750 lines
28 KiB
TypeScript
750 lines
28 KiB
TypeScript
import { createReadStream, existsSync, statSync } from "node:fs";
|
|
import { extname, resolve } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import argon2 from "argon2";
|
|
import cookie from "@fastify/cookie";
|
|
import rateLimit from "@fastify/rate-limit";
|
|
import websocket from "@fastify/websocket";
|
|
import Fastify, { type FastifyInstance, type FastifyReply, type FastifyRequest } from "fastify";
|
|
import { z } from "zod";
|
|
import type { AppConfig } from "./config.js";
|
|
import { openDatabase, type CompanionDatabase } from "./database.js";
|
|
import { JobRunner } from "./jobs.js";
|
|
import {
|
|
clientAddress,
|
|
CSRF_COOKIE,
|
|
hashToken,
|
|
randomToken,
|
|
safeEqual,
|
|
SESSION_COOKIE
|
|
} from "./security.js";
|
|
import { collectSystemStatus } from "./status.js";
|
|
import { readNetworkActivity } from "./network-activity.js";
|
|
import { readUpdateStatus, triggerSystemUpdate } from "./update.js";
|
|
import {
|
|
hotspotConfigurationSchema,
|
|
networkActionSchema,
|
|
readNetworkStatus,
|
|
requestHotspotConfiguration,
|
|
requestNetworkAction
|
|
} from "./network.js";
|
|
import {
|
|
collectAdbStatus,
|
|
installAdbApk,
|
|
launchAdbTarget,
|
|
listInstalledAdbPackages,
|
|
MAX_APK_BYTES
|
|
} from "./adb.js";
|
|
import { CarTelemetryRecorder, type TelemetryPeriod } from "./car-telemetry.js";
|
|
import { openShell } from "./shell.js";
|
|
import { systemPowerActionSchema, triggerSystemPower } from "./system.js";
|
|
import "./types.js";
|
|
|
|
const usernameSchema = z
|
|
.string()
|
|
.trim()
|
|
.min(3, "Username must contain at least 3 characters")
|
|
.max(48, "Username must contain at most 48 characters")
|
|
.regex(/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/, "Use letters, numbers, dots, hyphens, or underscores");
|
|
|
|
const loginCredentialsSchema = z.object({
|
|
username: usernameSchema,
|
|
password: z.string().min(1).max(256)
|
|
});
|
|
|
|
const setupCredentialsSchema = loginCredentialsSchema.extend({
|
|
password: z
|
|
.string()
|
|
.min(8, "Password must contain at least 8 characters")
|
|
.max(256)
|
|
.regex(/[A-Z]/, "Password must contain at least one uppercase letter")
|
|
.regex(/[0-9]/, "Password must contain at least one number")
|
|
});
|
|
|
|
const adbPackageNameSchema = z.string().trim().max(240).regex(
|
|
/^(?:[a-zA-Z][a-zA-Z0-9_]*\.)+[a-zA-Z][a-zA-Z0-9_]*$/,
|
|
"Enter a valid Android package name"
|
|
);
|
|
const adbComponentSchema = z.string().trim().max(240).regex(
|
|
/^(?:[a-zA-Z][a-zA-Z0-9_]*\.)+[a-zA-Z][a-zA-Z0-9_]*\/(?:\.|[a-zA-Z])[a-zA-Z0-9_.$]*$/,
|
|
"Enter a valid Android component"
|
|
);
|
|
const adbTargetSchema = z.discriminatedUnion("type", [
|
|
z.object({ type: z.literal("component"), value: adbComponentSchema }),
|
|
z.object({ type: z.literal("package"), value: adbPackageNameSchema })
|
|
]);
|
|
const adbShortcutSchema = z.object({ name: z.string().trim().min(1).max(48), type: z.enum(["component", "package"]), value: z.string() })
