@fonlan/dsh-web-auth 0.1.0

package/lib/profile-patch.d.ts

@@ -0,0 +1,45 @@
+/** The two bind hosts the webserver config schema accepts. */
+export declare const ALLOWED_LISTEN_HOSTS: readonly ["127.0.0.1", "0.0.0.0"];
+export type ListenHost = (typeof ALLOWED_LISTEN_HOSTS)[number];
+/**
+ * Delay between confirming the change to the browser and writing the patch
+ * file. The HMR watcher fires within milliseconds of the write and the
+ * webserver teardown destroys every connection — including the one carrying
+ * the confirmation — so the write lands a beat AFTER the response flushed.
+ */
+export declare const LISTEN_APPLY_DELAY_MS = 300;
+/** Whether a value is one of the two allowed bind-host literals. */
+export declare function isAllowedListenHost(value: unknown): value is ListenHost;
+/** Whether a patch document already spells the webserver row. */
+export declare function patchHasWebserverEntry(content: string): boolean;
+/**
+ * Pure text transform: set the `host` of the `webserver` patch entry.
+ *
+ * - entry present with a `host:` under `config:` → the value is replaced;
+ * - entry present without `host:` → the line is inserted under `config:`;
+ * - entry present without `config:` → a config block is appended;
+ * - no entry at all → a complete row is appended (name/inject/port restated).
+ *
+ * @param content - the patch file's current text.
+ * @param host - the target bind host literal.
+ * @returns the next file text; every other byte is untouched.
+ */
+export declare function setWebserverHost(content: string, host: ListenHost): string;
+/** Read a patch file as text; a missing file reads as the empty document. */
+export declare function readPatchOrEmpty(patchPath: string): string;
+/**
+ * Which patch layer owns the webserver override: the highest layer that
+ * spells the row (home outranks the profile, the same order the boot
+ * applies them); when no layer spells it, the profile patch is where the
+ * row will be created.
+ */
+export declare function resolveListenPatchPath(profilePatch: string, homePatch: string): string;
+/**
+ * Read + transform the owning patch layer for `host`, returning the next
+ * file content. Throws when the file cannot be read.
+ */
+export declare function prepareWebserverHostPatch(patchPath: string, host: ListenHost): string;
+/** Atomic write of prepared patch content (tmp + rename, like the state files). */
+export declare function writeWebserverHostPatch(patchPath: string, content: string): void;
+/** Whether a path exists on disk (guards the home-patch resolution). */
+export declare function patchExists(patchPath: string): boolean;

