@qodalis/cli-core 2.0.0-beta.13 → 2.0.0-beta.14

package/public-api.mjs

@@ -665,7 +665,7 @@ var require_compare_build = __commonJS({
 var require_sort = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/sort.js"(exports$1, module) {
     var compareBuild = require_compare_build();
-    var sort = (list, loose) => list.sort((a, b) => compareBuild(a, b, loose));
+    var sort = (list2, loose) => list2.sort((a, b) => compareBuild(a, b, loose));
     module.exports = sort;
   }
 });
@@ -674,7 +674,7 @@ var require_sort = __commonJS({
 var require_rsort = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/rsort.js"(exports$1, module) {
     var compareBuild = require_compare_build();
-    var rsort = (list, loose) => list.sort((a, b) => compareBuild(b, a, loose));
+    var rsort = (list2, loose) => list2.sort((a, b) => compareBuild(b, a, loose));
     module.exports = rsort;
   }
 });
@@ -2065,10 +2065,17 @@ var ICliTranslationService_TOKEN = "cli-translation-service";
 var ICliPermissionService_TOKEN = "cli-permission-service";
 var ICliFilePickerProvider_TOKEN = "cli-file-picker-provider";
 var ICliHttpClient_TOKEN = "cli-http-client";
+var ICliUserEventService_TOKEN = "cli-user-event-service";
+var ICliAuditService_TOKEN = "cli-audit-service";
+var ICliAuthorizationService_TOKEN = "cli-authorization-service";
+var ICliPermissionRegistry_TOKEN = "cli-permission-registry";
+var ICliSessionsService_TOKEN = "cli-sessions-service";
+var ICliKeyValueStore_TOKEN = "cli-key-value-store";
 
 // src/lib/interfaces/services.ts
 var ICliServerAuthTokenProvider_TOKEN = "cli-server-auth-token-provider";
 var ICliServerAuthService_TOKEN = "cli-server-auth-service";
+var ICliServerManager_TOKEN = "cli-server-manager";
 
 // src/lib/models/server.ts
 function resolveHeaders(provider) {
@@ -2110,6 +2117,113 @@ var enums = {
   CliLogLevel
 };
 
