@vantran-se/openchamber-web 1.23.1 → 1.24.4

package/server/lib/guests/service.test.js

@@ -0,0 +1,277 @@
+import { afterEach, describe, expect, test } from 'bun:test';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import {
+  getServiceStatus,
+  proxyGuestServiceRequest,
+  readServicePid,
+  stopAllGuestServices,
+  stopGuestService,
+} from './service.js';
+import { setCapabilityGrants, writeExtensionStore } from './persist.js';
+
+const writeFixture = async () => {
+  const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-service-'));
+  const persistPath = path.join(dir, 'extensions.json');
+  const packageRoot = path.join(dir, 'docker');
+  await fs.mkdir(path.join(packageRoot, 'service'), { recursive: true });
+  await fs.writeFile(path.join(packageRoot, 'service', 'main.js'), `
+import http from 'node:http';
+const port = Number(process.env.OPENCHAMBER_SERVICE_PORT);
+const token = process.env.OPENCHAMBER_SERVICE_TOKEN;
+http.createServer((req, res) => {
+  if (req.headers.authorization !== \`Bearer \${token}\`) {
+    res.writeHead(401);
+    res.end('no');
+    return;
+  }
+  if (req.url === '/health') {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true }));
+    return;
+  }
+  if (req.url === '/ping') {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ pong: true }));
+    return;
+  }
+  res.writeHead(404);
+  res.end('missing');
+}).listen(port, '127.0.0.1');
+`);
+  await writeExtensionStore(persistPath, { paths: [packageRoot], sources: {}, capabilityGrants: {} });
+  return { dir, persistPath, packageRoot };
+};
+
+afterEach(async () => {
+  await stopAllGuestServices();
+});
+
+describe('guest service proxy', () => {
+  test('refuses when permissions need a grant', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await expect(proxyGuestServiceRequest({
+        guestId: 'docker',
+        packageRoot,
+        service: {
+          entry: 'service/main.js',
+          permissions: { exec: ['docker'] },
+        },
+        granted: [],
+        persistPath,
+        method: 'GET',
+        path: '/ping',
+      })).rejects.toMatchObject({ code: 'NO_SERVICE' });
+      expect(getServiceStatus('docker')).toBe('stopped');
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('refuses when the extension is disabled', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await writeExtensionStore(persistPath, {
+        paths: [packageRoot],
+        sources: {},
+        capabilityGrants: { docker: ['service'] },
+        disabledGuests: { docker: true },
+      });
+      await expect(proxyGuestServiceRequest({
+        guestId: 'docker',
+        guestName: 'Docker',
+        packageRoot,
+        service: {
+          entry: 'service/main.js',
+          permissions: { exec: ['docker'] },
+        },
+        granted: ['service'],
+        persistPath,
+        method: 'GET',
+        path: '/ping',
+      })).rejects.toMatchObject({
+        code: 'DISABLED',
+        message: 'Docker is disabled in Settings → Extensions.',
+      });
+      expect(getServiceStatus('docker')).toBe('stopped');
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('spawns, proxies, and reports ready', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      const result = await proxyGuestServiceRequest({
+        guestId: 'docker',
+        packageRoot,
+        service: {
+          entry: 'service/main.js',
+          permissions: { exec: ['docker'] },
+        },
+        granted: ['service'],
+        persistPath,
+        method: 'GET',
+        path: '/ping',
+      });
+      expect(result).toEqual({ status: 200, body: '{"pong":true}' });
+      expect(getServiceStatus('docker')).toBe('ready');
+      await stopGuestService('docker');
+      expect(getServiceStatus('docker')).toBe('stopped');
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('coalesces parallel first requests onto one spawn', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      const service = {
