@cjhyy/code-shell-server 0.9.7 → 0.9.9

package/dist/hub/auth-store.js

@@ -0,0 +1,316 @@
+import { createHash, randomBytes, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
+import { chmodSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { acquireFileLock } from "@cjhyy/code-shell-core/internal";
+export const HUB_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1_000;
+const MAX_SESSIONS = 64;
+const MAX_STORE_BYTES = 128 * 1024;
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+const SCRYPT_OPTIONS = { N: 32_768, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+export class HubAuthError extends Error {
+    statusCode;
+    constructor(statusCode, message) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+export class HubAuthStore {
+    filePath;
+    sessionTtlMs;
+    now;
+    maxSessions;
+    constructor(options) {
+        this.filePath = join(options.dataDir, "hub", "auth.json");
+        this.now = options.now ?? Date.now;
+        this.sessionTtlMs = options.sessionTtlMs ?? HUB_SESSION_TTL_MS;
+        this.maxSessions = options.maxSessions ?? MAX_SESSIONS;
+        if (!Number.isSafeInteger(this.sessionTtlMs) || this.sessionTtlMs < 1_000) {
+            throw new Error("Hub session lifetime must be at least 1,000 milliseconds");
+        }
+        if (!Number.isSafeInteger(this.maxSessions) ||
+            this.maxSessions < 1 ||
+            this.maxSessions > MAX_SESSIONS) {
+            throw new Error(`Hub session limit must be between 1 and ${MAX_SESSIONS}`);
+        }
+    }
+    /** Only the process that creates the store receives the one-time secret. */
+    initialize() {
+        this.ensureDirectory();
+        const release = acquireFileLock(this.filePath);
+        try {
+            const current = this.read(true);
+            if (current) {
+                chmodSync(this.filePath, 0o600);
+                return undefined;
+            }
+            const token = randomToken();
+            this.write({ version: 1, bootstrapTokenHash: hashToken(token), account: null, sessions: [] });
+            return token;
+        }
+        finally {
+            release();
+        }
+    }
+    isInitialized() {
+        return this.read().account !== null;
+    }
+    async setup(input) {
+        const normalized = validateLoginInput(input);
+        this.checkBootstrap(this.read(), input.token);
+        const salt = randomBytes(16).toString("hex");
+        // Never await with the synchronous cross-process lock held.
+        const passwordHash = await hashPassword(input.password, salt);
+        return this.mutate((record) => {
+            this.checkBootstrap(record, input.token);
+            record.account = {
+                username: normalized.username,
+                passwordHash,
+                passwordSalt: salt,
+                createdAt: this.now(),
+            };
+            record.bootstrapTokenHash = null;
+            return { result: this.grant(record, normalized.deviceName), changed: true };
+        });
+    }
+    async login(input, replaceToken) {
+        const normalized = validateLoginInput(input);
+        const account = this.read().account;
+        if (!account)
+            throw new HubAuthError(401, "Invalid username or password");
+        const candidate = await hashPassword(input.password, account.passwordSalt);
+        if (!safeHashEqual(candidate, account.passwordHash) ||
+            normalized.username !== account.username) {
+            throw new HubAuthError(401, "Invalid username or password");
+        }
+        return this.mutate((record) => {
+            if (!record.account || !safeHashEqual(record.account.passwordHash, account.passwordHash)) {
+                throw new HubAuthError(401, "Invalid username or password");
+            }
+            return { result: this.grant(record, normalized.deviceName, replaceToken), changed: true };
+        });
+    }
+    authenticate(token) {
+        if (!token || !TOKEN_PATTERN.test(token))
+            return null;
+        return this.mutate((record) => {
+            const now = this.now();
+            const tokenHash = hashToken(token);
+            const session = record.sessions.find((row) => safeHashEqual(row.tokenHash, tokenHash));
+            if (!record.account || !session || session.expiresAt <= now || session.createdAt > now) {
+                return { result: null, changed: false };
+            }
+            // Persist activity at most once per minute; validation always reads disk.