|
|
.transform((value, context) => {
|
|
const target = adbTargetSchema.safeParse({ type: value.type, value: value.value });
|
|
if (!target.success) {
|
|
context.addIssue({ code: "custom", message: target.error.issues[0]?.message ?? "Enter a valid Android target" });
|
|
return z.NEVER;
|
|
}
|
|
return { name: value.name, ...target.data };
|
|
});
|
|
|
|
type UserRow = { id: number; username: string; role: "admin"; password_hash: string };
|
|
type SessionUserRow = { id: number; username: string; role: "admin" };
|
|
|
|
function audit(
|
|
database: CompanionDatabase,
|
|
event: {
|
|
actorUserId?: number;
|
|
action: string;
|
|
result: "success" | "failure";
|
|
ipAddress?: string;
|
|
details?: Record<string, string | number | boolean>;
|
|
}
|
|
): void {
|
|
database
|
|
.prepare(
|
|
`INSERT INTO audit_events
|
|
(actor_user_id, action, result, ip_address, details_json, created_at)
|
|
VALUES (?, ?, ?, ?, ?, ?)`
|
|
)
|
|
.run(
|
|
event.actorUserId ?? null,
|
|
event.action,
|
|
event.result,
|
|
event.ipAddress ?? null,
|
|
JSON.stringify(event.details ?? {}),
|
|
new Date().toISOString()
|
|
);
|
|
}
|
|
|
|
function cookieOptions(config: AppConfig, httpOnly: boolean) {
|
|
return {
|
|
path: "/",
|
|
httpOnly,
|
|
sameSite: "strict" as const,
|
|
secure: config.cookieSecure
|
|
};
|
|
}
|
|
|
|
function requireUser(request: FastifyRequest, reply: FastifyReply): boolean {
|
|
if (request.authUser) return true;
|
|
void reply.code(401).send({ error: { code: "AUTH_REQUIRED", message: "Sign in to continue" } });
|
|
return false;
|
|
}
|
|
|
|
export async function buildApp(config: AppConfig): Promise<FastifyInstance> {
|
|
const app = Fastify({
|
|
logger:
|
|
config.nodeEnv === "test"
|
|
? false
|
|
: {
|
|
level: config.nodeEnv === "production" ? "info" : "debug",
|
|
redact: ["req.headers.cookie", "req.headers.authorization", "req.headers.x-csrf-token"]
|
|
}
|
|
});
|
|
const database = openDatabase(config.databasePath);
|
|
const jobRunner = new JobRunner(database, undefined, config.adb);
|
|
const carTelemetry = new CarTelemetryRecorder(database, config.adb);
|
|
if (config.adb.enabled) void collectAdbStatus(config.adb);
|
|
carTelemetry.start();
|
|
|
|
app.decorate("database", database);
|
|
app.decorate("jobRunner", jobRunner);
|
|
app.decorateRequest("authUser", null);
|
|
await app.register(cookie);
|
|
await app.register(rateLimit, { global: false });
|
|
await app.register(websocket);
|
|
app.addContentTypeParser(
|
|
["application/vnd.android.package-archive", "application/octet-stream"],
|
|
{ parseAs: "buffer" },
|
|
(_request, body, done) => done(null, body)
|
|
);
|
|
|
|
app.addHook("onClose", async () => {
|
|
carTelemetry.stop();
|
|
jobRunner.close();
|
|
database.close();
|
|
});
|
|
app.addHook("onSend", async (_request, reply) => {
|
|
reply.header("X-Content-Type-Options", "nosniff");
|
|
reply.header("Referrer-Policy", "no-referrer");
|
|
reply.header("X-Frame-Options", "DENY");
|
|
reply.header(
|
|
