Rename and add browser target update

2026-06-10 09:33:15 +00:00 · 2026-06-07 12:07:08 -07:00
parent c394490473
commit 8daf7c2872
7 changed files with 259 additions and 76 deletions
--- a/server/lib/blueprints/applyBlueprint.ts
+++ b/server/lib/blueprints/applyBlueprint.ts
@@ -10,16 +10,22 @@ import {
    clientSiteResources
 } from "@server/db";
 import { Config, ConfigSchema } from "./types";
-import { ProxyResourcesResults, updateProxyResources } from "./proxyResources";
+import {
+    PublicResourcesResults,
+    updatePublicResources
+} from "./publicResources";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { sites } from "@server/db";
 import { eq, and, isNotNull } from "drizzle-orm";
-import { addTargets as addProxyTargets } from "@server/routers/newt/targets";
+import {
+    addTargets as addProxyTargets,
+    sendBrowserGatewayTargets
+} from "@server/routers/newt/targets";
 import {
    ClientResourcesResults,
-    updateClientResources
-} from "./clientResources";
+    updatePrivateResources
+} from "./privateResources";
 import { updateResourcePolicies } from "./resourcePolicies";
 import { BlueprintSource } from "@server/routers/blueprints/types";
 import { stringify as stringifyYaml } from "yaml";
@@ -54,18 +60,18 @@ export async function applyBlueprint({
    let error: any | null = null;

    try {
-        let proxyResourcesResults: ProxyResourcesResults = [];
+        let proxyResourcesResults: PublicResourcesResults = [];
        let clientResourcesResults: ClientResourcesResults = [];
        await db.transaction(async (trx) => {
            await updateResourcePolicies(orgId, config, trx);

-            proxyResourcesResults = await updateProxyResources(
+            proxyResourcesResults = await updatePublicResources(
                orgId,
                config,
                trx,
                siteId
            );
-            clientResourcesResults = await updateClientResources(
+            clientResourcesResults = await updatePrivateResources(
                orgId,
                config,
                trx,
@@ -104,13 +110,27 @@ export async function applyBlueprint({
                                (hc) => hc.targetId === target.targetId
                            );

-                        await addProxyTargets(
-                            site.newt.newtId,
-                            [target],
-                            matchingHealthcheck ? [matchingHealthcheck] : [],
-                            result.proxyResource.mode === "udp" ? "udp" : "tcp",
-                            site.newt.version
-                        );
+                        if (["http", "tcp", "udp"].includes(target.mode)) {
+                            await addProxyTargets(
+                                site.newt.newtId,
+                                [target],
+                                matchingHealthcheck
+                                    ? [matchingHealthcheck]
+                                    : [],
+                                result.proxyResource.mode === "udp"
+                                    ? "udp"
+                                    : "tcp",
+                                site.newt.version
+                            );
+                        } else if (
+                            ["ssh", "rdp", "vnc"].includes(target.mode)
+                        ) {
+                            await sendBrowserGatewayTargets(
+                                site.newt.newtId,
+                                [target],
+                                site.newt.version
+                            );
+                        }
                    }
                }
            }
--- a/server/lib/blueprints/privateResources.ts
+++ b/server/lib/blueprints/privateResources.ts
@@ -105,7 +105,7 @@ export type ClientResourcesResults = {
    oldSites: { siteId: number }[];
 }[];

-export async function updateClientResources(
+export async function updatePrivateResources(
    orgId: string,
    config: Config,
    trx: Transaction,
--- a/server/lib/blueprints/publicResources.ts
+++ b/server/lib/blueprints/publicResources.ts
@@ -52,19 +52,19 @@ import { encrypt } from "@server/lib/crypto";
 import { generateId } from "@server/auth/sessions/app";
 import serverConfig from "@server/lib/config";

-export type ProxyResourcesResults = {
+export type PublicResourcesResults = {
    proxyResource: Resource;
    targetsToUpdate: Target[];
    healthchecksToUpdate: TargetHealthCheck[];
 }[];

