), streamEpoch: url.searchParams.get('epoch') ?? undefined,
                                 flowControl: url.searchParams.get('flow') === '2', outputActive: url.searchParams.get('active') !== '0',
                                 independentTmux: full(subjectId) && url.searchParams.get('transport') === 'tmux-client',
                             }, allowed(subjectId, 'session.resize', match[1]) ? readTerminalHandshakeDimensions(url.searchParams) : undefined);

package/dist/server/federation/trustedCa.js

@@ -0,0 +1,55 @@
+import { X509Certificate } from 'node:crypto';
+import { get } from 'node:https';
+const cache = new Map();
+/** Only the CA download is unauthenticated. Its exact SHA-256 fingerprint was
+ * already approved locally for this origin; the subsequent WSS connection must
+ * still pass normal TLS chain, hostname and expiry checks using this CA.
+ */
+export function readPinnedCertificateAuthority(origin, fingerprint) {
+    const url = new URL('/onboarding/ca.crt', origin);
+    if (url.protocol !== 'https:' || url.username || url.password || !/^(?:[\da-f]{2}:){31}[\da-f]{2}$/i.test(fingerprint))
+        return Promise.reject(new Error('Invalid pinned certificate authority'));
+    const key = `${url.origin}:${fingerprint.toUpperCase()}`;
+    const cached = cache.get(key);
+    if (cached && cached.expires > Date.now())
+        return cached.value;
+    const value = new Promise((resolve, reject) => {
+        const request = get(url, { agent: false, rejectUnauthorized: false, signal: AbortSignal.timeout(5000) }, response => {
+            if (response.statusCode !== 200) {
+                response.resume();
+                reject(new Error('Pinned certificate authority unavailable'));
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            response.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > 256 * 1024) {
+                    request.destroy(new Error('Certificate authority is too large'));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.on('error', reject);
+            response.on('end', () => {
+                try {
+                    const pem = Buffer.concat(chunks), certificate = new X509Certificate(pem);
+                    if (!certificate.ca || certificate.fingerprint256 !== fingerprint.toUpperCase()
+                        || Date.now() < Date.parse(certificate.validFrom) || Date.now() > Date.parse(certificate.validTo))
+                        throw new Error('Certificate authority no longer matches Desktop trust');
+                    resolve(pem);
+                }
+                catch (error) {
+                    reject(error);
+                }
+            });
+        });
+        request.on('error', reject);
+    });
+    if (cache.size >= 64)
+        cache.delete(cache.keys().next().value);
+    cache.set(key, { expires: Date.now() + 120_000, value });
+    void value.catch(() => { if (cache.get(key)?.value === value)
+        cache.delete(key); });
+    return value;
+}

package/dist/server/notifications/pushService.js

@@ -1,3 +1,5 @@
+let pushTargetPeerId;
+export function setPushTargetPeerId(value) { pushTargetPeerId = value; }
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -124,6 +126,7 @@ async function sendPayload(options) {
             };
             await webpush.sendNotification(subscription, JSON.stringify({
                 ...options.build(entry.locale),
+                targetPeerId: pushTargetPeerId,
                 alertStyle: entry.alertStyle,
                 locale: entry.locale,
             }), {

package/dist/server/routes/notifications.js

@@ -1,7 +1,11 @@
 import { Router } from 'express';
+import { encryptedRequestSubject } from '../federation/requestContext.js';
 import { getPushSubscription, getVapidPublicKey, removePushSubscription, updatePushPreferences, upsertPushSubscription, } from '../notifications/pushService.js';
 const router = Router();
 function clientIdFromRequest(req) {
+    const subject = encryptedRequestSubject(req);
+    if (subject)
+        return `device:${subject}`;
     return typeof req.cookies?.['termdock-client'] === 'string' ? req.cookies['termdock-client'] : '';
 }
 function validAlertStyle(value) {