chore: Move API source code to API folder.

api/src/backendimpl/base.ts

@@ -0,0 +1,59 @@
+export type ParameterReturnedValue = { 
+  success: boolean,
+  message?: string
+}
+
+export type ForwardRule = {
+  sourceIP: string,
+  sourcePort: number,
+  destPort: number
+};
+
+export type ConnectedClient = {
+  ip: string,
+  port: number,
+  
+  connectionDetails: ForwardRule
+};
+
+export class BackendBaseClass {
+  state: "stopped" | "stopping" | "started" | "starting";
+
+  clients?: ConnectedClient[]; // Not required to be implemented, but more consistency
+  logs: string[];
+
+  constructor(parameters: string) {
+    this.logs = [];
+    this.clients = [];
+    
+    this.state = "stopped";
+  }
+
+  addConnection(sourceIP: string, sourcePort: number, destPort: number, protocol: "tcp" | "udp"): void {};
+  removeConnection(sourceIP: string, sourcePort: number, destPort: number, protocol: "tcp" | "udp"): void {};
+
+  async start(): Promise<boolean> {
+    return true;
+  }
+
+  async stop(): Promise<boolean> {
+    return true;
+  };
+
+  getAllConnections(): ConnectedClient[] {
+    if (this.clients == null) return [];
+    return this.clients;
+  };
+
+  static checkParametersConnection(sourceIP: string, sourcePort: number, destPort: number, protocol: "tcp" | "udp"): ParameterReturnedValue {
+    return {
+      success: true
+    }
+  };
+
+  static checkParametersBackendInstance(data: string): ParameterReturnedValue {
+    return {
+      success: true
+    }
+  };
+}

api/src/backendimpl/index.ts

@@ -0,0 +1,6 @@
+import type { BackendBaseClass } from "./base.js";
+import { SSHBackendProvider } from "./ssh.js";
+
+export const backendProviders: Record<string, typeof BackendBaseClass> = {
+  "ssh": SSHBackendProvider
+};

