@memorax/memorax-code 0.1.5 → 0.1.6

package/lib/memorax-code-adapter-common/src/config-utils.mjs

@@ -127,14 +127,17 @@ export async function withJsonFileLockAsync(path, operation, options = {}) {
   const timeoutMs = positiveInteger(options.timeoutMs, JSON_FILE_LOCK_TIMEOUT_MS);
   const staleMs = positiveInteger(options.staleMs, JSON_FILE_LOCK_STALE_MS);
   const retryMs = positiveInteger(options.retryMs, JSON_FILE_LOCK_RETRY_MS);
+  const signal = options.signal;
   const lockPath = `${path}.lock`;
   const ownerId = `${process.pid}:${randomUUID()}`;
   const deadline = Date.now() + timeoutMs;
   const observedProcessStarts = new Map();
   const directory = dirname(path);
+  throwIfJsonFileLockAborted(signal, path, lockPath);
   ensurePrivateDirectory(directory, { durableBoundary: directory });
 
   while (!tryAcquireJsonFileLock(lockPath, ownerId)) {
+    throwIfJsonFileLockAborted(signal, path, lockPath);
     if (removeStaleJsonFileLock(lockPath, staleMs, observedProcessStarts)) continue;
     const remainingMs = deadline - Date.now();
     if (remainingMs <= 0) {
@@ -144,10 +147,11 @@ export async function withJsonFileLockAsync(path, operation, options = {}) {
       error.lockPath = lockPath;
       throw error;
     }
-    await sleep(Math.min(retryMs, remainingMs));
+    await sleep(Math.min(retryMs, remainingMs), signal, path, lockPath);
   }
 
   try {
+    throwIfJsonFileLockAborted(signal, path, lockPath);
     return await operation();
   } finally {
     releaseJsonFileLock(lockPath, ownerId);
@@ -381,8 +385,37 @@ function sleepSync(milliseconds) {
   Atomics.wait(LOCK_SLEEP_BUFFER, 0, 0, Math.max(1, Math.trunc(milliseconds)));
 }
 
-function sleep(milliseconds) {
-  return new Promise((resolve) => setTimeout(resolve, Math.max(1, Math.trunc(milliseconds))));
+function sleep(milliseconds, signal, path, lockPath) {
+  const delayMs = Math.max(1, Math.trunc(milliseconds));
+  if (!signal) return new Promise((resolve) => setTimeout(resolve, delayMs));
+  throwIfJsonFileLockAborted(signal, path, lockPath);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      signal.removeEventListener?.("abort", onAbort);
+      if (error) reject(error);
+      else resolve();
+    };
+    const timeout = setTimeout(() => finish(), delayMs);
+    const onAbort = () => finish(jsonFileLockAbortError(path, lockPath));
+    signal.addEventListener?.("abort", onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+}
+
+function throwIfJsonFileLockAborted(signal, path, lockPath) {
+  if (signal?.aborted) throw jsonFileLockAbortError(path, lockPath);
+}
+
+function jsonFileLockAbortError(path, lockPath) {
+  const error = new Error(`aborted while waiting for JSON state lock: ${lockPath}`);
+  error.code = "JSON_FILE_LOCK_ABORTED";
+  error.path = path;
+  error.lockPath = lockPath;
+  return error;
 }
 
