@naviyra/cloud-panel 0.0.3-beta → 0.0.3-beta3

package/apps/agent/src/files.mjs

@@ -0,0 +1,162 @@
+import path from "node:path";
+import { lstat, mkdir, readdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
+
+const TEXT_LIMIT = 1024 * 1024;
+const UPLOAD_LIMIT = 32 * 1024 * 1024;
+const DOWNLOAD_LIMIT = 256 * 1024 * 1024;
+const LIST_LIMIT = 500;
+
+function fail(message, status = 400) {
+  return Object.assign(Error(message), { status });
+}
+
+export function safeRelative(value) {
+  const raw = String(value ?? "")
+    .replaceAll("\\", "/")
+    .trim();
+  if (!raw || raw === ".") return "";
+  if (raw.includes("\0") || raw.startsWith("/") || /^[a-zA-Z]:/.test(raw))
+    throw fail("Use a path inside the application directory");
+  const parts = [];
+  for (const part of raw.split("/")) {
+    if (!part || part === ".") continue;
+    if (part === ".." || part.includes(":") || part.includes("\0"))
+      throw fail("Use a path inside the application directory");
+    parts.push(part);
+  }
+  return parts.join("/");
+}
+
+async function inside(root, relative, { allowMissing = false } = {}) {
+  const safe = safeRelative(relative);
+  const realRoot = await realpath(root);
+  if (!safe) {
+    return { root: realRoot, target: realRoot, relative: "", stat: await lstat(realRoot) };
+  }
+  const target = path.resolve(realRoot, safe);
+  const parent = path.dirname(target);
+  let realParent;
+  try {
+    realParent = await realpath(parent);
+  } catch (error) {
+    if (error.code === "ENOENT") throw fail("Folder not found", 404);
+    throw error;
+  }
+  const parentRel = path.relative(realRoot, realParent);
+  if (parentRel.startsWith("..") || path.isAbsolute(parentRel))
+    throw fail("Use a path inside the application directory");
+  let stat = null;
+  try {
+    stat = await lstat(target);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    if (!allowMissing) throw fail("File not found", 404);
+  }
+  if (stat?.isSymbolicLink()) throw fail("Links are not allowed");
+  if (stat) {
+    const realTarget = await realpath(target);
+    const rel = path.relative(realRoot, realTarget);
+    if (rel.startsWith("..") || path.isAbsolute(rel))
+      throw fail("Use a path inside the application directory");
+  }
+  return { root: realRoot, target, relative: safe, stat };
+}
+
+export async function projectAppRoot(folderPath) {
+  if (!folderPath) throw fail("Deploy the project before opening files", 409);
+  const root = path.resolve(folderPath, "app");
+  await mkdir(root, { recursive: true });
+  return realpath(root);
+}
+
+export async function listFiles(root, relative = "") {
+  const located = await inside(root, relative);
+  if (!located.stat?.isDirectory()) throw fail("Folder not found", 404);
+  const names = await readdir(located.target);
+  const entries = [];
+  for (const name of names.sort((a, b) => a.localeCompare(b))) {
+    if (entries.length >= LIST_LIMIT) break;
+    const stat = await lstat(path.join(located.target, name));
+    entries.push({
+      name,
+      kind: stat.isSymbolicLink()
+        ? "link"
+        : stat.isDirectory()
+          ? "dir"
+          : "file",
+      size: stat.isDirectory() ? null : stat.size,
+      modified: stat.mtime.toISOString(),
+    });
+  }
+  return {
+    path: located.relative,
+    entries,
+    truncated: names.length > LIST_LIMIT,
+  };
+}
+
+export async function readFileText(root, relative) {
+  const located = await inside(root, relative);
+  if (!located.relative) throw fail("Choose a file");
+  if (!located.stat?.isFile()) throw fail("Choose a file");
+  if (located.stat.size > TEXT_LIMIT)
+    return { path: located.relative, binary: true, size: located.stat.size };
+  const buffer = await readFile(located.target);
+  if (buffer.includes(0))
