@cortexkit/common-auth 0.9.3 → 0.9.5

package/dist/claustrum/enrollment.d.ts

@@ -91,6 +91,16 @@ export declare function hostEnrollmentPaths(input: {
     override?: string;
     cwd?: string;
 }): ClaustrumEnrollmentPaths;
+/** Account-file paths are injectable for isolated setup tests; no environment overrides. */
+export interface EnrollmentAncestorOptions {
+    passwdPath?: string;
+    groupPath?: string;
+}
+/**
+ * Protect setup writes from directory replacement. Group write access is safe
+ * only when local account records prove that the effective user's group is private.
+ */
+export declare function refuseWritableAncestor(parent: string, options?: EnrollmentAncestorOptions): Promise<void>;
 export declare function readClaustrumEnrollmentStatus(paths: ClaustrumEnrollmentPaths, proposedName: string): Promise<ClaustrumEnrollmentStatus>;
 /**
  * Read fresh bearer material for one scoped operation; never publish it.
@@ -111,6 +121,7 @@ export declare class ClaustrumEnrollmentManager {
         now?: () => number;
         mintSecret?: () => string;
         writeTokenFile?: typeof writeEnrollmentTokenFile;
+        ancestorOptions?: EnrollmentAncestorOptions;
     });
     status(): Promise<ClaustrumEnrollmentStatus>;
     resetTerminal(): Promise<ClaustrumEnrollmentResetResult>;