+            const changed = now - session.lastSeenAt >= 60_000;
+            if (changed)
+                session.lastSeenAt = now;
+            return { result: this.toPublic(record, session), changed };
+        });
+    }
+    listSessions() {
+        const record = this.read();
+        const now = this.now();
+        return record.sessions
+            .filter((session) => session.expiresAt > now && session.createdAt <= now)
+            .map((session) => this.toPublic(record, session))
+            .sort((a, b) => b.lastSeenAt - a.lastSeenAt);
+    }
+    revoke(id) {
+        return this.mutate((record) => {
+            const index = record.sessions.findIndex((session) => session.id === id);
+            if (index < 0)
+                return { result: false, changed: false };
+            record.sessions.splice(index, 1);
+            return { result: true, changed: true };
+        });
+    }
+    checkBootstrap(record, token) {
+        if (record.account)
+            throw new HubAuthError(409, "Hub has already been initialized");
+        if (typeof token !== "string" ||
+            !TOKEN_PATTERN.test(token) ||
+            !safeHashEqual(hashToken(token), record.bootstrapTokenHash)) {
+            throw new HubAuthError(401, "Invalid initialization token");
+        }
+    }
+    grant(record, deviceName, replaceToken) {
+        const now = this.now();
+        const replacedHash = replaceToken && TOKEN_PATTERN.test(replaceToken) ? hashToken(replaceToken) : null;
+        const revokedSessionIds = [];
+        record.sessions = record.sessions.filter((row) => {
+            const remove = row.expiresAt <= now ||
+                (replacedHash !== null && safeHashEqual(row.tokenHash, replacedHash));
+            if (remove)
+                revokedSessionIds.push(row.id);
+            return !remove;
+        });
+        if (record.sessions.length >= this.maxSessions) {
+            record.sessions.sort((a, b) => a.lastSeenAt - b.lastSeenAt);
+            revokedSessionIds.push(record.sessions.shift().id);
+        }
+        const token = randomToken();
+        const session = {
+            id: randomUUID(),
+            deviceName,
+            tokenHash: hashToken(token),
+            createdAt: now,
+            lastSeenAt: now,
+            expiresAt: now + this.sessionTtlMs,
+        };
+        record.sessions.push(session);
+        return { token, session: this.toPublic(record, session), revokedSessionIds };
+    }
+    toPublic(record, session) {
+        return {
+            id: session.id,
+            username: record.account.username,
+            deviceName: session.deviceName,
+            createdAt: session.createdAt,
+            lastSeenAt: session.lastSeenAt,
+            expiresAt: session.expiresAt,
+        };
+    }
+    mutate(mutation) {
+        this.ensureDirectory();
+        const release = acquireFileLock(this.filePath);
+        try {
+            const record = this.read();
+            const { result, changed } = mutation(record);
+            if (changed)
+                this.write(record);
+            return result;
+        }
+        finally {
+            release();
+        }
+    }
+    ensureDirectory() {
+        const parent = dirname(this.filePath);
+        mkdirSync(parent, { recursive: true, mode: 0o700 });
+        const metadata = lstatSync(parent);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink())
+            throw new Error("Invalid Hub auth directory");
+        chmodSync(parent, 0o700);
+    }
+    read(allowMissing = false) {
+        let descriptor;
+        try {
+            const metadata = lstatSync(this.filePath);
+            if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_STORE_BYTES) {
+                throw new Error("Invalid Hub auth file");
+            }
+            descriptor = openSync(this.filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = fstatSync(descriptor);
+            if (!opened.isFile() || opened.size > MAX_STORE_BYTES)
+                throw new Error("Invalid Hub auth file");
+            const record = JSON.parse(readFileSync(descriptor, "utf8"));
+            if (!isAuthRecord(record))
+                throw new Error("Invalid Hub auth record");
+            return record;
+        }
+        catch (error) {
+            if (allowMissing && error.code === "ENOENT")
+                return undefined;
+            // A malformed or missing established store must never reopen bootstrap.
