unplugin-https-reverse-proxy 4.0.3 → 4.1.0-beta.2

package/dist/privileged-helper.js

@@ -0,0 +1,641 @@
+import {
+  serializeMessage
+} from "./chunk-RKHJN6KY.js";
+
+// src/privileged-helper.ts
+import process3 from "node:process";
+
+// src/privileged/bootstrap.ts
+import { Buffer } from "node:buffer";
+import { chmodSync, chownSync, rmSync } from "node:fs";
+import { createServer } from "node:net";
+import process2 from "node:process";
+
+// src/privileged/server.ts
+import { execFile, spawn } from "node:child_process";
+import { lchownSync, lstatSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { platform } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+import { promisify } from "node:util";
+
+// src/privileged/hosts-file.ts
+import { isIP } from "node:net";
+var HOSTS_MARKER = "# uhrp";
+var HOSTS_MARKER_PATTERN = /#\s*uhrp\b/;
+function detectEol(content) {
+  return content.includes("\r\n") ? "\r\n" : "\n";
+}
+function toBodyLines(content) {
+  const lines = content.split(/\r?\n/);
+  if (lines.length > 0 && lines[lines.length - 1] === "")
+    lines.pop();
+  return lines;
+}
+function parseLine(line) {
+  const withoutComment = line.replace(/#.*/, "").trim();
+  if (!withoutComment)
+    return void 0;
+  const [ip, ...hosts] = withoutComment.split(/\s+/);
+  if (!ip || hosts.length === 0)
+    return void 0;
+  return { ip, hosts };
+}
+function isOwned(line) {
+  return HOSTS_MARKER_PATTERN.test(line);
+}
+function mentionsHost(entry, host) {
+  return entry.hosts.some((candidate) => candidate.toLowerCase() === host.toLowerCase());
+}
+function sameIpFamily(left, right) {
+  const leftVersion = isIP(left);
+  return leftVersion !== 0 && leftVersion === isIP(right);
+}
+function rebuild(lines, original, eol) {
+  const content = lines.length > 0 ? lines.join(eol) + eol : "";
+  return { content, changed: content !== original };
+}
+function addHost(content, ip, host) {
+  var _a;
+  const eol = detectEol(content);
+  const lines = [];
+  for (const line of toBodyLines(content)) {
+    const entry = parseLine(line);
+    if (!entry || !mentionsHost(entry, host) || !sameIpFamily(entry.ip, ip)) {
+      lines.push(line);
+      continue;
+    }
+    const remaining = entry.hosts.filter((candidate) => candidate.toLowerCase() !== host.toLowerCase());
+    if (remaining.length === 0)
+      continue;
+    const comment = ((_a = line.match(/#.*/)) == null ? void 0 : _a[0]) ?? "";
+    const rebuilt = `${entry.ip} ${remaining.join(" ")}${comment ? ` ${comment}` : ""}`;
+    lines.push(rebuilt);
+  }
+  lines.push(`${ip} ${host} ${HOSTS_MARKER}`);
+  return rebuild(lines, content, eol);
+}
+function removeHost(content, ip, host) {
+  var _a;
+  const eol = detectEol(content);
+  const lines = [];
+  for (const line of toBodyLines(content)) {
+    const entry = parseLine(line);
+    if (!entry || entry.ip !== ip || !mentionsHost(entry, host)) {
+      lines.push(line);
+      continue;
+    }
+    const remaining = entry.hosts.filter((candidate) => candidate.toLowerCase() !== host.toLowerCase());
+    if (remaining.length === 0)
+      continue;
+    const comment = ((_a = line.match(/#.*/)) == null ? void 0 : _a[0]) ?? "";
+    lines.push(`${entry.ip} ${remaining.join(" ")}${comment ? ` ${comment}` : ""}`);
+  }
+  return rebuild(lines, content, eol);
+}
+function removeMarkedHosts(content) {
+  const eol = detectEol(content);
+  const lines = toBodyLines(content).filter((line) => !isOwned(line));
+  return rebuild(lines, content, eol);
+}
+
+// src/privileged/ports.ts
+function parseListeningPids(output) {
+  const pids = /* @__PURE__ */ new Set();
+  for (const line of output.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed)
+      continue;
+    if (!/^\d+$/.test(trimmed))
+      continue;
+    const pid = Number(trimmed);
+    if (Number.isSafeInteger(pid) && pid > 0)
+      pids.add(pid);
+  }
+  return [...pids];
+}
+function parseWindowsListeningPids(output, port) {
+  const pids = /* @__PURE__ */ new Set();
+  const suffix = `:${port}`;
+  for (const line of output.split(/\r?\n/)) {
+    const columns = line.trim().split(/\s+/);
