unplugin-https-reverse-proxy 4.0.4 → 4.1.0-beta.3

package/dist/webpack.js

@@ -1,8 +1,10 @@
 import {
   unpluginFactory
-} from "./chunk-5R33PUJP.js";
+} from "./chunk-HBXMM25C.js";
+import "./chunk-EY3HXBJ4.js";
 import "./chunk-C5A7XLKL.js";
-import "./chunk-2P7SUCQ3.js";
+import "./chunk-WOMR3ZLM.js";
+import "./chunk-RKHJN6KY.js";
 
 // src/webpack.ts
 import { createWebpackPlugin } from "unplugin";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "unplugin-https-reverse-proxy",
   "type": "module",
-  "version": "4.0.4",
+  "version": "4.1.0-beta.3",
   "description": "",
   "license": "MIT",
   "homepage": "https://github.com/zcf0508/unplugin-https-reverse-proxy#readme",
@@ -119,7 +119,6 @@
     "console-table-printer": "^2.12.1",
     "dotenv-flow": "^4.1.0",
     "got-cjs": "^12.5.4",
-    "hostile": "^1.4.0",
     "http-proxy-agent": "^7.0.2",
     "https-proxy-agent": "^7.0.6",
     "ora": "5",
@@ -133,8 +132,6 @@
     "@nuxt/schema": "^3.16.1",
     "@rsbuild/core": "^0.4.15",
     "@rspack/core": "^0.5.9",
-    "@types/hostile": "^1.3.5",
-    "@types/kill-port": "^2.0.3",
     "@types/node": "^20.11.19",
     "@types/proper-lockfile": "^4.1.4",
     "@types/qrcode-terminal": "^0.12.2",

package/src/caddy/caddyfile.ts

@@ -26,6 +26,7 @@ export function validateTemplateContext(ctx: unknown): typeof CaddyContext.infer
 export const caddyTemplate = `{
   debug
   auto_https disable_redirects ignore_loaded_certs
+  skip_install_trust
 }
 
 :7601 {

package/src/caddy/index.ts

@@ -1,4 +1,6 @@
-import { spawn } from 'node:child_process'
+import type { Buffer } from 'node:buffer'
+import type { OpenedPrivilegedSession } from './privileged'
+import { execFile } from 'node:child_process'
 import { chmodSync, createWriteStream, existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs'
 import { readFile, unlink, writeFile } from 'node:fs/promises'
 import { platform } from 'node:os'
@@ -9,25 +11,23 @@ import { got } from 'got-cjs'
 import { HttpProxyAgent } from 'http-proxy-agent'
 import { HttpsProxyAgent } from 'https-proxy-agent'
 import * as lockfile from 'proper-lockfile'
-import { addHost, removeHost } from '../host'
-import { chmodRecursive, consola, once } from '../utils'
+import { consola, once } from '../utils'
 import { genCaddyfile, validateTemplateContext } from './caddyfile'
 import { useCaddyConfig } from './config'
 import { caddyFilePath, caddyLockFilePath, caddyPath, supportList, TEMP_DIR } from './constants'
 import { isCaddyReloadCancellation } from './log'
+import { HelperCaddyProcess, openPrivilegedSession } from './privileged'
 import { formatTlsHealthFailure, waitForLocalTls } from './tls-health'
-import { kill, logProgress, logProgressOver, tryPort } from './utils'
+import { logProgress, logProgressOver } from './utils'
 
 export async function download(): Promise<string> {
   if (await testCaddy())
     return caddyPath
 
   return new Promise<string>((resolve, reject) => {
-    // https://caddyserver.com/api/download?os=darwin&arch=amd64
-
     if (!existsSync(TEMP_DIR)) {
       mkdirSync(TEMP_DIR, { recursive: true })
-      chmodSync(TEMP_DIR, 0o777)
+      chmodSync(TEMP_DIR, 0o700)
     }
 
     const file = createWriteStream(caddyPath)
@@ -55,8 +55,7 @@ export async function download(): Promise<string> {
     const httpsAgent = httpsProxy ? new HttpsProxyAgent(httpsProxy) : undefined
 
