@ai-ecoverse/slicc-kernel 1.59.0 → 1.60.0

package/dist/kernel-worker.js

@@ -2626,6 +2626,29 @@ function userEnv(account, system) {
     PATH: `${pnpm}/bin:/usr/local/bin:/usr/bin:/bin`
   };
 }
+function groupsOf(groups, names) {
+  return names.map((g) => {
+    const row = groups.find((r) => r.name === g);
+    if (!row) throw fsError("ENOENT", `no group ${g}`);
+    return row;
+  });
+}
+function homeModeOf(mode) {
+  if (mode === void 0) return void 0;
+  if (!Number.isInteger(mode) || mode < 0 || mode > 4095) {
+    throw fsError("EINVAL", `not a mode: ${String(mode)}`);
+  }
+  return mode;
+}
+function joined(name2, rows) {
+  let changed = false;
+  for (const g of rows) {
+    if (g.members.includes(name2)) continue;
+    g.members.push(name2);
+    changed = true;
+  }
+  return changed;
+}
 function homeGroupOf(groups, name2) {
   if (name2 === void 0) return void 0;
   const found = groups.find((g) => g.name === name2);
@@ -2641,14 +2664,14 @@ var UserDb = class {
     this.fs = fs;
     this.owners = owners;
   }
-  async stampHome(row, shared) {
+  async stampHome(row, shared, homeMode) {
     const home = this.fs.resolvePath("/", row.home);
     if (!this.owners || !this.fs.chown || !HOME_DIR.test(home)) return;
     if (!await this.realDir(home)) return;
     const gid = shared?.gid ?? row.gid;
     await this.fs.chown(home, { uid: row.uid, gid, follow: false, kind: "adopt" });
     const scoop = row.name.startsWith("scoop-");
-    await this.fs.chmod(home, shared ? 1512 : scoop ? 488 : 448);
+    await this.fs.chmod(home, homeMode ?? (shared ? 1512 : scoop ? 488 : 448));
     const pnpm = `${home}/.local/share/pnpm`;
     if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
   }
@@ -2762,31 +2785,33 @@ var UserDb = class {
       const groups = parsed(group);
       const found = users.find((r) => r.name === name2);
       const shared = homeGroupOf(groups, options.homeGroup);
+      const homeMode = homeModeOf(options.homeMode);
       if (found) {
+        const more = groupsOf(groups, options.groups ?? []);
+        if (more.some((g) => g.gid === found.gid)) {
+          throw fsError("EINVAL", `a user is no member of its own group ${name2}`);
+        }
         if (found.uid >= FIRST_UID && found.uid <= LAST_UID) {
           await this.provision(found);
-          await this.stampHome(found, shared);
+          await this.stampHome(found, shared, homeMode);
         }
+        if (joined(name2, more)) await this.fs.writeFile(GROUP, formatGroup(group));
         remember();
         return this.account(found, groups);
       }
       const home = homeOf(options.home ?? `/home/${name2}`);
-      const extra = [USERS_GROUP, ...options.groups ?? []].map((g) => {
-        const row2 = groups.find((r) => r.name === g);
-        if (!row2) throw fsError("ENOENT", `no group ${g}`);
-        return row2;
-      });
+      const extra = groupsOf(groups, [USERS_GROUP, ...options.groups ?? []]);
       if (groups.some((r) => r.name === name2)) throw fsError("EEXIST", `group ${name2} exists`);
       const uid = freeId(users, groups);
       const row = { name: name2, uid, gid: uid, gecos: name2, home, shell: "/bin/bash" };
-      for (const g of extra) if (!g.members.includes(name2)) g.members.push(name2);
+      joined(name2, extra);
       group.push({ name: name2, gid: uid, members: [] });
       passwd.push(row);
       const fresh = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
         await this.provision(row);
-        await this.stampHome(row, shared);
+        await this.stampHome(row, shared, homeMode);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
       } catch (err) {
@@ -2797,6 +2822,31 @@ var UserDb = class {
       return this.account(row, parsed(group));
     });
   }
+  async groups() {
+    const { group } = await this.tables();
+    return parsed(group).map(({ name: name2, gid, members }) => ({ name: name2, gid, members: [...members] }));
+  }
+  addMember(group, user) {
+    return this.member(group, user, true);
+  }
+  removeMember(group, user) {
+    return this.member(group, user, false);
+  }
+  member(name2, user, on) {
+    return this.serial(async () => {
+      const { passwd, group } = await this.tables();
+      const row = parsed(group).find((g) => g.name === name2);
+      if (!row) throw fsError("ENOENT", `no group ${String(name2)}`);
+      const who = parsed(passwd).find((u) => u.name === user);
+      if (!who) throw fsError("ENOENT", `no user ${String(user)}`);
+      if (who.gid === row.gid) throw fsError("EINVAL", `${name2} is the own group of ${user}`);
+      if (row.members.includes(user) !== on) {
+        row.members = on ? [...row.members, user] : row.members.filter((m) => m !== user);
+        await this.fs.writeFile(GROUP, formatGroup(group));
+      }
+      return { name: row.name, gid: row.gid, members: [...row.members] };
+    });
+  }
   remove(name2, options = {}) {
     return this.serial(async () => {
       const { passwd, group } = await this.tables();
@@ -8779,6 +8829,11 @@ var TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 function message(e) {
   return e instanceof Error ? e.message : String(e);
 }
+var ERRNO = /^E[A-Z]+$|^EAI_[A-Z]+$/;
+function errnoOf(e) {
+  const code = e?.code;
+  return typeof code === "string" && ERRNO.test(code) ? code : "ECONNREFUSED";
+}
 function fail(errno, text) {
   return { ok: false, errno, message: text };
 }
@@ -8822,13 +8877,13 @@ var WsHandles = class {
     let socket;
     try {
       socket = await transport.websocket({
-        url: req.url,
+        url: toHostLoopback(req.url),
         protocols: req.protocols,
         headers: req.headers,
         signal: entry.abort.signal
       });
     } catch (e) {
-      return fail("ECONNREFUSED", message(e));
+      return fail(errnoOf(e), message(e));
     }
     if (!this.open.has(handle)) {
       socket.close(1001, "the program went away");
@@ -14486,7 +14541,14 @@ function answered(data, remote, uplink) {
   else return false;
   return true;
 }
-var USERS_OPS = /* @__PURE__ */ new Set(["users-add", "users-remove", "users-list"]);
+var USERS_OPS = /* @__PURE__ */ new Set([
+  "users-add",
+  "users-remove",
+  "users-list",
+  "groups-list",
+  "groups-add-member",
+  "groups-remove-member"
+]);
 function isUsersRequest(req) {
   return USERS_OPS.has(req.op);
 }
@@ -14500,6 +14562,9 @@ function failure(err) {
 function usersOp(l, req) {
   if (req.op === "users-add") return l.users.add(req.user);
   if (req.op === "users-remove") return l.users.remove(req.name, req.options);
+  if (req.op === "groups-list") return l.users.groups();
+  if (req.op === "groups-add-member") return l.users.addMember(req.group, req.user);
+  if (req.op === "groups-remove-member") return l.users.removeMember(req.group, req.user);
   return l.users.list();
 }
 function hostOptions(req) {