@fkom13/mcp-sftp-orchestrator 6.0.0 → 11.8.0

package/sshPool.js

@@ -1,128 +1,166 @@
 import { Client } from 'ssh2';
 import fs from 'fs/promises';
 import queue from './queue.js';
+import utils from './utils.js';
+import config from './config.js';
 
+/**
+ * Pool de connexions SSH persistantes.
+ * v11.4.0 : listeners non empilés sur retry, flag ready fiable, port configurable.
+ */
 class SSHConnectionPool {
     constructor() {
-        this.pools = new Map(); // Map<serverAlias, Connection[]>
-        this.activeConnections = new Map(); // Map<connectionId, {conn, serverAlias, inUse, lastUsed}>
+        this.pools = new Map(); // Map<serverAlias, connId[]>
+        this.activeConnections = new Map(); // Map<connId, {conn, serverAlias, inUse, lastUsed, ready}>
         this.config = {
-            maxConnections: 5,      // Max connexions par serveur
-            minConnections: 1,      // Min connexions maintenues
-            idleTimeout: 300000,    // 5 minutes avant fermeture si inactif
-            keepAliveInterval: 30000, // Keep-alive toutes les 30s
+            maxConnections: config.maxConnectionsPerServer,
+            minConnections: config.minConnectionsPerServer,
+            idleTimeout: config.idleTimeout,
+            keepAliveInterval: config.keepAliveInterval,
             connectionTimeout: 20000,
             retryAttempts: 3
         };
-        
-        // Nettoyage périodique des connexions inactives
         this.startCleanupInterval();
     }
-    
-    // Obtenir ou créer une connexion
+
+    isConnectionReady(connId) {
+        const connInfo = this.activeConnections.get(connId);
+        if (!connInfo || !connInfo.ready || connInfo.closed) return false;
+        const sock = connInfo.conn && connInfo.conn._sock;
+        if (!sock) return false;
+        // Socket encore ouvert et lisible
+        if (sock.destroyed || sock.readyState === 'closed') return false;
+        return sock.readable !== false;
+    }
+
     async getConnection(serverAlias, serverConfig) {
-        // Chercher une connexion disponible
         const pool = this.pools.get(serverAlias) || [];
-        
+
         for (const connId of pool) {
             const connInfo = this.activeConnections.get(connId);
-            if (connInfo && !connInfo.inUse && connInfo.conn.isReady) {
+            if (connInfo && !connInfo.inUse && this.isConnectionReady(connId)) {
                 connInfo.inUse = true;
                 connInfo.lastUsed = Date.now();
                 queue.log('info', `Réutilisation connexion SSH existante pour ${serverAlias}`);
                 return { id: connId, client: connInfo.conn };
             }
+            // Connexion morte dans le pool → purge
+            if (connInfo && !connInfo.inUse && !this.isConnectionReady(connId)) {
+                this.removeConnection(connId);
+            }
         }
-        
-        // Si pas de connexion disponible, en créer une nouvelle
-        if (pool.length < this.config.maxConnections) {
-            const newConn = await this.createConnection(serverAlias, serverConfig);
-            return newConn;
+
+        const currentPool = this.pools.get(serverAlias) || [];
+        if (currentPool.length < this.config.maxConnections) {
+            return await this.createConnection(serverAlias, serverConfig);
         }
-        
-        // Si pool plein, attendre qu'une connexion se libère
+
         queue.log('warn', `Pool SSH saturé pour ${serverAlias}, attente...`);
         return await this.waitForConnection(serverAlias, serverConfig);
     }
-    
-    // Créer une nouvelle connexion
+
     async createConnection(serverAlias, serverConfig) {
-        const conn = new Client();
-        const connId = `${serverAlias}_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
-        
-        return new Promise((resolve, reject) => {
-            let retries = 0;
-            
-            const tryConnect = async () => {
