@ryuu-reinzz/ryuu-cli 0.4.2 → 0.5.0

package/plugins/google-drive/config.js

@@ -0,0 +1,252 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { ConfigError } from '../../src/utils/errors.js';
+import { settingsDir } from '../../src/config/settings.js';
+
+/**
+ * Configuration for the google-drive plugin.
+ *
+ * The non-sensitive settings live next to the user's config.json:
+ *   <config dir>/integrations/google-drive/config.json
+ * and the OAuth tokens received from the API backend live beside them in
+ * `credentials.enc`.
+ *
+ * No Google Client ID or Client Secret exists in the CLI: both belong to the
+ * root `website/api` project, which exposes `/admin/tools/drive-cli`. The
+ * backend URL is a constant, so no command or environment variable can
+ * redirect credentials elsewhere.
+ */
+export const DEFAULT_GOOGLE_DRIVE_CONFIG = Object.freeze({
+  scopes: Object.freeze(['https://www.googleapis.com/auth/drive.file']),
+  enabled: false,
+  autoRefresh: true,
+  // Backend OAuth milik proyek website/api. Keduanya konstanta aplikasi:
+  // tidak ada command / env var yang boleh mengubahnya, dan CLI tidak
+  // pernah menyimpan Client ID maupun Client Secret Google.
+  oauthBackend: 'https://restapi.ryuu-dev.my.id',
+  oauthCliPath: '/admin/tools/drive-cli',
+  defaultBackupFolder: null,
+  backupDirectory: 'Backups',
+  confirmDestructive: true,
+  maxUploadSize: 1073741824,
+  excludePatterns: Object.freeze([
+    'node_modules',
+    '.git',
+    '.env',
+    '.env.*',
+    '*.pem',
+    '*.key',
+    '*.p12',
+    '*.pfx',
+    'credentials.json',
+    'service-account*.json',
+    '*.log',
+    'cache',
+    'tmp',
+    'temp',
+  ]),
+});
+
+/** Keys the user may change with `/drive config set` (credentials are not). */
+export const EDITABLE_KEYS = Object.freeze([
+  'enabled',
+  'defaultBackupFolder',
+  'backupDirectory',
+  'excludePatterns',
+  'maxUploadSize',
+  'confirmDestructive',
+  'autoRefresh',
+]);
+
+// Client ID, Client Secret, endpoint backend, scope, dan kunci login Drive
+// (lihat secret.js) adalah milik aplikasi: tidak ada jalur command untuk
+// mengubahnya, jadi tidak ada nilai sensitif yang bisa ditanamkan lewat config.
+const BLOCKED_KEYS = new Set([
+  'clientId',
+  'clientSecret',
+  'scopes',
+  'oauthBackend',
+  'oauthCliPath',
+  'rootKey',
+  'driveKey',
+  'secret',
+  '__proto__',
+  'prototype',
+  'constructor',
+]);
+
+/** Absolute paths of the integration's own files. */
+export function drivePaths({ env = process.env, home = undefined, platform = undefined } = {}) {
+  const root = path.join(settingsDir({ env, home, platform }), 'integrations', 'google-drive');
+  return {
+    dir: root,
+    configFile: path.join(root, 'config.json'),
+    credentialFile: path.join(root, 'credentials.enc'),
+    // The encryption key lives outside the integration folder on purpose: the
+    // key and the ciphertext must not travel together.
