wyxrouter 0.4.71

package/src/lib/appUpdater.js

@@ -0,0 +1,200 @@
+import { spawn, execSync } from "child_process";
+import path from "path";
+import fs from "fs";
+import os from "os";
+import { UPDATER_CONFIG } from "@/shared/constants/config";
+
+const KILL_TIMEOUT_MS = 5000;
+const PROCESS_WAIT_MS = 1500;
+
+// Kill MITM server by PID file (MITM may run as admin/sudo)
+function killMitmByPidFile() {
+  try {
+    const mitmPidFile = path.join(
+      process.platform === "win32"
+        ? path.join(process.env.APPDATA || "", "9router")
+        : path.join(os.homedir(), ".9router"),
+      "mitm",
+      ".mitm.pid"
+    );
+    if (!fs.existsSync(mitmPidFile)) return;
+    const pid = parseInt(fs.readFileSync(mitmPidFile, "utf8").trim(), 10);
+    if (!pid) return;
+
+    if (process.platform === "win32") {
+      // taskkill first (works if same user); fallback to PowerShell Stop-Process which can kill admin process if our token allows
+      try { execSync(`taskkill /F /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch {
+        try { execSync(`powershell -NonInteractive -WindowStyle Hidden -Command "Stop-Process -Id ${pid} -Force"`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch { /* best effort */ }
+      }
+    } else {
+      try {
+        execSync(`sudo -n kill -9 ${pid} 2>/dev/null`, { stdio: "ignore", timeout: 3000 });
+      } catch {
+        try { process.kill(pid, "SIGKILL"); } catch { /* best effort */ }
+      }
+    }
+    try { fs.unlinkSync(mitmPidFile); } catch { /* best effort */ }
+  } catch { /* best effort */ }
+}
+
+// Collect PIDs of all 9router-related processes (excluding current)
+function collectAppPids() {
+  const pids = [];
+  const platform = process.platform;
+
+  if (platform === "win32") {
+    try {
+      const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"node.exe\\"' | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"`;
+      const output = execSync(psCmd, { encoding: "utf8", windowsHide: true, timeout: KILL_TIMEOUT_MS });
+      const lines = output.split("\n").slice(1).filter(l => l.trim());
+      lines.forEach(line => {
+        const lower = line.toLowerCase();
+        // Match anything running from 9router install dir or wrapper cli.js
+        const isAppProcess = lower.includes("9router") ||
+          lower.includes("next-server") ||
+          lower.includes("\\bin\\app\\") ||
+          lower.includes("/bin/app/") ||
+          lower.includes("cli.js");
+        if (isAppProcess) {
+          const match = line.match(/^"(\d+)"/);
+          if (match && match[1] && match[1] !== process.pid.toString()) pids.push(match[1]);
+        }
+      });
+    } catch { /* no processes */ }
+
+    // Kill cloudflared + tray binaries (hold app dir lock)
+    for (const procName of ["cloudflared", "tray_windows_release"]) {
+      try {
+        const cmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-Process ${procName} -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"`;
+        const out = execSync(cmd, { encoding: "utf8", windowsHide: true, timeout: KILL_TIMEOUT_MS });
+        out.split("\n").forEach(l => {
+          const pid = l.trim();
+          if (pid && !isNaN(pid)) pids.push(pid);
+        });
+      } catch { /* not running */ }
+    }
+  } else {
+    try {
+      const output = execSync("ps aux 2>/dev/null", { encoding: "utf8", timeout: KILL_TIMEOUT_MS });
+      output.split("\n").forEach(line => {
+        const isAppProcess = line.includes("9router") ||
+          line.includes("next-server") ||
+          line.includes("cloudflared") ||
+          line.includes("/bin/app/") ||
+          line.includes("tray_darwin") ||
+          line.includes("tray_linux");
+        if (isAppProcess) {
+          const parts = line.trim().split(/\s+/);
+          const pid = parts[1];
+          if (pid && !isNaN(pid) && pid !== process.pid.toString()) pids.push(pid);
+        }
+      });
+    } catch { /* no processes */ }
+  }
+
+  return pids;
+}
+
