feat: convert ssh tunnels into a plugin

src/backend/database/database.ts

@@ -10,7 +10,6 @@ import hostRoutes from "./routes/host.js";
 import alertRoutes from "./routes/alerts.js";
 import credentialsRoutes from "./routes/credentials.js";
 import sshAuthRoutes from "./routes/ssh-auth-routes.js";
-import c2sTunnelPresetRoutes from "./routes/c2s-tunnel-presets.js";
 import terminalRoutes from "./routes/terminal.js";
 import sessionLogRoutes from "./routes/session-log-routes.js";
 import sessionSharingRoutes from "../hosts/session-sharing/routes.js";
@@ -1809,7 +1808,6 @@ app.use("/host", hostRoutes);
 app.use("/alerts", alertRoutes);
 app.use("/credentials", credentialsRoutes);
 app.use("/ssh-auth", sshAuthRoutes);
-app.use("/c2s-tunnel-presets", c2sTunnelPresetRoutes);
 app.use("/terminal", terminalRoutes);
 app.use("/session_logs", sessionLogRoutes);
 app.use("/session-sharing", sessionSharingRoutes);

src/backend/database/db/index.ts

@@ -394,18 +394,6 @@ async function initializeCompleteDatabase(): Promise<void> {
         FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
     );
 
-    CREATE TABLE IF NOT EXISTS c2s_tunnel_presets (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        user_id TEXT NOT NULL,
-        name TEXT NOT NULL,
-        config TEXT NOT NULL,
-        platform TEXT,
-        computer_name TEXT,
-        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-        FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
-    );
-
     CREATE TABLE IF NOT EXISTS ssh_folders (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
         user_id TEXT NOT NULL,

src/backend/database/db/schema.mysql.ts

@@ -466,23 +466,6 @@ export const sshCredentialUsage = mysqlTable(
   ],
 );
 
-export const c2sTunnelPresets = mysqlTable("c2s_tunnel_presets", {
-  id: int("id").autoincrement().primaryKey(),
-  userId: varchar("user_id", { length: 255 })
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  name: varchar("name", { length: 255 }).notNull(),
-  config: text("config").notNull(),
-  platform: text("platform"),
-  computerName: text("computer_name"),
-  createdAt: varchar("created_at", { length: 255 })
-    .notNull()
-    .default(sql`(CURRENT_TIMESTAMP)`),
-  updatedAt: varchar("updated_at", { length: 255 })
-    .notNull()
-    .default(sql`(CURRENT_TIMESTAMP)`),
-});
-
 export const sshFolders = mysqlTable(
   "ssh_folders",
   {

src/backend/database/db/schema.pg.ts

@@ -467,23 +467,6 @@ export const sshCredentialUsage = pgTable(
   ],
 );
 
-export const c2sTunnelPresets = pgTable("c2s_tunnel_presets", {
-  id: serial("id").primaryKey(),
-  userId: varchar("user_id", { length: 255 })
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  name: varchar("name", { length: 255 }).notNull(),
-  config: text("config").notNull(),
-  platform: text("platform"),
-  computerName: text("computer_name"),
-  createdAt: varchar("created_at", { length: 255 })
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-  updatedAt: varchar("updated_at", { length: 255 })
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-});
-
 export const sshFolders = pgTable(
   "ssh_folders",
   {

src/backend/database/db/schema.ts

@@ -459,23 +459,6 @@ export const sshCredentialUsage = sqliteTable(
   ],
 );
 
-export const c2sTunnelPresets = sqliteTable("c2s_tunnel_presets", {
-  id: integer("id").primaryKey({ autoIncrement: true }),
-  userId: text("user_id")
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  name: text("name").notNull(),
-  config: text("config").notNull(),
-  platform: text("platform"),
-  computerName: text("computer_name"),
-  createdAt: text("created_at")
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-  updatedAt: text("updated_at")
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-});
-
 export const sshFolders = sqliteTable(
   "ssh_folders",
   {

