@jeffusion/bungee-types 5.4.5 → 5.5.0

package/dist/daemon-file.d.ts

@@ -14,6 +14,7 @@ export type WindowsAclEntry = {
     readonly inherited: boolean;
 };
 export type WindowsAclSnapshot = {
+    readonly ownerSid?: string;
     readonly currentSid: string;
     readonly entries: readonly WindowsAclEntry[];
 };
@@ -42,6 +43,8 @@ export type DaemonFileOptions = {
 export declare function formatDaemonFileAclError(error: unknown): string | null;
 /** @internal source-test probe; not re-exported from the package root. */
 export declare function __testSelectWindowsAclExecutable(environment: NodeJS.ProcessEnv): string;
+/** Read-only validation: untrusted input files must never have their ACL repaired. */
+export declare function assertWindowsOwnerOnlyFileAcl(path: string, adapter?: WindowsAclAdapter): Promise<void>;
 /** @internal source-test probe; not re-exported from the package root. */
 export declare function __testReadWindowsAcl(path: string, deadlineMs?: number): Promise<WindowsAclSnapshot>;
 /** @internal source-test probe; not re-exported from the package root. */

package/dist/daemon-file.js

@@ -619,15 +619,15 @@ function defaultWindowsAclAdapter(deadlineMs = WINDOWS_ACL_DEADLINE_MS) {
         + 'Import-Module Microsoft.PowerShell.Security -ErrorAction Stop;';
     const readScript = phase('started') + moduleBootstrap + phase('before_get_acl')
         + '$item=Get-Item -LiteralPath $env:BUNGEE_DAEMON_ACL_PATH -Force;'
-        + '$a=if($item -is [System.IO.DirectoryInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.DirectoryInfo]$item,[System.Security.AccessControl.AccessControlSections]::Access)}'
-        + 'elseif($item -is [System.IO.FileInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.FileInfo]$item,[System.Security.AccessControl.AccessControlSections]::Access)}'
+        + '$a=if($item -is [System.IO.DirectoryInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.DirectoryInfo]$item,([System.Security.AccessControl.AccessControlSections]::Access -bor [System.Security.AccessControl.AccessControlSections]::Owner))}'
+        + 'elseif($item -is [System.IO.FileInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.FileInfo]$item,([System.Security.AccessControl.AccessControlSections]::Access -bor [System.Security.AccessControl.AccessControlSections]::Owner))}'
         + 'else{throw "Windows ACL target is not a file or directory"};'
         + phase('after_get_acl')
         + '$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;'
         + '$e=@($a.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])|ForEach-Object { @{sid=$_.IdentityReference.Value;'
         + 'access=$(if([int]$_.AccessControlType -eq 0){"allow"}else{"deny"});rights=[int]$_.FileSystemRights;'
         + 'inheritance=[int]$_.InheritanceFlags;propagation=[int]$_.PropagationFlags;inherited=[bool]$_.IsInherited} });'
-        + '[Console]::Out.Write((ConvertTo-Json -Compress -Depth 4 @{currentSid=$sid;entries=$e}))';
+        + '[Console]::Out.Write((ConvertTo-Json -Compress -Depth 4 @{currentSid=$sid;ownerSid=$a.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;entries=$e}))';
     const setScript = phase('started') + moduleBootstrap + '$p=$env:BUNGEE_DAEMON_ACL_PATH;$u=$env:BUNGEE_DAEMON_ACL_SID;'
         + '$k=$env:BUNGEE_DAEMON_ACL_KIND;$a=if($k -eq "directory"){[System.Security.AccessControl.DirectorySecurity]::new()}else{[System.Security.AccessControl.FileSecurity]::new()};'
         + '$a.SetAccessRuleProtection($true,$false);$i=if($k -eq "directory"){[System.Security.AccessControl.InheritanceFlags]::ObjectInherit -bor [System.Security.AccessControl.InheritanceFlags]::ContainerInherit}else{[System.Security.AccessControl.InheritanceFlags]::None};'
@@ -717,6 +717,15 @@ function defaultWindowsAclAdapter(deadlineMs = WINDOWS_ACL_DEADLINE_MS) {
         },
     };
 }
+/** Read-only validation: untrusted input files must never have their ACL repaired. */
+export async function assertWindowsOwnerOnlyFileAcl(path, adapter = defaultWindowsAclAdapter()) {
+    const snapshot = await adapter.read(path);
+    if (!canonicalSid(snapshot.ownerSid) || snapshot.ownerSid !== snapshot.currentSid)
+        fail('acl', 'Recovery input must be owned by the current user');
+    const validation = windowsAclSecure(snapshot, 'file');
+    if (validation !== null)
+        throw new WindowsAclValidationError(validation);
+}
 /** @internal source-test probe; not re-exported from the package root. */
 export async function __testReadWindowsAcl(path, deadlineMs = WINDOWS_ACL_DEADLINE_MS) {
     return defaultWindowsAclAdapter(deadlineMs).read(path);

package/dist/types.d.ts

@@ -134,6 +134,8 @@ export interface LoadBalancingConfig {
     hash_policy?: HashPolicyConfig;
 }
 export interface Service {
+    /** Stable identity supplied by the runtime compiler. */
+    id?: string;
     name: string;
     endpoints: Endpoint[];
     plugins?: Array<PluginConfig | string>;
@@ -207,6 +209,7 @@ export interface RouteConfig extends ModificationRules {
     id?: string;
     path: string;
     service?: string;
+    service_id?: string;
     endpoints?: Endpoint[];
     path_rewrite?: Record<string, string>;
     auth?: AuthConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffusion/bungee-types",
-  "version": "5.4.5",
+  "version": "5.5.0",
   "description": "TypeScript type definitions for Bungee",
   "type": "module",
   "main": "./dist/index.js",