     const chmodCaddyOnce = once(() => {
-      // chmod +x
-      chmodSync(caddyPath, 0o777)
+      chmodSync(caddyPath, 0o755)
     })
 
     got.stream(dowmloadLink, {
@@ -71,30 +70,32 @@ export async function download(): Promise<string> {
       logProgressOver()
       if (process.platform === 'win32')
         return resolve(caddyPath)
-      // chmod +x
-      chmodSync(caddyPath, 0o777)
+      chmodSync(caddyPath, 0o755)
       resolve(caddyPath)
     }).on('error', (err) => {
-      // consola.error(err)
       reject(err)
     })
   })
 }
 
-function testCaddy(): Promise<boolean> {
-  return new Promise((resolve, reject) => {
+/**
+ * Checks for a usable binary by running it with no arguments: Caddy prints its
+ * usage and exits, so this neither binds a port nor needs privileges.
+ */
+export function testCaddy(): Promise<boolean> {
+  return new Promise((resolve) => {
     if (!existsSync(caddyPath))
       return resolve(false)
-    chmodSync(caddyPath, 0o777)
-    const child = process.platform === 'win32' ? spawn(caddyPath, []) : spawn('sudo', ['-E', caddyPath])
-    child.on('close', () => {
-      return resolve(false)
-    })
-    child.on('error', (err) => {
-      return reject(err)
-    })
-    child.stdout.on('data', (_data) => {
-      return resolve(true)
+
+    try {
+      chmodSync(caddyPath, 0o755)
+    }
+    catch {}
+
+    execFile(caddyPath, [], { timeout: 10_000 }, (error, stdout) => {
+      if (error && !stdout)
+        return resolve(false)
+      resolve(stdout.length > 0)
     })
   })
 }
@@ -129,32 +130,68 @@ function splitHostPort(addr: string): { host: string, port: string } {
   return { host: addr.slice(0, lastColon), port: addr.slice(lastColon + 1) }
 }
 
+/** Injection point for tests: opens the privileged helper without sudo. */
+export interface CaddyDependencies {
+  openSession: (runtimeDir: string, reason?: { target: string, https: boolean }) => Promise<OpenedPrivilegedSession>
+}
+
+const defaultDependencies: CaddyDependencies = {
+  openSession: (runtimeDir, reason) => openPrivilegedSession(runtimeDir, {
+    log: message => consola.debug(message),
+    // Both paths are fixed here, before any socket traffic: the privileged
+    // helper must never execute something named in a request.
+    caddyBin: caddyPath,
+    caddyConfigPath: caddyFilePath,
+    reason,
+  }),
+}
+
 export class CaddyInstant {
   private inited = false
   private stoped = false
+  private readonly deps: CaddyDependencies
 
   /** has locked when start */
   private locked = false
   private caddyfile: string | undefined
 
-  private _caddyChild: ReturnType<typeof spawn> | undefined
+  private _caddyChild: HelperCaddyProcess | undefined
+  private _session: OpenedPrivilegedSession | undefined
 
   private _source: string | undefined
   private _target: string | undefined
-  private _stopEffects: Array< (() => void)> = []
-
-  constructor() {
-    testCaddy().then(async () => {
-      this.inited = true
-    })
+  private _stopEffects: Array<(() => void)> = []
 
+  constructor(deps: Partial<CaddyDependencies> = {}) {
+    this.deps = { ...defaultDependencies, ...deps }
     this.locked = this.checkLock()
   }
 
   checkLock(): boolean {
     if (!existsSync(caddyLockFilePath))
       writeFileSync(caddyLockFilePath, '')
-    return lockfile.checkSync(caddyLockFilePath)
+    try {
+      return lockfile.checkSync(caddyLockFilePath)
+    }
+    catch {
+      return false
+    }
+  }
+
+  /**
+   * Connects to the privileged helper, starting it once if needed. It is
+   * reused across instances so a second dev server does not ask for a
+   * password again.
+   */
+  private async session(reason?: { target: string, https: boolean }): Promise<OpenedPrivilegedSession> {
+    // A crashed helper leaves the cached client permanently disconnected; drop
+    // it so the next call starts a fresh helper instead of failing forever.
+    if (this._session && !this._session.client.connected)
+      this._session = undefined
+
+    if (!this._session)
+      this._session = await this.deps.openSession(TEMP_DIR, reason)
+    return this._session
   }
 
