unplugin-https-reverse-proxy 4.0.3 → 4.1.0-beta.10

package/src/caddy/privileged.ts

@@ -0,0 +1,124 @@
+import type { PrivilegedClient } from '../privileged/client'
+import type { HelperEvent } from '../privileged/protocol'
+import { Buffer } from 'node:buffer'
+import { EventEmitter } from 'node:events'
+import { dirname, join } from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+import { resolveHelperEntry } from '../privileged/entry'
+import { openHelperSession } from '../privileged/session'
+
+export interface PrivilegedEnv {
+  /** Executable started as root, resolved from the running bundle. */
+  helperEntry: string
+  helperArgs: string[]
+}
+
+/**
+ * Resolves what the helper needs to be started from the current bundle.
+ * `__dirname` exists in both the CJS and ESM outputs (tsup injects a shim).
+ */
+export function resolvePrivilegedEnv(): PrivilegedEnv {
+  const moduleDir = typeof __dirname === 'string'
+    ? __dirname
+    : dirname(fileURLToPath(import.meta.url))
+  const resolved = resolveHelperEntry({ moduleDir })
+  return { helperEntry: resolved.entry, helperArgs: resolved.args }
+}
+
+/** Re-emits helper events as the `stdout`/`stderr` events the log parsing expects. */
+export class HelperCaddyProcess extends EventEmitter {
+  readonly stdout = new EventEmitter()
+  readonly stderr = new EventEmitter()
+  private finished = false
+  private readonly unsubscribe: () => void
+
+  constructor(private readonly client: PrivilegedClient) {
+    super()
+    this.unsubscribe = client.onEvent(event => this.handleEvent(event))
+  }
+
+  private handleEvent(event: HelperEvent): void {
+    if (event.type !== 'event')
+      return
+
+    if (event.kind === 'caddy.stdout') {
+      this.stdout.emit('data', Buffer.from(event.data))
+      return
+    }
+
+    if (event.kind === 'caddy.stderr') {
+      this.stderr.emit('data', Buffer.from(event.data))
+      return
+    }
+
+    if (event.kind === 'caddy.exit') {
+      this.finished = true
+      this.emit('exit', event.code, event.signal)
+    }
+  }
+
+  /** Asks the helper to stop Caddy; the helper also stops it on disconnect. */
+  kill(): void {
+    this.unsubscribe()
+    if (this.finished)
+      return
+    this.finished = true
+    void this.client.call('caddy.stop').catch(() => {})
+  }
+}
+
+export interface OpenedPrivilegedSession {
+  client: PrivilegedClient
+  reused: boolean
+  close: () => Promise<void>
+}
+
+export interface PrivilegedSessionOptions {
+  log?: (message: string) => void
+  /** Runs the helper as the current user; tests use this to avoid sudo. */
+  direct?: boolean
+  /** Caddy binary the helper may run; fixed before the session opens. */
+  caddyBin: string
+  /** Caddyfile the helper may load. */
+  caddyConfigPath: string
+  /** Admin API socket; `ca.trust` talks to it instead of the TCP default. */
+  caddyAdminSocket?: string
+  /** Shown before the password prompt so the request is not a surprise. */
+  reason?: { target: string, https: boolean }
+}
+
+/** Where Caddy keeps its PKI, per platform. */
+export function caddyStoragePath(): string {
+  return process.platform === 'win32'
+    ? join(process.env.AppData ?? '', 'Caddy')
+    : join(process.env.HOME ?? '', 'Library/Application Support/Caddy')
+}
+
+/**
+ * Opens (or reuses) the privileged helper for this runtime directory.
+ * Only the helper runs as root: the plugin process, its caches and its
+ * `node_modules` keep the developer's identity.
+ */
+export function openPrivilegedSession(
+  runtimeDir: string,
+  options: PrivilegedSessionOptions,
+): Promise<OpenedPrivilegedSession> {
+  const env = resolvePrivilegedEnv()
+  return openHelperSession({
+    runtimeDir,
+    helperEntry: env.helperEntry,
+    helperArgs: env.helperArgs,
+    direct: options.direct,
+    // Caddy keeps its PKI under the user's home; the helper runs it as root, so
+    // it must know which tree to hand back afterwards.
+    caddyStoragePath: caddyStoragePath(),
+    // The binary and Caddyfile are fixed here: the privileged helper must never
+    // execute a path supplied over the socket.
+    caddyBin: options.caddyBin,
+    caddyConfigPath: options.caddyConfigPath,
+    caddyAdminSocket: options.caddyAdminSocket,
+    reason: options.reason,
+    log: options.log,
+  })
+}

package/src/caddy/utils.ts

@@ -1,51 +1,8 @@
-import { exec } from 'node:child_process'
-import { createServer } from 'node:net'
 import ora from 'ora'
 import { consola } from '../utils'
 
