@theia/core 1.74.0-next.6 → 1.74.0-next.60

package/src/common/preferences/index.ts

@@ -16,6 +16,7 @@
 
 export * from './defaults-preference-provider';
 export * from './preference-language-override-service';
+export * from './session-preference-provider';
 export * from './preference-provider-impl';
 export * from './preference-provider';
 export * from './preference-schema-service';

package/src/common/preferences/preference-scope.spec.ts

@@ -20,11 +20,11 @@ import { PreferenceScope } from './preference-scope';
 describe('PreferenceScope', () => {
 
     it('getScopes() should return numbers from broadest to narrowest', () => {
-        expect(PreferenceScope.getScopes()).deep.equal([0, 1, 2, 3]);
+        expect(PreferenceScope.getScopes()).deep.equal([0, 1, 2, 3, 4]);
     });
 
     it('getReversedScopes() should return numbers from narrowest to broadest', () => {
-        expect(PreferenceScope.getReversedScopes()).deep.equal([3, 2, 1, 0]);
+        expect(PreferenceScope.getReversedScopes()).deep.equal([4, 3, 2, 1, 0]);
     });
 
     it('getScopeNames() should return the names of scopes broader than the current one', () => {
@@ -36,11 +36,13 @@ describe('PreferenceScope', () => {
         expect(PreferenceScope.is(PreferenceScope.User)).to.be.true;
         expect(PreferenceScope.is(PreferenceScope.Workspace)).to.be.true;
         expect(PreferenceScope.is(PreferenceScope.Folder)).to.be.true;
+        expect(PreferenceScope.is(PreferenceScope.Session)).to.be.true;
         expect(PreferenceScope.is(0)).to.be.true;
         expect(PreferenceScope.is(1)).to.be.true;
         expect(PreferenceScope.is(2)).to.be.true;
         expect(PreferenceScope.is(3)).to.be.true;
-        expect(PreferenceScope.is(4)).to.be.false;
+        expect(PreferenceScope.is(4)).to.be.true;
+        expect(PreferenceScope.is(5)).to.be.false;
         expect(PreferenceScope.is(-1)).to.be.false;
         expect(PreferenceScope.is({})).to.be.false;
         expect(PreferenceScope.is('Default')).to.be.false;

package/src/common/preferences/preference-scope.ts

@@ -23,7 +23,12 @@ export enum PreferenceScope {
     Default,
     User,
     Workspace,
-    Folder
+    Folder,
+    /**
+     * Process-lifetime, in-memory scope used by `--session-preference` CLI overrides.
+     * Has the highest precedence and is never persisted to disk.
+     */
+    Session
 }
 
 export namespace PreferenceScope {

package/src/common/preferences/preference-service.ts

@@ -254,6 +254,10 @@ export interface PreferenceInspection<T = JSONValue> {
      * Value in folder scope.
      */
     workspaceFolderValue: T | undefined,
+    /**
+     * Value in session scope (in-memory, set via `--session-preference`).
+     */
+    sessionValue?: T | undefined,
     /**
      * The value that is active, i.e. the value set in the lowest scope available.
      */
@@ -453,11 +457,37 @@ export class PreferenceServiceImpl implements PreferenceService {
         }
         const provider = this.getProvider(resolvedScope);
         if (provider && await provider.setPreference(preferenceName, value, resourceUri)) {
+            await this.evictSessionOverride(preferenceName, resolvedScope);
             return;
         }
         throw new Error(`Unable to write to ${PreferenceScope[resolvedScope]} Settings.`);
     }
 