+        entry: 'service/main.js',
+        permissions: { exec: ['docker'] },
+      };
+      const results = await Promise.all([
+        proxyGuestServiceRequest({
+          guestId: 'docker',
+          packageRoot,
+          service,
+          granted: ['service'],
+          persistPath,
+          method: 'GET',
+          path: '/ping',
+        }),
+        proxyGuestServiceRequest({
+          guestId: 'docker',
+          packageRoot,
+          service,
+          granted: ['service'],
+          persistPath,
+          method: 'GET',
+          path: '/ping',
+        }),
+        proxyGuestServiceRequest({
+          guestId: 'docker',
+          packageRoot,
+          service,
+          granted: ['service'],
+          persistPath,
+          method: 'GET',
+          path: '/ping',
+        }),
+      ]);
+      expect(results).toEqual([
+        { status: 200, body: '{"pong":true}' },
+        { status: 200, body: '{"pong":true}' },
+        { status: 200, body: '{"pong":true}' },
+      ]);
+      expect(getServiceStatus('docker')).toBe('ready');
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('rejects a path with a scheme', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      await expect(proxyGuestServiceRequest({
+        guestId: 'docker',
+        packageRoot,
+        service: { entry: 'service/main.js' },
+        granted: ['service'],
+        persistPath,
+        method: 'GET',
+        path: 'http://evil.example/ping',
+      })).rejects.toMatchObject({ code: 'BAD_PATH' });
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('pause during startup', () => {
+  test('a stop that lands while the service is coming up wins', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      const pending = proxyGuestServiceRequest({
+        guestId: 'docker',
+        packageRoot,
+        service: { entry: 'service/main.js', permissions: { exec: ['docker'] } },
+        granted: ['service'],
+        persistPath,
+        method: 'GET',
+        path: '/ping',
+      });
+      // Stop while the process is coming up: the start must notice and not
+      // hand a ready service to the request that began it.
+      const startedAt = Date.now();
+      while (getServiceStatus('docker') !== 'starting' && Date.now() - startedAt < 5_000) {
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      expect(getServiceStatus('docker')).toBe('starting');
+      await stopGuestService('docker');
+      await expect(pending).rejects.toMatchObject({ code: 'NO_SERVICE' });
+      expect(getServiceStatus('docker')).toBe('stopped');
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('pause before the request reads the store', () => {
+  test('a stop that lands before the first read still wins', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      const pending = proxyGuestServiceRequest({
+        guestId: 'docker',
+        packageRoot,
+        service: { entry: 'service/main.js', permissions: { exec: ['docker'] } },
+        granted: ['service'],
+        persistPath,
+        method: 'GET',
+        path: '/ping',
+      });
+      await stopGuestService('docker');
+      await expect(pending).rejects.toMatchObject({ code: 'NO_SERVICE' });
+      expect(getServiceStatus('docker')).toBe('stopped');
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('restart after the process died', () => {
+  test('the next request restarts the service instead of reading the cleanup as a pause', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      const params = {
+        guestId: 'docker',
+        packageRoot,
+        service: { entry: 'service/main.js', permissions: { exec: ['docker'] } },
+        granted: ['service'],
+        persistPath,
+        method: 'GET',
+        path: '/ping',
+      };
+      expect(await proxyGuestServiceRequest(params)).toEqual({ status: 200, body: '{"pong":true}' });
+      // Kill the process behind the host's back, the way a crash would.