+// src/lib/interfaces/command-guards.ts
+var ICliCommandGuard_TOKEN = "cli-command-guard";
+
+// src/lib/utils/permissions.ts
+function cliPermissionMatches(granted, required) {
+  const g = granted.trim().toLowerCase().split(":");
+  const r = required.trim().toLowerCase().split(":");
+  for (let i = 0; i < g.length; i++) {
+    if (g[i] === "*" && i === g.length - 1) return true;
+    if (i >= r.length || g[i] !== "*" && g[i] !== r[i]) return false;
+  }
+  return g.length === r.length;
+}
+function cliHasPermission(granted, required) {
+  return !!granted?.some((p) => cliPermissionMatches(p, required));
+}
+function cliMissingPermissions(granted, required) {
+  return required.filter((r) => !cliHasPermission(granted, r));
+}
+function cliMergePermissions(...lists) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const list2 of lists) {
+    for (const p of list2 ?? []) {
+      const key = p.trim();
+      if (key && !seen.has(key.toLowerCase())) {
+        seen.add(key.toLowerCase());
+        out.push(key);
+      }
+    }
+  }
+  return out;
+}
+var CliServerPermissions = {
+  /** Open a remote shell on a server (`ssh`) */
+  ShellExecute: "shell:execute"
+};
+var CliUsersPermissions = {
+  UsersRead: "users:read",
+  UsersCreate: "users:create",
+  UsersUpdate: "users:update",
+  UsersDelete: "users:delete",
+  GroupsRead: "groups:read",
+  GroupsCreate: "groups:create",
+  GroupsUpdate: "groups:update",
+  GroupsDelete: "groups:delete",
+  SessionsRead: "sessions:read",
+  SessionsRevoke: "sessions:revoke",
+  AuditRead: "audit:read",
+  AuditClear: "audit:clear"
+};
+
+// src/lib/interfaces/authorization.ts
+var CliAccessDeniedError = class _CliAccessDeniedError extends Error {
+  constructor(message = "permission denied") {
+    super(message);
+    this.code = "EACCES";
+    this.name = "CliAccessDeniedError";
+    Object.setPrototypeOf(this, _CliAccessDeniedError.prototype);
+  }
+};
+function isCliAccessDeniedError(error) {
+  return error instanceof CliAccessDeniedError || !!error && typeof error === "object" && error.name === "CliAccessDeniedError";
+}
+function authorizationService(context) {
+  try {
+    return context.services.get(ICliAuthorizationService_TOKEN);
+  } catch {
+    return void 0;
+  }
+}
+function cliAuthorize(context, permission) {
+  const auth = authorizationService(context);
+  return auth ? auth.can(permission) : true;
+}
+function cliCanAccess(context, resource, action, bypassPermissions) {
+  const auth = authorizationService(context);
+  return auth ? auth.canAccess(resource, action, bypassPermissions) : true;
+}
+function cliEvaluateAccess(principal, resource, action, bypassPermissions = []) {
+  const mode = resource.permissions;
+  const owner = resource.ownership;
+  if (!mode || mode.length < 9 || !owner) return true;
+  if (principal && (cliHasPermission(principal.permissions, "*") || bypassPermissions.some((p) => cliHasPermission(principal.permissions, p)))) {
+    return true;
+  }
+  let offset = 6;
+  if (principal) {
+    if (owner.uid === principal.name || owner.uid === principal.id) offset = 0;
+    else if (principal.groups.some((g) => g.toLowerCase() === owner.gid.toLowerCase())) offset = 3;
+  }
+  const index = offset + (action === "read" ? 0 : action === "write" ? 1 : 2);
+  return mode.charAt(index) !== "-";
+}
+
+// src/lib/interfaces/http-client.ts
+var CliHttpError = class _CliHttpError extends Error {
+  constructor(message, status, statusText = "", body) {
+    super(message);
+    this.status = status;
+    this.statusText = statusText;
+    this.body = body;
+    this.name = "CliHttpError";
+    Object.setPrototypeOf(this, _CliHttpError.prototype);
+  }
+};
+
 // src/lib/constants/index.ts
 var DefaultLibraryAuthor = {
   name: "Nicolae Lupei",
@@ -2337,7 +2451,7 @@ function satisfiesVersionRange(installed, range) {
 }
 
 // src/lib/version.ts
-var LIBRARY_VERSION = "2.0.0-beta.13";
+var LIBRARY_VERSION = "2.0.0-beta.14";
 var API_VERSION = 2;
 
 // src/lib/utils/server-version-negotiator.ts
@@ -2393,6 +2507,20 @@ function buildAuthenticatedWebSocketUrl(wsUrl, headers) {
   ).join("&");
   return `${wsUrl}${separator}${params}`;
 }
+async function resolveServerWebSocketUrl(services, serverName, wsUrl, configHeaders) {
+  const authService = services?.get(ICliServerAuthService_TOKEN);
+  const params = await authService?.getWebSocketParams?.(serverName);
+  if (params) {
+    return appendQueryParams(wsUrl, params);
+  }
+  return buildAuthenticatedWebSocketUrl(wsUrl, () => resolveServerHeaders(services, serverName, configHeaders));
+}
+function appendQueryParams(url, params) {
+  const entries = Object.entries(params);
+  if (!entries.length) return url;
+  const query = entries.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+  return `${url}${url.includes("?") ? "&" : "?"}${query}`;
+}
 
 // src/lib/utils/panel-theme-sync.ts
 function hexToRgb(hex) {
@@ -2494,6 +2622,74 @@ function isWideCharacter(cp) {
   return false;
 }
 