package/dist/claustrum/enrollment.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { constants as fsConstants } from 'node:fs';
-import { chmod, mkdir, open, realpath, rename, stat, unlink, } from 'node:fs/promises';
+import { chmod, mkdir, open, readFile, realpath, rename, stat, unlink, } from 'node:fs/promises';
 import { basename, dirname, extname, isAbsolute, join, resolve, } from 'node:path';
 import { ClaustrumCredentialError, ClaustrumClient as ClaustrumWireClient, writeEnrollmentTokenFile, } from '@cortexkit/claustrum-client';
 import { acquireRefreshFileLock } from '../fs/index.js';
@@ -183,7 +183,7 @@ function validateReadableSecretFile(metadata) {
     if ((metadata.mode & 0o077) !== 0) {
         throw new ClaustrumConsumerError('unsafe-file', 'Claustrum enrollment file must be owner-only');
     }
-    const expectedUid = process.getuid?.();
+    const expectedUid = process.geteuid?.();
     if (expectedUid !== undefined && metadata.uid !== expectedUid) {
         throw new ClaustrumConsumerError('unsafe-file', 'Claustrum enrollment file must be owned by the current user');
     }
@@ -221,11 +221,61 @@ async function readBoundedJson(path) {
         await descriptor.close();
     }
 }
+function accountRecords(text, fields) {
+    const records = [];
+    for (const line of text.split('\n')) {
+        if (line.trim() === '' || line.startsWith('#'))
+            continue;
+        const parts = line.split(':');
+        if (parts.length !== fields ||
+            !/^[^\s:,]+$/.test(parts[0] ?? '') ||
+            !/^\d+$/.test(parts[2] ?? '') ||
+            !Number.isSafeInteger(Number(parts[2])) ||
+            (fields === 7 &&
+                (!/^\d+$/.test(parts[3] ?? '') ||
+                    !Number.isSafeInteger(Number(parts[3])))) ||
+            (fields === 4 &&
+                parts[3] !== '' &&
+                !/^[^\s:,]+(?:,[^\s:,]+)*$/.test(parts[3] ?? '')))
+            return undefined;
+        records.push(parts);
+    }
+    return records;
+}
+async function isPrivateGroup(uid, gid, options) {
+    try {
+        const [passwdText, groupText] = await Promise.all([
+            readFile(options.passwdPath ?? '/etc/passwd', 'utf8'),
+            readFile(options.groupPath ?? '/etc/group', 'utf8'),
+        ]);
+        const users = accountRecords(passwdText, 7);
+        const groups = accountRecords(groupText, 4);
+        if (!users || !groups)
+            return false;
+        const owners = users.filter((user) => Number(user[2]) === uid);
+        const matchingGroups = groups.filter((group) => Number(group[2]) === gid);
+        if (owners.length !== 1 || matchingGroups.length !== 1)
+            return false;
+        const name = owners[0]?.[0];
+        const members = matchingGroups[0]?.[3] ?? '';
+        return ((members === '' ||
+            members.split(',').every((member) => member === name)) &&
+            !users.some((user) => Number(user[2]) !== uid && Number(user[3]) === gid));
+    }
+    catch {
+        // Missing local records (including NSS-only accounts) cannot prove exclusivity.
+        return false;
+    }
+}
 /**
- * Refuse a path below any group- or world-writable directory without the
- * sticky bit: another user could swap the file out from under us there.
+ * Protect setup writes from directory replacement. Group write access is safe
+ * only when local account records prove that the effective user's group is private.
  */
-async function refuseWritableAncestor(parent) {
+export async function refuseWritableAncestor(parent, options = {}) {
+    const uid = process.geteuid?.();
+    if (uid === undefined)
+        return;
+    const gid = process.getegid?.();
     let component;
     try {
         component = await realpath(parent);
@@ -233,12 +283,23 @@ async function refuseWritableAncestor(parent) {
     catch {
         return;
     }
+    // Load lazily, once per traversal: account changes take effect on the next write.
+    let privateGroup;
     for (;;) {
         const metadata = await stat(component).catch(() => undefined);
         if (metadata &&
             (metadata.mode & 0o022) !== 0 &&
             (metadata.mode & 0o1000) === 0) {
-            throw new ClaustrumConsumerError('unsafe-file', 'Claustrum enrollment path has an unsafe writable ancestor');
+            if (privateGroup === undefined) {
+                privateGroup =
+                    gid !== undefined && (await isPrivateGroup(uid, gid, options));
+            }
+            if ((metadata.mode & 0o002) !== 0 ||
+                metadata.uid !== uid ||
+                metadata.gid !== gid ||
+                !privateGroup) {
+                throw new ClaustrumConsumerError('unsafe-file', `Claustrum enrollment path has a writable ancestor: ${component}. Another user could replace it. Run: chmod g-w,o-w ${component}`);
+            }
         }
         const next = dirname(component);
         if (next === component)
@@ -254,17 +315,17 @@ async function refuseWritableAncestor(parent) {
 async function ensurePrivateDirectory(directory) {
     await mkdir(directory, { recursive: true, mode: 0o700 });
     const metadata = await stat(directory);
-    const uid = process.getuid?.();
+    const uid = process.geteuid?.();
     if (uid !== undefined && metadata.uid !== uid) {
         throw new ClaustrumConsumerError('unsafe-file', 'Claustrum enrollment directory must be owned by the current user');
     }
     if ((metadata.mode & 0o077) !== 0)
