@serverkgg/bridge 0.0.21 → 0.1.2

package/src/runtime/bridgeRedaction.test.ts

@@ -0,0 +1,410 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { BridgeKind } from "../core";
+import type { BridgeDriver } from "../modules";
+import { BridgeControl, BridgeFormTarget, BridgeLayout, type BridgeTab } from "../panel";
+import type { BridgeConfig } from "../protocol";
+import { createBridgeLiveConfig } from "./bridgeLiveConfig";
+import type { BridgeLeveledLogger } from "./bridgeLog";
+import { createBridgeRedaction, REDACTED, redactLocalized, redactLogger, secretFieldKeys } from "./bridgeRedaction";
+
+const text = (value: string) => ({
+	ar: value,
+	en: value,
+});
+
+const TOKEN = "123456789:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw";
+
+const driverWith = (tabs: BridgeTab[]): BridgeDriver => ({
+	install: {
+		kind: BridgeKind.Install,
+		run: async () => undefined,
+	},
+	lifecycle: {
+		kind: BridgeKind.Lifecycle,
+		command: async () => [
+			"run",
+		],
+	},
+	panel: {
+		tabs,
+	},
+});
+
+const secretsTab: BridgeTab = {
+	id: "bot",
+	title: text("Bot"),
+	sections: [
+		{
+			layout: BridgeLayout.Form,
+			id: "token",
+			target: BridgeFormTarget.Variables,
+			fields: [
+				{
+					key: "BOT_PLATFORM",
+					control: BridgeControl.Select,
+					label: text("Platform"),
+				},
+				{
+					key: "BOT_TOKEN",
+					control: BridgeControl.Secret,
+					label: text("Token"),
+				},
+			],
+		},
+		{
+			layout: BridgeLayout.Form,
+			id: "source",
+			target: BridgeFormTarget.Variables,
+			fields: [
+				{
+					key: "GIT_TOKEN",
+					control: BridgeControl.Secret,
+					label: text("Git token"),
+				},
+				{
+					key: "BOT_TOKEN",
+					control: BridgeControl.Secret,
+					label: text("Token again"),
+				},
+			],
+		},
+	],
+};
+
+const sourceOf = (initial: Record<string, string>, secrets: Record<string, string> = {}) => {
+	let variables: Readonly<Record<string, string>> = initial;
+	let current: Readonly<Record<string, string>> = secrets;
+
+	return {
+		source: {
+			variables: () => variables,
+			secrets: () => current,
+		},
+		save(next: Record<string, string>) {
+			variables = next;
+		},
+		seal(next: Record<string, string>) {
+			current = next;
+		},
+	};
+};
+
+describe("secretFieldKeys", () => {
+	test("collects every secret form field once and nothing else", () => {
+		expect(
+			secretFieldKeys(
+				driverWith([
+					secretsTab,
+				]),
+			),
+		).toEqual([
+			"BOT_TOKEN",
+			"GIT_TOKEN",
+		]);
+	});
+
+	test("finds nothing in a driver with no secret fields", () => {
+		expect(secretFieldKeys(driverWith([]))).toEqual([]);
+	});
+});
+
+describe("createBridgeRedaction", () => {
+	test("is built for every driver and leaves text alone until a secret exists", () => {
+		const { source, seal } = sourceOf({});
+		const redact = createBridgeRedaction([], source);
+
+		expect(redact(`token ${TOKEN}`)).toBe(`token ${TOKEN}`);
+
+		seal({
+			DISCORD_TOKEN: TOKEN,
+		});
+
+		expect(redact(`token ${TOKEN}`)).toBe(`token ${REDACTED}`);
+	});
+
+	test("blanks the platform secrets the manifest declares, with the same length floor", () => {
+		const redact = createBridgeRedaction(
+			[],
+			sourceOf(
+				{},
+				{
+					CURSEFORGE_API_KEY: "cf-api-key-0123456789",
+					SHORT_KEY: "short",
+				},
+			).source,
+		);
+
+		expect(redact("key cf-api-key-0123456789 and short")).toBe(`key ${REDACTED} and short`);
+	});
+
+	test("blanks secret fields and platform secrets together", () => {
+		const redact = createBridgeRedaction(
+			[
+				"BOT_TOKEN",
+			],
+			sourceOf(
+				{
+					BOT_TOKEN: TOKEN,
+				},
+				{
+					CURSEFORGE_API_KEY: "cf-api-key-0123456789",
+				},
+			).source,
+		);
+
+		expect(redact(`${TOKEN} cf-api-key-0123456789`)).toBe(`${REDACTED} ${REDACTED}`);
+	});
+
+	test("replaces every occurrence of a secret value", () => {