+    /**
+     * When a preference is written to a persistent scope, drop any in-memory session
+     * override (set via `--session-preference`) for the same key so that the explicit
+     * change takes effect for the remainder of the session. Without this, the session
+     * scope would keep shadowing the user's change because it has higher precedence.
+     *
+     * Note: this fires for any write to a persistent scope, including programmatic
+     * writes from extensions. Extensions that race with startup CLI overrides will
+     * therefore clear them. This is intentional: a programmatic write is "explicit"
+     * from the preference system's point of view, but consumers should be aware.
+     *
+     * Session preferences are global (no per-resource scoping), so `resourceUri` is
+     * not threaded through.
+     */
+    protected async evictSessionOverride(preferenceName: string, writtenScope: PreferenceScope): Promise<void> {
+        if (writtenScope === PreferenceScope.Session || writtenScope === PreferenceScope.Default) {
+            return;
+        }
+        const sessionProvider = this.getProvider(PreferenceScope.Session);
+        if (sessionProvider && sessionProvider.get(preferenceName) !== undefined) {
+            // Passing `undefined` clears the value in the session provider.
+            await sessionProvider.setPreference(preferenceName, undefined as unknown as JSONValue);
+        }
+    }
+
     getBoolean(preferenceName: string): boolean | undefined;
     getBoolean(preferenceName: string, defaultValue: boolean): boolean;
     getBoolean(preferenceName: string, defaultValue: boolean, resourceUri: string): boolean;
@@ -499,10 +529,11 @@ export class PreferenceServiceImpl implements PreferenceService {
         const globalValue = this.inspectInScope<T>(preferenceName, PreferenceScope.User, resourceUri, forceLanguageOverride);
         const workspaceValue = this.inspectInScope<T>(preferenceName, PreferenceScope.Workspace, resourceUri, forceLanguageOverride);
         const workspaceFolderValue = this.inspectInScope<T>(preferenceName, PreferenceScope.Folder, resourceUri, forceLanguageOverride);
+        const sessionValue = this.inspectInScope<T>(preferenceName, PreferenceScope.Session, resourceUri, forceLanguageOverride);
 
-        const valueApplied = workspaceFolderValue ?? workspaceValue ?? globalValue ?? defaultValue;
+        const valueApplied = sessionValue ?? workspaceFolderValue ?? workspaceValue ?? globalValue ?? defaultValue;
 
-        return { preferenceName, defaultValue, globalValue, workspaceValue, workspaceFolderValue, value: valueApplied };
+        return { preferenceName, defaultValue, globalValue, workspaceValue, workspaceFolderValue, sessionValue, value: valueApplied };
     }
 
     inspectInScope<T extends JSONValue>(preferenceName: string, scope: PreferenceScope, resourceUri?: string, forceLanguageOverride?: boolean): T | undefined {
@@ -526,6 +557,8 @@ export class PreferenceServiceImpl implements PreferenceService {
                 return inspection.workspaceValue;
             case PreferenceScope.Folder:
                 return inspection.workspaceFolderValue;
+            case PreferenceScope.Session:
+                return inspection.sessionValue;
         }
         unreachable(scope, 'Not all PreferenceScope enum variants handled.');
     }
@@ -551,9 +584,10 @@ export class PreferenceServiceImpl implements PreferenceService {
         }
 
         // Scopes in ascending order of scope breadth.
-        const allScopes = [...this.schemaService.validScopes].reverse();
-        // Get rid of Default scope. We can't set anything there.
-        allScopes.pop();
+        const allScopes = [...this.schemaService.validScopes].reverse()
+            // Default is read-only, and Session is populated only by `--session-preference`,
+            // so neither is a valid target for a regular user edit.
+            .filter(scope => scope !== PreferenceScope.Default && scope !== PreferenceScope.Session);
 
         const isScopeDefined = (scope: PreferenceScope) => this.getScopedValueFromInspection(inspection, scope) !== undefined;
 