 function positiveInteger(value, fallback) {

package/lib/memorax-code-adapter-common/src/credentials/linux-secret-service.mjs

@@ -0,0 +1,110 @@
+import {
+  DEFAULT_SECURE_COMMAND_OUTPUT_BYTES,
+  DEFAULT_SECURE_COMMAND_TIMEOUT_MS,
+  decodeSecureCredential,
+  encodeSecureCredential,
+  executeSecureCommand,
+  minimalEnvironment,
+  runSecureCommand,
+  secureCredentialBackendError,
+  validateSecureCredentialNamespace,
+  wipeSecureCommandResult,
+} from "./secure-command.mjs";
+
+const BACKEND = "linux-secret-service";
+const SECRET_TOOL = "/usr/bin/secret-tool";
+const LINUX_ENVIRONMENT_NAMES = Object.freeze([
+  "DBUS_SESSION_BUS_ADDRESS",
+  "XDG_RUNTIME_DIR",
+  "DISPLAY",
+  "WAYLAND_DISPLAY",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+]);
+
+export function createLinuxSecretServiceBackend(options) {
+  const namespace = validateSecureCredentialNamespace(options?.namespace, BACKEND);
+  const runner = options?.runner ?? runSecureCommand;
+  const environment = minimalEnvironment(options?.environment ?? process.env, LINUX_ENVIRONMENT_NAMES);
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_SECURE_COMMAND_TIMEOUT_MS;
+  const maxOutputBytes = options?.maxOutputBytes ?? DEFAULT_SECURE_COMMAND_OUTPUT_BYTES;
+  const attributes = Object.freeze([
+    "application",
+    "memorax-code",
+    "record",
+    "trial-credentials",
+    "namespace",
+    namespace,
+  ]);
+
+  async function invoke(operation, args, input = undefined) {
+    return executeSecureCommand(runner, {
+      backend: BACKEND,
+      operation,
+      command: SECRET_TOOL,
+      args,
+      input,
+      env: environment,
+      timeoutMs,
+      maxOutputBytes,
+    });
+  }
+
+  return Object.freeze({
+    async load() {
+      const result = await invoke("load", ["lookup", "--", ...attributes]);
+      try {
+        if (result.status === 1
+          && result.stdout.length === 0
+          && result.stderr.length === 0) return null;
+        if (result.status !== 0 || result.signal !== null) {
+          throw secureCredentialBackendError(BACKEND, "load", "command_failed");
+        }
+        return decodeSecureCredential(result.stdout, BACKEND, "load");
+      } finally {
+        wipeSecureCommandResult(result);
+      }
+    },
+
+    async save(serialized) {
+      const input = encodeSecureCredential(serialized, BACKEND, "save");
+      try {
+        const result = await invoke(
+          "save",
+          [
+            "store",
+            "--label=MemoraX Code trial credentials",
+            "--",
+            ...attributes,
+          ],
+          input,
+        );
+        try {
+          if (result.status !== 0 || result.signal !== null) {
+            throw secureCredentialBackendError(BACKEND, "save", "command_failed");
+          }
+        } finally {
+          wipeSecureCommandResult(result);
+        }
+      } finally {
+        input.fill(0);
+      }
+    },
+
+    async delete() {
+      const result = await invoke("delete", ["clear", "--", ...attributes]);
+      try {
+        if (result.status === 1
+          && result.stdout.length === 0
+          && result.stderr.length === 0) return false;
+        if (result.status !== 0 || result.signal !== null) {
+          throw secureCredentialBackendError(BACKEND, "delete", "command_failed");
+        }
+        return true;
+      } finally {
+        wipeSecureCommandResult(result);
+      }
+    },
+  });
+}

