@lemoncat7/dsh-ssh 1.1.8 → 1.3.0-alpha.9

package/lib/api.js

@@ -1,12 +1,13 @@
 import { randomBytes } from 'node:crypto';
 import { pipeline } from 'node:stream/promises';
 import { HostKeyRequiredError } from './connector.js';
-import { normalizeCredentialEntryDraft, normalizeForwardDraft, normalizeProfileDraft, normalizeProxyEntryDraft, normalizeSecrets, } from './domain.js';
+import { normalizeCredentialEntryDraft, normalizeForwardDraft, normalizeFtpProfileDraft, normalizeProfileDraft, normalizeProxyEntryDraft, normalizeRemoteProjectDraft, normalizeSecrets, } from './domain.js';
 import { setSessionDirectory } from './directory.js';
 import { streamTerminalOutput } from './terminal-stream.js';
 import { listSftpDirectory, openSftpFile, readSftpFilePreview, uploadSftpFile } from './sftp.js';
 import { streamActivityEvents } from './activity-events.js';
 import { listLocalWorkspace, openLocalWorkspaceFile, readLocalWorkspacePreview } from './local-workspace.js';
+import { connectFtpProfile } from './ftp-adapter.js';
 const MAX_BODY_BYTES = 1_048_576;
 const MAX_SFTP_UPLOAD_BYTES = 512 * 1024 * 1024;
 export function registerSshApi(webServer, prefix, runtime) {
@@ -30,7 +31,138 @@ async function dispatch(req, res, prefix, runtime) {
     const segments = relative ? relative.split('/').map(decodeURIComponent) : [];
     const method = req.method ?? 'GET';
     if (method === 'GET' && segments[0] === 'health')
-        return sendJson(res, 200, { ok: true, service: 'dsh-ssh', schemaVersion: 2 });
+        return sendJson(res, 200, { ok: true, service: 'dsh-ssh', schemaVersion: 5 });
+    if (segments[0] === 'file-transfer') {
+        if (method === 'GET' && segments[1] === 'endpoints' && segments.length === 2)
+            return sendJson(res, 200, runtime.files.endpoints());
+        if (method === 'GET' && segments[1] === 'directory' && segments.length === 2) {
+            const endpointId = requireText(url.searchParams.get('endpointId'), 'endpointId', 110);
+            const paneId = requireText(url.searchParams.get('paneId'), 'paneId', 100);
+            return sendJson(res, 200, await runtime.fileSessions.run(paneId, endpointId, session => session.list(url.searchParams.get('path') ?? session.endpoint.initialPath)));
+        }
+        if (method === 'POST' && segments[1] === 'delete' && segments.length === 2) {
+            requireMutationHeader(req);
+            const request = parseFileDeleteRequest(await readObject(req));
+            await runtime.fileSessions.run(request.paneId, request.endpointId, async (session) => {
+                const directory = await session.list(request.directory);
+                const available = new Set(directory.entries.map(entry => entry.path));
+                for (const path of request.paths)
+                    if (!available.has(path))
+                        throw httpError(404, `remote path ${path} is not a direct child of ${directory.path}`);
+                for (const path of request.paths)
+                    await session.remove(path, true);
+            });
+            return sendJson(res, 204, undefined);
+        }
+        if (segments[1] === 'jobs') {
+            if (method === 'GET' && segments.length === 2)
+                return sendJson(res, 200, runtime.transfers.list());
+            if (method === 'POST' && segments.length === 2) {
+                requireMutationHeader(req);
+                const body = await readObject(req);
+                return sendJson(res, 202, runtime.transfers.start('ui', parseTransferRequest(body)));
+            }
+            const jobId = segments[2];
+            if (jobId !== undefined && method === 'GET' && segments.length === 3)
+                return sendJson(res, 200, runtime.transfers.get(jobId));
+            if (jobId !== undefined && method === 'DELETE' && segments.length === 3) {
+                requireMutationHeader(req);
+                runtime.transfers.cancel(jobId);
+                return sendJson(res, 204, undefined);
+            }
+        }
+    }
+    if (segments[0] === 'ftp-profiles') {
+        if (method === 'GET' && segments.length === 1)
+            return sendJson(res, 200, await ftpProfileViews(runtime));
+        if (method === 'POST' && segments[1] === 'test-draft' && segments.length === 2) {
+            requireMutationHeader(req);
+            const body = await readObject(req);
+            const draft = normalizeFtpProfileDraft(body.profile);
+            const id = body.profileId === undefined ? createId('ftp-preview') : requiredFtpProfile(runtime.store, requireText(body.profileId, 'profileId', 100)).id;