+// src/lib/utils/access-guards.ts
+var list = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string" && v.trim()) : [];
+var authorization = (context) => {
+  try {
+    return context.services.get(ICliAuthorizationService_TOKEN);
+  } catch {
+    return void 0;
+  }
+};
+function chain(processor) {
+  const out = [];
+  let current = processor;
+  while (current && out.length < 32 && !out.includes(current)) {
+    out.push(current);
+    current = current.parent;
+  }
+  return out;
+}
+var requiredPermissionsOf = (p) => [...new Set(chain(p).flatMap((x) => list(x.metadata?.requiredPermissions)))];
+var requiredGroupLevels = (p) => chain(p).map((x) => list(x.metadata?.requiredGroups)).filter((g) => g.length > 0);
+var needsAuth = (p) => chain(p).some((x) => x.metadata?.requireAuth === true) || requiredGroupLevels(p).length > 0 || requiredPermissionsOf(p).length > 0;
+var cliRequireAuthGuard = {
+  name: "access:require-auth",
+  priority: -100,
+  appliesTo: (processor, _command, context) => needsAuth(processor) && !!authorization(context),
+  canActivate: (_command, processor, context) => authorization(context).getPrincipal() ? true : `${processor.command}: login required`
+};
+var cliRequiredGroupsGuard = {
+  name: "access:required-groups",
+  priority: -90,
+  appliesTo: (processor, _command, context) => requiredGroupLevels(processor).length > 0 && !!authorization(context),
+  canActivate: (_command, processor, context) => {
+    const auth = authorization(context);
+    const principal = auth.getPrincipal();
+    if (!principal) return `${processor.command}: login required`;
+    if (auth.can("*")) return true;
+    for (const required of requiredGroupLevels(processor)) {
+      const member = required.some((g) => principal.groups.some((pg) => pg.toLowerCase() === g.toLowerCase()));
+      if (!member) return `${processor.command}: permission denied (requires group: ${required.join(" or ")})`;
+    }
+    return true;
+  }
+};
+var cliRequiredPermissionsGuard = {
+  name: "access:required-permissions",
+  priority: -80,
+  appliesTo: (processor, _command, context) => requiredPermissionsOf(processor).length > 0 && !!authorization(context),
+  canActivate: (_command, processor, context) => {
+    const principal = authorization(context).getPrincipal();
+    if (!principal) return `${processor.command}: login required`;
+    const missing = cliMissingPermissions(principal.permissions, requiredPermissionsOf(processor));
+    return missing.length === 0 ? true : `${processor.command}: permission denied (requires ${missing.join(", ")})`;
+  }
+};
+var cliAccessMetadataGuards = [
+  cliRequireAuthGuard,
+  cliRequiredGroupsGuard,
+  cliRequiredPermissionsGuard
+];
+
+// src/lib/utils/server-target.ts
+function cliDefaultServer(context) {
+  const servers = context.options?.servers ?? [];
+  const manager = context.services?.get(ICliServerManager_TOKEN);
+  const preferred = manager?.preferredServer?.();
+  return (preferred ? servers.find((s) => s.name === preferred) : void 0) ?? servers[0];
+}
+
 // src/lib/utils/index.ts
 var getParameterValue = (p, args) => {
   if (args[p.name] !== void 0) {
@@ -3693,6 +3889,6 @@ var BrowserFileTransferService = class {
   }
 };
 