api/src/backendimpl/ssh.ts

@@ -0,0 +1,215 @@
+import { NodeSSH } from "node-ssh";
+import { Socket } from "node:net";
+
+import type { BackendBaseClass, ForwardRule, ConnectedClient, ParameterReturnedValue } from "./base.js";
+
+type ForwardRuleExt = ForwardRule & {
+  enabled: boolean
+}
+
+// Fight me (for better naming)
+type BackendParsedProviderString = {
+  ip:         string,
+  port:       number,
+
+  username:   string,
+  privateKey: string
+}
+
+function parseBackendProviderString(data: string): BackendParsedProviderString {
+  try {
+    JSON.parse(data);
+  } catch (e) {
+    throw new Error("Payload body is not JSON")
+  }
+
+  const jsonData = JSON.parse(data);
+
+  if (typeof jsonData.ip != "string") throw new Error("IP field is not a string");
+  if (typeof jsonData.port != "number") throw new Error("Port is not a number");
+
+  if (typeof jsonData.username != "string") throw new Error("Username is not a string");
+  if (typeof jsonData.privateKey != "string") throw new Error("Private key is not a string");
+  
+  return {
+    ip: jsonData.ip,
+    port: jsonData.port,
+    
+    username: jsonData.username,
+    privateKey: jsonData.privateKey
+  }
+}
+
+export class SSHBackendProvider implements BackendBaseClass {
+  state: "stopped" | "stopping" | "started" | "starting";
+
+  clients: ConnectedClient[];
+  proxies: ForwardRuleExt[];
+  logs: string[];
+
+  sshInstance: NodeSSH;
+  options: BackendParsedProviderString;
+
+  constructor(parameters: string) {
+    this.logs = [];
+    this.proxies = [];
+    this.clients = [];
+    
+    this.options = parseBackendProviderString(parameters);
+
+    this.state = "stopped";
+  }
+
+  async start(): Promise<boolean> {
+    this.state = "starting";
+    this.logs.push("Starting SSHBackendProvider...");
+
+    if (this.sshInstance) {
+      this.sshInstance.dispose();
+    }
+
+    this.sshInstance = new NodeSSH();
+
+    try {
+      await this.sshInstance.connect({
+        host: this.options.ip,
+        port: this.options.port,
+
+        username: this.options.username,
+        privateKey: this.options.privateKey
+      });
+    } catch (e) {
+      this.logs.push(`Failed to start SSHBackendProvider! Error: '${e}'`);
+      this.state = "stopped";
+
+      // @ts-ignore
+      this.sshInstance = null;
+
+      return false;
+    };
+
+    this.state = "started";
+    this.logs.push("Successfully started SSHBackendProvider.");
+
+    return true;
+  }
+
+  async stop(): Promise<boolean> {
+    this.state = "stopping";
+    this.logs.push("Stopping SSHBackendProvider...");
+
+    this.proxies.splice(0, this.proxies.length);
+
+    this.sshInstance.dispose();
+
+    // @ts-ignore
+    this.sshInstance = null;
+
+    this.logs.push("Successfully stopped SSHBackendProvider.");
+    this.state = "stopped";
+
+    return true;
+  };
+
+  addConnection(sourceIP: string, sourcePort: number, destPort: number, protocol: "tcp" | "udp"): void {
+    const connectionCheck = SSHBackendProvider.checkParametersConnection(sourceIP, sourcePort, destPort, protocol);
+    if (!connectionCheck.success) throw new Error(connectionCheck.message);
+
+    const foundProxyEntry = this.proxies.find((i) => i.sourceIP == sourceIP && i.sourcePort == sourcePort && i.destPort == destPort);
+    if (foundProxyEntry) return;
+
+    (async() => {
+      await this.sshInstance.forwardIn("0.0.0.0", destPort, (info, accept, reject) => {
+        const foundProxyEntry = this.proxies.find((i) => i.sourceIP == sourceIP && i.sourcePort == sourcePort && i.destPort == destPort);
+        if (!foundProxyEntry) return reject();
+        if (!foundProxyEntry.enabled) return reject();
+
+        const client: ConnectedClient = {
+          ip: info.srcIP,
+          port: info.srcPort,
+
+          connectionDetails: foundProxyEntry
+        };
+
+        this.clients.push(client);
+        
+        const srcConn = new Socket();
+        
+        srcConn.connect({
+          host: sourceIP,
+          port: sourcePort
+        });
+
+        // Why is this so confusing
+        const destConn = accept();
+
+        destConn.on("data", (chunk: Uint8Array) => {
+          srcConn.write(chunk);
+        });
+
+        destConn.on("exit", () => {
+          this.clients.splice(this.clients.indexOf(client), 1);
+          srcConn.end();
+        });
+
+        srcConn.on("data", (data) => {
+          destConn.write(data);
+        });
+
+        srcConn.on("end", () => {
+          this.clients.splice(this.clients.indexOf(client), 1);
+          destConn.close();
+        });
+      });
+    })();
+
+    this.proxies.push({
+      sourceIP,
+      sourcePort,
+      destPort,
+
+      enabled: true
+    });
+  };
+  
+  removeConnection(sourceIP: string, sourcePort: number, destPort: number, protocol: "tcp" | "udp"): void {
+    const connectionCheck = SSHBackendProvider.checkParametersConnection(sourceIP, sourcePort, destPort, protocol);
+    if (!connectionCheck.success) throw new Error(connectionCheck.message);
+
+    const foundProxyEntry = this.proxies.find((i) => i.sourceIP == sourceIP && i.sourcePort == sourcePort && i.destPort == destPort);
+    if (!foundProxyEntry) return;
+
+    foundProxyEntry.enabled = false;
+  };
+
+  getAllConnections(): ConnectedClient[] {
+    return this.clients;
+  };
+
+  static checkParametersConnection(sourceIP: string, sourcePort: number, destPort: number, protocol: "tcp" | "udp"): ParameterReturnedValue {
+    if (protocol == "udp") return {
+      success: false,
+      message: "SSH does not support UDP tunneling! Please use something like PortCopier instead (if it gets done)"
+    };
+
+    return {
+      success: true
+    }
+  };
+
+  static checkParametersBackendInstance(data: string): ParameterReturnedValue {
+    try {
+      parseBackendProviderString(data);
+      // @ts-ignore
+    } catch (e: Error) {
+      return {
+        success: false,
+        message: e.toString()
+      }
+    }
+
+    return {
+      success: true
+    }
+  };
+}