+    if (columns.length < 5)
+      continue;
+    const protocol = columns[0].toUpperCase();
+    if (protocol !== "TCP")
+      continue;
+    if (!columns[1].endsWith(suffix))
+      continue;
+    if (columns[3].toUpperCase() !== "LISTENING")
+      continue;
+    const pid = Number(columns[4]);
+    if (Number.isSafeInteger(pid) && pid > 0)
+      pids.add(pid);
+  }
+  return [...pids];
+}
+
+// src/privileged/validation.ts
+import { isIP as isIP2 } from "node:net";
+var ALLOWED_FREE_PORTS = /* @__PURE__ */ new Set([80, 443]);
+var HOSTNAME_PATTERN = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+var IPV6_IN_HOSTS = /^[0-9a-f:.]+$/i;
+function isSafeHost(host) {
+  if (typeof host !== "string" || host.length === 0 || host.length > 253)
+    return false;
+  if (/[\s#\0]/.test(host))
+    return false;
+  return HOSTNAME_PATTERN.test(host);
+}
+function isSafeIp(ip) {
+  if (typeof ip !== "string")
+    return false;
+  if (isIP2(ip) !== 0)
+    return true;
+  return IPV6_IN_HOSTS.test(ip);
+}
+function isAllowedFreePort(port) {
+  return typeof port === "number" && Number.isInteger(port) && ALLOWED_FREE_PORTS.has(port);
+}
+
+// src/privileged/server.ts
+var execFileAsync = promisify(execFile);
+function execFileQuiet(file, args) {
+  return new Promise((resolve) => {
+    execFile(file, args, (error, stdout) => resolve({ stdout: error && !stdout ? "" : stdout }));
+  });
+}
+var HOSTS_PATH = platform() === "win32" ? "C:\\Windows\\System32\\drivers\\etc\\hosts" : "/etc/hosts";
+var FLUSH_COMMANDS = {
+  win32: [{ file: "ipconfig", args: ["/flushdns"] }],
+  darwin: [{ file: "killall", args: ["-HUP", "mDNSResponder"] }],
+  // systemd-resolved is the common case; the legacy name covers older distros
+  // and hosts without resolved simply have no cache to drop.
+  linux: [
+    { file: "resolvectl", args: ["flush-caches"] },
+    { file: "systemd-resolve", args: ["--flush-caches"] }
+  ]
+};
+var FLUSH_FALLBACK = [{ file: "killall", args: ["-HUP", "mDNSResponder"] }];
+async function flushDnsBestEffort(deps) {
+  try {
+    await deps.flushDns();
+  } catch (error) {
+    deps.log(`dns flush failed: ${error.message}`);
+  }
+}
+function createHelperRuntime(deps) {
+  const clients = /* @__PURE__ */ new Set();
+  let teardown;
+  let generation = 0;
+  let caddy;
+  const broadcast = (event) => {
+    const line = serializeMessage(event);
+    for (const client of clients) {
+      const socket = client;
+      if (typeof socket.write === "function" && !socket.destroyed)
+        socket.write(line);
+    }
+  };
+  async function stopCaddy() {
+    const current = caddy;
+    caddy = void 0;
+    if (current) {
+      try {
+        current.kill("SIGTERM");
+      } catch {
+      }
+    }
+    await deps.stopCaddy().catch(() => {
+    });
+    if (deps.caddyStoragePath && deps.storageOwner)
+      await reclaimTree(deps.caddyStoragePath, deps.storageOwner.uid, deps.storageOwner.gid).catch(() => {
+      });
+  }
+  function dispose() {
+    if (!teardown) {
+      const startedAt = generation;
+      teardown = (async () => {
+        try {
+          if (generation === startedAt) {
+            const edited = removeMarkedHosts(deps.readHosts());
+            if (edited.changed) {
+              deps.writeHosts(edited.content);
+              await deps.flushDns().catch(() => {
+              });
+            }
+          }
+        } catch (error) {
+          deps.log(`hosts cleanup failed: ${error.message}`);
+        }
+        if (generation === startedAt)
+          await stopCaddy();
+      })();
+    }
+    return teardown;
+  }
+  async function sweepStaleEntries() {
+    try {
+      const edited = removeMarkedHosts(deps.readHosts());
+      if (!edited.changed)
+        return false;
+      deps.writeHosts(edited.content);
+      await flushDnsBestEffort(deps);
+      return true;
+    } catch (error) {
+      deps.log(`stale hosts cleanup failed: ${error.message}`);
+      return false;
+    }
+  }
+  async function handle(request) {
+    try {
+      switch (request.method) {
+        case "ping":
+          return { id: request.id, ok: true, result: { pid: process.pid } };