src/backend/database/repositories/c2s-tunnel-preset-repository.ts

@@ -1,132 +0,0 @@
-import { and, asc, eq, sql } from "drizzle-orm";
-import { c2sTunnelPresets } from "../db/schema.js";
-import type { DatabaseContext } from "./database-context.js";
-import { rowsAffected } from "./mutation-result.js";
-import { insertReturning, updateReturning } from "./returning.js";
-
-export type C2sTunnelPresetRecord = typeof c2sTunnelPresets.$inferSelect;
-
-export interface C2sTunnelPresetCreateInput {
-  name: string;
-  config: string;
-  platform?: string | null;
-  computerName?: string | null;
-}
-
-export type C2sTunnelPresetUpdateInput = Partial<C2sTunnelPresetCreateInput>;
-
-export class C2sTunnelPresetRepository {
-  constructor(
-    private readonly context: DatabaseContext,
-    private readonly onWrite?: () => void | Promise<void>,
-  ) {}
-
-  async listByUserId(userId: string): Promise<C2sTunnelPresetRecord[]> {
-    return this.context.drizzle
-      .select()
-      .from(c2sTunnelPresets)
-      .where(eq(c2sTunnelPresets.userId, userId))
-      .orderBy(asc(c2sTunnelPresets.name));
-  }
-
-  async findByIdForUser(
-    userId: string,
-    id: number,
-  ): Promise<C2sTunnelPresetRecord | null> {
-    const rows = await this.context.drizzle
-      .select()
-      .from(c2sTunnelPresets)
-      .where(
-        and(eq(c2sTunnelPresets.id, id), eq(c2sTunnelPresets.userId, userId)),
-      )
-      .limit(1);
-
-    return rows[0] ?? null;
-  }
-
-  async hasNameForUser(
-    userId: string,
-    name: string,
-    excludingId?: number,
-  ): Promise<boolean> {
-    const rows = await this.context.drizzle
-      .select({ id: c2sTunnelPresets.id })
-      .from(c2sTunnelPresets)
-      .where(
-        and(
-          eq(c2sTunnelPresets.userId, userId),
-          eq(c2sTunnelPresets.name, name),
-        ),
-      );
-
-    return rows.some((row) => row.id !== excludingId);
-  }
-
-  async createForUser(
-    userId: string,
-    input: C2sTunnelPresetCreateInput,
-  ): Promise<C2sTunnelPresetRecord> {
-    const [created] = await insertReturning(this.context, c2sTunnelPresets, {
-      userId,
-      name: input.name,
-      config: input.config,
-      platform: input.platform ?? null,
-      computerName: input.computerName ?? null,
-    });
-
-    await this.afterWrite();
-    return created;
-  }
-
-  async updateForUser(
-    userId: string,
-    id: number,
-    updates: C2sTunnelPresetUpdateInput,
-  ): Promise<C2sTunnelPresetRecord | null> {
-    const [updated] = await updateReturning(
-      this.context,
-      c2sTunnelPresets,
-      {
-        ...updates,
-        updatedAt: sql`CURRENT_TIMESTAMP`,
-      },
-      and(eq(c2sTunnelPresets.id, id), eq(c2sTunnelPresets.userId, userId)),
-    );
-
-    if (updated) {
-      await this.afterWrite();
-    }
-
-    return updated ?? null;
-  }
-
-  async deleteForUser(userId: string, id: number): Promise<boolean> {
-    const result = await this.context.drizzle
-      .delete(c2sTunnelPresets)
-      .where(
-        and(eq(c2sTunnelPresets.id, id), eq(c2sTunnelPresets.userId, userId)),
-      );
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result) > 0;
-  }
-
-  async deleteByUserId(userId: string): Promise<number> {
-    const result = await this.context.drizzle
-      .delete(c2sTunnelPresets)
-      .where(eq(c2sTunnelPresets.userId, userId));
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result);
-  }
-
-  private async afterWrite(): Promise<void> {
-    await this.onWrite?.();
-  }
-}

src/backend/database/repositories/factory.ts

@@ -9,7 +9,6 @@ import { NotificationChannelRepository } from "./notification-channel-repository
 import { AutomationRepository } from "./automation-repository.js";
 import { ApiKeyRepository } from "./api-key-repository.js";
 import { AuditLogRepository } from "./audit-log-repository.js";
-import { C2sTunnelPresetRepository } from "./c2s-tunnel-preset-repository.js";
 import { CommandHistoryRepository } from "./command-history-repository.js";
 import { CredentialRepository } from "./credential-repository.js";
 import { DashboardServiceLinkRepository } from "./dashboard-service-link-repository.js";
@@ -185,13 +184,6 @@ export function createCurrentAuditLogRepository(): AuditLogRepository {
   );
 }
 
