@platless/axom-cli 0.3.13 → 0.6.36

package/dist/workstation/control/runtimeHost.js

@@ -0,0 +1,148 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import net from 'node:net';
+import path from 'node:path';
+import { privateDirectory, socketLimit } from '../keepers/kit/paths.js';
+import { pidAlive, processCommand } from '../keepers/kit/lock.js';
+import { processStartTime } from '../keepers/kit/orphanSweep.js';
+import { LocalControlError } from './protocol.js';
+import { withPrivateLock } from './locks.js';
+export function runtimePaths(directory) {
+    const root = path.join(path.resolve(directory), 'control');
+    const key = createHash('sha256').update(`${process.getuid?.() ?? 'user'}:${path.resolve(directory)}`).digest('hex').slice(0, 24);
+    const local = path.join(root, 'runtime.sock');
+    return { socket: Buffer.byteLength(local) < socketLimit() ? local : `/tmp/axom-control-${process.getuid?.() ?? 'user'}/${key}.sock`, tokenFile: path.join(root, 'runtime.token'), ownerFile: path.join(root, 'runtime.owner.json') };
+}
+export async function readControlFile(file) {
+    const stat = await fs.lstat(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 65_536 || (process.getuid && stat.uid !== process.getuid()) || (stat.mode & 0o077))
+        throw Error('Unsafe control file');
+    return fs.readFile(file, 'utf8');
+}
+/** A persisted PID can belong to another process after a container restart or reboot. */
+export async function runtimeOwnerLive(owner) {
+    if (!pidAlive(owner.pid))
+        return false;
+    const command = await processCommand(owner.pid);
+    if (command !== null && command !== owner.command)
+        return false;
+    if (typeof owner.startTime === 'string') {
+        const startTime = await processStartTime(owner.pid);
+        if (startTime !== null && startTime !== owner.startTime)
+            return false;
+    }
+    // Inability to read the process identity is not evidence that it stopped.
+    return true;
+}
+export async function openRuntimeHost(options) {
+    const paths = runtimePaths(options.directory);
+    await privateDirectory(path.dirname(paths.ownerFile));
+    await privateDirectory(path.dirname(paths.socket));
+    return withPrivateLock(path.join(options.directory, 'control/runtime-start'), async () => {
+        try {
+            const owner = JSON.parse(await readControlFile(paths.ownerFile));
+            if (!Number.isSafeInteger(owner.pid) || owner.pid <= 0 || typeof owner.command !== 'string')
+                throw Error('Unknown runtime owner');
+            if (await runtimeOwnerLive(owner))
+                throw new LocalControlError('INSTANCE_OCCUPIED', 'A workstation daemon already owns this computer');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                if (error instanceof LocalControlError)
+                    throw error;
+                throw new LocalControlError('INSTANCE_OCCUPIED', 'Cannot verify the existing workstation daemon');
+            }
+            // A socket with no owner cannot safely be reclaimed.
+            try {
+                await fs.lstat(paths.socket);
+                throw new LocalControlError('INSTANCE_OCCUPIED', 'Unverified workstation socket');
+            }
+            catch (e) {
+                if (e.code !== 'ENOENT')
+                    throw e;
+            }
+        }
+        await fs.rm(paths.socket, { force: true });
+        const generation = randomUUID();
+        const token = randomBytes(32).toString('hex');
+        const binding = { ...options.binding };
+        let closed = false;
+        const clients = new Set();
+        const server = net.createServer(socket => {
+            clients.add(socket);
+            socket.on('close', () => clients.delete(socket));
+            socket.on('error', () => { });
+            socket.setTimeout(3000, () => socket.destroy());
+            let body = '';
+            let handled = false;
+            socket.on('data', chunk => {
+                body += chunk.toString();
+                if (Buffer.byteLength(body) > 65_536) {
+                    socket.destroy();
+                    return;
+                }
+                if (handled || !body.includes('\n'))
+                    return;
+                handled = true;
+                void (async () => {
+                    try {
+                        const request = JSON.parse(body.split('\n')[0]);
+                        if (typeof request.token !== 'string' || request.token.length !== token.length || !timingSafeEqual(Buffer.from(token), Buffer.from(request.token)))
+                            throw Error('Unauthorized');
+                        if (request.generation !== generation)
+                            throw new LocalControlError('BINDING_CONFLICT', 'Runtime generation changed');
+                        let value;
+                        if (request.action === 'inspect')
+                            value = { ...await options.snapshot(), state: 'running', binding, generation, mode: options.mode };
+                        else if (request.action === 'stop')
+                            value = { accepted: true };
+                        else if (request.action === 'update') {
+                            const r = request.release;
+                            if (typeof request.operationId !== 'string' || request.operationId.length > 128 || !r || typeof r.version !== 'string' || typeof r.url !== 'string' || typeof r.sha512 !== 'string' || !Number.isSafeInteger(r.size))
+                                throw Error('Invalid update request');
+                            value = await options.update(r, request.operationId);
+                        }
+                        else
+                            throw Error('Invalid action');
+                        socket.end(JSON.stringify({ ok: true, value }) + '\n');
+                        if (request.action === 'stop')
+                            setImmediate(() => { void options.shutdown().catch(() => { }); });
+                    }
+                    catch (error) {
+                        socket.end(JSON.stringify({ ok: false, code: error instanceof LocalControlError ? error.code : 'SERVICE_FAILED' }) + '\n');
+                    }
+                })();
+            });
+        });
+        const close = async () => {
+            if (closed)
+                return;
+            closed = true;
+            for (const socket of clients)
+                socket.destroy();
+            await new Promise(resolve => server.close(() => resolve()));
+            // Only remove our own generation.
+            try {
+                if (JSON.parse(await readControlFile(paths.ownerFile)).generation === generation) {
+                    await fs.rm(paths.ownerFile, { force: true });
+                    await fs.rm(paths.tokenFile, { force: true });
+                    await fs.rm(paths.socket, { force: true });
+                }
+            }
+            catch { /* never remove another owner */ }
+        };
+        try {
+            await new Promise((resolve, reject) => { server.once('error', reject); server.listen(paths.socket, () => { server.removeListener('error', reject); resolve(); }); });
+            await fs.chmod(paths.socket, 0o600);
+            await fs.writeFile(paths.tokenFile, token, { mode: 0o600 });
+            await fs.chmod(paths.tokenFile, 0o600);
+            await fs.writeFile(paths.ownerFile, JSON.stringify({ schemaVersion: 1, pid: process.pid, command: await processCommand(process.pid), startTime: await processStartTime(process.pid), generation }), { mode: 0o600 });
+            await fs.chmod(paths.ownerFile, 0o600);
+            return { generation, close };
+        }
+        catch (error) {
+            await close();
+            throw error;
+        }
+    });
+}