+// Copy updater.js into DATA_DIR so npm -g can overwrite node_modules safely
+function getDataDir() {
+  if (process.env.DATA_DIR) return process.env.DATA_DIR;
+  if (process.platform === "win32") {
+    return path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "9router");
+  }
+  return path.join(os.homedir(), ".9router");
+}
+
+function resolveBundledUpdaterPath() {
+  if (process.env.UPDATER_SCRIPT_PATH && fs.existsSync(process.env.UPDATER_SCRIPT_PATH)) {
+    return process.env.UPDATER_SCRIPT_PATH;
+  }
+  // Production standalone: cwd is binAppDir (see bin/cli.js)
+  // Dev: cwd is app/
+  const fromCwd = path.join(process.cwd(), "src", "lib", "updater", "updater.js");
+  if (fs.existsSync(fromCwd)) return fromCwd;
+  const fromParent = path.join(process.cwd(), "..", "src", "lib", "updater", "updater.js");
+  if (fs.existsSync(fromParent)) return fromParent;
+  return fromCwd;
+}
+
+function ensureRuntimeUpdater(bundledPath) {
+  try {
+    if (!bundledPath || !fs.existsSync(bundledPath)) return bundledPath;
+    const runtimeDir = path.join(getDataDir(), "runtime", "updater");
+    const runtimePath = path.join(runtimeDir, "updater.js");
+    if (fs.existsSync(runtimePath)) {
+      try {
+        if (fs.statSync(bundledPath).size === fs.statSync(runtimePath).size) return runtimePath;
+      } catch { /* recopy */ }
+    }
+    fs.mkdirSync(runtimeDir, { recursive: true });
+    fs.copyFileSync(bundledPath, runtimePath);
+    return runtimePath;
+  } catch {
+    return bundledPath;
+  }
+}
+
+// Kill all app-related processes to release file locks (esp. on Windows)
+export async function killAppProcesses() {
+  killMitmByPidFile();
+  const pids = collectAppPids();
+  const platform = process.platform;
+
+  pids.forEach(pid => {
+    try {
+      if (platform === "win32") {
+        execSync(`taskkill /F /PID ${pid} 2>nul`, { stdio: "ignore", shell: true, windowsHide: true, timeout: 3000 });
+      } else {
+        execSync(`kill -9 ${pid} 2>/dev/null`, { stdio: "ignore", timeout: 3000 });
+      }
+    } catch { /* already dead */ }
+  });
+
+  if (pids.length > 0) {
+    await new Promise(r => setTimeout(r, PROCESS_WAIT_MS));
+  }
+}
+
+// Resolve npx/9router binary to relaunch after update (cross-platform)
+function resolveRelaunchCommand() {
+  const isWin = process.platform === "win32";
+  // Prefer `npx 9router` — works regardless of global bin path changes after npm i -g
+  const npx = isWin ? "npx.cmd" : "npx";
+  return { cmd: npx, args: [UPDATER_CONFIG.npmPackageName] };
+}
+
+// Spawn detached headless updater (Node process) then exit current server
+export function spawnUpdaterAndExit(packageName = UPDATER_CONFIG.npmPackageName) {
+  const updaterPath = ensureRuntimeUpdater(resolveBundledUpdaterPath());
+  const isTray = process.env.TRAY_MODE === "1";
+  const relaunch = resolveRelaunchCommand();
+  // Relaunch matching original env: tray stays tray, foreground stays foreground
+  const relaunchArgs = isTray
+    ? [...relaunch.args, "--tray", "--skip-update"]
+    : [...relaunch.args, "--skip-update"];
+
+  spawn(process.execPath, [updaterPath], {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true,
+    env: {
+      ...process.env,
+      UPDATER_PKG_NAME: packageName,
+      UPDATER_PORT: String(UPDATER_CONFIG.statusPort),
+      UPDATER_TAIL_LINES: String(UPDATER_CONFIG.statusLogTailLines),
+      UPDATER_RETRIES: String(UPDATER_CONFIG.installRetries),
+      UPDATER_RETRY_DELAY_MS: String(UPDATER_CONFIG.installRetryDelayMs),
+      UPDATER_LINGER_MS: String(UPDATER_CONFIG.lingerAfterDoneMs),
+      UPDATER_WAIT_MIN_MS: String(UPDATER_CONFIG.waitForExitMinMs),
+      UPDATER_WAIT_MAX_MS: String(UPDATER_CONFIG.waitForExitMaxMs),
+      UPDATER_WAIT_CHECK_MS: String(UPDATER_CONFIG.waitForExitCheckMs),
+      UPDATER_APP_PORT: String(UPDATER_CONFIG.appPort),
+      UPDATER_RELAUNCH: "1",
+      UPDATER_RELAUNCH_CMD: relaunch.cmd,
+      UPDATER_RELAUNCH_ARGS: JSON.stringify(relaunchArgs),
+    },
+  }).unref();
+
+  setTimeout(() => process.exit(0), UPDATER_CONFIG.exitDelayMs);
+}