   async getCaddyfile(): Promise<string> {
@@ -189,6 +226,34 @@ export class CaddyInstant {
     this.inited = true
   }
 
+  /**
+   * Hands the Caddy storage directory back to the developer. Local CA data
+   * created by an earlier root-owned run must stay readable for `tls internal`
+   * to keep serving the same certificate the browser already trusts.
+   */
+  /**
+   * Installs Caddy's local root CA so the browser stops warning about
+   * `tls internal` certificates. Generating the CA and trusting it are separate
+   * steps: a new CA appears whenever the previous one expires or the storage is
+   * replaced, so this runs on every start instead of once.
+   *
+   * The helper owns both the binary path and the command, so nothing here can
+   * be turned into an arbitrary root execution.
+   */
+  private async trustLocalCa(session: OpenedPrivilegedSession): Promise<void> {
+    try {
+      const result = await session.client.call('ca.trust')
+      if (result.trusted)
+        consola.debug(`Caddy local CA is trusted\n${result.output}`)
+    }
+    catch (error) {
+      consola.warn(
+        `could not install the Caddy root certificate automatically: ${(error as Error).message}\n`
+        + `Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`,
+      )
+    }
+  }
+
   private async ensureTlsReady(targetHost: string): Promise<void> {
     const health = await waitForLocalTls(targetHost)
     if (!health.healthy)
@@ -251,9 +316,11 @@ export class CaddyInstant {
 
     const sourceHost = splitHostPort(source).host
     const targetHost = splitHostPort(target).host
-    if (!await addHost(sourceHost, targetHost))
-      throw new Error('update host failed')
+
+    const session = await this.session({ target: targetHost, https })
+    await session.client.call('hosts.add', { ip: sourceHost, host: targetHost })
     consola.success('update host success\n')
+
     const normalizeBase = (b: string): string => {
       let out = b || '/'
       if (!out.startsWith('/'))
@@ -296,10 +363,10 @@ export class CaddyInstant {
       writeFileSync(caddyLockFilePath, '')
 
     if (!this.locked) {
-      if (await tryPort(443))
-        await kill(443)
-      if ((process.platform === 'win32' || !https) && await tryPort(80))
-        await kill(80)
+      // Ports 80/443 may still be held by a previous, uncleanly stopped run.
+      await session.client.call('port.free', { port: 443 })
+      if (process.platform === 'win32' || !https)
+        await session.client.call('port.free', { port: 80 })
     }
 
     return new Promise<void>((resolve, reject) => {
@@ -311,8 +378,13 @@ export class CaddyInstant {
         startupCheckStarted = true
 
         try {
-          if (https)
+          if (https) {
+            // `caddy trust` reads the CA through the admin API, so it can only
+            // run once Caddy is serving. The helper does it as root because the
+            // system trust store is not writable by the developer account.
+            await this.trustLocalCa(session)
             await this.ensureTlsReady(targetHost)
+          }
           resolve()
         }
         catch (error) {
@@ -344,25 +416,6 @@ export class CaddyInstant {
 
