@pi-chamber/web 0.1.8

package/server/lib/ui-auth/ui-passkeys.js

@@ -0,0 +1,543 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import {
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  verifyAuthenticationResponse,
+  verifyRegistrationResponse,
+} from '@simplewebauthn/server';
+
+import { resolvePiChamberDataDir, resolvePiChamberDataPath } from '../pichamber-data-dir.js';
+
+const DEFAULT_STORE_VERSION = 1;
+const DEFAULT_CHALLENGE_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_RP_NAME = 'PiChamber';
+
+const PICHAMBER_DATA_DIR = resolvePiChamberDataDir();
+const PASSKEY_STORE_FILE = resolvePiChamberDataPath('ui-passkeys.json');
+
+const createUserId = () => crypto.randomBytes(32).toString('base64url');
+
+const decodeUserId = (value) => {
+  if (typeof value !== 'string' || !value) {
+    return null;
+  }
+
+  try {
+    return Uint8Array.from(Buffer.from(value, 'base64url'));
+  } catch {
+    return null;
+  }
+};
+
+const normalizeLabel = (value, fallback) => {
+  if (typeof value !== 'string') {
+    return fallback;
+  }
+  const normalized = value.trim().replace(/\s+/g, ' ');
+  return normalized ? normalized.slice(0, 120) : fallback;
+};
+
+const normalizeHost = (value) => {
+  if (typeof value !== 'string') {
+    return '';
+  }
+
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return '';
+  }
+
+  if (trimmed.startsWith('[')) {
+    const end = trimmed.indexOf(']');
+    return end >= 0 ? trimmed.slice(1, end).toLowerCase() : trimmed.toLowerCase();
+  }
+
+  const colonIndex = trimmed.indexOf(':');
+  return (colonIndex >= 0 ? trimmed.slice(0, colonIndex) : trimmed).toLowerCase();
+};
+
+const isLocalRpId = (rpID) => rpID === 'localhost' || rpID === '127.0.0.1' || rpID === '::1';
+
+const getCurrentRequestOrigin = (req) => {
+  const forwardedProto = typeof req.headers['x-forwarded-proto'] === 'string'
+    ? req.headers['x-forwarded-proto'].split(',')[0].trim().toLowerCase()
+    : '';
+  const protocol = forwardedProto || (req.socket?.encrypted ? 'https' : 'http');
+  const forwardedHost = typeof req.headers['x-forwarded-host'] === 'string'
+    ? req.headers['x-forwarded-host'].split(',')[0].trim()
+    : '';
+  const host = forwardedHost || (typeof req.headers.host === 'string' ? req.headers.host.trim() : '');
+
+  if (!host) {
+    return '';
+  }
+
+  return `${protocol}://${host}`;
+};
+
+const getCurrentRpId = (req) => {
+  const forwardedHost = typeof req.headers['x-forwarded-host'] === 'string'
+    ? req.headers['x-forwarded-host'].split(',')[0].trim()
+    : '';
+  const host = forwardedHost || (typeof req.headers.host === 'string' ? req.headers.host.trim() : '');
+  return normalizeHost(host || req.hostname || '');
+};
+
+const parseStoredPasskey = (record) => {
+  if (!record || typeof record !== 'object') {
+    return null;
+  }
+
+  if (typeof record.id !== 'string' || typeof record.publicKey !== 'string' || typeof record.rpID !== 'string') {
+    return null;
+  }
+
+  return {
+    id: record.id,
+    publicKey: record.publicKey,
+    counter: typeof record.counter === 'number' && Number.isFinite(record.counter) ? record.counter : 0,
+    transports: Array.isArray(record.transports)
+      ? record.transports.filter((value) => typeof value === 'string')
+      : [],
+    deviceType: typeof record.deviceType === 'string' ? record.deviceType : 'singleDevice',
+    backedUp: record.backedUp === true,
+    createdAt: typeof record.createdAt === 'number' ? record.createdAt : Date.now(),
+    lastUsedAt: typeof record.lastUsedAt === 'number' ? record.lastUsedAt : null,
+    label: normalizeLabel(record.label, 'Unnamed device'),
+    rpID: record.rpID,
+  };
+};
+
+export const createUiPasskeys = ({
+  passwordBinding,
+  readSettingsFromDiskMigrated,
+  storeFile = PASSKEY_STORE_FILE,
+  rpName = DEFAULT_RP_NAME,
+  challengeTtlMs = DEFAULT_CHALLENGE_TTL_MS,
+} = {}) => {
+  const registrationChallenges = new Map();
