@qodalis/cli-files 2.0.0-beta.13 → 2.0.0-beta.14

package/umd/index.global.js

@@ -628,14 +628,14 @@ var files = (() => {
   var require_sort = __commonJS({
     "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/sort.js"(exports$1, module2) {
       var compareBuild = require_compare_build();
-      var sort = (list, loose) => list.sort((a, b) => compareBuild(a, b, loose));
+      var sort = (list2, loose) => list2.sort((a, b) => compareBuild(a, b, loose));
       module2.exports = sort;
     }
   });
   var require_rsort = __commonJS({
     "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/functions/rsort.js"(exports$1, module2) {
       var compareBuild = require_compare_build();
-      var rsort = (list, loose) => list.sort((a, b) => compareBuild(b, a, loose));
+      var rsort = (list2, loose) => list2.sort((a, b) => compareBuild(b, a, loose));
       module2.exports = rsort;
     }
   });
@@ -1838,6 +1838,17 @@ var files = (() => {
     if (!provider) return {};
     return typeof provider === "function" ? provider() : provider;
   }
+  var CliAccessDeniedError = class _CliAccessDeniedError extends Error {
+    constructor(message = "permission denied") {
+      super(message);
+      this.code = "EACCES";
+      this.name = "CliAccessDeniedError";
+      Object.setPrototypeOf(this, _CliAccessDeniedError.prototype);
+    }
+  };
+  function isCliAccessDeniedError(error) {
+    return error instanceof CliAccessDeniedError || !!error && typeof error === "object" && error.name === "CliAccessDeniedError";
+  }
   var DefaultLibraryAuthor = {
     name: "Nicolae Lupei",
     email: "nicolae.lupei@qodalis.com"
@@ -2701,7 +2712,7 @@ var files = (() => {
   };
 
   // src/lib/version.ts
-  var LIBRARY_VERSION = "2.0.0-beta.13";
+  var LIBRARY_VERSION = "2.0.0-beta.14";
   var API_VERSION2 = 2;
 
   // src/lib/interfaces/i-file-system-service.ts
@@ -2714,6 +2725,7 @@ var files = (() => {
   var CWD_KEY = "cwd";
   var HOME_KEY = "home";
   var DEFAULT_HOME = "/";
+  var ANONYMOUS_OWNERSHIP = { uid: "nobody", gid: "nogroup" };
   function createSeedFileSystem() {
     const now = Date.now();
     return {
@@ -2761,6 +2773,88 @@ var files = (() => {
       this.homePath = DEFAULT_HOME;
       this.currentUid = null;
       this.currentGroups = [];
+      this.systemDepth = 0;
+    }
+    // --- Access control ---
+    setAccessPolicy(policy) {
+      this.accessPolicy = policy;
+    }
+    runAsSystem(fn) {
+      this.systemDepth++;
+      try {
+        return fn();
+      } finally {
+        this.systemDepth--;
+      }
+    }
+    reassignOwner(fromUid, toUid) {
+      const from = fromUid.toLowerCase();
+      if (!from || !toUid) return 0;
+      let changed = 0;
+      const visit = (node) => {
+        if (node.ownership && node.ownership.uid.toLowerCase() === from) {
+          node.ownership = { ...node.ownership, uid: toUid };
+          changed++;
+        }
+        node.children?.forEach(visit);
+      };
+      visit(this.root);
+      return changed;
+    }
+    canTraverse(path) {
+      try {
+        this.assertTraverse(this.resolvePath(path), "stat", path);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    get enforcing() {
+      return !!this.accessPolicy && this.systemDepth === 0;
+    }
+    deny(op, path, reason = "Permission denied") {
+      throw new CliAccessDeniedError(`${op}: ${path}: ${reason}`);
+    }
+    /** `x` on every existing directory on the way to `resolved` (excluding the target). */
+    assertTraverse(resolved, op, display) {
+      if (!this.enforcing) return;
+      const parts = resolved.split("/").filter(Boolean);
+      let current = this.root;
+      for (let i = 0; i < parts.length; i++) {
+        if (!current || current.type !== "directory") return;
+        if (!this.accessPolicy.canAccess(current, "execute")) this.deny(op, display);
+        current = current.children?.find((c) => c.name === parts[i]);
