BetterDesk/web-nodejs/services/meshAshxProxy.js

/**
 * MeshCentral .ashx WebSocket proxy — panel HTTPS → Go API listener.
 * MeshAgent connects to wss://panel:5443/agent.ashx (no panel session; binary auth on Go).
 */

const WebSocket = require('ws');
const config = require('../config/config');
const { enforceOrigin } = require('../middleware/wsOrigin');

const MESH_PATHS = new Set([
    '/agent.ashx',
    '/meshrelay.ashx',
    '/control.ashx',
]);

function goWsBase() {
    const base = config.betterdeskApiUrl || `http://127.0.0.1:${config.goApiPort || 21114}/api`;
    return base.replace(/^http/, 'ws').replace(/\/api\/?$/, '');
}

function initMeshAshxProxy(server, sessionMiddleware) {
    const wss = new WebSocket.Server({ noServer: true });

    server.on('upgrade', (req, socket, head) => {
        const url = new URL(req.url, `http://${req.headers.host}`);
        if (!MESH_PATHS.has(url.pathname)) return;

        const needsSession = url.pathname === '/control.ashx';
        const label = `mesh-${url.pathname}`;

        if (!enforceOrigin(req, socket, label)) return;

        const connect = () => {
            wss.handleUpgrade(req, socket, head, (browserWs) => {
                const target = goWsBase() + url.pathname + (url.search || '');
                const goWs = new WebSocket(target, {
                    headers: {
                        'x-forwarded-for': req.socket?.remoteAddress || '',
                    },
                });

                goWs.on('open', () => {
                    browserWs.on('message', (data, isBinary) => {
                        if (goWs.readyState === WebSocket.OPEN) {
                            goWs.send(data, { binary: isBinary });
                        }
                    });
                    goWs.on('message', (data, isBinary) => {
                        if (browserWs.readyState === WebSocket.OPEN) {
                            browserWs.send(data, { binary: isBinary });
                        }
                    });
                });

                goWs.on('error', (err) => {
                    console.warn('[mesh proxy]', url.pathname, err.message);
                    browserWs.close();
                });
                browserWs.on('close', () => goWs.close());
                goWs.on('close', () => browserWs.close());
                browserWs.on('error', () => goWs.close());
            });
        };

        if (needsSession) {
            sessionMiddleware(req, {}, () => {
                if (!req.session || !req.session.userId) {
                    socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
                    socket.destroy();
                    return;
                }
                connect();
            });
        } else {
            connect();
        }
    });
}

module.exports = { initMeshAshxProxy };