@dotobokuri/fleet-console 1.14.0 → 1.16.0

package/dist/fleet-plugins/file-explorer/routes.mjs

@@ -0,0 +1,446 @@
+#!/usr/bin/env node
+import fs from 'fs';
+import path2 from 'path';
+
+// sdk/plugin/node.ts
+function definePlugin(definition) {
+  return definition;
+}
+function registerRouter(ctx, path4, handler) {
+  ctx.registerRouter(normalizePath(path4), handler);
+}
+function normalizePath(path4) {
+  if (path4.length === 0 || path4 === "/") return "/";
+  return path4;
+}
+var FileReadError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.name = "FileReadError";
+    this.code = code;
+  }
+};
+var FILE_SIZE_CAP = 1024 * 1024;
+var BINARY_CHECK_BYTES = 8192;
+var BINARY_NUL_THRESHOLD = 0.05;
+var EXT_LANG_MAP = {
+  ".ts": "typescript",
+  ".tsx": "typescript",
+  ".js": "javascript",
+  ".jsx": "javascript",
+  ".mjs": "javascript",
+  ".cjs": "javascript",
+  ".json": "json",
+  ".json5": "json",
+  ".md": "markdown",
+  ".mdx": "markdown",
+  ".html": "html",
+  ".htm": "html",
+  ".css": "css",
+  ".scss": "scss",
+  ".sass": "sass",
+  ".less": "less",
+  ".py": "python",
+  ".go": "go",
+  ".rs": "rust",
+  ".sh": "bash",
+  ".bash": "bash",
+  ".zsh": "bash",
+  ".yaml": "yaml",
+  ".yml": "yaml",
+  ".toml": "toml",
+  ".xml": "xml",
+  ".svg": "xml",
+  ".sql": "sql",
+  ".rb": "ruby",
+  ".java": "java",
+  ".kt": "kotlin",
+  ".swift": "swift",
+  ".c": "c",
+  ".h": "c",
+  ".cpp": "cpp",
+  ".cc": "cpp",
+  ".hpp": "cpp",
+  ".dockerfile": "dockerfile",
+  ".gitignore": "plaintext",
+  ".env": "plaintext",
+  ".txt": "plaintext"
+};
+async function readFileForTheater(theaterPath, relativePath) {
+  const resolved = path2.resolve(theaterPath, relativePath);
+  if (!isWithinRoot(resolved, theaterPath)) throw new FileReadError("path_outside_theater");
+  let realResolved;
+  let realRoot;
+  try {
+    [realResolved, realRoot] = await Promise.all([
+      fs.promises.realpath(resolved),
+      fs.promises.realpath(theaterPath)
+    ]);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EACCES" || code === "EPERM") throw new FileReadError("forbidden");
+    throw new FileReadError("not_found");
+  }
+  if (!isWithinRoot(realResolved, realRoot)) throw new FileReadError("path_outside_theater");
+  let stat;
+  try {
+    stat = await fs.promises.stat(realResolved);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EACCES" || code === "EPERM") throw new FileReadError("forbidden");
+    throw new FileReadError("not_found");
+  }
+  if (!stat.isFile()) throw new FileReadError("not_a_file");
+  if (stat.size > FILE_SIZE_CAP) {
+    const fd = await fs.promises.open(realResolved, "r");
+    const buffer2 = Buffer.alloc(FILE_SIZE_CAP);
+    const { bytesRead } = await fd.read(buffer2, 0, FILE_SIZE_CAP, 0);
+    await fd.close();
+    const chunk = buffer2.subarray(0, bytesRead);
+    if (isBinaryBuffer(chunk)) throw new FileReadError("binary_file");
+    return {
+      relativePath: path2.relative(realRoot, realResolved),
+      content: chunk.toString("utf8"),
+      lang: detectLang(realResolved),
+      truncated: true
+    };
+  }
+  const buffer = await fs.promises.readFile(realResolved);
+  if (isBinaryBuffer(buffer)) throw new FileReadError("binary_file");
+  return {
+    relativePath: path2.relative(realRoot, realResolved),
+    content: buffer.toString("utf8"),
+    lang: detectLang(realResolved)
+  };
+}
+function isWithinRoot(resolved, root) {
+  const normalizedRoot = root.endsWith(path2.sep) ? root : root + path2.sep;
+  return resolved === root || resolved.startsWith(normalizedRoot);
+}
+function isBinaryBuffer(buffer) {
+  const checkLen = Math.min(buffer.length, BINARY_CHECK_BYTES);
+  if (checkLen === 0) return false;
+  let nulCount = 0;
+  for (let i = 0; i < checkLen; i++) {
+    if (buffer[i] === 0) nulCount++;
+  }
+  return nulCount / checkLen > BINARY_NUL_THRESHOLD;
+}
+function detectLang(filePath) {
+  const ext = path2.extname(filePath).toLowerCase();
+  return EXT_LANG_MAP[ext] ?? "plaintext";
+}
+var FolderBrowserError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.name = "FolderBrowserError";
+    this.code = code;
+  }
+};
+var DIRECTORY_ENTRY_CAP = 500;
+async function listTheaterContents(theaterPath, relativePath, deps = {}) {
+  const opendir = deps.opendir ?? fs.promises.opendir;
+  const stat = deps.stat ?? fs.promises.stat;
+  const targetAbs = path2.resolve(theaterPath, relativePath);
+  const normalizedRoot = theaterPath.endsWith(path2.sep) ? theaterPath : theaterPath + path2.sep;
+  if (targetAbs !== theaterPath && !targetAbs.startsWith(normalizedRoot)) {
+    throw new FolderBrowserError("forbidden");
+  }
+  let realRoot;
+  let realTargetAbs;
+  try {
+    [realRoot, realTargetAbs] = await Promise.all([
+      fs.promises.realpath(theaterPath),
