@tinycloud/cli 1.3.0-beta.50 → 1.3.0-beta.52

package/README.md

@@ -242,6 +242,17 @@ record (for example, restored from an older copy) refuses logout; switch the
 default profile if needed, then run `tc profile delete <name>` and sign in
 again.
 
+`auth logout`, `auth rotate`, and replica-enabled `auth login` that replaces the
+profile's share-history key check the sender share history first. If it records
+unexpired shares, or cannot be read, the command refuses with exit 5
+(`SHARE_HISTORY_UNEXPIRED` or `SHARE_HISTORY_UNAVAILABLE`) and changes nothing.
+Pass `--force` to proceed anyway; `auth logout --revoke` also skips the check. A
+plain re-login that keeps the key is not checked, and local-owner profiles are not
+checked. `tc share history recover` moves an unreadable history file aside to
+`share-history-v2.json.unreadable-<UTC timestamp>` and reports the new path. It
+never deletes or overwrites a file. If the file exists but cannot be read,
+recover exits 1 with `SHARE_HISTORY_RECOVER_FAILED` and moves nothing.
+
 `tc auth grants list` labels the signed-in delegation CID `(current session)`.
 `tc delegation revoke <cid>` still accepts any eligible exact CID, but when
 `<cid>` is the current session it requires `--yes` or an interactive confirmation

package/dist/courier-entry.js

@@ -9070,8 +9070,9 @@ function loadPeers(path21, ownerUid2 = process.getuid?.()) {
     const stat = fs14.fstatSync(fd);
     if (!stat.isFile())
       throw new CourierError("insecure-peers", `${path21} is not a regular file.`);
-    if (ownerUid2 !== void 0 && stat.uid !== ownerUid2)
-      throw new CourierError("insecure-peers", `${path21} is not owned by the courier user.`);
+    if (ownerUid2 !== void 0 && stat.uid !== ownerUid2) {
+      throw new CourierError("insecure-peers", `${path21} is not owned by the peers owner (uid ${ownerUid2}); pass --peers-owner or chown the file.`);
+    }
     if ((stat.mode & 18) !== 0) {
       throw new CourierError("insecure-peers", `${path21} is writable by group or others; restrict it to the owner (chmod 600).`);
     }
@@ -9093,6 +9094,53 @@ function loadPeers(path21, ownerUid2 = process.getuid?.()) {
 function policyOf(peers, peerId) {
   return Object.hasOwn(peers, peerId) ? peers[peerId] : { ...ABSENT };
 }
+var UID_MAX = 4294967294;
+var PASSWD = "/etc/passwd";
+function uidOfName(name2, passwdPath) {
+  let text;
+  try {
+    text = fs14.readFileSync(passwdPath, "utf8");
+  } catch {
+    throw new CourierError("usage", `cannot read ${passwdPath} to resolve "${name2}"; pass a numeric uid instead.`);
+  }
+  const uids = /* @__PURE__ */ new Set();
+  for (const line of text.split("\n")) {
+    if (line === "" || line.startsWith("#") || line.startsWith("+") || line.startsWith("-"))
+      continue;
+    const fields = line.split(":");
+    if (fields.length !== 7 || !/^(0|[1-9]\d*)$/.test(fields[2]) || Number(fields[2]) > UID_MAX) {
+      throw new CourierError("usage", `${passwdPath} has a malformed line; fix it or pass a numeric uid.`);
+    }
+    if (fields[0] === name2)
+      uids.add(Number(fields[2]));
+  }
+  if (uids.size === 0)
+    throw new CourierError("usage", `no account named "${name2}"; pass a numeric uid instead.`);
+  if (uids.size > 1)
+    throw new CourierError("usage", `"${name2}" maps to more than one uid in ${passwdPath}; pass a numeric uid.`);
+  return [...uids][0];
+}
+function resolvePeersOwner(flag, env, passwdPath = PASSWD) {
+  const value2 = flag ?? env;
+  if (value2 === void 0) {
+    const uid = process.getuid?.();
+    if (uid === void 0)
+      throw new CourierError("unsupported", "peers ownership needs a POSIX platform.");
+    return uid;
+  }
+  if (value2 === "true")
+    throw new CourierError("usage", "--peers-owner needs a user name or numeric uid.");
+  if (/^(0|[1-9]\d*)$/.test(value2)) {
+    const uid = Number(value2);
+    if (uid > UID_MAX)
+      throw new CourierError("usage", `peers owner uid ${value2} is out of range.`);
+    return uid;
+  }
+  if (!/^[A-Za-z_][A-Za-z0-9._-]{0,31}$/.test(value2)) {
+    throw new CourierError("usage", `peers owner "${value2}" is neither a user name nor a numeric uid.`);
+  }
+  return uidOfName(value2, passwdPath);
+}
 
