@drisp/cli 0.4.5 → 0.5.0

package/dist/chunk-MRAM6EYI.js

@@ -0,0 +1,76 @@
+import {
+  isLoopbackHost
+} from "./chunk-BTY7MYYT.js";
+
+// src/gateway/auth.ts
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+var TOKEN_BYTES = 32;
+function loadOrCreateToken(tokenPath) {
+  try {
+    const buf = fs.readFileSync(tokenPath);
+    const text = buf.toString("utf-8").trim();
+    if (text.length >= 16) return text;
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ENOENT") throw err;
+  }
+  return writeNewToken(tokenPath);
+}
+function rotateGatewayToken(tokenPath) {
+  return writeNewToken(tokenPath);
+}
+function writeNewToken(tokenPath) {
+  const dir = path.dirname(tokenPath);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  const token = crypto.randomBytes(TOKEN_BYTES).toString("base64url");
+  const tmpPath = `${tokenPath}.tmp-${process.pid}-${crypto.randomBytes(4).toString("hex")}`;
+  fs.writeFileSync(tmpPath, token + "\n", { mode: 384 });
+  try {
+    fs.renameSync(tmpPath, tokenPath);
+  } catch (err) {
+    try {
+      fs.unlinkSync(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+  if (process.platform !== "win32") {
+    fs.chmodSync(dir, 448);
+    fs.chmodSync(tokenPath, 384);
+  }
+  return token;
+}
+function timingSafeTokenEqual(a, b) {
+  const ab = Buffer.from(a, "utf-8");
+  const bb = Buffer.from(b, "utf-8");
+  if (ab.length !== bb.length) {
+    const filler = Buffer.alloc(Math.max(ab.length, bb.length));
+    crypto.timingSafeEqual(filler, filler);
+    return false;
+  }
+  return crypto.timingSafeEqual(ab, bb);
+}
+function requireTokenForBind(spec, token) {
+  if (spec.kind === "uds" || isLoopbackHost(spec.host)) return;
+  if (!token || token.length < 16) {
+    throw new Error(
+      `gateway: refusing to bind ${spec.host}:${spec.port} without token configured`
+    );
+  }
+  if (spec.tls) return;
+  if (!spec.insecure) {
+    throw new Error(
+      `gateway: refusing to bind ${spec.host}:${spec.port} without TLS; pass --tls-cert/--tls-key, or --insecure only for trusted reverse-proxy/tunnel deployments`
+    );
+  }
+}
+
+export {
+  loadOrCreateToken,
+  rotateGatewayToken,
+  timingSafeTokenEqual,
+  requireTokenForBind
+};
+//# sourceMappingURL=chunk-MRAM6EYI.js.map