+        case "hosts.add": {
+          const { ip, host } = request.params;
+          if (!isSafeIp(ip) || !isSafeHost(host))
+            return { id: request.id, ok: false, error: { message: "invalid hosts entry" } };
+          const edited = addHost(deps.readHosts(), ip, host);
+          if (edited.changed)
+            deps.writeHosts(edited.content);
+          await flushDnsBestEffort(deps);
+          return { id: request.id, ok: true };
+        }
+        case "hosts.remove": {
+          const { ip, host } = request.params;
+          if (!isSafeIp(ip) || !isSafeHost(host))
+            return { id: request.id, ok: false, error: { message: "invalid hosts entry" } };
+          const edited = removeHost(deps.readHosts(), ip, host);
+          if (edited.changed)
+            deps.writeHosts(edited.content);
+          await flushDnsBestEffort(deps);
+          return { id: request.id, ok: true };
+        }
+        case "port.free": {
+          const { port } = request.params;
+          if (!isAllowedFreePort(port))
+            return { id: request.id, ok: false, error: { message: `port ${port} is not releasable` } };
+          const killed = await deps.freePort(port);
+          return { id: request.id, ok: true, result: { killed } };
+        }
+        case "caddy.start": {
+          if (caddy)
+            await stopCaddy();
+          caddy = deps.startCaddy(broadcast);
+          return { id: request.id, ok: true, result: { pid: caddy.pid } };
+        }
+        case "caddy.stop": {
+          await stopCaddy();
+          return { id: request.id, ok: true };
+        }
+        case "ca.trust": {
+          const result = await deps.trustLocalCa();
+          return { id: request.id, ok: true, result };
+        }
+        default:
+          return { id: request.id, ok: false, error: { message: "unknown method" } };
+      }
+    } catch (error) {
+      return { id: request.id, ok: false, error: { message: error.message } };
+    }
+  }
+  return {
+    handle,
+    attach(client) {
+      clients.add(client);
+      generation++;
+      teardown = void 0;
+    },
+    async detach(client) {
+      clients.delete(client);
+      if (clients.size === 0)
+        await dispose();
+    },
+    dispose,
+    sweepStaleEntries
+  };
+}
+async function reclaimTree(target, uid, gid) {
+  const reclaimed = [];
+  const walk = (path) => {
+    let stats;
+    try {
+      stats = lstatSync(path);
+    } catch {
+      return;
+    }
+    try {
+      lchownSync(path, uid, gid);
+      reclaimed.push(path);
+    } catch {
+    }
+    if (!stats.isDirectory())
+      return;
+    let entries;
+    try {
+      entries = readdirSync(path);
+    } catch {
+      return;
+    }
+    for (const entry of entries)
+      walk(join(path, entry));
+  };
+  walk(target);
+  return reclaimed;
+}
+async function trustLocalCaWithSystemTools(caddyBin) {
+  try {
+    const { stdout, stderr } = await execFileAsync(
+      caddyBin,
+      ["trust", "--ca", "local", "--address", "127.0.0.1:2019"],
+      { timeout: 12e4 }
+    );
+    return { trusted: true, output: `${stdout}${stderr}`.trim() };
+  } catch (error) {
+    const output = String(error.stdout ?? "") + String(error.stderr ?? "");
+    if (/already|not modified|no changes/i.test(output))
+      return { trusted: true, output: output.trim() };
+    throw new Error(output.trim() || error.message);
+  }
+}
+function createNodeHelperDeps(options) {
+  const hostsPath = options.hostsPath ?? HOSTS_PATH;
+  const log = options.log ?? ((message) => process.stdout.write(`${message}
+`));
+  let caddy;
+  return {
+    readHosts: () => readFileSync(hostsPath, "utf8"),
+    writeHosts: (content) => {
+      writeFileSync(hostsPath, content);
+    },
+    flushDns: async () => {
+      const candidates = FLUSH_COMMANDS[platform()] ?? [...FLUSH_FALLBACK];
+      let lastError;
+      for (const candidate of candidates) {
+        try {
+          await execFileAsync(candidate.file, candidate.args);
+          return;
+        } catch (error) {
+          lastError = error;
+        }
+      }