api/src/index.ts

@@ -0,0 +1,103 @@
+import process from "node:process";
+
+import { PrismaClient } from '@prisma/client';
+import Fastify from "fastify";
+
+import type { ServerOptions, SessionToken, RouteOptions } from "./libs/types.js";
+import type { BackendBaseClass } from "./backendimpl/base.js";``
+
+import { route as getPermissions } from "./routes/getPermissions.js";
+
+import { route as backendCreate } from "./routes/backends/create.js";
+import { route as backendRemove } from "./routes/backends/remove.js";
+import { route as backendLookup } from "./routes/backends/lookup.js";
+
+import { route as forwardConnections } from "./routes/forward/connections.js";
+import { route as forwardCreate } from "./routes/forward/create.js";
+import { route as forwardRemove } from "./routes/forward/remove.js";
+import { route as forwardLookup } from "./routes/forward/lookup.js";
+import { route as forwardStart } from "./routes/forward/start.js";
+import { route as forwardStop } from "./routes/forward/stop.js";
+
+import { route as userCreate } from "./routes/user/create.js";
+import { route as userRemove } from "./routes/user/remove.js";
+import { route as userLookup } from "./routes/user/lookup.js";
+import { route as userLogin } from "./routes/user/login.js";
+
+import { backendInit } from "./libs/backendInit.js";
+
+const prisma = new PrismaClient();
+
+const isSignupEnabled: boolean   = Boolean(process.env.IS_SIGNUP_ENABLED);
+const unsafeAdminSignup: boolean = Boolean(process.env.UNSAFE_ADMIN_SIGNUP);
+
+const noUsersCheck: boolean = await prisma.user.count() == 0;
+
+if (unsafeAdminSignup) {
+  console.error("WARNING: You have admin sign up on! This means that anyone that signs up will have admin rights!");
+}
+
+const serverOptions: ServerOptions = {
+  isSignupEnabled: isSignupEnabled ? true : noUsersCheck,
+  isSignupAsAdminEnabled: unsafeAdminSignup ? true : noUsersCheck,
+
+  allowUnsafeGlobalTokens: process.env.NODE_ENV != "production"
+};
+
+const sessionTokens: Record<number, SessionToken[]> = {};
+const backends: Record<number, BackendBaseClass> = {};
+
+const fastify = Fastify({
+  logger: true
+});
+
+const routeOptions: RouteOptions = {
+  fastify: fastify,
+  prisma: prisma,
+  tokens: sessionTokens,
+  options: serverOptions,
+
+  backends: backends
+};
+
+console.log("Initializing forwarding rules...");
+
+const createdBackends = await prisma.desinationProvider.findMany();
+
+for (const backend of createdBackends) {
+  console.log(`Running init steps for ID '${backend.id}' (${backend.name})`);
+  const init = await backendInit(backend, backends, prisma);  
+
+  if (init) console.log("Init successful.");
+}
+
+console.log("Done.");
+
+getPermissions(routeOptions);
+ 
+backendCreate(routeOptions);
+backendRemove(routeOptions);
+backendLookup(routeOptions);
+
+forwardConnections(routeOptions);
+forwardCreate(routeOptions);
+forwardRemove(routeOptions);
+forwardLookup(routeOptions);
+forwardStart(routeOptions);
+forwardStop(routeOptions);
+
+userCreate(routeOptions);
+userRemove(routeOptions);
+userLookup(routeOptions);
+userLogin(routeOptions);
+
+// Run the server!
+try {
+  await fastify.listen({
+    port: 3000,
+    host: process.env.NODE_ENV == "production" ? "0.0.0.0" : "127.0.0.1"
+  });
+} catch (err) {
+  fastify.log.error(err);
+  process.exit(1);
+}

api/src/libs/backendInit.ts

@@ -0,0 +1,53 @@
+import type { PrismaClient } from "@prisma/client";
+
+import type { BackendBaseClass } from "../backendimpl/base.js";
+import { backendProviders } from "../backendimpl/index.js";
+
+type Backend = {
+  id: number;
+  name: string; 
+  description: string | null; 
+  backend: string; 
+  connectionDetails: string;
+};
+
+export async function backendInit(backend: Backend, backends: Record<number, BackendBaseClass>, prisma: PrismaClient): Promise<boolean> {
+  const ourProvider = backendProviders[backend.backend];
+  
+  if (!ourProvider) {
+    console.log(" - Error: Invalid backend recieved!");
+    return false;
+  }
+
+  console.log(" - Initializing backend...");
+
+  backends[backend.id] = new ourProvider(backend.connectionDetails);
+  const ourBackend = backends[backend.id];
+
+  if (!await ourBackend.start()) {
+    console.log(" - Error initializing backend!");
+    console.log("   - " + ourBackend.logs.join("\n   - "));
+
+    return false;
+  }
+
+  console.log(" - Initializing clients...");
+
+  const clients = await prisma.forwardRule.findMany({
+    where: {
+      destProviderID: backend.id,
+      enabled: true
+    }
+  });
+
+  for (const client of clients) {
+    if (client.protocol != "tcp" && client.protocol != "udp") {
+      console.error(` - Error: Client with ID of '${client.id}' has an invalid protocol! (must be either TCP or UDP)`);
+      continue;
+    }
+
+    ourBackend.addConnection(client.sourceIP, client.sourcePort, client.destPort, client.protocol);
+  }
+
+  return true;
+}

api/src/libs/generateToken.ts

@@ -0,0 +1,26 @@
+function getRandomInt(min: number, max: number): number {
+  const minCeiled = Math.ceil(min);
+  const maxFloored = Math.floor(max);
+  return Math.floor(Math.random() * (maxFloored - minCeiled) + minCeiled); // The maximum is exclusive and the minimum is inclusive
+}
+
+export function generateRandomData(length: number): string {
+  let newString = "";
+
+  for (let i = 0; i < length; i += 2) {
+    const randomNumber = getRandomInt(0, 255);
+    
+    if (randomNumber == 0) {
+      i -= 2;
+      continue;
+    }
+
+    newString += randomNumber.toString(16);
+  }
+
+  return newString;
+}
+
+export function generateToken() {
+  return generateRandomData(128);
+}

