arcane-os 0.3.0 → 0.3.2

package/src/dev-server.mjs

@@ -1,23 +1,9 @@
-import {randomBytes,timingSafeEqual} from 'node:crypto';
 import {constants as FS_CONSTANTS} from 'node:fs';
 import {lstat,open,realpath} from 'node:fs/promises';
 import http from 'node:http';
 import path from 'node:path';
-import {
-    authenticateAppReleaseReceipt,
-    readVerifiedAppReleaseFile,
-    RELEASE_MANIFEST_NAME
-} from './packager/core.mjs';
-import {
-    authenticateWorkspaceRuntimeReceipt,
-    readVerifiedWorkspaceRuntimeFile,
-    verifyWorkspaceRuntime
-} from './workspace-runtime.mjs';
-import {verifyRuntime} from './runtime.mjs';
-import {verifySdkBrowserRuntime} from './sdk-browser-runtime.mjs';
-import {resolveWorkspace,validateWorkspace} from './workspace.mjs';
+import {resolveWorkspace} from './workspace.mjs';
 import {createEventQueue} from './event-queue.mjs';
-import {SDK_NAME,SDK_VERSION} from './constants.mjs';
 
 const MIME_TYPES=new Map([
     ['.css','text/css; charset=utf-8'],
@@ -38,10 +24,6 @@ const MIME_TYPES=new Map([
     ['.woff2','font/woff2']
 ]);
 const READ_ONLY_NO_FOLLOW=FS_CONSTANTS.O_RDONLY|(FS_CONSTANTS.O_NOFOLLOW??0);
-const MAX_DEVELOPMENT_FILE_BYTES=64*1024*1024;
-const MAX_CONCURRENT_FILE_RESPONSES=4;
-const MAX_PENDING_FILE_RESPONSES=256;
-const SESSION_COOKIE='Arcane-Dev-Session';
 const PRIVATE_SOURCE_SEGMENTS=new Set([
     'arcane-app.json','arcane-package.json','test','tests','scripts','node_modules','dist','local'
 ]);
@@ -57,27 +39,6 @@ const SDK_RUNTIME_SOURCE_PRIVATE_MANIFESTS=new Set([
     'arcane_app_release.json','arcane_runtime_release.json','arcane_sdk_browser_release.json'
 ]);
 
-// This server is a loopback-only development host, not a production policy
-// boundary. The bundled runtime currently needs inline component execution,
-// workers, remote provider requests, media, and embedded web content. The
-// unguessable session cookie and exact numeric Host check protect this broad
-// development CSP from being exposed as a general network service.
-const DEVELOPMENT_CSP=[
-    "default-src 'self'",
-    "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'",
-    "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data: blob: http: https:",
-    "font-src 'self' data:",
-    "connect-src 'self' data: blob: http: https: ws: wss:",
-    "worker-src 'self' blob:",
-    "frame-src 'self' data: blob: http: https:",
-    "media-src 'self' data: blob: http: https:",
-    "object-src 'none'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'",
-    "form-action 'self'"
-].join('; ');
-
 function fail(message,code='ARCANE_OPERATION_FAILED'){
     const error=new Error(message);
     error.code=code;
@@ -91,20 +52,9 @@ function throwIfAborted(signal){
     throw error;
 }
 
-function responseSecurityHeaders(contentSecurityPolicy=DEVELOPMENT_CSP){
-    return {
-        'cache-control':'no-store',
-        'x-content-type-options':'nosniff',
-        'content-security-policy':contentSecurityPolicy,
-        'cross-origin-resource-policy':'same-origin',
-        'referrer-policy':'no-referrer'
-    };
-}
-
 function deny(response,status,message){
     response.writeHead(status,{
-        'content-type':'text/plain; charset=utf-8',
-        ...responseSecurityHeaders("default-src 'none'; frame-ancestors 'none'; base-uri 'none'")
+        'content-type':'text/plain; charset=utf-8'
     });
     response.end(`${message}\n`);
 }
@@ -136,17 +86,6 @@ function resolveInside(root,segments){
     return candidate;
 }
 
