@platless/axom-cli 0.5.9 → 0.6.52

package/dist/workstation/desktopControl/nativeDeviceAdmission.js

@@ -0,0 +1,207 @@
+import { createConnection } from 'node:net';
+import { z } from 'zod';
+import { matchesDeviceGrant, nativeReceiptMatches } from './ownershipProtocol.js';
+const identity = z.string().min(1).max(128);
+const grantSchema = z.strictObject({ registrationId: identity, controllerId: identity, deviceEpoch: identity,
+    revision: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER), authorization: identity });
+const receiptSchema = z.strictObject({ commandId: identity, hostLifetimeId: identity, action: z.enum(['admit', 'isolate']),
+    grant: grantSchema, admission: z.enum(['active', 'revoked']), physical: z.literal('completed') });
+const registrationReceiptSchema = z.strictObject({ commandId: identity, registrationId: identity, deviceGeneration: identity,
+    hostLifetimeId: identity, physical: z.literal('completed'), admission: z.literal('revoked') });
+const statusSchema = z.strictObject({ hostLifetimeId: identity, deviceEpoch: identity.nullable(), connected: z.boolean(), active: z.boolean(),
+    workers: z.number().int().min(0).max(1024), operations: z.number().int().min(0).max(64),
+    scopeCount: z.number().int().min(0).max(1024), scopeBudget: z.literal(1024), rotationRequired: z.boolean(), quiescent: z.boolean(),
+}).refine(value => value.quiescent === (!value.active && value.workers === 0 && value.operations === 0) &&
+    value.rotationRequired === (value.scopeCount === value.scopeBudget || !value.connected));
+const hostRetirementSchema = z.strictObject({ commandId: identity, hostLifetimeId: identity, action: z.literal('retireHost'),
+    admission: z.literal('revoked'), physical: z.literal('completed') });
+export function nativeDeviceRequest(original) {
+    const endpoint = { ...original };
+    return value => new Promise((resolve, reject) => {
+        const socket = createConnection(endpoint.socket);
+        let authenticated = false, settled = false, bytes = Buffer.alloc(0);
+        const finish = (error, result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket.destroy();
+            if (error)
+                reject(error);
+            else
+                resolve(result);
+        };
+        const timer = setTimeout(() => finish(new Error('device_admission_unconfirmed')), 5000);
+        socket.once('connect', () => socket.write(endpoint.token));
+        socket.on('error', error => finish(error));
+        socket.on('end', () => finish(new Error('device_admission_unconfirmed')));
+        socket.on('data', chunk => {
+            bytes = Buffer.concat([bytes, chunk]);
+            if (!authenticated) {
+                if (bytes[0] !== 1) {
+                    finish(new Error('device_admission_unconfirmed'));
+                    return;
+                }
+                authenticated = true;
+                bytes = bytes.subarray(1);
+                socket.write(`device ${JSON.stringify(value)}\n`);
+            }
+            if (bytes.length > 8192) {
+                finish(new Error('device_admission_unconfirmed'));
+                return;
+            }
+            const newline = bytes.indexOf(10);
+            if (newline < 0)
+                return;
+            try {
+                finish(undefined, JSON.parse(bytes.subarray(0, newline).toString('utf8')));
+            }
+            catch {
+                finish(new Error('device_admission_unconfirmed'));
+            }
+        });
+    });
+}
+export class NativeDeviceAdmission {
+    hostLifetimeId;
+    request;
+    live = true;
+    nativeRetired = false;
+    retirementCommandId;
+    epoch;
+    retiredRevision = -1;
+    installed = new Map();
+    obligations = new Map();
+    revocations = new Map();
+    constructor(hostLifetimeId, request) {
+        this.hostLifetimeId = hostLifetimeId;
+        this.request = request;
+        identity.parse(hostLifetimeId);
+    }
+    static async connect(original) {
+        const request = nativeDeviceRequest(original);
+        const hello = z.strictObject({ hostLifetimeId: identity, deviceAdmissionProtocol: z.literal(1) }).parse(await request({ action: 'hello' }));
+        return new NativeDeviceAdmission(hello.hostLifetimeId, request);
+    }
+    current() { return this.live; }
+    async bindDeviceEpoch(commandId, deviceEpoch) {
+        identity.parse(deviceEpoch);
+        if (!this.live || this.epoch && this.epoch !== deviceEpoch)
+            throw Error('control_lost');
+        const schema = z.strictObject({ commandId: identity, hostLifetimeId: identity, action: z.literal('bindDeviceEpoch'), deviceEpoch: identity });
+        const receipt = schema.parse(await this.request({ action: 'bindDeviceEpoch', commandId, hostLifetimeId: this.hostLifetimeId, deviceEpoch }));
+        if (!this.live || receipt.commandId !== commandId || receipt.hostLifetimeId !== this.hostLifetimeId || receipt.deviceEpoch !== deviceEpoch)
+            throw Error('device_admission_unconfirmed');
+        this.epoch = deviceEpoch;
+    }
+    retire() { this.live = false; for (const grant of this.obligations.values())
+        this.revoke(grant); }
+    key(grant) { return JSON.stringify(grantSchema.parse(grant)); }
+    async admit(commandId, grant) {
+        const key = this.key(grant);
+        if (!this.live || grant.revision <= this.retiredRevision || (this.epoch && this.epoch !== grant.deviceEpoch))
+            throw new Error('control_lost');
+        const original = grantSchema.parse(grant);
+        this.epoch = original.deviceEpoch;
+        this.obligations.set(key, original);
+        try {