package/lib/memorax-code-adapter-common/src/credentials/macos-keychain.mjs

@@ -0,0 +1,224 @@
+import {
+  DEFAULT_SECURE_COMMAND_OUTPUT_BYTES,
+  DEFAULT_SECURE_COMMAND_TIMEOUT_MS,
+  decodeSecureCredential,
+  encodeSecureCredential,
+  executeSecureCommand,
+  minimalEnvironment,
+  runSecureCommand,
+  secureCredentialBackendError,
+  validateSecureCredentialNamespace,
+  wipeSecureCommandResult,
+} from "./secure-command.mjs";
+
+const BACKEND = "macos-keychain";
+const OSASCRIPT = "/usr/bin/osascript";
+const KEYCHAIN_SERVICE = "net.memorax.memorax-code.trial";
+const ITEM_NOT_FOUND_EXIT = 44;
+const INVALID_SECRET_EXIT = 65;
+const MACOS_ENVIRONMENT_NAMES = Object.freeze([
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LOGNAME",
+  "TMPDIR",
+  "USER",
+]);
+
+const JXA_PREFIX = String.raw`
+ObjC.import("Foundation");
+ObjC.import("Security");
+ObjC.bindFunction("exit", ["void", ["int"]]);
+const errSecItemNotFound = -25300;
+const errSecDuplicateItem = -25299;
+const maxSecretBytes = 4096;
+function quit(code) { $.exit(code); }
+function utf8Length(value) {
+  return Number(value.lengthOfBytesUsingEncoding($.NSUTF8StringEncoding));
+}
+function itemIdentity(argv) {
+  if (!argv || argv.length !== 2) quit(70);
+  const service = $(argv[0]);
+  const account = $(argv[1]);
+  if (utf8Length(service) < 1 || utf8Length(account) < 1) quit(70);
+  return { service, account };
+}
+function findItem(identity, passwordLength, passwordData, item) {
+  return $.SecKeychainFindGenericPassword(
+    $.nil,
+    utf8Length(identity.service),
+    identity.service.UTF8String,
+    utf8Length(identity.account),
+    identity.account.UTF8String,
+    passwordLength,
+    passwordData,
+    item
+  );
+}
+`;
+
+const LOAD_SCRIPT = `${JXA_PREFIX}
+function run(argv) {
+  const identity = itemIdentity(argv);
+  const passwordLength = Ref();
+  const passwordData = Ref();
+  const item = Ref();
+  const code = findItem(identity, passwordLength, passwordData, item);
+  if (code === errSecItemNotFound) quit(${ITEM_NOT_FOUND_EXIT});
+  if (code !== 0) quit(70);
+  let invalidSecret = false;
+  try {
+    const length = Number(passwordLength[0]);
+    if (length < 1 || length > maxSecretBytes) {
+      invalidSecret = true;
+    } else {
+      const secret = $.NSData.alloc.initWithBytesLength(passwordData[0], length);
+      $.NSFileHandle.fileHandleWithStandardOutput.writeData(secret);
+    }
+  } finally {
+    $.SecKeychainItemFreeContent($.nil, passwordData[0]);
+  }
+  if (invalidSecret) quit(${INVALID_SECRET_EXIT});
+}
+`;
+
+const SAVE_SCRIPT = `${JXA_PREFIX}
+function run(argv) {
+  const identity = itemIdentity(argv);
+  const secret = $.NSFileHandle.fileHandleWithStandardInput.readDataToEndOfFile;
+  const length = Number(secret.length);
+  if (length < 1 || length > maxSecretBytes) quit(${INVALID_SECRET_EXIT});
+  const item = Ref();
+  let code = findItem(identity, null, null, item);
+  if (code === 0) {
+    code = $.SecKeychainItemModifyAttributesAndData(
+      item[0],
+      $.nil,
+      length,
+      secret.bytes
+    );
+  } else if (code === errSecItemNotFound) {
+    code = $.SecKeychainAddGenericPassword(
+      $.nil,
+      utf8Length(identity.service),
+      identity.service.UTF8String,
+      utf8Length(identity.account),
+      identity.account.UTF8String,
+      length,
+      secret.bytes,
+      item
+    );
+    if (code === errSecDuplicateItem) {
+      code = findItem(identity, null, null, item);
+      if (code === 0) {
+        code = $.SecKeychainItemModifyAttributesAndData(
+          item[0],
+          $.nil,
+          length,
+          secret.bytes
+        );
+      }
+    }
+  }
+  if (code !== 0) quit(70);
+}
+`;
+
+const DELETE_SCRIPT = `${JXA_PREFIX}
+function run(argv) {
+  const identity = itemIdentity(argv);
+  const item = Ref();
+  const found = findItem(identity, null, null, item);
+  if (found === errSecItemNotFound) quit(${ITEM_NOT_FOUND_EXIT});
+  if (found !== 0) quit(70);
+  const deleted = $.SecKeychainItemDelete(item[0]);
+  if (deleted !== 0) quit(70);
+}
+`;
+
+export function createMacosKeychainBackend(options) {
+  const namespace = validateSecureCredentialNamespace(options?.namespace, BACKEND);
+  const runner = options?.runner ?? runSecureCommand;
+  const environment = minimalEnvironment(
+    options?.environment ?? process.env,
+    MACOS_ENVIRONMENT_NAMES,
+  );
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_SECURE_COMMAND_TIMEOUT_MS;
+  const maxOutputBytes = options?.maxOutputBytes ?? DEFAULT_SECURE_COMMAND_OUTPUT_BYTES;
+  const account = `credential-v1:${namespace}`;
+
+  async function invoke(operation, script, input = undefined) {
+    return executeSecureCommand(runner, {
+      backend: BACKEND,
+      operation,
+      command: OSASCRIPT,
+      args: ["-l", "JavaScript", "-e", script, "--", KEYCHAIN_SERVICE, account],
+      input,
+      env: environment,
+      timeoutMs,
+      maxOutputBytes,
+    });
+  }
+
+  async function load() {
+    const result = await invoke("load", LOAD_SCRIPT);
+    try {
+      if (isEmptyExit(result, ITEM_NOT_FOUND_EXIT)) return null;
+      if (result.status === INVALID_SECRET_EXIT) {
+        throw secureCredentialBackendError(BACKEND, "load", "invalid_response");
+      }
+      if (result.status !== 0 || result.signal !== null || result.stderr.length !== 0) {
+        throw secureCredentialBackendError(BACKEND, "load", "command_failed");
+      }
+      return decodeSecureCredential(result.stdout, BACKEND, "load");
+    } finally {
+      wipeSecureCommandResult(result);
+    }
+  }
+
+  return Object.freeze({
+    load,
+
+    async save(serialized) {
+      const input = encodeSecureCredential(serialized, BACKEND, "save");
+      try {
+        const result = await invoke("save", SAVE_SCRIPT, input);
+        try {
+          if (result.status !== 0
+            || result.signal !== null
+            || result.stdout.length !== 0
+            || result.stderr.length !== 0) {
+            throw secureCredentialBackendError(BACKEND, "save", "command_failed");
+          }
+        } finally {
+          wipeSecureCommandResult(result);
+        }
+      } finally {
+        input.fill(0);
+      }
+    },
+
+    async delete() {
+      const result = await invoke("delete", DELETE_SCRIPT);
+      try {
+        if (isEmptyExit(result, ITEM_NOT_FOUND_EXIT)) return false;
+        if (result.status !== 0
+          || result.signal !== null
+          || result.stdout.length !== 0
+          || result.stderr.length !== 0) {
+          throw secureCredentialBackendError(BACKEND, "delete", "command_failed");
+        }
+      } finally {
+        wipeSecureCommandResult(result);
+      }
+      return true;
+    },
+  });
+}
+
+function isEmptyExit(result, status) {
+  return result.status === status
+    && result.signal === null
+    && result.stdout.length === 0
+    && result.stderr.length === 0;
+}