@jbrowse/cli 4.3.0 → 5.0.0-beta.10

package/dist/commands/admin-server/utils.js

@@ -1,36 +1,25 @@
-import crypto from 'crypto';
-import fs from 'fs';
-import path from 'path';
-import { debug, resolveConfigPath, writeJsonFile } from "../../utils.js";
-import { createDefaultConfig } from "../add-assembly/utils.js";
-/**
- * Validates if a port number is in the valid range
- */
-export function isValidPort(port) {
-    return port > 0 && port < 65535;
-}
-/**
- * Parses and validates a port string
- */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import handler from 'serve-handler';
+import { debug, isRecord, resolveConfigPath, writeJsonFile, } from '../../utils.js';
+import { createDefaultConfig } from '../add-assembly/utils.js';
+// Loopback, so the unauthenticated static handler below does not serve the
+// data directory to every host on the network. `--host` opts out.
+export const DEFAULT_HOST = '127.0.0.1';
 export function parsePort({ portStr, defaultPort = 9090, }) {
     if (!portStr) {
         return defaultPort;
     }
     const parsedPort = Number.parseInt(portStr, 10);
-    if (!isValidPort(parsedPort)) {
+    if (!(parsedPort > 0 && parsedPort <= 65535)) {
         throw new Error(`${portStr} is not a valid port`);
     }
     return parsedPort;
 }
-/**
- * Generates a random alphanumeric string to serve as admin key
- */
 export function generateKey() {
-    return crypto.randomBytes(5).toString('hex');
+    return crypto.randomBytes(16).toString('hex');
 }
-/**
- * Sets up the configuration file
- */
 export async function setupConfigFile({ root = '.', } = {}) {
     const outFile = await resolveConfigPath(root);
     const baseDir = path.dirname(outFile);
@@ -43,131 +32,264 @@ export async function setupConfigFile({ root = '.', } = {}) {
     }
     return { outFile, baseDir };
 }
+const BYTE_UNITS = {
+    b: 1,
+    kb: 1024,
+    mb: 1024 ** 2,
+    gb: 1024 ** 3,
+};
 /**
- * Validates admin key and extracts config path from request
+ * `--bodySizeLimit` as a byte count. Replaces the `bytes` package that
+ * `express.json` used, and covers the suffixes a config update could plausibly
+ * be given; anything else is a mistake at the command line and says so, rather
+ * than silently becoming a default the user did not ask for.
  */
-function validateAndExtractParams({ req, key, baseDir, outFile, }) {
-    const { body } = req;
-    // Check for adminKey in both query parameters and request body for backward compatibility
-    const adminKeyFromQuery = req.query.adminKey;
-    const adminKeyFromBody = body?.adminKey;
-    const adminKey = adminKeyFromBody || adminKeyFromQuery;
-    if (adminKey !== key) {
-        return { isValid: false, error: 'Invalid admin key' };
+export function parseByteLimit(limit) {
+    const match = /^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/i.exec(limit.trim());
+    const amount = match?.[1];
+    const scale = BYTE_UNITS[(match?.[2] ?? 'b').toLowerCase()];
+    if (amount === undefined || scale === undefined) {
+        throw new Error(`${limit} is not a valid body size limit; use a number optionally followed by b, kb, mb or gb`);
     }
-    // Get configPath from either body or query parameters
-    const configPathParam = body?.configPath || req.query.config;
-    try {
-        // Normalize the config path
-        const configPath = configPathParam
-            ? path.normalize(path.join(baseDir, configPathParam))
-            : outFile;
-        // Check for directory traversal attempts
-        const normalizedBaseDir = path.normalize(baseDir);
-        const relPath = path.relative(normalizedBaseDir, configPath);
-        // Ensure the config path is within the base directory and doesn't contain path traversal
-        if (relPath.startsWith('..') || path.isAbsolute(relPath)) {
-            return { isValid: false, error: 'Cannot perform directory traversal' };
+    return Math.floor(Number(amount) * scale);
+}
+/** A request body that was over the limit, so the handler can answer 413. */
+class PayloadTooLargeError extends Error {
+}
+/**
+ * The JSON body, or `undefined` when the request carried none. The size is
+ * counted as it streams rather than after, so an oversized upload is refused
+ * without being buffered first — which is the only reason the limit exists.
+ */
+async function readJsonBody(req, limitBytes) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+        size += buffer.length;
+        if (size > limitBytes) {
+            throw new PayloadTooLargeError(`request body exceeds ${limitBytes} bytes`);
         }
-        return { isValid: true, configPath };
+        chunks.push(buffer);
     }
-    catch (error) {
-        return { isValid: false, error: 'Failed to validate config path' };
+    const raw = Buffer.concat(chunks).toString('utf8').trim();
+    const parsed = raw === '' ? undefined : JSON.parse(raw);
+    return parsed;
+}
+// A missing or non-object body yields no properties instead of throwing, so a
+// route reading it before checking the key cannot turn an unauthorized request
+// into a 500.