+      const pid = readServicePid('docker');
+      process.kill(pid, 'SIGKILL');
+      const startedAt = Date.now();
+      while (getServiceStatus('docker') === 'ready' && Date.now() - startedAt < 5_000) {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+      expect(await proxyGuestServiceRequest(params)).toEqual({ status: 200, body: '{"pong":true}' });
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+});

package/server/lib/guests/sockets.js

@@ -0,0 +1,129 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+const SOCKET_PLATFORMS = new Set(['linux', 'darwin', 'win32']);
+
+/**
+ * @param {string} value
+ * @param {string} [home]
+ */
+export const expandHomePath = (value, home = process.env.HOME || os.homedir()) => {
+  if (value === '~') {
+    return home;
+  }
+  if (value.startsWith('~/') || value.startsWith('~\\')) {
+    return path.join(home, value.slice(2));
+  }
+  return value;
+};
+
+/**
+ * @param {{ id: string, candidatesByPlatform?: Partial<Record<'linux' | 'darwin' | 'win32', string[]>> }} binding
+ * @param {NodeJS.Platform} [platform]
+ * @param {string} [home]
+ */
+export const platformSocketCandidates = (
+  binding,
+  platform = process.platform,
+  home = process.env.HOME || os.homedir(),
+) => {
+  if (!SOCKET_PLATFORMS.has(platform)) {
+    return [];
+  }
+  const list = binding.candidatesByPlatform?.[platform] ?? [];
+  return list.map((entry) => expandHomePath(entry, home));
+};
+
+/**
+ * @param {{ id: string, candidatesByPlatform?: Partial<Record<'linux' | 'darwin' | 'win32', string[]>> }} binding
+ * @param {{
+ *   override?: string | null,
+ *   platform?: NodeJS.Platform,
+ *   access?: (candidate: string) => Promise<void>,
+ *   home?: string,
+ * }} [options]
+ * @returns {Promise<string | null>}
+ */
+export const resolveSocketBinding = async (binding, options = {}) => {
+  const {
+    override = null,
+    platform = process.platform,
+    access = (candidate) => fs.access(candidate),
+    home = process.env.HOME || os.homedir(),
+  } = options;
+  if (typeof override === 'string' && override.trim()) {
+    return expandHomePath(override.trim(), home);
+  }
+  for (const candidate of platformSocketCandidates(binding, platform, home)) {
+    try {
+      await access(candidate);
+      return candidate;
+    } catch {
+      // try next candidate
+    }
+  }
+  return null;
+};
+
+/**
+ * @param {Array<{ id: string, candidatesByPlatform?: Partial<Record<'linux' | 'darwin' | 'win32', string[]>> }>} bindings
+ * @param {Record<string, string>} [overrides]
+ * @param {{
+ *   platform?: NodeJS.Platform,
+ *   access?: (candidate: string) => Promise<void>,
+ *   home?: string,
+ * }} [options]
+ */
+export const buildPublicSocketBindings = async (bindings, overrides = {}, options = {}) => {
+  const {
+    platform = process.platform,
+    access,
+    home = process.env.HOME || os.homedir(),
+  } = options;
+  /** @type {Array<{ id: string, candidates: string[], resolved: string | null, override: string | null }>} */
+  const out = [];
+  for (const binding of bindings) {
+    const rawOverride = overrides[binding.id];
+    const override = typeof rawOverride === 'string' && rawOverride.trim()
+      ? expandHomePath(rawOverride.trim(), home)
+      : null;
+    const candidates = platformSocketCandidates(binding, platform, home);
+    const resolved = await resolveSocketBinding(binding, {
+      override: rawOverride,
+      platform,
+      access,
+      home,
+    });
+    out.push({
+      id: binding.id,
+      candidates,
+      resolved,
+      override,
+    });
+  }
+  return out;
+};
+
+/**
+ * @param {Array<{ id: string, candidatesByPlatform?: Partial<Record<'linux' | 'darwin' | 'win32', string[]>> }>} bindings
+ * @param {Record<string, string>} [overrides]
+ * @param {{
+ *   platform?: NodeJS.Platform,
+ *   access?: (candidate: string) => Promise<void>,
+ *   home?: string,
+ * }} [options]
