unplugin-https-reverse-proxy 4.1.0-beta.2 → 4.1.0-beta.3

package/dist/{chunk-7CA3EIIX.js → chunk-HBXMM25C.js}

@@ -8,6 +8,10 @@ import {
   hmrSseBridgeClientScript,
   setupHmrSseBridge
 } from "./chunk-C5A7XLKL.js";
+import {
+  isPrivilegeDenied,
+  markPrivilegeDenied
+} from "./chunk-WOMR3ZLM.js";
 import {
   decodeMessage,
   serializeMessage,
@@ -13615,27 +13619,39 @@ function isCaddyReloadCancellation(line) {
 // src/caddy/privileged.ts
 import { Buffer as Buffer2 } from "node:buffer";
 import { EventEmitter } from "node:events";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { dirname as dirname3, join as join5 } from "node:path";
 import process6 from "node:process";
 import { fileURLToPath } from "node:url";
 
 // src/privileged/entry.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { join as join3 } from "node:path";
+import { dirname as dirname2, join as join3 } from "node:path";
 import process3 from "node:process";
 function resolveHelperEntry(options) {
   const { moduleDir, nodeBin = process3.execPath, exists: exists2 = existsSync3 } = options;
   for (const name of ["privileged-helper.js", "privileged-helper.cjs", "privileged-helper.mjs"]) {
-    const candidate = join3(moduleDir, name);
-    if (exists2(candidate))
+    const candidate = findUp(moduleDir, name, exists2);
+    if (candidate)
       return { entry: nodeBin, args: [candidate] };
   }
-  const source = join3(moduleDir, "privileged-helper.ts");
-  const tsxCli = join3(moduleDir, "../node_modules/tsx/dist/cli.mjs");
-  if (exists2(source) && exists2(tsxCli))
+  const source = findUp(moduleDir, "privileged-helper.ts", exists2);
+  const tsxCli = findUp(moduleDir, "node_modules/tsx/dist/cli.mjs", exists2);
+  if (source && tsxCli)
     return { entry: nodeBin, args: [tsxCli, source] };
   throw new Error(`privileged helper entry not found in ${moduleDir}. Build the package first.`);
 }
+function findUp(from, relative, exists2) {
+  let current = from;
+  while (true) {
+    const candidate = join3(current, relative);
+    if (exists2(candidate))
+      return candidate;
+    const parent = dirname2(current);
+    if (parent === current)
+      return void 0;
+    current = parent;
+  }
+}
 
 // src/privileged/session.ts
 import { Buffer } from "node:buffer";
@@ -13883,18 +13899,42 @@ function spawnElevatedOnWindows(options) {
 function createHelperToken() {
   return randomBytes(24).toString("hex");
 }
-function authenticateSudo(sudoCommand = "sudo") {
+function describePasswordReason(target, https) {
+  const port = https ? "443" : "80";
+  return [
+    `reverse proxy needs administrator permission for ${target}`,
+    `  \xB7 bind port ${port}${https ? ` for https://${target}` : ""}`,
+    `  \xB7 add ${target} to the hosts file`,
+    "",
+    "This is the only prompt; the rest of the dev server keeps running as you.",
+    "Press Ctrl+C at the prompt to skip the proxy and keep the dev server."
+  ];
+}
+function authenticateSudo(sudoCommand = "sudo", options = {}) {
   if (platform() === "win32")
     return { ok: true };
   if (spawnSync(sudoCommand, ["-n", "true"], { stdio: "ignore" }).status === 0)
     return { ok: true };
+  if (options.target) {
+    for (const line of describePasswordReason(options.target, options.https ?? false))
+      process5.stderr.write(`${line}
+`);
+    process5.stderr.write("\n");
+  }
   if (spawnSync(sudoCommand, ["-v"], { stdio: "inherit" }).status === 0)
     return { ok: true };
   return {
     ok: false,
+    denied: true,
     message: "administrator permission is required to edit the hosts file and bind ports 80/443"
   };
 }
+var PrivilegeDeniedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PrivilegeDeniedError";
+  }
+};
 async function startPrivilegedHelper(options) {
   var _a4, _b3;
   const {
@@ -13910,9 +13950,11 @@ async function startPrivilegedHelper(options) {
     connectTimeoutMs = 12e4
   } = options;
   if (!skipAuth && !direct) {
-    const auth = authenticateSudo(sudoCommand);
-    if (!auth.ok)
-      throw new Error(auth.message);
+    const auth = authenticateSudo(sudoCommand, options.reason);
+    if (!auth.ok) {
+      const message = auth.message ?? "administrator permission is required";
+      throw auth.denied ? new PrivilegeDeniedError(message) : new Error(message);
+    }
   }
   const forwarded = collectForwardedEnv(env2);
   const forwardedArgs = Object.entries(forwarded).map(([key, value2]) => `${key}=${value2}`);
@@ -14017,6 +14059,7 @@ async function openHelperSession(scope2) {
     caddyStoragePath: scope2.caddyStoragePath,
     caddyBin: scope2.caddyBin,
     caddyConfigPath: scope2.caddyConfigPath,
+    reason: scope2.reason,
     log: scope2.log
   });
   await writeToken(scope2.runtimeDir, token);
@@ -14046,7 +14089,7 @@ async function writeToken(runtimeDir, token) {
 