package/src/lib/auth/dashboardSession.js

@@ -0,0 +1,68 @@
+import { SignJWT, jwtVerify } from "jose";
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { DATA_DIR } from "@/lib/dataDir";
+
+function loadJwtSecret() {
+  if (process.env.JWT_SECRET) return process.env.JWT_SECRET;
+  const file = path.join(DATA_DIR, "jwt-secret");
+  try {
+    return fs.readFileSync(file, "utf8").trim();
+  } catch {}
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  const generated = crypto.randomBytes(32).toString("hex");
+  fs.writeFileSync(file, generated, { mode: 0o600 });
+  return generated;
+}
+
+const SECRET = new TextEncoder().encode(loadJwtSecret());
+
+export function shouldUseSecureCookie(request) {
+  const forceSecureCookie = process.env.AUTH_COOKIE_SECURE === "true";
+  const forwardedProto = request?.headers?.get?.("x-forwarded-proto");
+  const isHttpsRequest = forwardedProto === "https";
+  return forceSecureCookie || isHttpsRequest;
+}
+
+export async function createDashboardAuthToken(claims = {}) {
+  return new SignJWT({ authenticated: true, ...claims })
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime("24h")
+    .sign(SECRET);
+}
+
+export async function verifyDashboardAuthToken(token) {
+  if (!token) return false;
+  try {
+    await jwtVerify(token, SECRET);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function getDashboardAuthSession(token) {
+  if (!token) return null;
+  try {
+    const { payload } = await jwtVerify(token, SECRET);
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+export async function setDashboardAuthCookie(cookieStore, request, claims = {}) {
+  const token = await createDashboardAuthToken(claims);
+  cookieStore.set("auth_token", token, {
+    httpOnly: true,
+    secure: shouldUseSecureCookie(request),
+    sameSite: "lax",
+    path: "/",
+  });
+}
+
+export function clearDashboardAuthCookie(cookieStore) {
+  cookieStore.delete("auth_token");
+}