-                try {
-                    const config = {
-                        host: serverConfig.host,
-                        port: 22,
-                        username: serverConfig.user,
-                        readyTimeout: this.config.connectionTimeout,
-                        keepaliveInterval: this.config.keepAliveInterval,
-                        keepaliveCountMax: 3
-                    };
-                    
-                    if (serverConfig.keyPath) {
-                        config.privateKey = await fs.readFile(serverConfig.keyPath);
-                    } else if (serverConfig.password) {
-                        config.password = serverConfig.password;
-                    }
-                    
-                    conn.on('ready', () => {
-                        queue.log('info', `Nouvelle connexion SSH établie pour ${serverAlias}`);
-                        
-                        // Ajouter au pool
-                        if (!this.pools.has(serverAlias)) {
-                            this.pools.set(serverAlias, []);
-                        }
-                        this.pools.get(serverAlias).push(connId);
-                        
-                        // Enregistrer la connexion
-                        this.activeConnections.set(connId, {
-                            conn,
-                            serverAlias,
-                            inUse: true,
-                            lastUsed: Date.now(),
-                            config: serverConfig
-                        });
-                        
-                        // Ajouter un flag pour vérifier si la connexion est prête
-                        conn.isReady = true;
-                        
-                        resolve({ id: connId, client: conn });
-                    });
-                    
-                    conn.on('error', (err) => {
-                        conn.isReady = false;
-                        if (retries < this.config.retryAttempts) {
-                            retries++;
-                            queue.log('warn', `Tentative ${retries}/${this.config.retryAttempts} de connexion à ${serverAlias}`);
-                            setTimeout(tryConnect, 2000 * retries);
-                        } else {
-                            this.removeConnection(connId);
-                            reject(new Error(`Impossible de se connecter à ${serverAlias}: ${err.message}`));
-                        }
-                    });
-                    
-                    conn.on('close', () => {
-                        conn.isReady = false;
-                        this.removeConnection(connId);
-                        queue.log('info', `Connexion SSH fermée pour ${serverAlias}`);
-                    });
-                    
-                    conn.connect(config);
-                } catch (err) {
-                    reject(err);
+        const connId = `${serverAlias}_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+        let lastError = null;
+
+        for (let attempt = 1; attempt <= this.config.retryAttempts; attempt++) {
+            try {
+                const conn = await this._connectOnce(serverAlias, serverConfig, connId);
+                return conn;
+            } catch (err) {
+                lastError = err;
+                queue.log('warn', `Tentative ${attempt}/${this.config.retryAttempts} de connexion à ${serverAlias}: ${err.message}`);
+                if (attempt < this.config.retryAttempts) {
+                    await new Promise(r => setTimeout(r, 2000 * attempt));
                 }
+            }
+        }
+
+        this.removeConnection(connId);
+        throw new Error(`Impossible de se connecter à ${serverAlias}: ${lastError?.message || 'erreur inconnue'}`);
+    }
+
+    /**
+     * Une seule tentative = un nouveau Client + listeners uniques (pas d'empilement).
