tickcli-js 0.1.1 → 0.1.3

package/src/remote.ts

@@ -19,8 +19,8 @@ import crypto from "node:crypto";
 import type { Duplex } from "node:stream";
 import { fileURLToPath } from "node:url";
 import { WebSocketServer, type WebSocket } from "ws";
-import { CLOSE, RoomHub, type Limits, type SavePort } from "./hub.ts";
-import { GuestPasses, Heartbeat, WS_OPTIONS, attach, clientAddress, fileSaves, gameHash } from "./node.ts";
+import { CLOSE, RoomHub, addressKey, type Limits, type SavePort } from "./hub.ts";
+import { GuestPasses, Heartbeat, WS_OPTIONS, attach, clientAddress, fileSaves, gameHash, hardenServer } from "./node.ts";
 
 export interface Deployment {
   /** public id, as in the page's script tag: letters, digits, "_" and "-", 3 to 64 */
@@ -59,6 +59,8 @@ export interface Remote {
   request(req: http.IncomingMessage, res: http.ServerResponse): boolean;
   /** Turn a deployment off now: its open rooms close (saves are written first) and its cached settings are dropped. */
   revoke(id: string): void;
+  /** Drop the cached settings of one deployment (after its sites or caps changed) without closing its rooms. Unchanged ones refresh every LOOKUP_MS. */
+  forget(id: string): void;
   /** The hub namespace of a deployment (for hub.scopeStats, hub.closeScope). */
   scope(id: string): string;
   /** The rooms cap the hub should use for a namespace (pass to new RoomHub({ roomsPerScope })). */
@@ -68,6 +70,10 @@ export interface Remote {
 }
 
 const ID_RE = /^[A-Za-z0-9_-]{3,64}$/;
+/** A deployment (found or not) is asked for again after this long; call forget(id) to make an edit count at once. */
+export const LOOKUP_MS = 15_000;
+/** Fresh lookups one client address (IPv6: /64) may cause per 10 s. */
+export const LOOKUPS_PER_ADDRESS = 20;
 const GAME_RE = /^[A-Za-z0-9_-]{1,60}$/;
 const VER_RE = /^[A-Za-z0-9._-]{1,40}$/;
 const KEY_RE = /^[A-Za-z0-9_-]{22,64}$/;
@@ -134,13 +140,33 @@ export function createRemote(o: RemoteOptions): Remote {
   const sources = { relay: src("relay"), room: src("room"), game: src("game") };
   const files: Record<string, string> = { relay: sources.relay, room: sources.room, game: sources.game, game3d: src("game3d") };
   const scope = (id: string) => `dep:${id}`;
-  const lookup = async (id: string) => {
+  // Deployments are looked up at most once per LOOKUP_MS per id (found or not), and an address may cause at most LOOKUPS_PER_ADDRESS fresh lookups
+  // per 10 s: a flood of sockets or boot scripts with random ids costs a map hit, not a query on your table per request.
+  const seen = new Map<string, number>();   // id -> when it was last looked up
+  const misses = new Map<string, { at: number; n: number }>();
+  const lookupAllowed = (addr: string) => {
+    const k = addressKey(addr), now = Date.now();
+    let w = misses.get(k);
+    if (!w || now - w.at >= 10_000) {
+      if (misses.size >= 50_000) for (const [x, v] of misses) if (now - v.at >= 10_000) misses.delete(x);
+      if (misses.size >= 50_000) return false;
+      w = { at: now, n: 0 }; misses.set(k, w);
+    }
+    return ++w.n <= LOOKUPS_PER_ADDRESS;
+  };
+  const lookup = async (id: string, addr: string) => {
     if (!ID_RE.test(id)) return null;
+    const at = seen.get(id);
+    if (at !== undefined && Date.now() - at < LOOKUP_MS) return cache.get(id) ?? null;
+    if (!lookupAllowed(addr)) return cache.get(id) ?? null;
     let dep: Deployment | null | undefined = null;
     try { dep = await o.deployment(id); } catch { dep = null; }
+    if (seen.size >= 100_000) seen.clear();
+    seen.set(id, Date.now());
     if (dep && dep.id === id) cache.set(id, dep); else cache.delete(id);
     return dep && dep.id === id ? dep : null;
   };
+  const addrOf = (req: http.IncomingMessage) => (o.address ? o.address(req) : req.socket.remoteAddress || "?");
   // refused sockets are still accepted, then closed with a code the page shows (4001 is final: the page stops trying; 1013 busy: it retries)
   const closeWith = (req: http.IncomingMessage, socket: Duplex, head: Buffer, code: number, reason: string) =>
     wss.handleUpgrade(req, socket, head, (ws: WebSocket) => ws.close(code, reason));
@@ -149,7 +175,8 @@ export function createRemote(o: RemoteOptions): Remote {
     scope,
     sockets: (id) => live.get(id) || 0,
     roomsPerScope: (sc) => (sc.startsWith("dep:") ? cache.get(sc.slice(4))?.caps?.rooms : undefined),
-    revoke(id) { cache.delete(id); o.hub.closeScope(scope(id), "this game was turned off by its owner"); },
+    revoke(id) { cache.delete(id); seen.delete(id); o.hub.closeScope(scope(id), "this game was turned off by its owner"); },
+    forget(id) { cache.delete(id); seen.delete(id); },
 