+  const authenticationChallenges = new Map();
+
+  const ensureStoreDirectory = () => {
+    fs.mkdirSync(path.dirname(storeFile), { recursive: true });
+  };
+
+  const persistStore = (store) => {
+    ensureStoreDirectory();
+    fs.writeFileSync(storeFile, JSON.stringify(store, null, 2));
+  };
+
+  const createEmptyStore = () => ({
+    version: DEFAULT_STORE_VERSION,
+    userID: createUserId(),
+    passwordBinding,
+    passkeys: [],
+  });
+
+  const loadStore = () => {
+    let store = createEmptyStore();
+
+    try {
+      if (fs.existsSync(storeFile)) {
+        const raw = fs.readFileSync(storeFile, 'utf8');
+        const parsed = JSON.parse(raw);
+        store = {
+          version: DEFAULT_STORE_VERSION,
+          userID: decodeUserId(parsed?.userID) ? parsed.userID : store.userID,
+          passwordBinding: typeof parsed?.passwordBinding === 'string' ? parsed.passwordBinding : '',
+          passkeys: Array.isArray(parsed?.passkeys) ? parsed.passkeys.map(parseStoredPasskey).filter(Boolean) : [],
+        };
+      }
+    } catch (error) {
+      console.warn('[UI Passkeys] Failed to read passkey store:', error?.message || error);
+    }
+
+    if (!passwordBinding) {
+      if (store.passkeys.length > 0 || store.passwordBinding) {
+        store = { ...store, passkeys: [], passwordBinding: '' };
+        persistStore(store);
+      }
+      return store;
+    }
+
+    if (store.passwordBinding !== passwordBinding) {
+        store = {
+          version: DEFAULT_STORE_VERSION,
+          userID: store.userID || createUserId(),
+          passwordBinding,
+          passkeys: [],
+        };
+      persistStore(store);
+      return store;
+    }
+
+    if (!fs.existsSync(storeFile)) {
+      persistStore(store);
+    }
+
+    return store;
+  };
+
+  const cleanupChallengeMap = (map) => {
+    const now = Date.now();
+    for (const [requestId, record] of map.entries()) {
+      if (!record || now >= record.expiresAt) {
+        map.delete(requestId);
+      }
+    }
+  };
+
+  const buildOriginCandidates = async (req) => {
+    const origins = new Set();
+    const currentOrigin = getCurrentRequestOrigin(req);
+    if (currentOrigin) {
+      origins.add(currentOrigin);
+    }
+
+    try {
+      const settings = await readSettingsFromDiskMigrated?.();
+      if (typeof settings?.publicOrigin === 'string' && settings.publicOrigin.trim().length > 0) {
+        origins.add(new URL(settings.publicOrigin.trim()).origin);
+      }
+    } catch {
+    }
+
+    return Array.from(origins);
+  };
+
+  const assertEnabled = () => {
+    if (!passwordBinding) {
+      const error = new Error('Passkeys require UI password protection to be enabled');
+      error.statusCode = 400;
+      throw error;
+    }
+  };
+
+  const getPasskeysForRpId = (store, rpID) => store.passkeys.filter((passkey) => passkey.rpID === rpID);
+
+  const getStatus = (req) => {
+    const store = loadStore();
+    const rpID = getCurrentRpId(req);
+    return {
+      enabled: Boolean(passwordBinding),
+      hasPasskeys: Boolean(rpID) && getPasskeysForRpId(store, rpID).length > 0,
+      passkeyCount: Boolean(rpID) ? getPasskeysForRpId(store, rpID).length : 0,
+      rpID,
+    };
+  };
+
+  const listPasskeys = (req) => {
+    assertEnabled();
+
+    const store = loadStore();
+    const rpID = getCurrentRpId(req);
+    if (!rpID) {
+      return [];
+    }
+
+    return getPasskeysForRpId(store, rpID).map((passkey) => ({
+      id: passkey.id,
+      label: passkey.label,
+      createdAt: passkey.createdAt,
+      lastUsedAt: passkey.lastUsedAt,
+      deviceType: passkey.deviceType,
+      backedUp: passkey.backedUp,
+    }));
+  };
+
+  const revokePasskey = (req, passkeyId) => {
+    assertEnabled();
+
+    const normalizedPasskeyId = typeof passkeyId === 'string' ? passkeyId.trim() : '';
+    if (!normalizedPasskeyId) {
+      const error = new Error('Passkey ID is required');
