@pi-in-go/pigpen-ahp 0.1.0

package/extensions/ahp/internal/settings/access_test.go

@@ -0,0 +1,52 @@
+package settings
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+// Additions: the capability keys are the port's own (upstream has a bare port/token/host file).
+
+func writeSettings(t *testing.T, body string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "settings.json")
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func TestAccessDefaultsToNothing(t *testing.T) {
+	// a freshly created file (port and token only) grants no capability
+	path := filepath.Join(t.TempDir(), "ahp", "settings.json")
+	if _, err := LoadDirect(path); err != nil {
+		t.Fatal(err)
+	}
+	a, err := LoadAccess(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a.Filesystem.Enabled || a.Terminals.Enabled || a.AllowSessionDeletion || len(a.AllowedOrigins) != 0 {
+		t.Fatalf("%+v", a)
+	}
+}
+
+func TestAccessReadsCapabilities(t *testing.T) {
+	a, err := LoadAccess(writeSettings(t, `{"port": 1, "allowedOrigins": ["https://vscode.dev"], "filesystem": {"enabled": true, "roots": ["/work"]}, "terminals": {"enabled": true}, "allowSessionDeletion": true}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !a.Filesystem.Enabled || !reflect.DeepEqual(a.Filesystem.Roots, []string{"/work"}) || a.Filesystem.Unrestricted || !a.Terminals.Enabled || !a.AllowSessionDeletion || !reflect.DeepEqual(a.AllowedOrigins, []string{"https://vscode.dev"}) {
+		t.Fatalf("%+v", a)
+	}
+}
+
+func TestAccessRejectsWrongTypes(t *testing.T) {
+	for _, body := range []string{`{"filesystem": true}`, `{"terminals": {"enabled": "yes"}}`, `{"allowedOrigins": "x"}`, `{"filesystem": {"roots": "/work"}}`} {
+		if _, err := LoadAccess(writeSettings(t, body)); err == nil {
+			t.Errorf("%s must be refused", body)
+		}
+	}
+}

