pastilhas
2acd103750
Officer holds the credential; Linkwarden holds the data and decides who may see it. That split is the whole design and it is why there are two doors that look alike from outside and are not. `/lw/*` is the extension's. Unauthenticated, forwarded verbatim, the credential is the caller's own - the same argument Vault's public router makes, that this is one address instead of two rather than new exposure, and it is what lets Linkwarden stop being reachable on its own. `/api/*` is ours. An Officer session names the caller, we find their mapped account and put THEIR token on the request. A browser holding an Officer session never holds a Linkwarden credential, which is the property Vault exists to give, applied per user. Officer decides whose token goes on; Linkwarden decides what it may see, because re-implementing that here would be a second answer able to disagree with the first. `proxiedSubPath: '/lw'` is load-bearing rather than tidy. Claiming the whole prefix would tell the body parser to leave /config alone too, and every field on it would read as missing - the failure caldav hit the day it was extracted. The sidecar is a plain HTTP proxy with no WebSocket: Vaultwarden pushes over SignalR and Linkwarden does not, so a socket here would be scaffolding for a protocol that does not exist. Its onCommand is empty for the same reason - it forwards bytes, and everything that decides anything happens before a request reaches it. Two things measured rather than assumed while writing this. The port announcement typechecks because SidecarPortAnnouncement was generalised, so a plugin no longer needs a platform pull request to announce its own port. And the config URL is the LOOPBACK address, not the advertised one: on alpha the name Linkwarden now advertises resolves to 127.0.1.1, where nothing is bound, so a sidecar running there would dial the name it publishes and get nothing. Typechecks clean. No provisioning and no panel yet.
90 lines
3.6 KiB
TypeScript
90 lines
3.6 KiB
TypeScript
import { getLinkwardenConfig } from '../db/queries';
|
|
|
|
// Where Linkwarden is, for the officer-linkwarden sidecar, plus header hygiene.
|
|
//
|
|
// ── The URL comes from the database, and can change while this is running ──
|
|
//
|
|
// `db/schema.ts` says why it is not an environment variable. The consequence here is the interesting
|
|
// part: a value that would have been constant for the process lifetime is now something the owner can
|
|
// change from a settings panel without restarting anything.
|
|
//
|
|
// ── Why a cache with a TTL rather than a read per request ──
|
|
//
|
|
// This sits in front of every proxied byte. A Postgres round trip per request would put the database on
|
|
// the hot path of a proxy whose whole design rule is to do as little as possible. Ten seconds is chosen
|
|
// against what the value actually is — a URL edited by hand, roughly never, and then wanted immediately.
|
|
// Imperceptible to somebody who just pressed Save, and free the rest of the time.
|
|
//
|
|
// The TTL is the WHOLE mechanism. There is no push: `sidecar-registry.ts` carries events from a sidecar
|
|
// to the platform, not commands the other way, so the config route has nothing to call. Building that
|
|
// channel for a cache hint would be a channel built for the wrong reason.
|
|
//
|
|
// A failed read keeps serving the last known-good value rather than dropping to null, because "cannot
|
|
// reach Postgres" and "the owner never configured this" look identical on screen and are not the same.
|
|
|
|
const TTL_MS = 10_000;
|
|
|
|
type Cached = { url: string | null; enabled: boolean; at: number };
|
|
let cache: Cached | null = null;
|
|
let inflight: Promise<Cached> | null = null;
|
|
|
|
async function read(): Promise<Cached> {
|
|
try {
|
|
const config = await getLinkwardenConfig();
|
|
cache = { url: config.url, enabled: config.enabled, at: Date.now() };
|
|
return cache;
|
|
} catch (err) {
|
|
console.error(`[linkwarden] could not read config: ${err instanceof Error ? err.message : String(err)}`);
|
|
if (cache) return { ...cache, at: Date.now() };
|
|
return { url: null, enabled: true, at: Date.now() };
|
|
}
|
|
}
|
|
|
|
async function current(): Promise<Cached> {
|
|
if (cache && Date.now() - cache.at < TTL_MS) return cache;
|
|
// One read at a time. Without this, every request under load misses the same expired entry and fires
|
|
// its own query — the stampede that makes a cache slower than no cache.
|
|
inflight ??= read().finally(() => {
|
|
inflight = null;
|
|
});
|
|
return inflight;
|
|
}
|
|
|
|
/** The base URL to forward to, or null when unconfigured or switched off. No trailing slash. */
|
|
export async function getLinkwardenBase(): Promise<string | null> {
|
|
const { url, enabled } = await current();
|
|
return enabled ? url : null;
|
|
}
|
|
|
|
const HOP_BY_HOP = new Set([
|
|
'connection',
|
|
'keep-alive',
|
|
'proxy-authenticate',
|
|
'proxy-authorization',
|
|
'te',
|
|
'trailer',
|
|
'transfer-encoding',
|
|
'upgrade',
|
|
'host',
|
|
]);
|
|
|
|
/** Copy headers, dropping only hop-by-hop and `proxy-*` ones. Authorization and cookies pass through. */
|
|
export function stripHopByHop(src: Headers): Headers {
|
|
const out = new Headers();
|
|
src.forEach((value, key) => {
|
|
const k = key.toLowerCase();
|
|
if (HOP_BY_HOP.has(k) || k.startsWith('proxy-')) return;
|
|
out.set(key, value);
|
|
});
|
|
return out;
|
|
}
|
|
|
|
/*
|
|
Paths are logged; tokens are not.
|
|
|
|
Linkwarden puts an access token in a query string in more than one place, and a NextAuth callback
|
|
carries a csrf token the same way. None of it belongs in a log that gets pasted into a chat.
|
|
*/
|
|
const REDACT = /([?&](access_token|token|csrfToken|code)=)[^&]*/gi;
|
|
export const redactPath = (pathAndQuery: string): string => pathAndQuery.replace(REDACT, '$1<redacted>');
|