 // src/caddy/privileged.ts
 function resolvePrivilegedEnv() {
-  const moduleDir = typeof __dirname === "string" ? __dirname : dirname2(fileURLToPath(import.meta.url));
+  const moduleDir = typeof __dirname === "string" ? __dirname : dirname3(fileURLToPath(import.meta.url));
   const resolved = resolveHelperEntry({ moduleDir });
   return { helperEntry: resolved.entry, helperArgs: resolved.args };
 }
@@ -14102,6 +14145,7 @@ function openPrivilegedSession(runtimeDir, options) {
     // execute a path supplied over the socket.
     caddyBin: options.caddyBin,
     caddyConfigPath: options.caddyConfigPath,
+    reason: options.reason,
     log: options.log
   });
 }
@@ -14302,12 +14346,13 @@ function splitHostPort(addr) {
   return { host: addr.slice(0, lastColon), port: addr.slice(lastColon + 1) };
 }
 var defaultDependencies = {
-  openSession: (runtimeDir) => openPrivilegedSession(runtimeDir, {
+  openSession: (runtimeDir, reason) => openPrivilegedSession(runtimeDir, {
     log: (message) => consola.debug(message),
     // Both paths are fixed here, before any socket traffic: the privileged
     // helper must never execute something named in a request.
     caddyBin: caddyPath,
-    caddyConfigPath: caddyFilePath
+    caddyConfigPath: caddyFilePath,
+    reason
   })
 };
 var CaddyInstant = class {
@@ -14334,11 +14379,11 @@ var CaddyInstant = class {
    * reused across instances so a second dev server does not ask for a
    * password again.
    */
-  async session() {
+  async session(reason) {
     if (this._session && !this._session.client.connected)
       this._session = void 0;
     if (!this._session)
-      this._session = await this.deps.openSession(TEMP_DIR);
+      this._session = await this.deps.openSession(TEMP_DIR, reason);
     return this._session;
   }
   async getCaddyfile() {
@@ -14443,9 +14488,9 @@ Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`
     this._target = target;
     if (!this.inited)
       await this.init();
-    const session = await this.session();
     const sourceHost = splitHostPort(source).host;
     const targetHost = splitHostPort(target).host;
+    const session = await this.session({ target: targetHost, https });
     await session.client.call("hosts.add", { ip: sourceHost, host: targetHost });
     consola.success("update host success\n");
     const normalizeBase = (b) => {
@@ -14682,16 +14727,27 @@ async function printForwardProxy() {
 }
 var vitePrintUrls = once((options, source, target, base = "/", _printUrls) => {
   _printUrls == null ? void 0 : _printUrls();
+  if (isPrivilegeDenied())
+    return;
   if (caddy)
     return;
-  caddy = new CaddyInstant();
-  caddy.run(source, target, {
+  const instance = new CaddyInstant();
+  caddy = instance;
+  instance.run(source, target, {
     base,
     ...options
   }).then(async () => {
     await printForwardProxy();
     consola.success(`  ${c.green("\u279C")}  ${c.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
   }).catch((e) => {
+    if (caddy === instance)
+      caddy = void 0;
+    if (e instanceof PrivilegeDeniedError) {
+      markPrivilegeDenied();
+      consola.warn("reverse proxy skipped: administrator permission was not granted.");
+      consola.info("Restart the dev server to enable it again.");
+      return;
+    }
     throw e;
   });
 });
@@ -14771,6 +14827,8 @@ var unpluginFactory = (options) => ({
       ...(_a4 = process8.VUE_CLI_SERVICE) == null ? void 0 : _a4.projectOptions.devServer
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
     let base = "/";
@@ -14792,8 +14850,9 @@ var unpluginFactory = (options) => ({
     } else {
       options.https = false;
     }
-    caddy = new CaddyInstant();
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(() => {
@@ -14802,6 +14861,14 @@ var unpluginFactory = (options) => ({
         consola.success(`  ${c.green("\u279C")}  ${c.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
       });
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   },
@@ -14832,9 +14899,10 @@ var unpluginFactory = (options) => ({
       }))) == null ? void 0 : _b3.content) == null ? void 0 : _c2.server
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
-    caddy = new CaddyInstant();
     let base = "/";
     const publicPath = (_d2 = compiler.options.output) == null ? void 0 : _d2.publicPath;
     if (typeof publicPath === "string" && publicPath) {
@@ -14844,13 +14912,23 @@ var unpluginFactory = (options) => ({
       base = `/${base}`;
     if (base !== "/" && !base.endsWith("/"))
       base = `${base}/`;
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(async () => {
       await printForwardProxy();
       consola.success(`  ${c.green("\u279C")}  ${c.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   }