package/extensions/ahp/internal/settings/settings.go

@@ -0,0 +1,117 @@
+// Package settings reads and writes the listener settings file (port of pi-ahp's
+// src/host/direct-settings.ts).
+//
+// Unlike the standalone upstream server, this extension never opens a listener on its own: the
+// file is only loaded (and, if absent, created) after the user explicitly asked for one.
+package settings
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"math"
+	"net"
+	"os"
+	"path/filepath"
+)
+
+// DefaultHost is where the listener binds unless told otherwise: loopback only.
+const DefaultHost = "127.0.0.1"
+
+// Direct is the endpoint configuration of the direct listener.
+type Direct struct {
+	Port  int     `json:"port"`
+	Token *string `json:"token"`
+	Host  string  `json:"host"`
+}
+
+// Error is a problem with the settings file, naming the file.
+type Error struct{ Path, Detail string }
+
+func (e *Error) Error() string { return e.Path + ": " + e.Detail }
+
+func freePort() (int, error) {
+	l, err := net.Listen("tcp", net.JoinHostPort(DefaultHost, "0"))
+	if err != nil {
+		return 0, err
+	}
+	defer l.Close()
+	return l.Addr().(*net.TCPAddr).Port, nil
+}
+
+func newToken() (string, error) {
+	var b [32]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(b[:]), nil
+}
+
+// LoadDirect reads the settings at path. A missing file is created with a free loopback port and
+// a fresh token (only a missing file mints a token); an existing file is taken literally, with
+// only the optional fields defaulted, and a malformed one is an error rather than an invitation
+// to invent replacements.
+func LoadDirect(path string) (Direct, error) {
+	raw, err := os.ReadFile(path)
+	if os.IsNotExist(err) {
+		port, err := freePort()
+		if err != nil {
+			return Direct{}, err
+		}
+		token, err := newToken()
+		if err != nil {
+			return Direct{}, err
+		}
+		settings := Direct{Port: port, Token: &token, Host: DefaultHost}
+		return settings, write(settings, path)
+	}
+	if err != nil {
+		return Direct{}, err
+	}
+
+	var stored map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &stored); err != nil || stored == nil {
+		detail := "not an object"
+		if err != nil {
+			detail = err.Error()
+		}
+		return Direct{}, &Error{path, fmt.Sprintf("not valid JSON (%s)", detail)}
+	}
+	rawPort, hasPort := stored["port"]
+	if !hasPort {
+		return Direct{}, &Error{path, "no `port`. Set one, or delete the file to have it chosen."}
+	}
+	var portValue float64
+	if err := json.Unmarshal(rawPort, &portValue); err != nil || portValue != math.Trunc(portValue) || portValue < 1 || portValue > 65535 {
+		return Direct{}, &Error{path, fmt.Sprintf("`port` must be an integer 1-65535, got %s", rawPort)}
+	}
+	out := Direct{Port: int(portValue), Host: DefaultHost}
+	if rawToken, ok := stored["token"]; ok && string(rawToken) != "null" {
+		var token string
+		if err := json.Unmarshal(rawToken, &token); err != nil {
+			return Direct{}, &Error{path, fmt.Sprintf("`token` must be a string or null, got %s", rawToken)}
+		}
+		out.Token = &token // absent means absent
+	}
+	if rawHost, ok := stored["host"]; ok {
+		var host string
+		if err := json.Unmarshal(rawHost, &host); err != nil {
+			return Direct{}, &Error{path, fmt.Sprintf("`host` must be a string, got %s", rawHost)}
+		}
+		out.Host = host
+	}
+	return out, nil
+}
+
+func write(s Direct, path string) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return err
+	}
+	raw, err := json.MarshalIndent(s, "", "  ")
+	if err != nil {
+		return err
+	}
+	// Owner-only: the token is a bearer credential for the endpoint.
+	return os.WriteFile(path, append(raw, '\n'), 0o600)
+}

