@tomato414941/foundation 0.24.0 → 0.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomato414941/foundation",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Foundation CLI: give this machine a WebAuthn credential, and hand what is kept to a command without it passing through the agent.",
   "type": "module",
   "engines": {

package/runtime.mjs

@@ -5,7 +5,7 @@ import { rmSync, readdirSync, constants } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { homedir, hostname, tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve, sep } from 'node:path';
 import { createRequire } from 'node:module';
 import { validEnvName } from './env-name.mjs';
 import { createCredential, answer } from './webauthn.mjs';
@@ -106,6 +106,39 @@ async function outputBytes(path) {
   } finally { await handle?.close(); }
 }
 
+// Taking a principal's data out: what the server's export holds, and each stored object's bytes, fetched straight from
+// where they are kept by a time-limited URL so that they never pass through the server. The directory is new, private,
+// and written into only.
+async function exportTo({ directory, principal }, send) {
+  try { await mkdir(directory, { mode: 0o700 }); }
+  catch (error) { throw error.code === 'EEXIST' ? new Error('Choose a directory that does not exist yet: ' + directory) : error; }
+  const base = '/v1/principals/' + encodeURIComponent(principal);
+  await writeFile(join(directory, 'export.json'), JSON.stringify(await send(base + '/export', undefined, { method: 'GET' }), null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+  const { resources = [] } = await send(base + '/resources?kind=object', undefined, { method: 'GET', accept: data => data.error?.code === 'space_unavailable' });
+  const kept = [];
+  for (const object of resources) {
+    // The server answers a burst of links with rate_limit; its window is a minute.
+    let link;
+    for (let attempt = 0; !link; attempt++) {
+      const answered = await send('/v1/resources/' + object.id + '/link', {}, { accept: data => data.error?.code === 'rate_limit' && attempt < 5 });
+      if (answered.error) await new Promise(done => setTimeout(done, Number(process.env.FOUNDATION_EXPORT_WAIT_MS ?? 15_000)));
+      else link = answered;
+    }
+    const response = await fetch(link.url, { redirect: 'error', signal: AbortSignal.timeout(300_000) });
+    if (!response.ok) throw new Error('Could not download ' + object.name + ' (' + response.status + ').');
+    const bytes = Buffer.from(await response.arrayBuffer());
+    // A name becomes a path under objects/ when every part of it is a plain name; otherwise, or where that path is
+    // taken, the object is saved under its id.
+    const parts = object.name.split('/');
+    let file = parts.every(part => part && part !== '.' && part !== '..' && !part.includes(sep) && !/[\u0000-\u001f]/.test(part)) ? join(directory, 'objects', ...parts) : null;
+    try { if (!file) throw new Error('unsafe'); await mkdir(dirname(file), { recursive: true, mode: 0o700 }); await writeFile(file, bytes, { mode: 0o600, flag: 'wx' }); }
+    catch { file = join(directory, 'objects', object.id); await mkdir(dirname(file), { recursive: true, mode: 0o700 }); await writeFile(file, bytes, { mode: 0o600, flag: 'wx' }); }
+    kept.push({ id: object.id, name: object.name, type: object.type ?? null, size: bytes.length, file: file.slice(directory.length + 1) });
+  }
+  await writeFile(join(directory, 'objects.json'), JSON.stringify(kept, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+  console.log(JSON.stringify({ directory, objects: kept.length }));
+}
+
 // --help describes the CLI. The server publishes its API contract at /openapi.json.
 const HELP = `Usage: foundation <command> [options]
 
@@ -122,6 +155,9 @@ Commands:
   exec --output '<json>' -- <command>  Also save a file the command writes.
   keep <name> --from <file>            Save a file as a secret, sealed here for whoever may open it.
   read <name>                          Print a secret this machine was handed an envelope for.
+  export <directory> [--principal <id>]
+                                       Save a principal's data (this machine's by default) into a new directory:
+                                       export.json as the server gives it, and every stored object under objects/.
   version                              Print the version.
 