-export { API_VERSION, BrowserFileTransferService, CANCELLATION_ERROR_MESSAGE, CLI_CONFIGURE_STORE_NAME, CancellablePromise, CliBackgroundColor, CliForegroundColor, CliIcon, CliLogLevel, CliModuleRegistry, DEFAULT_DIR_PERMISSIONS, DEFAULT_FILE_PERMISSIONS, DefaultLibraryAuthor, DefaultThemeInfos, DefaultThemes, ICliAuthService_TOKEN, ICliCompletionProvider_TOKEN, ICliDragDropService_TOKEN, ICliFilePickerProvider_TOKEN, ICliFileTransferService_TOKEN, ICliGroupsStoreService_TOKEN, ICliHttpClient_TOKEN, ICliPermissionService_TOKEN, ICliServerAuthService_TOKEN, ICliServerAuthTokenProvider_TOKEN, ICliTranslationService_TOKEN, ICliUserSessionService_TOKEN, ICliUsersStoreService_TOKEN, LIBRARY_VERSION, ObjectDescriber, ServerVersionNegotiator, bootCliModule, bootUmdModule, buildAuthenticatedWebSocketUrl, clearTerminalLine, colorFirstWord, colorizeJson, compareVersions, constants, createWorkerService, delay, derivePanelThemeStyles, enums, formatJson, getConfigValue, getParameterValue, getPluginConfigValue, getRightOfWord, highlightTextWithBg, initializeBrowserEnvironment, loadPanelPosition, nextPanelPosition, resolveConfigurationCategories, resolveHeaders, resolveServerHeaders, satisfiesMinVersion, satisfiesVersionRange, savePanelPosition, stripAnsi, toQueryString, utils, visibleLength };
+export { API_VERSION, BrowserFileTransferService, CANCELLATION_ERROR_MESSAGE, CLI_CONFIGURE_STORE_NAME, CancellablePromise, CliAccessDeniedError, CliBackgroundColor, CliForegroundColor, CliHttpError, CliIcon, CliLogLevel, CliModuleRegistry, CliServerPermissions, CliUsersPermissions, DEFAULT_DIR_PERMISSIONS, DEFAULT_FILE_PERMISSIONS, DefaultLibraryAuthor, DefaultThemeInfos, DefaultThemes, ICliAuditService_TOKEN, ICliAuthService_TOKEN, ICliAuthorizationService_TOKEN, ICliCommandGuard_TOKEN, ICliCompletionProvider_TOKEN, ICliDragDropService_TOKEN, ICliFilePickerProvider_TOKEN, ICliFileTransferService_TOKEN, ICliGroupsStoreService_TOKEN, ICliHttpClient_TOKEN, ICliKeyValueStore_TOKEN, ICliPermissionRegistry_TOKEN, ICliPermissionService_TOKEN, ICliServerAuthService_TOKEN, ICliServerAuthTokenProvider_TOKEN, ICliServerManager_TOKEN, ICliSessionsService_TOKEN, ICliTranslationService_TOKEN, ICliUserEventService_TOKEN, ICliUserSessionService_TOKEN, ICliUsersStoreService_TOKEN, LIBRARY_VERSION, ObjectDescriber, ServerVersionNegotiator, appendQueryParams, bootCliModule, bootUmdModule, buildAuthenticatedWebSocketUrl, clearTerminalLine, cliAccessMetadataGuards, cliAuthorize, cliCanAccess, cliDefaultServer, cliEvaluateAccess, cliHasPermission, cliMergePermissions, cliMissingPermissions, cliPermissionMatches, cliRequireAuthGuard, cliRequiredGroupsGuard, cliRequiredPermissionsGuard, colorFirstWord, colorizeJson, compareVersions, constants, createWorkerService, delay, derivePanelThemeStyles, enums, formatJson, getConfigValue, getParameterValue, getPluginConfigValue, getRightOfWord, highlightTextWithBg, initializeBrowserEnvironment, isCliAccessDeniedError, loadPanelPosition, nextPanelPosition, resolveConfigurationCategories, resolveHeaders, resolveServerHeaders, resolveServerWebSocketUrl, satisfiesMinVersion, satisfiesVersionRange, savePanelPosition, stripAnsi, toQueryString, utils, visibleLength };
 //# sourceMappingURL=public-api.mjs.map
 //# sourceMappingURL=public-api.mjs.map