+    return { path: located.relative, binary: true, size: located.stat.size };
+  return { path: located.relative, binary: false, content: buffer.toString("utf8") };
+}
+
+export async function writeFileText(root, relative, content) {
+  if (typeof content !== "string") throw fail("File content must be text");
+  if (content.length > TEXT_LIMIT) throw fail("File is larger than 1 MB", 413);
+  const safe = safeRelative(relative);
+  if (!safe) throw fail("Choose a file");
+  const located = await inside(root, safe, { allowMissing: true });
+  if (located.stat?.isDirectory()) throw fail("Choose a file name");
+  await writeFile(located.target, content, "utf8");
+  return { ok: true, path: safe };
+}
+
+export async function createDirectory(root, relative) {
+  const safe = safeRelative(relative);
+  if (!safe) throw fail("Choose a folder name");
+  const located = await inside(root, safe, { allowMissing: true });
+  if (located.stat) throw fail("That name already exists", 409);
+  await mkdir(located.target);
+  return { ok: true, path: safe };
+}
+
+export async function removePath(root, relative) {
+  const safe = safeRelative(relative);
+  if (!safe) throw fail("Choose a file or folder");
+  const located = await inside(root, safe);
+  if (located.target === located.root) throw fail("The application directory cannot be removed");
+  await rm(located.target, { recursive: true, force: false });
+  return { ok: true };
+}
+
+export async function saveUpload(root, relative, source) {
+  const safe = safeRelative(relative);
+  if (!safe) throw fail("Choose a file name");
+  const located = await inside(root, safe, { allowMissing: true });
+  if (located.stat?.isDirectory()) throw fail("Choose a file name");
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of source) {
+    size += chunk.length;
+    if (size > UPLOAD_LIMIT) throw fail("File is larger than 32 MB", 413);
+    chunks.push(chunk);
+  }
+  await writeFile(located.target, Buffer.concat(chunks));
+  return { ok: true, path: safe, size };
+}
+
+export async function openDownload(root, relative) {
+  const located = await inside(root, relative);
+  if (!located.stat?.isFile()) throw fail("Choose a file");
+  if (located.stat.size > DOWNLOAD_LIMIT)
+    throw fail("File is larger than 256 MB", 413);
+  const name = path.basename(located.target).replace(/[^A-Za-z0-9._-]/g, "_") || "download";
+  return { file: located.target, name };
+}

package/apps/agent/src/host-tools.mjs

@@ -0,0 +1,518 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream, createWriteStream, existsSync } from "node:fs";
+import {
+  access,
+  chmod,
+  mkdir,
+  readdir,
+  readFile,
+  rename,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGunzip } from "node:zlib";
+import path from "node:path";
+import yauzl from "yauzl";
+
+const HOSTS = new Set([
+  "github.com",
+  "release-assets.githubusercontent.com",
+  "objects.githubusercontent.com",
+  "github-releases.githubusercontent.com",
+  "windows.php.net",
+  "downloads.php.net",
+  "www.php.net",
+  "dl.static-php.dev",
+]);
+const PHP_VERSION = "8.4.26";
+const LINUX_PHP_VERSION = "8.4.23";
+const CADDY_VERSION = "2.11.7";
+const WINDOWS = {
+  php: {
+    version: PHP_VERSION,
+    file: `php-${PHP_VERSION}-nts-Win32-vs17-x64.zip`,
+    url: `https://windows.php.net/downloads/releases/php-${PHP_VERSION}-nts-Win32-vs17-x64.zip`,
+    sha256:
+      "da68394f9193b7f6b89d0c76861a4034ae10efee7fd55a7255d8118c2acf70d7",
+  },
+  caddy: {
+    version: CADDY_VERSION,
+    file: `caddy_${CADDY_VERSION}_windows_amd64.zip`,
+    url: `https://github.com/caddyserver/caddy/releases/download/v${CADDY_VERSION}/caddy_${CADDY_VERSION}_windows_amd64.zip`,
+    sha256:
+      "0a1edc0b799512051c57071ce0e798d3f2cf67dc98171366f1d2b326072e3b06",
+  },
+};
+const LINUX_PHP_SHA256 = {