package/lib/profile-patch.js

@@ -0,0 +1,154 @@
+/**
+ * dsh-web-auth — profile patch editing for the web server bind host.
+ *
+ * The webserver's `host` is composition config: the dsh-web-app bundle row
+ * defaults to `ctx.webStartup.host ?? '127.0.0.1'`, and a later patch layer
+ * (the profile's cordis.patch.yml, or the home-level patch) overrides it.
+ * The boot process tails those patch files with HMR, so rewriting the
+ * override entry in place hot-applies the change: the webserver row reloads,
+ * closes its listener, and rebinds on the new host — no process restart.
+ *
+ * This module only ever touches the `host` value inside the `webserver`
+ * entry. Everything else — comments, other entries, and especially the
+ * `!!js` port expression — is preserved byte-for-byte, which a YAML
+ * round-trip could never guarantee. A fresh entry (when no layer spells the
+ * webserver row) restates `name`/`inject` and the port expression,
+ * because a patch entry replaces the targeted row's whole `config`.
+ */
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+/** The two bind hosts the webserver config schema accepts. */
+export const ALLOWED_LISTEN_HOSTS = ['127.0.0.1', '0.0.0.0'];
+/**
+ * Delay between confirming the change to the browser and writing the patch
+ * file. The HMR watcher fires within milliseconds of the write and the
+ * webserver teardown destroys every connection — including the one carrying
+ * the confirmation — so the write lands a beat AFTER the response flushed.
+ */
+export const LISTEN_APPLY_DELAY_MS = 300;
+/** Whether a value is one of the two allowed bind-host literals. */
+export function isAllowedListenHost(value) {
+    return value === '127.0.0.1' || value === '0.0.0.0';
+}
+/** The patch row id owning the web transport. */
+const WEBSERVER_ROW_ID = 'webserver';
+/** The bundle's port expression, restated when inserting a fresh row. */
+const WEBSERVER_PORT_EXPRESSION = 'ctx.webStartup.port ?? 3080';
+/** The webserver's package name, restated when inserting a fresh row. */
+const WEBSERVER_PACKAGE = '@deepseek-ai/dsh-host-webserver';
+const ENTRY_LINE = /^- id:\s*['"]?webserver['"]?\s*(?:#.*)?$/;
+const LIST_ITEM = /^-\s/;
+const CONFIG_LINE = /^(\s*)config:\s*(?:#.*)?$/;
+const HOST_LINE = /^(\s*)host:\s*(.*)$/;
+/** Whether a patch document already spells the webserver row. */
+export function patchHasWebserverEntry(content) {
+    for (const line of content.split('\n'))
+        if (ENTRY_LINE.test(line))
+            return true;
+    return false;
+}
+/**
+ * Pure text transform: set the `host` of the `webserver` patch entry.
+ *
+ * - entry present with a `host:` under `config:` → the value is replaced;
+ * - entry present without `host:` → the line is inserted under `config:`;
+ * - entry present without `config:` → a config block is appended;
+ * - no entry at all → a complete row is appended (name/inject/port restated).
+ *
+ * @param content - the patch file's current text.
+ * @param host - the target bind host literal.
+ * @returns the next file text; every other byte is untouched.
+ */
+export function setWebserverHost(content, host) {
+    const lines = content.split('\n');
+    let entryStart = -1;
+    for (let i = 0; i < lines.length; i++) {
+        if (ENTRY_LINE.test(lines[i])) {
+            entryStart = i;
+            break;
+        }
+    }
+    if (entryStart === -1) {
+        const block = [
+            '- id: ' + WEBSERVER_ROW_ID,
+            '  name: ' + JSON.stringify(WEBSERVER_PACKAGE),
+            '  inject: [webStartup]',
+            '  config:',
+            '    host: ' + host,
+            '    port: !!js ' + WEBSERVER_PORT_EXPRESSION
+        ].join('\n');
+        return content.length === 0 || content.endsWith('\n') ? content + block + '\n' : content + '\n' + block + '\n';
+    }
+    // The entry block ends at the next top-level list item or EOF.
+    let entryEnd = lines.length;
+    for (let i = entryStart + 1; i < lines.length; i++) {
+        if (LIST_ITEM.test(lines[i])) {
+            entryEnd = i;
+            break;
+        }
+    }
+    let configIndex = -1;
+    let configIndent = 0;
+    for (let i = entryStart; i < entryEnd; i++) {
+        const match = CONFIG_LINE.exec(lines[i]);
+        if (match !== null) {
+            configIndex = i;
+            configIndent = match[1].length;
+            break;
+        }
+    }
+    if (configIndex === -1) {
+        // No config block: append one (2-space entry indent, as the template).
+        lines.splice(entryEnd, 0, '  config:', '    host: ' + host, '    port: !!js ' + WEBSERVER_PORT_EXPRESSION);
+        return lines.join('\n');
+    }
+    for (let i = configIndex + 1; i < entryEnd; i++) {
+        const match = HOST_LINE.exec(lines[i]);
+        if (match !== null && match[1].length > configIndent) {
+            lines[i] = match[1] + 'host: ' + host;
+            return lines.join('\n');
+        }
+    }
+    // Config block present but no host key: insert right after `config:`.
+    lines.splice(configIndex + 1, 0, ' '.repeat(configIndent + 2) + 'host: ' + host);
+    return lines.join('\n');
+}
+/** Read a patch file as text; a missing file reads as the empty document. */
+export function readPatchOrEmpty(patchPath) {
+    try {
+        return readFileSync(patchPath, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return '';
+        throw error;
+    }
+}
+/**
+ * Which patch layer owns the webserver override: the highest layer that
+ * spells the row (home outranks the profile, the same order the boot
+ * applies them); when no layer spells it, the profile patch is where the
+ * row will be created.
+ */
+export function resolveListenPatchPath(profilePatch, homePatch) {
+    if (patchHasWebserverEntry(readPatchOrEmpty(homePatch)))
+        return homePatch;
+    return profilePatch;
+}
+/**
+ * Read + transform the owning patch layer for `host`, returning the next
+ * file content. Throws when the file cannot be read.
+ */
+export function prepareWebserverHostPatch(patchPath, host) {
+    return setWebserverHost(readPatchOrEmpty(patchPath), host);
+}
+/** Atomic write of prepared patch content (tmp + rename, like the state files). */
+export function writeWebserverHostPatch(patchPath, content) {
+    const tmp = patchPath + '.tmp-' + randomBytes(4).toString('hex');
+    writeFileSync(tmp, content);
+    renameSync(tmp, patchPath);
+}
+/** Whether a path exists on disk (guards the home-patch resolution). */
+export function patchExists(patchPath) {
+    return existsSync(patchPath);
+}

