@qodalis/cli-core 2.0.0-beta.13 → 2.0.0-beta.14

package/public-api.js

@@ -667,7 +667,7 @@ var require_compare_build = __commonJS({
 var require_sort = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/sort.js"(exports$1, module) {
     var compareBuild = require_compare_build();
-    var sort = (list, loose) => list.sort((a, b) => compareBuild(a, b, loose));
+    var sort = (list2, loose) => list2.sort((a, b) => compareBuild(a, b, loose));
     module.exports = sort;
   }
 });
@@ -676,7 +676,7 @@ var require_sort = __commonJS({
 var require_rsort = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/rsort.js"(exports$1, module) {
     var compareBuild = require_compare_build();
-    var rsort = (list, loose) => list.sort((a, b) => compareBuild(b, a, loose));
+    var rsort = (list2, loose) => list2.sort((a, b) => compareBuild(b, a, loose));
     module.exports = rsort;
   }
 });
@@ -2067,10 +2067,17 @@ var ICliTranslationService_TOKEN = "cli-translation-service";
 var ICliPermissionService_TOKEN = "cli-permission-service";
 var ICliFilePickerProvider_TOKEN = "cli-file-picker-provider";
 var ICliHttpClient_TOKEN = "cli-http-client";
+var ICliUserEventService_TOKEN = "cli-user-event-service";
+var ICliAuditService_TOKEN = "cli-audit-service";
+var ICliAuthorizationService_TOKEN = "cli-authorization-service";
+var ICliPermissionRegistry_TOKEN = "cli-permission-registry";
+var ICliSessionsService_TOKEN = "cli-sessions-service";
+var ICliKeyValueStore_TOKEN = "cli-key-value-store";
 
 // src/lib/interfaces/services.ts
 var ICliServerAuthTokenProvider_TOKEN = "cli-server-auth-token-provider";
 var ICliServerAuthService_TOKEN = "cli-server-auth-service";
+var ICliServerManager_TOKEN = "cli-server-manager";
 
 // src/lib/models/server.ts
 function resolveHeaders(provider) {
@@ -2112,6 +2119,113 @@ var enums = {
   CliLogLevel
 };
 
