termdock 1.4.350 → 1.4.352

package/dist/server/federation/authorization.js

@@ -1,3 +1,4 @@
+import { validShareResources, resourceSubset } from '../shared/shareResources.js';
 import { randomUUID } from 'node:crypto';
 import { mkdirSync, readFileSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync } from 'node:fs';
 import { dirname } from 'node:path';
@@ -18,6 +19,7 @@ function validateInput(v) {
         assert(v.scope.kind === 'sessions' && ids(v.scope.sessionIds), 'session scope');
         keys(v.scope, ['kind', 'sessionIds']);
     }
+    assert(v.resources === undefined || validShareResources(v.resources), 'shared resources');
     assert(Array.isArray(v.actions) && v.actions.length > 0 && v.actions.length <= 256 && v.actions.every(action) && new Set(v.actions).size === v.actions.length, 'actions');
     if (v.scope.kind === 'sessions')
         assert(v.actions.every(a => a.startsWith('session.')), 'session scope cannot grant service or file capabilities');
@@ -37,7 +39,7 @@ function isSubset(child, parent) {
         return false;
     if (parent.scope.kind === 'sessions' && (child.scope.kind !== 'sessions' || !child.scope.sessionIds.every(s => parent.scope.kind === 'sessions' && parent.scope.sessionIds.includes(s))))
         return false;
-    if (!parent.actions.includes('service:*') && !child.actions.every(a => parent.actions.includes(a)))
+    if (!parent.actions.includes('service:*') && (!child.actions.every(a => parent.actions.includes(a)) || !resourceSubset(child.resources, parent.resources)))
         return false;
     for (const key of ['entryServiceIds', 'relayIds']) {
         const limit = parent.conditions?.[key];
@@ -86,7 +88,7 @@ export class AuthorizationStore {
         for (const value of data.grants) {
             validateInput(value);
             const g = value;
-            keys(g, ['id', 'serviceId', 'createdAt', 'parentGrantId', 'revokedAt', 'subjectId', 'scope', 'actions', 'expiresAt', 'canDelegate', 'conditions', 'passwordCredential']);
+            keys(g, ['id', 'serviceId', 'createdAt', 'parentGrantId', 'revokedAt', 'subjectId', 'scope', 'actions', 'expiresAt', 'canDelegate', 'conditions', 'passwordCredential', 'resources']);
             assert(id(g.id) && g.serviceId === this.options.serviceId && Number.isSafeInteger(g.createdAt) && g.createdAt >= 0, 'grant metadata');
             assert(g.parentGrantId === undefined || id(g.parentGrantId), 'parent identity');
             assert(g.revokedAt === undefined || (Number.isSafeInteger(g.revokedAt) && g.revokedAt >= 0), 'revocation');
@@ -122,7 +124,7 @@ export class AuthorizationStore {
     }
     create(input) {
         validateInput(input);
-        keys(input, ['subjectId', 'scope', 'actions', 'expiresAt', 'canDelegate', 'conditions']);
+        keys(input, ['subjectId', 'scope', 'actions', 'expiresAt', 'canDelegate', 'conditions', 'resources']);
         const now = this.now();
         assert(input.expiresAt === undefined || input.expiresAt > now, 'already expired');
         return { ...structuredClone(input), id: randomUUID(), serviceId: this.options.serviceId, createdAt: now };
@@ -169,6 +171,27 @@ export class AuthorizationStore {
         return true;
     }
     list() { return this.read(); }
+    listActive() { const grants = this.read(); return grants.filter(grant => active(grant, grants, this.now(), new Set(), this.options.passwordCredential?.())); }
+    /** Narrow only this Session, preserving sibling Session grants and descendant checks. */
+    revokeSession(sessionId, normalize = id => id) {
+        const grants = this.read();
+        let changed = 0;
+        for (const grant of grants) {
+            if (grant.revokedAt !== undefined || grant.scope.kind !== 'sessions')
+                continue;
+            const remaining = grant.scope.sessionIds.filter(id => normalize(id) !== sessionId);
+            if (remaining.length === grant.scope.sessionIds.length)
+                continue;
+            changed++;
+            if (!remaining.length)
+                grant.revokedAt = this.now();
+            else
+                grant.scope = { kind: 'sessions', sessionIds: remaining };
+        }
+        if (changed)
+            this.save(grants);
+        return changed;
+    }
     listEffective(request) {
         if (!request || !id(request.subjectId) || request.serviceId !== this.options.serviceId)
             return [];