+		const redact = createBridgeRedaction(
+			[
+				"BOT_TOKEN",
+			],
+			sourceOf({
+				BOT_TOKEN: TOKEN,
+			}).source,
+		);
+
+		expect(redact(`InvalidToken: ${TOKEN} was rejected (${TOKEN})`)).toBe(
+			`InvalidToken: ${REDACTED} was rejected (${REDACTED})`,
+		);
+	});
+
+	test("blanks every line of a multi-line secret the process prints one line at a time", () => {
+		const key = [
+			"-----BEGIN PRIVATE KEY-----",
+			"MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7",
+			"  q1w2e3r4t5y6u7i8o9p0  ",
+			"short",
+			"-----END PRIVATE KEY-----",
+		].join("\r\n");
+		const redact = createBridgeRedaction(
+			[],
+			sourceOf(
+				{},
+				{
+					GOOGLE_PRIVATE_KEY: key,
+				},
+			).source,
+		);
+
+		expect(redact("MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7")).toBe(REDACTED);
+		expect(redact("line: q1w2e3r4t5y6u7i8o9p0")).toBe(`line: ${REDACTED}`);
+		expect(redact("-----BEGIN PRIVATE KEY-----")).toBe(REDACTED);
+		expect(redact("short stays")).toBe("short stays");
+		expect(redact(`whole ${key}`)).toBe(`whole ${REDACTED}`);
+	});
+
+	test("leaves a value under eight characters alone", () => {
+		const redact = createBridgeRedaction(
+			[
+				"RCON_PASSWORD",
+			],
+			sourceOf({
+				RCON_PASSWORD: "hunter2",
+			}).source,
+		);
+
+		expect(redact("the password is hunter2")).toBe("the password is hunter2");
+	});
+
+	test("escapes values that look like patterns and prefers the longest overlapping value", () => {
+		const redact = createBridgeRedaction(
+			[
+				"SHORT",
+				"LONG",
+			],
+			sourceOf({
+				SHORT: "a.b+c*d?",
+				LONG: "a.b+c*d?-and-more",
+			}).source,
+		);
+
+		expect(redact("x a.b+c*d?-and-more y a.b+c*d? z aXb+c*d?")).toBe(`x ${REDACTED} y ${REDACTED} z aXb+c*d?`);
+	});
+
+	test("follows a value saved after it was built and forgets the old one", () => {
+		const { source, save } = sourceOf({
+			BOT_TOKEN: "old-token-value",
+		});
+		const redact = createBridgeRedaction(
+			[
+				"BOT_TOKEN",
+			],
+			source,
+		);
+
+		expect(redact("old-token-value")).toBe(REDACTED);
+
+		save({
+			BOT_TOKEN: "new-token-value",
+		});
+
+		expect(redact("old-token-value new-token-value")).toBe(`old-token-value ${REDACTED}`);
+	});
+});
+
+describe("redacting what the bridge reports", () => {
+	const redact = (value: string) => value.split(TOKEN).join(REDACTED);
+
+	test("covers both languages of a customer-facing message", () => {
+		expect(redactLocalized(text(`bad ${TOKEN}`), redact)).toEqual(text(`bad ${REDACTED}`));
+	});
+
+	test("covers the message and every string field of a log line", () => {
+		const lines: unknown[] = [];
+		const record = (level: string) => (message: string, fields?: Record<string, unknown>) => {
+			lines.push({
+				level,
+				message,
+				fields,
+			});
+		};
+		const logger: BridgeLeveledLogger = Object.assign(record("info"), {
+			warn: record("warn"),
+			error: record("error"),
+		});
+		const redacted = redactLogger(logger, redact);
+
+		redacted(`saw ${TOKEN}`);
+		redacted.warn("driver failed", {
+			error: `InvalidToken: ${TOKEN}`,
+			code: 401,
+			nested: {
+				list: [
+					TOKEN,
+				],
+			},
+			driver: true,
+		});
+		redacted.error("plain");
+
+		expect(lines).toEqual([
+			{
+				level: "info",
+				message: `saw ${REDACTED}`,
+				fields: undefined,
+			},
+			{
+				level: "warn",
+				message: "driver failed",
+				fields: {
+					error: `InvalidToken: ${REDACTED}`,
+					code: 401,
+					nested: {
+						list: [
+							REDACTED,
+						],
+					},
+					driver: true,
+				},
+			},
+			{
+				level: "error",
+				message: "plain",
+				fields: undefined,
+			},
+		]);
+	});
+});
+
+describe("redaction over the live config", () => {
+	let directory = "";
+	let path = "";
+
+	const configWith = (variables: Record<string, string>): BridgeConfig => ({
+		code: "wsvv8fakxm",
