(
server: &str,
name: &str,
tls: &TlsOptions,
)
| 73 | } |
| 74 | |
| 75 | async fn ssh_session_config( |
| 76 | server: &str, |
| 77 | name: &str, |
| 78 | tls: &TlsOptions, |
| 79 | ) -> Result<SshSessionConfig> { |
| 80 | let mut client = grpc_client(server, tls).await?; |
| 81 | |
| 82 | // Resolve sandbox name to id. |
| 83 | let sandbox = client |
| 84 | .get_sandbox(GetSandboxRequest { |
| 85 | name: name.to_string(), |
| 86 | }) |
| 87 | .await |
| 88 | .into_diagnostic()? |
| 89 | .into_inner() |
| 90 | .sandbox |
| 91 | .ok_or_else(|| miette::miette!("sandbox not found"))?; |
| 92 | |
| 93 | let response = client |
| 94 | .create_ssh_session(CreateSshSessionRequest { |
| 95 | sandbox_id: sandbox.object_id().to_string(), |
| 96 | }) |
| 97 | .await |
| 98 | .into_diagnostic()?; |
| 99 | let session = response.into_inner(); |
| 100 | validate_ssh_session_response(&session) |
| 101 | .map_err(|err| miette::miette!("gateway returned invalid SSH session response: {err}"))?; |
| 102 | |
| 103 | let exe = std::env::current_exe() |
| 104 | .into_diagnostic() |
| 105 | .wrap_err("failed to resolve OpenShell executable")?; |
| 106 | let exe_command = exe.to_string_lossy().into_owned(); |
| 107 | |
| 108 | // When using Cloudflare bearer auth, the SSH CONNECT must go through the |
| 109 | // external tunnel endpoint (the cluster URL), not the server's internal |
| 110 | // scheme/host/port which may be plaintext HTTP on 127.0.0.1. |
| 111 | let gateway_url = if tls.is_bearer_auth() { |
| 112 | server.trim_end_matches('/').to_string() |
| 113 | } else { |
| 114 | // If the server returned a loopback gateway address, override it with the |
| 115 | // cluster endpoint's host. This handles the case where the server defaults |
| 116 | // to 127.0.0.1 but the cluster is actually running on a remote host. |
| 117 | #[allow(clippy::cast_possible_truncation)] |
| 118 | let gateway_port_u16 = session.gateway_port as u16; |
| 119 | let (gateway_host, gateway_port) = |
| 120 | resolve_ssh_gateway(&session.gateway_host, gateway_port_u16, server); |
| 121 | format_gateway_url(&session.gateway_scheme, &gateway_host, gateway_port) |
| 122 | }; |
| 123 | let gateway_name = tls |
| 124 | .gateway_name() |
| 125 | .ok_or_else(|| miette::miette!("gateway name is required to build SSH proxy command"))?; |
| 126 | let proxy_command = build_proxy_command( |
| 127 | &exe_command, |
| 128 | &gateway_url, |
| 129 | &session.sandbox_id, |
| 130 | &session.token, |
| 131 | gateway_name, |
| 132 | ); |
no test coverage detected