package/src/lib/auth/loginLimiter.js

@@ -0,0 +1,52 @@
+// In-memory progressive lockout for dashboard login. Resets on process restart.
+
+const MAX_FAILS_BEFORE_LOCK = 5;
+const LOCK_STEPS_MS = [30_000, 120_000, 600_000, 1_800_000]; // 30s, 2m, 10m, 30m
+const FAIL_WINDOW_MS = 60 * 60 * 1000; // 1h since last fail → auto reset
+
+const attempts = new Map(); // ip → { fails, lockUntil, lockLevel, lastFailAt }
+
+function now() { return Date.now(); }
+
+function getEntry(ip) {
+  const e = attempts.get(ip);
+  if (!e) return null;
+  // Auto reset if window expired and not currently locked
+  if (e.lastFailAt && now() - e.lastFailAt > FAIL_WINDOW_MS && (!e.lockUntil || now() >= e.lockUntil)) {
+    attempts.delete(ip);
+    return null;
+  }
+  return e;
+}
+
+export function checkLock(ip) {
+  const e = getEntry(ip);
+  if (!e || !e.lockUntil) return { locked: false };
+  const remaining = e.lockUntil - now();
+  if (remaining <= 0) return { locked: false };
+  return { locked: true, retryAfter: Math.ceil(remaining / 1000) };
+}
+
+export function recordFail(ip) {
+  const e = getEntry(ip) || { fails: 0, lockUntil: 0, lockLevel: 0, lastFailAt: 0 };
+  e.fails += 1;
+  e.lastFailAt = now();
+  if (e.fails >= MAX_FAILS_BEFORE_LOCK) {
+    const step = LOCK_STEPS_MS[Math.min(e.lockLevel, LOCK_STEPS_MS.length - 1)];
+    e.lockUntil = now() + step;
+    e.lockLevel += 1;
+    e.fails = 0;
+  }
+  attempts.set(ip, e);
+  return { remainingBeforeLock: Math.max(0, MAX_FAILS_BEFORE_LOCK - e.fails) };
+}
+
+export function recordSuccess(ip) {
+  attempts.delete(ip);
+}
+
+export function getClientIp(request) {
+  const xff = request.headers.get("x-forwarded-for");
+  if (xff) return xff.split(",")[0].trim();
+  return request.headers.get("x-real-ip") || "unknown";
+}