-export async function updateProxyResources(
+export async function updatePublicResources(
    orgId: string,
    config: Config,
    trx: Transaction,
    siteId?: number
-): Promise<ProxyResourcesResults> {
-    const results: ProxyResourcesResults = [];
+): Promise<PublicResourcesResults> {
+    const results: PublicResourcesResults = [];

    for (const [resourceNiceId, resourceData] of Object.entries(
        config["proxy-resources"]
--- a/src/app/rdp/RdpClient.tsx
+++ b/src/app/rdp/RdpClient.tsx
@@ -37,6 +37,10 @@ import BrandedAuthSurface from "@app/components/BrandedAuthSurface";
 import PoweredByPangolin from "@app/components/PoweredByPangolin";
 import AuthPageFooterNotices from "@app/components/AuthPageFooterNotices";
 import { useTranslations } from "next-intl";
+import {
+    loadEncryptedLocalStorage,
+    saveEncryptedLocalStorage
+} from "@app/lib/secureLocalStorage";

 declare module "react" {
    namespace JSX {
@@ -63,22 +67,14 @@ type RdpCredentialsForm = {
    enableClipboard: boolean;
 };

-function loadStoredCredentials(key: string): RdpCredentialsForm {
-    try {
-        const saved = localStorage.getItem(key);
-        if (saved) return JSON.parse(saved) as RdpCredentialsForm;
-    } catch {
-        // ignore
-    }
-    return {
-        username: "",
-        password: "",
-        domain: "",
-        kdcProxyUrl: "",
-        pcb: "",
-        enableClipboard: true
-    };
-}
+const DEFAULT_RDP_CREDENTIALS: RdpCredentialsForm = {
+    username: "",
+    password: "",
+    domain: "",
+    kdcProxyUrl: "",
+    pcb: "",
+    enableClipboard: true
+};

 const isIronError = (error: unknown): error is IronError => {
    return (
@@ -113,9 +109,25 @@ export default function RdpClient({

    const form = useForm<RdpCredentialsForm>({
        resolver: zodResolver(formSchema),
-        defaultValues: loadStoredCredentials(STORAGE_KEY)
+        defaultValues: DEFAULT_RDP_CREDENTIALS
    });

+    useEffect(() => {
+        let cancelled = false;
+
+        void loadEncryptedLocalStorage<RdpCredentialsForm>(
+            STORAGE_KEY,
+            target?.authToken
+        ).then((saved) => {
+            if (cancelled || !saved) return;
+            form.reset({ ...DEFAULT_RDP_CREDENTIALS, ...saved });
+        });
+
+        return () => {
+            cancelled = true;
+        };
+    }, [form, target?.authToken]);
+
    const [showLogin, setShowLogin] = useState(true);
    const [moduleReady, setModuleReady] = useState(false);
    const [connecting, setConnecting] = useState(false);
@@ -293,11 +305,11 @@ export default function RdpClient({
        try {
            const sessionInfo = await userInteraction.connect(builder.build());

-            try {
-                localStorage.setItem(STORAGE_KEY, JSON.stringify(values));
-            } catch {
-                // ignore
-            }
+            void saveEncryptedLocalStorage(
+                STORAGE_KEY,
+                values,
+                target.authToken
+            );
            setConnecting(false);
            setShowLogin(false);
            userInteraction.setVisibility(true);
--- a/src/app/ssh/SshClient.tsx
+++ b/src/app/ssh/SshClient.tsx
@@ -32,6 +32,10 @@ import { useTranslations } from "next-intl";
 import BrandedAuthSurface from "@app/components/BrandedAuthSurface";
 import PoweredByPangolin from "@app/components/PoweredByPangolin";
 import AuthPageFooterNotices from "@app/components/AuthPageFooterNotices";
+import {
+    loadEncryptedLocalStorage,
+    saveEncryptedLocalStorage
+} from "@app/lib/secureLocalStorage";

 type AuthTab = "password" | "privateKey";

@@ -48,15 +52,11 @@ type ConnectCredentials = {
    certificate?: string;
 };