"Content-Security-Policy",
|
|
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'"
|
|
);
|
|
});
|
|
|
|
app.addHook("onRequest", async (request) => {
|
|
request.authUser = null;
|
|
const token = request.cookies[SESSION_COOKIE];
|
|
if (!token) return;
|
|
|
|
const now = new Date().toISOString();
|
|
const user = database
|
|
.prepare(
|
|
`SELECT users.id, users.username, users.role
|
|
FROM sessions JOIN users ON users.id = sessions.user_id
|
|
WHERE sessions.id_hash = ? AND sessions.expires_at > ?`
|
|
)
|
|
.get(hashToken(token), now) as SessionUserRow | undefined;
|
|
if (user) request.authUser = user;
|
|
});
|
|
|
|
app.addHook("preValidation", async (request, reply) => {
|
|
if (!["POST", "PUT", "PATCH", "DELETE"].includes(request.method)) return;
|
|
|
|
const origin = request.headers.origin;
|
|
let sameHostOrigin = false;
|
|
if (origin && request.headers.host) {
|
|
try {
|
|
const parsedOrigin = new URL(origin);
|
|
sameHostOrigin = ["http:", "https:"].includes(parsedOrigin.protocol) && parsedOrigin.host === request.headers.host;
|
|
} catch {
|
|
sameHostOrigin = false;
|
|
}
|
|
}
|
|
if (origin && !sameHostOrigin && !config.allowedOrigins.has(origin)) {
|
|
return reply.code(403).send({ error: { code: "ORIGIN_REJECTED", message: "Request origin is not trusted" } });
|
|
}
|
|
|
|
const cookieToken = request.cookies[CSRF_COOKIE];
|
|
const headerToken = request.headers["x-csrf-token"];
|
|
if (!cookieToken || typeof headerToken !== "string" || !safeEqual(cookieToken, headerToken)) {
|
|
return reply.code(403).send({ error: { code: "CSRF_REJECTED", message: "Refresh the page and try again" } });
|
|
}
|
|
});
|
|
|
|
app.get("/healthz", async () => ({ status: "ok", timestamp: new Date().toISOString() }));
|
|
|
|
app.get("/api/auth/state", async (request, reply) => {
|
|
let csrfToken = request.cookies[CSRF_COOKIE];
|
|
if (!csrfToken) {
|
|
csrfToken = randomToken();
|
|
reply.setCookie(CSRF_COOKIE, csrfToken, cookieOptions(config, false));
|
|
}
|
|
const row = database.prepare("SELECT COUNT(*) AS count FROM users").get() as { count: number };
|
|
return {
|
|
setupRequired: row.count === 0,
|
|
user: request.authUser,
|
|
csrfToken
|
|
};
|
|
});
|
|
|
|
app.post(
|
|
"/api/auth/setup",
|
|
{ config: { rateLimit: { max: 5, timeWindow: "1 minute" } } },
|
|
async (request, reply) => {
|
|
const parsed = setupCredentialsSchema.safeParse(request.body);
|
|
if (!parsed.success) {
|
|
return reply.code(400).send({
|
|
error: { code: "INVALID_CREDENTIALS", message: parsed.error.issues[0]?.message ?? "Invalid account details" }
|
|
});
|
|
}
|
|
|
|
const passwordHash = await argon2.hash(parsed.data.password, { type: argon2.argon2id });
|
|
const createAdmin = database.transaction(() => {
|
|
const row = database.prepare("SELECT COUNT(*) AS count FROM users").get() as { count: number };
|
|
if (row.count !== 0) return null;
|
|
const result = database
|
|
.prepare("INSERT INTO users (username, password_hash, role, created_at) VALUES (?, ?, 'admin', ?)")