+     */
+    _connectOnce(serverAlias, serverConfig, connId) {
+        return new Promise(async (resolve, reject) => {
+            const conn = new Client();
+            let settled = false;
+
+            const fail = (err) => {
+                if (settled) return;
+                settled = true;
+                try { conn.removeAllListeners(); conn.end(); } catch { /* ignore */ }
+                reject(err instanceof Error ? err : new Error(String(err)));
             };
-            
-            tryConnect();
+
+            const succeed = () => {
+                if (settled) return;
+                settled = true;
+                queue.log('info', `Nouvelle connexion SSH établie pour ${serverAlias}`);
+
+                if (!this.pools.has(serverAlias)) this.pools.set(serverAlias, []);
+                const pool = this.pools.get(serverAlias);
+                if (!pool.includes(connId)) pool.push(connId);
+
+                this.activeConnections.set(connId, {
+                    conn,
+                    serverAlias,
+                    inUse: true,
+                    lastUsed: Date.now(),
+                    ready: true,
+                    closed: false,
+                    config: serverConfig
+                });
+
+                resolve({ id: connId, client: conn });
+            };
+
+            conn.once('ready', succeed);
+            conn.once('error', (err) => fail(err));
+            conn.on('close', () => {
+                const info = this.activeConnections.get(connId);
+                if (info) {
+                    info.ready = false;
+                    info.closed = true;
+                }
+                this.removeConnection(connId);
+                queue.log('info', `Connexion SSH fermée pour ${serverAlias}`);
+            });
+            conn.on('end', () => {
+                const info = this.activeConnections.get(connId);
+                if (info) {
+                    info.ready = false;
+                    info.closed = true;
+                }
+            });
+
+            try {
+                const connectConfig = {
+                    host: serverConfig.host,
+                    port: utils.resolveSshPort(serverConfig),
+                    username: serverConfig.user,
+                    readyTimeout: this.config.connectionTimeout,
+                    keepaliveInterval: this.config.keepAliveInterval,
+                    keepaliveCountMax: 3
+                };
+
+                if (serverConfig.keyPath) {
+                    connectConfig.privateKey = await fs.readFile(serverConfig.keyPath);
+                } else if (serverConfig.password) {
+                    connectConfig.password = serverConfig.password;
+                } else {
+                    return fail(new Error(`Aucune méthode d'authentification pour '${serverAlias}'`));
+                }
+
+                conn.connect(connectConfig);
+            } catch (err) {
+                fail(err);
+            }
         });
     }
-    
-    // Libérer une connexion
+
     releaseConnection(connId) {
         const connInfo = this.activeConnections.get(connId);
         if (connInfo) {
@@ -131,56 +169,46 @@ class SSHConnectionPool {
             queue.log('debug', `Connexion ${connId} libérée`);
         }
     }
-    
-    // Fermer une connexion spécifique
+
     closeConnection(connId) {
         const connInfo = this.activeConnections.get(connId);
         if (connInfo) {
             try {
+                connInfo.ready = false;
                 connInfo.conn.end();
-            } catch (e) {
-                // Ignorer les erreurs de fermeture
-            }
+            } catch { /* ignore */ }
             this.removeConnection(connId);
         }
     }
-    
-    // Retirer une connexion du pool
+
     removeConnection(connId) {
         const connInfo = this.activeConnections.get(connId);
         if (connInfo) {
             const pool = this.pools.get(connInfo.serverAlias);
             if (pool) {
                 const index = pool.indexOf(connId);
-                if (index > -1) {
-                    pool.splice(index, 1);
-                }
-                if (pool.length === 0) {
-                    this.pools.delete(connInfo.serverAlias);
-                }
+                if (index > -1) pool.splice(index, 1);
+                if (pool.length === 0) this.pools.delete(connInfo.serverAlias);
             }
             this.activeConnections.delete(connId);
         }
     }
-    
-    // Attendre qu'une connexion se libère
+
     async waitForConnection(serverAlias, serverConfig, timeout = 30000) {