package/extensions/ahp/internal/settings/settings_test.go

@@ -0,0 +1,104 @@
+package settings_test
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"regexp"
+	"runtime"
+	"testing"
+
+	"github.com/MichaelKinsy/pigpen/ahp/internal/settings"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/twin"
+)
+
+// Twins of upstream test/direct-settings.test.ts.
+
+func fixture(t *testing.T) (path string, write func(any)) {
+	path = filepath.Join(t.TempDir(), "nested", "settings.json")
+	return path, func(v any) {
+		t.Helper()
+		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		var raw []byte
+		if s, ok := v.(string); ok {
+			raw = []byte(s)
+		} else {
+			raw, _ = json.Marshal(v)
+		}
+		if err := os.WriteFile(path, raw, 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestDirectListenerSettings(t *testing.T) {
+	twin.Run(t, "direct-settings", "creates a private, reusable endpoint configuration on first use", func(t *testing.T) {
+		path, _ := fixture(t)
+		s, err := settings.LoadDirect(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if s.Host != "127.0.0.1" || s.Port < 1 || s.Port > 65535 {
+			t.Fatalf("settings = %+v", s)
+		}
+		if s.Token == nil || !regexp.MustCompile(`^[A-Za-z0-9_-]{43}$`).MatchString(*s.Token) {
+			t.Fatalf("token = %v", s.Token)
+		}
+		raw, _ := os.ReadFile(path)
+		var onDisk settings.Direct
+		if err := json.Unmarshal(raw, &onDisk); err != nil || !reflect.DeepEqual(onDisk, s) {
+			t.Fatalf("on disk %+v (%v), returned %+v", onDisk, err, s)
+		}
+		if runtime.GOOS != "windows" {
+			if info, _ := os.Stat(path); info.Mode().Perm() != 0o600 {
+				t.Fatalf("mode = %v; the token is a bearer credential", info.Mode().Perm())
+			}
+		}
+		again, err := settings.LoadDirect(path)
+		if err != nil || !reflect.DeepEqual(again, s) {
+			t.Fatalf("second load %+v (%v)", again, err)
+		}
+	})
+
+	twin.Run(t, "direct-settings", "takes an existing file literally and defaults only optional fields", func(t *testing.T) {
+		path, write := fixture(t)
+		write(map[string]any{"port": 12345})
+		got, err := settings.LoadDirect(path)
+		if err != nil || got.Port != 12345 || got.Token != nil || got.Host != "127.0.0.1" {
+			t.Fatalf("got %+v (%v)", got, err)
+		}
+		write(map[string]any{"port": 23456, "token": nil, "host": "0.0.0.0"})
+		got, err = settings.LoadDirect(path)
+		if err != nil || got.Port != 23456 || got.Token != nil || got.Host != "0.0.0.0" {
+			t.Fatalf("got %+v (%v)", got, err)
+		}
+	})
+
+	twin.Run(t, "direct-settings", "rejects malformed or incomplete files instead of inventing replacements", func(t *testing.T) {
+		path, write := fixture(t)
+		cases := []struct {
+			value   any
+			message string
+		}{
+			{"not json", `not valid JSON`},
+			{map[string]any{}, "no `port`"},
+			{map[string]any{"port": 0}, `integer 1-65535`},
+			{map[string]any{"port": 65536}, `integer 1-65535`},
+			{map[string]any{"port": 1.5}, `integer 1-65535`},
+			{map[string]any{"port": 12345, "token": 42}, `string or null`},
+			{map[string]any{"port": 12345, "host": 42}, `host.*string`},
+		}
+		for _, c := range cases {
+			write(c.value)
+			_, err := settings.LoadDirect(path)
+			var se *settings.Error
+			if !errors.As(err, &se) || !regexp.MustCompile(c.message).MatchString(se.Error()) {
+				t.Fatalf("%v: err = %v, want /%s/", c.value, err, c.message)
+			}
+		}
+	})
+}

package/extensions/ahp/internal/svc/etag_other.go

@@ -0,0 +1,15 @@
+//go:build !unix
+
+package svc
+
+import (
+	"fmt"
+	"os"
+	"time"
+)
+
+func etagOf(info os.FileInfo) string {
+	return fmt.Sprintf("0-0-%d-%d", info.Size(), info.ModTime().UnixNano())
+}
+
+func ctimeOf(info os.FileInfo) time.Time { return info.ModTime() }

package/extensions/ahp/internal/svc/etag_unix.go

@@ -0,0 +1,34 @@
+//go:build unix
+
+package svc
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"syscall"
+	"time"
+)
+
+func msOf(sec, nsec int64) string {
+	return strconv.FormatFloat(float64(sec)*1e3+float64(nsec)/1e6, 'f', -1, 64)
+}
+
+// etagOf is an opaque change token: device, inode, size and both timestamps, so a write, a
+// replacement or a metadata change all invalidate it.
+func etagOf(info os.FileInfo) string {
+	if st, ok := info.Sys().(*syscall.Stat_t); ok {
+		mt, ct := statTimes(st)
+		return fmt.Sprintf("%d-%d-%d-%s-%s", st.Dev, st.Ino, st.Size, msOf(mt[0], mt[1]), msOf(ct[0], ct[1]))
+	}
+	return fmt.Sprintf("0-0-%d-%d", info.Size(), info.ModTime().UnixNano())
+}
+
+// ctimeOf is the inode change time (the birth time is not portable).
+func ctimeOf(info os.FileInfo) time.Time {
+	if st, ok := info.Sys().(*syscall.Stat_t); ok {
+		_, ct := statTimes(st)
+		return time.Unix(ct[0], ct[1])
+	}
+	return info.ModTime()
+}

