feat(app): per-container CF SSH tunnel for VS Code panel

packages/api/package.json

@@ -54,6 +54,6 @@
  "globals": "^17.6.0",
  "typescript": "^6.0.3",
  "typescript-eslint": "^8.61.1",
- "vitest": "^4.1.9"
+ "vitest": "^3.2.0"
  }
 }

packages/api/src/api/contracts.ts

@@ -809,3 +809,29 @@ export type ApiEvent = {
  readonly at: string
  readonly payload: unknown
 }
+
+export type ShareLinkInfo = {
+ readonly token: string
+ readonly projectKey: string
+ readonly projectDir: string
+ readonly displayName: string
+ readonly sshAlias: string
+ readonly sshConfigSnippet: string
+ readonly cfSshConfigSnippet: string | null
+ readonly vscodeUri: string
+ readonly cfVscodeUri: string | null
+ readonly workspacePath: string
+ readonly sshPassword: string | null
+ readonly createdAt: string
+ readonly expiresAt: string
+}
+
+export type CreateShareLinkRequest = {
+ readonly ttlMs?: number | undefined
+}
+
+export type CreateShareLinkResponse = {
+ readonly ok: true
+ readonly link: ShareLinkInfo
+ readonly url: string
+}

packages/api/src/api/openapi.ts

@@ -30,6 +30,10 @@ import {
  ProjectDatabaseSessionSchema,
  ProjectPortForwardRequestSchema,
  ProjectSkillUpdateRequestSchema,
+ CreateShareLinkRequestSchema,
+ ShareLinkInfoResponseSchema,
+ CreateShareLinkResponseSchema,
+ ShareLinksListResponseSchema,
  StartPanelCloudflareTunnelRequestSchema,
  StartProjectTerminalSessionRequestSchema,
  UpProjectRequestSchema
@@ -735,6 +739,8 @@ const TasksGroup = HttpApiGroup.make("tasks")
  .addSuccess(OutputResponseSchema)
  )
 
+const ShareLinkTokenParam = HttpApiSchema.param("token", Schema.String)
+
 const SharingGroup = HttpApiGroup.make("sharing")
  .add(endpoint.get("readPanelCloudflareTunnel", "/cloudflare-tunnels/panel").addSuccess(PanelCloudflareTunnelResponseSchema))
  .add(
@@ -743,6 +749,14 @@ const SharingGroup = HttpApiGroup.make("sharing")
  .addSuccess(PanelCloudflareTunnelResponseSchema, { status: 202 })
  )
  .add(endpoint.del("stopPanelCloudflareTunnel", "/cloudflare-tunnels/panel").addSuccess(PanelCloudflareTunnelResponseSchema))
+ .add(endpoint.get("getShareLink")`/share-links/${ShareLinkTokenParam}`.addSuccess(ShareLinkInfoResponseSchema))
+ .add(
+ endpoint.post("createShareLink")`/projects/by-key/${ProjectKeyParam}/share-links`
+ .setPayload(CreateShareLinkRequestSchema)
+ .addSuccess(CreateShareLinkResponseSchema, { status: 201 })
+ )
+ .add(endpoint.get("listShareLinks")`/projects/by-key/${ProjectKeyParam}/share-links`.addSuccess(ShareLinksListResponseSchema))
+ .add(endpoint.del("deleteShareLink")`/projects/by-key/${ProjectKeyParam}/share-links/${ShareLinkTokenParam}`.addSuccess(OkResponseSchema))
 
 export const DockerGitApi = HttpApi.make("docker-git")
  .annotate(OpenApi.Title, "docker-git API")

packages/api/src/api/schema.ts

@@ -392,3 +392,37 @@ export type ProjectPortForwardRequestInput = Schema.Schema.Type<typeof ProjectPo
 export type ProjectDatabaseProfileRequestInput = Schema.Schema.Type<typeof ProjectDatabaseProfileRequestSchema>
 export type CreateAgentRequestInput = Schema.Schema.Type<typeof CreateAgentRequestSchema>
 export type CreateFollowRequestInput = Schema.Schema.Type<typeof CreateFollowRequestSchema>
+
+export const CreateShareLinkRequestSchema = Schema.Struct({
+ ttlMs: Schema.optional(Schema.Number)
+})
+
+export const ShareLinkInfoSchema = Schema.Struct({
+ token: Schema.String,
+ projectKey: Schema.String,
+ projectDir: Schema.String,
+ displayName: Schema.String,
+ sshAlias: Schema.String,
+ sshConfigSnippet: Schema.String,
+ cfSshConfigSnippet: Schema.NullOr(Schema.String),
+ vscodeUri: Schema.String,
+ cfVscodeUri: Schema.NullOr(Schema.String),
+ workspacePath: Schema.String,
+ sshPassword: Schema.NullOr(Schema.String),
+ createdAt: Schema.String,
+ expiresAt: Schema.String
+})
+
+export const ShareLinkInfoResponseSchema = Schema.Struct({
+ link: ShareLinkInfoSchema
+})
+
+export const CreateShareLinkResponseSchema = Schema.Struct({
+ ok: Schema.Literal(true),
+ link: ShareLinkInfoSchema,
+ url: Schema.String
+})
+
+export const ShareLinksListResponseSchema = Schema.Struct({
+ links: Schema.Array(ShareLinkInfoSchema)
+})

