feat: tunnel-node service + CodeFull.gs (#93)

Standalone Rust/axum HTTP server + Apps Script-side CodeFull.gs for users who want to deploy a remote tunnel node. All new files; no changes to the main Rust crate. This is part 1 of 3 of the full-tunnel feature — it adds scaffolding that users can opt into once the Rust-side Mode::Full lands in #94.
2026-05-17 21:24:48 +03:00 · 2026-04-23 22:34:51 +02:00
parent 39537e6689
commit 31ae569aa2
8 changed files with 1913 additions and 0 deletions
@@ -0,0 +1,208 @@
+/**
+ * DomainFront Relay + Full Tunnel — Google Apps Script
+ *
+ * FOUR modes:
+ *   1. Single relay:  POST { k, m, u, h, b, ct, r }           → { s, h, b }
+ *   2. Batch relay:   POST { k, q: [{m,u,h,b,ct,r}, ...] }    → { q: [{s,h,b}, ...] }
+ *   3. Tunnel:        POST { k, t, h, p, sid, d }              → { sid, d, eof }
+ *   4. Tunnel batch:  POST { k, t:"batch", ops:[...] }         → { r: [...] }
+ *
+ * CHANGE THESE TO YOUR OWN VALUES!
+ */
+
+const AUTH_KEY = "CHANGE_ME_TO_A_STRONG_SECRET";
+const TUNNEL_SERVER_URL = "https://YOUR_TUNNEL_NODE_URL";
+const TUNNEL_AUTH_KEY = "YOUR_TUNNEL_AUTH_KEY";
+
+const SKIP_HEADERS = {
+  host: 1, connection: 1, "content-length": 1,
+  "transfer-encoding": 1, "proxy-connection": 1, "proxy-authorization": 1,
+  "priority": 1, te: 1,
+};
+
+// ========================== Entry point ==========================
+
+function doPost(e) {
+  try {
+    var req = JSON.parse(e.postData.contents);
+    if (req.k !== AUTH_KEY) return _json({ e: "unauthorized" });
+
+    // Tunnel mode
+    if (req.t) return _doTunnel(req);
+
+    // Batch relay mode
+    if (Array.isArray(req.q)) return _doBatch(req.q);
+
+    // Single relay mode
+    return _doSingle(req);
+  } catch (err) {
+    return _json({ e: String(err) });
+  }
+}
+
+// ========================== Tunnel mode ==========================
+
+function _doTunnel(req) {
+  // Batch tunnel: { k, t:"batch", ops:[...] }
+  if (req.t === "batch") {
+    return _doTunnelBatch(req);
+  }
+
+  // Single tunnel op
+  var payload = { k: TUNNEL_AUTH_KEY };
+  switch (req.t) {
+    case "connect":
+      payload.op = "connect";
+      payload.host = req.h;
+      payload.port = req.p;
+      break;
+    case "data":
+      payload.op = "data";
+      payload.sid = req.sid;
+      if (req.d) payload.data = req.d;
+      break;
+    case "close":
+      payload.op = "close";
+      payload.sid = req.sid;
+      break;
+    default:
+      return _json({ e: "unknown tunnel op: " + req.t });
+  }
+
+  var resp = UrlFetchApp.fetch(TUNNEL_SERVER_URL + "/tunnel", {
+    method: "post",
+    contentType: "application/json",
+    payload: JSON.stringify(payload),
+    muteHttpExceptions: true,
+    followRedirects: true,
+  });
+
+  if (resp.getResponseCode() !== 200) {
+    return _json({ e: "tunnel node HTTP " + resp.getResponseCode() });
+  }
+
+  return ContentService.createTextOutput(resp.getContentText())
+    .setMimeType(ContentService.MimeType.JSON);
+}
+
+// Batch tunnel: forward all ops in one request to /tunnel/batch
+function _doTunnelBatch(req) {
+  var payload = {
+    k: TUNNEL_AUTH_KEY,
+    ops: req.ops || [],
+  };
+
