@knowttl/mg-axi 0.1.4 → 0.1.6

package/dist/mutations.js

@@ -1,10 +1,12 @@
-import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, fsyncSync, openSync, unlinkSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { AxiError } from "axi-sdk-js";
 import { encodeGraphPathSegment, GRAPH_HOST, redactGraphValue } from "./graph-session.js";
-import { validateApplicationProfile, validateDelegatedProfile } from "./profiles.js";
+import { booleanEnv, movedError, validateApplicationProfile, validateDelegatedProfile } from "./profiles.js";
+import { statePath } from "./paths.js";
+import { PrivateFiles } from "./private-file.js";
 // Shared mutation coordinator for reviewed named mutation families.
 // The gate order follows az-axi's write gates as the reference: read-only default,
 // allowWrites plus a scope allowlist, preview, --execute, --confirm,
@@ -15,15 +17,19 @@ import { validateApplicationProfile, validateDelegatedProfile } from "./profiles
 export const READ_ONLY_ENV = "MG_AXI_READ_ONLY";
 export const WRITE_LOG_ENV = "MG_AXI_WRITE_LOG";
 export function readOnlyForced(env = process.env) {
-    return env[READ_ONLY_ENV] === "1";
+    return booleanEnv(READ_ONLY_ENV, env);
 }
 // Mutation intents and outcomes are journaled here: MG_AXI_WRITE_LOG when
-// set, otherwise ~/.mg-axi/writes.log. A blank override falls back.
+// set, otherwise the machine-local state directory. A blank override falls back.
 export function resolveWriteLogPath(env = process.env) {
     const override = env[WRITE_LOG_ENV]?.trim();
     if (override)
         return override;
-    return join(homedir(), ".mg-axi", "writes.log");
+    const target = statePath("writes.log", env);
+    const legacy = join(homedir(), ".mg-axi", "writes.log");
+    if (!existsSync(target) && existsSync(legacy))
+        movedError("Write log", legacy, target, "The moved journal keeps its intent and outcome history");
+    return target;
 }
 export const mutationFetchTransport = async (request) => {
     const response = await fetch(request.url, {
@@ -155,8 +161,8 @@ function decodeMutationBody(response) {
 // send needs a coordinator authorization minted after the write gates pass.
 // The bound profile copy is private; no profile snapshot is exposed.
 export function createMutationSender(args) {
-    const { delegated, application, transport } = args;
-    const bound = args.profile.mode === "application" ? validateApplicationProfile(args.profile) : validateDelegatedProfile(args.profile);
+    const { delegated, application, transport, files = new PrivateFiles() } = args;
+    const bound = args.profile.mode === "application" ? validateApplicationProfile(args.profile, files) : validateDelegatedProfile(args.profile, files);
     async function credential(scopes, signal) {
         signal?.throwIfAborted();
         if (bound.mode === "delegated") {
@@ -165,14 +171,14 @@ export function createMutationSender(args) {
                     "Pass the operation's documented delegated permission using full https://graph.microsoft.com/ scope names",
                 ]);
             }
-            return (await delegated.credential(validateDelegatedProfile(bound), scopes)).token;
+            return (await delegated.credential(bound, scopes)).token;
         }
         if (scopes !== undefined) {
             throw new AxiError("Application profiles use the configured Graph .default audience; delegated scopes are unavailable", "VALIDATION_ERROR", [
                 "mg-axi profile show --profile <name>",
             ]);
         }
-        return (await application.credential(validateApplicationProfile(bound))).token;
+        return (await application.credential(bound)).token;
     }
     async function send(authorization, options) {
         let handedOff = false;
@@ -240,8 +246,8 @@ export function createMutationSender(args) {
     return sender;
 }
 function flushDirectory(path) {
-    // Node cannot open directory handles on Windows; journal fsync still
-    // applies, and recordAudit pre-creates the journal file there instead.
+    // Node cannot open directory handles on Windows; atomic journal writes
+    // still fsync the file before replacement.
     if (process.platform === "win32")
         return;
     const fd = openSync(path, "r");
@@ -266,16 +272,16 @@ function serialize(value) {
     }
 }
 export function createMutationCoordinator(args) {
-    const { profile, delegated, application, transport } = args;
+    const { profile, delegated, application, transport, files = new PrivateFiles() } = args;
     const clock = args.clock ?? Date.now;
     const journalPath = args.journalPath ?? resolveWriteLogPath();
-    const validated = profile.mode === "application" ? validateApplicationProfile(profile) : validateDelegatedProfile(profile);
+    const validated = profile.mode === "application" ? validateApplicationProfile(profile, files) : validateDelegatedProfile(profile, files);
     const scope = Object.freeze({
         tenantId: validated.tenantId,
         allowWrites: validated.writes?.allowWrites === true,
         operations: Object.freeze([...(validated.writes?.operations ?? [])]),
     });
-    const sender = createMutationSender({ profile: validated, delegated, application, transport });
+    const sender = createMutationSender({ profile: validated, delegated, application, transport, files });
     function enforceWriteGates(definition) {
         // Gate 1: forced read-only overrides every profile.
