@opentig/cli 0.2.3 → 0.2.4

package/dist/chunks/network-settings-CdFeKFRB.mjs

@@ -0,0 +1,142 @@
+import { chmod, mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { isIP } from "node:net";
+//#region ../../src/shared/redaction.ts
+/** Removes credential-shaped values before text reaches logs or clients. */
+function redactSensitiveText(value) {
+	return value.replace(/\b(?:github_pat_|gh[opusr]_)[A-Za-z0-9_]{16,}/g, "[redacted]").replace(/\bauthorization\s*[:=]\s*(?:bearer|basic)\s+[^\s,;]+/gi, "authorization=[redacted]").replace(/\b(authorization|cookie|set-cookie)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/\b(token|secret|password)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/https?:\/\/[^\s"'<>]+/gi, (candidate) => redactUrl(candidate));
+}
+function redactUrl(candidate) {
+	try {
+		const url = new URL(candidate);
+		if (url.username || url.password) {
+			url.username = "[redacted]";
+			url.password = "";
+		}
+		url.search = "";
+		url.hash = "";
+		return url.toString();
+	} catch {
+		return "[redacted-url]";
+	}
+}
+//#endregion
+//#region ../../src/main/persistence/atomicWrite.ts
+function backupPathFor(filePath) {
+	return `${filePath}.bak`;
+}
+async function writeFileAtomically(filePath, contents, options = {}) {
+	if (options.parseJson) JSON.parse(contents);
+	const directory = path.dirname(filePath);
+	await mkdir(directory, {
+		recursive: true,
+		...options.directoryMode === void 0 ? {} : { mode: options.directoryMode }
+	});
+	const temporary = `${filePath}.${randomUUID()}.tmp`;
+	try {
+		const handle = await open(temporary, "wx", 384);
+		try {
+			await handle.writeFile(contents, "utf8");
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		await rename(temporary, filePath);
+		await chmod(filePath, 384);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+//#endregion
+//#region ../../src/shared/web-access.ts
+/** An address for link construction only, never an authentication allowlist. */
+function normalizePairingOrigin(value) {
+	const input = value.trim();
+	if (!input || input.length > 2048 || /[\s\\]/.test(input) || !/^https?:\/\/[^/?#]+\/?$/i.test(input)) throw new Error("Enter an HTTP or HTTPS address without a path, query, fragment, or credentials.");
+	const url = new URL(input);
+	if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw new Error("Enter an HTTP or HTTPS address without a path, query, fragment, or credentials.");
+	return url.origin;
+}
+//#endregion
+//#region src/network-settings.ts
+/** Shared by startup and preflight so saved settings have identical precedence. */
+async function loadStartupNetwork(config) {
+	const desktop = config.mode !== "web-access";
+	const networkSettings = new NetworkSettings(config.networkSettingsPath ?? (desktop ? path.join(path.dirname(config.settingsPath), "desktop-server.json") : path.join(config.serverDataPath ?? path.dirname(config.settingsPath), "web-access.json")), desktop);
+	return {
+		networkSettings,
+		network: await networkSettings.load({
+			webAccessEnabled: config.browserAccessEnabled ?? config.mode === "web-access",
+			lanAccessEnabled: !isLoopbackHost(config.host ?? "127.0.0.1"),
+			publicOrigin: null,
+			listenerHost: config.host ?? "127.0.0.1",
+			listenerPort: config.port ?? 6767
+		}),
+		savedListener: networkSettings.hasSavedListener
+	};
+}
+function applyNetworkPatch(previous, input) {
+	if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("Invalid web access settings.");
+	const patch = input;
+	if (Object.keys(patch).some((key) => ![
+		"webAccessEnabled",
+		"lanAccessEnabled",
+		"publicOrigin",
+		"listenerHost",
+		"listenerPort"
+	].includes(key))) throw new Error("Unknown web access setting.");
+	for (const key of ["webAccessEnabled", "lanAccessEnabled"]) if (patch[key] !== void 0 && typeof patch[key] !== "boolean") throw new Error("Invalid access switch.");
+	if (patch.listenerHost !== void 0 && (typeof patch.listenerHost !== "string" || !isIP(patch.listenerHost))) throw new Error("Enter an IPv4 or IPv6 listening address.");
+	if (patch.listenerPort !== void 0 && (!Number.isInteger(patch.listenerPort) || patch.listenerPort < 1 || patch.listenerPort > 65535)) throw new Error("Enter a port between 1 and 65535.");
+	if (patch.publicOrigin !== void 0 && patch.publicOrigin !== null && typeof patch.publicOrigin !== "string") throw new Error("Invalid pairing domain.");
+	const next = {
+		...previous,
+		...patch
+	};
+	if (patch.publicOrigin !== void 0) next.publicOrigin = patch.publicOrigin ? normalizePairingOrigin(patch.publicOrigin) : null;
+	if (patch.lanAccessEnabled !== void 0 && patch.listenerHost === void 0) next.listenerHost = patch.lanAccessEnabled ? "0.0.0.0" : "127.0.0.1";
+	next.lanAccessEnabled = !isLoopbackHost(next.listenerHost);
+	return next;
+}
+function isLoopbackHost(host) {
+	return host === "::1" || host.startsWith("127.") || host.startsWith("::ffff:127.");
+}
+/** Desktop v4 remains readable; CLI settings are isolated in its private home. */
+var NetworkSettings = class {
+	filePath;
+	desktop;
+	hasSavedListener = false;
+	constructor(filePath, desktop = false) {
+		this.filePath = filePath;
+		this.desktop = desktop;
+	}
+	async load(defaults) {
+		this.hasSavedListener = false;
+		let value;
+		try {
+			value = JSON.parse(await readFile(this.filePath, "utf8"));
+		} catch (error) {
+			if (error.code === "ENOENT") return defaults;
+			throw new Error("Could not read web access settings. Reset access locally before restarting.", { cause: error });
+		}
+		if (!value || value.version !== (this.desktop ? 4 : 1)) throw new Error("Invalid web access settings version.");
+		const { version: _version, ...patch } = value;
+		this.hasSavedListener = patch.listenerHost !== void 0 || patch.listenerPort !== void 0 || patch.lanAccessEnabled !== void 0;
+		const config = applyNetworkPatch(defaults, patch);
+		if (this.desktop && patch.listenerHost === void 0 && !config.webAccessEnabled) config.listenerHost = defaults.listenerHost;
+		return config;
+	}
+	save(config) {
+		return writeFileAtomically(this.filePath, `${JSON.stringify({
+			version: this.desktop ? 4 : 1,
+			...config
+		}, null, 2)}\n`, {
+			parseJson: true,
+			directoryMode: 448
+		});
+	}
+};
+//#endregion
+export { normalizePairingOrigin as a, redactSensitiveText as c, loadStartupNetwork as i, applyNetworkPatch as n, backupPathFor as o, isLoopbackHost as r, writeFileAtomically as s, NetworkSettings as t };