Bohdan Triapitsyn
859b4529da
Adds OpenChamber Relay — an opt-in way to reach an instance from a phone, browser, or another desktop from anywhere, with no open inbound ports, no tunnel, and no shared LAN. The instance dials outbound to a relay; all app traffic (HTTP, the event stream, terminal, dictation) is multiplexed and encrypted through a single connection per client, so the relay only ever forwards opaque ciphertext. Transport - End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF -> AES-256-GCM) with a capability-negotiated handshake and a small HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror is cross-checked by tests. - Host: outbound connection manager, per-client tunnel dispatcher to the local server over loopback, reuse of the existing instance identity key, and management routes. Disabled by default; explicit opt-in. - Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/ -auth, event pipeline, terminal, dictation) so features work over the relay unchanged; direct-URL and Electron realtime-proxy paths are untouched. Pairing & UX - Relay section in Settings -> Remote Instances (live status, QR/link pairing, revocation via the existing client-token list) and the mobile connect flow. - Frame batching and idle-gated keepalive keep tunnel message volume low without affecting streaming smoothness. Security - The tunnel is transport only; the server authenticates every tunneled request exactly as for a direct remote client. fragments only. The relay stores no keys, tokens, or payloads. Operability - The endpoint can be pinned to a self-hosted rel paired clients inherit it from the offer automatically. - Relay module DOCUMENTATION.md and a relay-trans invariants that future WebSocket/streaming changes must follow. The relay transport is complete and tested; the UI for enabling and pairing is gated behind openchamber_relay_gate and stays
67 lines
2.9 KiB
TypeScript
67 lines
2.9 KiB
TypeScript
import { describe, expect, test } from 'bun:test';
|
|
|
|
import { buildRelayOfferUrl } from '@/lib/relay/offer';
|
|
import type { RelayOfferV1 } from '@/lib/relay/protocol';
|
|
|
|
import { parseConnectionPayload } from './mobileQrScan';
|
|
|
|
const baseOffer: RelayOfferV1 = {
|
|
v: 1,
|
|
mode: 'relay',
|
|
relayUrl: 'wss://relay.example/tunnel',
|
|
serverId: 'srv_test123',
|
|
hostEncPubJwk: { kty: 'EC', crv: 'P-256', x: 'eHhY', y: 'eVlZ' },
|
|
};
|
|
|
|
describe('parseConnectionPayload', () => {
|
|
test('parses direct pairing links unchanged', () => {
|
|
const payload = parseConnectionPayload('openchamber://connect?v=1&server=http%3A%2F%2F192.168.1.10%3A2606&token=tok&label=Home');
|
|
expect(payload).toEqual({ url: 'http://192.168.1.10:2606', clientToken: 'tok', label: 'Home' });
|
|
});
|
|
|
|
test('parses bare http(s) URLs unchanged', () => {
|
|
expect(parseConnectionPayload('https://oc.example')).toEqual({ url: 'https://oc.example' });
|
|
expect(parseConnectionPayload(' http://192.168.1.10:2606 ')).toEqual({ url: 'http://192.168.1.10:2606' });
|
|
});
|
|
|
|
test('rejects non-connection payloads', () => {
|
|
expect(parseConnectionPayload('')).toBeNull();
|
|
expect(parseConnectionPayload('hello world')).toBeNull();
|
|
expect(parseConnectionPayload('openchamber://connect')).toBeNull();
|
|
expect(parseConnectionPayload('openchamber://session/abc')).toBeNull();
|
|
});
|
|
|
|
test('recognizes relay offers with embedded token and grant', () => {
|
|
const url = buildRelayOfferUrl({ ...baseOffer, label: 'My Desktop', token: 'oc_client_secret', grant: 'grant123' });
|
|
const payload = parseConnectionPayload(url);
|
|
expect(payload).not.toBeNull();
|
|
expect(payload?.url).toBe(url);
|
|
expect(payload?.label).toBe('My Desktop');
|
|
expect(payload?.clientToken).toBe('oc_client_secret');
|
|
expect(payload?.relay).toEqual({
|
|
relayUrl: baseOffer.relayUrl,
|
|
serverId: baseOffer.serverId,
|
|
hostEncPubJwk: baseOffer.hostEncPubJwk,
|
|
});
|
|
expect(payload?.relayGrant).toBe('grant123');
|
|
});
|
|
|
|
test('recognizes token-less relay offers (login-on-first-connect)', () => {
|
|
const url = buildRelayOfferUrl(baseOffer);
|
|
const payload = parseConnectionPayload(url);
|
|
expect(payload).not.toBeNull();
|
|
expect(payload?.clientToken).toBe(undefined);
|
|
expect(payload?.relayGrant).toBe(undefined);
|
|
expect(payload?.relay?.serverId).toBe(baseOffer.serverId);
|
|
});
|
|
|
|
test('malformed relay offers fall through to direct parsing rules', () => {
|
|
// mode=relay but no fragment payload → not a valid offer, and no `server`
|
|
// param either → rejected entirely, exactly like before relay support.
|
|
expect(parseConnectionPayload('openchamber://connect?v=1&mode=relay')).toBeNull();
|
|
// Direct link that also carries an unrelated mode param keeps direct parsing.
|
|
const direct = parseConnectionPayload('openchamber://connect?v=1&mode=relay&server=http%3A%2F%2Fhost.example');
|
|
expect(direct).toEqual({ url: 'http://host.example' });
|
|
});
|
|
});
|