open-in-editor-bridge 0.1.1 → 0.3.0

data/lib/open_in_editor_bridge/docker.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require "tempfile"
+
+class OpenInEditorBridge
+  class Docker
+    CONTAINER_DIRECTORY = "/open-in-editor-bridge"
+    COMPOSE_FILES = %w[compose.yaml compose.yml docker-compose.yaml docker-compose.yml].freeze
+    OVERRIDE_FILES = %w[compose.override.yaml compose.override.yml docker-compose.override.yaml docker-compose.override.yml].freeze
+
+    def initialize(env:, project_root:, service:, compose_options:)
+      @env = env.to_h
+      @project_root = File.expand_path(project_root || @env.fetch("OPEN_IN_EDITOR_PROJECT_ROOT", Dir.pwd))
+      @service = service
+      @compose_options = compose_options
+    end
+
+    def call(*args)
+      return up(args) if args.first == "up"
+
+      result = run(args)
+      bridge.call("--shutdown") if args.first == "down"
+      result
+    end
+
+    private
+
+    def configuration
+      @configuration ||= Configuration.new(env: @env, project_root: @project_root)
+    end
+
+    def bridge
+      @bridge ||= OpenInEditorBridge.new(env: @env, project_root: @project_root)
+    end
+
+    def up(args)
+      if %w[127.0.0.1 ::1 localhost].include?(configuration.bind_address)
+        raise ArgumentError, "Docker editor access requires explicit OPEN_IN_EDITOR_BRIDGE_BIND_ADDRESS (for example 0.0.0.0 on a trusted network)."
+      end
+      raise ArgumentError, "Select a Compose service for the Vite integration" if @service.to_s.empty?
+
+      # Resolve Compose inputs before acquiring a lease; invalid setup must not leave a broker behind.
+      files = compose_file_options
+      with_override do |override|
+        options = [*files, "-f", override]
+        detached?(args) ? detached_up(args, options) : foreground_up(args, options)
+      end
+    end
+
+    def foreground_up(args, options)
+      lease = SecureRandom.hex(16)
+      bridge.start_session(lease)
+      begin
+        run(args, options)
+      ensure
+        release_preserving_error(lease)
+      end
+    end
+
+    def detached_up(args, options)
+      registration = bridge.start_session("detached")
+      run(args, options)
+    rescue StandardError
+      release_preserving_error("detached") if registration == :started
+      raise
+    end
+
+    def release_preserving_error(lease)
+      original_error = $!
+      bridge.stop_session(lease)
+    rescue StandardError
+      raise unless original_error
+    end
+
+    def detached?(args)
+      flags = args.select { |arg| %w[-d --detach --detach=true --detach=false -d=true -d=false].include?(arg) }
+      !flags.empty? && !%w[--detach=false -d=false].include?(flags.last)
+    end
+
+    def run(args, extra_options = [])
+      system(@env, "docker", "compose", *@compose_options, *extra_options, *args,
+        chdir: @project_root, exception: true)
+    end
+
+    def with_override
+      configuration.ensure_runtime_directory
+      manifest = write_manifest
+      mounts = [
+        file_mount(File.join(__dir__, "vite.mjs"), "vite.mjs"),
+        file_mount(manifest, "session.json"),
+      ]
+      override = { "services" => { @service => {
+        "extra_hosts" => { "host.docker.internal" => "host-gateway" },
+        "volumes" => mounts,
+      } } }
+      Tempfile.create(["compose-", ".json"], configuration.runtime_directory) do |file|
+        file.write(JSON.generate(override))
+        file.flush
+        yield file.path
+      end
+    end
+
+    def file_mount(source, name)
+      { "type" => "bind", "source" => File.expand_path(source),
+        "target" => "#{CONTAINER_DIRECTORY}/#{name}", "read_only" => true,
+        "bind" => { "create_host_path" => false } }
+    end
+
+    def write_manifest
+      path = File.join(configuration.runtime_directory, "docker-#{configuration.port}-#{configuration.session_id}.json")
+      payload = { "session" => configuration.session_id, "target" => "http://host.docker.internal:#{configuration.port}" }
+      # Atomic replacement keeps simultaneous starts from exposing a partial identity file.