 API specification:
@@ -202,8 +238,12 @@ async function main() {
     call = { name: args[0] };
   } else if (action === 'token') {
     if (args.length) throw new Error('Usage: token');
+  } else if (action === 'export') {
+    const parsed = parseArgs({ args, options: { principal: { type: 'string' } }, strict: true, allowPositionals: true });
+    if (parsed.positionals.length !== 1 || (parsed.values.principal !== undefined && !/^[0-9a-f-]{36}$/.test(parsed.values.principal))) throw new Error('Usage: export <directory> [--principal <id>]');
+    call = { directory: resolve(parsed.positionals[0]), principal: parsed.values.principal ?? 'me' };
   } else if (!(action === 'exec' && (names.length || output) && command.length)) {
-    throw new Error('Usage: init [<url>] [--name <name>] | join | token | exec [<ENV>=<name> ... | --inputs <json>] [--output <json>] -- <command> [args...] | keep <name> --from <file> | read <name> | api <method> </path> [--json <body>] [--from <file>]');
+    throw new Error('Usage: init [<url>] [--name <name>] | join | token | exec [<ENV>=<name> ... | --inputs <json>] [--output <json>] -- <command> [args...] | keep <name> --from <file> | read <name> | export <directory> [--principal <id>] | api <method> </path> [--json <body>] [--from <file>]');
   }
   const url = serverUrl(serverGiven ?? configured);
   const keyPath = process.env.FOUNDATION_RUNTIME_KEY_FILE || join(homedir(), '.local', 'state', 'foundation', createHash('sha256').update(url.origin).digest('hex').slice(0, 24) + (agentName ? '-' + agentName.toLowerCase().replace(/[^a-z0-9]+/g, '-') : '') + '.key');
@@ -230,7 +270,7 @@ async function main() {
   // A lent machine's key stays as it is; it ends with the machine.
   async function upgrade(label) {
     const me = await send('/v1/principals/me', undefined, { method: 'GET' });
-    if (me.key?.environment) return;
+    if ((await send('/v1/session', undefined, { method: 'GET' })).current?.via.environment) return;
     const { options } = await send('/v1/principals/' + encodeURIComponent(me.principal.id) + '/credentials', { kind: 'webauthn' });
     const made = createCredential(options, url.origin);
     await send('/v1/principals/' + encodeURIComponent(me.principal.id) + '/credentials', { kind: 'webauthn', name: label, credential: made.response }, { method: 'PUT' });
@@ -254,6 +294,7 @@ async function main() {
     catch (error) { if (action !== 'init') throw error; key = null; token = null; }
   }
   if (action === 'token') { console.log(token); return; }
+  if (action === 'export') { await exportTo(call, send); return; }
   // One request, as this machine, and the answer printed as it came. Nothing here knows the endpoints.
   if (action === 'api') {
     const response = await fetch(url.origin + call.target, { method: call.method, headers: { ...(token ? { authorization: 'Bearer ' + token } : {}), ...(call.body === undefined ? {} : { 'content-type': call.type }) },
@@ -288,14 +329,14 @@ async function main() {
     } else if (key?.token) { await upgrade(wanted); token = await prove(); await publishKey(); }
     if (serverGiven !== undefined) await saveUrl(url.origin);
     if (!me) me = await send('/v1/principals/me', undefined, { method: 'GET' });
-    console.log(JSON.stringify({ principal: me.principal, acts_for: me.acts_for ?? [] }, null, 2));
+    console.log(JSON.stringify({ principal: { id: me.principal.id, name: me.principal.name, created_at: me.principal.created_at }, acts_for: me.principal.acts_for ?? [] }, null, 2));
     console.log('\nKey file: ' + keyPath + '\nServer: ' + url.origin + (serverGiven !== undefined ? ' (saved to ' + configPath() + ')' : '') + '\nTo act for someone: foundation join\nEverything else is HTTP: Authorization: Bearer $(foundation token)');
     return;
   }
   // Asking a person to make this machine their agent. One they already approved has nothing to ask.
   if (action === 'join') {
     const me = await send('/v1/principals/me', undefined, { method: 'GET', accept: data => data.error?.code === 'not_approved' });
-    if (me.acts_for?.length) { console.log('Already approved on ' + url.origin + '.'); return; }
+    if (me.principal?.acts_for?.length) { console.log('Already approved on ' + url.origin + '.'); return; }
     const answer = await send('/v1/requests', { authorization_details: [{ type: 'relation', relation: 'agent' }] });
     console.log(JSON.stringify(answer, null, 2));
     return;
@@ -323,11 +364,14 @@ async function main() {
   }
   // Nothing runs before someone has accepted this key: a key that acts for nobody reaches only its own empty resources,
   // and the person it asked has yet to answer.
-  const current = await send('/v1/principals/me', undefined, { method: 'GET' });
+  const current = (await send('/v1/principals/me', undefined, { method: 'GET' })).principal;
   // A key given to a lent machine acts as its principal's own self. Any other key acts for someone once approved;
   // until then, whether waiting or refused, it has nothing to run with.
-  const own = Boolean(current.key?.environment);
-  if (!own && !current.acts_for?.length) throw new Error('Foundation request failed (401, not_approved). This key acts for nobody yet' + (current.requests?.[0] ? '; it is waiting for approval at ' + current.requests[0].verification_uri : '') + '.');
+  const own = Boolean((await send('/v1/session', undefined, { method: 'GET' })).current?.via.environment);
+  if (!own && !current.acts_for?.length) {
+    const waiting = (await send('/v1/requests?status=pending', undefined, { method: 'GET', accept: () => true })).requests?.[0];
+    throw new Error('Foundation request failed (401, not_approved). This key acts for nobody yet' + (waiting ? '; it is waiting for approval at ' + waiting.verification_uri : '') + '.');
+  }
   // Whose resources a run reaches: the one this key acts for, the one named when it acts for several, or its own.
   const acting = current.acts_for ?? [];
   const owner = process.env.FOUNDATION_AS || (acting.length === 1 ? acting[0] : null);