+// src/lib/interfaces/command-guards.ts
+var ICliCommandGuard_TOKEN = "cli-command-guard";
+
+// src/lib/utils/permissions.ts
+function cliPermissionMatches(granted, required) {
+  const g = granted.trim().toLowerCase().split(":");
+  const r = required.trim().toLowerCase().split(":");
+  for (let i = 0; i < g.length; i++) {
+    if (g[i] === "*" && i === g.length - 1) return true;
+    if (i >= r.length || g[i] !== "*" && g[i] !== r[i]) return false;
+  }
+  return g.length === r.length;
+}
+function cliHasPermission(granted, required) {
+  return !!granted?.some((p) => cliPermissionMatches(p, required));
+}
+function cliMissingPermissions(granted, required) {
+  return required.filter((r) => !cliHasPermission(granted, r));
+}
+function cliMergePermissions(...lists) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const list2 of lists) {
+    for (const p of list2 ?? []) {
+      const key = p.trim();
+      if (key && !seen.has(key.toLowerCase())) {
+        seen.add(key.toLowerCase());
+        out.push(key);
+      }
+    }
+  }
+  return out;
+}
+var CliServerPermissions = {
+  /** Open a remote shell on a server (`ssh`) */
+  ShellExecute: "shell:execute"
+};
+var CliUsersPermissions = {
+  UsersRead: "users:read",
+  UsersCreate: "users:create",
+  UsersUpdate: "users:update",
+  UsersDelete: "users:delete",
+  GroupsRead: "groups:read",
+  GroupsCreate: "groups:create",
+  GroupsUpdate: "groups:update",
+  GroupsDelete: "groups:delete",
+  SessionsRead: "sessions:read",
+  SessionsRevoke: "sessions:revoke",
+  AuditRead: "audit:read",
+  AuditClear: "audit:clear"
+};
+
+// src/lib/interfaces/authorization.ts
+var CliAccessDeniedError = class _CliAccessDeniedError extends Error {
+  constructor(message = "permission denied") {
+    super(message);
+    this.code = "EACCES";
+    this.name = "CliAccessDeniedError";
+    Object.setPrototypeOf(this, _CliAccessDeniedError.prototype);
+  }
+};
+function isCliAccessDeniedError(error) {
+  return error instanceof CliAccessDeniedError || !!error && typeof error === "object" && error.name === "CliAccessDeniedError";
+}
+function authorizationService(context) {
+  try {
+    return context.services.get(ICliAuthorizationService_TOKEN);
+  } catch {
+    return void 0;
+  }
+}
+function cliAuthorize(context, permission) {
+  const auth = authorizationService(context);
+  return auth ? auth.can(permission) : true;
+}
+function cliCanAccess(context, resource, action, bypassPermissions) {
+  const auth = authorizationService(context);
+  return auth ? auth.canAccess(resource, action, bypassPermissions) : true;
+}
+function cliEvaluateAccess(principal, resource, action, bypassPermissions = []) {
+  const mode = resource.permissions;
+  const owner = resource.ownership;
+  if (!mode || mode.length < 9 || !owner) return true;
+  if (principal && (cliHasPermission(principal.permissions, "*") || bypassPermissions.some((p) => cliHasPermission(principal.permissions, p)))) {
+    return true;
+  }
+  let offset = 6;
+  if (principal) {
+    if (owner.uid === principal.name || owner.uid === principal.id) offset = 0;
+    else if (principal.groups.some((g) => g.toLowerCase() === owner.gid.toLowerCase())) offset = 3;
+  }
+  const index = offset + (action === "read" ? 0 : action === "write" ? 1 : 2);
+  return mode.charAt(index) !== "-";
+}
+
+// src/lib/interfaces/http-client.ts
+var CliHttpError = class _CliHttpError extends Error {
+  constructor(message, status, statusText = "", body) {
+    super(message);
+    this.status = status;
+    this.statusText = statusText;
+    this.body = body;
+    this.name = "CliHttpError";
+    Object.setPrototypeOf(this, _CliHttpError.prototype);
+  }
+};
+
 // src/lib/constants/index.ts
 var DefaultLibraryAuthor = {
   name: "Nicolae Lupei",
@@ -2339,7 +2453,7 @@ function satisfiesVersionRange(installed, range) {
 }
 
 // src/lib/version.ts
-var LIBRARY_VERSION = "2.0.0-beta.13";
+var LIBRARY_VERSION = "2.0.0-beta.14";
 var API_VERSION = 2;
 
 // src/lib/utils/server-version-negotiator.ts
@@ -2395,6 +2509,20 @@ function buildAuthenticatedWebSocketUrl(wsUrl, headers) {
   ).join("&");
   return `${wsUrl}${separator}${params}`;
 }
+async function resolveServerWebSocketUrl(services, serverName, wsUrl, configHeaders) {
+  const authService = services?.get(ICliServerAuthService_TOKEN);
+  const params = await authService?.getWebSocketParams?.(serverName);
+  if (params) {
+    return appendQueryParams(wsUrl, params);
+  }
+  return buildAuthenticatedWebSocketUrl(wsUrl, () => resolveServerHeaders(services, serverName, configHeaders));
+}
+function appendQueryParams(url, params) {
+  const entries = Object.entries(params);
+  if (!entries.length) return url;
+  const query = entries.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+  return `${url}${url.includes("?") ? "&" : "?"}${query}`;
+}
 
 // src/lib/utils/panel-theme-sync.ts
 function hexToRgb(hex) {
@@ -2496,6 +2624,74 @@ function isWideCharacter(cp) {
   return false;
 }
 
