@qodalis/cli-core 2.0.0-beta.12 → 2.0.0-beta.14

package/public-api.js

@@ -667,7 +667,7 @@ var require_compare_build = __commonJS({
 var require_sort = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/sort.js"(exports$1, module) {
     var compareBuild = require_compare_build();
-    var sort = (list, loose) => list.sort((a, b) => compareBuild(a, b, loose));
+    var sort = (list2, loose) => list2.sort((a, b) => compareBuild(a, b, loose));
     module.exports = sort;
   }
 });
@@ -676,7 +676,7 @@ var require_sort = __commonJS({
 var require_rsort = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/rsort.js"(exports$1, module) {
     var compareBuild = require_compare_build();
-    var rsort = (list, loose) => list.sort((a, b) => compareBuild(b, a, loose));
+    var rsort = (list2, loose) => list2.sort((a, b) => compareBuild(b, a, loose));
     module.exports = rsort;
   }
 });
@@ -2055,6 +2055,47 @@ var CliIcon = /* @__PURE__ */ ((CliIcon2) => {
   return CliIcon2;
 })(CliIcon || {});
 
+// src/lib/tokens.ts
+var ICliUserSessionService_TOKEN = "cli-user-session-service";
+var ICliUsersStoreService_TOKEN = "cli-users-store-service";
+var ICliGroupsStoreService_TOKEN = "cli-groups-store-service";
+var ICliAuthService_TOKEN = "cli-auth-service";
+var ICliCompletionProvider_TOKEN = "cli-completion-provider";
+var ICliDragDropService_TOKEN = "cli-drag-drop-service";
+var ICliFileTransferService_TOKEN = "cli-file-transfer-service";
+var ICliTranslationService_TOKEN = "cli-translation-service";
+var ICliPermissionService_TOKEN = "cli-permission-service";
+var ICliFilePickerProvider_TOKEN = "cli-file-picker-provider";
+var ICliHttpClient_TOKEN = "cli-http-client";
+var ICliUserEventService_TOKEN = "cli-user-event-service";
+var ICliAuditService_TOKEN = "cli-audit-service";
+var ICliAuthorizationService_TOKEN = "cli-authorization-service";
+var ICliPermissionRegistry_TOKEN = "cli-permission-registry";
+var ICliSessionsService_TOKEN = "cli-sessions-service";
+var ICliKeyValueStore_TOKEN = "cli-key-value-store";
+
+// src/lib/interfaces/services.ts
+var ICliServerAuthTokenProvider_TOKEN = "cli-server-auth-token-provider";
+var ICliServerAuthService_TOKEN = "cli-server-auth-service";
+var ICliServerManager_TOKEN = "cli-server-manager";
+
+// src/lib/models/server.ts
+function resolveHeaders(provider) {
+  if (!provider) return {};
+  return typeof provider === "function" ? provider() : provider;
+}
+function resolveServerHeaders(services, serverName, configHeaders) {
+  if (services) {
+    const authService = services.get(
+      ICliServerAuthService_TOKEN
+    );
+    if (authService) {
+      return authService.getHeaders(serverName, configHeaders);
+    }
+  }
+  return resolveHeaders(configHeaders);
+}
+
 // src/lib/models/options.ts
 var CliLogLevel = /* @__PURE__ */ ((CliLogLevel2) => {
   CliLogLevel2[CliLogLevel2["None"] = 0] = "None";
@@ -2078,17 +2119,112 @@ var enums = {
   CliLogLevel
 };
 
