Merge branch 'dev' into local-connection

install/main.go

@@ -76,7 +76,7 @@ var redisFlag *bool
 func main() {
 
 	crowdsecFlag := flag.Bool("crowdsec", false, "Enable the CrowdSec installation prompt")
-	redisFlag = flag.Bool("redis", false, "Install Redis as cacheing solution. Required for HA. Not required for the Enterprise version.")
+	redisFlag = flag.Bool("redis", false, "Install Redis as caching solution. Required for HA. Not required for the Enterprise version.")
 	flag.Parse()
 
 	// print a banner about prerequisites - opening port 80, 443, 51820, and 21820 on the VPS and firewall and pointing your domain to the VPS IP with a records. Docs are at http://localhost:3000/Getting%20Started/dns-networking

server/db/pg/schema/schema.ts

@@ -107,6 +107,7 @@ export const sites = pgTable(
         lastPing: integer("lastPing"),
         address: varchar("address"),
         endpoint: varchar("endpoint"),
+        localEndpoints: varchar("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
         publicKey: varchar("publicKey"),
         lastHolePunch: bigint("lastHolePunch", { mode: "number" }),
         listenPort: integer("listenPort"),

server/db/sqlite/schema/schema.ts

@@ -118,6 +118,7 @@ export const sites = sqliteTable("sites", {
     // exit node stuff that is how to connect to the site when it has a wg server
     address: text("address"), // this is the address of the wireguard interface in newt
     endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
+    localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
     publicKey: text("publicKey"), // TODO: Fix typo in publicKey
     lastHolePunch: integer("lastHolePunch"),
     listenPort: integer("listenPort"),

server/routers/auth/logout.ts

@@ -16,18 +16,26 @@ export async function logout(
     next: NextFunction
 ): Promise<any> {
     const { user, session } = await verifySession(req);
+    const isSecure = req.protocol === "https";
+
+    // Always clear the session cookie so logout is idempotent, even when
+    // the session is already missing or invalid
+    res.setHeader("Set-Cookie", createBlankSessionTokenCookie(isSecure));
+
     if (!user || !session) {
         if (config.getRawConfig().app.log_failed_attempts) {
             logger.info(
-                `Log out failed because missing or invalid session. IP: ${req.ip}.`
+                `Log out with missing or invalid session. IP: ${req.ip}.`
             );
         }
-        return next(
+
-            createHttpError(
+        return response<null>(res, {
-                HttpCode.BAD_REQUEST,
+            data: null,
-                "You must be logged in to sign out"
+            success: true,
-            )
+            error: false,
-        );
+            message: "Logged out successfully",
+            status: HttpCode.OK
+        });
     }
 
     try {
@@ -37,9 +45,6 @@ export async function logout(
             logger.error("Failed to invalidate session", error);
         }
 
-        const isSecure = req.protocol === "https";
-        res.setHeader("Set-Cookie", createBlankSessionTokenCookie(isSecure));
-
         return response<null>(res, {
             data: null,
             success: true,

server/routers/newt/handleNewtGetConfigMessage.ts

@@ -29,7 +29,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         return;
     }
 
-    const { publicKey, port, chainId } = message.data;
+    const { publicKey, port, localEndpoints, chainId } = message.data;
     const siteId = newt.siteId;
 
     // Get the current site data
@@ -69,7 +69,10 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         .update(sites)
         .set({
             publicKey,
-            listenPort: port
+            listenPort: port,
+            localEndpoints: localEndpoints
+                ? JSON.stringify(localEndpoints)
+                : null
         })
         .where(eq(sites.siteId, siteId))
         .returning();

server/routers/olm/buildConfiguration.ts

@@ -30,6 +30,7 @@ export async function buildSiteConfigurationForOlmClient(
         siteId: number;
         name?: string;
         endpoint?: string;
+        localEndpoints?: string[];
         publicKey?: string;
         serverIP?: string | null;
         serverPort?: number | null;
@@ -206,6 +207,9 @@ export async function buildSiteConfigurationForOlmClient(
             name: site.name,
             // relayEndpoint: relayEndpoint, // this can be undefined now if not relayed // lets not do this for now because it would conflict with the hole punch testing
             endpoint: site.endpoint,
+            localEndpoints: site.localEndpoints
+                ? JSON.parse(site.localEndpoints)
+                : undefined,
             publicKey: site.publicKey,
             serverIP: site.address,
             serverPort: site.listenPort,