+      fs.promises.realpath(targetAbs)
+    ]);
+  } catch (error) {
+    throw mapFsError(error);
+  }
+  const realNormalizedRoot = realRoot.endsWith(path2.sep) ? realRoot : realRoot + path2.sep;
+  if (realTargetAbs !== realRoot && !realTargetAbs.startsWith(realNormalizedRoot)) {
+    throw new FolderBrowserError("forbidden");
+  }
+  const targetStat = await statDirectory(realTargetAbs, stat);
+  if (!targetStat.isDirectory()) throw new FolderBrowserError("invalid_path");
+  const entries = [];
+  const truncated = await collectContentsEntries(realTargetAbs, realRoot, opendir, stat, entries);
+  entries.sort((a, b) => {
+    if (a.kind !== b.kind) return a.kind === "dir" ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+  const rel = path2.relative(realRoot, realTargetAbs);
+  const parentRel = rel === "" ? null : path2.relative(realRoot, path2.dirname(realTargetAbs));
+  return {
+    relativePath: rel,
+    parentRelativePath: parentRel === "" ? null : parentRel ?? null,
+    entries,
+    ...truncated ? { truncated: true } : {}
+  };
+}
+async function statDirectory(targetPath, stat) {
+  try {
+    return await stat(targetPath);
+  } catch (error) {
+    throw mapFsError(error);
+  }
+}
+async function collectContentsEntries(targetPath, theaterPath, opendir, stat, entries) {
+  const directory = await openDirectory(targetPath, opendir);
+  try {
+    let dirent = await directory.read();
+    while (dirent !== null) {
+      if (entries.length >= DIRECTORY_ENTRY_CAP) return true;
+      const entry = await toContentsEntry(targetPath, theaterPath, dirent, stat);
+      if (entry !== null) entries.push(entry);
+      dirent = await directory.read();
+    }
+    return false;
+  } catch (error) {
+    throw mapFsError(error);
+  } finally {
+    await directory.close();
+  }
+}
+async function openDirectory(targetPath, opendir) {
+  try {
+    return await opendir(targetPath);
+  } catch (error) {
+    throw mapFsError(error);
+  }
+}
+async function toContentsEntry(targetPath, theaterPath, dirent, stat) {
+  const entryPath = path2.join(targetPath, dirent.name);
+  const rel = path2.relative(theaterPath, entryPath);
+  if (dirent.isDirectory()) return { name: dirent.name, relativePath: rel, kind: "dir" };
+  if (dirent.isFile()) return { name: dirent.name, relativePath: rel, kind: "file" };
+  if (dirent.isSymbolicLink()) {
+    try {
+      const realEntryPath = await fs.promises.realpath(entryPath);
+      const realNormalizedRoot = theaterPath.endsWith(path2.sep) ? theaterPath : theaterPath + path2.sep;
+      if (realEntryPath !== theaterPath && !realEntryPath.startsWith(realNormalizedRoot)) return null;
+      const s = await stat(realEntryPath);
+      if (s.isDirectory()) return { name: dirent.name, relativePath: rel, kind: "dir" };
+      if (s.isFile()) return { name: dirent.name, relativePath: rel, kind: "file" };
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function mapFsError(error) {
+  const code = error.code;
+  if (code === "EACCES" || code === "EPERM") return new FolderBrowserError("forbidden");
+  if (code === "ENOENT" || code === "ENOTDIR") return new FolderBrowserError("not_found");
+  return new FolderBrowserError("invalid_path");
+}
+var ImageServeError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.name = "ImageServeError";
+    this.code = code;
+  }
+};
+var IMAGE_SIZE_CAP = 4 * 1024 * 1024;
+var MIME_ALLOWLIST = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp",
+  ".gif": "image/gif"
+};
+var IMAGE_SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "Referrer-Policy": "no-referrer",
+  "Cache-Control": "private, no-store"
+};
+async function readImageForTheater(theaterPath, relativePath) {
+  const resolved = path2.resolve(theaterPath, relativePath);
+  if (!isWithinRoot2(resolved, theaterPath)) throw new ImageServeError("path_outside_theater");
+  const ext = path2.extname(resolved).toLowerCase();
+  const mimeType = MIME_ALLOWLIST[ext];
+  if (!mimeType) throw new ImageServeError("mime_not_allowed");
+  let realResolved;
+  let realRoot;
+  try {
+    [realResolved, realRoot] = await Promise.all([
+      fs.promises.realpath(resolved),
+      fs.promises.realpath(theaterPath)
+    ]);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EACCES" || code === "EPERM") throw new ImageServeError("forbidden");
+    throw new ImageServeError("not_found");
+  }
+  if (!isWithinRoot2(realResolved, realRoot)) throw new ImageServeError("path_outside_theater");
+  let stat;
+  try {
+    stat = await fs.promises.stat(realResolved);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EACCES" || code === "EPERM") throw new ImageServeError("forbidden");
+    throw new ImageServeError("not_found");
+  }
+  if (!stat.isFile()) throw new ImageServeError("not_a_file");