packages/api/src/http.ts

@@ -38,6 +38,7 @@ import {
  ProjectPortForwardRequestSchema,
  ProjectPromptUpdateRequestSchema,
  ProjectSkillUpdateRequestSchema,
+ CreateShareLinkRequestSchema,
  StartProjectTerminalSessionRequestSchema,
  StartPanelCloudflareTunnelRequestSchema,
  StateCommitRequestSchema,
@@ -130,6 +131,24 @@ import {
  startPanelCloudflareTunnel,
  stopPanelCloudflareTunnel
 } from "./services/panel-cloudflare-tunnel.js"
+import {
+ createShareLink,
+ deleteShareLink,
+ listShareLinks,
+ resolveShareLink
+} from "./services/project-share-links.js"
+import {
+ getSshShareLinkTunnelHostname,
+ startSshShareLinkTunnel,
+ stopSshShareLinkTunnel
+} from "./services/ssh-share-link-tunnels.js"
+import { startSshProjectTunnel } from "./services/ssh-project-tunnels.js"
+import {
+ disableContainerPasswordAuth,
+ enableContainerPasswordAuth,
+ generateSshPassword
+} from "./services/ssh-password-setup.js"
+import { buildShareLinkSshAccess } from "@effect-template/lib/usecases/ssh-access"
 import {
  deleteProjectDatabaseForward,
  deleteProjectDatabaseProfile,
@@ -556,6 +575,13 @@ const skillScopeFromBody = (scope: string): ProjectSkillScope | null =>
 const readProjectPortForwardRequest = () => HttpServerRequest.schemaBodyJson(ProjectPortForwardRequestSchema)
 const readStartPanelCloudflareTunnelRequest = () =>
  HttpServerRequest.schemaBodyJson(StartPanelCloudflareTunnelRequestSchema)
+const readCreateShareLinkRequest = () =>
+ HttpServerRequest.schemaBodyJson(CreateShareLinkRequestSchema)
+
+const ShareLinkTokenParamsSchema = Schema.Struct({ token: Schema.String })
+const ShareLinkByProjectKeyParamsSchema = Schema.Struct({ projectKey: Schema.String, token: Schema.String })
+const shareLinkTokenParams = HttpRouter.schemaParams(ShareLinkTokenParamsSchema)
+const shareLinkByProjectKeyParams = HttpRouter.schemaParams(ShareLinkByProjectKeyParamsSchema)
 const readProjectDatabaseProfileRequest = () => HttpServerRequest.schemaBodyJson(ProjectDatabaseProfileRequestSchema)
 const readStateInitRequest = () => HttpServerRequest.schemaBodyJson(StateInitRequestSchema)
 const readStateCommitRequest = () => HttpServerRequest.schemaBodyJson(StateCommitRequestSchema)
@@ -1104,6 +1130,144 @@ export const makeRouter = () => {
  Effect.flatMap((tunnel) => jsonResponse({ tunnel }, 200)),
  Effect.catchAll(errorResponse)
  )
+ ),
+ HttpRouter.get(
+ "/share-links/:token",
+ Effect.gen(function*(_) {
+ const request = yield* _(HttpServerRequest.HttpServerRequest)
+ const { token } = yield* _(shareLinkTokenParams)
+ const projectsRoot = defaultProjectsRoot(process.cwd())
+ const link = yield* _(resolveShareLink(projectsRoot, token))
+ if (link === null) {
+ return yield* _(Effect.fail(new ApiNotFoundError({ message: `Share link not found or expired: ${token}` })))
+ }
+ const project = yield* _(getProjectItemByKey(link.projectKey))
+ const clientHost = new URL(request.url, "http://localhost").searchParams.get("host")
+ ?? resolvePortPublicHost(request)
+ ?? "localhost"
+ const sshCfHostname = getSshShareLinkTunnelHostname(link.token)
+ const sshAccess = buildShareLinkSshAccess({
+ containerName: project.containerName,
+ sshUser: project.sshUser,
+ sshPort: project.sshPort,
+ sshKeyPath: null,
+ targetDir: project.targetDir,
+ clientHost,
+ sshCfHostname
+ })
+ const shareLinkInfo = {
+ token: link.token,
+ projectKey: link.projectKey,
+ projectDir: link.projectDir,
+ displayName: project.displayName,
+ sshAlias: sshAccess.alias,
+ sshConfigSnippet: sshAccess.configSnippet,
+ cfSshConfigSnippet: sshAccess.cfConfigSnippet,
+ vscodeUri: sshAccess.vscodeUri,
+ cfVscodeUri: sshAccess.cfVscodeUri,
+ workspacePath: sshAccess.workspacePath,
