termdock 1.4.322 → 1.4.325

package/dist/server/federation/packets.js

@@ -8,6 +8,16 @@ export class AsyncQueue {
     constructor(limit = 64) {
         this.limit = limit;
     }
+    /** Try to enqueue without changing the fail-closed behavior of push(). */
+    tryPush(value) {
+        if (this.ended)
+            throw new Error('Channel closed');
+        if (this.items.length >= this.limit)
+            return false;
+        this.items.push(value);
+        this.wake?.();
+        return true;
+    }
     push(value) {
         if (this.ended)
             throw new Error('Channel closed');
@@ -18,7 +28,9 @@ export class AsyncQueue {
         this.items.push(value);
         this.wake?.();
     }
+    get size() { return this.items.length; }
     end(error) { this.ended = true; this.error ??= error; this.wake?.(); }
+    clear() { this.items.length = 0; }
     async *[Symbol.asyncIterator]() {
         while (true) {
             if (this.error)
@@ -35,7 +47,13 @@ export class AsyncQueue {
         }
     }
 }
+export class PacketQueueBackpressureError extends Error {
+    code = 'PACKET_QUEUE_BACKPRESSURE';
+    constructor(message = 'Record queue capacity exceeded') { super(message); this.name = 'PacketQueueBackpressureError'; }
+}
 const MAX_PACKET = 2 * 1024 * 1024;
+const MAX_BUFFERED_PACKET_BYTES = MAX_PACKET * 2 + 8;
+const READ_BLOCK_BYTES = 64 * 1024;
 const encoder = new TextEncoder();
 const decoder = new TextDecoder('utf-8', { fatal: true });
 /** Application records live entirely inside Noise; transport routing never sees them. */
@@ -43,24 +61,31 @@ export class PacketChannel {
     duplex;
     outgoing = new AsyncQueue(256);
     outgoingBytes = 0;
+    queuedBytesById = new Map();
+    closed = false;
     get hasPendingWrites() { return this.outgoingBytes > 0; }
+    queuedBytesFor(id) { return this.queuedBytesById.get(id) ?? 0; }
     done;
     constructor(duplex) {
         this.duplex = duplex;
         const self = this;
         this.done = duplex.sink((async function* () {
-            for await (const bytes of self.outgoing) {
+            for await (const packet of self.outgoing) {
                 try {
-                    yield bytes;
+                    yield packet.bytes;
                 }
                 finally {
-                    self.outgoingBytes -= bytes.byteLength;
+                    self.releaseQueuedPacket(packet);
                 }
             }
         })());
-        void this.done.catch(error => this.close(error instanceof Error ? error : new Error('Transport failed')));
+        void this.done.then(() => this.discardPending(), error => this.discardPending(error instanceof Error ? error : new Error('Transport failed')));
     }
     send(packet) {
+        // The item-count cap protects against floods of tiny records. Check it
+        // before encoding and keep this queue alive when it is temporarily full.
+        if (this.outgoing.size >= 256)
+            throw new PacketQueueBackpressureError('Record queue item limit exceeded');
         const body = encoder.encode(JSON.stringify(packet));
         if (body.length > MAX_PACKET)
             throw new Error('Record too large');
@@ -68,40 +93,166 @@ export class PacketChannel {
         new DataView(bytes.buffer).setUint32(0, body.length);
         bytes.set(body, 4);
         if (this.outgoingBytes + bytes.byteLength > 4 * 1024 * 1024)
-            throw new Error('Record queue byte budget exceeded');
+            throw new PacketQueueBackpressureError('Record queue byte budget exceeded');
+        const queued = { id: packet.id, bytes };
+        if (!this.outgoing.tryPush(queued))
+            throw new PacketQueueBackpressureError('Record queue item limit exceeded');
         this.outgoingBytes += bytes.byteLength;
-        try {
-            this.outgoing.push(bytes);
-        }
-        catch (error) {
-            this.outgoingBytes -= bytes.byteLength;
-            throw error;
-        }
+        this.queuedBytesById.set(packet.id, this.queuedBytesFor(packet.id) + bytes.byteLength);
+    }
+    releaseQueuedPacket(packet) {
+        this.outgoingBytes = Math.max(0, this.outgoingBytes - packet.bytes.byteLength);
+        const current = this.queuedBytesById.get(packet.id);
+        if (current === undefined)
+            return;
+        const remaining = current - packet.bytes.byteLength;
+        if (remaining > 0)
+            this.queuedBytesById.set(packet.id, remaining);
+        else
+            this.queuedBytesById.delete(packet.id);
+    }
+    close(error) {
+        // Closing the duplex stops transport delivery, so queued records cannot
+        // be described as drained. Discard them and release their accounting.
+        this.discardPending(error);
+    }
+    abort(error) {
+        this.discardPending(error);
+    }
+    discardPending(error) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.outgoing.clear();
+        this.outgoing.end(error);
+        this.outgoingBytes = 0;
+        this.queuedBytesById.clear();
+        this.duplex.close?.(error);
     }
-    close(error) { this.outgoing.end(error); this.duplex.close?.(error); }
     async *read() {
-        let pending = new Uint8Array(0);
+        const segments = [];
+        let firstSegment = 0;
+        let bufferedBytes = 0;
+        let spareBlock;
+        const parseFrame = (frame) => {
+            const packet = JSON.parse(decoder.decode(frame.subarray(4)));
+            if (!packet || typeof packet !== 'object' || typeof packet.id !== 'string' || typeof packet.type !== 'string')
+                throw new Error('Invalid record');
+            return packet;
+        };
+        const append = (chunk) => {