+      }
+    }
+    assertAccess(node, action, op, display) {
+      if (this.enforcing && !this.accessPolicy.canAccess(node, action)) this.deny(op, display);
+    }
+    /** Recursive delete: every directory inside must allow removing its entries (`w` + `x`, readable). */
+    assertRemovableTree(dir, dirPath, display) {
+      if (!this.enforcing) return;
+      this.assertAccess(dir, "read", "rm", display);
+      this.assertAccess(dir, "execute", "rm", display);
+      if ((dir.children?.length ?? 0) > 0) this.assertAccess(dir, "write", "rm", display);
+      for (const child of dir.children ?? []) {
+        if (child.type === "directory") this.assertRemovableTree(child, `${dirPath}/${child.name}`, display);
+      }
+    }
+    /** Copying reads everything it copies: `r` on every file, `r` + `x` on every directory. */
+    assertReadableTree(node, display) {
+      if (!this.enforcing) return;
+      this.assertAccess(node, "read", "cp", display);
+      if (node.type !== "directory") return;
+      this.assertAccess(node, "execute", "cp", display);
+      for (const child of node.children ?? []) {
+        this.assertReadableTree(child, `${display.replace(/\/+$/, "")}/${child.name}`);
+      }
+    }
+    /** Creating/removing entries needs `w` and `x` on the containing directory. */
+    assertModifyDir(dir, dirPath, op, display) {
+      if (!this.enforcing) return;
+      this.assertTraverse(dirPath, op, display);
+      this.assertAccess(dir, "execute", op, display);
+      this.assertAccess(dir, "write", op, display);
     }
     // --- User context ---
     setCurrentUser(uid, groups) {
@@ -2768,7 +2862,9 @@ var files = (() => {
       this.currentGroups = groups;
     }
     getDefaultOwnership() {
-      if (!this.currentUid) return void 0;
+      if (!this.currentUid) {
+        return this.accessPolicy ? { ...ANONYMOUS_OWNERSHIP } : void 0;
+      }
       return {
         uid: this.currentUid,
         gid: this.currentGroups[0] || "users"
@@ -2787,6 +2883,8 @@ var files = (() => {
       if (node.type !== "directory") {
         throw new Error(`cd: ${path}: Not a directory`);
       }
+      this.assertTraverse(resolved, "cd", path);
+      this.assertAccess(node, "execute", "cd", path);
       this.cwd = resolved;
     }
     getHomePath() {
@@ -2843,6 +2941,8 @@ var files = (() => {
       if (node.type !== "directory") {
         throw new Error(`ls: ${path}: Not a directory`);
       }
+      this.assertTraverse(this.resolvePath(path), "ls", path);
+      this.assertAccess(node, "read", "ls", path);
       return node.children || [];
     }
     readFile(path) {
@@ -2853,6 +2953,8 @@ var files = (() => {
       if (node.type === "directory") {
         throw new Error(`cat: ${path}: Is a directory`);
       }
+      this.assertTraverse(this.resolvePath(path), "cat", path);
+      this.assertAccess(node, "read", "cat", path);
       return node.content ?? "";
     }
     exists(path) {
@@ -2877,6 +2979,10 @@ var files = (() => {
           }
           let child = current.children.find((c) => c.name === part);
           if (!child) {
+            if (this.enforcing) {
+              this.assertAccess(current, "execute", "mkdir", path);
+              this.assertAccess(current, "write", "mkdir", path);
+            }
             const now = Date.now();
             child = {
               name: part,
@@ -2892,6 +2998,8 @@ var files = (() => {
             current.modifiedAt = now;
           } else if (child.type !== "directory") {
             throw new Error(`mkdir: ${part}: Not a directory`);
+          } else {
+            this.assertAccess(child, "execute", "mkdir", path);
           }
           current = child;
         }
@@ -2910,6 +3018,7 @@ var files = (() => {
         if (parent.children?.find((c) => c.name === dirName)) {
           throw new Error(`mkdir: ${path}: File exists`);
         }
+        this.assertModifyDir(parent, parentPath, "mkdir", path);