         // @ts-expect-error override
         process.exit = async (code?: number) => {
-          const port = Number(splitHostPort(source).port)
-          if (!Number.isNaN(port) && await tryPort(port))
-            await kill(port)
-
-          // fix `Error: EPERM: operation not permitted`
-          const pwd = process.cwd()
-          const viteCacheDir = `${pwd}/node_modules/.vite`
-          if (existsSync(viteCacheDir))
-            await chmodRecursive(viteCacheDir, 0o777).catch(() => { })
-          const viteTempCacheDir = `${pwd}/node_modules/.vite-temp`
-          if (existsSync(viteTempCacheDir))
-            await chmodRecursive(viteTempCacheDir, 0o777).catch(() => { })
-          const nuxtCacheDir = `${pwd}/.nuxt`
-          if (existsSync(nuxtCacheDir))
-            await chmodRecursive(nuxtCacheDir, 0o777).catch(() => { })
-          const webpackCacheDir = `${pwd}/node_modules/.cache`
-          if (existsSync(webpackCacheDir))
-            await chmodRecursive(webpackCacheDir, 0o777).catch(() => { })
-
           if (this.stoped)
             return originalExit(code)
 
@@ -382,56 +435,67 @@ export class CaddyInstant {
       }
 
       if (!this.locked) {
-        this._caddyChild = process.platform !== 'win32'
-          ? spawn('sudo', ['-E', caddyPath, 'run', '--config', caddyFilePath, '--watch'])
-          : spawn(caddyPath, ['run', '--config', caddyFilePath, '--watch'])
-
         lockfile.lockSync(caddyLockFilePath)
+        setupCleanup()
 
-        this._caddyChild!.on('error', (err) => {
-          return reject(err)
-        })
+        void (async () => {
+          try {
+            const child = new HelperCaddyProcess(session.client)
+            this._caddyChild = child
 
-        this._caddyChild!.stderr?.on('data', async (data) => {
-          const lines = (data.toString() as string).split('\n').map(line => line.trim())
-          for (const line of lines) {
-            // caddy log
-            // eslint-disable-next-line no-console
-            showCaddyLog && line && console.info(line)
-            if (isCaddyReloadCancellation(line)) {
-              consola.info('Caddy restarted before TLS issuance completed; retrying.\n')
-              continue
-            }
-            try {
-              if (line.includes('Error:') || (line && JSON.parse(line).level === 'error')) {
-                if (line.includes('parsing caddyfile tokens')) {
-                  consola.error('Caddyfile syntax error, please contact the author:\n', `${this.caddyfile}\n\n${line}\n`)
-                  await this.baseCleanup()
-                  process.exit()
+            await session.client.call('caddy.start')
+
+            child.on('exit', (code: number | null) => {
+              if (code !== null && code !== 0)
+                reject(new Error(`Caddy exited with code ${code}`))
+            })
+
+            child.stderr.on('data', async (data: Buffer) => {
+              const lines = data.toString().split('\n').map((line: string) => line.trim())
+              for (const line of lines) {
+                // caddy log
+                // eslint-disable-next-line no-console
+                showCaddyLog && line && console.info(line)
+                if (isCaddyReloadCancellation(line)) {
+                  consola.info('Caddy restarted before TLS issuance completed; retrying.\n')
+                  continue
                 }
-                else {
-                  consola.error(`${line}\n`)
-                  // child.kill()
-                  return reject(line)
+                try {
+                  if (line.includes('Error:') || (line && JSON.parse(line).level === 'error')) {
+                    if (line.includes('parsing caddyfile tokens')) {
+                      consola.error('Caddyfile syntax error, please contact the author:\n', `${this.caddyfile}\n\n${line}\n`)
+                      await this.baseCleanup()
+                      process.exit()
+                    }
+                    else {
+                      consola.error(`${line}\n`)
+                      return reject(line)
+                    }
+                  }
                 }
-              }
-            }
-            catch {}
+                catch {}
 
-            if (line.includes('config file changed'))
-              consola.success('Detect added a new reverse proxy config, restarted.\n')
+                if (line.includes('config file changed'))
+                  consola.success('Detect added a new reverse proxy config, restarted.\n')
 