+            let offset = 0;
+            while (offset < chunk.byteLength) {
+                let tail = segments[segments.length - 1];
+                if (!tail || tail.end === tail.bytes.byteLength) {
+                    tail = { bytes: spareBlock ?? new Uint8Array(READ_BLOCK_BYTES), start: 0, end: 0 };
+                    spareBlock = undefined;
+                    segments.push(tail);
+                }
+                const take = Math.min(chunk.byteLength - offset, tail.bytes.byteLength - tail.end);
+                tail.bytes.set(chunk.subarray(offset, offset + take), tail.end);
+                tail.end += take;
+                offset += take;
+            }
+            bufferedBytes += chunk.byteLength;
+        };
+        const byteAt = (offset) => {
+            let index = firstSegment;
+            let position = offset;
+            while (index < segments.length) {
+                const segment = segments[index];
+                if (!segment) {
+                    index++;
+                    continue;
+                }
+                const available = segment.end - segment.start;
+                if (position < available)
+                    return segment.bytes[segment.start + position];
+                position -= available;
+                index++;
+            }
+            throw new Error('Incomplete record header');
+        };
+        const advance = (length) => {
+            bufferedBytes -= length;
+            while (length > 0) {
+                const segment = segments[firstSegment];
+                if (!segment) {
+                    firstSegment++;
+                    continue;
+                }
+                const take = Math.min(length, segment.end - segment.start);
+                segment.start += take;
+                length -= take;
+                if (segment.start === segment.end) {
+                    if (!spareBlock && segment.bytes.byteLength === READ_BLOCK_BYTES)
+                        spareBlock = segment.bytes;
+                    segments[firstSegment] = undefined;
+                    firstSegment++;
+                }
+            }
+            if (bufferedBytes === 0) {
+                segments.length = 0;
+                firstSegment = 0;
+                spareBlock = undefined;
+            }
+            else if (firstSegment >= 64 && firstSegment * 2 >= segments.length) {
+                segments.splice(0, firstSegment);
+                firstSegment = 0;
+            }
+        };
+        const recordBytes = (length) => {
+            const first = segments[firstSegment];
+            if (!first)
+                throw new Error('Incomplete record body');
+            const available = first.end - first.start;
+            if (available >= length) {
+                const result = first.bytes.subarray(first.start, first.start + length);
+                advance(length);
+                return result;
+            }
+            const result = new Uint8Array(length);
+            let index = firstSegment;
+            let written = 0;
+            while (written < length) {
+                const segment = segments[index];
+                if (!segment) {
+                    index++;
+                    continue;
+                }
+                const take = Math.min(length - written, segment.end - segment.start);
+                result.set(segment.bytes.subarray(segment.start, segment.start + take), written);
+                written += take;
+                index++;
+            }
+            advance(length);
+            return result;
+        };
         for await (const chunk of this.duplex.source) {
-            if (pending.length + chunk.length > MAX_PACKET * 2 + 8)
+            if (bufferedBytes + chunk.byteLength > MAX_BUFFERED_PACKET_BYTES)
                 throw new Error('Record buffer exceeded');
-            const next = new Uint8Array(pending.length + chunk.length);
-            next.set(pending);
-            next.set(chunk, pending.length);
-            pending = next;
-            while (pending.length >= 4) {
-                const size = new DataView(pending.buffer, pending.byteOffset, 4).getUint32(0);
+            if (bufferedBytes === 0 && chunk.byteLength >= 5) {
+                const size = ((chunk[0] * 0x1000000) + (chunk[1] << 16) + (chunk[2] << 8) + chunk[3]) >>> 0;
+                if (size > MAX_PACKET || size === 0)
+                    throw new Error('Invalid record size');
+                if (chunk.byteLength === size + 4) {
+                    yield parseFrame(chunk);
+                    continue;
+                }
+            }
+            if (chunk.byteLength)
+                append(chunk);
+            while (bufferedBytes >= 4) {
+                const size = ((byteAt(0) * 0x1000000) + (byteAt(1) << 16) + (byteAt(2) << 8) + byteAt(3)) >>> 0;
                 if (size > MAX_PACKET || size === 0)
                     throw new Error('Invalid record size');
-                if (pending.length < size + 4)
+                if (bufferedBytes < size + 4)
                     break;
-                const packet = JSON.parse(decoder.decode(pending.subarray(4, size + 4)));
-                if (!packet || typeof packet !== 'object' || typeof packet.id !== 'string' || typeof packet.type !== 'string')
-                    throw new Error('Invalid record');
-                yield packet;
-                pending = pending.slice(size + 4);
+                const frame = recordBytes(size + 4);
+                yield parseFrame(frame);
             }
         }
-        if (pending.length)
+        if (bufferedBytes)
             throw new Error('Truncated record');
     }
 }