-export function createCurrentC2sTunnelPresetRepository(): C2sTunnelPresetRepository {
-  return new C2sTunnelPresetRepository(
-    createCurrentRepositoryContext(),
-    createCurrentRepositoryWriteHook("c2s_tunnel_preset_repository_write"),
-  );
-}
-
 export function createCurrentCommandHistoryRepository(): CommandHistoryRepository {
   return new CommandHistoryRepository(
     createCurrentRepositoryContext(),

src/backend/database/routes/c2s-tunnel-presets.ts

@@ -1,293 +0,0 @@
-import type {
-  AuthenticatedRequest,
-  TunnelConnection,
-} from "../../../types/index.js";
-import express, { type Request, type Response } from "express";
-import { authLogger, databaseLogger } from "../../utils/logger.js";
-import { AuthManager } from "../../utils/auth-manager.js";
-import type { C2sTunnelPresetRecord } from "../repositories/c2s-tunnel-preset-repository.js";
-import { createCurrentC2sTunnelPresetRepository } from "../repositories/factory.js";
-
-const router = express.Router();
-
-const authManager = AuthManager.getInstance();
-const authenticateJWT = authManager.createAuthMiddleware();
-const requireDataAccess = authManager.createDataAccessMiddleware();
-
-function isNonEmptyString(val: unknown): val is string {
-  return typeof val === "string" && val.trim().length > 0;
-}
-
-function parsePreset(row: C2sTunnelPresetRecord) {
-  return {
-    ...row,
-    config: JSON.parse(row.config) as TunnelConnection[],
-  };
-}
-
-function validateConfig(config: unknown): config is TunnelConnection[] {
-  if (!Array.isArray(config)) return false;
-  return config.every((item) => {
-    if (!item || typeof item !== "object") return false;
-    const tunnel = item as Partial<TunnelConnection>;
-    const mode = tunnel.mode || tunnel.tunnelType;
-    return (
-      tunnel.scope === "c2s" &&
-      (mode === "local" || mode === "remote" || mode === "dynamic") &&
-      typeof tunnel.sourcePort === "number" &&
-      tunnel.sourcePort >= 1 &&
-      tunnel.sourcePort <= 65535 &&
-      (mode === "dynamic" ||
-        (typeof tunnel.endpointPort === "number" &&
-          tunnel.endpointPort >= 1 &&
-          tunnel.endpointPort <= 65535))
-    );
-  });
-}
-
-/**
- * @openapi
- * /c2s-tunnel-presets:
- *   get:
- *     summary: List client tunnel presets
- *     description: Returns the authenticated user's saved client-to-server tunnel presets.
- *     tags:
- *       - Tunnel Presets
- *     responses:
- *       200:
- *         description: List of tunnel presets.
- *       401:
- *         description: Authentication required.
- *       500:
- *         description: Failed to list presets.
- */
-router.get(
-  "/",
-  authenticateJWT,
-  requireDataAccess,
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    if (!isNonEmptyString(userId)) {
-      return res.status(400).json({ error: "Invalid userId" });
-    }
-
-    try {
-      const result =
-        await createCurrentC2sTunnelPresetRepository().listByUserId(userId);
-      res.json(result.map(parsePreset));
-    } catch (error) {
-      authLogger.error("Failed to fetch C2S tunnel presets", error);
-      res.status(500).json({ error: "Failed to fetch C2S tunnel presets" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /c2s-tunnel-presets:
- *   post:
- *     summary: Create a client tunnel preset
- *     description: Saves a named client-to-server tunnel configuration for the authenticated user.
- *     tags:
- *       - Tunnel Presets
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             properties:
- *               name:
- *                 type: string
- *               config:
- *                 type: array
- *                 items:
- *                   type: object
- *     responses:
- *       200:
- *         description: Preset created.
- *       400:
- *         description: Invalid name or config.
- *       401:
- *         description: Authentication required.
- *       500:
- *         description: Failed to create preset.
- */
-router.post(
-  "/",
-  authenticateJWT,
-  requireDataAccess,
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const { name, config, platform, computerName } = req.body;
-
-    if (!isNonEmptyString(userId) || !isNonEmptyString(name)) {
-      return res.status(400).json({ error: "Preset name is required" });
-    }
-    if (!validateConfig(config)) {
-      return res
-        .status(400)
-        .json({ error: "Invalid C2S tunnel configuration" });
-    }
-
-    const trimmedName = name.trim();
-    try {
-      const presetRepository = createCurrentC2sTunnelPresetRepository();
-      if (await presetRepository.hasNameForUser(userId, trimmedName)) {
-        return res.status(409).json({ error: "Preset name already exists" });
-      }
-
-      const created = await presetRepository.createForUser(userId, {
-        name: trimmedName,
-        config: JSON.stringify(config),
-        platform: platform?.trim() || null,
-        computerName: computerName?.trim() || null,
-      });
-
-      databaseLogger.info("C2S tunnel preset created", {
-        operation: "c2s_tunnel_preset_create",
-        userId,
-        presetId: created.id,
-      });
-      res.status(201).json(parsePreset(created));