api/src/libs/permissions.ts

@@ -0,0 +1,92 @@
+import type { PrismaClient } from "@prisma/client";
+import type { SessionToken } from "./types.js";
+
+export const permissionListDisabled: Record<string, boolean> = {
+  "routes.add":         false,
+  "routes.remove":      false,
+  "routes.start":       false,
+  "routes.stop":        false,
+  "routes.edit":        false,
+  "routes.visible":     false,
+  "routes.visibleConn": false,
+
+  "backends.add":       false,
+  "backends.remove":    false,
+  "backends.start":     false,
+  "backends.stop":      false,
+  "backends.edit":      false,
+  "backends.visible":   false,
+  "backends.secretVis": false,
+
+  "permissions.see":    false,
+
+  "users.add":          false,
+  "users.remove":       false,
+  "users.lookup":       false,
+  "users.edit":         false,
+};
+
+// FIXME: This solution fucking sucks.
+export let permissionListEnabled: Record<string, boolean> = JSON.parse(JSON.stringify(permissionListDisabled));
+
+for (const index of Object.keys(permissionListEnabled)) {
+  permissionListEnabled[index] = true;
+}
+
+export async function hasPermission(permissionList: string[], uid: number, prisma: PrismaClient): Promise<boolean> {
+  for (const permission of permissionList) {
+    const permissionNode = await prisma.permission.findFirst({
+      where: {
+        userID: uid,
+        permission
+      }
+    });
+
+    if (!permissionNode || !permissionNode.has) return false;
+  }
+
+  return true;
+}
+
+export async function getUID(token: string, tokens: Record<number, SessionToken[]>, prisma: PrismaClient): Promise<number> {
+  let userID = -1;
+
+  // Look up in our currently authenticated users
+  for (const otherTokenKey of Object.keys(tokens)) {
+    const otherTokenList = tokens[parseInt(otherTokenKey)];
+
+    for (const otherTokenIndex in otherTokenList) {
+      const otherToken = otherTokenList[otherTokenIndex];
+
+      if (otherToken.token == token) {
+        if (otherToken.expiresAt < otherToken.createdAt + (otherToken.createdAt - Date.now())) {
+          otherTokenList.splice(parseInt(otherTokenIndex), 1);
+          continue;
+        } else {
+          userID = parseInt(otherTokenKey);
+        }
+      }
+    }
+  }
+
+  // Fine, we'll look up for global tokens...
+  // FIXME: Could this be more efficient? IDs are sequential in SQL I think
+  if (userID == -1) {
+    const allUsers = await prisma.user.findMany({
+      where: {
+        isRootServiceAccount: true
+      }
+    });
+  
+    for (const user of allUsers) {
+      if (user.rootToken == token) userID = user.id;
+    };
+  }
+
+  return userID;
+}
+
+export async function hasPermissionByToken(permissionList: string[], token: string, tokens: Record<number, SessionToken[]>, prisma: PrismaClient): Promise<boolean> {
+  const userID = await getUID(token, tokens, prisma);
+  return await hasPermission(permissionList, userID, prisma);
+}

api/src/libs/types.ts

@@ -0,0 +1,28 @@
+import type { PrismaClient } from "@prisma/client";
+import type { FastifyInstance } from "fastify";
+
+import type { BackendBaseClass } from "../backendimpl/base.js";
+
+export type ServerOptions = {
+  isSignupEnabled: boolean;
+  isSignupAsAdminEnabled: boolean;
+
+  allowUnsafeGlobalTokens: boolean;
+}
+
+// NOTE: Someone should probably use Redis for this, but this is fine...
+export type SessionToken = {
+  createdAt: number,
+  expiresAt: number, // Should be (createdAt + (30 minutes))
+  
+  token: string
+};
+
+export type RouteOptions = {
+  fastify: FastifyInstance,
+  prisma: PrismaClient,
+  tokens: Record<number, SessionToken[]>,
+  
+  options: ServerOptions,
+  backends: Record<number, BackendBaseClass>
+};

api/src/routes/ROUTE_PLAN.md

@@ -0,0 +1,17 @@
+# Route Plan
+- [x] /api/v1/users/create
+- [x] /api/v1/users/login
+- [x] /api/v1/users/remove
+- [ ] /api/v1/users/modify 
+- [x] /api/v1/users/lookup
+- [x] /api/v1/backends/create
+- [x] /api/v1/backends/remove
+- [ ] /api/v1/backends/modify
+- [x] /api/v1/backends/lookup
+- [x] /api/v1/routes/create
+- [x] /api/v1/routes/remove
+- [ ] /api/v1/routes/modify
+- [x] /api/v1/routes/lookup
+- [ ] /api/v1/routes/start
+- [ ] /api/v1/routes/stop
+- [x] /api/v1/getPermissions