         const startTime = Date.now();
-        
+
         return new Promise((resolve, reject) => {
-            const checkInterval = setInterval(async () => {
-                // Vérifier le timeout
+            const checkInterval = setInterval(() => {
                 if (Date.now() - startTime > timeout) {
                     clearInterval(checkInterval);
                     reject(new Error(`Timeout en attendant une connexion pour ${serverAlias}`));
                     return;
                 }
-                
-                // Essayer d'obtenir une connexion
+
                 const pool = this.pools.get(serverAlias) || [];
                 for (const connId of pool) {
                     const connInfo = this.activeConnections.get(connId);
-                    if (connInfo && !connInfo.inUse && connInfo.conn.isReady) {
+                    if (connInfo && !connInfo.inUse && this.isConnectionReady(connId)) {
                         clearInterval(checkInterval);
                         connInfo.inUse = true;
                         connInfo.lastUsed = Date.now();
@@ -188,53 +216,52 @@ class SSHConnectionPool {
                         return;
                     }
                 }
+
+                // Slot libre → créer
+                if (pool.length < this.config.maxConnections) {
+                    clearInterval(checkInterval);
+                    this.createConnection(serverAlias, serverConfig).then(resolve).catch(reject);
+                }
             }, 500);
         });
     }
-    
-    // Nettoyer les connexions inactives
+
     startCleanupInterval() {
         setInterval(() => {
             const now = Date.now();
-            
-            for (const [connId, connInfo] of this.activeConnections) {
-                // Fermer les connexions inactives depuis trop longtemps
+            for (const [connId, connInfo] of [...this.activeConnections.entries()]) {
                 if (!connInfo.inUse && (now - connInfo.lastUsed) > this.config.idleTimeout) {
                     const pool = this.pools.get(connInfo.serverAlias) || [];
-                    
-                    // Garder au moins minConnections
                     if (pool.length > this.config.minConnections) {
                         queue.log('info', `Fermeture connexion inactive: ${connId}`);
                         this.closeConnection(connId);
+                        continue;
                     }
                 }
-                
-                // Vérifier que la connexion est toujours vivante
-                if (!connInfo.conn.isReady && !connInfo.inUse) {
+                if (!this.isConnectionReady(connId) && !connInfo.inUse) {
                     this.removeConnection(connId);
                 }
             }
-        }, 60000); // Vérifier toutes les minutes
+        }, 60000);
     }
-    
-    // Obtenir les statistiques du pool
+
     getStats() {
         const stats = {
             totalConnections: this.activeConnections.size,
             byServer: {}
         };
-        
+
         for (const [serverAlias, pool] of this.pools) {
             const connections = pool.map(connId => {
                 const info = this.activeConnections.get(connId);
                 return {
                     id: connId,
                     inUse: info?.inUse || false,
-                    ready: info?.conn?.isReady || false,
+                    ready: this.isConnectionReady(connId),
                     lastUsed: info?.lastUsed
                 };
             });
-            
+
             stats.byServer[serverAlias] = {
                 total: connections.length,
                 inUse: connections.filter(c => c.inUse).length,
@@ -242,31 +269,17 @@ class SSHConnectionPool {
                 connections
             };
         }
-        
+
         return stats;
     }
-    
-    // Fermer toutes les connexions
+
     closeAll() {
         queue.log('info', 'Fermeture de toutes les connexions SSH...');
-        for (const connId of this.activeConnections.keys()) {
+        for (const connId of [...this.activeConnections.keys()]) {
             this.closeConnection(connId);
         }
     }
 }
 
-// Instance singleton
 const sshPool = new SSHConnectionPool();
-
-// Nettoyer à la fermeture du processus
-process.on('SIGINT', () => {
-    sshPool.closeAll();
-    process.exit(0);
-});
-
-process.on('SIGTERM', () => {
-    sshPool.closeAll();
-    process.exit(0);
-});
-
 export default sshPool;

package/sshTrust.js

@@ -0,0 +1,214 @@
+/**
+ * sshTrust.js — Autorisation croisée de clés SSH (pubkey only).
+ * Ne copie JAMAIS de clé privée entre serveurs.