+            const previous = body.profileId === undefined ? {} : await runtime.credentials.readFtp(id);
+            const secrets = { ...previous, ...normalizeSecrets(body.secrets) };
+            if (!secrets.password && draft.credentialId === undefined)
+                throw httpError(400, 'FTP password is required');
+            const credentialEntry = draft.credentialId === undefined ? undefined : requiredPasswordCredential(runtime.store, draft.credentialId);
+            const password = credentialEntry === undefined ? secrets.password : (await runtime.credentials.readEntry(credentialEntry.id)).password;
+            if (!password)
+                throw httpError(400, 'FTP password credential is not configured');
+            const now = Date.now();
+            const profile = { ...draft, id, username: credentialEntry?.username ?? draft.username, port: draft.port ?? defaultFtpPort(draft.protocol), proxy: draft.proxy ?? { type: 'none' }, initialPath: draft.initialPath ?? '/', connectTimeoutMs: draft.connectTimeoutMs ?? 15_000, createdAt: now, updatedAt: now };
+            const session = await connectFtpProfile(profile, password, runtime.dialer);
+            try {
+                await session.list(profile.initialPath);
+                return sendJson(res, 200, { ok: true });
+            }
+            finally {
+                session.close();
+            }
+        }
+        if (method === 'POST' && segments.length === 1) {
+            requireMutationHeader(req);
+            const body = await readObject(req);
+            const draft = normalizeFtpProfileDraft(body.profile);
+            if (draft.credentialId !== undefined)
+                requiredPasswordCredential(runtime.store, draft.credentialId);
+            const secrets = normalizeSecrets(body.secrets);
+            if (draft.credentialId === undefined && !secrets.password)
+                throw httpError(400, 'FTP password is required');
+            const now = Date.now();
+            const profile = { ...draft, id: createId('ftp'), port: draft.port ?? defaultFtpPort(draft.protocol), proxy: draft.proxy ?? { type: 'none' }, initialPath: draft.initialPath ?? '/', connectTimeoutMs: draft.connectTimeoutMs ?? 15_000, createdAt: now, updatedAt: now };
+            if (profile.credentialId === undefined)
+                await runtime.credentials.replaceFtp(profile.id, { password: secrets.password });
+            try {
+                await runtime.store.update(state => { state.ftpProfiles.push(profile); });
+            }
+            catch (error) {
+                if (profile.credentialId === undefined)
+                    await runtime.credentials.deleteFtp(profile.id).catch(() => { });
+                throw error;
+            }
+            return sendJson(res, 201, await ftpProfileView(runtime, profile));
+        }
+        const id = segments[1];
+        if (id !== undefined && method === 'PUT' && segments.length === 2) {
+            requireMutationHeader(req);
+            const previous = requiredFtpProfile(runtime.store, id);
+            const body = await readObject(req);
+            const draft = normalizeFtpProfileDraft(body.profile);
+            if (draft.credentialId !== undefined)
+                requiredPasswordCredential(runtime.store, draft.credentialId);
+            const secrets = normalizeSecrets(body.secrets);
+            const next = { ...previous, ...draft, id, port: draft.port ?? defaultFtpPort(draft.protocol), proxy: draft.proxy ?? { type: 'none' }, initialPath: draft.initialPath ?? '/', connectTimeoutMs: draft.connectTimeoutMs ?? 15_000, createdAt: previous.createdAt, updatedAt: Date.now() };
+            if (draft.group === undefined)
+                delete next.group;
+            if (draft.tlsServerName === undefined)
+                delete next.tlsServerName;
+            const oldSecrets = await runtime.credentials.readFtp(id);
+            if (next.credentialId === undefined && !secrets.password && !oldSecrets.password)
+                throw httpError(400, 'FTP password is required when switching to connection-specific credentials');
+            if (next.credentialId === undefined && secrets.password)
+                await runtime.credentials.writeFtp(id, { password: secrets.password });
+            try {
+                await runtime.store.update(state => { state.ftpProfiles = state.ftpProfiles.map(profile => profile.id === id ? next : profile); });
+            }