+  x86_64:
+    "a7119303b87687e87b7ae71929ff64970882aeb5a8ae8befab641396e1179280",
+  aarch64:
+    "b3f16bb29920be756c803601200cc8f65655fab6e377d66d21dccd4296ea75c8",
+};
+const LINUX_CADDY_SHA512 = {
+  amd64:
+    "a7a433a1b133efc3c8d10eb0b99d52a24b5ef5c322dc77f5282182b1c0402139ab83f3a99f0c52409df77d20123fb0b523edad8a66d8f5e49136197bf61ef0e7",
+  arm64:
+    "3db36ba90c7a6e8dda40ee3dd71fa08844c76b5fb08f61b31e5e78d2ed38e71c51dc7baed875e50d1ca1279196e84302967237386ae87c91ae9f2aaceada682e",
+};
+const EXTENSIONS = [
+  "curl",
+  "fileinfo",
+  "mbstring",
+  "openssl",
+  "pdo_mysql",
+  "mysqli",
+  "gd",
+];
+const pending = new Map();
+
+export function assertDownloadUrl(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password)
+    throw Error("Unexpected download address");
+  if (!HOSTS.has(url.hostname)) throw Error("Unexpected download host");
+  return url;
+}
+
+async function exists(file) {
+  try {
+    await access(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function checksumOf(artifact) {
+  if (artifact.sha256) return ["sha256", artifact.sha256];
+  if (artifact.sha512) return ["sha512", artifact.sha512];
+  throw Error("Missing checksum");
+}
+
+function hashFile(file, algorithm) {
+  return new Promise((resolve, reject) => {
+    const hash = createHash(algorithm);
+    createReadStream(file)
+      .on("data", (chunk) => hash.update(chunk))
+      .on("error", reject)
+      .on("end", () => resolve(hash.digest("hex")));
+  });
+}
+
+async function downloadOnce(artifact, destination, algorithm, digest, fetchImpl) {
+  const temporary = `${destination}.${randomUUID()}.part`;
+  let current = artifact.url;
+  let response;
+  try {
+    for (let hop = 0; hop < 5; hop++) {
+      assertDownloadUrl(current);
+      response = await fetchImpl(current, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(30 * 60 * 1000),
+      });
+      if ([301, 302, 303, 307, 308].includes(response.status)) {
+        const location = response.headers.get("location");
+        if (!location) throw Error("Download redirect was empty");
+        current = new URL(location, current).href;
+        continue;
+      }
+      break;
+    }
+    if (!response?.ok || !response.body) throw Error("Download failed");
+    const hash = createHash(algorithm);
+    let length = 0;
+    await pipeline(
+      Readable.fromWeb(response.body),
+      new Transform({
+        transform(chunk, encoding, callback) {
+          length += chunk.length;
+          if (length > 80 * 1024 * 1024) callback(Error("Download too large"));
+          else {
+            hash.update(chunk);
+            callback(null, chunk);
+          }
+        },
+      }),
+      createWriteStream(temporary, { flags: "wx" }),
+    );
+    if (hash.digest("hex") !== digest) throw Error("Checksum mismatch");
+    await rm(destination, { force: true });
+    await rename(temporary, destination);
+    return destination;
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+
+async function download(artifact, directory, fetchImpl) {
+  await mkdir(directory, { recursive: true });
+  const destination = path.join(directory, artifact.file);
+  const [algorithm, digest] = checksumOf(artifact);
+  if (
+    (await exists(destination)) &&
+    (await hashFile(destination, algorithm)) === digest
+  )
+    return destination;
+  let last;
+  for (let attempt = 1; attempt <= 4; attempt++) {
+    try {
+      return await downloadOnce(
+        artifact,
+        destination,
+        algorithm,
+        digest,
+        fetchImpl,
+      );
+    } catch (error) {
+      last = error;
+      if (
+        /Checksum mismatch|Unexpected download|Download too large/.test(
+          error.message || "",
+        )
+      )
+        break;
+    }
+  }
+  throw Error(