api/src/routes/backends/create.ts

@@ -0,0 +1,94 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+import { backendProviders } from "../../backendimpl/index.js";
+import { backendInit } from "../../libs/backendInit.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens,
+    backends
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+  
+  /**
+   * Creates a new backend to use
+   */
+  fastify.post("/api/v1/backends/create", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token", "name", "backend", "connectionDetails"],
+
+        properties: {
+          token:             { type: "string" },
+          name:              { type: "string" },
+          description:       { type: "string" },
+          backend:           { type: "string" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+      name: string,
+      description?: string,
+      connectionDetails: any,
+      backend: string
+    } = req.body;
+
+    if (!await hasPermission(body.token, [
+      "backends.add"
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    if (!backendProviders[body.backend]) {
+      return res.status(400).send({
+        error: "Unknown/unsupported/deprecated backend!"
+      });
+    };
+
+    const connectionDetails = JSON.stringify(body.connectionDetails);
+    const connectionDetailsValidityCheck = backendProviders[body.backend].checkParametersBackendInstance(connectionDetails);
+
+    if (!connectionDetailsValidityCheck.success) {
+      return res.status(400).send({
+        error: connectionDetailsValidityCheck.message ?? "Unknown error while attempting to parse connectionDetails (it's on your side)"
+      });
+    };
+
+    const backend = await prisma.desinationProvider.create({
+      data: {
+        name: body.name,
+        description: body.description,
+
+        backend: body.backend,
+        connectionDetails: JSON.stringify(body.connectionDetails)
+      }
+    });
+
+    const init = await backendInit(backend, backends, prisma);
+    
+    if (!init) {
+      // TODO: better error code
+      return res.status(504).send({
+        error: "Backend is created, but failed to initalize correctly",
+        id: backend.id
+      });
+    }
+
+    return {
+      success: true,
+      id: backend.id
+    };
+  });
+}

api/src/routes/backends/lookup.ts

@@ -0,0 +1,78 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens,
+    backends
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+
+  /**
+   * Creates a new route to use
+   */
+  fastify.post("/api/v1/backends/lookup", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token"],
+
+        properties: {
+          token:             { type: "string" },
+          id:                { type: "number" },
+          name:              { type: "string" },
+          description:       { type: "string" },
+          backend:           { type: "string" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+      id?: number,
+      name?: string,
+      description?: string,
+      backend?: string
+    } = req.body;
+
+    if (!await hasPermission(body.token, [
+      "backends.visible" // wtf?
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    const canSeeSecrets = await hasPermission(body.token, [
+      "backends.secretVis"
+    ]);
+    
+    const prismaBackends = await prisma.desinationProvider.findMany({
+      where: {
+        id: body.id,
+        name: body.name,
+        description: body.description,
+        backend: body.backend
+      }
+    });
+
+    return {
+      success: true,
+      data: prismaBackends.map((i) => ({
+        name: i.name,
+        description: i.description,
+
+        backend: i.backend,
+        connectionDetails: canSeeSecrets ? i.connectionDetails : "",
+
+        logs: backends[i.id].logs
+      }))
+    }
+  });
+}

api/src/routes/backends/remove.ts

@@ -0,0 +1,71 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens,
+    backends
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+
+  /**
+   * Creates a new route to use
+   */
+  fastify.post("/api/v1/backends/remove", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token", "id"],
+
+        properties: {
+          token: { type: "string" },
+          id:    { type: "number" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+      id: number
+    } = req.body;
+
+    if (!await hasPermission(body.token, [
+      "backends.remove"
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    if (!backends[body.id]) {
+      return res.status(400).send({
+        error: "Backend not found"
+      });
+    };
+
+    // Unload the backend
+    if (!await backends[body.id].stop()) {
+      return res.status(400).send({
+        error: "Failed to stop backend! Please report this issue."
+      })
+    }
+
+    delete backends[body.id];
+
+    await prisma.desinationProvider.delete({
+      where: {
+        id: body.id
+      }
+    });
+
+    return {
+      success: true
+    }
+  });
+}