+            catch (error) {
+                await runtime.credentials.replaceFtp(id, oldSecrets).catch(() => { });
+                throw error;
+            }
+            if (next.credentialId !== undefined && previous.credentialId === undefined)
+                await runtime.credentials.deleteFtp(id).catch(() => { });
+            return sendJson(res, 200, await ftpProfileView(runtime, next));
+        }
+        if (id !== undefined && method === 'DELETE' && segments.length === 2) {
+            requireMutationHeader(req);
+            requiredFtpProfile(runtime.store, id);
+            await runtime.store.update(state => {
+                state.ftpProfiles = state.ftpProfiles.filter(profile => profile.id !== id);
+                state.injections = state.injections.map(injection => ({ ...injection, fileEndpointIds: injection.fileEndpointIds.filter(endpointId => endpointId !== `ftp:${id}`) }));
+            });
+            await runtime.credentials.deleteFtp(id);
+            return sendJson(res, 204, undefined);
+        }
+    }
     if (segments[0] === 'vault') {
         if (method === 'GET' && segments.length === 1)
             return sendJson(res, 200, await credentialEntryViews(runtime));
@@ -76,9 +208,9 @@ async function dispatch(req, res, prefix, runtime) {
         if (id !== undefined && method === 'DELETE' && segments.length === 2) {
             requireMutationHeader(req);
             requiredCredentialEntry(runtime.store, id);
-            const references = runtime.store.profiles().filter(profile => profile.credentialId === id);
-            if (references.length > 0)
-                throw httpError(409, `credential entry is used by ${references.length} SSH profile(s)`);
+            const references = runtime.store.profiles().filter(profile => profile.credentialId === id).length + runtime.store.ftpProfiles().filter(profile => profile.credentialId === id).length;
+            if (references > 0)
+                throw httpError(409, `credential entry is used by ${references} connection(s)`);
             await runtime.store.update(state => { state.credentialEntries = state.credentialEntries.filter(entry => entry.id !== id); });
             await runtime.credentials.deleteEntry(id);
             return sendJson(res, 204, undefined);
@@ -127,9 +259,9 @@ async function dispatch(req, res, prefix, runtime) {
         if (id !== undefined && method === 'DELETE' && segments.length === 2) {
             requireMutationHeader(req);
             requiredProxyEntry(runtime.store, id);
-            const references = runtime.store.profiles().filter(profile => profile.proxy.type === 'saved' && profile.proxy.proxyId === id);
-            if (references.length > 0)
-                throw httpError(409, `proxy entry is used by ${references.length} SSH profile(s)`);
+            const references = runtime.store.profiles().filter(profile => profile.proxy.type === 'saved' && profile.proxy.proxyId === id).length + runtime.store.ftpProfiles().filter(profile => profile.proxy.type === 'saved' && profile.proxy.proxyId === id).length;
+            if (references > 0)
+                throw httpError(409, `proxy entry is used by ${references} connection(s)`);
             await runtime.store.update(state => { state.proxyEntries = state.proxyEntries.filter(entry => entry.id !== id); });
             await runtime.credentials.deleteProxyEntry(id);
             return sendJson(res, 204, undefined);
@@ -178,6 +310,49 @@ async function dispatch(req, res, prefix, runtime) {
             return sendJson(res, 201, await profileView(runtime, profile));
         }
         const id = segments[1];
+        if (id !== undefined && segments[2] === 'projects') {
+            requiredProfile(runtime.store, id);
+            if (method === 'GET' && segments.length === 3)
+                return sendJson(res, 200, runtime.store.remoteProjects(id));
+            if (method === 'POST' && segments.length === 3) {
+                requireMutationHeader(req);
+                const draft = normalizeRemoteProjectDraft((await readObject(req)).project);
+                const now = Date.now();
+                const project = { ...draft, id: createId('project'), profileId: id, createdAt: now, updatedAt: now };
+                await runtime.store.update(state => { state.remoteProjects.push(project); });
+                return sendJson(res, 201, project);
+            }
+            const projectId = segments[3];
+            if (projectId !== undefined && method === 'PUT' && segments.length === 4) {