+    `Could not download ${artifact.file}. Check the network and deploy again. ${last?.message || ""}`.trim(),
+  );
+}
+
+function extractZip(file, destination) {
+  return new Promise((resolve, reject) => {
+    yauzl.open(
+      file,
+      { lazyEntries: true, validateEntrySizes: true },
+      (error, zip) => {
+        if (error) return reject(error);
+        let total = 0;
+        const fail = (error) => {
+          zip.close();
+          reject(error);
+        };
+        zip.on("error", fail);
+        zip.on("end", resolve);
+        zip.on("entry", (entry) => {
+          const filename = entry.fileName.replaceAll("\\", "/");
+          const target = path.resolve(destination, filename);
+          const rel = path.relative(destination, target);
+          if (
+            !rel ||
+            rel.startsWith("..") ||
+            path.isAbsolute(rel) ||
+            filename.includes(":")
+          )
+            return fail(Error("Unsafe archive entry"));
+          total += entry.uncompressedSize;
+          if (total > 400 * 1024 * 1024)
+            return fail(Error("Archive is too large"));
+          if (filename.endsWith("/")) {
+            mkdir(target, { recursive: true })
+              .then(() => zip.readEntry())
+              .catch(fail);
+            return;
+          }
+          mkdir(path.dirname(target), { recursive: true })
+            .then(
+              () =>
+                new Promise((done, stop) => {
+                  zip.openReadStream(entry, (error, stream) => {
+                    if (error) return stop(error);
+                    pipeline(stream, createWriteStream(target))
+                      .then(done)
+                      .catch(stop);
+                  });
+                }),
+            )
+            .then(() => zip.readEntry())
+            .catch(fail);
+        });
+        zip.readEntry();
+      },
+    );
+  });
+}
+
+function archiveHome(file) {
+  return file.replace(/\.tar\.gz$/i, "").replace(/\.zip$/i, "");
+}
+
+function octal(buffer) {
+  const text = buffer.toString("utf8").replace(/\0.*$/, "").trim();
+  if (!text) return 0;
+  const value = Number.parseInt(text, 8);
+  if (!Number.isFinite(value)) throw Error("Invalid archive header");
+  return value;
+}
+
+function tarName(header) {
+  const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+  const prefix = header.subarray(345, 500).toString("utf8").replace(/\0.*$/, "");
+  return prefix ? `${prefix}/${name}` : name;
+}
+
+function validTarChecksum(header) {
+  const recorded = octal(header.subarray(148, 156));
+  let sum = 0;
+  for (let i = 0; i < 512; i++) sum += i >= 148 && i < 156 ? 32 : header[i];
+  return sum === recorded;
+}
+
+function safeTarget(destination, name) {
+  const filename = String(name).replaceAll("\\", "/");
+  if (!filename || filename.startsWith("/") || filename.includes(":"))
+    throw Error("Unsafe archive entry");
+  const target = path.resolve(destination, filename);
+  const rel = path.relative(destination, target);
+  if (!rel || rel.startsWith("..") || path.isAbsolute(rel))
+    throw Error("Unsafe archive entry");
+  return target;
+}
+
+async function extractTarGz(file, destination) {
+  const chunks = [];
+  let length = 0;
+  await pipeline(
+    createReadStream(file),
+    createGunzip(),
+    new Transform({
+      transform(chunk, encoding, callback) {
+        length += chunk.length;
+        if (length > 400 * 1024 * 1024) callback(Error("Archive is too large"));
+        else {
+          chunks.push(chunk);
+          callback();
+        }
+      },
+    }),
+  );
+  const data = Buffer.concat(chunks);
+  let offset = 0;
+  let pending = "";
+  let total = 0;
+  while (offset + 512 <= data.length) {
+    const header = data.subarray(offset, offset + 512);