+            const receipt = receiptSchema.parse(await this.request({ action: 'admit', commandId, grant: original, hostLifetimeId: this.hostLifetimeId }));
+            if (!this.live || original.revision <= this.retiredRevision || !nativeReceiptMatches(this, commandId, original, 'admit', receipt))
+                throw new Error('device_admission_unconfirmed');
+            this.installed.set(key, original);
+            return receipt;
+        }
+        catch (error) {
+            if (this.nativeRetired)
+                this.obligations.delete(key);
+            else
+                this.revoke(original);
+            throw error;
+        }
+    }
+    revoke(grant) {
+        const key = this.key(grant);
+        if (this.nativeRetired)
+            return;
+        if (this.epoch && this.epoch !== grant.deviceEpoch)
+            throw new Error('control_lost');
+        this.epoch = grant.deviceEpoch;
+        this.retiredRevision = Math.max(this.retiredRevision, grant.revision);
+        this.installed.delete(key);
+        this.obligations.set(key, grantSchema.parse(grant));
+        if (this.revocations.has(key))
+            return;
+        const pending = this.request({ action: 'revoke', grant: grantSchema.parse(grant), hostLifetimeId: this.hostLifetimeId }).then(value => z.strictObject({}).parse(value));
+        this.revocations.set(key, pending);
+        void pending.catch(() => { if (this.revocations.get(key) === pending)
+            this.revocations.delete(key); });
+    }
+    async isolate(commandId, grant) {
+        this.revoke(grant);
+        await this.revocations.get(this.key(grant))?.catch(() => { });
+        const original = grantSchema.parse(grant);
+        const receipt = receiptSchema.parse(await this.request({ action: 'isolate', commandId, grant: original, hostLifetimeId: this.hostLifetimeId }));
+        if (!nativeReceiptMatches(this, commandId, original, 'isolate', receipt))
+            throw new Error('device_admission_unconfirmed');
+        const key = this.key(original);
+        this.installed.delete(key);
+        this.obligations.delete(key);
+        this.revocations.delete(key);
+        return receipt;
+    }
+    async isolateRegistration(commandId, registrationId, deviceGeneration) {
+        const receipt = registrationReceiptSchema.parse(await this.request({ action: 'isolateRegistration', commandId, registrationId,
+            deviceGeneration, hostLifetimeId: this.hostLifetimeId }));
+        if (receipt.commandId !== commandId || receipt.registrationId !== registrationId || receipt.deviceGeneration !== deviceGeneration ||
+            receipt.hostLifetimeId !== this.hostLifetimeId)
+            throw new Error('device_admission_unconfirmed');
+        return receipt;
+    }
+    async status() {
+        const status = statusSchema.parse(await this.request({ action: 'status', hostLifetimeId: this.hostLifetimeId }));
+        if (status.hostLifetimeId !== this.hostLifetimeId)
+            throw new Error('device_admission_unconfirmed');
+        return status;
+    }
+    async retireHost(commandId) {
+        const receipt = hostRetirementSchema.parse(await this.request({ action: 'retireHost', commandId, hostLifetimeId: this.hostLifetimeId }));
+        if (receipt.commandId !== commandId || receipt.hostLifetimeId !== this.hostLifetimeId)
+            throw new Error('device_admission_unconfirmed');
+        this.nativeRetired = true;
+        this.live = false;
+        this.installed.clear();
+        this.obligations.clear();
+        this.revocations.clear();
+        this.retirementCommandId = commandId;
+        return receipt;
+    }
+    async stopHost(commandId) {
+        const schema = z.strictObject({ commandId: identity, hostLifetimeId: identity, action: z.literal('stopHost'), admission: z.literal('revoked'), physical: z.literal('completed') });
+        const receipt = schema.parse(await this.request({ action: 'stopHost', commandId, hostLifetimeId: this.hostLifetimeId }));
+        if (receipt.commandId !== commandId || receipt.hostLifetimeId !== this.hostLifetimeId)
+            throw new Error('device_admission_unconfirmed');
+        this.live = false;
+        this.installed.clear();
+        return receipt;
+    }
+    async acknowledgeHostRetirement(commandId) {
+        if (!this.nativeRetired || !this.retirementCommandId)
+            throw new Error('device_admission_unconfirmed');
+        const schema = z.strictObject({ commandId: identity, hostLifetimeId: identity, action: z.literal('acknowledgeHostRetirement'), admission: z.literal('revoked'), physical: z.literal('completed') });
+        const receipt = schema.parse(await this.request({ action: 'acknowledgeHostRetirement', commandId, retirementCommandId: this.retirementCommandId, hostLifetimeId: this.hostLifetimeId }));
+        if (receipt.commandId !== commandId || receipt.hostLifetimeId !== this.hostLifetimeId)
+            throw new Error('device_admission_unconfirmed');
+        return receipt;
+    }
+    context(registrationId, deviceGeneration, consumerId, grant) {
+        identity.parse(registrationId);
+        identity.parse(deviceGeneration);
+        identity.parse(consumerId);
+        if (!this.live || !this.epoch)
+            throw new Error('control_lost');
+        if (grant && (grant.registrationId !== registrationId || grant.controllerId !== consumerId ||
+            ![...this.installed.values()].some(value => matchesDeviceGrant(value, grant))))
+            throw new Error('control_lost');
+        return JSON.stringify({ hostLifetimeId: this.hostLifetimeId, deviceEpoch: this.epoch, registrationId, deviceGeneration, consumerId, grant: grant ?? null });
+    }
+}