+    keyFile: path.join(settingsDir({ env, home, platform }), '.keys', 'google-drive.key'),
+  };
+}
+
+function boolValue(name, value, issues) {
+  if (typeof value === 'boolean') return value;
+  const text = String(value ?? '').trim().toLowerCase();
+  if (['1', 'true', 'yes', 'y', 'on', 'enable', 'enabled', 'aktif'].includes(text)) return true;
+  if (['0', 'false', 'no', 'n', 'off', 'disable', 'disabled', 'nonaktif'].includes(text)) return false;
+  issues.push(`${name} harus berupa boolean (true/false), diterima: ${JSON.stringify(value)}`);
+  return undefined;
+}
+
+/** Validate one `/drive config set <key> <value>` write. */
+export function validateConfigEntry(key, rawValue) {
+  const name = String(key ?? '').trim();
+  if (BLOCKED_KEYS.has(name)) {
+    throw new ConfigError(
+      `Key "${name}" tidak dapat diubah: Client ID/Secret Google, endpoint backend, dan kunci login Drive dikelola aplikasi (proyek API) dan tidak boleh diubah dari command.`,
+    );
+  }
+  if (!EDITABLE_KEYS.includes(name)) {
+    throw new ConfigError(
+      `Key tidak dikenal: "${name}". Key yang didukung: ${EDITABLE_KEYS.join(', ')}.`,
+    );
+  }
+  const issues = [];
+  let value;
+  switch (name) {
+    case 'enabled':
+    case 'confirmDestructive':
+    case 'autoRefresh':
+      value = boolValue(name, rawValue, issues);
+      break;
+    case 'defaultBackupFolder': {
+      const text = String(rawValue ?? '').trim();
+      if (!text || ['none', 'null', '-', 'off'].includes(text.toLowerCase())) value = null;
+      else if (!/^[A-Za-z0-9_-]{10,200}$/.test(text)) {
+        issues.push('defaultBackupFolder harus berupa folder ID Google Drive (10-200 karakter huruf/angka/-/_).');
+      } else value = text;
+      break;
+    }
+    case 'backupDirectory': {
+      const text = String(rawValue ?? '').trim().replace(/^\/+|\/+$/g, '');
+      if (!text) issues.push('backupDirectory tidak boleh kosong.');
+      else if (text.length > 120 || text.split('/').some((part) => part === '..')) {
+        issues.push('backupDirectory tidak valid: gunakan nama folder biasa (maksimal 120 karakter, tanpa "..").');
+      } else value = text;
+      break;
+    }
+    case 'excludePatterns': {
+      const text = String(rawValue ?? '').trim();
+      if (['none', 'empty', '-'].includes(text.toLowerCase())) value = [];
+      else value = text.split(',').map((part) => part.trim()).filter(Boolean);
+      if (Array.isArray(value) && value.some((pattern) => pattern.includes('..') || pattern.length > 100)) {
+        issues.push('excludePatterns berisi pola yang tidak valid (tanpa ".." dan maksimal 100 karakter per pola).');
+      }
+      break;
+    }
+    case 'maxUploadSize': {
+      const parsed = Number(String(rawValue ?? '').trim());
+      if (!Number.isFinite(parsed) || !Number.isInteger(parsed)) issues.push('maxUploadSize harus berupa angka byte.');
+      else if (parsed < 1024 || parsed > 1073741824) {
+        issues.push('maxUploadSize harus antara 1024 dan 1073741824 byte (1 GB).');
+      } else value = parsed;
+      break;
+    }
+    default:
+      issues.push(`Key tidak dikenal: ${name}`);
+  }
+  if (issues.length > 0) throw new ConfigError(issues.join(' '), { key: name });
+  return value;
+}
+
+function normalize(data) {
+  const source = data && typeof data === 'object' && !Array.isArray(data) ? data : {};
+  // Only keys the application knows about survive; anything else (in
+  // particular credentials smuggled into the file by hand) is dropped.
+  const stored = {};
+  for (const key of Object.keys(DEFAULT_GOOGLE_DRIVE_CONFIG)) {
+    if (key in source) stored[key] = source[key];
+  }
+  const merged = { ...DEFAULT_GOOGLE_DRIVE_CONFIG, ...stored };
+  // These are application-owned and always come from the defaults.