-            if (line.includes('caddy proxying') || line.includes('serving initial'))
+                if (line.includes('caddy proxying') || line.includes('serving initial'))
+                  void resolveWhenReady()
+              }
+            })
+
+            child.stdout.on('data', (data: Buffer) => {
+              consola.info(data.toString())
               void resolveWhenReady()
+            })
           }
-        })
-
-        this._caddyChild!.stdout?.on('data', (_data) => {
-          consola.info(_data.toString())
-          void resolveWhenReady()
-        })
-
-        setupCleanup()
+          catch (error) {
+            // The hosts entry was written before Caddy started; a failed start
+            // must not leave it behind while the dev server keeps running.
+            if (!this.locked)
+              await this.baseCleanup(restore)
+            reject(error)
+          }
+        })()
       }
       else {
         consola.info('Caddy is running in another process.')
@@ -453,26 +517,36 @@ export class CaddyInstant {
 
   async baseCleanup(restore: boolean = true): Promise<void> {
     this._stopEffects.forEach(fn => fn())
+    this._stopEffects.length = 0
 
     try {
-      if (restore && this._source && this._target) {
-        if (await removeHost(splitHostPort(this._source).host, splitHostPort(this._target).host))
-          consola.success('Restore host success.\n')
-
-        else
-          consola.fail('Restore host failed.\n')
+      if (restore && this._source && this._target && this._session) {
+        const sourceHost = splitHostPort(this._source).host
+        const targetHost = splitHostPort(this._target).host
+        await this._session.client.call('hosts.remove', { ip: sourceHost, host: targetHost })
+        if (sourceHost === 'localhost')
+          await this._session.client.call('hosts.remove', { ip: '127.0.0.1', host: targetHost })
+        consola.success('Restore host success.\n')
       }
     }
     catch (e) {
-      consola.error(e)
-      consola.fail('Restore host failed.\n')
+      // The helper restores its own entries when the connection drops, so a
+      // closed session here is not a failed cleanup.
+      if (this._session?.client.connected === false) {
+        consola.debug('hosts entries are restored by the privileged helper on disconnect')
+      }
+      else {
+        consola.error(e)
+        consola.fail('Restore host failed.\n')
+      }
     }
+
     if (!this.locked && !this.stoped) {
       await this.stopCaddy()
       try {
-        await lockfile.unlock(caddyLockFilePath).catch(() => { })
-        await unlink(caddyFilePath).catch(() => { })
-        await unlink(caddyLockFilePath).catch(() => { })
+        await lockfile.unlock(caddyLockFilePath).catch(() => {})
+        await unlink(caddyFilePath).catch(() => {})
+        await unlink(caddyLockFilePath).catch(() => {})
         if (caddyConfig) {
           await caddyConfig.cleanUp()
         }