         // Gate 2: the profile must opt in through hand-edited configuration.
@@ -357,7 +363,7 @@ export function createMutationCoordinator(args) {
         const line = JSON.stringify({ ...safe, intentKey: record.intentKey });
         try {
             const directory = dirname(journalPath);
-            const firstCreated = mkdirSync(directory, { recursive: true, mode: 0o700 });
+            const firstCreated = files.directory(directory);
             if (firstCreated) {
                 let path = directory;
                 const parent = dirname(firstCreated);
@@ -367,48 +373,31 @@ export function createMutationCoordinator(args) {
                 }
                 flushDirectory(parent);
             }
-            if (process.platform === "win32" && !existsSync(journalPath)) {
-                const journal = openSync(journalPath, "a", 0o600);
-                try {
-                    fsyncSync(journal);
-                }
-                finally {
-                    closeSync(journal);
-                }
-            }
             const lockPath = `${journalPath}.lock`;
             const lock = openSync(lockPath, "wx", 0o600);
             try {
-                const created = !existsSync(journalPath);
-                const journal = openSync(journalPath, "a+", 0o600);
-                try {
-                    if (record.kind === "intent") {
-                        const contents = readFileSync(journal, "utf8");
-                        if (contents && !contents.endsWith("\n"))
-                            throw new Error("Incomplete mutation journal");
-                        const records = contents.split("\n").filter(Boolean)
-                            .map(entry => JSON.parse(entry));
-                        if (records.some(entry => !entry || !["intent", "outcome"].includes(entry.kind)
-                            || typeof entry.intentKey !== "string" || !/^[a-f0-9]{64}$/.test(entry.intentKey))) {
-                            throw new Error("Invalid mutation journal");
-                        }
-                        // No automatic replay: a recreated coordinator refuses an intent
-                        // recorded without a terminal outcome, and a duplicate intent id
-                        // is never reserved twice.
-                        if (records.some(entry => entry.kind === "intent" && entry.intentKey === record.intentKey)) {
-                            throw new AxiError(`blocked: intent '${record.id}' was already reserved`, "ALREADY_EXECUTED", [
-                                `Intent '${record.id}' requires manual reconciliation; read back its target and never resend it`,
-                            ]);
-                        }
+                files.protect(lockPath);
+                const contents = existsSync(journalPath) ? files.read(journalPath) : "";
+                if (record.kind === "intent") {
+                    if (contents && !contents.endsWith("\n"))
+                        throw new Error("Incomplete mutation journal");
+                    const records = contents.split("\n").filter(Boolean)
+                        .map(entry => JSON.parse(entry));
+                    if (records.some(entry => !entry || !["intent", "outcome"].includes(entry.kind)
+                        || typeof entry.intentKey !== "string" || !/^[a-f0-9]{64}$/.test(entry.intentKey))) {
+                        throw new Error("Invalid mutation journal");
+                    }
+                    // No automatic replay: a recreated coordinator refuses an intent
+                    // recorded without a terminal outcome, and a duplicate intent id
+                    // is never reserved twice.