+function requestBody(body) {
+    return isRecord(body) ? body : {};
+}
+// body and query values are untrusted input: a repeated query param arrives as
+// an array, a nested one as an object, and neither is a key or a path
+function asString(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+// The shape `express` gave `req.query`, which the checks below are written
+// against: absent, one value, or an array when the param was repeated. An array
+// is not a string, so `asString` rejects it and a repeated `adminKey` or
+// `config` fails rather than quietly using whichever copy came first.
+function queryValue(params, name) {
+    const values = params.getAll(name);
+    return values.length === 0
+        ? undefined
+        : values.length === 1
+            ? values[0]
+            : values;
+}
+function validateAndExtractParams({ body, query, key, baseDir, outFile, }) {
+    const adminKey = asString(body.adminKey) || asString(queryValue(query, 'adminKey'));
+    if (adminKey !== key) {
+        return { ok: false, error: 'Invalid admin key' };
+    }
+    // a configPath that is there but is not a string (a JSON number, an object, a
+    // repeated query param) is a malformed request, not an absent one — it must not
+    // silently fall through to writing the default config
+    const rawConfigPath = body.configPath || queryValue(query, 'config');
+    const configPathParam = asString(rawConfigPath);
+    if (rawConfigPath !== undefined && configPathParam === undefined) {
+        return { ok: false, error: 'Failed to validate config path' };
+    }
+    const configPath = configPathParam
+        ? path.normalize(path.join(baseDir, configPathParam))
+        : outFile;
+    const relPath = path.relative(path.normalize(baseDir), configPath);
+    if (relPath.startsWith('..') || path.isAbsolute(relPath)) {
+        return { ok: false, error: 'Cannot perform directory traversal' };
     }
+    return { ok: true, configPath };
 }
-/**
- * Sets up the API routes for the server
- */
-export function setupRoutes({ app, baseDir, outFile, key, serverRef, }) {
-    // Root route
-    app.get('/', (_req, res) => {
-        res.setHeader('Content-Type', 'text/plain');
-        res.send('JBrowse Admin Server');
+function sendText(res, status, body) {
+    res.writeHead(status, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end(body);
+}
+// What `cors()` sent. The admin key is what authorizes a write; the origin
+// never was.
+function applyCorsHeaders(res) {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, HEAD, POST, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+}
+function updateConfig({ res, body, query, key, baseDir, outFile, }) {
+    // the key is checked before the payload is touched, so a request with no JSON
+    // body gets the 401 it earned rather than a 500 from reading it
+    const validation = validateAndExtractParams({
+        body,
+        query,
+        key,
+        baseDir,
+        outFile,
     });
-    // Update config route
-    app.post('/updateConfig', (req, res) => {
-        const { body } = req;
+    if (validation.ok) {
         const config = body.config;
-        const validation = validateAndExtractParams({ req, key, baseDir, outFile });
-        if (!validation.isValid) {
-            res.status(401).setHeader('Content-Type', 'text/plain');
-            res.send(`Error: ${validation.error}`);
-            return;
+        if (config === undefined) {
+            sendText(res, 400, 'Error: Missing config in request body');
         }
-        // Remove adminKey from body before saving to config
-        if (body.adminKey) {
-            delete body.adminKey;
-        }
-        try {
-            fs.writeFileSync(validation.configPath, JSON.stringify(config, null, 2));
-            res.setHeader('Content-Type', 'text/plain');
-            res.send('Config updated successfully');
-        }
-        catch (error) {
-            res.status(500).setHeader('Content-Type', 'text/plain');
-            res.send('Error: Failed to update config');
+        else {
+            try {
+                fs.writeFileSync(validation.configPath, JSON.stringify(config, null, 2));
+                sendText(res, 200, 'Config updated successfully');
+            }
+            catch {
+                sendText(res, 500, 'Error: Failed to update config');
+            }
         }
+    }
+    else {
+        sendText(res, 401, `Error: ${validation.error}`);
+    }
+}
+function readConfig({ res, body, query, key, baseDir, outFile, }) {
+    const validation = validateAndExtractParams({
+        body,
+        query,
+        key,
+        baseDir,
+        outFile,
     });
-    // Get config route
-    app.get('/config', (req, res) => {
-        const validation = validateAndExtractParams({ req, key, baseDir, outFile });
-        if (!validation.isValid) {
-            res.status(401).setHeader('Content-Type', 'text/plain');
-            res.send(`Error: ${validation.error}`);
-            return;
-        }
+    if (validation.ok) {
         try {
             if (fs.existsSync(validation.configPath)) {