|
|
.run(parsed.data.username, passwordHash, new Date().toISOString());
|
|
return Number(result.lastInsertRowid);
|
|
});
|
|
const userId = createAdmin();
|
|
if (userId === null) {
|
|
audit(database, {
|
|
action: "auth.setup",
|
|
result: "failure",
|
|
ipAddress: clientAddress(request),
|
|
details: { reason: "setup_already_complete" }
|
|
});
|
|
return reply.code(409).send({ error: { code: "SETUP_COMPLETE", message: "Initial setup is already complete" } });
|
|
}
|
|
|
|
audit(database, {
|
|
actorUserId: userId,
|
|
action: "auth.setup",
|
|
result: "success",
|
|
ipAddress: clientAddress(request)
|
|
});
|
|
return reply.code(201).send({ created: true });
|
|
}
|
|
);
|
|
|
|
app.post(
|
|
"/api/auth/login",
|
|
{ config: { rateLimit: { max: 8, timeWindow: "1 minute" } } },
|
|
async (request, reply) => {
|
|
const parsed = loginCredentialsSchema.safeParse(request.body);
|
|
const user = parsed.success
|
|
? (database
|
|
.prepare("SELECT id, username, role, password_hash FROM users WHERE username = ? COLLATE NOCASE")
|
|
.get(parsed.data.username) as UserRow | undefined)
|
|
: undefined;
|
|
const valid = user && parsed.success ? await argon2.verify(user.password_hash, parsed.data.password) : false;
|
|
|
|
if (!user || !valid) {
|
|
audit(database, {
|
|
action: "auth.login",
|
|
result: "failure",
|
|
ipAddress: clientAddress(request),
|
|
details: { reason: "invalid_credentials" }
|
|
});
|
|
return reply.code(401).send({ error: { code: "LOGIN_FAILED", message: "Username or password is incorrect" } });
|
|
}
|
|
|
|
database.prepare("DELETE FROM sessions WHERE expires_at <= ?").run(new Date().toISOString());
|
|
const token = randomToken();
|
|
const expiresAt = new Date(Date.now() + config.sessionTtlMs);
|
|
database
|
|
.prepare("INSERT INTO sessions (id_hash, user_id, expires_at, created_at) VALUES (?, ?, ?, ?)")
|
|
.run(hashToken(token), user.id, expiresAt.toISOString(), new Date().toISOString());
|
|
reply.setCookie(SESSION_COOKIE, token, {
|
|
...cookieOptions(config, true),
|
|
expires: expiresAt
|
|
});
|
|
audit(database, {
|
|
actorUserId: user.id,
|
|
action: "auth.login",
|
|
result: "success",
|
|
ipAddress: clientAddress(request)
|
|
});
|
|
return { user: { id: user.id, username: user.username, role: user.role } };
|
|
}
|
|
);
|
|
|
|
app.post("/api/auth/logout", async (request, reply) => {
|
|
const token = request.cookies[SESSION_COOKIE];
|
|
if (token) database.prepare("DELETE FROM sessions WHERE id_hash = ?").run(hashToken(token));
|
|
if (request.authUser) {
|
|
audit(database, {
|
|
actorUserId: request.authUser.id,
|
|
action: "auth.logout",
|
|
result: "success",
|
|
ipAddress: clientAddress(request)
|
|
});
|
|
}
|
|
reply.clearCookie(SESSION_COOKIE, cookieOptions(config, true));
|
|
return { loggedOut: true };
|
|
});
|
|
|
|
app.get("/api/status", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
return collectSystemStatus(config.adb);
|
|
});
|
|
|
|
app.get("/api/jobs", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
return { jobs: jobRunner.listJobs() };
|
|
});
|
|
|
|
app.get("/api/job-runs", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
return { runs: jobRunner.listRuns() };
|
|
});
|
|
|
|
app.get<{ Params: { id: string } }>("/api/job-runs/:id", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const run = jobRunner.getRun(request.params.id);
|
|
if (!run) return reply.code(404).send({ error: { code: "RUN_NOT_FOUND", message: "Job run not found" } });
|
|
return run;
|
|
});
|
|
|
|
app.post<{ Params: { jobId: string } }>("/api/jobs/:jobId/runs", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
if (!jobRunner.has(request.params.jobId)) {
|
|
return reply.code(404).send({ error: { code: "JOB_NOT_FOUND", message: "Job is not available" } });
|
|
}
|
|
const run = jobRunner.enqueue(request.params.jobId, request.authUser!.id);
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "job.enqueue",