+      throw lastError ?? new Error("no DNS cache flush command for this platform");
+    },
+    freePort: async (port) => {
+      const pids = platform() === "win32" ? parseWindowsListeningPids((await execFileAsync("netstat", ["-ano"])).stdout, port) : parseListeningPids((await execFileQuiet("lsof", [`-ti:${port}`, "-sTCP:LISTEN"])).stdout);
+      const killed = [];
+      for (const pid of pids) {
+        if (pid === process.pid)
+          continue;
+        try {
+          process.kill(pid, "SIGTERM");
+          killed.push(pid);
+        } catch {
+        }
+      }
+      return killed;
+    },
+    caddyBin: options.caddyBin,
+    caddyConfigPath: options.caddyConfigPath,
+    caddyCwd: options.caddyCwd ?? process.cwd(),
+    caddyEnv: options.caddyEnv ?? {},
+    trustLocalCa: () => trustLocalCaWithSystemTools(options.caddyBin),
+    caddyStoragePath: options.caddyStoragePath,
+    storageOwner: options.storageOwner,
+    startCaddy: (emit) => {
+      var _a, _b;
+      const child = spawn(options.caddyBin, ["run", "--adapter", "caddyfile", "--config", options.caddyConfigPath], {
+        cwd: options.caddyCwd ?? process.cwd(),
+        env: { ...process.env, ...options.caddyEnv },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      (_a = child.stdout) == null ? void 0 : _a.on("data", (data) => emit({ type: "event", kind: "caddy.stdout", data: data.toString() }));
+      (_b = child.stderr) == null ? void 0 : _b.on("data", (data) => emit({ type: "event", kind: "caddy.stderr", data: data.toString() }));
+      child.on("exit", (code, signal) => emit({ type: "event", kind: "caddy.exit", code, signal }));
+      caddy = child;
+      return caddy;
+    },
+    stopCaddy: async () => {
+      const current = caddy;
+      caddy = void 0;
+      if (!current)
+        return;
+      try {
+        current.kill("SIGTERM");
+      } catch {
+      }
+    },
+    log
+  };
+}
+function attachSocket(socket, runtime, log) {
+  let buffer = "";
+  runtime.attach(socket);
+  socket.on("data", (chunk) => {
+    buffer += chunk.toString("utf8");
+    let index = buffer.indexOf("\n");
+    while (index >= 0) {
+      const line = buffer.slice(0, index);
+      buffer = buffer.slice(index + 1);
+      index = buffer.indexOf("\n");
+      if (!line.trim())
+        continue;
+      let request;
+      try {
+        request = JSON.parse(line);
+      } catch (error) {
+        log(`invalid request: ${error.message}`);
+        continue;
+      }
+      void runtime.handle(request).then((response) => {
+        if (!socket.destroyed)
+          socket.write(serializeMessage(response));
+      });
+    }
+  });
+  socket.on("error", (error) => {
+    log(`connection error: ${error.message}`);
+  });
+  socket.on("close", () => {
+    void runtime.detach(socket);
+  });
+}
+
+// src/privileged/bootstrap.ts
+var HANDSHAKE_TIMEOUT_MS = 12e4;
+async function startHelper(options) {
+  const { socketPath, token } = options;
+  const log = options.log ?? ((message) => process2.stdout.write(`[uhrp-helper] ${message}
+`));
+  const deps = options.deps ?? createNodeHelperDeps({
+    hostsPath: options.hostsPath,
+    log,
+    caddyBin: options.caddyBin,
+    caddyConfigPath: options.caddyConfigPath,
+    caddyCwd: options.caddyCwd,
+    caddyEnv: options.caddyEnv,
+    caddyStoragePath: options.caddyStoragePath,
+    storageOwner: typeof options.ownerUid === "number" ? { uid: options.ownerUid, gid: options.ownerGid ?? options.ownerUid } : void 0
+  });
+  const runtime = createHelperRuntime(deps);
+  await runtime.sweepStaleEntries().catch(() => {
+  });
+  try {
+    rmSync(socketPath, { force: true });
+  } catch {
+  }
+  const connections = /* @__PURE__ */ new Set();
+  const server = createServer((socket) => {
+    var _a;
+    let buffer = "";
+    let authenticated = false;
+    connections.add(socket);
+    socket.on("close", () => connections.delete(socket));
+    const timer = setTimeout(() => {
+      if (!authenticated)
+        socket.destroy();
+    }, HANDSHAKE_TIMEOUT_MS);
+    (_a = timer.unref) == null ? void 0 : _a.call(timer);
+    const onData = (chunk) => {