+  var resp = UrlFetchApp.fetch(TUNNEL_SERVER_URL + "/tunnel/batch", {
+    method: "post",
+    contentType: "application/json",
+    payload: JSON.stringify(payload),
+    muteHttpExceptions: true,
+    followRedirects: true,
+  });
+
+  if (resp.getResponseCode() !== 200) {
+    return _json({ e: "tunnel batch HTTP " + resp.getResponseCode() });
+  }
+
+  return ContentService.createTextOutput(resp.getContentText())
+    .setMimeType(ContentService.MimeType.JSON);
+}
+
+// ========================== HTTP relay mode ==========================
+
+function _doSingle(req) {
+  if (!req.u || typeof req.u !== "string" || !req.u.match(/^https?:\/\//i)) {
+    return _json({ e: "bad url" });
+  }
+  var opts = _buildOpts(req);
+  var resp = UrlFetchApp.fetch(req.u, opts);
+  return _json({
+    s: resp.getResponseCode(),
+    h: _respHeaders(resp),
+    b: Utilities.base64Encode(resp.getContent()),
+  });
+}
+
+function _doBatch(items) {
+  var fetchArgs = [];
+  var errorMap = {};
+  for (var i = 0; i < items.length; i++) {
+    var item = items[i];
+    if (!item.u || typeof item.u !== "string" || !item.u.match(/^https?:\/\//i)) {
+      errorMap[i] = "bad url";
+      continue;
+    }
+    var opts = _buildOpts(item);
+    opts.url = item.u;
+    fetchArgs.push({ _i: i, _o: opts });
+  }
+  var responses = [];
+  if (fetchArgs.length > 0) {
+    responses = UrlFetchApp.fetchAll(fetchArgs.map(function(x) { return x._o; }));
+  }
+  var results = [];
+  var rIdx = 0;
+  for (var i = 0; i < items.length; i++) {
+    if (errorMap.hasOwnProperty(i)) {
+      results.push({ e: errorMap[i] });
+    } else {
+      var resp = responses[rIdx++];
+      results.push({
+        s: resp.getResponseCode(),
+        h: _respHeaders(resp),
+        b: Utilities.base64Encode(resp.getContent()),
+      });
+    }
+  }
+  return _json({ q: results });
+}
+
+// ========================== Helpers ==========================
+
+function _buildOpts(req) {
+  var opts = {
+    method: (req.m || "GET").toLowerCase(),
+    muteHttpExceptions: true,
+    followRedirects: req.r !== false,
+    validateHttpsCertificates: true,
+    escaping: false,
+  };
+  if (req.h && typeof req.h === "object") {
+    var headers = {};
+    for (var k in req.h) {
+      if (req.h.hasOwnProperty(k) && !SKIP_HEADERS[k.toLowerCase()]) {
+        headers[k] = req.h[k];
+      }
+    }
+    opts.headers = headers;
+  }
+  if (req.b) {
+    opts.payload = Utilities.base64Decode(req.b);
+    if (req.ct) opts.contentType = req.ct;
+  }
+  return opts;
+}
+
+function _respHeaders(resp) {
+  try {
+    if (typeof resp.getAllHeaders === "function") {
+      return resp.getAllHeaders();
+    }
+  } catch (err) {}
+  return resp.getHeaders();
+}
+
+function doGet(e) {
+  return HtmlService.createHtmlOutput(
+    "<!DOCTYPE html><html><head><title>My App</title></head>" +
+      '<body style="font-family:sans-serif;max-width:600px;margin:40px auto">' +
+      "<h1>Welcome</h1><p>This application is running normally.</p>" +
+      "</body></html>"
+  );
+}
+
+function _json(obj) {
+  return ContentService.createTextOutput(JSON.stringify(obj)).setMimeType(
+    ContentService.MimeType.JSON
+  );
+}