-    } catch (error) {
-      authLogger.error("Failed to create C2S tunnel preset", error);
-      res.status(500).json({ error: "Failed to create C2S tunnel preset" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /c2s-tunnel-presets/{id}:
- *   put:
- *     summary: Update a client tunnel preset
- *     description: Updates the name or config of one of the authenticated user's tunnel presets.
- *     tags:
- *       - Tunnel Presets
- *     parameters:
- *       - in: path
- *         name: id
- *         required: true
- *         schema: { type: integer }
- *     responses:
- *       200:
- *         description: Preset updated.
- *       400:
- *         description: Invalid name or config.
- *       404:
- *         description: Preset not found.
- *       500:
- *         description: Failed to update preset.
- */
-router.put(
-  "/:id",
-  authenticateJWT,
-  requireDataAccess,
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const id = Number(req.params.id);
-    const { name, config, platform, computerName } = req.body;
-
-    if (!isNonEmptyString(userId) || !Number.isInteger(id)) {
-      return res.status(400).json({ error: "Invalid request" });
-    }
-
-    try {
-      const presetRepository = createCurrentC2sTunnelPresetRepository();
-      const existing = await presetRepository.findByIdForUser(userId, id);
-      if (!existing) {
-        return res.status(404).json({ error: "Preset not found" });
-      }
-
-      const updateFields: Parameters<typeof presetRepository.updateForUser>[2] =
-        {};
-
-      if (name !== undefined) {
-        if (!isNonEmptyString(name)) {
-          return res.status(400).json({ error: "Preset name is required" });
-        }
-        const trimmedName = name.trim();
-        if (await presetRepository.hasNameForUser(userId, trimmedName, id)) {
-          return res.status(409).json({ error: "Preset name already exists" });
-        }
-        updateFields.name = trimmedName;
-      }
-
-      if (config !== undefined) {
-        if (!validateConfig(config)) {
-          return res
-            .status(400)
-            .json({ error: "Invalid C2S tunnel configuration" });
-        }
-        updateFields.config = JSON.stringify(config);
-      }
-      if (platform !== undefined)
-        updateFields.platform = platform?.trim() || null;
-      if (computerName !== undefined)
-        updateFields.computerName = computerName?.trim() || null;
-
-      const updated = await presetRepository.updateForUser(
-        userId,
-        id,
-        updateFields,
-      );
-      res.json(parsePreset(updated ?? existing));
-    } catch (error) {
-      authLogger.error("Failed to update C2S tunnel preset", error);
-      res.status(500).json({ error: "Failed to update C2S tunnel preset" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /c2s-tunnel-presets/{id}:
- *   delete:
- *     summary: Delete a client tunnel preset
- *     description: Deletes one of the authenticated user's tunnel presets.
- *     tags:
- *       - Tunnel Presets
- *     parameters:
- *       - in: path
- *         name: id
- *         required: true
- *         schema: { type: integer }
- *     responses:
- *       200:
- *         description: Preset deleted.
- *       404:
- *         description: Preset not found.
- *       500:
- *         description: Failed to delete preset.
- */
-router.delete(
-  "/:id",
-  authenticateJWT,
-  requireDataAccess,
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const id = Number(req.params.id);
-
-    if (!isNonEmptyString(userId) || !Number.isInteger(id)) {
-      return res.status(400).json({ error: "Invalid request" });
-    }
-
-    try {
-      const presetRepository = createCurrentC2sTunnelPresetRepository();
-      const existing = await presetRepository.findByIdForUser(userId, id);
-      if (!existing) {
-        return res.status(404).json({ error: "Preset not found" });
-      }
-
-      await presetRepository.deleteForUser(userId, id);
-
-      res.json({ success: true });
-    } catch (error) {
-      authLogger.error("Failed to delete C2S tunnel preset", error);
-      res.status(500).json({ error: "Failed to delete C2S tunnel preset" });
-    }
-  },
-);
-
-export default router;

src/backend/database/routes/delete-user-data.ts

@@ -4,7 +4,6 @@ import {
   createCurrentNotificationChannelRepository,
   createCurrentApiKeyRepository,
   createCurrentAuditLogRepository,
-  createCurrentC2sTunnelPresetRepository,
   createCurrentCommandHistoryRepository,
   createCurrentCredentialRepository,
   createCurrentDashboardServiceLinkRepository,
@@ -110,7 +109,6 @@ export async function deleteUserAndRelatedData(
     await createCurrentDashboardServiceLinkRepository().deleteByUserId(userId);
     await createCurrentHomepageItemRepository().deleteByUserId(userId);
     await createCurrentHomepageLayoutRepository().deleteByUserId(userId);
-    await createCurrentC2sTunnelPresetRepository().deleteByUserId(userId);
     await createCurrentOpksshTokenRepository().deleteByUserId(userId);
     await createCurrentVaultTokenRepository().deleteByUserId(userId);
     await createCurrentVaultProfileRepository().deleteByUserId(userId);