+ * @returns {Promise<Record<string, string>>}
+ */
+export const resolveServiceSocketEnv = async (bindings, overrides = {}, options = {}) => {
+  const publicBindings = await buildPublicSocketBindings(bindings, overrides, options);
+  /** @type {Record<string, string>} */
+  const sockets = {};
+  for (const binding of publicBindings) {
+    if (!binding.resolved) {
+      continue;
+    }
+    sockets[binding.id] = binding.resolved;
+  }
+  return sockets;
+};

package/server/lib/guests/sockets.test.js

@@ -0,0 +1,110 @@
+import { describe, expect, test } from 'bun:test';
+import path from 'node:path';
+
+import {
+  buildPublicSocketBindings,
+  expandHomePath,
+  resolveServiceSocketEnv,
+  resolveSocketBinding,
+} from './sockets.js';
+
+const dockerBinding = {
+  id: 'docker',
+  candidatesByPlatform: {
+    linux: ['/var/run/docker.sock', '/run/user/1000/docker.sock'],
+    darwin: ['~/.docker/run/docker.sock', '~/.colima/default/docker.sock'],
+    win32: ['//./pipe/docker_engine'],
+  },
+};
+
+describe('expandHomePath', () => {
+  test('expands ~ and leaves absolute paths alone', () => {
+    expect(expandHomePath('~/run/docker.sock', '/Users/user')).toBe(
+      path.join('/Users/user', 'run/docker.sock'),
+    );
+    expect(expandHomePath('/var/run/docker.sock', '/Users/user')).toBe('/var/run/docker.sock');
+  });
+});
+
+describe('resolveSocketBinding', () => {
+  test('override wins before candidates', async () => {
+    const resolved = await resolveSocketBinding(dockerBinding, {
+      override: '~/custom.sock',
+      platform: 'darwin',
+      home: '/Users/user',
+      access: async () => {
+        throw new Error('should not access');
+      },
+    });
+    expect(resolved).toBe(path.join('/Users/user', 'custom.sock'));
+  });
+
+  test('picks the first existing candidate for the platform', async () => {
+    const seen = [];
+    const resolved = await resolveSocketBinding(dockerBinding, {
+      platform: 'linux',
+      access: async (candidate) => {
+        seen.push(candidate);
+        if (candidate !== '/run/user/1000/docker.sock') {
+          throw Object.assign(new Error('missing'), { code: 'ENOENT' });
+        }
+      },
+    });
+    expect(resolved).toBe('/run/user/1000/docker.sock');
+    expect(seen).toEqual(['/var/run/docker.sock', '/run/user/1000/docker.sock']);
+  });
+
+  test('returns null when nothing exists', async () => {
+    const resolved = await resolveSocketBinding(dockerBinding, {
+      platform: 'darwin',
+      home: '/Users/user',
+      access: async () => {
+        throw Object.assign(new Error('missing'), { code: 'ENOENT' });
+      },
+    });
+    expect(resolved).toBeNull();
+  });
+});
+
+describe('buildPublicSocketBindings', () => {
+  test('exposes candidates, override, and resolved for the catalog', async () => {
+    const [binding] = await buildPublicSocketBindings(
+      [dockerBinding],
+      { docker: '/tmp/docker.sock' },
+      {
+        platform: 'darwin',
+        home: '/Users/user',
+        access: async () => undefined,
+      },
+    );
+    expect(binding).toEqual({
+      id: 'docker',
+      candidates: [
+        path.join('/Users/user', '.docker/run/docker.sock'),
+        path.join('/Users/user', '.colima/default/docker.sock'),
+      ],
+      resolved: '/tmp/docker.sock',
+      override: '/tmp/docker.sock',
+    });
+  });
+});
+
+describe('resolveServiceSocketEnv', () => {
+  test('builds OPENCHAMBER_SERVICE_SOCKETS map from resolved bindings', async () => {
+    const env = await resolveServiceSocketEnv(
+      [dockerBinding],
+      {},
+      {
+        platform: 'linux',
+        access: async (candidate) => {
+          if (candidate !== '/var/run/docker.sock') {
+            throw Object.assign(new Error('missing'), { code: 'ENOENT' });
+          }
+        },
+      },
+    );
+    expect(env).toEqual({
+      docker: '/var/run/docker.sock',
+    });
+  });
+});