|
|
result: "success",
|
|
ipAddress: clientAddress(request),
|
|
details: { jobId: request.params.jobId, runId: run.id }
|
|
});
|
|
return reply.code(202).send(run);
|
|
});
|
|
|
|
app.get("/api/network", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
return readNetworkStatus(config);
|
|
});
|
|
|
|
app.get("/api/network/activity", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
return readNetworkActivity(config.network.activityPath);
|
|
});
|
|
|
|
app.get("/api/adb/packages", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
try {
|
|
return { packages: await listInstalledAdbPackages(config.adb) };
|
|
} catch {
|
|
return reply.code(503).send({ error: { code: "ADB_UNAVAILABLE", message: "The infotainment unit is not available over ADB" } });
|
|
}
|
|
});
|
|
|
|
app.post(
|
|
"/api/adb/install",
|
|
{ config: { rateLimit: { max: 4, timeWindow: "10 minutes" } }, bodyLimit: MAX_APK_BYTES },
|
|
async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
if (!Buffer.isBuffer(request.body)) {
|
|
return reply.code(400).send({ error: { code: "INVALID_APK", message: "Choose a valid APK file" } });
|
|
}
|
|
try {
|
|
await installAdbApk(config.adb, request.body);
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "adb.install-apk",
|
|
result: "success",
|
|
ipAddress: clientAddress(request),
|
|
details: { bytes: request.body.byteLength }
|
|
});
|
|
return reply.code(201).send({ installed: true });
|
|
} catch (error) {
|
|
const invalid = error instanceof Error && error.message === "INVALID_APK";
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "adb.install-apk",
|
|
result: "failure",
|
|
ipAddress: clientAddress(request),
|
|
details: { reason: invalid ? "invalid_apk" : "install_failed" }
|
|
});
|
|
return reply.code(invalid ? 400 : 503).send({
|
|
error: {
|
|
code: invalid ? "INVALID_APK" : "APK_INSTALL_FAILED",
|
|
message: invalid ? "Choose a valid APK file" : "The APK could not be installed on the infotainment unit"
|
|
}
|
|
});
|
|
}
|
|
}
|
|
);
|
|
|
|
app.post("/api/adb/launch", { config: { rateLimit: { max: 30, timeWindow: "1 minute" } } }, async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const parsed = adbTargetSchema.safeParse(request.body);
|
|
if (!parsed.success) {
|
|
return reply.code(400).send({ error: { code: "INVALID_ADB_TARGET", message: "Enter a valid package or activity" } });
|
|
}
|
|
try {
|
|
await launchAdbTarget(config.adb, parsed.data);
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "adb.launch",
|
|
result: "success",
|
|
ipAddress: clientAddress(request),
|
|
details: { targetType: parsed.data.type, target: parsed.data.value }
|
|
});
|
|
return { launched: true };
|
|
} catch {
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "adb.launch",
|
|
result: "failure",
|
|
ipAddress: clientAddress(request),
|
|
details: { targetType: parsed.data.type, target: parsed.data.value }
|
|
});
|
|
return reply.code(503).send({ error: { code: "ADB_LAUNCH_FAILED", message: "The target could not be opened on the infotainment unit" } });
|
|
}
|
|
});
|
|
|
|
app.get("/api/adb/shortcuts", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const shortcuts = database
|
|
.prepare("SELECT id, name, target_type AS type, target_value AS value, created_at AS createdAt FROM adb_shortcuts ORDER BY created_at, id")
|
|
.all();
|
|
return { shortcuts };
|
|
});
|
|
|
|
app.post("/api/adb/shortcuts", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const parsed = adbShortcutSchema.safeParse(request.body);
|
|
if (!parsed.success) {
|
|
return reply.code(400).send({ error: { code: "INVALID_ADB_SHORTCUT", message: "Enter a name and a valid target" } });
|
|
}
|
|
try {
|
|
const createdAt = new Date().toISOString();
|
|
const result = database
|
|
.prepare("INSERT INTO adb_shortcuts (name, target_type, target_value, created_at) VALUES (?, ?, ?, ?)")