package/src/lib/auth/oidc.js

@@ -0,0 +1,234 @@
+import crypto from "node:crypto";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { getSettings } from "@/lib/localDb";
+
+export const OIDC_COOKIE_NAMES = {
+  state: "oidc_state",
+  nonce: "oidc_nonce",
+  verifier: "oidc_code_verifier",
+};
+
+const DEFAULT_SCOPES = "openid profile email";
+const DEFAULT_LOGIN_LABEL = "Sign in with OIDC";
+
+function trimTrailingSlashes(value) {
+  return (value || "").trim().replace(/\/+$/, "");
+}
+
+function normalizeScopes(value) {
+  return (value || DEFAULT_SCOPES).trim() || DEFAULT_SCOPES;
+}
+
+export function getPublicOrigin(request) {
+  const configuredBaseUrl =
+    process.env.BASE_URL ||
+    process.env.NEXT_PUBLIC_BASE_URL ||
+    "";
+
+  if (configuredBaseUrl) {
+    return trimTrailingSlashes(configuredBaseUrl);
+  }
+
+  const forwardedProto = request?.headers?.get?.("x-forwarded-proto") || "";
+  const forwardedHost = request?.headers?.get?.("x-forwarded-host") || "";
+  const host = forwardedHost || request?.headers?.get?.("host") || "";
+  if (host) {
+    const protocol = (forwardedProto || new URL(request.url).protocol || "http:").replace(/:$/, "");
+    return `${protocol}://${host}`.replace(/\/+$/, "");
+  }
+
+  return trimTrailingSlashes(new URL(request.url).origin);
+}
+
+export function isOidcConfigured(settings) {
+  return !!(
+    trimTrailingSlashes(settings?.oidcIssuerUrl) &&
+    (settings?.oidcClientId || "").trim() &&
+    (settings?.oidcClientSecret || "").trim()
+  );
+}
+
+export async function getOidcRuntimeConfig() {
+  const settings = await getSettings();
+  if (!["oidc", "both"].includes(settings.authMode) || !isOidcConfigured(settings)) return null;
+
+  const issuerUrl = trimTrailingSlashes(settings.oidcIssuerUrl);
+  return {
+    issuerUrl,
+    clientId: settings.oidcClientId.trim(),
+    clientSecret: settings.oidcClientSecret.trim(),
+    scopes: normalizeScopes(settings.oidcScopes),
+    loginLabel: (settings.oidcLoginLabel || DEFAULT_LOGIN_LABEL).trim() || DEFAULT_LOGIN_LABEL,
+  };
+}
+
+export async function fetchOidcDiscovery(issuerUrl) {
+  const discoveryUrl = `${trimTrailingSlashes(issuerUrl)}/.well-known/openid-configuration`;
+  const res = await fetch(discoveryUrl, { cache: "no-store" });
+  if (!res.ok) {
+    throw new Error(`Failed to load OIDC discovery document from ${discoveryUrl}`);
+  }
+  return await res.json();
+}
+
+export function createPkcePair() {
+  const verifier = crypto.randomBytes(32).toString("base64url");
+  const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+
+export function createOidcState() {
+  return crypto.randomBytes(16).toString("base64url");
+}
+
+export function createOidcNonce() {
+  return crypto.randomBytes(16).toString("base64url");
+}
+
+export function buildOidcAuthorizationUrl({
+  authorizationEndpoint,
+  clientId,
+  redirectUri,
+  scopes = DEFAULT_SCOPES,
+  state,
+  nonce,
+  codeChallenge,
+}) {
+  const url = new URL(authorizationEndpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("scope", normalizeScopes(scopes));
+  url.searchParams.set("state", state);
+  url.searchParams.set("nonce", nonce);
+  url.searchParams.set("code_challenge", codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+
+export async function exchangeOidcCode({
+  tokenEndpoint,
+  clientId,
+  clientSecret,
+  code,
+  redirectUri,
+  codeVerifier,
+}) {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: clientId,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: codeVerifier,
+  });
+
+  if (clientSecret) {
+    body.set("client_secret", clientSecret);
+  }
+
+  const res = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body,
+  });
+
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const message = data?.error_description || data?.error || `OIDC token exchange failed (${res.status})`;
+    throw new Error(message);
+  }
+
+  return data;
+}
+
+export async function probeOidcClientSecret({
+  tokenEndpoint,
+  clientId,
+  clientSecret,
+  redirectUri,
+}) {
+  if (!clientSecret) {
+    return {
+      tested: false,
+      valid: null,
+      message: "No client secret was provided, so secret validation was skipped.",
+    };
+  }
+
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: clientId,
+    client_secret: clientSecret,
+    code: "__oidc_test_invalid_code__",
+    redirect_uri: redirectUri,
+    code_verifier: "__oidc_test_invalid_verifier__",
+  });
+
+  const res = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body,
+  });
+
+  const data = await res.json().catch(() => ({}));
+  const error = (data?.error || "").toLowerCase();
+  const errorDescription = data?.error_description || data?.error || "";
+
+  if (res.ok) {
+    return {
+      tested: true,
+      valid: true,
+      message: "Client secret was accepted by the token endpoint.",
+      raw: data,
+    };
+  }
+
+  if (error === "invalid_client" || error === "unauthorized_client" || /client.*(invalid|failed|mismatch)/i.test(errorDescription)) {
+    return {
+      tested: true,
+      valid: false,
+      message: errorDescription || "Client secret is not valid.",
+      raw: data,
+    };
+  }
+
+  if (error === "invalid_grant" || error === "invalid_code" || /grant|code/i.test(errorDescription)) {
+    return {
+      tested: true,
+      valid: true,
+      message: "Client secret was accepted; the token exchange failed only because the test authorization code is invalid.",
+      raw: data,
+    };
+  }
+
+  return {
+    tested: true,
+    valid: null,
+    message: errorDescription || `Token endpoint responded with ${res.status}`,
+    raw: data,
+  };
+}
+
+export async function verifyOidcIdToken({
+  idToken,
+  issuer,
+  audience,
+  jwksUri,
+  nonce,
+}) {
+  const jwks = createRemoteJWKSet(new URL(jwksUri));
+  const { payload } = await jwtVerify(idToken, jwks, {
+    issuer,
+    audience,
+    nonce,
+  });
+  return payload;
+}
+
+export function pickOidcDisplayName(payload = {}) {
+  return payload.preferred_username || payload.email || payload.name || payload.given_name || payload.sub || "OIDC user";
+}
+
+export function pickOidcEmail(payload = {}) {
+  return payload.email || "";
+}