         await chmod(directory, 0o700);
 }
-async function writeStateAtomic(path, state) {
+async function writeStateAtomic(path, state, ancestorOptions = {}) {
     const parent = dirname(path);
     await ensurePrivateDirectory(parent);
-    await refuseWritableAncestor(parent);
+    await refuseWritableAncestor(parent, ancestorOptions);
     const bytes = `${JSON.stringify(state)}\n`;
     if (Buffer.byteLength(bytes) > ENROLLMENT_FILE_MAX_BYTES) {
         throw new ClaustrumConsumerError('invalid-state', 'Claustrum enrollment state is too large');
@@ -321,7 +382,10 @@ export async function readClaustrumEnrollmentStatus(paths, proposedName) {
  * Re-reading per operation is what lets an operator reissue a token on disk.
  */
 export async function readClaustrumEnrollmentToken(tokenPath) {
-    await refuseWritableAncestor(tokenPath);
+    // Reads rely on O_NOFOLLOW and regular, owner-only, effective-uid-owned files:
+    // another user cannot plant a file owned by us. Ancestor checks protect writes
+    // from placing our secret in a swapped directory, not reads; keep their
+    // realpath/stat and account-file I/O off the authorization path.
     const value = await readBoundedJson(tokenPath);
     if (value === undefined)
         throw new ClaustrumConsumerError('not-enrolled', 'Claustrum enrollment is not configured');
@@ -368,7 +432,9 @@ export class ClaustrumEnrollmentManager {
     #now;
     #mintSecret;
     #writeTokenFile;
+    #ancestorOptions;
     constructor(options) {
+        this.#ancestorOptions = options.ancestorOptions ?? {};
         this.#client = options.client;
         this.#paths = options.paths;
         this.#proposedName = options.proposedName;
@@ -392,7 +458,7 @@ export class ClaustrumEnrollmentManager {
             errorCode: code,
             updatedAt: this.#now(),
         };
-        await writeStateAtomic(this.#paths.statePath, blocked);
+        await writeStateAtomic(this.#paths.statePath, blocked, this.#ancestorOptions);
         return statusFromState(blocked);
     }
     async reconcile() {
@@ -421,7 +487,7 @@ export class ClaustrumEnrollmentManager {
                         tokenGeneration: token.token_generation,
                         updatedAt: this.#now(),
                     };
-                    await writeStateAtomic(this.#paths.statePath, approved);
+                    await writeStateAtomic(this.#paths.statePath, approved, this.#ancestorOptions);
                     state = approved;
                 }
                 return {
@@ -442,7 +508,7 @@ export class ClaustrumEnrollmentManager {
                     errorCode: 'missing_token',
                     updatedAt: this.#now(),
                 };
-                await writeStateAtomic(this.#paths.statePath, blocked);
+                await writeStateAtomic(this.#paths.statePath, blocked, this.#ancestorOptions);
                 return statusFromState(blocked);
             }
             if (state && state.phase !== 'pending')
@@ -462,7 +528,7 @@ export class ClaustrumEnrollmentManager {
                 // The secret is on disk before the proposal leaves the process: the
                 // vault answers a repeated proposal with the same secret with the same
                 // request id, so a crash between propose and saving the id costs nothing.
-                await writeStateAtomic(this.#paths.statePath, state);
+                await writeStateAtomic(this.#paths.statePath, state, this.#ancestorOptions);
             }
             if (!state.requestId) {
                 try {
@@ -478,7 +544,7 @@ export class ClaustrumEnrollmentManager {
                         requestId: proposed.requestId,
                         updatedAt: this.#now(),
                     };
-                    await writeStateAtomic(this.#paths.statePath, state);
+                    await writeStateAtomic(this.#paths.statePath, state, this.#ancestorOptions);
                 }
                 catch (error) {
                     const refusal = classifyEnrollmentError(error);
@@ -511,11 +577,13 @@ export class ClaustrumEnrollmentManager {
                         proposedName: state.proposedName,
                         updatedAt: this.#now(),
                     };
-                    await writeStateAtomic(this.#paths.statePath, denied);
+                    await writeStateAtomic(this.#paths.statePath, denied, this.#ancestorOptions);
                     return statusFromState(denied);
                 }
                 // The vault returns the token exactly once: it reaches disk before the
                 // pending metadata (and its secret) is replaced.
+                await ensurePrivateDirectory(dirname(this.#paths.tokenPath));
+                await refuseWritableAncestor(dirname(this.#paths.tokenPath), this.#ancestorOptions);
                 await this.#writeTokenFile(this.#paths.tokenPath, {
                     token: outcome.token,
                     token_generation: outcome.tokenGeneration,
@@ -528,7 +596,7 @@ export class ClaustrumEnrollmentManager {
                     tokenGeneration: outcome.tokenGeneration,
                     updatedAt: this.#now(),
                 };
-                await writeStateAtomic(this.#paths.statePath, approved);
+                await writeStateAtomic(this.#paths.statePath, approved, this.#ancestorOptions);
                 return statusFromState(approved);
             }
             catch (error) {

