Replacing VPN with Pomerium Zero Trust Proxy and SSH Multi-hop Tunnels — Implementation in Node.js

Pomerium (network access control)
  → Triggers Okta login (identity verification + MFA)
    → Pomerium obtains ID token
      → Pomerium checks authorization policy
        → Allows only TCP tunnel to specific jump server

class Pomerium {
  private isConnected = false;
  private pomeriumProcess: ChildProcess | null = null;
  private startPromise: Promise<void> | null = null; // ongoing startup process

  public async start(): Promise<void> {
    // If a startup is in progress, return the same Promise and wait
    if (this.startPromise) {
      return this.startPromise;
    }

    if (this.isConnected) {
      return Promise.resolve();
    }

    this.startPromise = (async () => {
      try {
        await this.initPomeriumProcess();
        this.isConnected = true;
      } catch (error) {
        this.isConnected = false;
        throw error;
      } finally {
        this.startPromise = null; // clear after completion
      }
    })();

    return this.startPromise;
  }

private initPomeriumProcess(): Promise<void> {
  return new Promise((resolve, reject) => {
    // On macOS, the Gatekeeper quarantine attribute must be removed
    if (os.platform() === "darwin") {
      execSync(`chmod +x "${this.POMERIUM_CLI_PATH}"`);
      execSync(`xattr -d com.apple.quarantine "${this.POMERIUM_CLI_PATH}"`);
    }

    this.pomeriumProcess = spawn(this.POMERIUM_CLI_PATH, [
      "tcp",
      this.POMERIUM_TARGET_HOST,
      "--browser-cmd", "echo",  // Output auth URL to stdout without opening a browser
      "--listen", `:${this.POMERIUM_LISTEN_PORT}`,
    ]);

    let connectionEstablished = false;

    this.pomeriumProcess.stderr?.on("data", (chunk) => {
      const message = chunk.toString();

      if (message.includes("listening on")) {
        // Started listening on port → connection not yet established
        this.testConnection(); // connectivity check (side effect only)
      }

      if (message.includes("connection established")) {
        if (!connectionEstablished) {
          connectionEstablished = true;
          resolve(); // ← only here do we resolve the Promise
        }
      }

      if (message.includes("connection closed")) {
        // If connection drops, restart (in practice, re-spawn with same args; omitted here)
        this.pomeriumProcess = spawn(/* ...omitted... */);
      }

      if (message.includes("https")) {
        // When the Okta login URL appears, handle it with browser automation
        const match = message.match(/https?:\/\/[^\s]+/g);
        if (match?.[0]) Playwright.handleOktaLogin(match[0]);
      }
    });

    // Time out if connection is not established within 60 seconds
    const timeout = setTimeout(() => {
      if (!connectionEstablished) {
        this.pomeriumProcess?.kill();
        reject(new Error("Pomerium connection timed out."));
      }
    }, 60000);

    this.pomeriumProcess.once("close", () => clearTimeout(timeout));
    this.pomeriumProcess.once("error", () => clearTimeout(timeout));
  });
}

private async handleOktaLogin(url: string): Promise<void> {
  const browser = await chromium.launch({ headless: true });
  const context = await browser.newContext({ locale: "en-US" });
  const page = await context.newPage();

  try {
    await page.goto(url, { timeout: 60000 });

    // Enter ID/password
    await page.getByLabel("Username").fill(process.env.OKTA_USERNAME!);
    await page.getByLabel("Password").fill(process.env.OKTA_PASSWORD!);
    await page.getByRole("button", { name: "Sign In" }).click();

    // Enter MFA code (generate TOTP with otplib)
    await page.getByLabel("Enter code").waitFor({ state: "visible", timeout: 10000 });
    const otpCode = totp.generate(process.env.OKTA_MFA_SECRET!);
    await page.getByLabel("Enter code").fill(otpCode);
    await page.getByRole("button", { name: "Verify" }).click();

    await page.waitForFunction(
      () => document.title.includes("Authenticated"),
      null,
      { timeout: 10000 }
    );
  } catch (error) {
    await page.screenshot({ path: path.join(os.tmpdir(), "okta_error.png") });
    throw error;
  } finally {
    await browser.close();
  }
}

class Remote {
  private jumpTunnel?: Client;
  private remoteTunnel?: Client;

  private async connectJumpServer(): Promise<void> {
    await Pomerium.start(); // Steps 1-2 are executed automatically

    return new Promise((resolve, reject) => {
      const jumpTunnel = new Client();
      jumpTunnel
        .on("ready", () => {
          this.jumpTunnel = jumpTunnel;

          jumpTunnel.on("error", () => this.handleJumpTunnelDisconnection());
          jumpTunnel.on("close", () => this.handleJumpTunnelDisconnection());

          resolve();
        })
        .on("error", reject)
        .connect({
          host: "127.0.0.1",
          port: this.pomeriumPort(),   // switch between prod/stg by env
          username: credentials.SSH_USERNAME,
          password: credentials.JUMP_SERVER_PASSWORD,
          readyTimeout: 60000,
        });
    });
  }

  public async forwardToRemote(): Promise<void> {
    if (!this.jumpTunnel) await this.initJumpTunnel();

    return new Promise((resolve, reject) => {
      this.jumpTunnel!.forwardOut(
        "127.0.0.1", 8000,
        this.remoteHost(), 22,
        (err, stream) => {
          if (err) reject(err);

          const remoteTunnel = new Client();
          remoteTunnel
            .on("ready", () => {
              this.remoteTunnel = remoteTunnel;

              remoteTunnel.on("error", () => this.handleRemoteTunnelDisconnection());
              remoteTunnel.on("close", () => this.handleRemoteTunnelDisconnection());

              resolve();
            })
            .on("error", reject)
            .connect({
              sock: stream,           // ← use jumpTunnel's stream as a socket
              username: credentials.SSH_USERNAME,
              password: credentials.REMOTE_PASSWORD,
              readyTimeout: 60000,
            });
        }
      );
    });
  }

  public async execRemote(cmd: string, debug: boolean = false): Promise<string> {
    if (!this.remoteTunnel) await this.initRemoteTunnel();

    return new Promise((resolve, reject) => {
      this.remoteTunnel!.exec(cmd, (err, stream) => {
        if (err) reject(err);

        let data = "";
        stream.on("data", (chunk: Buffer) => (data += chunk.toString()));
        stream.on("end", () => resolve(data));
      });
    });
  }

  private handleJumpTunnelDisconnection() {
    console.warn("Attempting to re-establish JumpTunnel...");
    this.jumpTunnel = undefined;
    this.initJumpTunnel().catch((err) => {
      console.error(`Failed to re-establish JumpTunnel: ${err}`);
    });
  }

  private handleRemoteTunnelDisconnection() {
    console.warn("Attempting to re-establish RemoteTunnel...");
    this.remoteTunnel = undefined;
    this.initRemoteTunnel().catch((err) => {
      console.error(`Failed to re-establish RemoteTunnel: ${err}`);
    });
  }