homeio

1import "server-only";
2
3import { eq, sql } from "drizzle-orm";
4import { db } from "@/lib/server/db/drizzle";
5import { settings } from "@/lib/server/db/schema";
6import { decryptSecret, encryptSecret } from "@/lib/server/modules/files/secrets";
7import type { CloudflareTunnelConfigPublic } from "@/lib/shared/contracts/cloudflare-tunnel";
8
9export type CloudflareTunnelConfig = {
10  enabled: boolean;
11  domain: string;
12  token: string | null;
13  apiToken: string | null;
14};
15
16async function ensureSettingsRow() {
17  await db.execute(sql`
18    INSERT INTO settings (id, appearance_json, updated_at)
19    VALUES ('singleton', '{}', NOW())
20    ON CONFLICT (id) DO NOTHING
21  `);
22}
23
24function normalizeDomain(domain: string) {
25  const normalized = domain.trim().toLowerCase().replace(/^https?:\/\//, "");
26  // Trailing slashes are stripped by scanning, not /\/+$/, which is quadratic
27  // on a long run of slashes followed by anything else.
28  let end = normalized.length;
29  while (end > 0 && normalized[end - 1] === "/") end--;
30  return normalized.slice(0, end);
31}
32
33export async function getCloudflareTunnelConfig(): Promise<CloudflareTunnelConfig> {
34  await ensureSettingsRow();
35
36  const rows = await db
37    .select({
38      enabled: settings.cloudflareTunnelEnabled,
39      domain: settings.cloudflareTunnelDomain,
40      tokenCiphertext: settings.cloudflareTunnelTokenCiphertext,
41      tokenIv: settings.cloudflareTunnelTokenIv,
42      tokenTag: settings.cloudflareTunnelTokenTag,
43      apiCiphertext: settings.cloudflareApiTokenCiphertext,
44      apiIv: settings.cloudflareApiTokenIv,
45      apiTag: settings.cloudflareApiTokenTag,
46    })
47    .from(settings)
48    .where(eq(settings.id, "singleton"))
49    .limit(1);
50
51  const row = rows[0];
52  const hasToken = Boolean(row?.tokenCiphertext && row.tokenIv && row.tokenTag);
53  const hasApiToken = Boolean(row?.apiCiphertext && row.apiIv && row.apiTag);
54
55  return {
56    enabled: Boolean(row?.enabled),
57    domain: row?.domain ?? "",
58    token: hasToken
59      ? decryptSecret({
60          ciphertext: row!.tokenCiphertext!,
61          iv: row!.tokenIv!,
62          tag: row!.tokenTag!,
63        })
64      : null,
65    apiToken: hasApiToken
66      ? decryptSecret({
67          ciphertext: row!.apiCiphertext!,
68          iv: row!.apiIv!,
69          tag: row!.apiTag!,
70        })
71      : null,
72  };
73}
74
75export async function getCloudflareTunnelConfigPublic(): Promise<CloudflareTunnelConfigPublic> {
76  const config = await getCloudflareTunnelConfig();
77
78  return {
79    enabled: config.enabled,
80    domain: config.domain,
81    hasToken: config.token !== null,
82    hasApiToken: config.apiToken !== null,
83  };
84}
85
86export async function saveCloudflareTunnelConfig(input: {
87  enabled: boolean;
88  domain: string;
89  /** Undefined keeps the stored token, empty string clears it. */
90  token?: string;
91  apiToken?: string;
92}): Promise<CloudflareTunnelConfigPublic> {
93  await ensureSettingsRow();
94
95  const values: Record<string, unknown> = {
96    cloudflareTunnelEnabled: input.enabled,
97    cloudflareTunnelDomain: normalizeDomain(input.domain) || null,
98    updatedAt: new Date(),
99  };
100
101  if (input.token !== undefined) {
102    if (input.token.trim().length === 0) {
103      values.cloudflareTunnelTokenCiphertext = null;
104      values.cloudflareTunnelTokenIv = null;
105      values.cloudflareTunnelTokenTag = null;
106    } else {
107      const encrypted = encryptSecret(input.token.trim());
108      values.cloudflareTunnelTokenCiphertext = encrypted.ciphertext;
109      values.cloudflareTunnelTokenIv = encrypted.iv;
110      values.cloudflareTunnelTokenTag = encrypted.tag;
111    }
112  }
113
114  if (input.apiToken !== undefined) {
115    if (input.apiToken.trim().length === 0) {
116      values.cloudflareApiTokenCiphertext = null;
117      values.cloudflareApiTokenIv = null;
118      values.cloudflareApiTokenTag = null;
119    } else {
120      const encrypted = encryptSecret(input.apiToken.trim());
121      values.cloudflareApiTokenCiphertext = encrypted.ciphertext;
122      values.cloudflareApiTokenIv = encrypted.iv;
123      values.cloudflareApiTokenTag = encrypted.tag;
124    }
125  }
126
127  await db.update(settings).set(values).where(eq(settings.id, "singleton"));
128
129  return getCloudflareTunnelConfigPublic();
130}
131
132export async function clearCloudflareTunnelConfig(): Promise<void> {
133  await ensureSettingsRow();
134
135  await db
136    .update(settings)
137    .set({
138      cloudflareTunnelEnabled: false,
139      cloudflareTunnelDomain: null,
140      cloudflareTunnelTokenCiphertext: null,
141      cloudflareTunnelTokenIv: null,
142      cloudflareTunnelTokenTag: null,
143      cloudflareApiTokenCiphertext: null,
144      cloudflareApiTokenIv: null,
145      cloudflareApiTokenTag: null,
146      updatedAt: new Date(),
147    })
148    .where(eq(settings.id, "singleton"));
149}
150
151export { normalizeDomain as normalizeTunnelDomain };
152