package/dist/chunk-WOMR3ZLM.js

@@ -0,0 +1,17 @@
+// src/privilege-state.ts
+var denied = false;
+function markPrivilegeDenied() {
+  denied = true;
+}
+function isPrivilegeDenied() {
+  return denied;
+}
+function resetPrivilegeDenied() {
+  denied = false;
+}
+
+export {
+  markPrivilegeDenied,
+  isPrivilegeDenied,
+  resetPrivilegeDenied
+};

package/dist/esbuild.cjs

@@ -13678,16 +13678,28 @@ var import_node_process2 = __toESM(require("process"), 1);
 function resolveHelperEntry(options) {
   const { moduleDir, nodeBin = import_node_process2.default.execPath, exists: exists2 = import_node_fs2.existsSync } = options;
   for (const name of ["privileged-helper.js", "privileged-helper.cjs", "privileged-helper.mjs"]) {
-    const candidate = (0, import_node_path2.join)(moduleDir, name);
-    if (exists2(candidate))
+    const candidate = findUp(moduleDir, name, exists2);
+    if (candidate)
       return { entry: nodeBin, args: [candidate] };
   }
-  const source = (0, import_node_path2.join)(moduleDir, "privileged-helper.ts");
-  const tsxCli = (0, import_node_path2.join)(moduleDir, "../node_modules/tsx/dist/cli.mjs");
-  if (exists2(source) && exists2(tsxCli))
+  const source = findUp(moduleDir, "privileged-helper.ts", exists2);
+  const tsxCli = findUp(moduleDir, "node_modules/tsx/dist/cli.mjs", exists2);
+  if (source && tsxCli)
     return { entry: nodeBin, args: [tsxCli, source] };
   throw new Error(`privileged helper entry not found in ${moduleDir}. Build the package first.`);
 }
+function findUp(from, relative, exists2) {
+  let current = from;
+  while (true) {
+    const candidate = (0, import_node_path2.join)(current, relative);
+    if (exists2(candidate))
+      return candidate;
+    const parent = (0, import_node_path2.dirname)(current);
+    if (parent === current)
+      return void 0;
+    current = parent;
+  }
+}
 