+ sshPassword: link.sshPassword ?? null,
+ createdAt: link.createdAt,
+ expiresAt: link.expiresAt
+ }
+ return yield* _(jsonResponse({ link: shareLinkInfo }, 200))
+ }).pipe(Effect.catchAll(errorResponse))
+ ),
+ HttpRouter.post(
+ "/projects/by-key/:projectKey/share-links",
+ Effect.gen(function*(_) {
+ const request = yield* _(HttpServerRequest.HttpServerRequest)
+ const { projectKey } = yield* _(projectKeyParams)
+ const body = yield* _(readCreateShareLinkRequest())
+ const project = yield* _(getProjectItemByKey(projectKey))
+ const projectsRoot = defaultProjectsRoot(process.cwd())
+ const sshPassword = generateSshPassword()
+ yield* _(
+ enableContainerPasswordAuth(project.containerName, sshPassword).pipe(
+ Effect.orElse(() => Effect.void)
+ )
+ )
+ const link = yield* _(createShareLink(projectsRoot, project.projectDir, projectKey, sshPassword, body.ttlMs))
+ const clientHost = resolvePortPublicHost(request) ?? "localhost"
+ const sshCfHostname = yield* _(
+ startSshShareLinkTunnel(link.token, project.sshPort).pipe(
+ Effect.orElse(() => Effect.succeed(null))
+ )
+ )
+ const sshAccess = buildShareLinkSshAccess({
+ containerName: project.containerName,
+ sshUser: project.sshUser,
+ sshPort: project.sshPort,
+ sshKeyPath: null,
+ targetDir: project.targetDir,
+ clientHost,
+ sshCfHostname
+ })
+ const shareLinkInfo = {
+ token: link.token,
+ projectKey: link.projectKey,
+ projectDir: link.projectDir,
+ displayName: project.displayName,
+ sshAlias: sshAccess.alias,
+ sshConfigSnippet: sshAccess.configSnippet,
+ cfSshConfigSnippet: sshAccess.cfConfigSnippet,
+ vscodeUri: sshAccess.vscodeUri,
+ cfVscodeUri: sshAccess.cfVscodeUri,
+ workspacePath: sshAccess.workspacePath,
+ sshPassword,
+ createdAt: link.createdAt,
+ expiresAt: link.expiresAt
+ }
+ const url = `${resolveRequestOrigin(request)}/ssh/${encodeURIComponent(projectKey)}?t=${link.token}`
+ return yield* _(jsonResponse({ ok: true, link: shareLinkInfo, url }, 201))
+ }).pipe(Effect.catchAll(errorResponse))
+ ),
+ HttpRouter.get(
+ "/projects/by-key/:projectKey/share-links",
+ projectKeyParams.pipe(
+ Effect.flatMap(({ projectKey }) =>
+ Effect.gen(function*(_) {
+ const project = yield* _(getProjectItemByKey(projectKey))
+ const projectsRoot = defaultProjectsRoot(process.cwd())
+ const links = yield* _(listShareLinks(projectsRoot, project.projectDir))
+ return { links }
+ })
+ ),
+ Effect.flatMap((payload) => jsonResponse(payload, 200)),
+ Effect.catchAll(errorResponse)
+ )
+ ),
+ HttpRouter.del(
+ "/projects/by-key/:projectKey/share-links/:token",
+ shareLinkByProjectKeyParams.pipe(
+ Effect.flatMap(({ projectKey, token }) =>
+ Effect.gen(function*(_) {
+ const project = yield* _(getProjectItemByKey(projectKey))
+ const projectsRoot = defaultProjectsRoot(process.cwd())
+ yield* _(deleteShareLink(projectsRoot, project.projectDir, token))
+ yield* _(stopSshShareLinkTunnel(token))
+ const remaining = yield* _(listShareLinks(projectsRoot, project.projectDir))
+ if (remaining.length === 0) {
+ yield* _(disableContainerPasswordAuth(project.containerName))
+ }
+ })
+ ),
+ Effect.flatMap(() => jsonResponse({ ok: true }, 200)),
+ Effect.catchAll(errorResponse)
+ )
+ ),
+ HttpRouter.post(
+ "/projects/by-key/:projectKey/ssh-tunnel",
+ Effect.gen(function*(_) {
+ const { projectKey } = yield* _(projectKeyParams)
+ const project = yield* _(getProjectItemByKey(projectKey))
+ const result = yield* _(
+ startSshProjectTunnel(projectKey, project.sshPort, project.containerName).pipe(
+ Effect.orElse(() => Effect.succeed({ hostname: null, sshPassword: "" }))
+ )
+ )
+ return yield* _(jsonResponse(result, 200))
+ }).pipe(Effect.catchAll(errorResponse))
  )
  )