     upgrade(req, socket, head) {
       const url = new URL(req.url || "/", "http://localhost");
@@ -159,7 +186,9 @@ export function createRemote(o: RemoteOptions): Remote {
       const id = url.searchParams.get("d") || "", game = url.searchParams.get("game") || "", ver = url.searchParams.get("v") || "1";
       if (!GAME_RE.test(game) || !VER_RE.test(ver)) { closeWith(req, socket, head, CLOSE.badMessage, "bad game name or version"); return true; }
       socket.on("error", () => { /* closed early */ });
-      void lookup(id).then((dep) => {
+      const addr = addrOf(req);
+      if (!o.hub.allowAddress(addr)) { closeWith(req, socket, head, CLOSE.busy, "too many new connections, try again"); return true; }
+      void lookup(id, addr).then((dep) => {
         if (socket.destroyed) return;
         if (!dep || dep.revoked) return closeWith(req, socket, head, CLOSE.notAllowed, "this game's deployment is unknown or turned off");
         if (!originAllowed(dep, origin)) return closeWith(req, socket, head, CLOSE.notAllowed, `this site is not allowed for deployment ${id}`);
@@ -170,7 +199,7 @@ export function createRemote(o: RemoteOptions): Remote {
           live.set(id, (live.get(id) || 0) + 1);
           ws.on("close", () => { const left = (live.get(id) || 1) - 1; if (left > 0) live.set(id, left); else live.delete(id); });
           attach(ws, {
-            hub: o.hub, heartbeat: o.heartbeat, address: o.address ? o.address(req) : req.socket.remoteAddress || "?",
+            hub: o.hub, heartbeat: o.heartbeat, address: addr, counted: true,
             // the guest key is the page's own random 128-bit value: unguessable, so nobody can take another player's seat; it names a seat in
             // this deployment only (the hub shows others a short HMAC of it, never the key)
             authenticate: (ticket) => typeof ticket === "string" && KEY_RE.test(ticket)
@@ -193,7 +222,7 @@ export function createRemote(o: RemoteOptions): Remote {
       if (c) { js(200, files[c[1]], "public, max-age=300"); return true; }
       const b = /^\/c\/([^/]+)\.js$/.exec(url.pathname);
       if (!b) return false;
-      void lookup(b[1]).then((dep) => {
+      void lookup(b[1], addrOf(req)).then((dep) => {
         if (!dep || dep.revoked) return js(404, `console.error(${JSON.stringify(`tickcli: no deployment ${b[1].slice(0, 64)} (unknown or turned off)`)});`);
         js(200, bootScript(dep.id, sources), "public, max-age=300");
       });
@@ -222,10 +251,10 @@ export function createRemoteServer(o: RemoteServerOptions) {
   hub.start();
   const heartbeat = new Heartbeat();
   remote = createRemote({ hub, deployment: o.deployment, heartbeat, address: o.address ?? (o.trustProxy ? (req) => clientAddress(req, true) : undefined) });
-  const server = http.createServer((req, res) => {
+  const server = hardenServer(http.createServer((req, res) => {
     if (remote!.request(req, res)) return;
     res.writeHead(404, { "Content-Type": "text/plain" }); res.end("not found");
-  });
+  }));
   server.on("upgrade", (req, socket, head) => { if (!remote!.upgrade(req, socket, head)) socket.destroy(); });
   const listen = (port = 8080, host?: string) => new Promise<string>((resolve, reject) => {
     server.once("error", reject);