 // src/privileged/session.ts
 var import_node_buffer = require("buffer");
@@ -13986,18 +13998,42 @@ function spawnElevatedOnWindows(options) {
 function createHelperToken() {
   return (0, import_node_crypto.randomBytes)(24).toString("hex");
 }
-function authenticateSudo(sudoCommand = "sudo") {
+function describePasswordReason(target, https) {
+  const port = https ? "443" : "80";
+  return [
+    `reverse proxy needs administrator permission for ${target}`,
+    `  \xB7 bind port ${port}${https ? ` for https://${target}` : ""}`,
+    `  \xB7 add ${target} to the hosts file`,
+    "",
+    "This is the only prompt; the rest of the dev server keeps running as you.",
+    "Press Ctrl+C at the prompt to skip the proxy and keep the dev server."
+  ];
+}
+function authenticateSudo(sudoCommand = "sudo", options = {}) {
   if ((0, import_node_os3.platform)() === "win32")
     return { ok: true };
   if ((0, import_node_child_process2.spawnSync)(sudoCommand, ["-n", "true"], { stdio: "ignore" }).status === 0)
     return { ok: true };
+  if (options.target) {
+    for (const line of describePasswordReason(options.target, options.https ?? false))
+      import_node_process5.default.stderr.write(`${line}
+`);
+    import_node_process5.default.stderr.write("\n");
+  }
   if ((0, import_node_child_process2.spawnSync)(sudoCommand, ["-v"], { stdio: "inherit" }).status === 0)
     return { ok: true };
   return {
     ok: false,
+    denied: true,
     message: "administrator permission is required to edit the hosts file and bind ports 80/443"
   };
 }
+var PrivilegeDeniedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PrivilegeDeniedError";
+  }
+};
 async function startPrivilegedHelper(options) {
   var _a4, _b3;
   const {
@@ -14013,9 +14049,11 @@ async function startPrivilegedHelper(options) {
     connectTimeoutMs = 12e4
   } = options;
   if (!skipAuth && !direct) {
-    const auth = authenticateSudo(sudoCommand);
-    if (!auth.ok)
-      throw new Error(auth.message);
+    const auth = authenticateSudo(sudoCommand, options.reason);
+    if (!auth.ok) {
+      const message = auth.message ?? "administrator permission is required";
+      throw auth.denied ? new PrivilegeDeniedError(message) : new Error(message);
+    }
   }
   const forwarded = collectForwardedEnv(env2);
   const forwardedArgs = Object.entries(forwarded).map(([key, value2]) => `${key}=${value2}`);
@@ -14120,6 +14158,7 @@ async function openHelperSession(scope2) {
     caddyStoragePath: scope2.caddyStoragePath,
     caddyBin: scope2.caddyBin,
     caddyConfigPath: scope2.caddyConfigPath,
+    reason: scope2.reason,
     log: scope2.log
   });
   await writeToken(scope2.runtimeDir, token);
@@ -14206,6 +14245,7 @@ function openPrivilegedSession(runtimeDir, options) {
     // execute a path supplied over the socket.
     caddyBin: options.caddyBin,
     caddyConfigPath: options.caddyConfigPath,
+    reason: options.reason,
     log: options.log
   });
 }
@@ -14406,12 +14446,13 @@ function splitHostPort(addr) {
   return { host: addr.slice(0, lastColon), port: addr.slice(lastColon + 1) };
 }
 var defaultDependencies = {
-  openSession: (runtimeDir) => openPrivilegedSession(runtimeDir, {
+  openSession: (runtimeDir, reason) => openPrivilegedSession(runtimeDir, {
     log: (message) => consola.debug(message),
     // Both paths are fixed here, before any socket traffic: the privileged
     // helper must never execute something named in a request.
     caddyBin: caddyPath,
-    caddyConfigPath: caddyFilePath
+    caddyConfigPath: caddyFilePath,
+    reason
   })
 };
 var CaddyInstant = class {
@@ -14438,11 +14479,11 @@ var CaddyInstant = class {
    * reused across instances so a second dev server does not ask for a
    * password again.
    */
-  async session() {
+  async session(reason) {
     if (this._session && !this._session.client.connected)
       this._session = void 0;
     if (!this._session)
-      this._session = await this.deps.openSession(TEMP_DIR);
+      this._session = await this.deps.openSession(TEMP_DIR, reason);
     return this._session;
   }
   async getCaddyfile() {
@@ -14547,9 +14588,9 @@ Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`
     this._target = target;
     if (!this.inited)
       await this.init();
-    const session = await this.session();
     const sourceHost = splitHostPort(source).host;
     const targetHost = splitHostPort(target).host;
+    const session = await this.session({ target: targetHost, https });
     await session.client.call("hosts.add", { ip: sourceHost, host: targetHost });
     consola.success("update host success\n");
     const normalizeBase = (b) => {
@@ -14981,6 +15022,15 @@ var hmrSseBridgeClientScript = `
 })();
 `;
 