+		token: "token",
+		cwd: "/data",
+		run: "/run/bridge",
+		ports: {},
+		memoryMb: 1024,
+		cpuPercent: 100,
+		gameUid: 1000,
+		gameGid: 1000,
+		variables,
+		secrets: {},
+	});
+
+	const write = async (config: BridgeConfig) => {
+		await writeFile(path, `${JSON.stringify(config)}\n`);
+	};
+
+	beforeEach(async () => {
+		directory = await mkdtemp(join(tmpdir(), "bridge-redaction-"));
+		path = join(directory, "config.json");
+	});
+
+	afterEach(async () => {
+		await rm(directory, {
+			force: true,
+			recursive: true,
+		});
+	});
+
+	test("reads the platform secrets from the config the agent wrote", async () => {
+		const boot = {
+			...configWith({}),
+			secrets: {
+				CURSEFORGE_API_KEY: "cf-api-key-0123456789",
+			},
+		};
+
+		await write(boot);
+
+		const redact = createBridgeRedaction([], createBridgeLiveConfig(path, boot, 60_000));
+
+		expect(redact("cf-api-key-0123456789")).toBe(REDACTED);
+	});
+
+	test("starts as the identity with no secret anywhere and blanks a secret written after boot", async () => {
+		const boot = configWith({});
+
+		await write(boot);
+
+		const live = createBridgeLiveConfig(path, boot, 60_000);
+		const redact = createBridgeRedaction([], live);
+
+		expect(redact(`key ${TOKEN}`)).toBe(`key ${TOKEN}`);
+
+		await write({
+			...configWith({}),
+			secrets: {
+				MY_API_KEY: TOKEN,
+			},
+		});
+
+		live.reload();
+
+		expect(redact(`key ${TOKEN}`)).toBe(`key ${REDACTED}`);
+	});
+
+	test("picks up a token the agent writes into the config after boot", async () => {
+		const boot = configWith({});
+
+		await write(boot);
+
+		const live = createBridgeLiveConfig(path, boot, 60_000);
+		const redact = createBridgeRedaction(
+			[
+				"BOT_TOKEN",
+			],
+			live,
+		);
+
+		expect(redact(TOKEN)).toBe(TOKEN);
+
+		await write(
+			configWith({
+				BOT_TOKEN: TOKEN,
+			}),
+		);
+
+		live.reload();
+
+		expect(redact(TOKEN)).toBe(REDACTED);
+	});
+});

package/src/runtime/bridgeRedaction.ts

@@ -0,0 +1,214 @@
+import { BridgeSetupPromptKind, type LocalizedText } from "../core";
+import type { BridgeDriver } from "../modules";
+import { BridgeControl, BridgeLayout } from "../panel";
+import type { BridgeSetupAction, BridgeSetupPrompt, BridgeSetupRuntime } from "../protocol";
+import type { BridgeLeveledLogger, BridgeLogger } from "./bridgeLog";
+
+export const REDACTED = "••••";
+
+export const REDACTION_MIN_LENGTH = 8;
+
+const REDACTION_DEPTH_LIMIT = 4;
+
+const PATTERN_SPECIALS = /[.*+?^${}()|[\]\\]/g;
+
+export type BridgeRedact = (text: string) => string;
+
+export interface BridgeRedactionSource {
+	variables(): Readonly<Record<string, string>>;
+	secrets(): Readonly<Record<string, string>>;
+}
+
+export const secretFieldKeys = (driver: BridgeDriver): string[] => {
+	const keys = new Set<string>();
+
+	for (const tab of driver.panel?.tabs ?? []) {
+		for (const section of tab.sections) {
+			if (section.layout !== BridgeLayout.Form) {
+				continue;
+			}
+
+			for (const field of section.fields) {
+				if (field.control === BridgeControl.Secret) {
+					keys.add(field.key);
+				}
+			}
+		}
+	}
+
+	return [
+		...keys,
+	];
+};
+
+const LINE_BREAK = /\r\n|\r|\n/;
+
+const redactableParts = (value: string): string[] => {
+	if (!LINE_BREAK.test(value)) {
+		return [
+			value,
+		];
+	}
+
+	return [
+		value,
+		...value.split(LINE_BREAK).map((line) => line.trim()),
+	];
+};
+
+const matcherFor = (values: string[]) => {
+	if (values.length === 0) {
+		return null;
+	}
+
+	return new RegExp(values.map((value) => value.replace(PATTERN_SPECIALS, "\\$&")).join("|"), "g");
+};
+
+export const createBridgeRedaction = (keys: string[], source: BridgeRedactionSource): BridgeRedact => {
+	let seenVariables: Readonly<Record<string, string>> | null = null;
+	let seenSecrets: Readonly<Record<string, string>> | null = null;
+	let signature = "";