-function loadStoredCredentials(key: string): SshCredentialsForm {
-    try {
-        const saved = localStorage.getItem(key);
-        if (saved) return JSON.parse(saved) as SshCredentialsForm;
-    } catch {
-        // ignore
-    }
-    return { username: "", password: "", privateKey: "" };
-}
+const DEFAULT_SSH_CREDENTIALS: SshCredentialsForm = {
+    username: "",
+    password: "",
+    privateKey: ""
+};

 export default function SshClient({
    target,
@@ -86,9 +86,25 @@ export default function SshClient({
    });

    const form = useForm<SshCredentialsForm>({
-        defaultValues: loadStoredCredentials(STORAGE_KEY)
+        defaultValues: DEFAULT_SSH_CREDENTIALS
    });

+    useEffect(() => {
+        let cancelled = false;
+
+        void loadEncryptedLocalStorage<SshCredentialsForm>(
+            STORAGE_KEY,
+            target?.authToken
+        ).then((saved) => {
+            if (cancelled || !saved) return;
+            form.reset({ ...DEFAULT_SSH_CREDENTIALS, ...saved });
+        });
+
+        return () => {
+            cancelled = true;
+        };
+    }, [form, target?.authToken]);
+
    function handleKeyFile(e: React.ChangeEvent<HTMLInputElement>) {
        const file = e.target.files?.[0];
        if (!file) return;
@@ -252,14 +268,11 @@ export default function SshClient({
                })
            );
            if (!override) {
-                try {
-                    localStorage.setItem(
-                        STORAGE_KEY,
-                        JSON.stringify(form.getValues())
-                    );
-                } catch {
-                    // ignore
-                }
+                void saveEncryptedLocalStorage(
+                    STORAGE_KEY,
+                    form.getValues(),
+                    target.authToken
+                );
            }
        };

@@ -625,7 +638,7 @@ export default function SshClient({

            {connected && (
                <div className="fixed inset-0 z-50 flex flex-col bg-neutral-900">
-                    <div className="flex flex-wrap items-center gap-2 bg-black p-2 text-white">
+                    {/* <div className="flex flex-wrap items-center gap-2 bg-black p-2 text-white">
                        <Button
                            size="sm"
                            variant="destructive"
@@ -633,7 +646,7 @@ export default function SshClient({
                        >
                            {t("sshTerminate")}
                        </Button>
-                    </div>
+                    </div> */}
                    <div
                        ref={terminalRef}
                        className="flex-1 overflow-hidden"
--- a/src/app/vnc/VncClient.tsx
+++ b/src/app/vnc/VncClient.tsx
@@ -28,20 +28,18 @@ import BrandedAuthSurface from "@app/components/BrandedAuthSurface";
 import PoweredByPangolin from "@app/components/PoweredByPangolin";
 import AuthPageFooterNotices from "@app/components/AuthPageFooterNotices";
 import { useTranslations } from "next-intl";
+import {
+    loadEncryptedLocalStorage,
+    saveEncryptedLocalStorage
+} from "@app/lib/secureLocalStorage";

 type VncCredentialsForm = {
    password: string;
 };

-function loadStoredCredentials(key: string): VncCredentialsForm {
-    try {
-        const saved = localStorage.getItem(key);
-        if (saved) return JSON.parse(saved) as VncCredentialsForm;
-    } catch {
-        // ignore
-    }
-    return { password: "" };
-}
+const DEFAULT_VNC_CREDENTIALS: VncCredentialsForm = {
+    password: ""
+};

 export default function VncClient({
    target,
@@ -62,9 +60,25 @@ export default function VncClient({

    const form = useForm<VncCredentialsForm>({
        resolver: zodResolver(formSchema),
-        defaultValues: loadStoredCredentials(STORAGE_KEY)
+        defaultValues: DEFAULT_VNC_CREDENTIALS
    });

+    useEffect(() => {
+        let cancelled = false;
+
+        void loadEncryptedLocalStorage<VncCredentialsForm>(
+            STORAGE_KEY,
+            target?.authToken
+        ).then((saved) => {
+            if (cancelled || !saved) return;
+            form.reset({ ...DEFAULT_VNC_CREDENTIALS, ...saved });
+        });
+
+        return () => {
+            cancelled = true;
+        };
+    }, [form, target?.authToken]);
+
    const [connected, setConnected] = useState(false);
    const [connectError, setConnectError] = useState<string | null>(null);
    const rfbRef = useRef<any>(null);
@@ -132,11 +146,11 @@ export default function VncClient({
        rfb.resizeSession = true;

        rfb.addEventListener("connect", () => {
-            try {
-                localStorage.setItem(STORAGE_KEY, JSON.stringify(values));
-            } catch {
-                // ignore
-            }
+            void saveEncryptedLocalStorage(
+                STORAGE_KEY,
+                values,
+                target.authToken
+            );
            setConnected(true);
        });