package/dist/server/federation/invitations.js

@@ -1,3 +1,4 @@
+import { validShareResources } from '../shared/shareResources.js';
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { mkdirSync, readFileSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, chmodSync } from 'node:fs';
 import { dirname } from 'node:path';
@@ -8,8 +9,9 @@ const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 function requireValid(ok) { if (!ok)
     throw new Error('INVALID_INVITATION'); }
 export function validateInvitation(input) {
-    requireValid(record(input) && Object.keys(input).every(k => ['scope', 'actions', 'label', 'expiresAt'].includes(k)));
+    requireValid(record(input) && Object.keys(input).every(k => ['scope', 'actions', 'label', 'expiresAt', 'resources'].includes(k)));
     requireValid(record(input.scope) && Array.isArray(input.actions) && input.actions.length > 0 && new Set(input.actions).size === input.actions.length);
+    requireValid(input.resources === undefined || validShareResources(input.resources));
     const scope = input.scope;
     if (scope.kind === 'service') {
         requireValid(Object.keys(scope).length === 1 && ((input.actions.length === 1 && input.actions[0] === 'service:*') || input.actions.every(a => typeof a === 'string' && actions.has(a))));
@@ -50,9 +52,9 @@ export class InvitationStore {
         requireValid(record(data) && data.version === 1 && data.serviceId === this.options.serviceId && Array.isArray(data.invitations) && data.invitations.length <= 2048);
         const seen = new Set();
         for (const item of data.invitations) {
-            requireValid(record(item) && Object.keys(item).every(k => ['scope', 'actions', 'label', 'expiresAt', 'hash', 'issuerId', 'createdAt', 'invitationExpiresAt', 'consumedAt', 'consumedBy'].includes(k)));
-            const { scope, actions, label, expiresAt, hash, issuerId, createdAt, invitationExpiresAt, consumedAt, consumedBy } = item;
-            validateInvitation({ scope, actions, ...(label === undefined ? {} : { label }), ...(expiresAt === undefined ? {} : { expiresAt }) });
+            requireValid(record(item) && Object.keys(item).every(k => ['scope', 'actions', 'label', 'expiresAt', 'hash', 'issuerId', 'createdAt', 'invitationExpiresAt', 'consumedAt', 'consumedBy', 'resources'].includes(k)));
+            const { scope, actions, resources, label, expiresAt, hash, issuerId, createdAt, invitationExpiresAt, consumedAt, consumedBy } = item;
+            validateInvitation({ scope, actions, ...(resources === undefined ? {} : { resources }), ...(label === undefined ? {} : { label }), ...(expiresAt === undefined ? {} : { expiresAt }) });
             requireValid(typeof hash === 'string' && /^[a-f0-9]{64}$/.test(hash) && !seen.has(hash) && identity(issuerId));
             seen.add(hash);
             requireValid(Number.isSafeInteger(createdAt) && Number.isSafeInteger(invitationExpiresAt) && Number(invitationExpiresAt) === Number(createdAt) + TTL);
@@ -87,7 +89,7 @@ export class InvitationStore {
     listPending() {
         const now = this.now();
         return this.read().filter(i => i.consumedAt === undefined && i.invitationExpiresAt > now && (i.expiresAt === undefined || i.expiresAt > now))
-            .map(({ hash, scope, actions, label, expiresAt, createdAt, invitationExpiresAt }) => ({ id: hash, scope, actions, ...(label ? { label } : {}), ...(expiresAt === undefined ? {} : { expiresAt }), createdAt, invitationExpiresAt }));
+            .map(({ hash, scope, actions, resources, label, expiresAt, createdAt, invitationExpiresAt }) => ({ id: hash, scope, actions, ...(resources === undefined ? {} : { resources }), ...(label ? { label } : {}), ...(expiresAt === undefined ? {} : { expiresAt }), createdAt, invitationExpiresAt }));
     }
     revoke(id) {
         const current = this.read();
@@ -98,6 +100,25 @@ export class InvitationStore {
         this.save(current);
         return true;
     }
+    revokeSession(sessionId, normalize = id => id) {
+        const current = this.read();
+        let changed = 0;
+        const next = current.filter(invitation => {
+            if (invitation.consumedAt !== undefined || invitation.scope.kind !== 'sessions')
+                return true;
+            const remaining = invitation.scope.sessionIds.filter(id => normalize(id) !== sessionId);
+            if (remaining.length === invitation.scope.sessionIds.length)
+                return true;
+            changed++;
+            if (!remaining.length)
+                return false;
+            invitation.scope = { kind: 'sessions', sessionIds: remaining };
+            return true;
+        });
+        if (changed)
+            this.save(next);
+        return changed;
+    }
     create(issuerId, input) {
         requireValid(identity(issuerId));
         validateInvitation(input);
@@ -129,7 +150,7 @@ export class InvitationStore {
         invite.consumedAt = now;
         invite.consumedBy = subjectId;
         this.save(current);
-        return { subjectId, scope: structuredClone(invite.scope), actions: [...invite.actions], ...(invite.expiresAt === undefined ? {} : { expiresAt: invite.expiresAt }), canDelegate: false };
+        return { subjectId, ...(invite.resources ? { resources: structuredClone(invite.resources) } : {}), scope: structuredClone(invite.scope), actions: [...invite.actions], ...(invite.expiresAt === undefined ? {} : { expiresAt: invite.expiresAt }), canDelegate: false };
     }
     subjectLabels() {
         return Object.fromEntries(this.read().filter(i => i.consumedBy && i.label).map(i => [i.consumedBy, i.label]));