+  if (stat.size > IMAGE_SIZE_CAP) throw new ImageServeError("size_exceeded");
+  const buffer = await fs.promises.readFile(realResolved);
+  return { mimeType, buffer };
+}
+function writeImageResponse(res, result) {
+  res.writeHead(200, {
+    ...IMAGE_SECURITY_HEADERS,
+    "Content-Type": result.mimeType,
+    "Content-Length": result.buffer.length
+  });
+  res.end(result.buffer);
+}
+function isWithinRoot2(resolved, root) {
+  const normalizedRoot = root.endsWith(path2.sep) ? root : root + path2.sep;
+  return resolved === root || resolved.startsWith(normalizedRoot);
+}
+
+// ../fleet-plugins/file-explorer/server/handlers.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readUrl(req) {
+  return new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+}
+async function handleFilesList(req, res, ctx) {
+  if (req.method !== "POST") {
+    ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const body = await ctx.host.http.readJsonBody(req);
+  if (!isPlainObject(body)) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const rawTheaterId = body.theaterId;
+  if (typeof rawTheaterId !== "string") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const rawRel = body.relativePath;
+  const relPath = rawRel === void 0 || rawRel === null ? "" : typeof rawRel === "string" ? rawRel : null;
+  if (relPath === null) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_path" });
+    return;
+  }
+  const theaterPath = ctx.host.paths.resolveTheaterPath(rawTheaterId);
+  if (!theaterPath) {
+    ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
+    return;
+  }
+  try {
+    const result = await listTheaterContents(theaterPath, relPath);
+    ctx.host.http.writeJson(res, 200, result);
+  } catch (error) {
+    if (error instanceof FolderBrowserError) {
+      const httpStatus = error.code === "forbidden" ? 403 : error.code === "not_found" ? 404 : 400;
+      ctx.host.http.writeJson(res, httpStatus, { error: error.code });
+      return;
+    }
+    throw error;
+  }
+}
+async function handleFilesRead(req, res, ctx) {
+  if (req.method !== "POST") {
+    ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const body = await ctx.host.http.readJsonBody(req);
+  if (!isPlainObject(body) || typeof body.relativePath !== "string") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_path" });
+    return;
+  }
+  const theaterId = body.theaterId;
+  if (typeof theaterId !== "string") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const theaterPath = ctx.host.paths.resolveTheaterPath(theaterId);
+  if (!theaterPath) {
+    ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
+    return;
+  }
+  try {
+    const result = await readFileForTheater(theaterPath, body.relativePath);
+    ctx.host.http.writeJson(res, 200, result);
+  } catch (error) {
+    if (error instanceof FileReadError) {
+      const httpStatus = error.code === "path_outside_theater" || error.code === "forbidden" ? 403 : error.code === "binary_file" ? 422 : 404;
+      ctx.host.http.writeJson(res, httpStatus, { error: error.code });
+      return;
+    }
+    throw error;
+  }
+}
+async function handleFilesImage(req, res, ctx) {
+  if (req.method !== "GET") {
+    ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const url = readUrl(req);
+  const theaterId = url.searchParams.get("theaterId");
+  const relPath = url.searchParams.get("path");
+  if (!theaterId) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  if (!relPath) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_path" });
+    return;
+  }
+  const theaterPath = ctx.host.paths.resolveTheaterPath(theaterId);
+  if (!theaterPath) {
+    ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
+    return;
+  }
+  try {
+    const result = await readImageForTheater(theaterPath, relPath);
+    writeImageResponse(res, result);
+  } catch (error) {
+    if (error instanceof ImageServeError) {
+      const httpStatus = error.code === "path_outside_theater" || error.code === "mime_not_allowed" || error.code === "forbidden" ? 403 : error.code === "size_exceeded" ? 413 : 404;
+      ctx.host.http.writeJson(res, httpStatus, { error: error.code });
+      return;
+    }
+    throw error;
+  }
+}
+
+// ../fleet-plugins/file-explorer/routes.ts
+var routes_default = definePlugin({
+  id: "file-explorer",
+  register(ctx) {
+    registerRouter(ctx, "files/list", async ({ req, res }) => {
+      await handleFilesList(req, res, ctx);
+      return true;
+    });
+    registerRouter(ctx, "files/read", async ({ req, res }) => {
+      await handleFilesRead(req, res, ctx);
+      return true;
+    });
+    registerRouter(ctx, "files/image", async ({ req, res }) => {
+      await handleFilesImage(req, res, ctx);
+      return true;
+    });
+  }
+});
+
+export { routes_default as default };