+      error.statusCode = 400;
+      throw error;
+    }
+
+    const store = loadStore();
+    const rpID = getCurrentRpId(req);
+    const existingPasskey = store.passkeys.find((passkey) => passkey.id === normalizedPasskeyId && passkey.rpID === rpID);
+
+    if (!existingPasskey) {
+      const error = new Error('Passkey not found for this host');
+      error.statusCode = 404;
+      throw error;
+    }
+
+    const nextPasskeys = store.passkeys.filter((passkey) => !(passkey.id === normalizedPasskeyId && passkey.rpID === rpID));
+    persistStore({
+      ...store,
+      passwordBinding,
+      passkeys: nextPasskeys,
+    });
+
+    return {
+      revoked: true,
+      passkeyCount: nextPasskeys.filter((passkey) => passkey.rpID === rpID).length,
+    };
+  };
+
+  const clearAllPasskeys = () => {
+    assertEnabled();
+
+    const store = loadStore();
+    const clearedCount = store.passkeys.length;
+    persistStore({
+      ...store,
+      userID: crypto.randomBytes(32).toString('base64url'),
+      passwordBinding,
+      passkeys: [],
+    });
+
+    return {
+      cleared: true,
+      clearedCount,
+    };
+  };
+
+  const beginRegistration = async (req, { label } = {}) => {
+    assertEnabled();
+    cleanupChallengeMap(registrationChallenges);
+
+    const rpID = getCurrentRpId(req);
+    if (!rpID) {
+      const error = new Error('Unable to resolve a valid passkey host for this request');
+      error.statusCode = 400;
+      throw error;
+    }
+
+    const currentOrigin = getCurrentRequestOrigin(req);
+    if (!currentOrigin) {
+      const error = new Error('Unable to resolve a valid passkey origin for this request');
+      error.statusCode = 400;
+      throw error;
+    }
+
+    const store = loadStore();
+    const userID = decodeUserId(store.userID);
+    if (!userID) {
+      const error = new Error('Passkey storage is invalid. Please try again.');
+      error.statusCode = 500;
+      throw error;
+    }
+
+    const options = await generateRegistrationOptions({
+      rpName,
+      rpID,
+      userID,
+      userName: 'pichamber-ui',
+      userDisplayName: 'PiChamber UI',
+      attestationType: 'none',
+      excludeCredentials: getPasskeysForRpId(store, rpID).map((passkey) => ({
+        id: passkey.id,
+        transports: passkey.transports,
+      })),
+      authenticatorSelection: {
+        residentKey: 'required',
+        userVerification: 'required',
+      },
+    });
+
+    const requestId = crypto.randomBytes(16).toString('base64url');
+    registrationChallenges.set(requestId, {
+      challenge: options.challenge,
+      expectedOrigins: await buildOriginCandidates(req),
+      expectedRPIDs: [rpID],
+      rpID,
+      label: normalizeLabel(label, 'This device'),
+      createdAt: Date.now(),
+      expiresAt: Date.now() + challengeTtlMs,
+    });
+
+    return {
+      requestId,
+      optionsJSON: options,
+    };
+  };
+
+  const finishRegistration = async (payload) => {
+    assertEnabled();
+    cleanupChallengeMap(registrationChallenges);
+
+    const store = loadStore();
+    const requestId = typeof payload?.requestId === 'string' ? payload.requestId : '';
+    const response = payload?.response;
+
+    const matchingRecord = requestId ? registrationChallenges.get(requestId) : null;
+    if (!matchingRecord) {
+      const error = new Error('Passkey setup has expired. Please try again.');
+      error.statusCode = 400;
+      throw error;
+    }
+
+    registrationChallenges.delete(requestId);
+
+    const verification = await verifyRegistrationResponse({
+      response,
+      expectedChallenge: matchingRecord.challenge,
+      expectedOrigin: matchingRecord.expectedOrigins,
+      expectedRPID: matchingRecord.expectedRPIDs,
+      requireUserVerification: true,
+    });
+
+    if (!verification.verified || !verification.registrationInfo) {
+      const error = new Error('Passkey registration could not be verified');