package/extensions/ahp/internal/svc/glob.go

@@ -0,0 +1,197 @@
+package svc
+
+import "strings"
+
+// matchesGlob reports whether a slash-separated relative path matches a glob pattern with the
+// semantics of Node's path.matchesGlob (minimatch): `*` and `?` stay inside one segment, `**`
+// spans whole segments, `[...]` is a character class, `{a,b}` alternates, and wildcards never
+// match a segment starting with a dot unless the pattern names the dot itself. A trailing `**`
+// needs at least one segment (so `a/**` does not match `a`).
+func matchesGlob(path, pattern string) bool {
+	segments := strings.Split(path, "/")
+	for _, alt := range expandBraces(pattern) {
+		if matchSegments(strings.Split(alt, "/"), segments) {
+			return true
+		}
+	}
+	return false
+}
+
+func expandBraces(pattern string) []string {
+	open := -1
+	depth := 0
+	for i := 0; i < len(pattern); i++ {
+		switch pattern[i] {
+		case '\\':
+			i++
+		case '{':
+			if depth == 0 {
+				open = i
+			}
+			depth++
+		case '}':
+			if depth == 0 {
+				continue
+			}
+			depth--
+			if depth == 0 {
+				body := pattern[open+1 : i]
+				var parts []string
+				level, start := 0, 0
+				for j := 0; j < len(body); j++ {
+					switch body[j] {
+					case '\\':
+						j++
+					case '{':
+						level++
+					case '}':
+						level--
+					case ',':
+						if level == 0 {
+							parts = append(parts, body[start:j])
+							start = j + 1
+						}
+					}
+				}
+				parts = append(parts, body[start:])
+				if len(parts) == 1 {
+					// {a} is literal in minimatch, like a brace without a comma.
+					return []string{pattern}
+				}
+				var out []string
+				for _, p := range parts {
+					out = append(out, expandBraces(pattern[:open]+p+pattern[i+1:])...)
+				}
+				return out
+			}
+		}
+	}
+	return []string{pattern}
+}
+
+func matchSegments(pattern, path []string) bool {
+	if len(pattern) == 0 {
+		return len(path) == 0
+	}
+	if pattern[0] == "**" {
+		if len(pattern) == 1 {
+			if len(path) == 0 {
+				return false
+			}
+			for _, s := range path {
+				if strings.HasPrefix(s, ".") {
+					return false
+				}
+			}
+			return true
+		}
+		for skip := 0; skip <= len(path); skip++ {
+			if matchSegments(pattern[1:], path[skip:]) {
+				return true
+			}
+			if skip < len(path) && strings.HasPrefix(path[skip], ".") {
+				break // ** never swallows a dot segment
+			}
+		}
+		return false
+	}
+	if len(path) == 0 {
+		return false
+	}
+	if strings.HasPrefix(path[0], ".") && !strings.HasPrefix(pattern[0], ".") {
+		return false
+	}
+	return matchSegment(pattern[0], path[0]) && matchSegments(pattern[1:], path[1:])
+}
+
+func matchSegment(pattern, name string) bool {
+	return matchRunes([]rune(pattern), []rune(name))
+}
+
+func matchRunes(p, s []rune) bool {
+	for len(p) > 0 {
+		switch p[0] {
+		case '*':
+			for len(p) > 0 && p[0] == '*' {
+				p = p[1:]
+			}
+			if len(p) == 0 {
+				return true
+			}
+			for i := 0; i <= len(s); i++ {
+				if matchRunes(p, s[i:]) {
+					return true
+				}
+			}
+			return false
+		case '?':
+			if len(s) == 0 {
+				return false
+			}
+			p, s = p[1:], s[1:]
+		case '[':
+			if len(s) == 0 {
+				return false
+			}
+			ok, rest, valid := matchClass(p, s[0])
+			if !valid {
+				// An unterminated class is a literal '['.
+				if s[0] != '[' {
+					return false
+				}
+				p, s = p[1:], s[1:]
+				continue
+			}
+			if !ok {
+				return false
+			}
+			p, s = rest, s[1:]
+		case '\\':
+			if len(p) > 1 {
+				p = p[1:]
+			}
+			fallthrough
+		default:
+			if len(s) == 0 || s[0] != p[0] {
+				return false
+			}
+			p, s = p[1:], s[1:]
+		}
+	}
+	return len(s) == 0
+}
+
+// matchClass matches r against the class at the start of p; valid is false when it never closes.
+func matchClass(p []rune, r rune) (ok bool, rest []rune, valid bool) {
+	i := 1
+	negate := false
+	if i < len(p) && (p[i] == '!' || p[i] == '^') {
+		negate = true
+		i++
+	}
+	first := true
+	matched := false
+	for ; i < len(p); i++ {
+		if p[i] == ']' && !first {
+			return matched != negate, p[i+1:], true
+		}
+		first = false
+		lo := p[i]
+		if p[i] == '\\' && i+1 < len(p) {
+			i++
+			lo = p[i]
+		}
+		if i+2 < len(p) && p[i+1] == '-' && p[i+2] != ']' {
+			hi := p[i+2]
+			if lo <= r && r <= hi {
+				matched = true
+			}
+			i += 2
+			continue
+		}
+		if r == lo {
+			matched = true
+		}
+	}
+	return false, nil, false
+}