+  merged.scopes = [...DEFAULT_GOOGLE_DRIVE_CONFIG.scopes];
+  merged.oauthBackend = DEFAULT_GOOGLE_DRIVE_CONFIG.oauthBackend;
+  merged.oauthCliPath = DEFAULT_GOOGLE_DRIVE_CONFIG.oauthCliPath;
+  merged.enabled = Boolean(merged.enabled);
+  merged.autoRefresh = merged.autoRefresh !== false;
+  merged.confirmDestructive = merged.confirmDestructive !== false;
+  merged.defaultBackupFolder =
+    typeof merged.defaultBackupFolder === 'string' && merged.defaultBackupFolder.trim()
+      ? merged.defaultBackupFolder.trim()
+      : null;
+  merged.backupDirectory =
+    typeof merged.backupDirectory === 'string' && merged.backupDirectory.trim()
+      ? merged.backupDirectory.trim().replace(/^\/+|\/+$/g, '')
+      : DEFAULT_GOOGLE_DRIVE_CONFIG.backupDirectory;
+  merged.maxUploadSize = Number.isInteger(merged.maxUploadSize)
+    ? merged.maxUploadSize
+    : DEFAULT_GOOGLE_DRIVE_CONFIG.maxUploadSize;
+  merged.excludePatterns = Array.isArray(merged.excludePatterns)
+    ? merged.excludePatterns.map((item) => String(item)).filter(Boolean)
+    : [...DEFAULT_GOOGLE_DRIVE_CONFIG.excludePatterns];
+  return merged;
+}
+
+/** Read the integration config; a missing file yields the built-in defaults. */
+export async function readDriveConfig({ paths = drivePaths() } = {}) {
+  let text;
+  try {
+    text = await fsp.readFile(paths.configFile, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return normalize({});
+    throw new ConfigError(`Tidak dapat membaca konfigurasi Google Drive (${paths.configFile}): ${error.message}`);
+  }
+  try {
+    return normalize(JSON.parse(text));
+  } catch (error) {
+    throw new ConfigError(
+      `Konfigurasi Google Drive tidak valid (${paths.configFile}): ${error.message}. File tidak diubah — perbaiki atau hapus file tersebut.`,
+    );
+  }
+}
+
+/** Write the integration config atomically with owner-only permissions. */
+export async function writeDriveConfig(config, { paths = drivePaths() } = {}) {
+  const data = normalize(config);
+  await fsp.mkdir(paths.dir, { recursive: true, mode: 0o700 });
+  const tmp = path.join(paths.dir, `.config.${process.pid}.${randomBytes(6).toString('hex')}.tmp`);
+  try {
+    await fsp.writeFile(tmp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+    await fsp.rename(tmp, paths.configFile);
+    if (process.platform !== 'win32') await fsp.chmod(paths.configFile, 0o600).catch(() => {});
+  } catch (error) {
+    await fsp.rm(tmp, { force: true }).catch(() => {});
+    throw new ConfigError(`Gagal menyimpan konfigurasi Google Drive: ${error.message}`);
+  }
+  return data;
+}
+
+/** Read-modify-write one setting so concurrent saves are not lost. */
+export async function updateDriveConfig(key, value, { paths = drivePaths() } = {}) {
+  const current = await readDriveConfig({ paths });
+  current[key] = value;
+  return writeDriveConfig(current, { paths });
+}
+
+/** Short human-readable view of the non-sensitive configuration. */
+export function describeDriveConfig(config) {
+  return {
+    enabled: config.enabled ? 'true' : 'false',
+    autoRefresh: config.autoRefresh ? 'true' : 'false',
+    oauthBackend: config.oauthBackend,
+    oauthCliPath: config.oauthCliPath,
+    loginKey: 'bawaan aplikasi (tidak dapat diubah, tidak pernah ditampilkan)',
+    confirmDestructive: config.confirmDestructive ? 'true' : 'false',
+    defaultBackupFolder: config.defaultBackupFolder || '(belum diatur)',
+    backupDirectory: config.backupDirectory,
+    maxUploadSize: `${config.maxUploadSize} byte`,
+    excludePatterns: config.excludePatterns.join(', ') || '(kosong)',
+    scopes: config.scopes.join(', '),
+    credentials: 'disimpan di backend API (CLI tidak memegang Client ID/Secret)',
+  };
+}

package/plugins/google-drive/credentials.js

@@ -0,0 +1,171 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { RyuuError } from '../../src/utils/errors.js';
+
+/**
+ * Credential storage for the google-drive integration.