|
|
.run(parsed.data.name, parsed.data.type, parsed.data.value, createdAt);
|
|
return reply.code(201).send({ id: Number(result.lastInsertRowid), ...parsed.data, createdAt });
|
|
} catch {
|
|
return reply.code(409).send({ error: { code: "ADB_SHORTCUT_EXISTS", message: "A shortcut for that target already exists" } });
|
|
}
|
|
});
|
|
|
|
app.delete<{ Params: { id: string } }>("/api/adb/shortcuts/:id", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const id = Number(request.params.id);
|
|
if (!Number.isInteger(id) || id < 1) {
|
|
return reply.code(400).send({ error: { code: "INVALID_ADB_SHORTCUT", message: "That shortcut is invalid" } });
|
|
}
|
|
const result = database.prepare("DELETE FROM adb_shortcuts WHERE id = ?").run(id);
|
|
if (result.changes === 0) return reply.code(404).send({ error: { code: "ADB_SHORTCUT_NOT_FOUND", message: "Shortcut not found" } });
|
|
return reply.code(204).send();
|
|
});
|
|
|
|
app.get("/api/car/telemetry", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
try {
|
|
return await carTelemetry.readLive();
|
|
} catch {
|
|
return reply.code(503).send({ error: { code: "CAR_TELEMETRY_UNAVAILABLE", message: "Live car telemetry is unavailable over ADB" } });
|
|
}
|
|
});
|
|
|
|
app.get<{ Querystring: { period?: string } }>("/api/car/history", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const parsed = z.enum(["24h", "7d", "30d", "1y", "all"]).safeParse(request.query.period ?? "24h");
|
|
if (!parsed.success) {
|
|
return reply.code(400).send({ error: { code: "INVALID_HISTORY_PERIOD", message: "That history period is not available" } });
|
|
}
|
|
return carTelemetry.store.history(parsed.data as TelemetryPeriod);
|
|
});
|
|
|
|
app.get("/api/car/statistics", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
return carTelemetry.store.overview();
|
|
});
|
|
|
|
app.post(
|
|
"/api/network/configuration",
|
|
{ config: { rateLimit: { max: 3, timeWindow: "10 minutes" } } },
|
|
async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const parsed = hotspotConfigurationSchema.safeParse(request.body);
|
|
if (!parsed.success) {
|
|
return reply.code(400).send({
|
|
error: {
|
|
code: "INVALID_HOTSPOT_CONFIGURATION",
|
|
message: parsed.error.issues[0]?.message ?? "The hotspot settings are invalid"
|
|
}
|
|
});
|
|
}
|
|
try {
|
|
const configuration = await requestHotspotConfiguration(config, parsed.data, request.authUser!.id);
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "network.configure-hotspot",
|
|
result: "success",
|
|
ipAddress: clientAddress(request),
|
|
details: { requestId: configuration.id }
|
|
});
|
|
return reply.code(202).send({ accepted: true, requestId: configuration.id });
|
|
} catch {
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "network.configure-hotspot",
|
|
result: "failure",
|
|
ipAddress: clientAddress(request),
|
|
details: { reason: "configuration_service_unavailable" }
|
|
});
|
|
return reply.code(503).send({
|
|
error: { code: "HOTSPOT_CONFIGURATION_UNAVAILABLE", message: "The hotspot configuration service is unavailable" }
|
|
});
|
|
}
|
|
}
|
|
);
|
|
|
|
app.post("/api/network/actions", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const parsed = z.object({ action: networkActionSchema }).safeParse(request.body);
|
|
if (!parsed.success) {
|
|
return reply.code(400).send({ error: { code: "INVALID_NETWORK_ACTION", message: "That network action is not available" } });