package/dist/server/federation/relay.js

@@ -211,7 +211,8 @@ export class RelayRouter {
             s.provider.streams.delete(s.providerId);
             send(s.provider.ws, { type: 'close', streamId: s.providerId, reason }, this.limits);
         }
-        send(s.owner.ws, { type: 'close', streamId: s.ownerId, reason }, this.limits);
+        send(s.owner.ws, { type: 'close', streamId: s.ownerId, reason,
+            ...(!this.canRoute(s.owner, s.serviceId) ? { code: 'RELAY_AUTHORIZATION_REQUIRED' } : {}) }, this.limits);
     }
     providerFailed(s, reason) {
         if (s.owner.streams.get(s.ownerId) !== s)
@@ -240,7 +241,19 @@ export class RelayRouter {
                 provider.streams.delete(s.providerId);
                 continue;
             }
-            s.deadline = setTimeout(() => this.providerFailed(s, 'Target timeout'), Math.min(this.limits.connectTimeoutMs, s.expires - Date.now()));
+            const deadline = Math.min(Date.now() + this.limits.connectTimeoutMs, s.expires);
+            const expire = () => {
+                // Timers can fire just before their absolute deadline. Do not fail a
+                // provider early and start a backup beyond the original route budget.
+                const remaining = deadline - Date.now();
+                if (remaining > 0) {
+                    s.deadline = setTimeout(expire, remaining);
+                    s.deadline.unref?.();
+                    return;
+                }
+                this.providerFailed(s, 'Target timeout');
+            };
+            s.deadline = setTimeout(expire, Math.max(0, deadline - Date.now()));
             s.deadline.unref?.();
             return true;
         }
@@ -264,10 +277,15 @@ export class RelayRouter {
             return;
         }
         if (f.type === 'open') {
+            if (this.options.isLocalTarget?.(f.serviceId)) {
+                send(peer.ws, { type: 'close', streamId: f.streamId, reason: 'Cannot relay to the entry itself', code: 'RELAY_SELF_TARGET' }, this.limits);
+                return;
+            }
             if (peer.streams.has(f.streamId))
                 throw new Error('Duplicate stream');
             if (!this.canRoute(peer, f.serviceId) || !this.hasRoute(f.serviceId)) {
-                send(peer.ws, { type: 'close', streamId: f.streamId, reason: 'Route unavailable or denied' }, this.limits);
+                send(peer.ws, { type: 'close', streamId: f.streamId, reason: 'Route unavailable or denied',
+                    ...(!this.canRoute(peer, f.serviceId) ? { code: 'RELAY_AUTHORIZATION_REQUIRED' } : {}) }, this.limits);
                 return;
             }
             if (peer.streams.size >= this.limits.maxStreams)

package/dist/server/federation/requestContext.js

@@ -1,9 +1,13 @@
 // Object identity is deliberately used instead of a remotely forgeable header.
+const resources = new WeakMap();
+export function encryptedRequestResources(request) { return resources.get(request); }
 const verified = new WeakSet();
 const subjects = new WeakMap();
 const serviceAccess = new WeakSet();
-export function markEncryptedRequest(request, subjectId, fullService = false) {
+export function markEncryptedRequest(request, subjectId, fullService = false, shared) {
     verified.add(request);
+    if (shared)
+        resources.set(request, shared);
     if (subjectId)
         subjects.set(request, subjectId);
     if (fullService)