+                    if (records.some(entry => entry.kind === "intent" && entry.intentKey === record.intentKey)) {
+                        throw new AxiError(`blocked: intent '${record.id}' was already reserved`, "ALREADY_EXECUTED", [
+                            `Intent '${record.id}' requires manual reconciliation; read back its target and never resend it`,
+                        ]);
                     }
-                    writeFileSync(journal, `${line}\n`);
-                    fsyncSync(journal);
-                    if (created)
-                        flushDirectory(directory);
-                }
-                finally {
-                    closeSync(journal);
                 }
+                files.write(journalPath, `${contents}${line}\n`);
+                flushDirectory(directory);
             }
             finally {
                 closeSync(lock);
@@ -416,7 +405,7 @@ export function createMutationCoordinator(args) {
             }
         }
         catch (error) {
-            if (error instanceof AxiError && error.code === "ALREADY_EXECUTED")
+            if (error instanceof AxiError && (error.code === "ALREADY_EXECUTED" || error.code === "CONFIG_INSECURE"))
                 throw error;
             if (record.kind === "intent") {
                 throw new AxiError(`Mutation intent '${record.id}' could not be recorded`, "INTENT_NOT_RECORDED", [

package/dist/paths.js

@@ -0,0 +1,17 @@
+import { homedir } from "node:os";
+import { isAbsolute, join, win32 } from "node:path";
+export function toolDirectory(kind, env = process.env, platform = process.platform, home = homedir()) {
+    if (platform === "win32") {
+        const base = env[kind === "config" ? "APPDATA" : "LOCALAPPDATA"];
+        return win32.join(base || win32.join(home, "AppData", kind === "config" ? "Roaming" : "Local"), "mg-axi");
+    }
+    const base = env[kind === "config" ? "XDG_CONFIG_HOME" : "XDG_STATE_HOME"];
+    return join(base && isAbsolute(base) ? base : join(home, kind === "config" ? ".config" : ".local/state"), "mg-axi");
+}
+export function configPath(env = process.env) {
+    const override = env.MG_AXI_CONFIG?.trim();
+    return override ? override : join(toolDirectory("config", env), "config.json");
+}
+export function statePath(name, env = process.env) {
+    return join(toolDirectory("state", env), name);
+}

package/dist/private-file.js

@@ -0,0 +1,227 @@
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, win32 } from "node:path";
+import { AxiError } from "axi-sdk-js";
+// LiteralPath and single-quoted literals keep file names out of PowerShell syntax.
+export const windowsAcl = (path, directory, action) => {
+    const literal = `'${path.replace(/'/g, "''")}'`;
+    const script = `$ErrorActionPreference='Stop'; $p=${literal};
+    $item=Get-Item -LiteralPath $p -Force;
+    if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Reparse point' };
+    ${action === "inspect" ? "" : `
+    $user=[Security.Principal.WindowsIdentity]::GetCurrent().User;
+    $ids=@($user.Value,'S-1-5-18','S-1-5-32-544');
+    ${action === "restrict" ? `
+    $acl=[Security.AccessControl.${directory ? "DirectorySecurity" : "FileSecurity"}]::new();
+    $acl.SetOwner($user); $acl.SetAccessRuleProtection($true,$false);
+    foreach ($id in $ids) {
+      $sid=[Security.Principal.SecurityIdentifier]::new($id);
+      $rule=[Security.AccessControl.FileSystemAccessRule]::new($sid,'FullControl','${directory ? "ContainerInherit,ObjectInherit" : "None"}','None','Allow');
+      $acl.AddAccessRule($rule);
+    }; Set-Acl -LiteralPath $p -AclObject $acl;` : `
+    $acl=Get-Acl -LiteralPath $p;
+    if (!$acl.AreAccessRulesProtected -or $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -ne $user.Value) { throw 'Unprotected ACL' };
+    $rules=@($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier]));
+    if ($rules.Count -ne 3) { throw 'Unexpected ACL' };
+    foreach ($id in $ids) {
+      $matches=@($rules | Where-Object { $_.IdentityReference.Value -eq $id -and $_.AccessControlType -eq 'Allow' -and $_.FileSystemRights -eq 'FullControl' -and !$_.IsInherited -and $_.InheritanceFlags -eq '${directory ? "ContainerInherit, ObjectInherit" : "None"}' -and $_.PropagationFlags -eq 'None' });
+      if ($matches.Count -ne 1) { throw 'Unexpected grant' };
+    };`}`}`;
+    execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { stdio: "pipe", windowsHide: true });
+};
+// All private-file permissions live here; Windows branches are injectable on Linux.