|
|
}
|
|
try {
|
|
const command = await requestNetworkAction(config, parsed.data.action, request.authUser!.id);
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: `network.${parsed.data.action}`,
|
|
result: "success",
|
|
ipAddress: clientAddress(request),
|
|
details: { commandId: command.id }
|
|
});
|
|
return reply.code(202).send({ accepted: true, commandId: command.id });
|
|
} catch {
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: `network.${parsed.data.action}`,
|
|
result: "failure",
|
|
ipAddress: clientAddress(request),
|
|
details: { reason: "controller_unavailable" }
|
|
});
|
|
return reply.code(503).send({
|
|
error: { code: "NETWORK_CONTROL_UNAVAILABLE", message: "Automatic network management is not configured" }
|
|
});
|
|
}
|
|
});
|
|
|
|
app.get("/api/system/update", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
return readUpdateStatus(config);
|
|
});
|
|
|
|
app.post(
|
|
"/api/system/update/check",
|
|
{ config: { rateLimit: { max: 6, timeWindow: "10 minutes" } } },
|
|
async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const current = await readUpdateStatus(config);
|
|
if (!current.supported) {
|
|
return reply.code(503).send({
|
|
error: { code: "UPDATES_UNAVAILABLE", message: "Install the system service before checking for updates" }
|
|
});
|
|
}
|
|
if (["checking", "building"].includes(current.state)) {
|
|
return reply.code(409).send({ error: { code: "UPDATE_IN_PROGRESS", message: "An update task is already running" } });
|
|
}
|
|
try {
|
|
await triggerSystemUpdate("check");
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "system.update-check",
|
|
result: "success",
|
|
ipAddress: clientAddress(request)
|
|
});
|
|
return reply.code(202).send({ queued: true });
|
|
} catch {
|
|
return reply.code(503).send({
|
|
error: { code: "UPDATE_CHECK_FAILED", message: "The update check could not be started" }
|
|
});
|
|
}
|
|
}
|
|
);
|
|
|
|
app.post(
|
|
"/api/system/update",
|
|
{ config: { rateLimit: { max: 2, timeWindow: "10 minutes" } } },
|
|
async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const current = await readUpdateStatus(config);
|
|
if (!current.supported) {
|
|
return reply.code(503).send({
|
|
error: { code: "UPDATES_UNAVAILABLE", message: "Install the system service before using automatic updates" }
|
|
});
|
|
}
|
|
if (["checking", "building"].includes(current.state)) {
|
|
return reply.code(409).send({ error: { code: "UPDATE_IN_PROGRESS", message: "An update is already running" } });
|
|
}
|
|
|
|
try {
|
|
await triggerSystemUpdate("install");
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "system.update",
|
|
result: "success",
|
|
ipAddress: clientAddress(request),
|
|
details: { state: "queued" }
|
|
});
|
|
return reply.code(202).send({ queued: true });
|
|
} catch {
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: "system.update",
|
|
result: "failure",
|
|
ipAddress: clientAddress(request),
|
|
details: { reason: "update_service_unavailable" }
|
|
});
|
|
return reply.code(503).send({
|
|
error: { code: "UPDATE_START_FAILED", message: "The update service could not be started" }
|
|
});
|
|
}
|
|
}
|
|
);
|
|
|
|
app.post(
|
|
"/api/system/power",
|
|
{ config: { rateLimit: { max: 3, timeWindow: "10 minutes" } } },
|
|
async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
