1import { spawn, type ChildProcessByStdio } from "node:child_process";
2import net from "node:net";
3import type { Readable } from "node:stream";
4 
5import type { StrictHostKeyChecking } from "./wechat-extend-config.ts";
6import type { WechatClient } from "./wechat-http.ts";
7import { createSocksClient } from "./wechat-socks-http.ts";
8 
9export interface RemotePublishConfig {
10  host: string;
11  user?: string;
12  port?: number;
13  identityFile?: string;
14  knownHostsFile?: string;
15  strictHostKeyChecking?: StrictHostKeyChecking;
16  connectTimeout?: number;
17  proxyJump?: string;
18}
19 
20export interface NormalizedRemotePublishConfig {
21  host: string;
22  user: string;
23  port: number;
24  identityFile?: string;
25  knownHostsFile?: string;
26  strictHostKeyChecking?: StrictHostKeyChecking;
27  connectTimeout?: number;
28  proxyJump?: string;
29}
30 
31export interface SshTunnel {
32  port: number;
33  client: WechatClient;
34  close: () => Promise<void>;
35}
36 
37export interface StartSshTunnelOptions {
38  readyTimeoutMs?: number;
39  killTimeoutMs?: number;
40}
41 
42const DEFAULT_USER = "root";
43const DEFAULT_PORT = 22;
44const DEFAULT_READY_TIMEOUT_MS = 10_000;
45const DEFAULT_KILL_TIMEOUT_MS = 3_000;
46const SSH_LOOPBACK_HOST = "127.0.0.1";
47 
48export function normalizeRemoteConfig(config: RemotePublishConfig): NormalizedRemotePublishConfig {
49  if (!config.host || !config.host.trim()) {
50    throw new Error("Remote publish host is required (set remote_publish_host or --remote-host).");
51  }
52 
53  const port = config.port ?? DEFAULT_PORT;
54  if (!Number.isInteger(port) || port < 1 || port > 65535) {
55    throw new Error(`Invalid remote publish port: ${config.port}`);
56  }
57 
58  if (config.connectTimeout !== undefined) {
59    if (!Number.isInteger(config.connectTimeout) || config.connectTimeout <= 0) {
60      throw new Error(`Invalid remote_publish_connect_timeout: ${config.connectTimeout}`);
61    }
62  }
63 
64  if (
65    config.strictHostKeyChecking !== undefined &&
66    config.strictHostKeyChecking !== "yes" &&
67    config.strictHostKeyChecking !== "no" &&
68    config.strictHostKeyChecking !== "accept-new"
69  ) {
70    throw new Error(`Invalid remote_publish_strict_host_key_checking: ${config.strictHostKeyChecking}`);
71  }
72 
73  return {
74    host: config.host.trim(),
75    user: (config.user ?? DEFAULT_USER).trim() || DEFAULT_USER,
76    port,
77    identityFile: config.identityFile,
78    knownHostsFile: config.knownHostsFile,
79    strictHostKeyChecking: config.strictHostKeyChecking,
80    connectTimeout: config.connectTimeout,
81    proxyJump: config.proxyJump,
82  };
83}
84 
85export function buildSshArgs(config: NormalizedRemotePublishConfig, socksPort: number): string[] {
86  if (!Number.isInteger(socksPort) || socksPort < 1 || socksPort > 65535) {
87    throw new Error(`Invalid SOCKS port: ${socksPort}`);
88  }
89 
90  const args: string[] = [
91    "-N",
92    "-T",
93    "-D", `${SSH_LOOPBACK_HOST}:${socksPort}`,
94    "-o", "ExitOnForwardFailure=yes",
95    "-o", "ServerAliveInterval=30",
96    "-o", "ServerAliveCountMax=3",
97    "-p", String(config.port),
98  ];
99 
100  if (config.identityFile) {
101    args.push("-i", config.identityFile);
102  }
103  if (config.knownHostsFile) {
104    args.push("-o", `UserKnownHostsFile=${config.knownHostsFile}`);
105  }
106  if (config.strictHostKeyChecking) {
107    args.push("-o", `StrictHostKeyChecking=${config.strictHostKeyChecking}`);
108  }
109  if (config.connectTimeout !== undefined) {
110    args.push("-o", `ConnectTimeout=${config.connectTimeout}`);
111  }
112  if (config.proxyJump) {
113    args.push("-J", config.proxyJump);
114  }
115 
116  args.push(`${config.user}@${config.host}`);
117  return args;
118}
119 
120export async function findFreePort(): Promise<number> {
121  return new Promise<number>((resolve, reject) => {
122    const server = net.createServer();
123    server.unref();
124    server.on("error", reject);
125    server.listen(0, SSH_LOOPBACK_HOST, () => {
126      const address = server.address();
127      if (!address || typeof address === "string") {
128        server.close(() => reject(new Error("Failed to acquire free port")));
129        return;
130      }
131      const port = address.port;
132      server.close((err) => {
133        if (err) reject(err);
134        else resolve(port);