+      error.statusCode = 400;
+      throw error;
+    }
+
+    const {
+      credential,
+      credentialDeviceType,
+      credentialBackedUp,
+    } = verification.registrationInfo;
+
+    const nextPasskeys = store.passkeys.filter((passkey) => passkey.id !== credential.id);
+    nextPasskeys.push({
+      id: credential.id,
+      publicKey: Buffer.from(credential.publicKey).toString('base64url'),
+      counter: credential.counter,
+      transports: Array.isArray(credential.transports) ? credential.transports.filter((value) => typeof value === 'string') : [],
+      deviceType: credentialDeviceType,
+      backedUp: credentialBackedUp,
+      createdAt: Date.now(),
+      lastUsedAt: null,
+      label: matchingRecord.label,
+      rpID: matchingRecord.rpID,
+    });
+
+    persistStore({
+      ...store,
+      passwordBinding,
+      passkeys: nextPasskeys,
+    });
+
+    return {
+      verified: true,
+      passkeyCount: nextPasskeys.filter((passkey) => passkey.rpID === matchingRecord.rpID).length,
+    };
+  };
+
+  const beginAuthentication = async (req) => {
+    assertEnabled();
+    cleanupChallengeMap(authenticationChallenges);
+
+    const store = loadStore();
+    const rpID = getCurrentRpId(req);
+    const passkeys = getPasskeysForRpId(store, rpID);
+
+    if (!rpID || passkeys.length === 0) {
+      const error = new Error('No passkeys are registered for this host yet');
+      error.statusCode = 404;
+      throw error;
+    }
+
+    const options = await generateAuthenticationOptions({
+      rpID,
+      userVerification: 'required',
+      allowCredentials: passkeys.map((passkey) => ({
+        id: passkey.id,
+        transports: passkey.transports,
+      })),
+    });
+
+    const requestId = crypto.randomBytes(16).toString('base64url');
+    authenticationChallenges.set(requestId, {
+      challenge: options.challenge,
+      expectedOrigins: await buildOriginCandidates(req),
+      expectedRPIDs: [rpID],
+      createdAt: Date.now(),
+      expiresAt: Date.now() + challengeTtlMs,
+    });
+
+    return {
+      requestId,
+      optionsJSON: options,
+    };
+  };
+
+  const finishAuthentication = async (payload) => {
+    assertEnabled();
+    cleanupChallengeMap(authenticationChallenges);
+
+    const requestId = typeof payload?.requestId === 'string' ? payload.requestId : '';
+    const response = payload?.response;
+    const store = loadStore();
+    const passkey = store.passkeys.find((item) => item.id === response?.id);
+
+    if (!passkey) {
+      const error = new Error('That passkey is not registered for this PiChamber instance');
+      error.statusCode = 404;
+      throw error;
+    }
+
+    const matchingRecord = requestId ? authenticationChallenges.get(requestId) : null;
+    if (!matchingRecord) {
+      const error = new Error('Passkey sign-in has expired. Please try again.');
+      error.statusCode = 400;
+      throw error;
+    }
+
+    authenticationChallenges.delete(requestId);
+
+    const verification = await verifyAuthenticationResponse({
+      response,
+      expectedChallenge: matchingRecord.challenge,
+      expectedOrigin: matchingRecord.expectedOrigins,
+      expectedRPID: matchingRecord.expectedRPIDs,
+      credential: {
+        id: passkey.id,
+        publicKey: Buffer.from(passkey.publicKey, 'base64url'),
+        counter: passkey.counter,
+        transports: passkey.transports,
+      },
+      requireUserVerification: true,
+    });
+
+    if (!verification.verified || !verification.authenticationInfo) {
+      const error = new Error('Passkey sign-in could not be verified');
+      error.statusCode = 400;
+      throw error;
+    }
+
+    const nextPasskeys = store.passkeys.map((item) => (
+      item.id === passkey.id
+        ? {
+            ...item,
+            counter: verification.authenticationInfo.newCounter,
+            lastUsedAt: Date.now(),