-function identityMatches(info,identity){
-    return !identity||(
-        String(info.dev)===identity.device
-        &&String(info.ino)===identity.inode
-        &&Number(info.size)===identity.bytes
-        &&String(info.mtimeNs)===identity.modifiedNanoseconds
-        &&String(info.ctimeNs)===identity.changedNanoseconds
-        &&(identity.links===undefined||String(info.nlink)===identity.links)
-    );
-}
-
 function inventoryKey(value){
     return process.platform==='win32'?value.toLowerCase():value;
 }
@@ -235,35 +174,6 @@ async function verifySdkRuntimeSourceRoot(sourceRoot,workspaceRoot,appId,{signal
             'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
     }
 
-    let packageFile;
-    try{
-        packageFile=await openSafeFile(canonicalRoot,['package.json']);
-    }catch{
-        fail('SDK runtime source package.json must be a readable bounded real file.',
-            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
-    }
-    if(!packageFile){
-        fail('SDK runtime source root must contain a real package.json.',
-            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
-    }
-    let packageDocument;
-    try{
-        packageDocument=JSON.parse(packageFile.bytes.toString('utf8'));
-    }catch{
-        fail('SDK runtime source package.json must be valid JSON.',
-            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
-    }
-    if(!packageDocument||Array.isArray(packageDocument)||packageDocument.name!==SDK_NAME){
-        fail(`SDK runtime source package name must be exactly ${SDK_NAME}.`,
-            'ARCANE_DEV_RUNTIME_SOURCE_INVALID');
-    }
-    if(packageDocument.version!==SDK_VERSION){
-        fail(
-            `SDK runtime source version must exactly match the executing SDK (${SDK_VERSION}).`,
-            'ARCANE_DEV_RUNTIME_VERSION_MISMATCH'
-        );
-    }
-
     const roots=[
         {
             path:'runtime/arcane',
@@ -299,36 +209,23 @@ async function verifySdkRuntimeSourceRoot(sourceRoot,workspaceRoot,appId,{signal
             path:root.path
         });
     }
-    const runtime=Object.freeze({
+    const runtime={
         mode:'sdk-source',
         protocol:SDK_RUNTIME_SOURCE_PROTOCOL,
-        sdkVersion:SDK_VERSION,
         mutable:true,
         distributionAuthority:false,
         sourceRoot:canonicalRoot
-    });
+    };
     await emitRuntimeSourceEvent(onEvent,{
         type:'runtime.source.mount.ready',
         appId,
         canonicalRoot,
-        sdkVersion:SDK_VERSION,
         protocol:SDK_RUNTIME_SOURCE_PROTOCOL,
         routeCount:mappings.length
     });
     return {mappings,runtime};
 }
 
-function identityMap(identities,prefix=''){
-    const normalizedPrefix=prefix?`${prefix}/`:'';
-    const result=new Map();
-    for(const identity of identities||[]){
-        if(!identity.path.startsWith(normalizedPrefix))continue;
-        const relative=identity.path.slice(normalizedPrefix.length);
-        if(relative)result.set(inventoryKey(relative),identity);
-    }
-    return result;
-}
-
 function routePrefixKey(prefix){
     return prefix.map(segment=>segment.normalize('NFC').toLowerCase()).join('/');
 }
@@ -355,38 +252,17 @@ function deterministicMappings(mappings){
 }
 
 function createFileWorkLimiter(){
-    let active=0;
-    const pending=[];
-    const release=()=>{
-        const next=pending.shift();
-        if(next)next();
-        else active-=1;
-    };
-    return async work=>{
-        if(active>=MAX_CONCURRENT_FILE_RESPONSES){
-            if(pending.length>=MAX_PENDING_FILE_RESPONSES){
-                fail('Development server file queue is full.','ARCANE_BACKPRESSURE');
-            }
-            await new Promise(resolve=>pending.push(resolve));
-        }else{
-            active+=1;
-        }
-        try{
-            return await work();
-        }finally{
-            release();
-        }
-    };
+    return async work=>work();
 }
 