+    offset += 512;
+    if (header.every((byte) => byte === 0)) continue;
+    if (!validTarChecksum(header)) throw Error("Archive header is invalid");
+    const size = octal(header.subarray(124, 136));
+    if (offset + size > data.length) throw Error("Archive is truncated");
+    const body = data.subarray(offset, offset + size);
+    offset += Math.ceil(size / 512) * 512;
+    const type = String.fromCharCode(header[156]);
+    if (type === "L") {
+      pending = body.toString("utf8").replace(/\0+$/, "");
+      continue;
+    }
+    if (type === "x") {
+      const match = /(?:^|\n)\d+ path=([^\n]+)/.exec(body.toString("utf8"));
+      if (match) pending = match[1];
+      continue;
+    }
+    if (type === "g" || type === "K") continue;
+    const name = pending || tarName(header);
+    pending = "";
+    if (type === "5" || name.endsWith("/")) {
+      await mkdir(safeTarget(destination, name), { recursive: true });
+      continue;
+    }
+    if (type === "1" || type === "2") throw Error("Unsafe archive entry");
+    if (type !== "0" && type !== "\0") continue;
+    total += size;
+    if (total > 400 * 1024 * 1024) throw Error("Archive is too large");
+    const target = safeTarget(destination, name);
+    await mkdir(path.dirname(target), { recursive: true });
+    await writeFile(target, body);
+    const mode = octal(header.subarray(100, 108));
+    if (process.platform !== "win32" && mode & 0o111)
+      await chmod(target, mode & 0o777);
+  }
+}
+
+export async function extractArchive(file, destination) {
+  if (file.endsWith(".tar.gz")) return extractTarGz(file, destination);
+  return extractZip(file, destination);
+}
+
+async function install(artifact, directory, fetchImpl, log) {
+  const home = path.join(directory, archiveHome(artifact.file));
+  const marker = path.join(home, ".naviyra-version");
+  if ((await exists(marker)) && (await readFile(marker, "utf8")) === artifact.version)
+    return home;
+  log(`Downloading ${artifact.file}`);
+  const archive = await download(artifact, path.join(directory, "cache"), fetchImpl);
+  await rm(home, { recursive: true, force: true });
+  await mkdir(home, { recursive: true });
+  log(`Installing ${artifact.file}`);
+  await extractArchive(archive, home);
+  await writeFile(marker, artifact.version);
+  return home;
+}
+
+async function writePhpIni(home) {
+  const lines = [
+    "engine = On",
+    "cgi.force_redirect = 0",
+    "cgi.fix_pathinfo = 1",
+    "date.timezone = UTC",
+    "expose_php = Off",
+    "memory_limit = 256M",
+    "upload_max_filesize = 32M",
+    "post_max_size = 32M",
+  ];
+  const ext = path.join(home, "ext");
+  if (await exists(ext)) {
+    lines.splice(1, 0, 'extension_dir = "ext"');
+    for (const name of EXTENSIONS) {
+      if (
+        (await exists(path.join(ext, `php_${name}.dll`))) ||
+        (await exists(path.join(ext, `${name}.so`)))
+      )
+        lines.push(`extension=${name}`);
+    }
+  }
+  const ini = path.join(home, "php.ini");
+  await writeFile(ini, `${lines.join("\n")}\n`);
+  return ini;
+}
+
+function linuxArtifact(kind, arch) {
+  const cpu = arch === "arm64" ? "aarch64" : "x86_64";
+  if (kind === "php") {
+    const file = `php-${LINUX_PHP_VERSION}-fpm-linux-${cpu}.tar.gz`;
+    return {
+      version: LINUX_PHP_VERSION,
+      file,
+      url: `https://dl.static-php.dev/static-php-cli/gnu-bulk/${file}`,
+      sha256: LINUX_PHP_SHA256[cpu],
+    };
+  }
+  const caddyCpu = arch === "arm64" ? "arm64" : "amd64";
+  const file = `caddy_${CADDY_VERSION}_linux_${caddyCpu}.tar.gz`;
+  return {
+    version: CADDY_VERSION,
+    file,
+    url: `https://github.com/caddyserver/caddy/releases/download/v${CADDY_VERSION}/${file}`,
+    sha512: LINUX_CADDY_SHA512[caddyCpu],
+  };
+}
+
+export function toolArtifacts(platform = process.platform, arch = process.arch) {