 let spinner: ora.Ora
 
-/**
- * @returns whether the port is in use
- */
-export function tryPort(port: number): Promise<boolean> {
-  return new Promise<boolean>((resolve, _reject) => {
-    try {
-      const server = createServer().listen(port)
-      server.on('listening', () => {
-        server.close()
-        resolve(false)
-      })
-      server.on('error', (err) => {
-        // @ts-expect-error err.code
-        if (err.code === 'EADDRINUSE')
-          resolve(true)
-        server.close()
-      })
-    }
-    catch {
-      resolve(true)
-    }
-  })
-}
-
-/**
- * npx free-port :port
- */
-export async function kill(port: number): Promise<void> {
-  return new Promise<void>((resolve, reject) => {
-    exec(`npx @maxbo/free-port ${port} -s`, (err, stdout, _stderr) => {
-      if (err) {
-        reject(err)
-      }
-      else {
-        consola.log(stdout)
-        resolve()
-      }
-    })
-  })
-}
-
 function getNumber(number: number): string {
   if (number <= 0)
     return '0%'

package/src/hmr-sse-bridge.ts

@@ -134,14 +134,25 @@ function handleClientMessage(
   })
 }
 
+export function shouldUseHmrSseBridge(protocol: string, userAgent: string): boolean {
+  if (protocol !== 'https:')
+    return false
+
+  const isApplePlatform = /Macintosh|iPhone|iPad|iPod/.test(userAgent)
+  const isSafari = /Version\//.test(userAgent)
+    && /Safari\//.test(userAgent)
+    && !/(?:Chrome|Chromium|CriOS|Edg|EdgiOS|OPR|OPiOS|Firefox|FxiOS)\//.test(userAgent)
+
+  return isApplePlatform && isSafari
+}
+
 /**
- * Client-side script that patches WebSocket to use SSE+fetch on iOS Safari.
+ * Client-side script that patches WebSocket to use SSE+fetch on macOS/iOS Safari.
  * This script is injected via Vite's transformIndexHtml hook.
  */
 export const hmrSseBridgeClientScript = `
 (function() {
-  // Activate when served over HTTPS to bypass WSS self-signed cert issues
-  if (location.protocol !== 'https:') return;
+  if (!(${shouldUseHmrSseBridge.toString()})(location.protocol, navigator.userAgent)) return;
 
   var OriginalWebSocket = window.WebSocket;
 

package/src/index.ts

@@ -7,7 +7,9 @@ import c from 'picocolors'
 import { createUnplugin } from 'unplugin'
 import { CaddyInstant } from './caddy'
 import { hmrSseBridgeClientScript, setupHmrSseBridge } from './hmr-sse-bridge'
-import { consola, generateQrcode, getIpv4List, isAdmin, once } from './utils'
+import { isPrivilegeDenied, markPrivilegeDenied } from './privilege-state'
+import { PrivilegeDeniedError } from './privileged/launch'
+import { consola, generateQrcode, getIpv4List, once } from './utils'
 
 let config: ResolvedConfig
 
@@ -62,10 +64,15 @@ export const vitePrintUrls = once((
 ) => {
   _printUrls?.()
 
+  // Declined earlier in this process; a hot restart must not ask again.
+  if (isPrivilegeDenied())
+    return
+
   if (caddy)
     return
-  caddy = new CaddyInstant()
-  caddy.run(source, target, {
+  const instance = new CaddyInstant()
+  caddy = instance
+  instance.run(source, target, {
     base,
     ...options,
   }).then(async () => {
@@ -73,6 +80,16 @@ export const vitePrintUrls = once((
 
     consola.success(`  ${c.green('➜')}  ${c.bold('run caddy reverse proxy success')}: ${colorUrl(`${options.https ? 'https' : 'http'}://${target}${base}`)}`)
   }).catch((e) => {
+    // Declining the password is a choice, not a crash: drop the half-started
+    // instance so a later attempt can prompt again.
+    if (caddy === instance)
+      caddy = undefined as unknown as CaddyInstant
+    if (e instanceof PrivilegeDeniedError) {
+      markPrivilegeDenied()
+      consola.warn('reverse proxy skipped: administrator permission was not granted.')
+      consola.info('Restart the dev server to enable it again.')
+      return
+    }
     throw e
   })
 })
@@ -96,10 +113,6 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
       if (!enable)
         return
 
-      if (!isAdmin()) {
-        consola.warn('please run as administrator')
-        return
-      }
       if (!target) {
         consola.fail('please provide target')
         return
@@ -123,17 +136,17 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
 
       server.printUrls = () => vitePrintUrls(options, source, target, base, _printUrls)
 