package/dist/server/federation/resourceAccess.js

@@ -0,0 +1,63 @@
+import { realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { canonicalApiPath } from './accessPolicy.js';
+export function computerResource(resources, host, protocol = 'vnc', port = protocol === 'rdp' ? 3389 : 5900) {
+    const matches = resources.computers?.filter(c => c.host.toLowerCase() === host.toLowerCase() && c.protocol === protocol && c.port === port);
+    return matches?.find(c => c.access === 'control') ?? matches?.[0];
+}
+/** Check both the lexical and real path. Symlinks cannot widen a shared root. */
+export function directoryResource(resources, requested, write = false) {
+    if (!path.isAbsolute(requested) || requested.includes('\0'))
+        return false;
+    try {
+        const lexical = path.resolve(requested), real = realpathSync(lexical);
+        const inside = (root, file) => { const rel = path.relative(root, file); return rel === '' || (!rel.startsWith(`..${path.sep}`) && rel !== '..' && !path.isAbsolute(rel)); };
+        return resources.directories?.some(root => (!write || root.access === 'write') && inside(path.resolve(root.path), lexical) && inside(realpathSync(root.path), real)) === true;
+    }
+    catch {
+        return false;
+    }
+}
+export function canonicalShareDirectories(resources) {
+    return { ...resources, ...(resources.directories ? { directories: resources.directories.map(root => {
+                const canonical = realpathSync(root.path);
+                if (!statSync(canonical).isDirectory())
+                    throw new Error('SHARE_DIRECTORY_UNAVAILABLE');
+                return { ...root, path: canonical };
+            }) } : {}) };
+}
+export function resourceHttpAllowed(resources, method, requestPath) {
+    const pathname = canonicalApiPath(requestPath);
+    if (!pathname)
+        return false;
+    if (method === 'GET' && pathname === '/api/android/devices')
+        return !!resources.android?.length;
+    if (resources.android?.length && ((['GET', 'POST'].includes(method) && pathname === '/api/android/recordings') || (method === 'POST' && /^\/api\/android\/recordings\/[a-f0-9-]{36}\/(?:stop|save)$/.test(pathname)) || (method === 'DELETE' && /^\/api\/android\/recordings\/[a-f0-9-]{36}$/.test(pathname))))
+        return true;
+    if (method === 'GET' && pathname === '/api/computer/status')
+        return !!resources.computers?.length;
+    const url = new URL(requestPath, 'http://inner');
+    const op = pathname.slice('/api/terminal/fs/'.length);
+    if (['GET', 'HEAD'].includes(method) && op.startsWith('preview/')) {
+        const parts = op.slice(8).split('/');
+        if (/^[0-9a-f]{32}$/.test(parts[0]))
+            parts.shift();
+        return directoryResource(resources, '/' + parts.join('/'));
+    }
+    if (!pathname.startsWith('/api/terminal/fs/'))
+        return false;
+    // Unregistered Git, shell, native-open and recursive APIs remain unavailable.
+    const read = ['GET', 'HEAD'].includes(method) && ['list', 'read', 'blob', 'video', 'download', 'eda-preview', 'eda-inspect'].includes(op);
+    const write = (method === 'POST' && op === 'upload') || (method === 'PUT' && op === 'write') || (method === 'DELETE' && op === 'file');
+    if (!read && !write)
+        return false;
+    const key = op === 'upload' ? 'dir' : 'path';
+    if (url.searchParams.getAll(key).length !== 1 || !directoryResource(resources, url.searchParams.get(key) ?? '', write))
+        return false;
+    // Listing can run git check-ignore; its repository is another filesystem input.
+    for (const extra of ['gitIgnoreRoot', 'cwd', 'root', 'repoRoot']) {
+        if (url.searchParams.has(extra) && (url.searchParams.getAll(extra).length !== 1 || !directoryResource(resources, url.searchParams.get(extra) ?? '')))
+            return false;
+    }
+    return true;
+}