package/lib/state.d.ts

@@ -0,0 +1,12 @@
+/** Resolve the harness home the same way dsh does: $DSH_HOME, else ~/.dsh. */
+export declare function resolveDshHome(env?: NodeJS.ProcessEnv): string;
+/** Directory holding web-auth state; created on first use (0700). */
+export declare function stateDir(dshHome: string): string;
+/** The stored password hash, or undefined when auth is not yet configured. */
+export declare function readPasswordHash(dshHome: string): string | undefined;
+/** Persist a new password hash (atomic replace, 0600). */
+export declare function writePasswordHash(dshHome: string, hash: string): void;
+/** The session-signing secret, minted and persisted on first use. */
+export declare function readSecret(dshHome: string): Buffer;
+/** Replace the signing secret (password change): every session dies. */
+export declare function rotateSecret(dshHome: string): Buffer;

package/lib/state.js

@@ -0,0 +1,78 @@
+/**
+ * dsh-web-auth — persistent state under the harness home.
+ *
+ * All state lives under `$DSH_HOME/web-auth/` (0600 files, 0700 dir):
+ *   password.hash — one scrypt line (GUI-maintained; absent = auth disabled)
+ *   secret        — 32 random bytes signing session cookies (rotated on
+ *                   password change, which logs every session out)
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+/** Resolve the harness home the same way dsh does: $DSH_HOME, else ~/.dsh. */
+export function resolveDshHome(env = process.env) {
+    return env.DSH_HOME?.trim() || join(homedir(), '.dsh');
+}
+/** Directory holding web-auth state; created on first use (0700). */
+export function stateDir(dshHome) {
+    const dir = join(dshHome, 'web-auth');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    return dir;
+}
+/** The stored password hash, or undefined when auth is not yet configured. */
+export function readPasswordHash(dshHome) {
+    const file = join(stateDir(dshHome), 'password.hash');
+    if (!existsSync(file))
+        return undefined;
+    const line = readFileSync(file, 'utf8').trim();
+    return line.length === 0 ? undefined : line;
+}
+/** Persist a new password hash (atomic replace, 0600). */
+export function writePasswordHash(dshHome, hash) {
+    const file = join(stateDir(dshHome), 'password.hash');
+    const tmp = file + '.tmp-' + randomBytes(4).toString('hex');
+    writeFileSync(tmp, hash + '\n', { mode: 0o600 });
+    renameSync(tmp, file);
+    try {
+        chmodSync(file, 0o600);
+    }
+    catch {
+        /* best effort on filesystems without chmod */
+    }
+}
+/** The session-signing secret, minted and persisted on first use. */
+export function readSecret(dshHome) {
+    const file = join(stateDir(dshHome), 'secret');
+    if (existsSync(file)) {
+        const raw = readFileSync(file);
+        if (raw.length >= 32)
+            return raw;
+    }
+    const secret = randomBytes(32);
+    const tmp = file + '.tmp-' + randomBytes(4).toString('hex');
+    writeFileSync(tmp, secret, { mode: 0o600 });
+    renameSync(tmp, file);
+    try {
+        chmodSync(file, 0o600);
+    }
+    catch {
+        /* best effort */
+    }
+    return secret;
+}
+/** Replace the signing secret (password change): every session dies. */
+export function rotateSecret(dshHome) {
+    const file = join(stateDir(dshHome), 'secret');
+    const secret = randomBytes(32);
+    const tmp = file + '.tmp-' + randomBytes(4).toString('hex');
+    writeFileSync(tmp, secret, { mode: 0o600 });
+    renameSync(tmp, file);
+    try {
+        chmodSync(file, 0o600);
+    }
+    catch {
+        /* best effort */
+    }
+    return secret;
+}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@fonlan/dsh-web-auth",
+  "version": "0.1.0",
+  "description": "DSH web plugin: password-gate authentication (login page + HttpOnly signed cookie) for exposing dsh web behind a reverse proxy",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fonlan/dsh-web-auth.git"
+  },
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "rm -rf lib && tsc -p tsconfig.build.json && node scripts/build-client.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && tsc -p tsconfig.test.json && node --test --test-force-exit 'lib-test/*.test.js'",
+    "test:only": "tsc -p tsconfig.test.json && node --test --test-force-exit 'lib-test/*.test.js'",
+    "prepublishOnly": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-slots"
+      ],
+      "platform": "web"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
+    "@types/node": "^22.0.0",
+    "@types/react": "^18.3.0",
+    "esbuild": "^0.24.0",
+    "react": "^18.2.0",
+    "typescript": "^5.6.0"
+  }
+}