+ *
+ * Tokens are never written in plaintext. The file is AES-256-GCM encrypted and
+ * the key lives in a different directory (`<config>/.keys/google-drive.key`,
+ * mode 0600) so a copied credential file is useless on its own. `RYUU_DRIVE_KEY`
+ * (hex or base64, 32 bytes) can supply the key instead, which is what a VPS or
+ * a secret manager should use.
+ *
+ * Nothing in this module ever logs or returns a token to the UI: callers get
+ * metadata only.
+ */
+
+const KEY_BYTES = 32;
+const MAGIC = 'RYUUDRIVE1';
+
+function credentialError(message, { cause = null } = {}) {
+  return new RyuuError(message, { code: 'DRIVE_CREDENTIAL', cause });
+}
+
+function decodeEnvKey(raw) {
+  const text = String(raw || '').trim();
+  if (!text) return null;
+  const buffer = /^[0-9a-fA-F]{64}$/.test(text) ? Buffer.from(text, 'hex') : Buffer.from(text, 'base64');
+  if (buffer.length !== KEY_BYTES) {
+    throw credentialError('RYUU_DRIVE_KEY tidak valid: butuh 32 byte (hex 64 karakter atau base64).');
+  }
+  return buffer;
+}
+
+async function readOrCreateKey(keyFile, { env = process.env } = {}) {
+  const fromEnv = decodeEnvKey(env.RYUU_DRIVE_KEY);
+  if (fromEnv) return fromEnv;
+  try {
+    const existing = await fsp.readFile(keyFile);
+    if (existing.length === KEY_BYTES) return existing;
+    throw credentialError(`File kunci Google Drive rusak (${keyFile}). Hapus file tersebut lalu jalankan /drive login.`);
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+  const key = crypto.randomBytes(KEY_BYTES);
+  await fsp.mkdir(path.dirname(keyFile), { recursive: true, mode: 0o700 });
+  // `wx` fails if another process created it first; read theirs in that case.
+  try {
+    await fsp.writeFile(keyFile, key, { mode: 0o600, flag: 'wx' });
+    if (process.platform !== 'win32') await fsp.chmod(keyFile, 0o600).catch(() => {});
+    return key;
+  } catch (error) {
+    if (error.code !== 'EEXIST') throw credentialError(`Gagal menyimpan kunci kredensial: ${error.message}`);
+    const again = await fsp.readFile(keyFile);
+    if (again.length !== KEY_BYTES) throw credentialError(`File kunci Google Drive rusak (${keyFile}).`);
+    return again;
+  }
+}
+
+/**
+ * Encrypt and store the OAuth tokens.
+ *
+ * Only the fields below are persisted; anything else is dropped so an API
+ * response can never smuggle a token into the file by accident.
+ */
+export async function saveCredentials({ tokens, account = null }, { paths, env = process.env } = {}) {
+  if (!tokens || typeof tokens !== 'object') throw credentialError('Token OAuth tidak tersedia.');
+  const payload = {
+    version: 2,
+    // Izin sempit dari backend: cukup untuk refresh/revoke tanpa kunci aplikasi.