-async function openSafeFile(root,segments,expectedIdentity){
+async function openSafeFile(root,segments){
     const candidate=resolveInside(root,segments);
     if(!candidate)return null;
     let current=root;
     for(const segment of segments){
         current=path.join(current,segment);
         let info;
-        try{info=await lstat(current,{bigint:true});}
+        try{info=await lstat(current);}
         catch(error){
             if(error?.code==='ENOENT')return null;
             throw error;
@@ -394,8 +270,10 @@ async function openSafeFile(root,segments,expectedIdentity){
         if(info.isSymbolicLink())return null;
     }
 
-    const before=await lstat(candidate,{bigint:true});
-    if(before.isSymbolicLink()||!before.isFile()||!identityMatches(before,expectedIdentity))return null;
+    const currentInfo=await lstat(candidate);
+    if(currentInfo.isSymbolicLink()||!currentInfo.isFile())return null;
+    const canonicalCandidate=await realpath(candidate);
+    if(!pathIsWithin(root,canonicalCandidate))return null;
     let handle;
     try{
         handle=await open(candidate,READ_ONLY_NO_FOLLOW);
@@ -404,53 +282,15 @@ async function openSafeFile(root,segments,expectedIdentity){
         throw error;
     }
     try{
-        const opened=await handle.stat({bigint:true});
-        if(!opened.isFile()||!identityMatches(opened,expectedIdentity)
-            ||!identityMatches(opened,{
-                device:String(before.dev),
-                inode:String(before.ino),
-                bytes:Number(before.size),
-                modifiedNanoseconds:String(before.mtimeNs),
-                changedNanoseconds:String(before.ctimeNs),
-                links:String(before.nlink)
-            })){
-            return null;
-        }
-        if(Number(opened.size)>MAX_DEVELOPMENT_FILE_BYTES){
-            fail(
-                `Development file exceeds the ${MAX_DEVELOPMENT_FILE_BYTES}-byte serving limit.`,
-                'ARCANE_POLICY_DENIED'
-            );
-        }
-        const bytes=await handle.readFile();
-        const after=await handle.stat({bigint:true});
-        if(!identityMatches(after,{
-            device:String(opened.dev),
-            inode:String(opened.ino),
-            bytes:Number(opened.size),
-            modifiedNanoseconds:String(opened.mtimeNs),
-            changedNanoseconds:String(opened.ctimeNs),
-            links:String(opened.nlink)
-        })||bytes.length!==Number(opened.size)){
-            return null;
-        }
-        const canonicalCandidate=await realpath(candidate);
-        const relative=path.relative(root,canonicalCandidate);
-        if(relative.startsWith('..')||path.isAbsolute(relative)){
+        const opened=await handle.stat();
+        if(!opened.isFile())return null;
+        const content=await handle.readFile();
+        const servedCandidate=await realpath(candidate);
+        if(!pathIsWithin(root,servedCandidate)
+            ||canonicalLocationKey(servedCandidate)!==canonicalLocationKey(canonicalCandidate)){
             return null;
         }
-        const currentInfo=await lstat(candidate,{bigint:true});
-        if(!identityMatches(currentInfo,{
-            device:String(opened.dev),
-            inode:String(opened.ino),
-            bytes:Number(opened.size),
-            modifiedNanoseconds:String(opened.mtimeNs),
-            changedNanoseconds:String(opened.ctimeNs),
-            links:String(opened.nlink)
-        })){
-            return null;
-        }
-        return {candidate:canonicalCandidate,bytes,size:bytes.length};
+        return {candidate:servedCandidate,content};
     }catch(error){
         if(error?.code==='ENOENT')return null;
         throw error;
@@ -463,8 +303,7 @@ async function sendFile(response,opened,{head=false}={}){
     const extension=path.extname(opened.candidate).toLowerCase();
     response.writeHead(200,{
         'content-type':MIME_TYPES.get(extension)||'application/octet-stream',
-        'content-length':opened.size,
-        ...responseSecurityHeaders()
+        'content-length':opened.content.byteLength
     });
     await new Promise((resolve,reject)=>{
         let settled=false;
@@ -488,7 +327,7 @@ async function sendFile(response,opened,{head=false}={}){
         response.once('error',failed);
         response.once('finish',completed);
         response.once('close',completed);
-        response.end(head?undefined:opened.bytes);
+        response.end(head?undefined:opened.content);
     });
 }
 