+  if (platform === "win32" && arch === "x64")
+    return { sapi: "cgi", php: WINDOWS.php, caddy: WINDOWS.caddy };
+  if (platform === "linux" && (arch === "x64" || arch === "arm64"))
+    return {
+      sapi: "fpm",
+      php: linuxArtifact("php", arch),
+      caddy: linuxArtifact("caddy", arch),
+    };
+  throw Error(
+    "The panel installs PHP automatically on 64-bit Windows and Linux. Set PHP_CGI_BIN and CADDY_BIN on this host.",
+  );
+}
+
+function assertGlibc(platform) {
+  if (platform !== "linux") return;
+  if (
+    existsSync("/lib/ld-musl-x86_64.so.1") ||
+    existsSync("/lib/ld-musl-aarch64.so.1")
+  )
+    throw Error(
+      "The automatic PHP build needs a glibc Linux server such as Debian, Ubuntu, or RHEL. Set PHP_CGI_BIN and CADDY_BIN on Alpine.",
+    );
+}
+
+async function findFile(directory, names) {
+  const wanted = new Set(names);
+  const stack = [directory];
+  while (stack.length) {
+    const current = stack.pop();
+    for (const entry of await readdir(current, { withFileTypes: true })) {
+      if (entry.isSymbolicLink()) continue;
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) stack.push(full);
+      else if (wanted.has(entry.name)) return full;
+    }
+  }
+  return "";
+}
+
+async function markExecutable(file) {
+  if (process.platform === "win32" || !file) return;
+  await chmod(file, 0o755);
+}
+
+function configuredTools() {
+  const bin = process.env.PHP_CGI_BIN;
+  const fpm = /php-fpm(?:\.exe)?$/i.test(path.basename(bin));
+  return {
+    php: process.env.PHP_BIN || bin,
+    phpcgi: fpm ? undefined : bin,
+    fpm: fpm ? bin : undefined,
+    caddy: process.env.CADDY_BIN,
+    ini: process.env.PHP_INI || path.join(path.dirname(bin), "php.ini"),
+  };
+}
+
+export async function ensurePhpTools(
+  directory,
+  {
+    fetchImpl = fetch,
+    log = () => {},
+    platform = process.platform,
+    arch = process.arch,
+  } = {},
+) {
+  const configured =
+    process.env.PHP_CGI_BIN &&
+    process.env.CADDY_BIN &&
+    path.isAbsolute(process.env.PHP_CGI_BIN) &&
+    path.isAbsolute(process.env.CADDY_BIN) &&
+    (await exists(process.env.PHP_CGI_BIN)) &&
+    (await exists(process.env.CADDY_BIN));
+  if (configured) return configuredTools();
+  const artifacts = toolArtifacts(platform, arch);
+  assertGlibc(platform);
+  const key = path.resolve(directory);
+  if (!pending.has(key))
+    pending.set(
+      key,
+      (async () => {
+        const phpHome = await install(artifacts.php, directory, fetchImpl, log);
+        const caddyHome = await install(artifacts.caddy, directory, fetchImpl, log);
+        const ini = await writePhpIni(phpHome);
+        const fpm =
+          artifacts.sapi === "fpm" ? await findFile(phpHome, ["php-fpm"]) : "";
+        const cli =
+          artifacts.sapi === "fpm" ? await findFile(phpHome, ["php"]) : "";
+        const tools =
+          artifacts.sapi === "fpm"
+            ? {
+                php: cli || fpm,
+                fpm,
+                caddy: await findFile(caddyHome, ["caddy"]),
+                ini,
+              }
+            : {
+                php: path.join(phpHome, "php.exe"),
+                phpcgi: path.join(phpHome, "php-cgi.exe"),
+                caddy: path.join(caddyHome, "caddy.exe"),
+                ini,
+              };
+        for (const file of [tools.phpcgi || tools.fpm, tools.caddy]) {
+          if (!(await exists(file)))
+            throw Error(
+              `PHP setup did not produce ${path.basename(file || "binary")}`,
+            );
+          await markExecutable(file);
+        }
+        if (cli) await markExecutable(cli);
+        return tools;
+      })().finally(() => {
+        pending.delete(key);
+      }),
+    );
+  return pending.get(key);
+}