api/src/routes/forward/connections.ts

@@ -0,0 +1,62 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens,
+    backends
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+
+  fastify.post("/api/v1/forward/connections", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token", "id"],
+
+        properties: {
+          token: { type: "string" },
+          id:    { type: "number" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+      id: number
+    } = req.body;
+
+    if (!await hasPermission(body.token, [
+      "routes.visibleConn"
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    const forward = await prisma.forwardRule.findUnique({
+      where: {
+        id: body.id
+      }
+    });
+
+    if (!forward) return res.status(400).send({
+      error: "Could not find forward entry"
+    });
+
+    if (!backends[forward.destProviderID]) return res.status(400).send({
+      error: "Backend not found"
+    });
+
+    return {
+      success: true,
+      data: backends[forward.destProviderID].getAllConnections()
+    }
+  })
+}

api/src/routes/forward/create.ts

@@ -0,0 +1,109 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+
+  /**
+   * Creates a new route to use
+   */
+  fastify.post("/api/v1/forward/create", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token", "name", "protocol", "sourceIP", "sourcePort", "destinationPort", "providerID"],
+
+        properties: {
+          token:           { type: "string" },
+
+          name:            { type: "string" },
+          description:     { type: "string" },
+
+          protocol:        { type: "string" },
+
+          sourceIP:        { type: "string" },
+          sourcePort:      { type: "number" },
+
+          destinationPort: { type: "number" },
+
+          providerID:      { type: "number" },
+          autoStart:       { type: "boolean" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+
+      name: string,
+      description?: string,
+
+      protocol: "tcp" | "udp",
+
+      sourceIP: string,
+      sourcePort: number,
+
+      destinationPort: number,
+
+      providerID: number,
+
+      autoStart?: boolean
+    } = req.body;
+
+    if (body.protocol != "tcp" && body.protocol != "udp") {
+      return res.status(400).send({
+        error: "Body protocol field must be either tcp or udp"
+      });
+    };
+
+    if (!await hasPermission(body.token, [
+      "routes.add"
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    const lookupIDForDestProvider = await prisma.desinationProvider.findUnique({
+      where: {
+        id: body.providerID
+      }
+    });
+
+    if (!lookupIDForDestProvider) return res.status(400).send({
+      error: "Could not find provider"
+    });
+
+    const forwardRule = await prisma.forwardRule.create({
+      data: {
+        name: body.name,
+        description: body.description,
+
+        protocol: body.protocol,
+
+        sourceIP: body.sourceIP,
+        sourcePort: body.sourcePort,
+
+        destPort: body.destinationPort,
+
+        destProviderID: body.providerID,
+
+        enabled: Boolean(body.autoStart)
+      }
+    });
+
+    return {
+      success: true,
+      id: forwardRule.id
+    }
+  });
+}

api/src/routes/forward/lookup.ts

@@ -0,0 +1,108 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+
+  /**
+   * Creates a new route to use
+   */
+  fastify.post("/api/v1/forward/lookup", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token"],
+        
+        properties: {
+          token:       { type: "string" },
+          id:          { type: "number" },
+
+          name:        { type: "string" },
+          protocol:    { type: "string" },
+          description: { type: "string" },
+
+          sourceIP:    { type: "string" },
+          sourcePort:  { type: "number" },
+          destPort:    { type: "number" },
+
+          providerID:  { type: "number" },
+          autoStart:   { type: "boolean" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+
+      id?: number,
+      name?: string,
+      description?: string,
+
+      protocol?: "tcp" | "udp",
+
+      sourceIP?: string,
+      sourcePort?: number,
+
+      destinationPort?: number,
+
+      providerID?: number,
+      autoStart?: boolean
+    } = req.body;
+
+    if (body.protocol && body.protocol != "tcp" && body.protocol != "udp") {
+      return res.status(400).send({
+        error: "Protocol specified in body must be either 'tcp' or 'udp'"
+      })
+    }
+
+    if (!await hasPermission(body.token, [
+      "routes.visible" // wtf?
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    const forwardRules = await prisma.forwardRule.findMany({
+      where: {
+        id: body.id,
+        name: body.name,
+        description: body.description,
+
+        sourceIP: body.sourceIP,
+        sourcePort: body.sourcePort,
+
+        destPort: body.destinationPort,
+
+        destProviderID: body.providerID,
+        enabled: body.autoStart
+      }
+    });
+
+    return {
+      success: true,
+      data: forwardRules.map((i) => ({
+        id: i.id,
+        name: i.name,
+        description: i.description,
+
+        sourceIP: i.sourceIP,
+        sourcePort: i.sourcePort,
+
+        destPort: i.destPort,
+
+        providerID: i.destProviderID,
+        autoStart: i.enabled // TODO: Add enabled flag in here to see if we're running or not
+      }))
+    };
+  });
+}

api/src/routes/forward/remove.ts

@@ -0,0 +1,55 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+
+  /**
+   * Creates a new route to use
+   */
+  fastify.post("/api/v1/forward/remove", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token", "id"],
+  
+        properties: {
+          token: { type: "string" },
+          id:    { type: "number" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+      id: number
+    } = req.body;
+
+    if (!await hasPermission(body.token, [
+      "routes.remove"
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+    
+    await prisma.forwardRule.delete({
+      where: {
+        id: body.id
+      }
+    });
+
+    return {
+      success: true
+    }
+  });
+}

