@securecoms/agent-bridge 0.3.2 → 0.5.0

package/dist/attachments.js

@@ -1,49 +0,0 @@
-import { basename } from "node:path";
-/** Reduce any name to a safe basename inside the target dir. Strips path
- *  separators and `..`; falls back when nothing usable remains. */
-export function sanitizeFilename(name, fallback) {
-    const base = basename(name ?? "");
-    const cleaned = base.replace(/[/\\]/g, "").replace(/^\.+$/, "");
-    return cleaned.length > 0 ? cleaned : fallback;
-}
-const MIME_BY_EXT = {
-    png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif",
-    webp: "image/webp", svg: "image/svg+xml", pdf: "application/pdf",
-    txt: "text/plain", md: "text/markdown", json: "application/json",
-    csv: "text/csv", html: "text/html", mp4: "video/mp4", mp3: "audio/mpeg",
-    zip: "application/zip", wav: "audio/wav",
-};
-export function mimeForName(name) {
-    const dot = name.lastIndexOf(".");
-    if (dot < 0 || dot === name.length - 1)
-        return "application/octet-stream";
-    return MIME_BY_EXT[name.slice(dot + 1).toLowerCase()] ?? "application/octet-stream";
-}
-export async function prepareAttachment(filePath, caption, channelId, deps) {
-    const bytes = await deps.readFile(filePath);
-    const name = basename(filePath);
-    const { encryptedData, fileKey, fileNonce, digest } = deps.encryptFile(bytes);
-    const blobId = await deps.uploadBlob(encryptedData, channelId);
-    const body = {
-        v: 1, type: "artifact_share", name, mime: mimeForName(name), size: bytes.length,
-        blobId, fileKey: deps.bytesToBase64(fileKey), fileNonce: deps.bytesToBase64(fileNonce), digest,
-    };
-    if (caption)
-        body.text = caption;
-    return body;
-}
-export async function materializeAttachment(body, ctx, deps) {
-    const ciphertext = await deps.downloadBlob(body.blobId);
-    // Verify digest on ciphertext BEFORE decrypting — tampered blobs fail here.
-    const sha256 = deps.computeFileDigest(ciphertext);
-    if (sha256 !== body.digest) {
-        throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
-    }
-    const plain = deps.decryptFile(ciphertext, deps.base64ToBytes(body.fileKey), deps.base64ToBytes(body.fileNonce));
-    const safeName = sanitizeFilename(body.name, ctx.messageId);
-    const dir = `${ctx.attachmentsDir}/${ctx.channelId}`;
-    const path = `${dir}/${ctx.messageId}-${safeName}`;
-    await deps.mkdirp(dir);
-    await deps.writeFile(path, plain);
-    return { filename: safeName, mime: body.mime, size: plain.length, path, sha256 };
-}

package/dist/auth.js

@@ -1,56 +0,0 @@
-import { randomBytes, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { isLoopback } from "./config.js";
-export function resolveToken(opts) {
-    if (opts.token)
-        return opts.token;
-    const f = opts.tokenFile;
-    if (f && existsSync(f))
-        return readFileSync(f, "utf8").trim();
-    const tok = randomBytes(32).toString("base64url");
-    if (f)
-        writeFileSync(f, tok, { mode: 0o600 });
-    return tok;
-}
-export function tokenMatches(provided, expected) {
-    if (!provided)
-        return false;
-    const a = Buffer.from(provided);
-    const b = Buffer.from(expected);
-    if (a.length !== b.length)
-        return false;
-    return timingSafeEqual(a, b);
-}
-export function bearerFrom(header) {
-    if (!header)
-        return undefined;
-    const m = /^Bearer (.+)$/i.exec(header.trim());
-    return m ? m[1] : undefined;
-}
-function hostnameOf(hostHeader) {
-    if (!hostHeader)
-        return undefined;
-    // Strip an optional :port (but keep [::1] intact).
-    if (hostHeader.startsWith("["))
-        return hostHeader.slice(0, hostHeader.indexOf("]") + 1);
-    const i = hostHeader.lastIndexOf(":");
-    return i > 0 ? hostHeader.slice(0, i) : hostHeader;
-}
-export function originHostAllowed(headers, allowOrigins) {
-    // Host must be a loopback name (blocks the DNS-rebind target Host: evil.com).
-    const host = hostnameOf(headers.host);
-    if (host && !isLoopback(host) && !isLoopback(`[${host}]`))
-        return false;
-    // Origin: absent → allow (non-browser). Present → must be loopback or allow-listed.
-    const origin = headers.origin;
-    if (!origin)
-        return true;
-    if (allowOrigins.includes(origin))
-        return true;
-    try {
-        return isLoopback(new URL(origin).hostname);
-    }
-    catch {
-        return false;
-    }
-}