@securecoms/agent-bridge 0.11.0 → 0.11.1

package/dist/attachments.d.ts

@@ -18,9 +18,11 @@ export type AttachmentMeta = {
     sha256: string;
 };
 export interface ReceiveDeps {
+    /** Warm libsodium before any WASM-backed call. See src/sodium-ready.ts. */
+    ready(): Promise<void>;
     downloadBlob(blobId: string): Promise<Uint8Array>;
-    decryptFile(enc: Uint8Array, key: Uint8Array, nonce: Uint8Array): Uint8Array;
-    computeFileDigest(b: Uint8Array): string;
+    decryptFile(enc: Uint8Array, key: Uint8Array, nonce: Uint8Array): Promise<Uint8Array>;
+    computeFileDigest(b: Uint8Array): Promise<string>;
     base64ToBytes(s: string): Uint8Array;
     mkdirp(dir: string): Promise<void>;
     writeFile(p: string, data: Uint8Array): Promise<void>;
@@ -30,13 +32,15 @@ export interface ReceiveDeps {
 export declare function sanitizeFilename(name: string, fallback: string): string;
 export declare function mimeForName(name: string): string;
 export interface SendDeps {
+    /** Warm libsodium before any WASM-backed call. See src/sodium-ready.ts. */
+    ready(): Promise<void>;
     uploadBlob(ciphertext: Uint8Array, channelId: string): Promise<string>;
-    encryptFile(b: Uint8Array): {
+    encryptFile(b: Uint8Array): Promise<{
         encryptedData: Uint8Array;
         fileKey: Uint8Array;
         fileNonce: Uint8Array;
         digest: string;
-    };
+    }>;
     bytesToBase64(b: Uint8Array): string;
     readFile(p: string): Promise<Uint8Array>;
 }

package/dist/attachments.js

@@ -0,0 +1,49 @@
+import { basename } from "node:path";
+/** Reduce any name to a safe basename inside the target dir. Strips path
+ *  separators and `..`; falls back when nothing usable remains. */
+export function sanitizeFilename(name, fallback) {
+    const base = basename(name ?? "");
+    const cleaned = base.replace(/[/\\]/g, "").replace(/^\.+$/, "");
+    return cleaned.length > 0 ? cleaned : fallback;
+}
+const MIME_BY_EXT = {
+    png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif",
+    webp: "image/webp", svg: "image/svg+xml", pdf: "application/pdf",
+    txt: "text/plain", md: "text/markdown", json: "application/json",
+    csv: "text/csv", html: "text/html", mp4: "video/mp4", mp3: "audio/mpeg",
+    zip: "application/zip", wav: "audio/wav",
+};
+export function mimeForName(name) {
+    const dot = name.lastIndexOf(".");
+    if (dot < 0 || dot === name.length - 1)
+        return "application/octet-stream";
+    return MIME_BY_EXT[name.slice(dot + 1).toLowerCase()] ?? "application/octet-stream";
+}
+export async function prepareAttachment(filePath, caption, channelId, deps) {
+    const bytes = await deps.readFile(filePath);
+    const name = basename(filePath);
+    const { encryptedData, fileKey, fileNonce, digest } = deps.encryptFile(bytes);
+    const blobId = await deps.uploadBlob(encryptedData, channelId);
+    const body = {
+        v: 1, type: "artifact_share", name, mime: mimeForName(name), size: bytes.length,
+        blobId, fileKey: deps.bytesToBase64(fileKey), fileNonce: deps.bytesToBase64(fileNonce), digest,
+    };
+    if (caption)
+        body.text = caption;
+    return body;
+}
+export async function materializeAttachment(body, ctx, deps) {
+    const ciphertext = await deps.downloadBlob(body.blobId);
+    // Verify digest on ciphertext BEFORE decrypting — tampered blobs fail here.
+    const sha256 = deps.computeFileDigest(ciphertext);
+    if (sha256 !== body.digest) {
+        throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
+    }
+    const plain = deps.decryptFile(ciphertext, deps.base64ToBytes(body.fileKey), deps.base64ToBytes(body.fileNonce));
+    const safeName = sanitizeFilename(body.name, ctx.messageId);
+    const dir = `${ctx.attachmentsDir}/${ctx.channelId}`;
+    const path = `${dir}/${ctx.messageId}-${safeName}`;
+    await deps.mkdirp(dir);
+    await deps.writeFile(path, plain);
+    return { filename: safeName, mime: body.mime, size: plain.length, path, sha256 };
+}

package/dist/auth.js

@@ -0,0 +1,56 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { isLoopback } from "./config.js";
+export function resolveToken(opts) {
+    if (opts.token)
+        return opts.token;
+    const f = opts.tokenFile;
+    if (f && existsSync(f))
+        return readFileSync(f, "utf8").trim();
+    const tok = randomBytes(32).toString("base64url");
+    if (f)
+        writeFileSync(f, tok, { mode: 0o600 });
+    return tok;
+}
+export function tokenMatches(provided, expected) {
+    if (!provided)
+        return false;
+    const a = Buffer.from(provided);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+export function bearerFrom(header) {
+    if (!header)
+        return undefined;
+    const m = /^Bearer (.+)$/i.exec(header.trim());
+    return m ? m[1] : undefined;
+}
+function hostnameOf(hostHeader) {
+    if (!hostHeader)
+        return undefined;
+    // Strip an optional :port (but keep [::1] intact).
+    if (hostHeader.startsWith("["))
+        return hostHeader.slice(0, hostHeader.indexOf("]") + 1);
+    const i = hostHeader.lastIndexOf(":");
+    return i > 0 ? hostHeader.slice(0, i) : hostHeader;
+}
+export function originHostAllowed(headers, allowOrigins) {
+    // Host must be a loopback name (blocks the DNS-rebind target Host: evil.com).
+    const host = hostnameOf(headers.host);
+    if (host && !isLoopback(host) && !isLoopback(`[${host}]`))
+        return false;
+    // Origin: absent → allow (non-browser). Present → must be loopback or allow-listed.
+    const origin = headers.origin;
+    if (!origin)
+        return true;
+    if (allowOrigins.includes(origin))
+        return true;
+    try {
+        return isLoopback(new URL(origin).hostname);
+    }
+    catch {
+        return false;
+    }
+}