+                requireMutationHeader(req);
+                const previous = requiredRemoteProject(runtime.store, projectId, id);
+                const draft = normalizeRemoteProjectDraft((await readObject(req)).project);
+                const next = { ...previous, ...draft, updatedAt: Date.now() };
+                await runtime.store.update(state => {
+                    state.remoteProjects = state.remoteProjects.map(project => project.id === projectId ? next : project);
+                    state.injections = state.injections.map(injection => {
+                        if (injection.workingProjectIds[previous.profileId] !== projectId || injection.workingDirectories[previous.profileId] !== previous.path)
+                            return injection;
+                        return { ...injection, workingDirectories: { ...injection.workingDirectories, [previous.profileId]: next.path } };
+                    });
+                });
+                return sendJson(res, 200, next);
+            }
+            if (projectId !== undefined && method === 'DELETE' && segments.length === 4) {
+                requireMutationHeader(req);
+                requiredRemoteProject(runtime.store, projectId, id);
+                await runtime.store.update(state => {
+                    state.remoteProjects = state.remoteProjects.filter(project => project.id !== projectId);
+                    state.injections = state.injections.map(injection => {
+                        if (injection.workingProjectIds[id] !== projectId)
+                            return injection;
+                        const { [id]: _removed, ...workingProjectIds } = injection.workingProjectIds;
+                        return { ...injection, workingProjectIds };
+                    });
+                });
+                return sendJson(res, 204, undefined);
+            }
+        }
         if (id !== undefined && segments[2] === 'sftp') {
             requiredProfile(runtime.store, id);
             const operation = segments[3];
@@ -236,10 +411,12 @@ async function dispatch(req, res, prefix, runtime) {
             await Promise.all(related.map(rule => runtime.forwards.stop(rule.id).catch(() => { })));
             await runtime.store.update(state => {
                 state.profiles = state.profiles.filter(profile => profile.id !== id);
+                state.remoteProjects = (state.remoteProjects ?? []).filter(project => project.profileId !== id);
                 state.forwardRules = state.forwardRules.filter(rule => rule.profileId !== id);
                 state.injections = state.injections.map(item => {
                     const { [id]: _removed, ...workingDirectories } = item.workingDirectories;
-                    return { ...item, profileIds: item.profileIds.filter(profileId => profileId !== id), workingDirectories };
+                    const { [id]: _removedProject, ...workingProjectIds } = item.workingProjectIds;
+                    return { ...item, profileIds: item.profileIds.filter(profileId => profileId !== id), fileEndpointIds: (item.fileEndpointIds ?? []).filter(endpointId => endpointId !== `sftp:${id}`), workingDirectories, workingProjectIds };
                 });
             });
             await runtime.credentials.delete(id);
@@ -329,19 +506,33 @@ async function dispatch(req, res, prefix, runtime) {
         if (sessionId !== undefined && method === 'PUT' && segments.length === 2) {
             requireMutationHeader(req);
             const body = await readObject(req);
+            const previous = runtime.store.injection(sessionId);
             const profileIds = parseProfileIds(body.profileIds, runtime.store);
+            const fileEndpointIds = body.fileEndpointIds === undefined ? previous?.fileEndpointIds ?? [] : parseFileEndpointIds(body.fileEndpointIds, runtime.files);
+            const filePermission = body.filePermission === undefined ? previous?.filePermission ?? 'browse' : body.filePermission === 'browse' ? 'browse' : body.filePermission === 'transfer' ? 'transfer' : undefined;
+            if (filePermission === undefined)
+                throw httpError(400, 'filePermission must be browse or transfer');
             const permission = body.permission === 'exec' ? 'exec' : body.permission === 'terminal' ? 'terminal' : undefined;
             if (permission === undefined)
                 throw httpError(400, 'permission must be exec or terminal');
-            const previousDirectories = runtime.store.injection(sessionId)?.workingDirectories ?? {};