package/dist/server/federation/runtime.js

@@ -1,3 +1,7 @@
+import { SessionSharingPresence } from './sessionSharing.js';
+import { collaborationSessionDisplayName } from '../utils/sessionDisplayName.js';
+import { mergeShareResources } from '../shared/shareResources.js';
+import { canonicalShareDirectories, computerResource, resourceHttpAllowed } from './resourceAccess.js';
 import { CollaborationRpc } from '../agent/collaborationPeerTransport.js';
 import { PasswordBootstrapServer } from './passwordBootstrap.js';
 import { DeviceProfiles } from './deviceProfiles.js';
@@ -92,6 +96,7 @@ export async function createFederationRuntime(app, directory, handlers, options
     const passwordStarts = [];
     const passwordAttempts = new Map();
     const store = new AuthorizationStore({ serviceId, filePath: join(directory, 'grants.json'), passwordCredential: getPasswordCredentialFingerprint });
+    const sharingPresence = new SessionSharingPresence();
     const deviceProfiles = new DeviceProfiles(join(directory, 'device-profiles.json'));
     const deviceNames = new DeviceNames(join(directory, 'device-names.json'));
     const invitations = new InvitationStore({ serviceId, filePath: join(directory, 'invitations.json') });
@@ -113,7 +118,9 @@ export async function createFederationRuntime(app, directory, handlers, options
         delete request.headers['x-termdock-device'];
         const fullService = request.headers['x-termdock-full-service'] === '1';
         delete request.headers['x-termdock-full-service'];
-        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined, fullService);
+        const resourcesHeader = request.headers['x-termdock-resources'];
+        delete request.headers['x-termdock-resources'];
+        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined, fullService, typeof resourcesHeader === 'string' ? JSON.parse(resourcesHeader) : undefined);
         app(request, response);
     });
     // The outer encrypted consumer can apply backpressure long after a local
@@ -163,10 +170,14 @@ export async function createFederationRuntime(app, directory, handlers, options
             const stable = stableSessionId(sessionId);
             return stable !== undefined && store.authorize({ subjectId, serviceId, action, sessionId: stable }).allowed;
         };
+        const resources = (subjectId) => mergeShareResources(store.listEffective({ subjectId, serviceId }).map(g => g.resources));
+        const androidAllowed = (subjectId, serial, control = false) => full(subjectId) || resources(subjectId).android?.some(d => d.serial === serial && (!control || d.access === 'control')) === true;
+        const computerAllowed = (subjectId, target) => full(subjectId) || !!computerResource(resources(subjectId), target.host, target.protocol, target.port);
         const full = (subjectId) => open() || store.hasFullServiceAccess({ subjectId, serviceId });
         let channel;
         const operations = new Map();
         const sockets = new Map();
+        const presenceKey = randomUUID();
         let revokeTimer;
         try {
             const secured = await secureConnection({ identity, duplex, initiator: false, signal: AbortSignal.timeout(15000) });
@@ -180,23 +191,26 @@ export async function createFederationRuntime(app, directory, handlers, options
                 if (typeof head.method !== 'string' || typeof head.path !== 'string' || !isBusinessApiPath(head.method, head.path))
                     throw new Error('API_NOT_ALLOWED');
                 const policy = resolveAccessRequest(head.method, head.path);
-                if (!full(subjectId)) {
+                if (!full(subjectId) && !resourceHttpAllowed(resources(subjectId), head.method, head.path)) {
                     if (!policy)
                         throw new Error('API_NOT_ALLOWED');
                     check(policy.action, policy.sessionId);
                 }
             };
             async function runHttp(id, operation) {
+                const scopeStamp = JSON.stringify([full(subjectId), resources(subjectId)]);
                 const sendHttp = (packet) => {
                     if (operations.get(id) !== operation || operation.abort.signal.aborted)
                         throw new Error('CANCELLED');
+                    if (scopeStamp !== JSON.stringify([full(subjectId), resources(subjectId)]))
+                        throw new Error('AUTHORIZATION_CHANGED');
                     httpAllowed(operation.head);
                     send(packet);
                 };
                 try {
                     httpAllowed(operation.head);
                     const headers = new Headers({ 'x-termdock-inner': internalToken, 'x-termdock-device': subjectId,
-                        'x-termdock-full-service': full(subjectId) ? '1' : '0' });
+                        'x-termdock-full-service': full(subjectId) ? '1' : '0', 'x-termdock-resources': JSON.stringify(resources(subjectId)) });
                     const supplied = operation.head.headers;
                     if (supplied && typeof supplied === 'object')
                         for (const [name, value] of Object.entries(supplied)) {
@@ -259,9 +273,9 @@ export async function createFederationRuntime(app, directory, handlers, options
                 }
             }
             revokeTimer = setInterval(() => {
-                for (const { socket: logical, sessionId, android, computer } of sockets.values()) {
+                for (const { socket: logical, sessionId, android, computer, computerTarget, computerControl } of sockets.values()) {
                     if (android || computer) {
-                        if (!full(subjectId))
+                        if (android ? !androidAllowed(subjectId, android) : !computerTarget || !computerAllowed(subjectId, computerTarget) || (computerControl && !full(subjectId) && !resources(subjectId).computers?.some(c => c.host.toLowerCase() === computerTarget.host.toLowerCase() && c.protocol === computerTarget.protocol && c.port === computerTarget.port && c.access === 'control')))
                             logical.close(4003, 'Authorization revoked');
                         continue;
                     }
@@ -389,7 +403,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                     }
                     else if (packet.type === 'permissions') {
                         const grants = store.listEffective({ subjectId, serviceId });
-                        send({ type: 'result', id: packet.id, subjectId, serviceId, fullService: full(subjectId), grants, httpWindow: MAX_TRANSFER_WINDOW, binaryChunks: true, webTransport: options.webTransport?.() });
+                        send({ type: 'result', id: packet.id, subjectId, serviceId, fullService: full(subjectId), grants, httpWindow: MAX_TRANSFER_WINDOW, binaryChunks: true, relayAuthorizationErrors: true, relaySelfTargetGuard: true, webTransport: options.webTransport?.() });