+      buffer += chunk.toString("utf8");
+      const index = buffer.indexOf("\n");
+      if (index < 0)
+        return;
+      const line = buffer.slice(0, index);
+      const rest = buffer.slice(index + 1);
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        socket.destroy();
+        return;
+      }
+      if (parsed.type !== "handshake" || typeof parsed.token !== "string") {
+        socket.destroy();
+        return;
+      }
+      clearTimeout(timer);
+      socket.removeListener("data", onData);
+      if (parsed.token !== token) {
+        socket.end(`${JSON.stringify({ type: "handshake", ok: false, reason: "invalid token" })}
+`);
+        return;
+      }
+      authenticated = true;
+      socket.write(`${JSON.stringify({ type: "handshake", ok: true, pid: process2.pid })}
+`);
+      attachSocket(socket, runtime, log);
+      if (rest.trim() !== "")
+        socket.emit("data", Buffer.from(rest));
+    };
+    socket.on("data", onData);
+    socket.on("error", () => {
+    });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => resolve());
+  });
+  try {
+    if (typeof options.ownerUid === "number") {
+      chownSync(socketPath, options.ownerUid, options.ownerGid ?? options.ownerUid);
+      chmodSync(socketPath, 384);
+    } else {
+      chmodSync(socketPath, 384);
+    }
+  } catch (error) {
+    log(`could not set socket ownership: ${error.message}`);
+  }
+  return {
+    runtime,
+    async close() {
+      for (const socket of connections)
+        socket.destroy();
+      connections.clear();
+      await new Promise((resolve) => {
+        server.close(() => resolve());
+      });
+    }
+  };
+}
+
+// src/privileged-helper.ts
+function parseArgs(argv) {
+  let socket = "";
+  let token = "";
+  let hosts;
+  let caddyBin = "";
+  let caddyConfig = "";
+  let ownerUid;
+  let ownerGid;
+  let caddyStorage;
+  for (let index = 0; index < argv.length; index++) {
+    const current = argv[index];
+    if (current === "--socket")
+      socket = argv[++index] ?? "";
+    else if (current === "--token")
+      token = argv[++index] ?? "";
+    else if (current === "--hosts")
+      hosts = argv[++index] ?? void 0;
+    else if (current === "--caddy")
+      caddyBin = argv[++index] ?? "";
+    else if (current === "--caddy-config")
+      caddyConfig = argv[++index] ?? "";
+    else if (current === "--owner-uid")
+      ownerUid = Number(argv[++index]);
+    else if (current === "--owner-gid")
+      ownerGid = Number(argv[++index]);
+    else if (current === "--caddy-storage")
+      caddyStorage = argv[++index] ?? void 0;
+  }
+  if (!socket || !token)
+    throw new Error("usage: privileged-helper --socket <path> --token <token> --caddy <bin> --caddy-config <path>");
+  if (!caddyBin || !caddyConfig)
+    throw new Error("privileged-helper requires --caddy and --caddy-config");
+  return {
+    socket,
+    token,
+    hosts,
+    caddyBin,
+    caddyConfig,
+    ownerUid: Number.isInteger(ownerUid) ? ownerUid : void 0,
+    ownerGid: Number.isInteger(ownerGid) ? ownerGid : void 0,
+    caddyStorage
+  };
+}
+async function main() {
+  const args = parseArgs(process3.argv.slice(2));
+  const helper = await startHelper({
+    socketPath: args.socket,
+    token: args.token,
+    hostsPath: args.hosts,
+    caddyBin: args.caddyBin,
+    caddyConfigPath: args.caddyConfig,
+    ownerUid: args.ownerUid,
+    ownerGid: args.ownerGid,
+    caddyStoragePath: args.caddyStorage,
+    caddyEnv: {
+      HOME: process3.env.HOME ?? "",
+      // Keep Caddy's storage next to the invoking user's home even though the
+      // process runs as root.
+      XDG_DATA_HOME: process3.env.XDG_DATA_HOME ?? ""
+    }
+  });
+  process3.on("SIGINT", () => {
+  });
+  const shutdown = () => {
+    void helper.runtime.dispose().finally(() => process3.exit(0));
+  };
+  process3.on("SIGTERM", shutdown);
+  process3.on("SIGHUP", shutdown);
+  process3.stdout.on("error", () => {
+  });
+  process3.stderr.on("error", () => {
+  });
+}
+main().catch((error) => {
+  process3.stderr.write(`[uhrp-helper] fatal: ${error.message}
+`);
+  process3.exit(1);
+});