--- a/src/lib/secureLocalStorage.ts
+++ b/src/lib/secureLocalStorage.ts
@@ -0,0 +1,124 @@
+type EncryptedStorageEnvelope = {
+    v: 1;
+    s: string;
+    i: string;
+    d: string;
+};
+
+const PBKDF2_ITERATIONS = 120000;
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+    return bytes.buffer.slice(
+        bytes.byteOffset,
+        bytes.byteOffset + bytes.byteLength
+    ) as ArrayBuffer;
+}
+
+function bytesToBase64(bytes: Uint8Array): string {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+
+function base64ToBytes(value: string): Uint8Array {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+
+async function deriveKey(authToken: string, salt: ArrayBuffer) {
+    const subtle = window.crypto?.subtle;
+    if (!subtle) {
+        throw new Error("Web Crypto is unavailable");
+    }
+
+    const tokenKey = await subtle.importKey(
+        "raw",
+        toArrayBuffer(new TextEncoder().encode(authToken)),
+        "PBKDF2",
+        false,
+        ["deriveKey"]
+    );
+
+    return subtle.deriveKey(
+        {
+            name: "PBKDF2",
+            salt,
+            iterations: PBKDF2_ITERATIONS,
+            hash: "SHA-256"
+        },
+        tokenKey,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["encrypt", "decrypt"]
+    );
+}
+
+export async function saveEncryptedLocalStorage<T>(
+    storageKey: string,
+    value: T,
+    authToken: string | null | undefined
+) {
+    if (typeof window === "undefined") return;
+    if (!authToken) {
+        window.localStorage.removeItem(storageKey);
+        return;
+    }
+
+    const salt = window.crypto.getRandomValues(new Uint8Array(16));
+    const iv = window.crypto.getRandomValues(new Uint8Array(12));
+    const key = await deriveKey(authToken, toArrayBuffer(salt));
+    const plaintext = new TextEncoder().encode(JSON.stringify(value));
+    const encrypted = await window.crypto.subtle.encrypt(
+        { name: "AES-GCM", iv: toArrayBuffer(iv) },
+        key,
+        toArrayBuffer(plaintext)
+    );
+
+    const payload: EncryptedStorageEnvelope = {
+        v: 1,
+        s: bytesToBase64(salt),
+        i: bytesToBase64(iv),
+        d: bytesToBase64(new Uint8Array(encrypted))
+    };
+
+    window.localStorage.setItem(storageKey, JSON.stringify(payload));
+}
+
+export async function loadEncryptedLocalStorage<T>(
+    storageKey: string,
+    authToken: string | null | undefined
+): Promise<T | null> {
+    if (typeof window === "undefined") return null;
+    if (!authToken) return null;
+
+    const raw = window.localStorage.getItem(storageKey);
+    if (!raw) return null;
+
+    try {
+        const payload = JSON.parse(raw) as EncryptedStorageEnvelope;
+        if (payload.v !== 1 || !payload.s || !payload.i || !payload.d) {
+            throw new Error("Invalid encrypted payload");
+        }
+
+        const salt = base64ToBytes(payload.s);
+        const iv = base64ToBytes(payload.i);
+        const data = base64ToBytes(payload.d);
+        const key = await deriveKey(authToken, toArrayBuffer(salt));
+        const decrypted = await window.crypto.subtle.decrypt(
+            { name: "AES-GCM", iv: toArrayBuffer(iv) },
+            key,
+            toArrayBuffer(data)
+        );
+        const json = new TextDecoder().decode(decrypted);
+        return JSON.parse(json) as T;
+    } catch {
+        window.localStorage.removeItem(storageKey);
+        return null;
+    }
+}