-                const config = fs.readFileSync(validation.configPath, 'utf8');
-                res.setHeader('Content-Type', 'text/plain');
-                res.send(config);
+                sendText(res, 200, fs.readFileSync(validation.configPath, 'utf8'));
             }
             else {
-                res.status(404).setHeader('Content-Type', 'text/plain');
-                res.send('Error: Config file not found');
+                sendText(res, 404, 'Error: Config file not found');
             }
         }
         catch (error) {
             console.error('Error reading config:', error);
-            res.status(500).setHeader('Content-Type', 'text/plain');
-            res.send('Error: Failed to read config');
+            sendText(res, 500, 'Error: Failed to read config');
         }
-    });
-    // Shutdown route for testing
-    app.post('/shutdown', (req, res) => {
-        const { body } = req;
-        const adminKey = body?.adminKey;
-        if (adminKey !== key) {
-            res.status(401).setHeader('Content-Type', 'text/plain');
-            res.send('Error: Invalid admin key');
-            return;
-        }
-        res.setHeader('Content-Type', 'text/plain');
-        res.send('Server shutting down');
-        // Shutdown the server after sending response
-        setImmediate(() => {
-            if (serverRef.current) {
-                serverRef.current.close();
-            }
-        });
-    });
+    }
+    else {
+        sendText(res, 401, `Error: ${validation.error}`);
+    }
+}
+/**
+ * The static half, and why it runs for `/` before the greeting below does: an
+ * admin server is pointed at a JBrowse install, so `/` has to load the app the
+ * user came for. `serve-handler` owns the parts worth not writing — content
+ * types, byte ranges (the same directory holds the BAM and CRAM files the app
+ * fetches by range), directory handling and the traversal guard.
+ */
+async function serveStatic({ req, res, baseDir, }) {
+    await handler(req, res, { public: baseDir });
+}
+async function hasIndexHtml(baseDir) {
+    return fs.promises
+        .stat(path.join(baseDir, 'index.html'))
+        .then(stats => stats.isFile())
+        .catch(() => false);
 }
 /**
- * Starts the server and sets up shutdown handlers
+ * The whole server, as one request handler.
+ *
+ * Replaces express + cors + express.json. The four routes are exact paths with
+ * no parameters, so the dispatch is a switch; the rest of what express supplied
+ * is the body reader, the CORS headers and the static handler above.
+ *
+ * One deliberate difference: `GET /config` is always the admin route. Under
+ * `express.static` a file literally named `config` sitting in the JBrowse
+ * directory would have shadowed it, which is not a thing anyone wants and was
+ * never intended.
  */
-export function startServer({ app, port, key, outFile, keyPath, serverRef, }) {
-    // Start the server
-    const server = app.listen(port, () => {
-        console.log(`Admin server started on port ${port}\n\n` +
+export function createRequestHandler({ baseDir, outFile, key, serverRef, bodySizeLimit, }) {
+    return async (req, res) => {
+        try {
+            applyCorsHeaders(res);
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            const route = `${req.method} ${url.pathname}`;
+            if (req.method === 'OPTIONS') {
+                res.writeHead(204);
+                res.end();
+            }
+            else if (route === 'POST /updateConfig' || route === 'GET /config') {
+                const body = requestBody(await readJsonBody(req, bodySizeLimit));
+                const args = {
+                    res,
+                    body,
+                    query: url.searchParams,
+                    key,
+                    baseDir,
+                    outFile,
+                };
+                if (route === 'GET /config') {
+                    readConfig(args);
+                }
+                else {
+                    updateConfig(args);
+                }
+            }
+            else if (route === 'POST /shutdown') {
+                const body = requestBody(await readJsonBody(req, bodySizeLimit));
+                if (asString(body.adminKey) === key) {
+                    sendText(res, 200, 'Server shutting down');
+                    setImmediate(() => {
+                        serverRef.current?.close();
+                    });
+                }
+                else {
+                    sendText(res, 401, 'Error: Invalid admin key');
+                }
+            }
+            else if (url.pathname === '/' && !(await hasIndexHtml(baseDir))) {
+                sendText(res, 200, 'JBrowse Admin Server');
+            }
+            else {
+                await serveStatic({ req, res, baseDir });
+            }
+        }
+        catch (error) {
+            // the express error middleware this replaces, and registered after the
+            // routes for the same reason: it has to catch what they and the body
+            // reader throw
+            if (!res.headersSent) {