-// src/lib/tokens.ts
-var ICliUserSessionService_TOKEN = "cli-user-session-service";
-var ICliUsersStoreService_TOKEN = "cli-users-store-service";
-var ICliGroupsStoreService_TOKEN = "cli-groups-store-service";
-var ICliAuthService_TOKEN = "cli-auth-service";
-var ICliCompletionProvider_TOKEN = "cli-completion-provider";
-var ICliDragDropService_TOKEN = "cli-drag-drop-service";
-var ICliFileTransferService_TOKEN = "cli-file-transfer-service";
-var ICliTranslationService_TOKEN = "cli-translation-service";
-var ICliPermissionService_TOKEN = "cli-permission-service";
-var ICliFilePickerProvider_TOKEN = "cli-file-picker-provider";
+// src/lib/interfaces/command-guards.ts
+var ICliCommandGuard_TOKEN = "cli-command-guard";
+
+// src/lib/utils/permissions.ts
+function cliPermissionMatches(granted, required) {
+  const g = granted.trim().toLowerCase().split(":");
+  const r = required.trim().toLowerCase().split(":");
+  for (let i = 0; i < g.length; i++) {
+    if (g[i] === "*" && i === g.length - 1) return true;
+    if (i >= r.length || g[i] !== "*" && g[i] !== r[i]) return false;
+  }
+  return g.length === r.length;
+}
+function cliHasPermission(granted, required) {
+  return !!granted?.some((p) => cliPermissionMatches(p, required));
+}
+function cliMissingPermissions(granted, required) {
+  return required.filter((r) => !cliHasPermission(granted, r));
+}
+function cliMergePermissions(...lists) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const list2 of lists) {
+    for (const p of list2 ?? []) {
+      const key = p.trim();
+      if (key && !seen.has(key.toLowerCase())) {
+        seen.add(key.toLowerCase());
+        out.push(key);
+      }
+    }
+  }
+  return out;
+}
+var CliServerPermissions = {
+  /** Open a remote shell on a server (`ssh`) */
+  ShellExecute: "shell:execute"
+};
+var CliUsersPermissions = {
+  UsersRead: "users:read",
+  UsersCreate: "users:create",
+  UsersUpdate: "users:update",
+  UsersDelete: "users:delete",
+  GroupsRead: "groups:read",
+  GroupsCreate: "groups:create",
+  GroupsUpdate: "groups:update",
+  GroupsDelete: "groups:delete",
+  SessionsRead: "sessions:read",
+  SessionsRevoke: "sessions:revoke",
+  AuditRead: "audit:read",
+  AuditClear: "audit:clear"
+};
+
+// src/lib/interfaces/authorization.ts
+var CliAccessDeniedError = class _CliAccessDeniedError extends Error {
+  constructor(message = "permission denied") {
+    super(message);
+    this.code = "EACCES";
+    this.name = "CliAccessDeniedError";
+    Object.setPrototypeOf(this, _CliAccessDeniedError.prototype);
+  }
+};
+function isCliAccessDeniedError(error) {
+  return error instanceof CliAccessDeniedError || !!error && typeof error === "object" && error.name === "CliAccessDeniedError";
+}
+function authorizationService(context) {
+  try {
+    return context.services.get(ICliAuthorizationService_TOKEN);
+  } catch {
+    return void 0;
+  }
+}
+function cliAuthorize(context, permission) {
+  const auth = authorizationService(context);
+  return auth ? auth.can(permission) : true;
+}
+function cliCanAccess(context, resource, action, bypassPermissions) {
+  const auth = authorizationService(context);
+  return auth ? auth.canAccess(resource, action, bypassPermissions) : true;
+}
+function cliEvaluateAccess(principal, resource, action, bypassPermissions = []) {
+  const mode = resource.permissions;
+  const owner = resource.ownership;
+  if (!mode || mode.length < 9 || !owner) return true;
+  if (principal && (cliHasPermission(principal.permissions, "*") || bypassPermissions.some((p) => cliHasPermission(principal.permissions, p)))) {
+    return true;
+  }
+  let offset = 6;
+  if (principal) {
+    if (owner.uid === principal.name || owner.uid === principal.id) offset = 0;
+    else if (principal.groups.some((g) => g.toLowerCase() === owner.gid.toLowerCase())) offset = 3;
+  }
+  const index = offset + (action === "read" ? 0 : action === "write" ? 1 : 2);
+  return mode.charAt(index) !== "-";
+}
+
+// src/lib/interfaces/http-client.ts
+var CliHttpError = class _CliHttpError extends Error {
+  constructor(message, status, statusText = "", body) {
+    super(message);
+    this.status = status;
+    this.statusText = statusText;
+    this.body = body;
+    this.name = "CliHttpError";
+    Object.setPrototypeOf(this, _CliHttpError.prototype);
+  }
+};
 
 // src/lib/constants/index.ts
 var DefaultLibraryAuthor = {
@@ -2252,7 +2388,7 @@ function getConfigValue(state, category, key, defaultValue) {
 }
 function getPluginConfigValue(context, category, key, defaultValue) {
   try {
-    const storeManager = context.services.get(
+    const storeManager = context.services.getRequired(
       "cli-state-store-manager"
     );
     if (!storeManager) return defaultValue;
@@ -2317,7 +2453,7 @@ function satisfiesVersionRange(installed, range) {
 }
 