package/dist/workstation/control/serverIdentity.js

@@ -0,0 +1,35 @@
+const ENDPOINTS = new Set(['/workstation/register', '/download/client/manifest.json', '/rest/auth/me', '/rest/auth/scopes/check']);
+export function normalizeWorkstationServer(value) {
+    if (/[\u0000-\u0020\\]/.test(value))
+        throw new Error('Invalid workstation server URL');
+    // Inspect the original path: URL construction silently removes encoded dot segments.
+    const rawPath = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]*(\/[^?#]*)?/.exec(value)?.[1] ?? '';
+    for (const part of rawPath.split('/')) {
+        const decoded = decodeURIComponent(part);
+        if (decoded === '.' || decoded === '..' || /[\/\\\u0000-\u001f\u007f]/.test(decoded))
+            throw new Error('Invalid workstation server path');
+    }
+    const url = new URL(value);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+        throw new Error('Workstation server must be an HTTP(S) URL without credentials, query or fragment');
+    }
+    return url.origin + url.pathname.replace(/\/+$/, '');
+}
+export function workstationEndpoint(server, apiPath) {
+    if (!ENDPOINTS.has(apiPath))
+        throw new Error('Unrecognized workstation endpoint');
+    return new URL(normalizeWorkstationServer(server) + apiPath);
+}
+/** Catalog URLs are deployment-relative even when a reverse proxy adds a path prefix. */
+export function deploymentDownloadURL(server, value) {
+    const base = normalizeWorkstationServer(server);
+    const configured = new URL(base);
+    const candidate = value.startsWith('/download/client/') ? base + value : new URL(value, base + '/').toString();
+    const normalized = normalizeWorkstationServer(candidate);
+    const url = new URL(normalized);
+    if (url.origin !== configured.origin)
+        throw new Error('Artifact URL must use the configured server origin');
+    if (!url.pathname.startsWith(configured.pathname.replace(/\/$/, '') + '/download/client/'))
+        throw new Error('Artifact URL must stay in the configured deployment');
+    return normalized;
+}