server/routers/olm/handleOlmLocalMessage.ts

@@ -0,0 +1,74 @@
+import { db, sites } from "@server/db";
+import { MessageHandler } from "@server/routers/ws";
+import { clients, Olm } from "@server/db";
+import { and, eq } from "drizzle-orm";
+import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import logger from "@server/logger";
+
+export const handleOlmLocalMessage: MessageHandler = async (context) => {
+    const { message, client: c, sendToClient } = context;
+    const olm = c as Olm;
+
+    logger.info("Handling local olm message!");
+
+    if (!olm) {
+        logger.warn("Olm not found");
+        return;
+    }
+
+    if (!olm.clientId) {
+        logger.warn("Olm has no client!");
+        return;
+    }
+
+    const clientId = olm.clientId;
+
+    const [client] = await db
+        .select()
+        .from(clients)
+        .where(eq(clients.clientId, clientId))
+        .limit(1);
+
+    if (!client) {
+        logger.warn("Client not found");
+        return;
+    }
+
+    // make sure we hand endpoints for both the site and the client and the lastHolePunch is not too old
+    if (!client.pubKey) {
+        logger.warn("Client has no endpoint or listen port");
+        return;
+    }
+
+    const { siteId, chainId } = message.data;
+
+    // Get the site
+    const [site] = await db
+        .select()
+        .from(sites)
+        .where(eq(sites.siteId, siteId))
+        .limit(1);
+
+    if (!site || !site.exitNodeId) {
+        logger.warn("Site not found or has no exit node");
+        return;
+    }
+
+    // update the peer on the newt
+    await newtUpdatePeer(siteId, client.pubKey, {
+        endpoint: "" // this removes the endpoint so the newt knows to accept local
+    });
+
+    // Just ack the message, we don't keep sending it
+    return {
+        message: {
+            type: "olm/wg/peer/local",
+            data: {
+                siteId: siteId,
+                chainId
+            }
+        },
+        broadcast: false,
+        excludeSender: false
+    };
+};

server/routers/olm/handleOlmRelayMessage.ts

@@ -79,9 +79,9 @@ export const handleOlmRelayMessage: MessageHandler = async (context) => {
             )
         );
 
-    // update the peer on the exit node
+    // update the peer on the newt
     await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: "" // this removes the endpoint so the exit node knows to relay
+        endpoint: "" // this removes the endpoint so the newt knows to relay
     });
 
     return {

server/routers/olm/handleOlmServerPeerAddMessage.ts

@@ -3,24 +3,15 @@ import {
     db,
     networks,
     siteNetworks,
-    siteResources,
+    siteResources
 } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
-import {
+import { clients, clientSitesAssociationsCache, Olm, sites } from "@server/db";
-    clients,
-    clientSitesAssociationsCache,
-    Olm,
-    sites
-} from "@server/db";
 import { and, eq, inArray, isNotNull, isNull } from "drizzle-orm";
 import logger from "@server/logger";
-import {
+import { generateAliasConfig } from "@server/lib/ip";
-    generateAliasConfig,
-} from "@server/lib/ip";
 import { generateRemoteSubnets } from "@server/lib/ip";
-import {
+import { addPeer as newtAddPeer } from "@server/routers/newt/peers";
-    addPeer as newtAddPeer,
-} from "@server/routers/newt/peers";
 
 export const handleOlmServerPeerAddMessage: MessageHandler = async (
     context
@@ -135,10 +126,7 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                 clientSiteResourcesAssociationsCache.siteResourceId
             )
         )
-        .innerJoin(
+        .innerJoin(networks, eq(siteResources.networkId, networks.networkId))
-            networks,
-            eq(siteResources.networkId, networks.networkId)
-        )
         .innerJoin(
             siteNetworks,
             and(
@@ -147,10 +135,7 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
             )
         )
         .where(
-            eq(
+            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
-                clientSiteResourcesAssociationsCache.clientId,
-                client.clientId
-            )
         );
 