+      Tempfile.create(["session-", ".json"], configuration.runtime_directory) do |file|
+        file.write(JSON.generate(payload))
+        file.flush
+        file.chmod(0o644)
+        File.rename(file.path, path)
+      end
+      path
+    end
+
+    def compose_file_options
+      return [] if @compose_options.any? { |arg| arg == "-f" || arg == "--file" || arg.start_with?("--file=") || arg.match?(/\A-f.+/) }
+
+      if @env["COMPOSE_FILE"] && !@env["COMPOSE_FILE"].empty?
+        separator = @env.fetch("COMPOSE_PATH_SEPARATOR", File::PATH_SEPARATOR)
+        return @env.fetch("COMPOSE_FILE").split(separator).flat_map { |path| ["-f", File.expand_path(path, @project_root)] }
+      end
+
+      directory = discovery_directory
+      loop do
+        base = COMPOSE_FILES.find { |name| File.file?(File.join(directory, name)) }
+        if base
+          override = OVERRIDE_FILES.find { |name| File.file?(File.join(directory, name)) }
+          return [base, override].compact.flat_map { |name| ["-f", File.join(directory, name)] }
+        end
+        parent = File.dirname(directory)
+        raise ArgumentError, "No Compose file found; select it with compose_options: [\"-f\", path]" if parent == directory
+        directory = parent
+      end
+    end
+
+    def discovery_directory
+      @compose_options.each_with_index do |option, index|
+        return File.expand_path(@compose_options.fetch(index + 1), @project_root) if option == "--project-directory"
+        return File.expand_path(option.delete_prefix("--project-directory="), @project_root) if option.start_with?("--project-directory=")
+      end
+      @project_root
+    end
+  end
+end

data/lib/open_in_editor_bridge/server.rb

@@ -0,0 +1,209 @@
+# frozen_string_literal: true
+
+require "socket"
+require "timeout"
+require "uri"
+
+class OpenInEditorBridge
+  class Server
+    RESPONSE_PHRASES = {
+      200 => "OK", 400 => "Bad Request", 403 => "Forbidden", 404 => "Not Found",
+      405 => "Method Not Allowed", 409 => "Conflict", 500 => "Internal Server Error",
+    }.freeze
+
+    def initialize(configuration, token:)
+      @configuration = configuration
+      @token = token
+      # Only this broker mutates sessions; each lease represents one live client.
+      @sessions = {}
+      # Accepted control nonces cannot be replayed during this broker's lifetime.
+      @used_nonces = {}
+    end
+
+    def start(initial_session: nil)
+      @listener = TCPServer.new(@configuration.bind_address, @configuration.port)
+      @sessions[initial_session.fetch("id")] = initial_session.merge("leases" => ["detached"]) if initial_session
+      @configuration.write_state(@token)
+      @running = true
+    rescue StandardError
+      @listener&.close
+      raise
+    end
+
+    def serve
+      trap("INT") { stop }
+      trap("TERM") { stop }
+      while @running
+        begin
+          socket = @listener.accept
+          handle_request(socket)
+        rescue IOError, Errno::EBADF
+          break unless @running
+          raise
+        end
+      end
+    ensure
+      @listener&.close unless @listener&.closed?
+      @configuration.delete_state(expected_pid: Process.pid)
+    end
+
+    private
+
+    def stop
+      @running = false
+      @listener.close unless @listener.closed?
+    end
+
+    def handle_request(socket)
+      Timeout.timeout(2) do
+        method, target, headers, body = read_request(socket)
+        path, query = target.split("?", 2)
+        params = URI.decode_www_form(query.to_s).to_h
+        case path
+        when "/health"
+          if method == "GET"
+            nonce = headers["x-open-in-editor-nonce"]
+            if nonce && !Authentication.valid_nonce?(nonce)
+              return respond(socket, 400, { "error" => "Invalid health nonce" })
+            end
+            respond(socket, 200, { "ok" => true, "pid" => Process.pid, "protocol" => Configuration::PROTOCOL,
+              "bind_address" => @configuration.bind_address, "sessions" => @sessions.keys },
+              nonce: nonce, path: path)
+          else
+            respond(socket, 405, { "error" => "Method not allowed" })
+          end
+        when "/__open-in-editor"
+          method == "GET" ? open_in_editor(socket, params) : respond(socket, 405, { "error" => "Method not allowed" })
+        when "/sessions", "/release"
+          control_request(socket, method, path, headers, body)
+        else
+          respond(socket, 404, { "error" => "Not found" })
+        end
+      end
+    rescue ArgumentError, JSON::ParserError, EOFError => error
+      respond(socket, 400, { "error" => "Bad request: #{error.message}" })
+    rescue Timeout::Error, Errno::EPIPE, Errno::ECONNRESET
+      nil
+    ensure
+      socket.close unless socket.closed?
