@mnstry/atelier 0.2.0-alpha.5 → 0.2.0-alpha.8

package/src/projection/obsidian/materialize/settings.mjs

@@ -0,0 +1,57 @@
+import { refuse, sha256Digest } from './byte-lens.mjs'
+
+// Policy-owned Obsidian settings. Atelier owns exactly two keys of one file:
+// the built-in Sync and Publish core plugins stay disabled, because a generated
+// view must not leave the machine through the editor. Every other path under
+// the settings directory, and every other key of that file, belongs to the
+// person using the vault and is never prepared, replaced or removed here.
+
+export const SETTINGS_ROOT = '.obsidian'
+export const POLICY_SETTINGS_PATH = `${SETTINGS_ROOT}/core-plugins.json`
+export const POLICY_DISABLED_CORE_PLUGINS = Object.freeze(['publish', 'sync'])
+
+export function isPolicySettingsPath(relativePath) {
+  return relativePath === POLICY_SETTINGS_PATH
+}
+
+export function isUserOwnedSettingsPath(relativePath) {
+  return (relativePath === SETTINGS_ROOT || relativePath.startsWith(`${SETTINGS_ROOT}/`)) && !isPolicySettingsPath(relativePath)
+}
+
+const serialize = (value) => Buffer.from(`${JSON.stringify(value, null, 2)}\n`, 'utf8')
+
+// `existing` is the current bytes of the policy file when the vault already
+// has one, so keys the person set survive. Bytes that already satisfy the
+// policy are returned untouched.
+export function prepareSettings({ existing = null } = {}) {
+  let bytes
+  if (existing === null || existing === undefined) {
+    bytes = serialize(Object.fromEntries(POLICY_DISABLED_CORE_PLUGINS.map((id) => [id, false])))
+  } else {
+    if (!Buffer.isBuffer(existing)) refuse('invalid-settings', 'existing settings must be supplied as a Buffer')
+    let current
+    try {
+      current = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(existing))
+    } catch {
+      refuse('invalid-settings', 'existing core plugin settings do not parse; they are left alone')
+    }
+    if (Array.isArray(current)) {
+      // Older list form: membership means enabled.
+      const kept = current.filter((id) => !POLICY_DISABLED_CORE_PLUGINS.includes(id))
+      bytes = kept.length === current.length ? existing : serialize(kept)
+    } else if (current !== null && typeof current === 'object') {
+      const satisfied = POLICY_DISABLED_CORE_PLUGINS.every((id) => current[id] === false)
+      bytes = satisfied ? existing : serialize({ ...current, ...Object.fromEntries(POLICY_DISABLED_CORE_PLUGINS.map((id) => [id, false])) })
+    } else {
+      refuse('invalid-settings', 'existing core plugin settings have an unknown shape; they are left alone')
+    }
+  }
+  return {
+    files: [{ path: POLICY_SETTINGS_PATH, kind: 'settings', bytes, digest: sha256Digest(bytes) }],
+    ownership: {
+      policyOwned: [{ path: POLICY_SETTINGS_PATH, ownedKeys: [...POLICY_DISABLED_CORE_PLUGINS], digest: sha256Digest(bytes), byteLength: bytes.length }],
+      userOwnedRoot: SETTINGS_ROOT,
+      rule: 'every-other-path-and-key-is-user-owned',
+    },
+  }
+}

package/src/projection/obsidian/materialize/stage.mjs

@@ -0,0 +1,27 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { refuse, sha256Digest } from './byte-lens.mjs'
+
+// Writes a prepared view into a caller-supplied staging directory. Staging is
+// disposable prepared output only: this never touches a vault, never replaces
+// a file and never follows a link. Publication is a separate protocol.
+export function stagePreparedView(prepared, stagingDir) {
+  if (typeof stagingDir !== 'string' || !path.isAbsolute(stagingDir)) refuse('invalid-staging-directory', 'the staging directory must be an absolute path')
+  fs.mkdirSync(stagingDir, { recursive: true, mode: 0o700 })
+  const root = fs.realpathSync(stagingDir)
+  if (fs.readdirSync(root).length > 0) refuse('staging-not-empty', 'the staging directory must be empty')
+  for (const file of prepared.files) {
+    const parts = file.path.split('/')
+    if (path.isAbsolute(file.path) || parts.some((part) => part === '' || part === '.' || part === '..')) refuse('path-escapes-vault', 'a prepared path would leave the staging root')
+    let directory = root
+    for (const part of parts.slice(0, -1)) {
+      directory = path.join(directory, part)
+      if (!fs.existsSync(directory)) fs.mkdirSync(directory, { mode: 0o700 })
+      if (!fs.lstatSync(directory).isDirectory()) refuse('path-escapes-vault', 'a staging path component is not a plain directory')
+    }
+    const target = path.join(directory, parts.at(-1))
+    fs.writeFileSync(target, file.bytes, { flag: 'wx', mode: 0o600 })
+    if (sha256Digest(fs.readFileSync(target)) !== file.digest) refuse('staging-readback-mismatch', 'staged bytes differ from the prepared bytes')
+  }
+  return { root, fileCount: prepared.files.length }
+}