+    grantId: typeof tokens.grant_id === 'string' ? tokens.grant_id : null,
+    accessToken: typeof tokens.access_token === 'string' ? tokens.access_token : null,
+    refreshToken: typeof tokens.refresh_token === 'string' ? tokens.refresh_token : null,
+    expiryDate: Number.isFinite(tokens.expiry_date) ? tokens.expiry_date : null,
+    tokenType: typeof tokens.token_type === 'string' ? tokens.token_type : 'Bearer',
+    scope: typeof tokens.scope === 'string' ? tokens.scope : '',
+    account: account
+      ? {
+          email: account.email || null,
+          name: account.name || null,
+          permissionId: account.permissionId || null,
+          storageQuota: account.storageQuota || null,
+        }
+      : null,
+    savedAt: new Date().toISOString(),
+  };
+  const key = await readOrCreateKey(paths.keyFile, { env });
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const encrypted = Buffer.concat([cipher.update(JSON.stringify(payload), 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const file = Buffer.concat([Buffer.from(MAGIC, 'utf8'), iv, tag, encrypted]);
+
+  await fsp.mkdir(paths.dir, { recursive: true, mode: 0o700 });
+  const tmp = `${paths.credentialFile}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+  try {
+    await fsp.writeFile(tmp, file, { mode: 0o600 });
+    await fsp.rename(tmp, paths.credentialFile);
+    if (process.platform !== 'win32') await fsp.chmod(paths.credentialFile, 0o600).catch(() => {});
+  } catch (error) {
+    await fsp.rm(tmp, { force: true }).catch(() => {});
+    throw credentialError(`Gagal menyimpan kredensial Google Drive: ${error.message}`);
+  }
+  return { file: paths.credentialFile, savedAt: payload.savedAt };
+}
+
+/** Read and decrypt the stored tokens. Returns null when nothing is stored. */
+export async function loadCredentials({ paths, env = process.env } = {}) {
+  let raw;
+  try {
+    raw = await fsp.readFile(paths.credentialFile);
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    if (error.code === 'EACCES' || error.code === 'EPERM') {
+      throw credentialError(`Izin ditolak saat membaca kredensial Google Drive (${paths.credentialFile}).`);
+    }
+    throw credentialError(`Gagal membaca kredensial Google Drive: ${error.message}`);
+  }
+  if (raw.length < MAGIC.length + 28) throw credentialError('File kredensial Google Drive rusak. Jalankan /drive login.');
+  if (raw.subarray(0, MAGIC.length).toString('utf8') !== MAGIC) {
+    throw credentialError('Format file kredensial Google Drive tidak dikenali. Jalankan /drive login.');
+  }
+  let key;
+  try {
+    key = await readOrCreateKey(paths.keyFile, { env });
+  } catch (error) {
+    if (error.code === 'DRIVE_CREDENTIAL') throw error;
+    throw credentialError(`Kunci kredensial Google Drive tidak tersedia: ${error.message}`);
+  }
+  const iv = raw.subarray(MAGIC.length, MAGIC.length + 12);
+  const tag = raw.subarray(MAGIC.length + 12, MAGIC.length + 28);
+  const body = raw.subarray(MAGIC.length + 28);
+  try {
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const json = Buffer.concat([decipher.update(body), decipher.final()]).toString('utf8');
+    return JSON.parse(json);
+  } catch {
+    throw credentialError(
+      'Kredensial Google Drive tidak dapat didekripsi (kunci berbeda atau file rusak). Jalankan /drive login untuk menghubungkan ulang.',
+    );
+  }
+}
+
+/** Delete the stored credentials. The encryption key is removed too. */
+export async function clearCredentials({ paths, env = process.env } = {}) {
+  let removed = false;
+  try {
+    await fsp.rm(paths.credentialFile, { force: true });
+    removed = true;
+  } catch (error) {
+    throw credentialError(`Gagal menghapus kredensial Google Drive: ${error.message}`);
+  }
+  if (!env.RYUU_DRIVE_KEY) await fsp.rm(paths.keyFile, { force: true }).catch(() => {});
+  return removed;
+}
+
+/** Metadata only — safe to print. Never contains a token. */
+export function describeCredentials(stored) {
+  if (!stored) return { connected: false };
+  return {
+    connected: Boolean(stored.refreshToken || stored.accessToken || stored.grantId),
+    hasRefreshToken: Boolean(stored.refreshToken || stored.grantId),
+    expiresAt: stored.expiryDate ? new Date(stored.expiryDate).toISOString() : null,
+    scope: stored.scope || '',
+    email: stored.account?.email || null,
+    name: stored.account?.name || null,
+    savedAt: stored.savedAt || null,
+  };
+}