+    end
+
+    def read_request(socket)
+      line = socket.gets("\n", 8192)
+      raise EOFError, "Missing request line" unless line
+      method, target, = line.split(" ")
+      raise ArgumentError, "Missing request target" unless target
+
+      headers = {}
+      header_bytes = 0
+      loop do
+        line = socket.gets("\n", 8192)
+        raise EOFError, "Incomplete headers" unless line
+        header_bytes += line.bytesize
+        raise ArgumentError, "Headers too large" if header_bytes > 65_536
+        break if line == "\r\n"
+
+        name, value = line.split(":", 2)
+        raise ArgumentError, "Invalid header" unless value
+        headers[name.downcase] = value.strip
+      end
+      length = Integer(headers.fetch("content-length", "0"))
+      raise ArgumentError, "Invalid content length" unless (0..65_536).cover?(length)
+      body = length.zero? ? "" : socket.read(length)
+      raise EOFError, "Incomplete body" unless body && body.bytesize == length
+      [method, target, headers, body]
+    end
+
+    def control_request(socket, method, path, headers, body)
+      return respond(socket, 405, { "error" => "Method not allowed" }) unless method == "POST"
+      nonce = headers["x-open-in-editor-nonce"]
+      valid_nonce = Authentication.valid_nonce?(nonce) && !@used_nonces.key?(nonce)
+      return respond(socket, 403, { "error" => "Forbidden" }) unless valid_nonce
+
+      valid_signature = Authentication.valid?(headers["x-open-in-editor-signature"], @token,
+        "request", nonce, method, path, body)
+      return respond(socket, 403, { "error" => "Forbidden" }) unless valid_signature
+
+      @used_nonces[nonce] = true
+      payload = JSON.parse(body)
+      path == "/sessions" ? register(socket, payload, nonce) : release(socket, payload, nonce)
+    end
+
+    def register(socket, payload, nonce)
+      session = payload.fetch("session")
+      id = session.fetch("id")
+      lease = payload.fetch("lease")
+      existing = @sessions[id]
+      if existing && existing.reject { |key, _| key == "leases" } != session
+        return respond(socket, 409, { "error" => "Checkout already registered with different editor configuration" },
+          nonce: nonce, path: "/sessions")
+      end
+      existing ||= @sessions[id] = session.merge("leases" => [])
+      added = !existing.fetch("leases").include?(lease)
+      existing.fetch("leases") << lease if added
+      respond(socket, 200, { "ok" => true, "added" => added }, nonce: nonce, path: "/sessions")
+    end
+
+    def release(socket, payload, nonce)
+      id = payload.fetch("session_id")
+      session = @sessions[id]
+      removed = session && session.fetch("leases").delete(payload.fetch("lease"))
+      @sessions.delete(id) if session && session.fetch("leases").empty?
+      stopping = !!removed && @sessions.empty?
+      respond(socket, 200, { "ok" => true, "stopping" => stopping }, nonce: nonce, path: "/release")
+      stop if stopping
+    end
+
+    def open_in_editor(socket, params)
+      file = params["file"]
+      return respond(socket, 400, { "error" => "Missing required query parameter: file" }) if file.nil? || file.empty?
+
+      id = params["session"]
+      if id.nil?
+        return respond(socket, 400, { "error" => "Specify session when multiple checkouts are registered" }) unless @sessions.size == 1
+        id = @sessions.keys.first
+      end
+      session = @sessions[id]
+      return respond(socket, 404, { "error" => "Unknown editor session" }) unless session
+
+      translated_target = translate_target(file, session)
+      editor_command = session.fetch("editor_command")
+      pid = Process.spawn(*Shellwords.split(editor_command), "--goto", translated_target,
+        chdir: session.fetch("working_directory"))
+      Process.detach(pid)
+      respond(socket, 200, { "ok" => true, "requestedFile" => file, "translatedTarget" => translated_target,
+        "editorCommand" => editor_command, "session" => id })
+    rescue StandardError => error
+      respond(socket, 500, { "ok" => false, "error" => "Failed to open editor: #{error.message}",
+        "requestedFile" => file, "translatedTarget" => translated_target, "editorCommand" => editor_command })
+    end
+
+    def translate_target(target, session)
+      # Query parameters have already been decoded; literal percent signs are filenames.