+ */
+import fs from 'fs/promises';
+import path from 'path';
+import os from 'os';
+import queue from './queue.js';
+import servers from './servers.js';
+import sourceAdapter from './sourceAdapter.js';
+import utils from './utils.js';
+
+/**
+ * Lit une pubkey depuis:
+ *  - { type:'string', pubkey }
+ *  - { type:'local_path', path }  (fichier .pub)
+ *  - { type:'alias', alias }      (keyPath du serveur → .pub à côté ou ssh-keygen -y)
+ */
+async function resolvePubkey(source) {
+    if (!source || !source.type) {
+        throw new Error("source requis: {type:'string'|'local_path'|'alias', ...}");
+    }
+
+    if (source.type === 'string') {
+        const pk = (source.pubkey || source.key || '').trim();
+        if (!pk.startsWith('ssh-') && !pk.startsWith('ecdsa-') && !pk.startsWith('sk-')) {
+            throw new Error('pubkey invalide (doit commencer par ssh-ed25519 / ssh-rsa / …)');
+        }
+        return pk.split('\n')[0].trim();
+    }
+
+    if (source.type === 'local_path') {
+        const p = source.path;
+        if (!p) throw new Error('source.path requis pour local_path');
+        let content = await fs.readFile(p, 'utf-8');
+        // Si c'est une privée, refuse
+        if (content.includes('PRIVATE KEY')) {
+            // tenter .pub voisin
+            const pubPath = p.endsWith('.pub') ? p : p + '.pub';
+            try {
+                content = await fs.readFile(pubPath, 'utf-8');
+            } catch {
+                throw new Error(`Refus: ${p} semble une clé privée. Fournissez le .pub`);
+            }
+        }
+        const line = content.trim().split('\n').find(l => l.startsWith('ssh-') || l.startsWith('ecdsa-'));
+        if (!line) throw new Error(`Aucune pubkey trouvée dans ${p}`);
+        return line.trim();
+    }
+
+    if (source.type === 'alias') {
+        const sc = await servers.getServer(source.alias);
+        if (!sc.keyPath) {
+            throw new Error(`Alias '${source.alias}' n'a pas de keyPath (password-only non supporté pour trust).`);
+        }
+        const pubPath = sc.keyPath.endsWith('.pub') ? sc.keyPath : sc.keyPath + '.pub';
+        try {
+            const content = await fs.readFile(pubPath, 'utf-8');
+            const line = content.trim().split('\n').find(l => l.startsWith('ssh-') || l.startsWith('ecdsa-') || l.startsWith('sk-'));
+            if (line) return line.trim();
+        } catch {
+            // fallback: ssh-keygen -y -f private
+        }
+        // Générer pubkey depuis privée localement (ne sort pas du MCP host)
+        const { execFile } = await import('child_process');
+        const { promisify } = await import('util');
+        const execFileAsync = promisify(execFile);
+        try {
+            const { stdout } = await execFileAsync('ssh-keygen', ['-y', '-f', sc.keyPath], {
+                timeout: 5000,
+                env: { ...process.env, SSH_AUTH_SOCK: '' }
+            });
+            const line = stdout.trim().split('\n')[0];
+            if (!line.startsWith('ssh-') && !line.startsWith('ecdsa-')) {
+                throw new Error('ssh-keygen -y n\'a pas renvoyé une pubkey valide');
+            }
+            return line.trim();
+        } catch (e) {
+            throw new Error(
+                `Impossible d'obtenir la pubkey pour '${source.alias}': ${e.message}. ` +
+                `Créez ${pubPath} ou passez source.type=string.`
+            );
+        }
+    }
+
+    throw new Error(`source.type inconnu: ${source.type}`);
+}
+
+function authorizedKeysPath(userHome, explicitPath) {
+    if (explicitPath) return explicitPath;
+    return path.posix.join(userHome || '~', '.ssh', 'authorized_keys');
+}
+
+/**
+ * options:
+ *  target_alias, source?, authorized_keys_path?,
+ *  source: {type, ...},
+ *  comment?, dryRun?, force?