 // src/lib/version.ts
-var LIBRARY_VERSION = "2.0.0-beta.12";
+var LIBRARY_VERSION = "2.0.0-beta.14";
 var API_VERSION = 2;
 
 // src/lib/utils/server-version-negotiator.ts
@@ -2341,9 +2477,12 @@ var ServerVersionNegotiator = class {
    * Returns the negotiated API version and the base path for all subsequent calls,
    * or null if the server is unreachable or incompatible.
    */
-  static async discover(baseUrl) {
+  static async discover(baseUrl, headers) {
     try {
-      const response = await fetch(`${baseUrl}${VERSIONS_ENDPOINT}`);
+      const resolved = resolveHeaders(headers);
+      const response = await fetch(`${baseUrl}${VERSIONS_ENDPOINT}`, {
+        headers: Object.keys(resolved).length > 0 ? resolved : void 0
+      });
       if (!response.ok) return null;
       const info = await response.json();
       const version = this.negotiate(info);
@@ -2358,6 +2497,33 @@ var ServerVersionNegotiator = class {
   }
 };
 
+// src/lib/utils/websocket-auth.ts
+function buildAuthenticatedWebSocketUrl(wsUrl, headers) {
+  const resolved = resolveHeaders(headers);
+  if (Object.keys(resolved).length === 0) {
+    return wsUrl;
+  }
+  const separator = wsUrl.includes("?") ? "&" : "?";
+  const params = Object.entries(resolved).map(
+    ([key, value]) => `_header_${encodeURIComponent(key)}=${encodeURIComponent(value)}`
+  ).join("&");
+  return `${wsUrl}${separator}${params}`;
+}
+async function resolveServerWebSocketUrl(services, serverName, wsUrl, configHeaders) {
+  const authService = services?.get(ICliServerAuthService_TOKEN);
+  const params = await authService?.getWebSocketParams?.(serverName);
+  if (params) {
+    return appendQueryParams(wsUrl, params);
+  }
+  return buildAuthenticatedWebSocketUrl(wsUrl, () => resolveServerHeaders(services, serverName, configHeaders));
+}
+function appendQueryParams(url, params) {
+  const entries = Object.entries(params);
+  if (!entries.length) return url;
+  const query = entries.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+  return `${url}${url.includes("?") ? "&" : "?"}${query}`;
+}
+
 // src/lib/utils/panel-theme-sync.ts
 function hexToRgb(hex) {
   const m = /^#?([0-9A-Fa-f]{6})([0-9A-Fa-f]{2})?$/.exec(hex);
@@ -2430,7 +2596,100 @@ function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
 }
 function visibleLength(text) {
-  return stripAnsi(text).length;
+  const stripped = stripAnsi(text);
+  let width = 0;
+  for (const ch of stripped) {
+    const cp = ch.codePointAt(0);
+    if (cp >= 65024 && cp <= 65039) continue;
+    if (cp === 8205) continue;
+    if (cp >= 768 && cp <= 879) continue;
+    width += isWideCharacter(cp) ? 2 : 1;
+  }
+  return width;
+}
+function isWideCharacter(cp) {
+  if (cp >= 126976) return true;
+  if (cp >= 9728 && cp <= 10175) return true;
+  if (cp >= 9984 && cp <= 10175) return true;
+  if (cp >= 19968 && cp <= 40959) return true;
+  if (cp >= 63744 && cp <= 64255) return true;
+  if (cp >= 65281 && cp <= 65376) return true;
+  if (cp >= 65504 && cp <= 65510) return true;
+  if (cp >= 11904 && cp <= 12255) return true;
+  if (cp >= 12288 && cp <= 12543) return true;
+  if (cp >= 12800 && cp <= 13055) return true;