-      // Setup SSE bridge for iOS Safari WSS workaround
+      // Setup SSE bridge for macOS/iOS Safari WSS workaround
       if (options.https) {
         setupHmrSseBridge(server)
         hmrSseBridgeActive = true
-        consola.info('HMR SSE bridge enabled for iOS Safari WSS workaround')
+        consola.info('HMR SSE bridge enabled for macOS/iOS Safari WSS workaround')
       }
     },
     transformIndexHtml() {
       if (!hmrSseBridgeActive)
         return []
-      // Inject client-side script to patch WebSocket on iOS Safari
+      // Inject client-side script to patch WebSocket on macOS/iOS Safari
       return [{
         tag: 'script',
         children: hmrSseBridgeClientScript,
@@ -153,11 +166,6 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
     if (!enable)
       return
 
-    if (!isAdmin()) {
-      consola.warn('please run as administrator')
-      return
-    }
-
     if (!target) {
       consola.fail('please provide target')
       return
@@ -177,6 +185,9 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
     }
     const source = `${devServer.host}:${devServer.port}`
 
+    if (isPrivilegeDenied())
+      return
+
     if (caddy)
       return
 
@@ -204,9 +215,10 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
       options.https = false
     }
 
-    caddy = new CaddyInstant()
+    const instance = new CaddyInstant()
+    caddy = instance
 
-    caddy.run(source, target, {
+    instance.run(source, target, {
       base,
       ...options,
     }).then(() => {
@@ -216,6 +228,14 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
         consola.success(`  ${c.green('➜')}  ${c.bold('run caddy reverse proxy success')}: ${colorUrl(`${options.https ? 'https' : 'http'}://${target}${base}`)}`)
       })
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = undefined as unknown as CaddyInstant
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied()
+        consola.warn('reverse proxy skipped: administrator permission was not granted.')
+        consola.info('Restart the dev server to enable it again.')
+        return
+      }
       throw e
     })
   },
@@ -231,11 +251,6 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
     if (!enable)
       return
 
-    if (!isAdmin()) {
-      consola.warn('please run as administrator')
-      return
-    }
-
     if (!target) {
       consola.fail('please provide target')
       return
@@ -257,10 +272,11 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
 
     const source = `${devServer.host}:${devServer.port}`
 
-    if (caddy)
+    if (isPrivilegeDenied())
       return
 
-    caddy = new CaddyInstant()
+    if (caddy)
+      return
 
     let base = '/'
     const publicPath = compiler.options.output?.publicPath as unknown
@@ -272,7 +288,10 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
     if (base !== '/' && !base.endsWith('/'))
       base = `${base}/`
 
-    caddy.run(source, target, {
+    const instance = new CaddyInstant()
+    caddy = instance
+
+    instance.run(source, target, {
       base,
       ...options,
     }).then(async () => {
@@ -280,6 +299,14 @@ export const unpluginFactory: UnpluginFactory<Options> = options => ({
 
       consola.success(`  ${c.green('➜')}  ${c.bold('run caddy reverse proxy success')}: ${colorUrl(`${options.https ? 'https' : 'http'}://${target}${base}`)}`)
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = undefined as unknown as CaddyInstant
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied()
+        consola.warn('reverse proxy skipped: administrator permission was not granted.')
+        consola.info('Restart the dev server to enable it again.')
+        return
+      }
       throw e
     })
   },

package/src/nuxt.ts

@@ -2,7 +2,7 @@ import type { Options } from './types'
 import process from 'node:process'
 import { defineNuxtModule } from '@nuxt/kit'
 import { vitePrintUrls } from '.'
-import { consola, isAdmin } from './utils'
+import { consola } from './utils'
 import '@nuxt/schema'
 
 export interface ModuleOptions extends Options {
@@ -26,11 +26,6 @@ export default defineNuxtModule<ModuleOptions>({
     if (!enable)
       return
 
-    if (!isAdmin()) {
-      consola.warn('please run as administrator')
-      return
-    }
-
     if (!target) {
       consola.fail('please provide target')
       return

package/src/privilege-state.ts

@@ -0,0 +1,23 @@
+/**
+ * Whether the user dismissed the password prompt in this process.
+ *
+ * Kept in its own module so the flag outlives a hot restart. Vite rebuilds the
+ * dev server in place (`Object.assign(server, newServer)`) rather than starting
+ * a new process, so module scope is the only place that distinguishes "saved
+ * the config again" from "started the dev server again".
+ */
+let denied = false
+
+/** Records that the user declined; every entry point checks this first. */
+export function markPrivilegeDenied(): void {
+  denied = true
+}
+
+export function isPrivilegeDenied(): boolean {
+  return denied
+}
+
+/** Test hook: restores the initial state between cases. */
+export function resetPrivilegeDenied(): void {
+  denied = false
+}