+                if (error instanceof PayloadTooLargeError) {
+                    sendText(res, 413, 'Error: Request body too large');
+                }
+                else if (error instanceof SyntaxError) {
+                    sendText(res, 400, 'Error: Malformed JSON in request body');
+                }
+                else {
+                    console.error('Server error:', error);
+                    sendText(res, 500, 'Internal Server Error');
+                }
+            }
+        }
+    };
+}
+export function startServer({ server, port, host = DEFAULT_HOST, key, outFile, serverRef, }) {
+    server.listen(port, host, () => {
+        console.log(`Admin server started on ${host}:${port}\n\n` +
             `To access the admin interface, open your browser to:\n` +
             `http://localhost:${port}?adminKey=${key}\n\n` +
             `Admin key: ${key}\n` +
             `Config file: ${outFile}\n\n` +
             `To stop the server, press Ctrl+C`);
     });
-    // Store server reference for shutdown route
     serverRef.current = server;
-    // Handle server errors
     server.on('error', (error) => {
         if (error.code === 'EADDRINUSE') {
             console.error(`Error: Port ${port} is already in use`);
@@ -177,22 +299,12 @@ export function startServer({ app, port, key, outFile, keyPath, serverRef, }) {
         }
         process.exit(1);
     });
-    // Common shutdown handler
     const shutdownHandler = () => {
         console.log('\nShutting down admin server...');
         server.close(() => {
-            // Clean up admin key file
-            try {
-                fs.unlinkSync(keyPath);
-                debug(`Removed admin key file: ${keyPath}`);
-            }
-            catch (error) {
-                // Ignore errors when cleaning up
-            }
             process.exit(0);
         });
     };
-    // Handle server shutdown
     process.on('SIGINT', shutdownHandler);
     process.on('SIGTERM', shutdownHandler);
 }

package/dist/commands/create.js

@@ -1,9 +1,6 @@
-import fs from 'fs';
-import { parseArgs } from 'util';
-import decompress from 'decompress';
-import fetch from "../cliFetch.js";
-import { fetchGithubVersions, getBranch, getLatest, getTag, printHelp, } from "../utils.js";
-const fsPromises = fs.promises;
+import { mkdir, readdir } from 'node:fs/promises';
+import { parseArgs } from 'node:util';
+import { downloadRelease, extractZip, printHelp, printVersions, } from '../utils.js';
 const description = 'Downloads and installs the latest JBrowse 2 release';
 const examples = [
     '# Download latest release from github, and put in specific path',
@@ -71,44 +68,31 @@ export async function run(args) {
         });
         return;
     }
-    const argsPath = positionals[0];
-    if (!argsPath && !runFlags.listVersions) {
-        console.error(`Missing 1 required arg:
-    localPath  Location where JBrowse 2 will be installed
-    See more help with --help`);
-        return;
-    }
     const { force, url, listVersions, tag, branch, nightly } = runFlags;
     if (listVersions) {
-        const versions = (await fetchGithubVersions()).map(version => version.tag_name);
-        console.log(`All JBrowse versions:\n${versions.join('\n')}`);
-        process.exit(0);
+        await printVersions();
+        return;
+    }
+    const argsPath = positionals[0];
+    if (!argsPath) {
+        throw new Error('Missing 1 required arg:\nlocalPath  Location where JBrowse 2 will be installed\nSee more help with --help');
     }
     // mkdir will do nothing if dir exists
-    await fsPromises.mkdir(argsPath, { recursive: true });
+    await mkdir(argsPath, { recursive: true });
     if (!force) {
         await checkPath(argsPath);
     }
-    const locationUrl = url ||
-        (nightly ? await getBranch('main') : '') ||
-        (branch ? await getBranch(branch) : '') ||
-        (tag ? await getTag(tag) : await getLatest());
-    console.log(`Fetching ${locationUrl}...`);
-    const response = await fetch(locationUrl);
-    if (!response.ok) {
-        throw new Error(`HTTP ${response.status} fetching ${locationUrl}: ${response.statusText}`);
-    }
-    const type = response.headers.get('content-type');
-    if (url &&
-        type !== 'application/zip' &&
-        type !== 'application/octet-stream') {
-        throw new Error('The URL provided does not seem to be a JBrowse installation URL');
-    }
-    await decompress(Buffer.from(await response.arrayBuffer()), argsPath);
+    const { locationUrl, archive } = await downloadRelease({
+        url,
+        nightly,
+        branch,
+        tag,
+    });
+    await extractZip(archive, argsPath);
     console.log(`Unpacked ${locationUrl} at ${argsPath}`);
 }
 async function checkPath(userPath) {
-    const allFiles = await fsPromises.readdir(userPath);
+    const allFiles = await readdir(userPath);
     if (allFiles.length > 0) {
         throw new Error(`This directory (${userPath}) has existing files and could cause conflicts with create. Please choose another directory or use the force flag to overwrite existing files`);
     }