     // Return connect message with all site configurations
@@ -161,6 +146,9 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                 siteId: site.siteId,
                 name: site.name,
                 endpoint: site.endpoint,
+                localEndpoints: site.localEndpoints
+                    ? JSON.parse(site.localEndpoints)
+                    : undefined,
                 publicKey: site.publicKey,
                 serverIP: site.address,
                 serverPort: site.listenPort,
@@ -170,7 +158,7 @@ export const handleOlmServerPeerAddMessage: MessageHandler = async (
                 aliases: generateAliasConfig(
                     allSiteResources.map(({ siteResources }) => siteResources)
                 ),
-                chainId: chainId,
+                chainId: chainId
             }
         },
         broadcast: false,

server/routers/olm/handleOlmUnLocalMessage.ts

@@ -0,0 +1,95 @@
+import { db, exitNodes, sites } from "@server/db";
+import { MessageHandler } from "@server/routers/ws";
+import { clients, clientSitesAssociationsCache, Olm } from "@server/db";
+import { and, eq } from "drizzle-orm";
+import { updatePeer as newtUpdatePeer } from "../newt/peers";
+import logger from "@server/logger";
+
+export const handleOlmUnLocalMessage: MessageHandler = async (context) => {
+    const { message, client: c, sendToClient } = context;
+    const olm = c as Olm;
+
+    logger.info("Handling unlocal olm message!");
+
+    if (!olm) {
+        logger.warn("Olm not found");
+        return;
+    }
+
+    if (!olm.clientId) {
+        logger.warn("Olm has no client!");
+        return;
+    }
+
+    const clientId = olm.clientId;
+
+    const [client] = await db
+        .select()
+        .from(clients)
+        .where(eq(clients.clientId, clientId))
+        .limit(1);
+
+    if (!client) {
+        logger.warn("Client not found");
+        return;
+    }
+
+    // make sure we hand endpoints for both the site and the client and the lastHolePunch is not too old
+    if (!client.pubKey) {
+        logger.warn("Client has no endpoint or listen port");
+        return;
+    }
+
+    const { siteId, chainId } = message.data;
+
+    // Get the site
+    const [site] = await db
+        .select()
+        .from(sites)
+        .where(eq(sites.siteId, siteId))
+        .limit(1);
+
+    if (!site) {
+        logger.warn("Site not found or has no exit node");
+        return;
+    }
+
+    const [clientSiteAssociation] = await db
+        .select()
+        .from(clientSitesAssociationsCache)
+        .where(
+            and(
+                eq(clientSitesAssociationsCache.clientId, olm.clientId),
+                eq(clientSitesAssociationsCache.siteId, siteId)
+            )
+        );
+
+    if (!clientSiteAssociation) {
+        logger.warn("Client-Site association not found");
+        return;
+    }
+
+    if (!clientSiteAssociation.endpoint) {
+        logger.warn("Client-Site association has no endpoint, cannot unrelay");
+        return;
+    }
+
+    // update the peer on the newt
+    await newtUpdatePeer(siteId, client.pubKey, {
+        endpoint: clientSiteAssociation.isRelayed
+            ? ""
+            : clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
+    });
+
+    return {
+        message: {
+            type: "olm/wg/peer/unlocal",
+            data: {
+                siteId: siteId,
+                chainId
+            }
+        },
+        broadcast: false,
+        excludeSender: false
+    };
+};

server/routers/olm/handleOlmUnRelayMessage.ts

@@ -77,9 +77,9 @@ export const handleOlmUnRelayMessage: MessageHandler = async (context) => {
         return;
     }
 
-    // update the peer on the exit node
+    // update the peer on the newt
     await newtUpdatePeer(siteId, client.pubKey, {
-        endpoint: clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the exit node
+        endpoint: clientSiteAssociation.endpoint // this is the endpoint of the client to connect directly to the newt
     });
 
     return {

server/routers/olm/index.ts

@@ -13,3 +13,5 @@ export * from "./recoverOlmWithFingerprint";
 export * from "./handleOlmDisconnectingMessage";
 export * from "./handleOlmServerInitAddPeerHandshake";
 export * from "./offlineChecker";
+export * from "./handleOlmUnLocalMessage";
+export * from "./handleOlmLocalMessage";

server/routers/olm/peers.ts

@@ -18,6 +18,7 @@ export async function addPeer(
         serverPort: number | null;
         remoteSubnets: string[] | null; // optional, comma-separated list of subnets that this site can access
         aliases: Alias[];
+        localEndpoints?: string[]; // optional, list of local endpoints for the peer
     },
     olmId?: string,
     version?: string | null
@@ -44,6 +45,7 @@ export async function addPeer(
                 name: peer.name,
                 publicKey: peer.publicKey,
                 endpoint: peer.endpoint,
+                localEndpoints: peer.localEndpoints,
                 relayEndpoint: peer.relayEndpoint,
                 serverIP: peer.serverIP,
                 serverPort: peer.serverPort,