api/src/routes/forward/start.ts

@@ -0,0 +1,70 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens,
+    backends
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+
+  /**
+   * Creates a new route to use
+   */
+  fastify.post("/api/v1/forward/start", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token", "id"],
+
+        properties: {
+          token: { type: "string" },
+          id: { type: "number" }
+        }
+      },
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+      id: number
+    } = req.body;
+
+    if (!await hasPermission(body.token, [
+      "routes.start"
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    const forward = await prisma.forwardRule.findUnique({
+      where: {
+        id: body.id
+      }
+    });
+
+    if (!forward) return res.status(400).send({
+      error: "Could not find forward entry"
+    });
+
+    if (!backends[forward.destProviderID]) return res.status(400).send({
+      error: "Backend not found"
+    });
+
+    // Other restrictions in place make it so that it MUST be either TCP or UDP
+    // @ts-ignore
+    const protocol: "tcp" | "udp" = forward.protocol;
+
+    backends[forward.destProviderID].addConnection(forward.sourceIP, forward.sourcePort, forward.destPort, protocol);
+
+    return {
+      success: true
+    }
+  });
+}

api/src/routes/forward/stop.ts

@@ -0,0 +1,70 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens,
+    backends
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+
+  /**
+   * Creates a new route to use
+   */
+  fastify.post("/api/v1/forward/stop", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token", "id"],
+
+        properties: {
+          token: { type: "string" },
+          id: { type: "number" }
+        }
+      },
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+      id: number
+    } = req.body;
+
+    if (!await hasPermission(body.token, [
+      "routes.stop"
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    const forward = await prisma.forwardRule.findUnique({
+      where: {
+        id: body.id
+      }
+    });
+
+    if (!forward) return res.status(400).send({
+      error: "Could not find forward entry"
+    });
+
+    if (!backends[forward.destProviderID]) return res.status(400).send({
+      error: "Backend not found"
+    });
+
+    // Other restrictions in place make it so that it MUST be either TCP or UDP
+    // @ts-ignore
+    const protocol: "tcp" | "udp" = forward.protocol;
+
+    backends[forward.destProviderID].removeConnection(forward.sourceIP, forward.sourcePort, forward.destPort, protocol);
+
+    return {
+      success: true
+    }
+  });
+}

api/src/routes/getPermissions.ts

@@ -0,0 +1,53 @@
+import { hasPermission, getUID } from "../libs/permissions.js";
+import type { RouteOptions } from "../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens
+  } = routeOptions;
+
+  /**
+   * Logs in to a user account.
+   */
+  fastify.post("/api/v1/getPermissions", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token"],
+
+        properties: {
+          token: { type: "string" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string
+    } = req.body;
+
+    const uid = await getUID(body.token, tokens, prisma);
+
+    if (!await hasPermission([
+      "permissions.see"
+    ], uid, prisma)) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    const permissionsRaw = await prisma.permission.findMany({
+      where: {
+        userID: uid
+      }
+    });
+
+    return {
+      success: true,
+      // Get the ones that we have, and transform them into just their name
+      data: permissionsRaw.filter((i) => i.has).map((i) => i.permission)
+    }
+  });
+}

api/src/routes/user/create.ts

@@ -0,0 +1,118 @@
+import { hash } from "bcrypt";
+
+import { permissionListEnabled } from "../../libs/permissions.js";
+import { generateToken } from "../../libs/generateToken.js";
+
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens,
+    options
+  } = routeOptions;
+
+  /**
+   * Creates a new user account to use, only if it is enabled.
+   */
+  fastify.post("/api/v1/users/create", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["name", "email", "password"],
+
+        properties: {
+          name:     { type: "string" },
+          email:    { type: "string" },
+          password: { type: "string" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      name: string,
+      email: string,
+      password: string
+    } = req.body;
+
+    if (!options.isSignupEnabled) {
+      return res.status(403).send({
+        error: "Signing up is not enabled at this time."
+      });
+    };
+
+    const userSearch = await prisma.user.findFirst({
+      where: {
+        email: body.email
+      }
+    });
+
+    if (userSearch) {
+      return res.status(400).send({
+        error: "User already exists"
+      })
+    };
+
+    const saltedPassword: string = await hash(body.password, 15);
+
+    const userData = {
+      name: body.name,
+      email: body.email,
+      password: saltedPassword,
+
+      permissions: {
+        create: [] as {
+          permission: string,
+          has: boolean
+        }[]
+      }
+    };
+
+    // TODO: There's probably a faster way to pull this off, but I'm lazy
+    for (const permissionKey of Object.keys(permissionListEnabled)) {
+      if (options.isSignupAsAdminEnabled || (permissionKey.startsWith("routes") || permissionKey == "permissions.see")) {
+        userData.permissions.create.push({
+          permission: permissionKey,
+          has: permissionListEnabled[permissionKey]
+        });
+      }
+    };
+
+    if (options.allowUnsafeGlobalTokens) {
+      // @ts-ignore
+      userData.rootToken = generateToken();
+      // @ts-ignore
+      userData.isRootServiceAccount = true;
+    }
+
+    const userCreateResults = await prisma.user.create({
+      data: userData
+    });
+
+    // FIXME(?): Redundant checks
+    if (options.allowUnsafeGlobalTokens) {
+      return {
+        success: true,
+        token: userCreateResults.rootToken
+      };
+    } else {
+      const generatedToken = generateToken();
+
+      tokens[userCreateResults.id] = [];
+
+      tokens[userCreateResults.id].push({
+        createdAt: Date.now(),
+        expiresAt: Date.now() + (30 * 60_000),
+
+        token: generatedToken
+      });
+
+      return {
+        success: true,
+        token: generatedToken
+      };
+    };
+  });
+}