135      });
136    });
137  });
138}
139 
140export async function waitForSocksReady(port: number, timeoutMs: number): Promise<void> {
141  const deadline = Date.now() + timeoutMs;
142  let lastError: unknown = undefined;
143 
144  while (Date.now() < deadline) {
145    try {
146      await tryConnect(port);
147      return;
148    } catch (err) {
149      lastError = err;
150      await sleep(150);
151    }
152  }
153  throw new Error(`SOCKS proxy on ${SSH_LOOPBACK_HOST}:${port} not ready within ${timeoutMs}ms${lastError ? `: ${(lastError as Error).message}` : ""}`);
154}
155 
156function tryConnect(port: number): Promise<void> {
157  return new Promise((resolve, reject) => {
158    const socket = net.connect({ host: SSH_LOOPBACK_HOST, port });
159    socket.once("connect", () => {
160      socket.destroy();
161      resolve();
162    });
163    socket.once("error", (err) => {
164      socket.destroy();
165      reject(err);
166    });
167  });
168}
169 
170function sleep(ms: number): Promise<void> {
171  return new Promise((resolve) => setTimeout(resolve, ms));
172}
173 
174export async function startSshTunnel(
175  config: NormalizedRemotePublishConfig,
176  options: StartSshTunnelOptions = {},
177): Promise<SshTunnel> {
178  const readyTimeout = options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
179  const killTimeout = options.killTimeoutMs ?? DEFAULT_KILL_TIMEOUT_MS;
180 
181  const port = await findFreePort();
182  const args = buildSshArgs(config, port);
183 
184  console.error(`[wechat-remote-publish] Starting SSH SOCKS5 tunnel: ssh ${args.join(" ")}`);
185  const child = spawn("ssh", args, {
186    stdio: ["ignore", "pipe", "pipe"],
187  }) as ChildProcessByStdio<null, Readable, Readable>;
188 
189  const stderrChunks: string[] = [];
190  child.stderr.on("data", (chunk: Buffer) => {
191    stderrChunks.push(chunk.toString("utf-8"));
192  });
193 
194  let earlyExit: { code: number | null; signal: NodeJS.Signals | null } | undefined;
195  child.once("exit", (code, signal) => {
196    earlyExit = { code, signal };
197  });
198 
199  try {
200    await waitForSocksReady(port, readyTimeout);
201  } catch (err) {
202    await killChild(child, killTimeout);
203    const stderrTail = stderrChunks.join("").trim().split("\n").slice(-5).join("\n");
204    const suffix = stderrTail ? `\nssh stderr (tail):\n${stderrTail}` : "";
205    const exitSuffix = earlyExit
206      ? `\nssh exited early with code=${earlyExit.code} signal=${earlyExit.signal}`
207      : "";
208    throw new Error(`${(err as Error).message}${exitSuffix}${suffix}`);
209  }
210 
211  const client = createSocksClient({ host: SSH_LOOPBACK_HOST, port });
212 
213  const signalHandlers: Array<{ signal: NodeJS.Signals; handler: () => void }> = [];
214  let closed = false;
215  const close = async (): Promise<void> => {
216    if (closed) return;
217    closed = true;
218    for (const { signal, handler } of signalHandlers) {
219      process.off(signal, handler);
220    }
221    await killChild(child, killTimeout);
222  };
223 
224  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"] as const) {
225    const handler = () => {
226      void close();
227    };
228    process.once(signal, handler);
229    signalHandlers.push({ signal, handler });
230  }
231 
232  return { port, client, close };
233}
234 
235async function killChild(child: ChildProcessByStdio<null, Readable, Readable>, killTimeoutMs: number): Promise<void> {
236  if (child.exitCode !== null || child.signalCode !== null) {
237    return;
238  }
239  const exited = new Promise<void>((resolve) => {
240    child.once("exit", () => resolve());
241  });
242  try {
243    child.kill("SIGTERM");
244  } catch {
245    /* already dead */
246  }
247 
248  const timer = setTimeout(() => {
249    try {
250      child.kill("SIGKILL");
251    } catch {
252      /* already dead */
253    }
254  }, killTimeoutMs);
255 
256  try {
257    await exited;
258  } finally {
259    clearTimeout(timer);
260  }
261}
262 
263export async function withSshTunnel<T>(
264  config: NormalizedRemotePublishConfig,
265  fn: (client: WechatClient) => Promise<T>,
266  options?: StartSshTunnelOptions,
267): Promise<T> {
268  const tunnel = await startSshTunnel(config, options);
269  try {
270    return await fn(tunnel.client);
271  } finally {
272    await tunnel.close();
273  }
274}
275