 // ../courier/dist/intake/queue.js
 import fs15 from "fs";
@@ -9801,13 +9849,29 @@ function intervalSeconds(raw) {
     throw new CourierError("usage", "--interval must be an integer from 5 to 3600");
   return n;
 }
-async function cmdIntake(args) {
+function reloadPeers(peersFile, peersOwner, last, log) {
+  try {
+    return loadPeers(peersFile, peersOwner);
+  } catch (error) {
+    log("intake-error", { code: errInfo(error).code ?? "bad-peers" });
+    return last;
+  }
+}
+var defaultLoopDeps = {
+  loadProfile,
+  courierNode,
+  reloadPeers,
+  intakeCycle,
+  sleep: (ms2) => new Promise((resolve) => setTimeout(resolve, ms2))
+};
+async function cmdIntake(args, deps = defaultLoopDeps) {
   const base = path18.join(profileDir(), "intake");
   const queueRoot = args.get("queue-dir") ?? path18.join(base, "queue");
   const doneRoot = args.get("done-dir") ?? path18.join(base, "done");
   const overflowRoot = args.get("overflow-dir") ?? path18.join(base, "overflow");
   const stateDir = args.get("state-dir") ?? path18.join(base, "state");
   const peersFile = args.get("peers-file") ?? path18.join(base, "peers.json");
+  const peersOwner = resolvePeersOwner(args.get("peers-owner"), process.env.COURIER_PEERS_OWNER);
   const once = args.has("once");
   const intervalMs = intervalSeconds(args.get("interval")) * 1e3;
   const log = jsonLineLog();
@@ -9824,18 +9888,14 @@ async function cmdIntake(args) {
       return;
     }
     const state = readState(path18.join(stateDir, STATE_FILE));
-    let peers = loadPeers(peersFile);
+    let peers = loadPeers(peersFile, peersOwner);
     log("intake-start", { once, intervalSeconds: intervalMs / 1e3 });
     for (; ; ) {
       try {
-        const profile = loadProfile();
-        const node = await courierNode(profile);
-        try {
-          peers = loadPeers(peersFile);
-        } catch (error) {
-          log("intake-error", { code: errInfo(error).code ?? "bad-peers" });
-        }
-        const queued = await intakeCycle({
+        const profile = deps.loadProfile();
+        const node = await deps.courierNode(profile);
+        peers = deps.reloadPeers(peersFile, peersOwner, peers, log);
+        const queued = await deps.intakeCycle({
           kv: node.kv,
           profile,
           peers,
@@ -9855,9 +9915,7 @@ async function cmdIntake(args) {
       }
       if (once)
         return;
-      await new Promise((resolve) => {
-        setTimeout(resolve, intervalMs);
-      });
+      await deps.sleep(intervalMs);
     }
   } finally {
     release();
@@ -9896,7 +9954,7 @@ var Refusal = class extends Error {
   }
 };
 var ADD_USAGE = `Usage: ${cmd("outbox add <peer> (--thread <id> | --new <subject>) [--text t | --file f | stdin] [--outbox-dir d]")}`;
-var SERVE_USAGE = `Usage: ${cmd("outbox serve --pipe <socket> [--outbox-dir d] [--socket-group g] [--peers-file f] [--sent-dir d] [--once] [--dry-run]")}`;
+var SERVE_USAGE = `Usage: ${cmd("outbox serve --pipe <socket> [--outbox-dir d] [--socket-group g] [--peers-file f] [--peers-owner u] [--sent-dir d] [--once] [--dry-run]")}`;
 var OUTBOX_USAGE = `Usage: ${cmd("outbox add <peer> ... | outbox serve ...")}`;
 function lstatOrUndefined(file) {
   try {
@@ -9928,6 +9986,7 @@ var LOGGABLE_CODES = /* @__PURE__ */ new Set([
   "ECONNRESET",
   "bad-marker",
   "bad-peers",
+  "insecure-peers",
   "socket-group-denied",
   "unknown-group",
   "unsafe-dir",
@@ -10230,7 +10289,7 @@ async function startOutbox(opts) {
   let peersNow;
   function currentPeers() {
     try {
-      peersNow = loadPeers(opts.peersFile);
+      peersNow = loadPeers(opts.peersFile, opts.peersOwnerUid);
     } catch (error) {
       limited("outbox.peers-invalid", { code: safeCode(error) });
     }
@@ -10396,6 +10455,7 @@ async function cmdOutboxServe(args) {
     pipe: configValue(args, "pipe", "COURIER_OUTBOX_PIPE", SERVE_USAGE),
     socketGroup: configValue(args, "socket-group", "COURIER_OUTBOX_SOCKET_GROUP", SERVE_USAGE, DEFAULT_SOCKET_GROUP),
     peersFile: args.get("peers-file") ?? path19.join(base, "intake", "peers.json"),
+    peersOwnerUid: resolvePeersOwner(args.get("peers-owner"), process.env.COURIER_PEERS_OWNER),
     sentDir: args.get("sent-dir") ?? path19.join(base, "outbox-sent"),
     once: args.has("once"),
     dryRun: args.has("dry-run")
@@ -10995,14 +11055,14 @@ Delivery (one watcher per person per machine; never calls a model):
   watch \u2026 --install-launchd | --install-systemd [--dry-run] [--name n]
                                    Install the same watch command as a macOS launchd agent or a Linux
                                    systemd --user unit. --dry-run prints the exact file and commands.
-  intake [--queue-dir d] [--peers-file f] [--state-dir d] [--interval 60] [--once]
+  intake [--queue-dir d] [--peers-file f] [--peers-owner u] [--state-dir d] [--interval 60] [--once]
                                    Intake reader: copy paired peers' mirrored messages into the local queue
                                    (one <msgId>.json per message) with cheap checks. Never calls a model.
   outbox add <peer> (--thread <id> | --new <subject>) [--text t | --file f | stdin] [--outbox-dir d]
                                    Queue one message for a paired peer as a single-use outbox item. Text limit:
                                    2000 characters (8 KiB UTF-8); subject limit: 200 characters.
   outbox serve --pipe <socket> [--outbox-dir d] [--socket-group courier-sender] [--peers-file f]
-               [--sent-dir d] [--once] [--dry-run]
+               [--peers-owner u] [--sent-dir d] [--once] [--dry-run]
                                    Sender: accept one-line item requests over a Unix socket and send the
                                    named outbox item. Replies are ok or refused:<code>.