@@ -526,7 +365,6 @@ function sharedPathAllowed(relative,route){
 }
 
 async function sourceRoutes(workspaceRoot,appId,{
-    workspaceRuntimeReceipt,
     sdkRuntimeSourceRoot,
     signal,
     onEvent
@@ -570,58 +408,6 @@ async function sourceRoutes(workspaceRoot,appId,{
         };
     }
     const runtimeRoot=path.join(resolved.workspaceRoot,'arcane');
-    const validation=await validateWorkspace({
-        workspaceRoot:resolved.workspaceRoot,
-        appId:resolved.appId,
-        allowMissingManagedImportMap:true,
-        signal
-    });
-    const sdkInstallation=validation.sdkInstallation;
-    if(!sdkInstallation
-        ||typeof sdkInstallation.runtimeRoot!=='string'
-        ||typeof sdkInstallation.browserRuntimeRoot!=='string'){
-        fail(
-            'Validated external workspace is missing its bound SDK installation authority.',
-            'ARCANE_WORKSPACE_INVALID'
-        );
-    }
-    let verified=workspaceRuntimeReceipt;
-    if(!verified){
-        const sdkRuntimeRoot=sdkInstallation.runtimeRoot;
-        const sdkRuntimeReceipt=await verifyRuntime({
-            runtimeRoot:sdkRuntimeRoot,
-            signal
-        });
-        const sdkBrowserRuntimeRoot=sdkInstallation.browserRuntimeRoot;
-        const sdkBrowserRuntimeReceipt=await verifySdkBrowserRuntime({
-            browserRuntimeRoot:sdkBrowserRuntimeRoot,
-            signal
-        });
-        verified=await verifyWorkspaceRuntime({
-            workspaceRoot:resolved.workspaceRoot,
-            runtimeRoot:sdkRuntimeRoot,
-            runtimeReceipt:sdkRuntimeReceipt,
-            browserRuntimeRoot:sdkBrowserRuntimeRoot,
-            sdkBrowserRuntimeReceipt,
-            signal
-        });
-    }
-    verified=await authenticateWorkspaceRuntimeReceipt(verified,{
-        workspaceRoot:resolved.workspaceRoot,
-        signal
-    });
-    if(typeof verified.sourceRuntimeLocation!=='string'
-        ||typeof verified.sourceBrowserRuntimeLocation!=='string'
-        ||canonicalLocationKey(verified.sourceRuntimeLocation)
-            !==canonicalLocationKey(sdkInstallation.runtimeRoot)
-        ||canonicalLocationKey(verified.sourceBrowserRuntimeLocation)
-            !==canonicalLocationKey(sdkInstallation.browserRuntimeRoot)){
-        fail(
-            'Workspace runtime receipt sources do not match the bound SDK installation authority.',
-            'ARCANE_INTEGRITY_FAILED'
-        );
-    }
-    const arcaneIdentities=identityMap(verified.identities);
     return {
         workspaceRoot:resolved.workspaceRoot,
         workspaceMode:'external',
@@ -632,61 +418,27 @@ async function sourceRoutes(workspaceRoot,appId,{
             {
                 prefix:['arcane'],
                 root:runtimeRoot,
-                identities:arcaneIdentities,
-                read:relative=>readVerifiedWorkspaceRuntimeFile(verified,{
-                    workspaceRoot:resolved.workspaceRoot,
-                    relativePath:relative.join('/'),
-                    signal
-                }),
-                allow:relative=>arcaneIdentities.has(inventoryKey(relative.join('/')))
+                allow:sdkArcaneSourcePathAllowed
             }
         ]
     };
 }
 