package/dist/claustrum/index.d.ts

@@ -7,7 +7,7 @@ export { type ClaustrumEnrollmentClient, type ClaustrumEnrollmentConnection, Cla
 export { ClaustrumConsumerError, type ClaustrumConsumerFailureKind, type ClaustrumLogger, } from './errors.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, type HostSlotContent, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';
 export { acceptAccount, type DeclinedAccount, declineAccount, isDeclined, } from './interlock.js';
-export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, readVaultRoster, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterRow, vaultRoutingRows, } from './roster.js';
+export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, readVaultRoster, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterLockContext, type VaultRosterRow, vaultRoutingRows, } from './roster.js';
 /**
  * Connect the client that lists and fetches this consumer's vault credentials
  * on the request path. `connectionFile` is required: this library

package/dist/claustrum/roster.d.ts

@@ -86,11 +86,16 @@ export declare function projectVaultRoster(previous: VaultRosterFile | undefined
  */
 export declare function vaultRoutingRows(roster: VaultRosterFile | undefined): RoutingRow[];
 export declare function readVaultRoster(path: string): Promise<VaultRosterFile | undefined>;
+/** The ownership assertion available to a roster mutation callback. */
+export interface VaultRosterLockContext {
+    assertOwned: () => Promise<void>;
+}
 /**
  * Read, change and write the roster under its write lock. `change` returns
- * undefined to leave the file as it is.
+ * undefined to leave the file as it is. Call `assertOwned()` immediately
+ * before any rename performed inside `change`; if it throws, do not rename.
  */
-export declare function mutateVaultRoster<T>(path: string, change: (current: VaultRosterFile | undefined) => Promise<{
+export declare function mutateVaultRoster<T>(path: string, change: (current: VaultRosterFile | undefined, context: VaultRosterLockContext) => Promise<{
     next?: VaultRosterFile;
     result: T;
 }> | {

package/dist/claustrum/roster.js

@@ -313,12 +313,15 @@ const WRITE_LOCK = {
 const DISCOVERY_LEASE = { name: 'claustrum-roster', ttlMs: 30_000 };
 /**
  * Read, change and write the roster under its write lock. `change` returns
- * undefined to leave the file as it is.
+ * undefined to leave the file as it is. Call `assertOwned()` immediately
+ * before any rename performed inside `change`; if it throws, do not rename.
  */
 export async function mutateVaultRoster(path, change) {
     return withLock(path, WRITE_LOCK, async (lock) => {
         const current = await readVaultRoster(path);
-        const { next, result } = await change(current);
+        const { next, result } = await change(current, {
+            assertOwned: () => lock.assertOwned(),
+        });
         if (next) {
             await lock.assertOwned();
             await writeJsonAtomic(path, next);

package/dist/rpc/rpc-server.js

@@ -61,6 +61,10 @@ async function withDeadline(work, ms) {
     let timer;
     const deadline = new Promise((_, reject) => {
         timer = setTimeout(() => reject(new ApplyDeadlineError('apply deadline exceeded')), ms);
+        // The deadline only bounds a reply. While a request is open its socket
+        // keeps the process alive anyway; after stop() closes it, a handler that
+        // never settles must not hold the process open until the deadline.
+        timer.unref?.();
     });
     // A handler that fails after its deadline has nobody left to answer.
     work.catch(() => { });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/common-auth",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "Shared code for the CortexKit auth plugins: account pool, quota and routing, commands and auth menu, OpenCode 2 hooks, Claustrum custody, and plumbing (loopback RPC, file locks, logger, sidebar state, TUI preferences and build).",
   "license": "MIT",
   "repository": {
@@ -94,7 +94,7 @@
     "lint": "biome check .",
     "prepublishOnly": "bun run build",
     "check:ranges": "bun scripts/check-installed-ranges.mjs",
-    "check:claustrum-040": "bun scripts/check-claustrum-040.mjs",
+    "check:claustrum-floor": "bun scripts/check-claustrum-floor.mjs",
     "check:opentui-0511": "bun scripts/check-opentui-0511.mjs"
   },
   "dependencies": {
@@ -104,7 +104,7 @@
     "@opentui/core": ">=0.5.11",
     "@opentui/solid": ">=0.5.11",
     "solid-js": "1.9.12",
-    "@cortexkit/claustrum-client": ">=0.4.0",
+    "@cortexkit/claustrum-client": ">=0.6.2",
     "@opencode/plugin": ">=2.0.21"
   },
   "peerDependenciesMeta": {
@@ -126,7 +126,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.14",
-    "@cortexkit/claustrum-client": "0.5.0",
+    "@cortexkit/claustrum-client": "0.6.2",
     "@opencode/plugin": "2.0.21",
     "@opentui/core": ">=0.5.12",
     "@opentui/solid": ">=0.5.12",