-            const workingDirectories = Object.fromEntries(Object.entries(previousDirectories).filter(([profileId]) => profileIds.includes(profileId)));
-            const injection = { sessionId, profileIds, permission, requireCommandApproval: body.requireCommandApproval !== false, workingDirectories, updatedAt: Date.now() };
+            const workingDirectories = parseWorkingDirectories(body.workingDirectories, profileIds);
+            const workingProjectIds = parseWorkingProjectIds(body.workingProjectIds, profileIds, runtime.store);
+            const injection = {
+                sessionId, profileIds, fileEndpointIds, filePermission, requireFileApproval: body.requireFileApproval === undefined ? previous?.requireFileApproval ?? true : body.requireFileApproval !== false,
+                permission, requireCommandApproval: body.requireCommandApproval !== false, workingDirectories, workingProjectIds, updatedAt: Date.now(),
+            };
             await runtime.store.update(state => { state.injections = [...state.injections.filter(item => item.sessionId !== sessionId), injection]; });
+            const revoked = previous?.profileIds.filter(profileId => !profileIds.includes(profileId)) ?? [];
+            if (permission !== 'terminal')
+                await runtime.aiTerminals.closeOwner(sessionId);
+            else
+                await Promise.all(revoked.map(profileId => runtime.aiTerminals.closeProfile(sessionId, profileId)));
             return sendJson(res, 200, injection);
         }
         if (sessionId !== undefined && method === 'DELETE' && segments.length === 2) {
             requireMutationHeader(req);
             await runtime.store.update(state => { state.injections = state.injections.filter(item => item.sessionId !== sessionId); });
+            await runtime.aiTerminals.closeOwner(sessionId);
             return sendJson(res, 204, undefined);
         }
     }
@@ -554,14 +745,24 @@ async function credentialEntryViews(runtime) {
 async function credentialEntryView(runtime, entry) {
     const credential = await runtime.credentials.describeEntry(entry.id);
     const requiredField = entry.authType === 'password' ? 'password' : 'privateKey';
-    return { ...entry, credential: { ...credential, configured: credential.fields.includes(requiredField) }, references: runtime.store.profiles().filter(profile => profile.credentialId === entry.id).length };
+    return { ...entry, credential: { ...credential, configured: credential.fields.includes(requiredField) }, references: runtime.store.profiles().filter(profile => profile.credentialId === entry.id).length + runtime.store.ftpProfiles().filter(profile => profile.credentialId === entry.id).length };
 }
 async function proxyEntryViews(runtime) {
     return Promise.all(runtime.store.proxyEntries().map(entry => proxyEntryView(runtime, entry)));
 }
 async function proxyEntryView(runtime, entry) {
     const credential = await runtime.credentials.describeProxyEntry(entry.id);
-    return { ...entry, credential, references: runtime.store.profiles().filter(profile => profile.proxy.type === 'saved' && profile.proxy.proxyId === entry.id).length };
+    return { ...entry, credential, references: runtime.store.profiles().filter(profile => profile.proxy.type === 'saved' && profile.proxy.proxyId === entry.id).length + runtime.store.ftpProfiles().filter(profile => profile.proxy.type === 'saved' && profile.proxy.proxyId === entry.id).length };
+}
+async function ftpProfileViews(runtime) { return Promise.all(runtime.store.ftpProfiles().map(profile => ftpProfileView(runtime, profile))); }
+async function ftpProfileView(runtime, profile) {
+    if (profile.credentialId !== undefined) {
+        const entry = requiredPasswordCredential(runtime.store, profile.credentialId);
+        const credential = await runtime.credentials.describeEntry(entry.id);
+        return { ...profile, username: entry.username, credential: { ...credential, configured: credential.fields.includes('password'), source: 'vault', entryId: entry.id, entryName: entry.name } };
+    }
+    const credential = await runtime.credentials.describeFtp(profile.id);
+    return { ...profile, credential: { ...credential, configured: credential.fields.includes('password'), source: 'profile' } };
 }
 function requiredProfile(store, id) {
     const profile = store.profile(id);
@@ -569,6 +770,24 @@ function requiredProfile(store, id) {
         throw httpError(404, 'SSH profile was not found');
     return profile;
 }
+function requiredFtpProfile(store, id) {