+  if (cp >= 13056 && cp <= 13311) return true;
+  if (cp >= 127232 && cp <= 127487) return true;
+  if (cp >= 8960 && cp <= 9215) return true;
+  return false;
+}
+
+// src/lib/utils/access-guards.ts
+var list = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string" && v.trim()) : [];
+var authorization = (context) => {
+  try {
+    return context.services.get(ICliAuthorizationService_TOKEN);
+  } catch {
+    return void 0;
+  }
+};
+function chain(processor) {
+  const out = [];
+  let current = processor;
+  while (current && out.length < 32 && !out.includes(current)) {
+    out.push(current);
+    current = current.parent;
+  }
+  return out;
+}
+var requiredPermissionsOf = (p) => [...new Set(chain(p).flatMap((x) => list(x.metadata?.requiredPermissions)))];
+var requiredGroupLevels = (p) => chain(p).map((x) => list(x.metadata?.requiredGroups)).filter((g) => g.length > 0);
+var needsAuth = (p) => chain(p).some((x) => x.metadata?.requireAuth === true) || requiredGroupLevels(p).length > 0 || requiredPermissionsOf(p).length > 0;
+var cliRequireAuthGuard = {
+  name: "access:require-auth",
+  priority: -100,
+  appliesTo: (processor, _command, context) => needsAuth(processor) && !!authorization(context),
+  canActivate: (_command, processor, context) => authorization(context).getPrincipal() ? true : `${processor.command}: login required`
+};
+var cliRequiredGroupsGuard = {
+  name: "access:required-groups",
+  priority: -90,
+  appliesTo: (processor, _command, context) => requiredGroupLevels(processor).length > 0 && !!authorization(context),
+  canActivate: (_command, processor, context) => {
+    const auth = authorization(context);
+    const principal = auth.getPrincipal();
+    if (!principal) return `${processor.command}: login required`;
+    if (auth.can("*")) return true;
+    for (const required of requiredGroupLevels(processor)) {
+      const member = required.some((g) => principal.groups.some((pg) => pg.toLowerCase() === g.toLowerCase()));
+      if (!member) return `${processor.command}: permission denied (requires group: ${required.join(" or ")})`;
+    }
+    return true;
+  }
+};
+var cliRequiredPermissionsGuard = {
+  name: "access:required-permissions",
+  priority: -80,
+  appliesTo: (processor, _command, context) => requiredPermissionsOf(processor).length > 0 && !!authorization(context),
+  canActivate: (_command, processor, context) => {
+    const principal = authorization(context).getPrincipal();
+    if (!principal) return `${processor.command}: login required`;
+    const missing = cliMissingPermissions(principal.permissions, requiredPermissionsOf(processor));
+    return missing.length === 0 ? true : `${processor.command}: permission denied (requires ${missing.join(", ")})`;
+  }
+};
+var cliAccessMetadataGuards = [
+  cliRequireAuthGuard,
+  cliRequiredGroupsGuard,
+  cliRequiredPermissionsGuard
+];
+
+// src/lib/utils/server-target.ts
+function cliDefaultServer(context) {
+  const servers = context.options?.servers ?? [];
+  const manager = context.services?.get(ICliServerManager_TOKEN);
+  const preferred = manager?.preferredServer?.();
+  return (preferred ? servers.find((s) => s.name === preferred) : void 0) ?? servers[0];
 }
 