                     }
                     else if (packet.type === 'session-list') {
                         const inventory = await sessionInventory();
@@ -400,17 +414,34 @@ export async function createFederationRuntime(app, directory, handlers, options
                                 return [];
                             seen.add(sessionId);
                             return [{ sessionId, ...(typeof session.sessionId === 'string' ? { sourceSessionId: session.sessionId } : {}),
-                                    name: typeof session.name === 'string' ? session.name : sessionId, live: session.live === true,
+                                    name: collaborationSessionDisplayName({ ...session, name: typeof session.name === 'string' ? session.name : sessionId }), live: session.live === true,
                                     canWrite: allowed(subjectId, 'session.input', sessionId), canResize: allowed(subjectId, 'session.resize', sessionId) }];
                         });
                         send({ type: 'result', id: packet.id, items });
                     }
+                    else if (packet.type === 'session-sharing-status') {
+                        check('authorization.manage');
+                        const normalize = (id) => options.resolveSessionId?.(id) || id;
+                        send({ type: 'result', id: packet.id, items: sharingPresence.summary(store.listActive(), invitations.listPending(), normalize) });
+                    }
+                    else if (packet.type === 'session-sharing-stop') {
+                        check('authorization.manage');
+                        if (typeof packet.sessionId !== 'string' || !packet.sessionId)
+                            throw new Error('INVALID_SESSION');
+                        const normalize = (id) => options.resolveSessionId?.(id) || id;
+                        const sessionId = normalize(packet.sessionId);
+                        const revoked = store.revokeSession(sessionId, normalize);
+                        invitations.revokeSession(sessionId, normalize);
+                        send({ type: 'result', id: packet.id, revoked });
+                    }
                     else if (packet.type === 'self-relay-ticket') {
                         if (!options.issueSelfRelayTicket)
                             throw new Error('SELF_RELAY_UNAVAILABLE');
                         send({ type: 'result', id: packet.id, serviceId: subjectId, ...options.issueSelfRelayTicket(subjectId) });
                     }
                     else if (packet.type === 'route-invite-create') {
+                        if (packet.serviceId === serviceId)
+                            throw new Error('RELAY_SELF_TARGET');
                         check('authorization.manage');
                         if (!options.createRouteInvitation || typeof packet.serviceId !== 'string' || !packet.serviceId || packet.serviceId.length > 512)
                             throw new Error('ROUTE_NOT_AVAILABLE');
@@ -433,6 +464,8 @@ export async function createFederationRuntime(app, directory, handlers, options
                         send({ type: 'result', id: packet.id, canManage, grants: canManage ? all : all.filter(grant => grant.subjectId === subjectId) });
                     }
                     else if (packet.type === 'route-grant') {
+                        if (packet.serviceId === serviceId)
+                            throw new Error('RELAY_SELF_TARGET');
                         check('authorization.manage');
                         if (!options.grantRouteAccess || typeof packet.serviceId !== 'string' || typeof packet.subjectId !== 'string')
                             throw new Error('ROUTE_NOT_AVAILABLE');
@@ -447,6 +480,8 @@ export async function createFederationRuntime(app, directory, handlers, options
                         send({ type: 'result', id: packet.id, revoked: options.revokeRouteAccess(packet.grantId) });
                     }
                     else if (packet.type === 'route-ticket') {
+                        if (packet.serviceId === serviceId)
+                            throw new Error('RELAY_SELF_TARGET');
                         if (typeof packet.serviceId !== 'string' || !options.hasRouteGrant?.(subjectId, packet.serviceId))
                             throw new Error('AUTHORIZATION_DENIED');
                         if (!options.issueRouteTicket || typeof packet.serviceId !== 'string' || !packet.serviceId || packet.serviceId.length > 512)
@@ -455,10 +490,12 @@ export async function createFederationRuntime(app, directory, handlers, options
                     }
                     else if (packet.type === 'invite-create') {
                         check('authorization.manage');
-                        const invitation = { scope: packet.scope, actions: packet.actions,
+                        const invitation = { scope: packet.scope, actions: packet.actions, ...(packet.resources === undefined ? {} : { resources: packet.resources }),
                             ...(packet.label === undefined ? {} : { label: packet.label }),
                             ...(packet.expiresAt === undefined ? {} : { expiresAt: packet.expiresAt }) };
                         validateInvitation(invitation);
+                        if (invitation.resources)
+                            invitation.resources = canonicalShareDirectories(invitation.resources);
                         if (invitation.scope.kind === 'sessions') {
                             // Bind to the stable client session id, never the transient backend
                             // PTY id: backends are replaced on restart, tmux recovery or
@@ -518,6 +555,9 @@ export async function createFederationRuntime(app, directory, handlers, options
                         if ((context.singleOperation ? operations.size + sockets.size >= 1 : operations.size >= MAX_SERVER_HTTP_REQUESTS) || operations.has(packet.id) || sockets.has(packet.id))
                             throw new Error('STREAM_LIMIT');
                         httpAllowed(packet);
+                        const requestedSession = resolveAccessRequest(String(packet.method), String(packet.path))?.sessionId;
+                        if (requestedSession && !full(subjectId))
+                            sharingPresence.visit(presenceKey, subjectId, stableSessionId(requestedSession) || requestedSession);
                         const upload = !['GET', 'HEAD'].includes(String(packet.method));
                         if (upload && uploadSlots >= 8)
                             throw new Error('UPLOAD_CONCURRENCY_LIMIT');
@@ -581,26 +621,34 @@ export async function createFederationRuntime(app, directory, handlers, options
                         const match = /^\/api\/terminal\/([^/%]+)\/ws$/.exec(url.pathname);