package/extensions/ahp/internal/svc/mime.go

@@ -0,0 +1,37 @@
+package svc
+
+import (
+	"path/filepath"
+	"strings"
+)
+
+// mimeTypes is the subset of the `mime` npm package's table (mime-db) that matters for source
+// trees: the same answers for the extensions people actually open. An extension that is not here
+// has no content type (text files fall back to text/plain at the call site).
+var mimeTypes = map[string]string{
+	"txt": "text/plain", "text": "text/plain", "log": "text/plain", "conf": "text/plain", "ini": "text/plain",
+	"md": "text/markdown", "markdown": "text/markdown", "html": "text/html", "htm": "text/html", "css": "text/css",
+	"csv": "text/csv", "tsv": "text/tab-separated-values", "xml": "application/xml", "json": "application/json",
+	"map": "application/json", "yaml": "text/yaml", "yml": "text/yaml", "toml": "application/toml",
+	"js": "text/javascript", "mjs": "text/javascript", "cjs": "text/javascript", "jsx": "text/jsx", "ts": "video/mp2t",
+	"tsx": "text/jsx", "sh": "application/x-sh", "py": "text/x-python", "c": "text/x-c", "h": "text/x-c", "cc": "text/x-c",
+	"cpp": "text/x-c", "java": "text/x-java-source", "rs": "text/x-rust", "go": "text/x-go", "rb": "text/x-ruby",
+	"php": "application/x-httpd-php", "sql": "application/sql", "svg": "image/svg+xml", "png": "image/png",
+	"jpg": "image/jpeg", "jpeg": "image/jpeg", "gif": "image/gif", "webp": "image/webp", "bmp": "image/bmp",
+	"ico": "image/vnd.microsoft.icon", "tif": "image/tiff", "tiff": "image/tiff", "avif": "image/avif",
+	"pdf": "application/pdf", "zip": "application/zip", "gz": "application/gzip", "tar": "application/x-tar",
+	"wasm": "application/wasm", "mp3": "audio/mpeg", "wav": "audio/wav", "mp4": "video/mp4", "webm": "video/webm",
+	"woff": "font/woff", "woff2": "font/woff2", "ttf": "font/ttf", "otf": "font/otf",
+}
+
+// contentTypeOf is the content type for a path's extension; "" when unknown and no text fallback.
+func contentTypeOf(path string, textFallback bool) string {
+	ext := strings.ToLower(strings.TrimPrefix(filepath.Ext(path), "."))
+	if t, ok := mimeTypes[ext]; ok {
+		return t
+	}
+	if textFallback {
+		return "text/plain"
+	}
+	return ""
+}