+// src/lib/utils/access-guards.ts
+var list = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string" && v.trim()) : [];
+var authorization = (context) => {
+  try {
+    return context.services.get(ICliAuthorizationService_TOKEN);
+  } catch {
+    return void 0;
+  }
+};
+function chain(processor) {
+  const out = [];
+  let current = processor;
+  while (current && out.length < 32 && !out.includes(current)) {
+    out.push(current);
+    current = current.parent;
+  }
+  return out;
+}
+var requiredPermissionsOf = (p) => [...new Set(chain(p).flatMap((x) => list(x.metadata?.requiredPermissions)))];
+var requiredGroupLevels = (p) => chain(p).map((x) => list(x.metadata?.requiredGroups)).filter((g) => g.length > 0);
+var needsAuth = (p) => chain(p).some((x) => x.metadata?.requireAuth === true) || requiredGroupLevels(p).length > 0 || requiredPermissionsOf(p).length > 0;
+var cliRequireAuthGuard = {
+  name: "access:require-auth",
+  priority: -100,
+  appliesTo: (processor, _command, context) => needsAuth(processor) && !!authorization(context),
+  canActivate: (_command, processor, context) => authorization(context).getPrincipal() ? true : `${processor.command}: login required`
+};
+var cliRequiredGroupsGuard = {
+  name: "access:required-groups",
+  priority: -90,
+  appliesTo: (processor, _command, context) => requiredGroupLevels(processor).length > 0 && !!authorization(context),
+  canActivate: (_command, processor, context) => {
+    const auth = authorization(context);
+    const principal = auth.getPrincipal();
+    if (!principal) return `${processor.command}: login required`;
+    if (auth.can("*")) return true;
+    for (const required of requiredGroupLevels(processor)) {
+      const member = required.some((g) => principal.groups.some((pg) => pg.toLowerCase() === g.toLowerCase()));
+      if (!member) return `${processor.command}: permission denied (requires group: ${required.join(" or ")})`;
+    }
+    return true;
+  }
+};
+var cliRequiredPermissionsGuard = {
+  name: "access:required-permissions",
+  priority: -80,
+  appliesTo: (processor, _command, context) => requiredPermissionsOf(processor).length > 0 && !!authorization(context),
+  canActivate: (_command, processor, context) => {
+    const principal = authorization(context).getPrincipal();
+    if (!principal) return `${processor.command}: login required`;
+    const missing = cliMissingPermissions(principal.permissions, requiredPermissionsOf(processor));
+    return missing.length === 0 ? true : `${processor.command}: permission denied (requires ${missing.join(", ")})`;
+  }
+};
+var cliAccessMetadataGuards = [
+  cliRequireAuthGuard,
+  cliRequiredGroupsGuard,
+  cliRequiredPermissionsGuard
+];
+
+// src/lib/utils/server-target.ts
+function cliDefaultServer(context) {
+  const servers = context.options?.servers ?? [];
+  const manager = context.services?.get(ICliServerManager_TOKEN);
+  const preferred = manager?.preferredServer?.();
+  return (preferred ? servers.find((s) => s.name === preferred) : void 0) ?? servers[0];
+}
+
 // src/lib/utils/index.ts
 var getParameterValue = (p, args) => {
   if (args[p.name] !== void 0) {
@@ -3700,36 +3896,61 @@ exports.BrowserFileTransferService = BrowserFileTransferService;
 exports.CANCELLATION_ERROR_MESSAGE = CANCELLATION_ERROR_MESSAGE;
 exports.CLI_CONFIGURE_STORE_NAME = CLI_CONFIGURE_STORE_NAME;
 exports.CancellablePromise = CancellablePromise;
+exports.CliAccessDeniedError = CliAccessDeniedError;
 exports.CliBackgroundColor = CliBackgroundColor;
 exports.CliForegroundColor = CliForegroundColor;
+exports.CliHttpError = CliHttpError;
 exports.CliIcon = CliIcon;
 exports.CliLogLevel = CliLogLevel;
 exports.CliModuleRegistry = CliModuleRegistry;