package/src/serve.ts

@@ -18,7 +18,7 @@ import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { WebSocketServer } from "ws";
 import { RoomHub, type Limits, type SavePort } from "./hub.ts";
-import { GuestPasses, Heartbeat, WS_OPTIONS, attach, clientAddress, fileSaves, gameHash, sameSite } from "./node.ts";
+import { GuestPasses, Heartbeat, WS_OPTIONS, attach, clientAddress, fileSaves, gameHash, hardenServer, sameSite } from "./node.ts";
 
 export interface GameServerOptions {
   /** Folder of games, one .html file each (names: letters, digits, "-" and "_"). Default: the current folder. */
@@ -172,7 +172,7 @@ export function createGameServer(o: GameServerOptions = {}): GameServer {
   };
   const title = o.title ?? "tickcli games";
 
-  const server = http.createServer((req, res) => {
+  const server = hardenServer(http.createServer((req, res) => {
     const url = new URL(req.url || "/", "http://localhost");
     const send = (code: number, type: string, body: string, headers: Record<string, string> = {}) => { res.writeHead(code, { "Content-Type": type, "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", ...headers }); res.end(body); };
     if (req.method !== "GET" && req.method !== "HEAD") return send(405, "text/plain", "method not allowed");
@@ -195,12 +195,14 @@ export function createGameServer(o: GameServerOptions = {}): GameServer {
     const headers: Record<string, string> = { "Content-Security-Policy": `default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: blob:; connect-src 'self'${wsOrigins(req)}; frame-ancestors 'none'` };
     if (!passes.check(SCOPE, cookie(req, PASS))) headers["Set-Cookie"] = GuestPasses.cookie(PASS, passes.issue(SCOPE), "/", !!o.secure);
     return send(200, "text/html; charset=utf-8", playPage(html, g![1]), headers);
-  });
+  }));
 
   server.on("upgrade", (req, socket, head) => {
     const url = new URL(req.url || "/", "http://localhost");
     const refuse = (code: number) => { socket.end(`HTTP/1.1 ${code} ${http.STATUS_CODES[code]}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`); };
     if (url.pathname !== "/room") return refuse(404);
+    const address = clientAddress(req, !!o.trustProxy);
+    if (!hub.allowAddress(address)) return refuse(429);
     if (!sameSite((n) => req.headers[n] as string | undefined)) return refuse(403);
     const pass = passes.check(SCOPE, cookie(req, PASS));
     if (!pass) return refuse(403);
@@ -208,7 +210,7 @@ export function createGameServer(o: GameServerOptions = {}): GameServer {
     const game = read(name);
     if (!game) return refuse(404);
     const identity = { scope: `${SCOPE}:${name}`, game: game.hash, slot: name, who: { seat: `g:${pass}`, name: GuestPasses.defaultName(pass), guest: true } };
-    wss.handleUpgrade(req, socket, head, (ws) => attach(ws, { hub, heartbeat, address: clientAddress(req, !!o.trustProxy), identity }));
+    wss.handleUpgrade(req, socket, head, (ws) => attach(ws, { hub, heartbeat, address, counted: true, identity }));
   });
 
   const listen = (port = 8080, host?: string) => new Promise<string>((resolve, reject) => {