-async function packagedRoutes(releaseRoot,releaseReceipt,{signal}={}){
+async function packagedRoutes(releaseRoot){
     if(typeof releaseRoot!=='string'||!releaseRoot.trim())fail('releaseRoot is required in packaged mode.','ARCANE_USAGE');
-    if(!releaseReceipt)fail('An authenticated release receipt is required in packaged mode.','ARCANE_POLICY_DENIED');
     const requested=path.resolve(releaseRoot);
-    await authenticateAppReleaseReceipt(releaseReceipt,{releaseRoot:requested,signal});
-    const info=await lstat(requested);
-    if(info.isSymbolicLink()||!info.isDirectory())fail('Packaged release root must be a real directory.');
-    const canonical=await realpath(requested);
-    const identities=identityMap(releaseReceipt.identities);
+    const canonical=await canonicalRealDirectory(requested,'Packaged release root');
     return {
         workspaceRoot:null,
         appId:null,
         startPath:'/index.html',
         mappings:[{
             prefix:[],
-            root:canonical,
-            identities,
-            read:relative=>readVerifiedAppReleaseFile(releaseReceipt,{
-                releaseRoot:canonical,
-                relativePath:relative.join('/'),
-                signal
-            }),
-            allow:relative=>identities.has(inventoryKey(relative.join('/')))
+            root:canonical
         }]
     };
 }
 