 // src/lib/utils/index.ts
@@ -3637,32 +3896,61 @@ exports.BrowserFileTransferService = BrowserFileTransferService;
 exports.CANCELLATION_ERROR_MESSAGE = CANCELLATION_ERROR_MESSAGE;
 exports.CLI_CONFIGURE_STORE_NAME = CLI_CONFIGURE_STORE_NAME;
 exports.CancellablePromise = CancellablePromise;
+exports.CliAccessDeniedError = CliAccessDeniedError;
 exports.CliBackgroundColor = CliBackgroundColor;
 exports.CliForegroundColor = CliForegroundColor;
+exports.CliHttpError = CliHttpError;
 exports.CliIcon = CliIcon;
 exports.CliLogLevel = CliLogLevel;
 exports.CliModuleRegistry = CliModuleRegistry;
+exports.CliServerPermissions = CliServerPermissions;
+exports.CliUsersPermissions = CliUsersPermissions;
 exports.DEFAULT_DIR_PERMISSIONS = DEFAULT_DIR_PERMISSIONS;
 exports.DEFAULT_FILE_PERMISSIONS = DEFAULT_FILE_PERMISSIONS;
 exports.DefaultLibraryAuthor = DefaultLibraryAuthor;
 exports.DefaultThemeInfos = DefaultThemeInfos;
 exports.DefaultThemes = DefaultThemes;
+exports.ICliAuditService_TOKEN = ICliAuditService_TOKEN;
 exports.ICliAuthService_TOKEN = ICliAuthService_TOKEN;
+exports.ICliAuthorizationService_TOKEN = ICliAuthorizationService_TOKEN;
+exports.ICliCommandGuard_TOKEN = ICliCommandGuard_TOKEN;
 exports.ICliCompletionProvider_TOKEN = ICliCompletionProvider_TOKEN;
 exports.ICliDragDropService_TOKEN = ICliDragDropService_TOKEN;
 exports.ICliFilePickerProvider_TOKEN = ICliFilePickerProvider_TOKEN;
 exports.ICliFileTransferService_TOKEN = ICliFileTransferService_TOKEN;
 exports.ICliGroupsStoreService_TOKEN = ICliGroupsStoreService_TOKEN;
+exports.ICliHttpClient_TOKEN = ICliHttpClient_TOKEN;
+exports.ICliKeyValueStore_TOKEN = ICliKeyValueStore_TOKEN;
+exports.ICliPermissionRegistry_TOKEN = ICliPermissionRegistry_TOKEN;
 exports.ICliPermissionService_TOKEN = ICliPermissionService_TOKEN;
+exports.ICliServerAuthService_TOKEN = ICliServerAuthService_TOKEN;
+exports.ICliServerAuthTokenProvider_TOKEN = ICliServerAuthTokenProvider_TOKEN;
+exports.ICliServerManager_TOKEN = ICliServerManager_TOKEN;
+exports.ICliSessionsService_TOKEN = ICliSessionsService_TOKEN;
 exports.ICliTranslationService_TOKEN = ICliTranslationService_TOKEN;
+exports.ICliUserEventService_TOKEN = ICliUserEventService_TOKEN;
 exports.ICliUserSessionService_TOKEN = ICliUserSessionService_TOKEN;
 exports.ICliUsersStoreService_TOKEN = ICliUsersStoreService_TOKEN;
 exports.LIBRARY_VERSION = LIBRARY_VERSION;
 exports.ObjectDescriber = ObjectDescriber;
 exports.ServerVersionNegotiator = ServerVersionNegotiator;
+exports.appendQueryParams = appendQueryParams;
 exports.bootCliModule = bootCliModule;
 exports.bootUmdModule = bootUmdModule;
+exports.buildAuthenticatedWebSocketUrl = buildAuthenticatedWebSocketUrl;
 exports.clearTerminalLine = clearTerminalLine;
+exports.cliAccessMetadataGuards = cliAccessMetadataGuards;
+exports.cliAuthorize = cliAuthorize;
+exports.cliCanAccess = cliCanAccess;
+exports.cliDefaultServer = cliDefaultServer;
+exports.cliEvaluateAccess = cliEvaluateAccess;
+exports.cliHasPermission = cliHasPermission;
+exports.cliMergePermissions = cliMergePermissions;
+exports.cliMissingPermissions = cliMissingPermissions;
+exports.cliPermissionMatches = cliPermissionMatches;
+exports.cliRequireAuthGuard = cliRequireAuthGuard;
+exports.cliRequiredGroupsGuard = cliRequiredGroupsGuard;
+exports.cliRequiredPermissionsGuard = cliRequiredPermissionsGuard;
 exports.colorFirstWord = colorFirstWord;
 exports.colorizeJson = colorizeJson;
 exports.compareVersions = compareVersions;
@@ -3678,9 +3966,13 @@ exports.getPluginConfigValue = getPluginConfigValue;
 exports.getRightOfWord = getRightOfWord;
 exports.highlightTextWithBg = highlightTextWithBg;
 exports.initializeBrowserEnvironment = initializeBrowserEnvironment;
+exports.isCliAccessDeniedError = isCliAccessDeniedError;
 exports.loadPanelPosition = loadPanelPosition;
 exports.nextPanelPosition = nextPanelPosition;
 exports.resolveConfigurationCategories = resolveConfigurationCategories;
+exports.resolveHeaders = resolveHeaders;
+exports.resolveServerHeaders = resolveServerHeaders;
+exports.resolveServerWebSocketUrl = resolveServerWebSocketUrl;
 exports.satisfiesMinVersion = satisfiesMinVersion;
 exports.satisfiesVersionRange = satisfiesVersionRange;
 exports.savePanelPosition = savePanelPosition;