+ */
+async function authorizeKey(options = {}) {
+    const {
+        target_alias,
+        user = null,
+        authorized_keys_path = null,
+        source,
+        comment = null,
+        dryRun = true,
+        force = false
+    } = options;
+
+    if (!target_alias) throw new Error('target_alias requis');
+    const sc = await servers.getServer(target_alias);
+
+    const pubkey = await resolvePubkey(source);
+    // Normalise: type + body (+ comment optionnel)
+    const parts = pubkey.trim().split(/\s+/);
+    const typeBody = parts.slice(0, 2).join(' ');
+    const existingComment = parts.slice(2).join(' ');
+    const lineToAdd = comment
+        ? `${typeBody} ${comment}`
+        : (existingComment ? `${typeBody} ${existingComment}` : typeBody);
+
+    // Résoudre home distant
+    const homeCmd = user ? `getent passwd ${utils.escapeShellArg(user).replace(/^'|'$/g, '')} 2>/dev/null | cut -d: -f6` : 'echo $HOME';
+    // Simpler: use ~ expansion via shell on target for path
+    const remoteUser = user || sc.user;
+    const akPath = authorized_keys_path
+        || `/home/${remoteUser}/.ssh/authorized_keys`;
+    // root special case
+    const finalAkPath = (remoteUser === 'root' && !authorized_keys_path)
+        ? '/root/.ssh/authorized_keys'
+        : akPath;
+
+    let existing = '';
+    let existed = false;
+    try {
+        const r = await sourceAdapter.readFile({ type: 'remote', alias: target_alias, path: finalAkPath });
+        existing = r.content.toString('utf-8');
+        existed = true;
+    } catch {
+        existing = '';
+        existed = false;
+    }
+
+    const lines = existing.split('\n').map(l => l.trimEnd());
+    const pubCore = pubkey.split(' ').slice(0, 2).join(' ');
+    const already = lines.some(l => l.includes(pubCore));
+
+    if (already && !force) {
+        return {
+            dryRun: !!dryRun,
+            applied: false,
+            alreadyPresent: true,
+            target_alias,
+            path: finalAkPath,
+            pubkey_fingerprint_hint: pubCore.slice(0, 40) + '…'
+        };
+    }
+
+    const newContent = already
+        ? existing // force re-add skipped if already
+        : (existing.trimEnd() + (existing && !existing.endsWith('\n') ? '\n' : '') + lineToAdd + '\n');
+
+    if (dryRun) {
+        return {
+            dryRun: true,
+            applied: false,
+            alreadyPresent: already,
+            wouldAdd: !already,
+            target_alias,
+            path: finalAkPath,
+            linePreview: lineToAdd.slice(0, 80) + (lineToAdd.length > 80 ? '…' : ''),
+            existed
+        };
+    }
+
+    // Ensure .ssh dir exists via write createDirs
+    // Write authorized_keys
+    // Also set permissions via a quick exec would be better
+    await sourceAdapter.writeFile(
+        { type: 'remote', alias: target_alias, path: finalAkPath },
+        Buffer.from(newContent, 'utf-8'),
+        { createDirs: true }
+    );
+
+    // chmod 700 .ssh / 600 authorized_keys
+    const sshDir = path.posix.dirname(finalAkPath);
+    const { default: ssh } = await import('./ssh.js');
+    const job = queue.addJob({
+        type: 'ssh',
+        alias: target_alias,
+        cmd: `mkdir -p ${utils.escapeShellArg(sshDir)} && chmod 700 ${utils.escapeShellArg(sshDir)} && chmod 600 ${utils.escapeShellArg(finalAkPath)}`,
+        timeout: 30,
+        skip_policy: true,
+        status: 'pending'
+    });
+    // fire and wait briefly
+    await ssh.executeCommand(job.id);
+    // small poll
+    await new Promise(r => setTimeout(r, 500));
+
+    queue.log('info', `ssh_authorize_key: pubkey ajoutée sur ${target_alias}:${finalAkPath}`);
+
+    return {
+        dryRun: false,
+        applied: true,
+        alreadyPresent: already,
+        target_alias,
+        path: finalAkPath,
+        linePreview: lineToAdd.slice(0, 80) + '…'
+    };
+}
+
+export default { authorizeKey, resolvePubkey };