+// src/privilege-state.ts
+var denied = false;
+function markPrivilegeDenied() {
+  denied = true;
+}
+function isPrivilegeDenied() {
+  return denied;
+}
+
 // src/index.ts
 var config;
 var caddy;
@@ -15020,16 +15070,27 @@ async function printForwardProxy() {
 }
 var vitePrintUrls = once((options, source, target, base = "/", _printUrls) => {
   _printUrls == null ? void 0 : _printUrls();
+  if (isPrivilegeDenied())
+    return;
   if (caddy)
     return;
-  caddy = new CaddyInstant();
-  caddy.run(source, target, {
+  const instance = new CaddyInstant();
+  caddy = instance;
+  instance.run(source, target, {
     base,
     ...options
   }).then(async () => {
     await printForwardProxy();
     consola.success(`  ${import_picocolors2.default.green("\u279C")}  ${import_picocolors2.default.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
   }).catch((e) => {
+    if (caddy === instance)
+      caddy = void 0;
+    if (e instanceof PrivilegeDeniedError) {
+      markPrivilegeDenied();
+      consola.warn("reverse proxy skipped: administrator permission was not granted.");
+      consola.info("Restart the dev server to enable it again.");
+      return;
+    }
     throw e;
   });
 });
@@ -15109,6 +15170,8 @@ var unpluginFactory = (options) => ({
       ...(_a4 = import_node_process8.default.VUE_CLI_SERVICE) == null ? void 0 : _a4.projectOptions.devServer
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
     let base = "/";
@@ -15130,8 +15193,9 @@ var unpluginFactory = (options) => ({
     } else {
       options.https = false;
     }
-    caddy = new CaddyInstant();
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(() => {
@@ -15140,6 +15204,14 @@ var unpluginFactory = (options) => ({
         consola.success(`  ${import_picocolors2.default.green("\u279C")}  ${import_picocolors2.default.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
       });
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   },
@@ -15170,9 +15242,10 @@ var unpluginFactory = (options) => ({
       }))) == null ? void 0 : _b3.content) == null ? void 0 : _c2.server
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
-    caddy = new CaddyInstant();
     let base = "/";
     const publicPath = (_d2 = compiler.options.output) == null ? void 0 : _d2.publicPath;
     if (typeof publicPath === "string" && publicPath) {
@@ -15182,13 +15255,23 @@ var unpluginFactory = (options) => ({
       base = `/${base}`;
     if (base !== "/" && !base.endsWith("/"))
       base = `${base}/`;
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(async () => {
       await printForwardProxy();
       consola.success(`  ${import_picocolors2.default.green("\u279C")}  ${import_picocolors2.default.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   }

package/dist/esbuild.js

@@ -1,8 +1,9 @@
 import {
   unpluginFactory
-} from "./chunk-7CA3EIIX.js";
+} from "./chunk-HBXMM25C.js";
 import "./chunk-EY3HXBJ4.js";
 import "./chunk-C5A7XLKL.js";
+import "./chunk-WOMR3ZLM.js";
 import "./chunk-RKHJN6KY.js";
 
 // src/esbuild.ts