+            throw new Error("Hub authentication store is unavailable or corrupt", { cause: error });
+        }
+        finally {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
+        }
+    }
+    write(record) {
+        const serialized = JSON.stringify(record, null, 2);
+        if (Buffer.byteLength(serialized) > MAX_STORE_BYTES)
+            throw new Error("Hub auth store limit exceeded");
+        const temp = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            writeFileSync(temp, serialized, { encoding: "utf8", flag: "wx", mode: 0o600 });
+            renameSync(temp, this.filePath);
+        }
+        finally {
+            rmSync(temp, { force: true });
+        }
+    }
+}
+function validateLoginInput(input) {
+    if (!isLabel(input.username, 64) ||
+        typeof input.password !== "string" ||
+        input.password.length < 12 ||
+        input.password.length > 256) {
+        throw new HubAuthError(400, "Use a username of 1–64 characters and a password of 12–256 characters");
+    }
+    if (input.deviceName !== undefined && !isLabel(input.deviceName, 100)) {
+        throw new HubAuthError(400, "Device name must contain 1–100 characters");
+    }
+    return { username: input.username.trim(), deviceName: input.deviceName?.trim() ?? "Browser" };
+}
+function randomToken() {
+    return randomBytes(32).toString("base64url");
+}
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+function safeHashEqual(a, b) {
+    return (HASH_PATTERN.test(a) &&
+        HASH_PATTERN.test(b) &&
+        timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex")));
+}
+function hashPassword(password, salt) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, 32, SCRYPT_OPTIONS, (error, key) => {
+            if (error)
+                reject(error);
+            else
+                resolve(key.toString("hex"));
+        });
+    });
+}
+function isLabel(value, max) {
+    return (typeof value === "string" &&
+        value.trim().length > 0 &&
+        value.length <= max &&
+        !/[\u0000-\u001f\u007f]/.test(value));
+}
+function isTimestamp(value) {
+    return Number.isSafeInteger(value) && value >= 0;
+}
+function isAuthRecord(value) {
+    if (!value ||
+        value.version !== 1 ||
+        !Array.isArray(value.sessions) ||
+        value.sessions.length > MAX_SESSIONS)
+        return false;
+    if (value.account === null) {
+        return (typeof value.bootstrapTokenHash === "string" &&
+            HASH_PATTERN.test(value.bootstrapTokenHash) &&
+            value.sessions.length === 0);
+    }
+    const account = value.account;
+    if (!account ||
+        value.bootstrapTokenHash !== null ||
+        !isLabel(account.username, 64) ||
+        !HASH_PATTERN.test(account.passwordHash) ||
+        !/^[a-f0-9]{32}$/.test(account.passwordSalt) ||
+        !isTimestamp(account.createdAt))
+        return false;
+    const ids = new Set();
+    const hashes = new Set();
+    return value.sessions.every((session) => {
+        if (!session ||
+            !/^[a-f0-9-]{36}$/.test(session.id) ||
+            !isLabel(session.deviceName, 100) ||
+            !HASH_PATTERN.test(session.tokenHash) ||
+            !isTimestamp(session.createdAt) ||
+            !isTimestamp(session.lastSeenAt) ||
+            !isTimestamp(session.expiresAt) ||
+            session.expiresAt <= session.createdAt ||
+            session.lastSeenAt < session.createdAt ||
+            ids.has(session.id) ||
+            hashes.has(session.tokenHash))
+            return false;
+        ids.add(session.id);
+        hashes.add(session.tokenHash);
+        return true;
+    });
+}

package/dist/hub/configuration.d.ts

@@ -0,0 +1,64 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { probeConfiguredModel } from "./model-probe.js";
+export declare class HubConfigurationError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export interface HubConfigurationOptions {
+    cwd: string;
+    /** Host serializes changes against active/staged runs and refreshes its idle worker. */
+    withMutation?: <T>(write: () => Promise<T>) => Promise<T>;
+    /** Recheck the device after reading its request body, before writing settings. */
+    isAuthorized?: (request: IncomingMessage) => Promise<boolean>;
+    ownerId?: (request: IncomingMessage) => Promise<string | undefined>;
+    /** Test seam; production always uses the shared Core client. */
+    probe?: typeof probeConfiguredModel;
+}
+/** The caller must authenticate and check Origin before dispatching any request here. */
+export declare function createHubConfiguration(options: HubConfigurationOptions): {
+    handle: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    snapshot: () => {
+        workspace: {
+            path: string;
+            settingsScope: "local";
+            skillDirectories: string[];
+        };
+        defaults: {
+            auxText?: string | undefined;
+            text?: string | undefined;
+        };
+        connections: {
+            id: string;
+            revision: string;
+            catalogId: string;
+            tag: "image" | "text" | "video" | "audio" | "speech";
+            model: string;
+            baseUrl: string;
+            hasApiKey: boolean;
+            needsKey: boolean;
+        }[];
+        catalog: {
+            id: string;
+            displayName: string;
+            adapterKind: string;
+            defaultBaseUrl: string;
+            needsKey: boolean;
+        }[];
+        skills: {
+            disabledReason?: string | undefined;
+            name: string;
+            description: string;
+            source: "user" | "project" | "plugin" | "panel-app";
+            enabled: boolean;
+        }[];
+        mcpServers: {
+            name: string;
+            transport: string;
+            enabled: boolean;
+        }[];
+        restartRequired: boolean;
+    };
+    cancelOwner: (owner: string) => void;
+    close: () => void;
+};
+export type HubConfigurationSnapshot = ReturnType<ReturnType<typeof createHubConfiguration>["snapshot"]>;