+exports.CliServerPermissions = CliServerPermissions;
+exports.CliUsersPermissions = CliUsersPermissions;
 exports.DEFAULT_DIR_PERMISSIONS = DEFAULT_DIR_PERMISSIONS;
 exports.DEFAULT_FILE_PERMISSIONS = DEFAULT_FILE_PERMISSIONS;
 exports.DefaultLibraryAuthor = DefaultLibraryAuthor;
 exports.DefaultThemeInfos = DefaultThemeInfos;
 exports.DefaultThemes = DefaultThemes;
+exports.ICliAuditService_TOKEN = ICliAuditService_TOKEN;
 exports.ICliAuthService_TOKEN = ICliAuthService_TOKEN;
+exports.ICliAuthorizationService_TOKEN = ICliAuthorizationService_TOKEN;
+exports.ICliCommandGuard_TOKEN = ICliCommandGuard_TOKEN;
 exports.ICliCompletionProvider_TOKEN = ICliCompletionProvider_TOKEN;
 exports.ICliDragDropService_TOKEN = ICliDragDropService_TOKEN;
 exports.ICliFilePickerProvider_TOKEN = ICliFilePickerProvider_TOKEN;
 exports.ICliFileTransferService_TOKEN = ICliFileTransferService_TOKEN;
 exports.ICliGroupsStoreService_TOKEN = ICliGroupsStoreService_TOKEN;
 exports.ICliHttpClient_TOKEN = ICliHttpClient_TOKEN;
+exports.ICliKeyValueStore_TOKEN = ICliKeyValueStore_TOKEN;
+exports.ICliPermissionRegistry_TOKEN = ICliPermissionRegistry_TOKEN;
 exports.ICliPermissionService_TOKEN = ICliPermissionService_TOKEN;
 exports.ICliServerAuthService_TOKEN = ICliServerAuthService_TOKEN;
 exports.ICliServerAuthTokenProvider_TOKEN = ICliServerAuthTokenProvider_TOKEN;
+exports.ICliServerManager_TOKEN = ICliServerManager_TOKEN;
+exports.ICliSessionsService_TOKEN = ICliSessionsService_TOKEN;
 exports.ICliTranslationService_TOKEN = ICliTranslationService_TOKEN;
+exports.ICliUserEventService_TOKEN = ICliUserEventService_TOKEN;
 exports.ICliUserSessionService_TOKEN = ICliUserSessionService_TOKEN;
 exports.ICliUsersStoreService_TOKEN = ICliUsersStoreService_TOKEN;
 exports.LIBRARY_VERSION = LIBRARY_VERSION;
 exports.ObjectDescriber = ObjectDescriber;
 exports.ServerVersionNegotiator = ServerVersionNegotiator;
+exports.appendQueryParams = appendQueryParams;
 exports.bootCliModule = bootCliModule;
 exports.bootUmdModule = bootUmdModule;
 exports.buildAuthenticatedWebSocketUrl = buildAuthenticatedWebSocketUrl;
 exports.clearTerminalLine = clearTerminalLine;
+exports.cliAccessMetadataGuards = cliAccessMetadataGuards;
+exports.cliAuthorize = cliAuthorize;
+exports.cliCanAccess = cliCanAccess;
+exports.cliDefaultServer = cliDefaultServer;
+exports.cliEvaluateAccess = cliEvaluateAccess;
+exports.cliHasPermission = cliHasPermission;
+exports.cliMergePermissions = cliMergePermissions;
+exports.cliMissingPermissions = cliMissingPermissions;
+exports.cliPermissionMatches = cliPermissionMatches;
+exports.cliRequireAuthGuard = cliRequireAuthGuard;
+exports.cliRequiredGroupsGuard = cliRequiredGroupsGuard;
+exports.cliRequiredPermissionsGuard = cliRequiredPermissionsGuard;
 exports.colorFirstWord = colorFirstWord;
 exports.colorizeJson = colorizeJson;
 exports.compareVersions = compareVersions;
@@ -3745,11 +3966,13 @@ exports.getPluginConfigValue = getPluginConfigValue;
 exports.getRightOfWord = getRightOfWord;
 exports.highlightTextWithBg = highlightTextWithBg;
 exports.initializeBrowserEnvironment = initializeBrowserEnvironment;
+exports.isCliAccessDeniedError = isCliAccessDeniedError;
 exports.loadPanelPosition = loadPanelPosition;
 exports.nextPanelPosition = nextPanelPosition;
 exports.resolveConfigurationCategories = resolveConfigurationCategories;
 exports.resolveHeaders = resolveHeaders;
 exports.resolveServerHeaders = resolveServerHeaders;
+exports.resolveServerWebSocketUrl = resolveServerWebSocketUrl;
 exports.satisfiesMinVersion = satisfiesMinVersion;
 exports.satisfiesVersionRange = satisfiesVersionRange;
 exports.savePanelPosition = savePanelPosition;