const parsed = z.object({ action: systemPowerActionSchema }).safeParse(request.body);
|
|
if (!parsed.success) {
|
|
return reply.code(400).send({ error: { code: "INVALID_POWER_ACTION", message: "That power action is not available" } });
|
|
}
|
|
try {
|
|
await triggerSystemPower(parsed.data.action);
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: `system.${parsed.data.action}`,
|
|
result: "success",
|
|
ipAddress: clientAddress(request)
|
|
});
|
|
return reply.code(202).send({ queued: true, action: parsed.data.action });
|
|
} catch {
|
|
audit(database, {
|
|
actorUserId: request.authUser!.id,
|
|
action: `system.${parsed.data.action}`,
|
|
result: "failure",
|
|
ipAddress: clientAddress(request)
|
|
});
|
|
return reply.code(503).send({
|
|
error: { code: "POWER_ACTION_FAILED", message: "The Pi could not schedule that power action" }
|
|
});
|
|
}
|
|
}
|
|
);
|
|
|
|
app.get("/api/system/shell", { websocket: true }, (socket, request) => {
|
|
openShell(socket, request, config);
|
|
});
|
|
|
|
app.get("/api/events", async (request, reply) => {
|
|
if (!requireUser(request, reply)) return;
|
|
reply.hijack();
|
|
reply.raw.writeHead(200, {
|
|
"Content-Type": "text/event-stream",
|
|
"Cache-Control": "no-cache, no-transform",
|
|
Connection: "keep-alive",
|
|
"X-Accel-Buffering": "no"
|
|
});
|
|
let closed = false;
|
|
const sendStatus = async () => {
|
|
if (closed) return;
|
|
try {
|
|
const status = await collectSystemStatus(config.adb);
|
|
reply.raw.write(`event: status\ndata: ${JSON.stringify(status)}\n\n`);
|
|
} catch {
|
|
reply.raw.write(`event: collection-error\ndata: {"code":"STATUS_COLLECTION_FAILED"}\n\n`);
|
|
}
|
|
};
|
|
await sendStatus();
|
|
const interval = setInterval(() => void sendStatus(), 10_000);
|
|
const stopJobEvents = jobRunner.onRun((run) => {
|
|
if (!closed) reply.raw.write(`event: job-run\ndata: ${JSON.stringify(run)}\n\n`);
|
|
});
|
|
request.raw.on("close", () => {
|
|
closed = true;
|
|
clearInterval(interval);
|
|
stopJobEvents();
|
|
});
|
|
});
|
|
|
|
const webRoot = resolve(fileURLToPath(new URL("../../web/dist", import.meta.url)));
|
|
if (config.nodeEnv === "production" && existsSync(webRoot)) {
|
|
app.get("/", async (_request, reply) => {
|
|
reply.type("text/html; charset=utf-8");
|
|
return reply.send(createReadStream(resolve(webRoot, "index.html")));
|
|
});
|
|
app.get<{ Params: { file: string } }>("/assets/:file", async (request, reply) => {
|
|
if (!/^[a-zA-Z0-9._-]+$/.test(request.params.file)) {
|
|
return reply.code(404).send({ error: { code: "NOT_FOUND", message: "Asset not found" } });
|
|
}
|
|
const assetPath = resolve(webRoot, "assets", request.params.file);
|
|
if (!existsSync(assetPath) || !statSync(assetPath).isFile()) {
|
|
return reply.code(404).send({ error: { code: "NOT_FOUND", message: "Asset not found" } });
|
|
}
|
|
const contentTypes: Record<string, string> = {
|
|
".css": "text/css; charset=utf-8",
|
|
".js": "text/javascript; charset=utf-8",
|
|
".map": "application/json; charset=utf-8",
|
|
".png": "image/png",
|
|
".svg": "image/svg+xml",
|
|
".woff2": "font/woff2"
|
|
};
|
|
reply.type(contentTypes[extname(assetPath)] ?? "application/octet-stream");
|
|
reply.header("Cache-Control", "public, max-age=31536000, immutable");
|
|
return reply.send(createReadStream(assetPath));
|
|
});
|
|
}
|
|
|
|
return app;
|
|
}
|