+          }
+        : item
+    ));
+
+    persistStore({
+      ...store,
+      passwordBinding,
+      passkeys: nextPasskeys,
+    });
+
+    return { verified: true };
+  };
+
+  const dispose = () => {
+    registrationChallenges.clear();
+    authenticationChallenges.clear();
+  };
+
+  return {
+    enabled: Boolean(passwordBinding),
+    getStatus,
+    listPasskeys,
+    revokePasskey,
+    clearAllPasskeys,
+    beginRegistration,
+    finishRegistration,
+    beginAuthentication,
+    finishAuthentication,
+    dispose,
+    isLocalRpId,
+  };
+};

package/server/lib/workspace/host.js

@@ -0,0 +1,91 @@
+import crypto from 'node:crypto';
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createProxyMiddleware, responseInterceptor } from 'http-proxy-middleware';
+import { registerFsRoutes } from '../fs/routes.js';
+import { registerGitRoutes } from '../git/routes.js';
+import { createPreviewProxyRuntime } from '../preview/proxy-runtime.js';
+import { createRequestSecurityRuntime } from '../security/request-security.js';
+import { mergePathValues } from '../server/path-utils.js';
+import { createTerminalRuntime } from '../terminal/runtime.js';
+import { getExecutableSearchDirectories } from '../tunnels/executable-search.js';
+
+const normalizeDirectoryPath = (value) => (typeof value === 'string' ? path.resolve(value.trim()) : '');
+
+const buildAugmentedPath = () => mergePathValues(process.env.PATH || '', process.env.Path || '', path.delimiter);
+
+const searchPathFor = (name) => {
+  for (const directory of getExecutableSearchDirectories()) {
+    const candidate = path.join(directory, name);
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  return name;
+};
+
+const isExecutable = (filePath) => {
+  try {
+    fs.accessSync(filePath, fs.constants.X_OK);
+    return true;
+  } catch {
+    return fs.existsSync(filePath);
+  }
+};
+
+const resolveProjectDirectory = async (req) => {
+  const header = typeof req.get === 'function' ? req.get('x-opencode-directory') || req.get('x-pichamber-directory') : null;
+  const query = Array.isArray(req.query?.directory) ? req.query.directory[0] : req.query?.directory;
+  const requested = typeof query === 'string' && query.trim() ? query.trim() : (typeof header === 'string' ? header.trim() : '');
+  if (!requested) return { directory: process.cwd(), error: null };
+  try {
+    const resolved = path.resolve(requested);
+    const stats = await fs.promises.stat(resolved);
+    if (!stats.isDirectory()) return { directory: null, error: 'Specified path is not a directory' };
+    return { directory: await fs.promises.realpath(resolved), error: null };
+  } catch {
+    return { directory: null, error: 'Directory not found' };
+  }
+};
+
+export const registerWorkspaceIntegrations = ({ app, server, express, uiAuthController }) => {
+  const security = createRequestSecurityRuntime({ readSettingsFromDiskMigrated: async () => ({}) });
+  registerGitRoutes(app);
+  registerFsRoutes(app, {
+    os,
+    path,
+    fsPromises: fs.promises,
+    spawn,
+    crypto,
+    normalizeDirectoryPath,
+    resolveProjectDirectory,
+    buildAugmentedPath,
+    resolveGitBinaryForSpawn: () => searchPathFor(process.platform === 'win32' ? 'git.exe' : 'git'),
+    pichamberUserConfigRoot: path.join(os.homedir(), '.config'),
+  });
+  createTerminalRuntime({
+    app,
+    server,
+    express,
+    fs,
+    path,
+    uiAuthController,
+    buildAugmentedPath,
+    searchPathFor,
+    isExecutable,
+    isRequestOriginAllowed: security.isRequestOriginAllowed,
+    rejectWebSocketUpgrade: security.rejectWebSocketUpgrade,
+  });
+  createPreviewProxyRuntime({
+    crypto,
+    URL,
+    createProxyMiddleware,
+    responseInterceptor,
+  }).attach(app, {
+    server,
+    express,
+    uiAuthController,
+    isRequestOriginAllowed: security.isRequestOriginAllowed,
+    rejectWebSocketUpgrade: security.rejectWebSocketUpgrade,
+  });
+};