api/src/routes/user/login.ts

@@ -0,0 +1,66 @@
+import { compare } from "bcrypt";
+
+import { generateToken } from "../../libs/generateToken.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens
+  } = routeOptions;
+
+  /**
+   * Logs in to a user account.
+   */
+  fastify.post("/api/v1/users/login", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["email", "password"],
+
+        properties: {
+          email:    { type: "string" },
+          password: { type: "string" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      email: string,
+      password: string
+    } = req.body;
+
+    const userSearch = await prisma.user.findFirst({
+      where: {
+        email: body.email
+      }
+    });
+
+    if (!userSearch) return res.status(403).send({
+      error: "Email or password is incorrect"
+    });
+
+    const passwordIsValid = await compare(body.password, userSearch.password);
+    
+    if (!passwordIsValid) return res.status(403).send({
+      error: "Email or password is incorrect"
+    });
+
+    const token = generateToken();
+    if (!tokens[userSearch.id]) tokens[userSearch.id] = [];
+    
+    tokens[userSearch.id].push({
+      createdAt: Date.now(),
+      expiresAt: Date.now() + (30 * 60_000),
+
+      token
+    });
+
+    return {
+      success: true,
+      token
+    }
+  });
+}

api/src/routes/user/lookup.ts

@@ -0,0 +1,66 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+
+  fastify.post("/api/v1/users/lookup", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token"],
+
+        properties: {
+          token:            { type: "string" },
+          id:               { type: "number" },
+          name:             { type: "string" },
+          email:            { type: "string" },
+          isServiceAccount: { type: "boolean" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+      id?: number,
+      name?: string,
+      email?: string,
+      isServiceAccount?: boolean
+    } = req.body;
+
+    if (!await hasPermission(body.token, [
+      "users.lookup"
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    const users = await prisma.user.findMany({
+      where: {
+        id: body.id,
+        name: body.name,
+        email: body.email,
+        isRootServiceAccount: body.isServiceAccount
+      }
+    });
+
+    return {
+      success: true,
+      data: users.map((i) => ({
+        name: i.name,
+        email: i.email,
+        isServiceAccount: i.isRootServiceAccount
+      }))
+    }
+  });
+}

api/src/routes/user/remove.ts

@@ -0,0 +1,61 @@
+import { hasPermissionByToken } from "../../libs/permissions.js";
+import type { RouteOptions } from "../../libs/types.js";
+
+export function route(routeOptions: RouteOptions) {
+  const {
+    fastify,
+    prisma,
+    tokens
+  } = routeOptions;
+
+  function hasPermission(token: string, permissionList: string[]): Promise<boolean> {
+    return hasPermissionByToken(permissionList, token, tokens, prisma);
+  };
+  
+  /**
+   * Creates a new backend to use
+   */
+  fastify.post("/api/v1/users/remove", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["token", "uid"],
+
+        properties: {
+          token:             { type: "string" },
+          uid:               { type: "number" }
+        }
+      }
+    }
+  }, async(req, res) => {
+    // @ts-ignore
+    const body: {
+      token: string,
+      uid: number
+    } = req.body;
+
+    if (!await hasPermission(body.token, [
+      "users.remove"
+    ])) {
+      return res.status(403).send({
+        error: "Unauthorized"
+      });
+    };
+
+    await prisma.permission.deleteMany({
+      where: {
+        userID: body.uid
+      }
+    });
+
+    await prisma.user.delete({
+      where: {
+        id: body.uid
+      }
+    });
+
+    return {
+      success: true
+    }
+  });
+};