package/extensions/ahp/internal/svc/paths.go

@@ -0,0 +1,108 @@
+// Package svc holds the services that expose the machine to a remote client: file resources,
+// resource watches and terminals. Every one is opt-in and confined; nothing here runs unless the
+// extension was explicitly configured to enable it (port of pi-ahp's resource-*, terminal
+// services).
+package svc
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/MichaelKinsy/pigpen/ahp/internal/wire"
+)
+
+// canonicalPath resolves symlinks in path even when the path (or its tail) does not exist yet: a
+// dangling symlink is followed to where it would create the file, so a write through a link that
+// points outside the permitted roots cannot slip past the check.
+func canonicalPath(path string) (string, error) {
+	absolute, err := filepath.Abs(path)
+	if err != nil {
+		return "", err
+	}
+	if real, err := filepath.EvalSymlinks(absolute); err == nil {
+		return real, nil
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return "", err
+	}
+	if info, err := os.Lstat(absolute); err == nil {
+		if info.Mode()&fs.ModeSymlink != 0 {
+			target, err := os.Readlink(absolute)
+			if err != nil {
+				return "", err
+			}
+			if !filepath.IsAbs(target) {
+				target = filepath.Join(filepath.Dir(absolute), target)
+			}
+			return canonicalPath(target)
+		}
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return "", err
+	}
+	parent := filepath.Dir(absolute)
+	if parent == absolute {
+		return absolute, nil
+	}
+	canonicalParent, err := canonicalPath(parent)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(canonicalParent, filepath.Base(absolute)), nil
+}
+
+// PathPolicy turns file: URIs into local paths and, when roots are configured, refuses anything
+// that resolves outside them. With no roots every path is allowed; the extension never builds a
+// policy without roots unless the user explicitly asked for an unrestricted one.
+type PathPolicy struct{ roots []string }
+
+// NewPathPolicy creates a policy over roots (each must exist; they are canonicalised).
+func NewPathPolicy(roots ...string) (*PathPolicy, error) {
+	p := &PathPolicy{}
+	for _, root := range roots {
+		abs, err := filepath.Abs(root)
+		if err != nil {
+			return nil, err
+		}
+		real, err := filepath.EvalSymlinks(abs)
+		if err != nil {
+			return nil, fmt.Errorf("resource root %s: %w", root, err)
+		}
+		p.roots = append(p.roots, real)
+	}
+	return p, nil
+}
+
+// Restricted reports whether the policy confines paths to roots.
+func (p *PathPolicy) Restricted() bool { return len(p.roots) > 0 }
+
+// PathFor returns the local path of a file: URI, or a protocol error: InvalidParams for a wrong
+// scheme or malformed URI, PermissionDenied for a path outside the roots.
+func (p *PathPolicy) PathFor(uri string) (string, error) {
+	if !strings.HasPrefix(uri, "file://") {
+		return "", wire.InvalidParams("Only file: URIs are supported, got: " + uri)
+	}
+	path, err := wire.FileURIToPath(uri)
+	if err != nil {
+		return "", wire.InvalidParams("Malformed file URI: " + uri)
+	}
+	if len(p.roots) == 0 {
+		return path, nil
+	}
+	candidate, err := canonicalPath(path)
+	if err != nil {
+		return "", wire.Coded(wire.CodePermissionDenied, err.Error())
+	}
+	for _, root := range p.roots {
+		prefix := root
+		if !strings.HasSuffix(prefix, string(filepath.Separator)) {
+			prefix += string(filepath.Separator)
+		}
+		if candidate == root || strings.HasPrefix(candidate, prefix) {
+			return path, nil
+		}
+	}
+	return "", wire.Coded(wire.CodePermissionDenied, "Outside the permitted roots: "+uri)
+}