package/src/lib/consoleLogBuffer.js

@@ -0,0 +1,79 @@
+import { EventEmitter } from "events";
+import { CONSOLE_LOG_CONFIG } from "@/shared/constants/config.js";
+
+const consoleLevels = ["log", "info", "warn", "error", "debug"];
+
+if (!global._consoleLogBufferState) {
+  global._consoleLogBufferState = {
+    logs: [],
+    patched: false,
+    originals: {},
+    emitter: new EventEmitter(),
+  };
+  global._consoleLogBufferState.emitter.setMaxListeners(50);
+}
+
+const state = global._consoleLogBufferState;
+
+// Ensure emitter exists (handles hot reload with stale global)
+if (!state.emitter) {
+  state.emitter = new EventEmitter();
+  state.emitter.setMaxListeners(50);
+}
+
+function toLogLine(level, args) {
+  return args.map(formatArg).join(" ");
+}
+
+// Strip ANSI escape codes so terminal colors don't bleed into UI
+const ANSI_RE = /\x1b\[[0-9;]*m/g;
+
+function stripAnsi(str) {
+  return str.replace(ANSI_RE, "");
+}
+
+function formatArg(arg) {
+  if (typeof arg === "string") return stripAnsi(arg);
+  if (arg instanceof Error) return stripAnsi(arg.stack || arg.message || String(arg));
+  try {
+    return stripAnsi(JSON.stringify(arg));
+  } catch {
+    return stripAnsi(String(arg));
+  }
+}
+
+function appendLine(line) {
+  state.logs.push(line);
+  const maxLines = CONSOLE_LOG_CONFIG.maxLines;
+  if (state.logs.length > maxLines) {
+    state.logs = state.logs.slice(-maxLines);
+  }
+  state.emitter.emit("line", line);
+}
+
+export function initConsoleLogCapture() {
+  if (state.patched) return;
+
+  for (const level of consoleLevels) {
+    state.originals[level] = console[level];
+    console[level] = (...args) => {
+      appendLine(toLogLine(level, args));
+      state.originals[level](...args);
+    };
+  }
+
+  state.patched = true;
+}
+
+export function getConsoleLogs() {
+  return state.logs;
+}
+
+export function clearConsoleLogs() {
+  state.logs = [];
+  state.emitter.emit("clear");
+}
+
+export function getConsoleEmitter() {
+  return state.emitter;
+}

package/src/lib/dataDir.js

@@ -0,0 +1,29 @@
+import fs from "node:fs";
+import path from "path";
+import os from "os";
+
+const APP_NAME = "9router";
+
+function defaultDir() {
+  if (process.platform === "win32") {
+    return path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), APP_NAME);
+  }
+  return path.join(os.homedir(), `.${APP_NAME}`);
+}
+
+export function getDataDir() {
+  const configured = process.env.DATA_DIR;
+  if (!configured) return defaultDir();
+  try {
+    fs.mkdirSync(configured, { recursive: true });
+    return configured;
+  } catch (e) {
+    if (e?.code === "EACCES" || e?.code === "EPERM") {
+      console.warn(`[DATA_DIR] '${configured}' not writable → fallback ~/.${APP_NAME}`);
+      return defaultDir();
+    }
+    throw e;
+  }
+}
+
+export const DATA_DIR = getDataDir();