+	let matcher: RegExp | null = null;
+
+	const current = () => {
+		const variables = source.variables();
+		const secrets = source.secrets();
+
+		if (variables === seenVariables && secrets === seenSecrets) {
+			return matcher;
+		}
+
+		seenVariables = variables;
+		seenSecrets = secrets;
+
+		const values = [
+			...new Set(
+				[
+					...keys.map((key) => variables[key] ?? ""),
+					...Object.values(secrets),
+				].flatMap(redactableParts),
+			),
+		]
+			.filter((value) => value.length >= REDACTION_MIN_LENGTH)
+			.sort((a, b) => b.length - a.length);
+		const next = values.join("\0");
+
+		if (next !== signature) {
+			signature = next;
+			matcher = matcherFor(values);
+		}
+
+		return matcher;
+	};
+
+	return (text) => {
+		const pattern = current();
+
+		return pattern ? text.replace(pattern, REDACTED) : text;
+	};
+};
+
+export const redactLocalized = (text: LocalizedText, redact: BridgeRedact): LocalizedText => {
+	return {
+		ar: redact(text.ar),
+		en: redact(text.en),
+	};
+};
+
+const redactActions = (actions: BridgeSetupAction[], redact: BridgeRedact): BridgeSetupAction[] => {
+	return actions.map((action) => ({
+		id: action.id,
+		label: redactLocalized(action.label, redact),
+	}));
+};
+
+const redactPrompt = (prompt: BridgeSetupPrompt, redact: BridgeRedact): BridgeSetupPrompt => {
+	const message = redactLocalized(prompt.message, redact);
+
+	switch (prompt.kind) {
+		case BridgeSetupPromptKind.Wait: {
+			return {
+				...prompt,
+				message,
+			};
+		}
+
+		case BridgeSetupPromptKind.Progress: {
+			return {
+				...prompt,
+				message,
+				detail: prompt.detail === null ? null : redact(prompt.detail),
+			};
+		}
+
+		case BridgeSetupPromptKind.Link: {
+			return {
+				...prompt,
+				message,
+				url: redact(prompt.url),
+				code: prompt.code === null ? null : redact(prompt.code),
+				actions: redactActions(prompt.actions, redact),
+			};
+		}
+
+		case BridgeSetupPromptKind.Action:
+		case BridgeSetupPromptKind.Failed: {
+			return {
+				...prompt,
+				message,
+				actions: redactActions(prompt.actions, redact),
+			};
+		}
+	}
+};
+
+export const redactSetupRuntime = (
+	runtime: BridgeSetupRuntime | null,
+	redact: BridgeRedact,
+): BridgeSetupRuntime | null => {
+	if (!runtime) {
+		return null;
+	}
+
+	return {
+		steps: runtime.steps,
+		prompt: runtime.prompt ? redactPrompt(runtime.prompt, redact) : null,
+	};
+};
+
+const redactValue = (value: unknown, redact: BridgeRedact, depth: number): unknown => {
+	if (typeof value === "string") {
+		return redact(value);
+	}
+
+	if (depth >= REDACTION_DEPTH_LIMIT || value === null || typeof value !== "object") {
+		return value;
+	}
+
+	if (Array.isArray(value)) {
+		return value.map((entry) => redactValue(entry, redact, depth + 1));
+	}
+
+	return Object.fromEntries(
+		Object.entries(value).map(([key, entry]) => [
+			key,
+			redactValue(entry, redact, depth + 1),
+		]),
+	);
+};
+
+const redactingWriter = (write: BridgeLogger, redact: BridgeRedact): BridgeLogger => {
+	return (message, fields) => {
+		write(
+			redact(message),
+			fields === undefined ? undefined : (redactValue(fields, redact, 0) as Record<string, unknown>),
+		);
+	};
+};
+
+export const redactLogger = (logger: BridgeLeveledLogger, redact: BridgeRedact): BridgeLeveledLogger => {
+	return Object.assign(redactingWriter(logger, redact), {
+		warn: redactingWriter(logger.warn, redact),
+		error: redactingWriter(logger.error, redact),
+	});
+};

package/src/runtime/bridgeRefusalError.ts

@@ -0,0 +1,13 @@
+import type { LocalizedText } from "../core";
+import { BridgeDriverError } from "./bridgeDriver";
+
+export class BridgeRefusalError extends BridgeDriverError {
+	readonly text: LocalizedText | null;
+
+	constructor(message: string, text: LocalizedText | null = null) {
+		super(message);
+
+		this.name = "BridgeRefusalError";
+		this.text = text;
+	}
+}