-function tokenMatches(value,expected){
-    if(typeof value!=='string')return false;
-    const received=Buffer.from(value,'utf8');
-    const wanted=Buffer.from(expected,'utf8');
-    return received.length===wanted.length&&timingSafeEqual(received,wanted);
-}
-
-function hasSessionCookie(request,cookieName,sessionToken){
-    const matches=String(request.headers.cookie||'')
-        .split(';')
-        .map(part=>part.trim())
-        .filter(part=>part.startsWith(`${cookieName}=`))
-        .map(part=>part.slice(cookieName.length+1));
-    return matches.length===1&&tokenMatches(matches[0],sessionToken);
-}
-
 function listen(server,{host,port,signal}){
     return new Promise((resolve,reject)=>{
         const cleanup=()=>{
@@ -718,9 +470,7 @@ async function startOwnedDevServer({
     host='127.0.0.1',
     port=0,
     signal,
-    workspaceRuntimeReceipt,
-    sdkRuntimeSourceRoot,
-    releaseReceipt
+    sdkRuntimeSourceRoot
 }={},events,releaseSignal){
     throwIfAborted(signal);
     if(mode!=='source'&&mode!=='packaged')fail(`Unsupported server mode: ${String(mode)}.`,'ARCANE_USAGE');
@@ -744,65 +494,31 @@ async function startOwnedDevServer({
     });
     const routeSet=mode==='source'
         ?await sourceRoutes(workspaceRoot,appId,{
-            workspaceRuntimeReceipt,
             sdkRuntimeSourceRoot,
             signal,
             onEvent:event=>events.send(event)
         })
-        :await packagedRoutes(releaseRoot,releaseReceipt,{signal});
+        :await packagedRoutes(releaseRoot);
     const mappings=deterministicMappings(routeSet.mappings);
     for(const mapping of mappings){
         const info=await lstat(mapping.root);
         if(info.isSymbolicLink()||!info.isDirectory())fail(`Server route root must be a real directory: ${mapping.root}.`);
         mapping.root=await realpath(mapping.root);
     }
-    const sessionToken=randomBytes(32).toString('hex');
-    const sessionCookieName=`${SESSION_COOKIE}-${randomBytes(8).toString('hex')}`;
-    let expectedAuthority=null;
     const requestTasks=new Set();
     const runFileWork=createFileWorkLimiter();
     const server=http.createServer((request,response)=>{
         let task;
         task=(async()=>{
-            if(!expectedAuthority){deny(response,503,'Server is starting.');return;}
-            if(request.headers.host!==expectedAuthority){
-                deny(response,421,'Misdirected request.');
-                return;
-            }
             if(request.method!=='GET'&&request.method!=='HEAD'){
                 deny(response,405,'Method not allowed.');
                 return;
             }
             const target=parseRequestTarget(request.url);
             if(!target){deny(response,400,'Invalid request path.');return;}
-            const queryKeys=[...target.searchParams.keys()];
-            const isBootstrap=request.method==='GET'
-                &&target.path===routeSet.startPath
-                &&queryKeys.length===1
-                &&queryKeys[0]==='arcane_session'
-                &&tokenMatches(target.searchParams.get('arcane_session'),sessionToken);
-            if(isBootstrap){
-                response.writeHead(302,{
-                    location:routeSet.startPath,
-                    'set-cookie':`${sessionCookieName}=${sessionToken}; HttpOnly; SameSite=Strict; Path=/`,
-                    ...responseSecurityHeaders()
-                });
-                response.end();
-                return;
-            }
-            if(!hasSessionCookie(request,sessionCookieName,sessionToken)){
-                deny(response,403,'Development server session required.');
-                return;
-            }
             const {segments}=target;
-            if(mode==='packaged'&&segments.some(segment=>
-                segment.toLowerCase()===RELEASE_MANIFEST_NAME.toLowerCase()
-            )){
-                deny(response,404,'Not found.');
-                return;
-            }
             if(segments.length===0){
-                response.writeHead(302,{location:routeSet.startPath,...responseSecurityHeaders()});
+                response.writeHead(302,{location:routeSet.startPath});
                 response.end();
                 return;
             }
@@ -814,23 +530,14 @@ async function startOwnedDevServer({
             if(relative.length===0){deny(response,404,'Not found.');return;}
             if(mapping.allow&&!mapping.allow(relative)){deny(response,404,'Not found.');return;}
             await runFileWork(async()=>{
-                const expectedIdentity=mapping.identities?.get(inventoryKey(relative.join('/')));
-                const opened=mapping.read
-                    ?{
-                        candidate:path.join(mapping.root,...relative),
-                        bytes:await mapping.read(relative)
-                    }
-                    :await openSafeFile(mapping.root,relative,expectedIdentity);
+                const opened=await openSafeFile(mapping.root,relative);
                 if(!opened){deny(response,404,'Not found.');return;}
-                opened.size=opened.bytes.length;
                 await sendFile(response,opened,{head:request.method==='HEAD'});
             });
         })().catch(async error=>{
             await events.enqueue({type:'server.request.failed',message:error.message});
             if(!response.headersSent){
-                const status=error?.code==='ARCANE_POLICY_DENIED'?413
-                    :error?.code==='ARCANE_BACKPRESSURE'?503
-                        :500;
+                const status=error?.code==='ARCANE_BACKPRESSURE'?503:500;
                 deny(response,status,'Internal server error.');
             }
             else response.destroy(error);
@@ -847,10 +554,9 @@ async function startOwnedDevServer({
     }
     const visibleHost=address.family==='IPv6'?`[${address.address}]`:address.address;
     const endpoint=new URL(`http://${visibleHost}:${address.port}`);
-    expectedAuthority=endpoint.host;
     const origin=endpoint.origin;
     const cleanUrl=`${origin}${routeSet.startPath}`;
-    const url=`${cleanUrl}?arcane_session=${sessionToken}`;
+    const url=cleanUrl;
     let closeInitiated=false;
     let lifecycleSettlementStarted=false;
     let operationalError=null;