package/dist/server/federation/requestContext.js

@@ -1,10 +1,15 @@
 // Object identity is deliberately used instead of a remotely forgeable header.
 const verified = new WeakSet();
 const subjects = new WeakMap();
-export function markEncryptedRequest(request, subjectId) {
+const serviceAccess = new WeakSet();
+export function markEncryptedRequest(request, subjectId, fullService = false) {
     verified.add(request);
     if (subjectId)
         subjects.set(request, subjectId);
+    if (fullService)
+        serviceAccess.add(request);
 }
 export function isEncryptedRequest(request) { return verified.has(request); }
 export function encryptedRequestSubject(request) { return subjects.get(request); }
+/** Set only by the target's authenticated internal dispatcher, never a page header. */
+export function hasEncryptedServiceAccess(request) { return serviceAccess.has(request); }

package/dist/server/federation/runtime.js

@@ -24,12 +24,14 @@ class LogicalSocket extends EventEmitter {
     canRead;
     OPEN = 1;
     readyState = 1;
-    bufferedAmount = 0;
-    constructor(channel, id, canRead) {
+    get bufferedAmount() { return this.channel.queuedBytesFor(this.id); }
+    maxQueuedBytes;
+    constructor(channel, id, canRead, maxQueuedBytes = 4 * 1024 * 1024) {
         super();
         this.channel = channel;
         this.id = id;
         this.canRead = canRead;
+        this.maxQueuedBytes = maxQueuedBytes;
     }
     send(data) {
         if (this.readyState !== 1)
@@ -38,12 +40,18 @@ class LogicalSocket extends EventEmitter {
             this.close(4003, 'Authorization revoked');
             return;
         }
+        // Apply the terminal backlog threshold to bytes already queued, leaving a
+        // single protocol-valid record (up to MAX_PACKET) intact. Other logical
+        // streams retain the shared channel budget and its own backpressure guard.
+        if (this.channel.queuedBytesFor(this.id) > this.maxQueuedBytes) {
+            this.close(1013, 'Output consumer is too slow');
+            return;
+        }
         try {
             this.channel.send({ type: 'ws-data', id: this.id, data });
         }
-        catch (error) {
-            this.channel.close(error instanceof Error ? error : new Error('Output transport failed'));
-            this.close();
+        catch {
+            this.close(1013, 'Output consumer is too slow');
         }
     }
     close(code = 1000, reason = '') {
@@ -100,7 +108,9 @@ export async function createFederationRuntime(app, directory, handlers, options
         delete request.headers['x-termdock-inner'];
         const subject = request.headers['x-termdock-device'];
         delete request.headers['x-termdock-device'];
-        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined);
+        const fullService = request.headers['x-termdock-full-service'] === '1';
+        delete request.headers['x-termdock-full-service'];
+        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined, fullService);
         app(request, response);
     });
     await new Promise((resolve, reject) => { internal.once('error', reject); internal.listen(0, '127.0.0.1', resolve); });
@@ -177,7 +187,8 @@ export async function createFederationRuntime(app, directory, handlers, options
                 };
                 try {
                     httpAllowed(operation.head);
-                    const headers = new Headers({ 'x-termdock-inner': internalToken, 'x-termdock-device': subjectId });
+                    const headers = new Headers({ 'x-termdock-inner': internalToken, 'x-termdock-device': subjectId,
+                        'x-termdock-full-service': full(subjectId) ? '1' : '0' });
                     const supplied = operation.head.headers;
                     if (supplied && typeof supplied === 'object')
                         for (const [name, value] of Object.entries(supplied)) {
@@ -580,7 +591,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                         }
                         else
                             throw new Error('API_NOT_ALLOWED');
-                        const logical = new LogicalSocket(channel, packet.id, () => (androidMatch || computer) ? full(subjectId) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]));
+                        const logical = new LogicalSocket(channel, packet.id, () => (androidMatch || computer) ? full(subjectId) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]), match ? 1024 * 1024 : undefined);
                         sockets.set(packet.id, { socket: logical, sessionId: match?.[1], android: Boolean(androidMatch), computer,
                             computerProtocol: computer ? url.searchParams.get('protocol') ?? 'vnc' : undefined });
                         logical.once('close', () => sockets.delete(packet.id));