         const now = Date.now();
         if (!parent.children) {
           parent.children = [];
@@ -2944,6 +3053,12 @@ var files = (() => {
       }
       const existing = parent.children?.find((c) => c.name === fileName);
       const now = Date.now();
+      if (existing) {
+        this.assertTraverse(resolved, "touch", path);
+        this.assertAccess(existing, "write", "touch", path);
+      } else {
+        this.assertModifyDir(parent, parentPath, "touch", path);
+      }
       if (existing) {
         existing.modifiedAt = now;
       } else {
@@ -2970,6 +3085,8 @@ var files = (() => {
         if (node.type === "directory") {
           throw new Error(`write: ${path}: Is a directory`);
         }
+        this.assertTraverse(resolved, "write", path);
+        this.assertAccess(node, "write", "write", path);
         const now = Date.now();
         node.content = append ? (node.content ?? "") + content : content;
         node.size = new Blob([node.content]).size;
@@ -2998,6 +3115,8 @@ var files = (() => {
       if (target.type === "directory" && !recursive) {
         throw new Error(`rm: ${path}: Is a directory`);
       }
+      this.assertModifyDir(parent, parentPath, "rm", path);
+      if (target.type === "directory") this.assertRemovableTree(target, resolved, path);
       parent.children.splice(index, 1);
       parent.modifiedAt = Date.now();
     }
@@ -3012,10 +3131,13 @@ var files = (() => {
           `cp: -r not specified; omitting directory '${src}'`
         );
       }
+      this.assertTraverse(srcResolved, "cp", src);
+      this.assertReadableTree(srcNode, src);
       const destResolved = this.resolvePath(dest);
       const destNode = this.getNode(destResolved);
       if (destNode && destNode.type === "directory") {
-        const clone = this.cloneNode(srcNode);
+        this.assertModifyDir(destNode, destResolved, "cp", dest);
+        const clone = this.ownedByCurrentUser(this.cloneNode(srcNode));
         if (!destNode.children) {
           destNode.children = [];
         }
@@ -3035,7 +3157,8 @@ var files = (() => {
         if (!parent || parent.type !== "directory") {
           throw new Error(`cp: ${parentPath}: No such file or directory`);
         }
-        const clone = this.cloneNode(srcNode);
+        this.assertModifyDir(parent, parentPath, "cp", dest);
+        const clone = this.ownedByCurrentUser(this.cloneNode(srcNode));
         clone.name = newName;
         if (!parent.children) {
           parent.children = [];
@@ -3067,10 +3190,12 @@ var files = (() => {
       if (!srcParent || !srcParent.children) {
         throw new Error(`mv: ${src}: No such file or directory`);
       }
+      this.assertModifyDir(srcParent, srcParentPath, "mv", src);
       const srcIndex = srcParent.children.findIndex(
         (c) => c.name === srcNode.name
       );
       if (destNode && destNode.type === "directory") {
+        this.assertModifyDir(destNode, destResolved, "mv", dest);
         if (!destNode.children) {
           destNode.children = [];
         }
@@ -3093,6 +3218,7 @@ var files = (() => {
             `mv: ${destParentPath}: No such file or directory`
           );
         }
+        this.assertModifyDir(destParent, destParentPath, "mv", dest);
         srcParent.children.splice(srcIndex, 1);
         srcNode.name = newName;
         if (!destParent.children) {
@@ -3116,6 +3242,9 @@ var files = (() => {
       if (!node) {
         throw new Error(`chmod: ${path}: No such file or directory`);
       }
+      if (this.enforcing && !this.accessPolicy.canChangeOwnership(node)) {
+        this.deny("chmod", path, "Operation not permitted");
+      }
       node.permissions = permissions;
     }
     chown(path, ownership) {
@@ -3124,6 +3253,9 @@ var files = (() => {
       if (!node) {
         throw new Error(`chown: ${path}: No such file or directory`);
       }