+      match = target.match(/\A(.+?):(\d+)(?::(\d+))?\z/)
+      path = match ? match[1] : target
+      location = match ? ":#{[match[2], match[3]].compact.join(":")}" : ""
+      root = session.fetch("container_root")
+      if path == root || path.start_with?("#{root}/")
+        path = "#{session.fetch("host_root")}#{path.delete_prefix(root)}"
+      end
+      "#{path}#{location}"
+    end
+
+    def respond(socket, status, payload, nonce: nil, path: nil)
+      body = JSON.generate(payload)
+      signature_header = ""
+      if nonce
+        signature = Authentication.signature(@token, "response", nonce, status, path, body)
+        signature_header = "X-Open-In-Editor-Signature: #{signature}\r\n"
+      end
+      socket.write("HTTP/1.1 #{status} #{RESPONSE_PHRASES.fetch(status)}\r\n" \
+        "Content-Type: application/json\r\nAccess-Control-Allow-Origin: *\r\n" \
+        "X-Open-In-Editor-Bridge: #{Configuration::PROTOCOL}\r\n#{signature_header}" \
+        "Content-Length: #{body.bytesize}\r\nConnection: close\r\n\r\n#{body}")
+    rescue Errno::EPIPE, Errno::ECONNRESET
+      # A disconnected HTTP client must not take down other checkout sessions.
+      nil
+    end
+  end
+end

data/lib/open_in_editor_bridge/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class OpenInEditorBridge
-  VERSION = "0.1.1"
+  VERSION = "0.3.0"
 end

data/lib/open_in_editor_bridge/vite.mjs

@@ -0,0 +1,79 @@
+import { readFileSync } from "node:fs";
+
+const sessionManifestPath = new URL("./session.json", import.meta.url);
+const editorRouteKey = "^/__open-in-editor(?:\\?|$)";
+
+function readSession() {
+  try {
+    const manifest = JSON.parse(readFileSync(sessionManifestPath, "utf8"));
+    if (
+      !manifest ||
+      typeof manifest.session !== "string" ||
+      !/^[a-f0-9]{64}$/.test(manifest.session) ||
+      typeof manifest.target !== "string"
+    ) {
+      throw new Error("Invalid checkout identity");
+    }
+
+    const target = new URL(manifest.target);
+    if (
+      target.protocol !== "http:" ||
+      !target.hostname ||
+      target.username ||
+      target.password ||
+      target.pathname !== "/" ||
+      target.search ||
+      target.hash
+    ) {
+      throw new Error("Invalid bridge target");
+    }
+
+    return { session: manifest.session, target: target.origin };
+  } catch (cause) {
+    throw new Error("OpenInEditorBridge requires a valid Docker session manifest; start Vite through OpenInEditorBridge.compose.", { cause });
+  }
+}
+
+function withSession(requestUrl, session) {
+  const queryStart = requestUrl.indexOf("?");
+  if (queryStart === -1) return `${requestUrl}?session=${encodeURIComponent(session)}`;
+
+  const path = requestUrl.slice(0, queryStart);
+  const query = requestUrl.slice(queryStart + 1);
+  const retained = query.split("&").filter((part) => {
+    const separator = part.indexOf("=");
+    const rawName = separator === -1 ? part : part.slice(0, separator);
+    try {
+      return decodeURIComponent(rawName.replace(/\+/g, " ")) !== "session";
+    } catch {
+      return true;
+    }
+  });
+  retained.push(`session=${encodeURIComponent(session)}`);
+  return `${path}?${retained.join("&")}`;
+}
+
+export default function openInEditorBridge() {
+  const identity = readSession();
+
+  return {
+    name: "open-in-editor-bridge",
+    enforce: "post",
+    config(config) {
+      const existing = { ...config.server?.proxy };
+      delete existing["/__open-in-editor"];
+      delete existing["^/__open-in-editor$"];
+      delete existing[editorRouteKey];
+
+      config.server ??= {};
+      config.server.proxy = {
+        [editorRouteKey]: {
+          target: identity.target,
+          changeOrigin: true,
+          rewrite: (requestUrl) => withSession(requestUrl, identity.session),
+        },
+        ...existing,
+      };
+    },
+  };
+}