package/src/caddy/privileged.ts

@@ -0,0 +1,121 @@
+import type { PrivilegedClient } from '../privileged/client'
+import type { HelperEvent } from '../privileged/protocol'
+import { Buffer } from 'node:buffer'
+import { EventEmitter } from 'node:events'
+import { dirname, join } from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+import { resolveHelperEntry } from '../privileged/entry'
+import { openHelperSession } from '../privileged/session'
+
+export interface PrivilegedEnv {
+  /** Executable started as root, resolved from the running bundle. */
+  helperEntry: string
+  helperArgs: string[]
+}
+
+/**
+ * Resolves what the helper needs to be started from the current bundle.
+ * `__dirname` exists in both the CJS and ESM outputs (tsup injects a shim).
+ */
+export function resolvePrivilegedEnv(): PrivilegedEnv {
+  const moduleDir = typeof __dirname === 'string'
+    ? __dirname
+    : dirname(fileURLToPath(import.meta.url))
+  const resolved = resolveHelperEntry({ moduleDir })
+  return { helperEntry: resolved.entry, helperArgs: resolved.args }
+}
+
+/** Re-emits helper events as the `stdout`/`stderr` events the log parsing expects. */
+export class HelperCaddyProcess extends EventEmitter {
+  readonly stdout = new EventEmitter()
+  readonly stderr = new EventEmitter()
+  private finished = false
+  private readonly unsubscribe: () => void
+
+  constructor(private readonly client: PrivilegedClient) {
+    super()
+    this.unsubscribe = client.onEvent(event => this.handleEvent(event))
+  }
+
+  private handleEvent(event: HelperEvent): void {
+    if (event.type !== 'event')
+      return
+
+    if (event.kind === 'caddy.stdout') {
+      this.stdout.emit('data', Buffer.from(event.data))
+      return
+    }
+
+    if (event.kind === 'caddy.stderr') {
+      this.stderr.emit('data', Buffer.from(event.data))
+      return
+    }
+
+    if (event.kind === 'caddy.exit') {
+      this.finished = true
+      this.emit('exit', event.code, event.signal)
+    }
+  }
+
+  /** Asks the helper to stop Caddy; the helper also stops it on disconnect. */
+  kill(): void {
+    this.unsubscribe()
+    if (this.finished)
+      return
+    this.finished = true
+    void this.client.call('caddy.stop').catch(() => {})
+  }
+}
+
+export interface OpenedPrivilegedSession {
+  client: PrivilegedClient
+  reused: boolean
+  close: () => Promise<void>
+}
+
+export interface PrivilegedSessionOptions {
+  log?: (message: string) => void
+  /** Runs the helper as the current user; tests use this to avoid sudo. */
+  direct?: boolean
+  /** Caddy binary the helper may run; fixed before the session opens. */
+  caddyBin: string
+  /** Caddyfile the helper may load. */
+  caddyConfigPath: string
+  /** Shown before the password prompt so the request is not a surprise. */
+  reason?: { target: string, https: boolean }
+}
+
+/** Where Caddy keeps its PKI, per platform. */
+export function caddyStoragePath(): string {
+  return process.platform === 'win32'
+    ? join(process.env.AppData ?? '', 'Caddy')
+    : join(process.env.HOME ?? '', 'Library/Application Support/Caddy')
+}
+
+/**
+ * Opens (or reuses) the privileged helper for this runtime directory.
+ * Only the helper runs as root: the plugin process, its caches and its
+ * `node_modules` keep the developer's identity.
+ */
+export function openPrivilegedSession(
+  runtimeDir: string,
+  options: PrivilegedSessionOptions,
+): Promise<OpenedPrivilegedSession> {
+  const env = resolvePrivilegedEnv()
+  return openHelperSession({
+    runtimeDir,
+    helperEntry: env.helperEntry,
+    helperArgs: env.helperArgs,
+    direct: options.direct,
+    // Caddy keeps its PKI under the user's home; the helper runs it as root, so
+    // it must know which tree to hand back afterwards.
+    caddyStoragePath: caddyStoragePath(),
+    // The binary and Caddyfile are fixed here: the privileged helper must never
+    // execute a path supplied over the socket.
+    caddyBin: options.caddyBin,
+    caddyConfigPath: options.caddyConfigPath,
+    reason: options.reason,
+    log: options.log,
+  })
+}

package/src/caddy/utils.ts

@@ -1,51 +1,8 @@
-import { exec } from 'node:child_process'
-import { createServer } from 'node:net'
 import ora from 'ora'
 import { consola } from '../utils'
 
 let spinner: ora.Ora
 
-/**
- * @returns whether the port is in use
- */
-export function tryPort(port: number): Promise<boolean> {
-  return new Promise<boolean>((resolve, _reject) => {
-    try {
-      const server = createServer().listen(port)
-      server.on('listening', () => {
-        server.close()
-        resolve(false)
-      })
-      server.on('error', (err) => {
-        // @ts-expect-error err.code
-        if (err.code === 'EADDRINUSE')
-          resolve(true)
-        server.close()
-      })
-    }
-    catch {
-      resolve(true)
-    }
-  })
-}
-
-/**
- * npx free-port :port
- */
-export async function kill(port: number): Promise<void> {
-  return new Promise<void>((resolve, reject) => {
-    exec(`npx @maxbo/free-port ${port} -s`, (err, stdout, _stderr) => {
-      if (err) {
-        reject(err)
-      }
-      else {
-        consola.log(stdout)
-        resolve()
-      }
-    })
-  })
-}
-
 function getNumber(number: number): string {
   if (number <= 0)
     return '0%'