                         const androidMatch = /^\/api\/android\/([^/%]+)\/ws$/.exec(url.pathname);
                         const computer = url.pathname === '/api/computer/ws';
-                        if (match)
+                        const computerTarget = { host: url.searchParams.get('host') ?? '', protocol: url.searchParams.get('protocol') ?? 'vnc', port: Number(url.searchParams.get('port') ?? (url.searchParams.get('protocol') === 'rdp' ? '3389' : '5900')) };
+                        const canView = () => androidMatch ? androidAllowed(subjectId, androidMatch[1]) : computer ? computerAllowed(subjectId, computerTarget) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]);
+                        if (match) {
                             check('session.view', match[1]);
+                            if (!full(subjectId))
+                                sharingPresence.visit(presenceKey, subjectId, stableSessionId(match[1]) || match[1]);
+                        }
                         else if (url.pathname === '/api/control/ws')
                             check('service.view');
                         else if (androidMatch || computer) {
-                            if (!full(subjectId))
+                            if (!canView())
                                 throw new Error('API_NOT_ALLOWED');
                         }
                         else
                             throw new Error('API_NOT_ALLOWED');
-                        const logical = new LogicalSocket(channel, packet.id, () => (androidMatch || computer) ? full(subjectId) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]), match ? 1024 * 1024 : undefined, !!match && packet.compression === 'gzip');
-                        sockets.set(packet.id, { socket: logical, sessionId: match?.[1], android: Boolean(androidMatch), computer,
-                            computerProtocol: computer ? url.searchParams.get('protocol') ?? 'vnc' : undefined });
-                        logical.once('close', () => sockets.delete(packet.id));
+                        const logical = new LogicalSocket(channel, packet.id, canView, match ? 1024 * 1024 : undefined, !!match && packet.compression === 'gzip');
+                        sockets.set(packet.id, { socket: logical, sessionId: match?.[1], android: androidMatch?.[1], computer, computerTarget: computer ? computerTarget : undefined,
+                            computerControl: computer && (full(subjectId) || resources(subjectId).computers?.some(c => c.host.toLowerCase() === computerTarget.host.toLowerCase() && c.protocol === computerTarget.protocol && c.port === computerTarget.port && c.access === 'control')), computerProtocol: computer ? url.searchParams.get('protocol') ?? 'vnc' : undefined });
+                        const shareStreamKey = `${presenceKey}:${packet.id}`;
+                        if (match && !full(subjectId))
+                            sharingPresence.openStream(shareStreamKey, presenceKey, subjectId, stableSessionId(match[1]) || match[1]);
+                        logical.once('close', () => { sockets.delete(packet.id); sharingPresence.closeStream(shareStreamKey); });
                         send({ type: 'ws-ready', id: packet.id });
                         if (match)
                             handlers.terminal(logical, match[1], randomUUID(), {
                                 pushClientId: `device:${subjectId}`, sinceSeq: Math.max(0, Number(url.searchParams.get('since')) || 0), streamEpoch: url.searchParams.get('epoch') ?? undefined,
                                 flowControl: url.searchParams.get('flow') === '2', outputActive: url.searchParams.get('active') !== '0',
-                                independentTmux: full(subjectId) && url.searchParams.get('transport') === 'tmux-client',
+                                independentTmux: allowed(subjectId, 'session.resize', match[1]) && url.searchParams.get('transport') === 'tmux-client',
                             }, allowed(subjectId, 'session.resize', match[1]) ? readTerminalHandshakeDimensions(url.searchParams) : undefined);
                         else if (androidMatch) {
                             if (!handlers.android)
@@ -617,7 +665,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                                 continue;
                             }
                             handlers.computer(logical, url.searchParams.get('host') ?? '', {
-                                protocol: url.searchParams.get('protocol') ?? undefined, port: url.searchParams.get('port') ?? undefined,
+                                protocol: computerTarget.protocol, port: String(computerTarget.port), readOnly: !full(subjectId) && computerResource(resources(subjectId), computerTarget.host, computerTarget.protocol, computerTarget.port)?.access !== 'control',
                             });
                         }
                         else
@@ -629,14 +677,14 @@ export async function createFederationRuntime(app, directory, handlers, options
                             throw new Error('INVALID_STREAM');
                         const data = JSON.parse(packet.data);
                         if (item.computer) {
-                            if (!full(subjectId))
+                            if (!item.computerTarget || !computerAllowed(subjectId, item.computerTarget) || (item.computerControl && !full(subjectId) && !resources(subjectId).computers?.some(c => c.host.toLowerCase() === item.computerTarget.host.toLowerCase() && c.protocol === item.computerTarget.protocol && c.port === item.computerTarget.port && c.access === 'control')))
                                 throw new Error('AUTHORIZATION_DENIED');
                             const types = item.computerProtocol === 'rdp' ? ['start', 'instruction', 'ack'] : ['data', 'ack'];
                             if (!types.includes(data?.type))
                                 throw new Error('ACTION_NOT_ALLOWED');
                         }
                         else if (item.android) {
-                            if (!full(subjectId))
+                            if (!androidAllowed(subjectId, item.android, data?.type === 'control' && data?.data !== 'EQ=='))
                                 throw new Error('AUTHORIZATION_DENIED');
                             if (!['control', 'ack', 'ping', 'bitrate'].includes(data?.type))
                                 throw new Error('ACTION_NOT_ALLOWED');
@@ -672,6 +720,7 @@ export async function createFederationRuntime(app, directory, handlers, options
             duplex.close?.(new Error('Secure channel closed'));
         }
         finally {
+            sharingPresence.close(presenceKey);
             unregisterCollaboration?.();
             collaborationRpc?.close();
             clearInterval(revokeTimer);