+export class PrivateFiles {
+    platform;
+    acl;
+    uid;
+    constructor(platform = process.platform, acl = windowsAcl, uid = process.getuid?.()) {
+        this.platform = platform;
+        this.acl = acl;
+        this.uid = uid;
+    }
+    absolute(path) {
+        return this.platform === "win32" ? /^[A-Za-z]:[\\/]/.test(path) && win32.isAbsolute(path) : isAbsolute(path);
+    }
+    insecure(path) {
+        throw new AxiError(`Insecure file ${path}`, "CONFIG_INSECURE", [this.platform === "win32" ? `Re-run the tool's write to protect ${path}` : `chmod 600 '${path.replace(/'/g, "'\\''")}'`]);
+    }
+    check(path, secret = true, verifyAcl = false) {
+        try {
+            const stat = lstatSync(path);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                this.insecure(path);
+            if (this.platform === "win32") {
+                try {
+                    this.acl(path, false, verifyAcl ? "verify" : "inspect");
+                }
+                catch (error) {
+                    if (error instanceof AxiError)
+                        throw error;
+                    this.insecure(path);
+                }
+            }
+            else if (stat.uid !== this.uid || (stat.mode & (secret ? 0o077 : 0o022)) !== 0)
+                this.insecure(path);
+            return stat;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOENT")
+                throw error;
+            if (code === "EACCES" || code === "EPERM" || code === "ELOOP")
+                return this.insecure(path);
+            throw error;
+        }
+    }
+    read(path, secret = true, verifyAcl = false) {
+        const checked = this.check(path, secret, verifyAcl);
+        let fd;
+        try {
+            fd = openSync(path, constants.O_RDONLY | (this.platform === "win32" ? 0 : constants.O_NOFOLLOW));
+            const opened = fstatSync(fd);
+            if (opened.dev !== checked.dev || opened.ino !== checked.ino)
+                this.insecure(path);
+            return readFileSync(fd, "utf8").replace(/^\uFEFF/, "");
+        }
+        catch (error) {
+            if (error instanceof AxiError)
+                throw error;
+            const code = error.code;
+            if (code === "EACCES" || code === "EPERM" || code === "ELOOP")
+                this.insecure(path);
+            throw error;
+        }
+        finally {
+            if (fd !== undefined)
+                try {
+                    closeSync(fd);
+                }
+                catch { /* original error preserved */ }
+        }
+    }
+    directory(path) {
+        try {
+            let firstCreated;
+            if (!existsSync(path)) {
+                const parent = dirname(path);
+                if (!existsSync(parent))
+                    firstCreated = this.directory(parent);
+                mkdirSync(path, { mode: 0o700 });
+                firstCreated ??= path;
+            }
+            const stat = lstatSync(path);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                this.insecure(path);
+            if (this.platform === "win32") {
+                try {
+                    this.acl(path, true, "restrict");
+                }
+                catch (error) {
+                    if (error instanceof AxiError)
+                        throw error;
+                    this.insecure(path);
+                }
+            }
+            else {
+                if (stat.uid !== this.uid)
+                    this.insecure(path);
+                chmodSync(path, 0o700);
+            }
+            return firstCreated;
+        }
+        catch (error) {
+            if (error instanceof AxiError)
+                throw error;
+            const code = error.code;
+            if (code === "EACCES" || code === "EPERM" || code === "ELOOP")
+                this.insecure(path);
+            throw error;
+        }
+    }
+    protect(path) {
+        try {
+            const stat = lstatSync(path);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                this.insecure(path);
+            if (this.platform === "win32") {
+                try {
+                    this.acl(path, false, "restrict");
+                }
+                catch (error) {
+                    if (error instanceof AxiError)
+                        throw error;
+                    this.insecure(path);
+                }
+            }
+            else {
+                if (stat.uid !== this.uid)
+                    this.insecure(path);
+                chmodSync(path, 0o600);
+            }
+        }
+        catch (error) {
+            if (error instanceof AxiError)
+                throw error;
+            const code = error.code;
+            if (code === "EACCES" || code === "EPERM" || code === "ELOOP")
+                this.insecure(path);
+            throw error;
+        }
+    }
+    write(path, content) {
+        this.directory(dirname(path));
+        const temporary = `${path}.${randomUUID()}.tmp`;
+        let fd;
+        try {
+            try {
+                fd = openSync(temporary, "wx", this.platform === "win32" ? undefined : 0o600);
+                try {
+                    if (this.platform === "win32")
+                        this.acl(temporary, false, "restrict");
+                }
+                catch (error) {
+                    if (error instanceof AxiError)
+                        throw error;
+                    this.insecure(path);
+                }
+                writeFileSync(fd, content);
+                fsyncSync(fd);
+                closeSync(fd);
+                fd = undefined;
+            }
+            catch (error) {
+                if (error instanceof AxiError)
+                    throw error;
+                const code = error.code;
+                if (code === "EACCES" || code === "EPERM" || code === "ELOOP")
+                    this.insecure(path);
+                throw error;
+            }
+            const deadline = Date.now() + 1000;
+            let delay = 10;
+            for (;;) {
+                try {
+                    renameSync(temporary, path);
+                    break;
+                }
+                catch (error) {
+                    if (error.code === "ELOOP")
+                        this.insecure(path);
+                    if (this.platform !== "win32" || !["EPERM", "EBUSY", "EACCES"].includes(error.code ?? "") || Date.now() >= deadline)
+                        throw error;
+                    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.min(delay, deadline - Date.now()));
+                    delay = Math.min(delay * 2, 100);
+                }
+            }
+        }
+        finally {
+            if (fd !== undefined)
+                try {
+                    closeSync(fd);
+                }
+                catch { /* original error preserved */ }
+            rmSync(temporary, { force: true });
+        }
+    }
+}