+    const profile = store.ftpProfile(id);
+    if (profile === undefined)
+        throw httpError(404, 'FTP profile was not found');
+    return profile;
+}
+function requiredPasswordCredential(store, id) {
+    const entry = requiredCredentialEntry(store, id);
+    if (entry.authType !== 'password')
+        throw httpError(400, 'FTP connections require a password credential');
+    return entry;
+}
+function requiredRemoteProject(store, id, profileId) {
+    const project = store.remoteProject(id);
+    if (project === undefined || project.profileId !== profileId)
+        throw httpError(404, 'remote project was not found');
+    return project;
+}
 function requiredForward(store, id) {
     const rule = store.forward(id);
     if (rule === undefined)
@@ -616,6 +835,79 @@ function parseProfileIds(value, store) {
         throw httpError(400, 'profileIds must be an array');
     return [...new Set(value.map(item => requireText(item, 'profileId', 100)))].map(id => requiredProfile(store, id).id);
 }
+function parseWorkingDirectories(value, profileIds) {
+    if (value === undefined)
+        return {};
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw httpError(400, 'workingDirectories must be an object');
+    const result = {};
+    for (const [profileId, rawPath] of Object.entries(value)) {
+        if (!profileIds.includes(profileId))
+            continue;
+        const path = requireRawText(rawPath, 'working directory', 4096).trim();
+        if (path.length > 0)
+            result[profileId] = path;
+    }
+    return result;
+}
+function parseWorkingProjectIds(value, profileIds, store) {
+    if (value === undefined)
+        return {};
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw httpError(400, 'workingProjectIds must be an object');
+    const result = {};
+    for (const [profileId, rawProjectId] of Object.entries(value)) {
+        if (!profileIds.includes(profileId))
+            continue;
+        const projectId = requireText(rawProjectId, 'working project id', 100);
+        result[profileId] = requiredRemoteProject(store, projectId, profileId).id;
+    }
+    return result;
+}
+function parseFileEndpointIds(value, files) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > 100)
+        throw httpError(400, 'fileEndpointIds must be an array');
+    return [...new Set(value.map(item => requireText(item, 'fileEndpointId', 110)))].map(id => {
+        if (files.endpoint(id) === undefined)
+            throw httpError(404, `file endpoint ${id} was not found`);
+        return id;
+    });
+}
+function parseTransferRequest(value) {
+    const conflict = value.conflictPolicy;
+    if (conflict !== 'fail' && conflict !== 'skip' && conflict !== 'overwrite' && conflict !== 'rename')
+        throw httpError(400, 'invalid conflictPolicy');
+    if (!Array.isArray(value.sourcePaths))
+        throw httpError(400, 'sourcePaths must be an array');
+    return {
+        sourceEndpointId: requireText(value.sourceEndpointId, 'sourceEndpointId', 110),
+        sourcePaths: value.sourcePaths.map(path => requireRawText(path, 'source path', 4096)),
+        destinationEndpointId: requireText(value.destinationEndpointId, 'destinationEndpointId', 110),
+        destinationDirectory: requireRawText(value.destinationDirectory, 'destinationDirectory', 4096),
+        conflictPolicy: conflict,
+    };
+}
+function parseFileDeleteRequest(value) {
+    if (!Array.isArray(value.paths) || value.paths.length < 1 || value.paths.length > 100)
+        throw httpError(400, 'paths must contain 1-100 entries');
+    const paths = [...new Set(value.paths.map(path => requireRawText(path, 'remote path', 4096)))];
+    for (const path of paths)
+        assertDeletableRemotePath(path);
+    return {
+        paneId: requireText(value.paneId, 'paneId', 100),
+        endpointId: requireText(value.endpointId, 'endpointId', 110),
+        directory: requireRawText(value.directory, 'directory', 4096),
+        paths,
+    };
+}
+function assertDeletableRemotePath(value) {
+    const normalized = value.trim().replaceAll('\\', '/').replace(/\/+$/, '') || '/';
+    if (normalized === '/' || normalized === '.' || normalized === '~' || /^[A-Za-z]:$/.test(normalized))
+        throw httpError(400, 'refusing to delete a remote filesystem root');
+}
+function defaultFtpPort(protocol) { return protocol === 'ftps-implicit' ? 990 : 21; }
 function createId(prefix) { return `${prefix}-${randomBytes(10).toString('hex')}`; }
 function assertSameOrigin(req) {
     const origin = req.headers.origin;