server/routers/ws/messageHandlers.ts

@@ -20,7 +20,9 @@ import {
     handleOlmServerPeerAddMessage,
     handleOlmUnRelayMessage,
     handleOlmDisconnectingMessage,
-    handleOlmServerInitAddPeerHandshake
+    handleOlmServerInitAddPeerHandshake,
+    handleOlmLocalMessage,
+    handleOlmUnLocalMessage
 } from "../olm";
 import { handleHealthcheckStatusMessage } from "../target";
 import { handleRoundTripMessage } from "./handleRoundTripMessage";
@@ -32,6 +34,8 @@ export const messageHandlers: Record<string, MessageHandler> = {
     "olm/wg/register": handleOlmRegisterMessage,
     "olm/wg/relay": handleOlmRelayMessage,
     "olm/wg/unrelay": handleOlmUnRelayMessage,
+    "olm/wg/local": handleOlmLocalMessage,
+    "olm/wg/unlocal": handleOlmUnLocalMessage,
     "olm/ping": handleOlmPingMessage,
     "olm/disconnecting": handleOlmDisconnectingMessage,
     "newt/disconnecting": handleNewtDisconnectingMessage,

src/actions/server.ts

@@ -248,6 +248,39 @@ export async function loginProxy(
     return await makeApiRequest<LoginResponse>(url, "POST", request);
 }
 
+export async function logoutProxy(): Promise<ResponseT<null>> {
+    const env = pullEnv();
+    const serverPort = process.env.SERVER_EXTERNAL_PORT;
+    const url = `http://localhost:${serverPort}/api/v1/auth/logout`;
+
+    const result = await makeApiRequest<null>(url, "POST");
+
+    try {
+        const headersList = await reqHeaders();
+        const host = headersList.get("host")?.split(":")[0];
+        const allCookies = await cookies();
+        const clearOptions = {
+            httpOnly: true,
+            secure: true,
+            sameSite: "lax" as const,
+            path: "/",
+            maxAge: 0
+        };
+        // Clear both host-only and domain-scoped variants.
+        allCookies.set(env.server.sessionCookieName, "", clearOptions);
+        if (host) {
+            allCookies.set(env.server.sessionCookieName, "", {
+                ...clearOptions,
+                domain: host
+            });
+        }
+    } catch (cookieError) {
+        console.error("Failed to clear session cookie:", cookieError);
+    }
+
+    return result;
+}
+
 export async function securityKeyStartProxy(
     request: SecurityKeyStartRequest,
     forceLogin?: boolean

src/components/OrgPolicyRequired.tsx

@@ -12,8 +12,8 @@ import { Shield, ArrowRight } from "lucide-react";
 import Link from "next/link";
 import { useTranslations } from "next-intl";
 import { useRouter } from "next/navigation";
-import { createApiClient } from "@app/lib/api";
+import { useState } from "react";
-import { useEnvContext } from "@app/hooks/useEnvContext";
+import { logoutProxy } from "@app/actions/server";
 
 type OrgPolicyRequiredProps = {
     orgId: string;
@@ -40,21 +40,23 @@ export default function OrgPolicyRequired({
 }: OrgPolicyRequiredProps) {
     const t = useTranslations();
     const router = useRouter();
-
+    const [loading, setLoading] = useState(false);
-    const api = createApiClient(useEnvContext());
 
     const sessionExpired =
         policies?.maxSessionLength &&
         policies.maxSessionLength.compliant === false;
 
-    function reauthenticate() {
+    async function reauthenticate() {
-        api.post("/auth/logout")
+        setLoading(true);
-            .catch(() => {})
+        try {
-            .then(() => {
+            await logoutProxy();
-                const destination = redirectAfterAuth ?? `/${orgId}`;
+        } catch (error) {
-                router.push(destination);
+            console.error("Error during logout:", error);
-                router.refresh();
+        } finally {
-            });
+            const destination = redirectAfterAuth ?? `/${orgId}`;
+            router.push(destination);
+            router.refresh();
+        }
     }
 
     if (sessionExpired) {
@@ -76,6 +78,7 @@ export default function OrgPolicyRequired({
                         <Button
                             className="w-full"
                             onClick={reauthenticate}
+                            loading={loading}
                         >
                             {t("reauthenticate")}
                             <ArrowRight className="ml-2 h-4 w-4" />