package/src/common/preferences/session-preference-provider.spec.ts

@@ -0,0 +1,78 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import { SessionPreferenceProvider } from './session-preference-provider';
+import { PreferenceScope } from './preference-scope';
+
+describe('SessionPreferenceProvider', () => {
+
+    let provider: SessionPreferenceProvider;
+
+    beforeEach(() => {
+        provider = new SessionPreferenceProvider();
+        // PostConstruct emulation
+        (provider as unknown as { init(): void }).init();
+    });
+
+    it('claims only the Session scope', () => {
+        expect(provider.canHandleScope(PreferenceScope.Session)).to.be.true;
+        expect(provider.canHandleScope(PreferenceScope.User)).to.be.false;
+        expect(provider.canHandleScope(PreferenceScope.Workspace)).to.be.false;
+        expect(provider.canHandleScope(PreferenceScope.Folder)).to.be.false;
+        expect(provider.canHandleScope(PreferenceScope.Default)).to.be.false;
+    });
+
+    it('starts empty', () => {
+        expect(provider.getPreferences()).to.deep.equal({});
+    });
+
+    it('stores set values in memory and exposes them via get/resolve', async () => {
+        const ok = await provider.setPreference('editor.fontSize', 18);
+        expect(ok).to.be.true;
+        expect(provider.get('editor.fontSize')).to.equal(18);
+        expect(provider.resolve('editor.fontSize').value).to.equal(18);
+        expect(provider.getPreferences()).to.deep.equal({ 'editor.fontSize': 18 });
+    });
+
+    it('emits a change event on set', async () => {
+        let received: { name: string; newValue: unknown; oldValue: unknown; scope: PreferenceScope } | undefined;
+        provider.onDidPreferencesChanged(changes => {
+            const key = Object.keys(changes)[0];
+            received = {
+                name: changes[key].preferenceName,
+                newValue: changes[key].newValue,
+                oldValue: changes[key].oldValue,
+                scope: changes[key].scope
+            };
+        });
+        await provider.setPreference('foo', 'bar');
+        expect(received).to.deep.equal({ name: 'foo', newValue: 'bar', oldValue: undefined, scope: PreferenceScope.Session });
+    });
+
+    it('removes a value when set to undefined', async () => {
+        await provider.setPreference('foo', 'bar');
+        const removed = await provider.setPreference('foo', undefined as never);
+        expect(removed).to.be.true;
+        expect(provider.get('foo')).to.equal(undefined);
+        expect(provider.getPreferences()).to.deep.equal({});
+    });
+
+    it('returns false when removing a key that was never set', async () => {
+        const removed = await provider.setPreference('missing', undefined as never);
+        expect(removed).to.be.false;
+    });
+});

package/src/common/preferences/session-preference-provider.ts

@@ -0,0 +1,69 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { JSONObject, JSONValue } from '@lumino/coreutils';
+import { injectable, postConstruct } from 'inversify';
+import { PreferenceProvider, PreferenceProviderDataChange } from './preference-provider';
+import { PreferenceProviderImpl } from './preference-provider-impl';
+import { PreferenceScope } from './preference-scope';
+
+/**
+ * In-memory preference provider used for process-lifetime overrides such as those
+ * supplied via the `--session-preference` CLI option. Values live in memory only
+ * and are dropped when the process exits.
+ */
+@injectable()
+export class SessionPreferenceProvider extends PreferenceProviderImpl implements PreferenceProvider {
+
+    protected readonly preferences = new Map<string, JSONValue>();
+
+    @postConstruct()
+    protected init(): void {
+        this._ready.resolve();
+    }
+
+    override canHandleScope(scope: PreferenceScope): boolean {
+        return scope === PreferenceScope.Session;
+    }
+
+    getPreferences(): JSONObject {
+        const result: JSONObject = {};
+        for (const [name, value] of this.preferences) {
+            result[name] = value;
+        }
+        return result;
+    }
+
+    async setPreference(key: string, value: JSONValue | undefined): Promise<boolean> {
+        const oldValue = this.preferences.get(key);
+        if (value === undefined) {
+            if (!this.preferences.has(key)) {
+                return false;
+            }
+            this.preferences.delete(key);
+        } else {
+            this.preferences.set(key, value);
+        }
+        const change: PreferenceProviderDataChange = {
+            preferenceName: key,
+            newValue: value,
+            oldValue,
+            scope: PreferenceScope.Session
+        };
+        await this.emitPreferencesChangedEvent([change]);
+        return true;
+    }
+}

package/src/electron-node/hosting/electron-backend-hosting-module.spec.ts

@@ -0,0 +1,42 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import { Container } from 'inversify';
+import electronBackendHostingModule from './electron-backend-hosting-module';
+import { HttpConnectionValidator } from '../../node/hosting/browser-connection-token';
+
+describe('electron-backend-hosting-module', () => {
+
+    it('should bind a no-op HttpConnectionValidator that calls next() unconditionally', () => {
+        const container = new Container();
+        container.load(electronBackendHostingModule);
+        const validator = container.get<HttpConnectionValidator>(HttpConnectionValidator);
+
+        let nextCalled = false;
+        let sentStatus: number | undefined;
+        // No cookie provided: the no-op validator must still call next() and never send a status.
+        const req = { headers: {} as Record<string, string | undefined> };
+        const res = { sendStatus: (status: number) => { sentStatus = status; } };
+        const next = (): void => { nextCalled = true; };
+
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        validator.validateRequest(req as any, res as any, next as any);
+
+        expect(nextCalled).to.be.true;
+        expect(sentStatus).to.be.undefined;
+    });
+});

