Bohdan Triapitsyn
859b4529da
Adds OpenChamber Relay — an opt-in way to reach an instance from a phone, browser, or another desktop from anywhere, with no open inbound ports, no tunnel, and no shared LAN. The instance dials outbound to a relay; all app traffic (HTTP, the event stream, terminal, dictation) is multiplexed and encrypted through a single connection per client, so the relay only ever forwards opaque ciphertext. Transport - End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF -> AES-256-GCM) with a capability-negotiated handshake and a small HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror is cross-checked by tests. - Host: outbound connection manager, per-client tunnel dispatcher to the local server over loopback, reuse of the existing instance identity key, and management routes. Disabled by default; explicit opt-in. - Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/ -auth, event pipeline, terminal, dictation) so features work over the relay unchanged; direct-URL and Electron realtime-proxy paths are untouched. Pairing & UX - Relay section in Settings -> Remote Instances (live status, QR/link pairing, revocation via the existing client-token list) and the mobile connect flow. - Frame batching and idle-gated keepalive keep tunnel message volume low without affecting streaming smoothness. Security - The tunnel is transport only; the server authenticates every tunneled request exactly as for a direct remote client. fragments only. The relay stores no keys, tokens, or payloads. Operability - The endpoint can be pinned to a self-hosted rel paired clients inherit it from the offer automatically. - Relay module DOCUMENTATION.md and a relay-trans invariants that future WebSocket/streaming changes must follow. The relay transport is complete and tested; the UI for enabling and pairing is gated behind openchamber_relay_gate and stays
79 lines
3.0 KiB
JavaScript
79 lines
3.0 KiB
JavaScript
import { describe, expect, it } from 'bun:test';
|
|
import crypto from 'node:crypto';
|
|
|
|
import { createRelayIdentityRuntime } from './identity.js';
|
|
import { canonicalPublicJwkString } from './signing-key.js';
|
|
|
|
// In-memory settings store standing in for the on-disk settings file.
|
|
const makeSettingsStore = (initial = {}) => {
|
|
let settings = { ...initial };
|
|
return {
|
|
readSettingsFromDiskMigrated: async () => ({ ...settings }),
|
|
writeSettingsToDisk: async (next) => {
|
|
settings = { ...next };
|
|
},
|
|
peek: () => settings,
|
|
};
|
|
};
|
|
|
|
describe('relay identity', () => {
|
|
it('derives a stable serverId from the signing key and persists both keypairs', async () => {
|
|
const store = makeSettingsStore();
|
|
const runtime = createRelayIdentityRuntime({ crypto, ...store });
|
|
const identity = await runtime.getRelayIdentity();
|
|
|
|
const stored = store.peek();
|
|
expect(stored.relaySigningKey).toBeDefined();
|
|
expect(stored.relayEncryptionKey).toBeDefined();
|
|
|
|
const expectedServerId = crypto
|
|
.createHash('sha256')
|
|
.update(canonicalPublicJwkString(stored.relaySigningKey.publicJwk))
|
|
.digest('base64url');
|
|
expect(identity.serverId).toBe(expectedServerId);
|
|
expect(identity.hostEncPubJwk.crv).toBe('P-256');
|
|
});
|
|
|
|
it('reuses an existing signing key (serverId stays stable across installs)', async () => {
|
|
const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
|
|
void privateKey;
|
|
const publicJwk = publicKey.export({ format: 'jwk' });
|
|
const store = makeSettingsStore({
|
|
relaySigningKey: {
|
|
privateJwk: crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' }).privateKey.export({ format: 'jwk' }),
|
|
publicJwk,
|
|
},
|
|
});
|
|
// Match private to public so importing works.
|
|
const pair = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
|
|
store.peek().relaySigningKey.privateJwk = pair.privateKey.export({ format: 'jwk' });
|
|
store.peek().relaySigningKey.publicJwk = pair.publicKey.export({ format: 'jwk' });
|
|
|
|
const runtime = createRelayIdentityRuntime({ crypto, ...store });
|
|
const identity = await runtime.getRelayIdentity();
|
|
const expected = crypto
|
|
.createHash('sha256')
|
|
.update(canonicalPublicJwkString(pair.publicKey.export({ format: 'jwk' })))
|
|
.digest('base64url');
|
|
expect(identity.serverId).toBe(expected);
|
|
});
|
|
|
|
it('produces a verifiable relay auth signature', async () => {
|
|
const store = makeSettingsStore();
|
|
const runtime = createRelayIdentityRuntime({ crypto, ...store });
|
|
const identity = await runtime.getRelayIdentity();
|
|
const { ts, sig, pk } = identity.signRelayAuth('host-control', null);
|
|
|
|
const canonical = Buffer.from(pk, 'base64url').toString('utf8');
|
|
const publicJwk = JSON.parse(canonical);
|
|
const key = crypto.createPublicKey({ key: publicJwk, format: 'jwk' });
|
|
const ok = crypto.verify(
|
|
'SHA256',
|
|
Buffer.from(`${ts}.${identity.serverId}.host-control.`),
|
|
{ key, dsaEncoding: 'ieee-p1363' },
|
|
Buffer.from(sig, 'base64url'),
|
|
);
|
|
expect(ok).toBe(true);
|
|
});
|
|
});
|