@vrtmrz/livesync-commonlib 0.1.0-rc.7 → 0.1.0-rc.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -2,7 +2,12 @@ import type { UXDataWriteOptions, UXStat } from "../../common/types.js";
|
|
|
2
2
|
import type { IStorageAdapter } from "../../serviceModules/adapters/IStorageAdapter.js";
|
|
3
3
|
export type NodeStorageStat = UXStat;
|
|
4
4
|
export interface CreateNodeStorageOptions {
|
|
5
|
-
/**
|
|
5
|
+
/**
|
|
6
|
+
* Host-selected root directory. Adapter paths are resolved relative to this root.
|
|
7
|
+
*
|
|
8
|
+
* The host owns this trust boundary. The adapter is not a filesystem sandbox against
|
|
9
|
+
* an untrusted local process which can replace path components concurrently.
|
|
10
|
+
*/
|
|
6
11
|
rootPath: string;
|
|
7
12
|
}
|
|
8
13
|
/** Rooted storage adapter backed by Node's file-system APIs. */
|
package/docs/platform-storage.md
CHANGED
|
@@ -39,7 +39,9 @@ await storage.write('notes/example.md', '# Example');
|
|
|
39
39
|
|
|
40
40
|
`rootPath` may be absolute or process-relative. The host should normally resolve and validate configuration before constructing the adapter.
|
|
41
41
|
|
|
42
|
-
The Node adapter
|
|
42
|
+
The Node adapter rejects symbolic-link components which it observes in an adapter path before an operation. File opens also use `O_NOFOLLOW` for the final component where the platform exposes that flag. These checks protect against invalid paths and symbolic links which already exist when an operation begins. Its concrete `rename(sourcePath, targetPath)` operation validates both paths before providing the atomic rename expected by Node hosts.
|
|
43
|
+
|
|
44
|
+
The host-selected `rootPath` is a trust boundary, not an operating-system filesystem sandbox. The adapter assumes that an untrusted local process cannot replace that root or its descendants concurrently with an operation. A host which grants another local actor write access to the tree must not rely on the adapter as a privilege boundary.
|
|
43
45
|
|
|
44
46
|
## Shared path contract
|
|
45
47
|
|