package/src/electron-node/hosting/electron-backend-hosting-module.ts

@@ -16,9 +16,17 @@
 
 import { ContainerModule } from 'inversify';
 import { WsRequestValidatorContribution } from '../../node/ws-request-validators';
+import { HttpConnectionValidator } from '../../node/hosting/browser-connection-token';
 import { ElectronWsOriginValidator } from './electron-ws-origin-validator';
 
 export default new ContainerModule(bind => {
     bind(ElectronWsOriginValidator).toSelf().inSingletonScope();
     bind(WsRequestValidatorContribution).toService(ElectronWsOriginValidator);
+
+    // Electron uses its own `ElectronSecurityToken`, so the connection-token cookie is not used.
+    // Bind a no-op validator so consumers can inject it uniformly.
+    const noopValidator: HttpConnectionValidator = {
+        validateRequest: (_req, _res, next) => next()
+    };
+    bind(HttpConnectionValidator).toConstantValue(noopValidator);
 });

package/src/node/hosting/backend-hosting-module.ts

@@ -19,7 +19,7 @@ import { BackendApplicationContribution } from '../backend-application';
 import { WsRequestValidatorContribution } from '../ws-request-validators';
 import { BackendApplicationHosts } from './backend-application-hosts';
 import {
-    BrowserConnectionToken, BrowserConnectionTokenBackendContribution, createBrowserConnectionToken
+    BrowserConnectionToken, BrowserConnectionTokenBackendContribution, HttpConnectionValidator, createBrowserConnectionToken
 } from './browser-connection-token';
 import { WsOriginValidator } from './ws-origin-validator';
 
@@ -28,9 +28,12 @@ export default new ContainerModule(bind => {
     bind(WsOriginValidator).toSelf().inSingletonScope();
     bind(WsRequestValidatorContribution).toService(WsOriginValidator);
 
-    // Cookie-based connection token protects both HTTP and WebSocket endpoints.
+    // Cookie-based connection token. It is validated on WebSocket upgrades and bootstrapped
+    // (set as a cookie) on every HTTP request; HTTP enforcement is opt-in per route via
+    // `HttpConnectionValidator`.
     bind(BrowserConnectionToken).toConstantValue(createBrowserConnectionToken());
     bind(BrowserConnectionTokenBackendContribution).toSelf().inSingletonScope();
     bind(BackendApplicationContribution).toService(BrowserConnectionTokenBackendContribution);
     bind(WsRequestValidatorContribution).toService(BrowserConnectionTokenBackendContribution);
+    bind(HttpConnectionValidator).toService(BrowserConnectionTokenBackendContribution);
 });

package/src/node/hosting/browser-connection-token.spec.ts

@@ -16,6 +16,7 @@
 
 import { expect } from 'chai';
 import * as http from 'http';
+import { environment } from '../../common';
 import {
     BrowserConnectionToken,
     BrowserConnectionTokenBackendContribution,
@@ -164,4 +165,95 @@ describe('BrowserConnectionTokenBackendContribution', () => {
             expect(result.cookieCalls[0].value).to.equal(token.value);
         });
     });
+
+    describe('validateRequest (HTTP token enforcement)', () => {
+
+        interface ValidationResult {
+            nextCalled: boolean;
+            sentStatus?: number;
+        }
+
+        function callValidate(cookieValue?: string): ValidationResult {
+            const contribution = createContribution();
+            const result: ValidationResult = { nextCalled: false };
+
+            const req = { headers: {} as Record<string, string | undefined> };
+            if (cookieValue !== undefined) {
+                req.headers.cookie = `${BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+            }
+
+            const res = {
+                sendStatus: (status: number) => { result.sentStatus = status; }
+            };
+
+            const next = (): void => { result.nextCalled = true; };
+
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (contribution as any).validateRequest(req, res, next);
+            return result;
+        }
+
+        it('should allow request with valid token cookie', () => {
+            const result = callValidate(token.value);
+            expect(result.nextCalled).to.be.true;
+            expect(result.sentStatus).to.be.undefined;
+        });
+
+        it('should reject request with no cookie', () => {
+            const result = callValidate();
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+
+        it('should reject request with invalid token', () => {
+            const result = callValidate('wrong-token');
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+
+        it('should reject request with stale token from previous server', () => {
+            const staleToken = createBrowserConnectionToken().value;
+            const result = callValidate(staleToken);
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+
+        it('should reject request with empty token', () => {
+            const result = callValidate('');
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+    });
+
+    describe('Electron deployment (no-op)', () => {
+
+        let originalIsElectron: () => boolean;
+
+        beforeEach(() => {
+            originalIsElectron = environment.electron.is;
+            environment.electron.is = () => true;
+        });
+
+        afterEach(() => {
+            environment.electron.is = originalIsElectron;
+        });
+
+        it('validateRequest should call next() without a cookie', () => {
+            const contribution = createContribution();
+            let nextCalled = false;
+            let sentStatus: number | undefined;
+            const req = { headers: {} as Record<string, string | undefined> };
+            const res = { sendStatus: (status: number) => { sentStatus = status; } };
+            const next = (): void => { nextCalled = true; };
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (contribution as any).validateRequest(req, res, next);
+            expect(nextCalled).to.be.true;
+            expect(sentStatus).to.be.undefined;
+        });
+
+        it('allowWsUpgrade should return true without a cookie', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest())).to.be.true;
+        });
+    });
 });

