PomeriumゼロトラストプロキシとSSH多段トンネルでVPNを置き換える — Node.jsでの実装

Pomerium（ネットワークアクセス制御）
  → Oktaログインをトリガー（本人確認 + MFA）
    → PomeriumがIDトークンを取得
      → Pomeriumが認可ポリシーを確認
        → 特定のジャンプサーバーへのTCPトンネルのみ許可

class Pomerium {
  private isConnected = false;
  private pomeriumProcess: ChildProcess | null = null;
  private startPromise: Promise<void> | null = null; // 進行中の起動処理

  public async start(): Promise<void> {
    // 起動処理が進行中なら、同じPromiseを返して待たせる
    if (this.startPromise) {
      return this.startPromise;
    }

    if (this.isConnected) {
      return Promise.resolve();
    }

    this.startPromise = (async () => {
      try {
        await this.initPomeriumProcess();
        this.isConnected = true;
      } catch (error) {
        this.isConnected = false;
        throw error;
      } finally {
        this.startPromise = null; // 完了後にクリア
      }
    })();

    return this.startPromise;
  }

private initPomeriumProcess(): Promise<void> {
  return new Promise((resolve, reject) => {
    // macOSではGatekeeperの検疫属性を解除する必要がある
    if (os.platform() === "darwin") {
      execSync(`chmod +x "${this.POMERIUM_CLI_PATH}"`);
      execSync(`xattr -d com.apple.quarantine "${this.POMERIUM_CLI_PATH}"`);
    }

    this.pomeriumProcess = spawn(this.POMERIUM_CLI_PATH, [
      "tcp",
      this.POMERIUM_TARGET_HOST,
      "--browser-cmd", "echo",  // ブラウザを開かずに認証URLをstdoutに出力
      "--listen", `:${this.POMERIUM_LISTEN_PORT}`,
    ]);

    let connectionEstablished = false;

    this.pomeriumProcess.stderr?.on("data", (chunk) => {
      const message = chunk.toString();

      if (message.includes("listening on")) {
        // ポートのリッスンを開始 → まだ接続は確立していない
        this.testConnection(); // 疎通確認（副作用のみ）
      }

      if (message.includes("connection established")) {
        if (!connectionEstablished) {
          connectionEstablished = true;
          resolve(); // ← ここで初めてPromiseを解決する
        }
      }

      if (message.includes("connection closed")) {
        // 接続が切れたら再起動（実際は同じ引数でspawnを再実行、ここでは省略）
        this.pomeriumProcess = spawn(/* ...省略... */);
      }

      if (message.includes("https")) {
        // OktaログインのURLが出たらブラウザ自動化で処理
        const match = message.match(/https?:\/\/[^\s]+/g);
        if (match?.[0]) Playwright.handleOktaLogin(match[0]);
      }
    });

    // 60秒で接続が確立しなければタイムアウト
    const timeout = setTimeout(() => {
      if (!connectionEstablished) {
        this.pomeriumProcess?.kill();
        reject(new Error("Pomerium connection timed out."));
      }
    }, 60000);

    this.pomeriumProcess.once("close", () => clearTimeout(timeout));
    this.pomeriumProcess.once("error", () => clearTimeout(timeout));
  });
}

private async handleOktaLogin(url: string): Promise<void> {
  const browser = await chromium.launch({ headless: true });
  const context = await browser.newContext({ locale: "en-US" });
  const page = await context.newPage();

  try {
    await page.goto(url, { timeout: 60000 });

    // ID/パスワード入力
    await page.getByLabel("Username").fill(process.env.OKTA_USERNAME!);
    await page.getByLabel("Password").fill(process.env.OKTA_PASSWORD!);
    await page.getByRole("button", { name: "Sign In" }).click();

    // MFAコード入力（otplibでTOTP生成）
    await page.getByLabel("Enter code").waitFor({ state: "visible", timeout: 10000 });
    const otpCode = totp.generate(process.env.OKTA_MFA_SECRET!);
    await page.getByLabel("Enter code").fill(otpCode);
    await page.getByRole("button", { name: "Verify" }).click();

    await page.waitForFunction(
      () => document.title.includes("Authenticated"),
      null,
      { timeout: 10000 }
    );
  } catch (error) {
    await page.screenshot({ path: path.join(os.tmpdir(), "okta_error.png") });
    throw error;
  } finally {
    await browser.close();
  }
}

class Remote {
  private jumpTunnel?: Client;
  private remoteTunnel?: Client;

  private async connectJumpServer(): Promise<void> {
    await Pomerium.start(); // ステップ1-2が自動実行される

    return new Promise((resolve, reject) => {
      const jumpTunnel = new Client();
      jumpTunnel
        .on("ready", () => {
          this.jumpTunnel = jumpTunnel;

          jumpTunnel.on("error", () => this.handleJumpTunnelDisconnection());
          jumpTunnel.on("close", () => this.handleJumpTunnelDisconnection());

          resolve();
        })
        .on("error", reject)
        .connect({
          host: "127.0.0.1",
          port: this.pomeriumPort(),   // envによってprod/stgを切り替え
          username: credentials.SSH_USERNAME,
          password: credentials.JUMP_SERVER_PASSWORD,
          readyTimeout: 60000,
        });
    });
  }

  public async forwardToRemote(): Promise<void> {
    if (!this.jumpTunnel) await this.initJumpTunnel();

    return new Promise((resolve, reject) => {
      this.jumpTunnel!.forwardOut(
        "127.0.0.1", 8000,
        this.remoteHost(), 22,
        (err, stream) => {
          if (err) reject(err);

          const remoteTunnel = new Client();
          remoteTunnel
            .on("ready", () => {
              this.remoteTunnel = remoteTunnel;

              remoteTunnel.on("error", () => this.handleRemoteTunnelDisconnection());
              remoteTunnel.on("close", () => this.handleRemoteTunnelDisconnection());

              resolve();
            })
            .on("error", reject)
            .connect({
              sock: stream,           // ← jumpTunnelのストリームをソケットとして使用
              username: credentials.SSH_USERNAME,
              password: credentials.REMOTE_PASSWORD,
              readyTimeout: 60000,
            });
        }
      );
    });
  }

  public async execRemote(cmd: string, debug: boolean = false): Promise<string> {
    if (!this.remoteTunnel) await this.initRemoteTunnel();

    return new Promise((resolve, reject) => {
      this.remoteTunnel!.exec(cmd, (err, stream) => {
        if (err) reject(err);

        let data = "";
        stream.on("data", (chunk: Buffer) => (data += chunk.toString()));
        stream.on("end", () => resolve(data));
      });
    });
  }

  private handleJumpTunnelDisconnection() {
    console.warn("Attempting to re-establish JumpTunnel...");
    this.jumpTunnel = undefined;
    this.initJumpTunnel().catch((err) => {
      console.error(`Failed to re-establish JumpTunnel: ${err}`);
    });
  }

  private handleRemoteTunnelDisconnection() {
    console.warn("Attempting to re-establish RemoteTunnel...");
    this.remoteTunnel = undefined;
    this.initRemoteTunnel().catch((err) => {
      console.error(`Failed to re-establish RemoteTunnel: ${err}`);
    });
  }