package/dist/server/federation/sessionSharing.js

@@ -0,0 +1,39 @@
+export class SessionSharingPresence {
+    connections = new Map();
+    visit(connection, device, session) {
+        const current = this.connections.get(connection) || { device, sessions: new Map() };
+        current.sessions.set(session, Date.now());
+        this.connections.set(connection, current);
+    }
+    streams = new Map();
+    openStream(key, connection, device, session) { this.streams.set(key, { connection, device, session }); }
+    closeStream(key) { this.streams.delete(key); }
+    close(connection) { this.connections.delete(connection); for (const [key, stream] of this.streams)
+        if (stream.connection === connection)
+            this.streams.delete(key); }
+    summary(grants, invitations, normalize) {
+        const result = new Map();
+        const record = (id) => { const key = normalize(id); let item = result.get(key); if (!item) {
+            item = { sessionId: key, devices: new Set(), invitations: 0 };
+            result.set(key, item);
+        } return item; };
+        for (const grant of grants)
+            if (grant.scope.kind === 'sessions')
+                for (const id of grant.scope.sessionIds)
+                    record(id).devices.add(grant.subjectId);
+        for (const invite of invitations)
+            if (invite.scope.kind === 'sessions')
+                for (const id of invite.scope.sessionIds)
+                    record(id).invitations++;
+        return [...result.values()].map(item => {
+            const online = new Set();
+            for (const connection of this.connections.values())
+                if (Date.now() - (connection.sessions.get(item.sessionId) || 0) < 15_000 && item.devices.has(connection.device))
+                    online.add(connection.device);
+            for (const stream of this.streams.values())
+                if (stream.session === item.sessionId && item.devices.has(stream.device))
+                    online.add(stream.device);
+            return { sessionId: item.sessionId, devices: item.devices.size, connectedDevices: online.size, invitations: item.invitations };
+        });
+    }
+}

package/dist/server/federation/socketDuplex.js

@@ -13,8 +13,8 @@ export function socketDuplex(socket) {
             close(new Error('Encrypted transport rejected frame'));
         }
     });
-    socket.addEventListener('close', () => input.end());
-    socket.addEventListener('error', () => input.end(new Error('Encrypted transport disconnected')));
+    socket.addEventListener('close', () => input.end(socket.transportFailure));
+    socket.addEventListener('error', () => input.end(socket.transportFailure || new Error('Encrypted transport disconnected')));
     return {
         source: input, close,
         async sink(source) {
@@ -28,7 +28,7 @@ export function socketDuplex(socket) {
                             await new Promise(resolve => setTimeout(resolve, 10));
                         }
                         if (socket.readyState !== 1)
-                            throw new Error('Encrypted transport closed');
+                            throw socket.transportFailure || new Error('Encrypted transport closed');
                         socket.send(chunk.subarray(offset, offset + 64 * 1024));
                     }
                 }