+      if (this.enforcing && !this.accessPolicy.canChangeOwnership(node, ownership)) {
+        this.deny("chown", path, "Operation not permitted");
+      }
       node.ownership = ownership;
     }
     // --- Persistence ---
@@ -3165,6 +3297,18 @@ var files = (() => {
       }
     }
     // --- Private helpers ---
+    /** A copy belongs to whoever made it (like `cp` without `-p`) */
+    ownedByCurrentUser(node) {
+      const owner = this.getDefaultOwnership();
+      if (owner) {
+        const apply = (n) => {
+          n.ownership = { ...owner };
+          n.children?.forEach(apply);
+        };
+        apply(node);
+      }
+      return node;
+    }
     cloneNode(node) {
       const now = Date.now();
       const clone = {
@@ -3773,6 +3917,16 @@ var files = (() => {
     }
   };
 
+  // src/lib/utils/readable-children.ts
+  function readableChildren(fs, path) {
+    try {
+      return fs.listDirectory(path);
+    } catch (e) {
+      if (isCliAccessDeniedError(e)) return null;
+      throw e;
+    }
+  }
+
   // src/lib/processors/cli-tree-command-processor.ts
   var CliTreeCommandProcessor = class {
     constructor() {
@@ -3820,7 +3974,8 @@ var files = (() => {
           )
         );
         const counts = { dirs: 0, files: 0 };
-        this.printTree(node, "", true, 0, maxDepth, context, counts);
+        this.fs = fs;
+        this.printTree(node, "", true, 0, maxDepth, context, counts, resolvedPath);
         context.writer.writeln();
         context.writer.writeln(
           `${counts.dirs} directories, ${counts.files} files`
@@ -3829,11 +3984,15 @@ var files = (() => {
         context.writer.writeError(e.message);
       }
     }
-    printTree(node, prefix, isRoot, depth, maxDepth, context, counts) {
-      if (!node.children || depth >= maxDepth) {
+    printTree(node, prefix, isRoot, depth, maxDepth, context, counts, path = "/") {
+      if (depth >= maxDepth) {
+        return;
+      }
+      const visible = this.fs ? readableChildren(this.fs, path) : node.children;
+      if (!visible) {
         return;
       }
-      const children = [...node.children].sort((a, b) => {
+      const children = [...visible].sort((a, b) => {
         if (a.type !== b.type) {
           return a.type === "directory" ? -1 : 1;
         }
@@ -3858,7 +4017,8 @@ var files = (() => {
             depth + 1,
             maxDepth,
             context,
-            counts
+            counts,
+            path === "/" ? `/${child.name}` : `${path}/${child.name}`
           );
         } else {
           counts.files++;
@@ -4156,6 +4316,7 @@ var files = (() => {
         const resolvedBase = fs.resolvePath(searchPath);
         const nameRegex = namePattern ? this.globToRegex(namePattern) : null;
         const results = [];
+        this.fs = fs;
         this.walk(
           node,
           resolvedBase,
@@ -4183,8 +4344,9 @@ var files = (() => {
       return new RegExp(`^${regexStr}$`, "i");
     }
     walk(node, currentPath, depth, maxDepth, nameRegex, typeFilter, results) {
-      if (!node.children) return;
-      for (const child of node.children) {
+      const children = this.fs ? readableChildren(this.fs, currentPath) : node.children;
+      if (!children) return;
+      for (const child of children) {
         const childPath = currentPath === "/" ? `/${child.name}` : `${currentPath}/${child.name}`;
         let matches = true;
         if (nameRegex && !nameRegex.test(child.name)) {
@@ -4417,8 +4579,9 @@ var files = (() => {
       };
     }
     collectFiles(fs, basePath, node, result) {
-      if (!node.children) return;
-      for (const child of node.children) {
+      const children = readableChildren(fs, basePath);
+      if (!children) return;
+      for (const child of children) {
         const childPath = basePath === "/" ? `/${child.name}` : `${basePath}/${child.name}`;
         if (child.type === "file") {
           result.push(childPath);