package/src/node/hosting/browser-connection-token.ts

@@ -33,6 +33,26 @@ export interface BrowserConnectionToken {
     value: string;
 }
 
+export const HttpConnectionValidator = Symbol('HttpConnectionValidator');
+
+/**
+ * Express middleware provider that rejects HTTP requests lacking a valid connection token.
+ *
+ * The connection-token cookie is only *bootstrapped* globally (see
+ * {@link BrowserConnectionTokenBackendContribution}); enforcement is opt-in per route.
+ * Security-sensitive HTTP endpoints (e.g. the filesystem upload/download routes) should
+ * inject this and apply {@link validateRequest} as route middleware. Non-sensitive routes
+ * (the initial HTML page, static assets) must not use it, as they legitimately have no
+ * cookie yet on the very first page load.
+ */
+export interface HttpConnectionValidator {
+    /**
+     * Express middleware that calls `next()` when the request carries a valid connection-token
+     * cookie (or when running in Electron) and responds with `403` otherwise.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void;
+}
+
 /**
  * Validates WebSocket and HTTP requests using a cookie-based connection token.
  *
@@ -40,13 +60,18 @@ export interface BrowserConnectionToken {
  * as a `SameSite=Strict; HttpOnly` cookie on the first page load. Cross-origin pages
  * cannot obtain or send this cookie, so their requests are rejected.
  *
+ * The cookie is *bootstrapped* for every HTTP request (via {@link expressMiddleware}) so that
+ * browsers always receive it, but HTTP requests are only *rejected* on routes that opt in to
+ * enforcement via {@link validateRequest} (see {@link HttpConnectionValidator}). WebSocket
+ * upgrades are always validated (see {@link allowWsUpgrade}).
+ *
  * This complements the origin validator: non-browser callers that omit the Origin
  * header (e.g. Node.js scripts) still cannot reach the backend without the cookie.
  *
  * Skipped in Electron deployments (which use their own `ElectronSecurityToken`).
  */
 @injectable()
-export class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution {
+export class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution, HttpConnectionValidator {
 
     @inject(BrowserConnectionToken)
     protected readonly browserConnectionToken: BrowserConnectionToken;
@@ -84,6 +109,25 @@ export class BrowserConnectionTokenBackendContribution implements BackendApplica
         return false;
     }
 
+    /**
+     * Reject the request with `403` unless it carries a valid connection-token cookie.
+     * Always allows the request in Electron deployments, consistent with {@link allowWsUpgrade}.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void {
+        if (environment.electron.is()) {
+            next();
+            return;
+        }
+        const token = this.getTokenFromCookie(req);
+        if (token && this.isTokenValid(token)) {
+            next();
+            return;
+        }
+        // No cookie or stale/invalid token: reject. Legitimate browsers always have the cookie
+        // because it is set on the initial page load, and same-origin requests send it automatically.
+        res.sendStatus(403);
+    }
+
     protected expressMiddleware(req: express.Request, res: express.Response, next: express.NextFunction): void {
         const existing = this.getTokenFromCookie(req);
         if (!existing || !this.isTokenValid(existing)) {

package/src/node/index.ts

@@ -23,3 +23,4 @@ export * from './cli';
 export * from './setting-service';
 export { FileSystemLocking } from './filesystem-locking';
 export { BackendRequestAllowedContribution } from './request/backend-request-facade';
+export { HttpConnectionValidator } from './hosting/browser-connection-token';