artifacty 0.1.0

package/src/lib/security.js

@@ -0,0 +1,114 @@
+const TOKEN_HEADER = "x-artifacty-token";
+
+const SECRET_PATTERNS = [
+  { type: "anthropic-api-key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+  { type: "openai-api-key", pattern: /\bsk-(?!ant-)[A-Za-z0-9_-]{20,}\b/g },
+  { type: "github-token", pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g },
+  { type: "aws-access-key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
+  { type: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{20,}\b/g },
+  { type: "slack-token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/g },
+  { type: "private-key", pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g }
+];
+
+export function securityConfig(options = {}) {
+  return {
+    apiToken: options.apiToken || process.env.ARTIFACTY_API_TOKEN || "",
+    shareMode: options.shareMode || process.env.ARTIFACTY_SHARE_MODE || "local",
+    allowSecrets: Boolean(options.allowSecrets || process.env.ARTIFACTY_ALLOW_SECRETS === "true")
+  };
+}
+
+export function validateServerExposure({ host, config = securityConfig() }) {
+  const local = isLoopbackHost(host);
+  if (local) {
+    return;
+  }
+  if (!["lan", "team"].includes(config.shareMode)) {
+    throw new Error("Non-local host requires ARTIFACTY_SHARE_MODE=lan or team");
+  }
+  if (!config.apiToken) {
+    throw new Error("Non-local host requires ARTIFACTY_API_TOKEN");
+  }
+}
+
+export function requireToken({ request, url, body = {}, config = securityConfig() }) {
+  if (!config.apiToken) {
+    return;
+  }
+  const provided = extractToken({ request, url, body });
+  if (provided !== config.apiToken) {
+    throw Object.assign(new Error("Artifacty API token required"), {
+      code: "AUTH_REQUIRED",
+      statusCode: 401
+    });
+  }
+}
+
+export function scanForSecrets(content) {
+  const text = String(content ?? "");
+  const findings = [];
+  for (const { type, pattern } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    let match = pattern.exec(text);
+    while (match) {
+      findings.push({
+        type,
+        index: match.index,
+        preview: redactSecret(match[0])
+      });
+      match = pattern.exec(text);
+    }
+  }
+  return findings;
+}
+
+export function assertNoSecrets(input = {}, options = {}) {
+  const findings = scanForSecrets(input.content);
+  const allowSecrets =
+    options.allowSecrets ||
+    input.allowSecrets === true ||
+    input.metadata?.secretScan?.allowSecrets === true;
+
+  if (findings.length > 0 && !allowSecrets) {
+    throw Object.assign(new Error(`Secret scan blocked artifact content: ${findings.map((finding) => finding.type).join(", ")}`), {
+      code: "SECRET_DETECTED",
+      statusCode: 400,
+      findings
+    });
+  }
+
+  return {
+    status: findings.length > 0 ? "allowed" : "passed",
+    findingCount: findings.length,
+    findings: findings.map((finding) => ({
+      type: finding.type,
+      preview: finding.preview
+    }))
+  };
+}
+
+export function isLoopbackHost(host) {
+  const normalized = String(host || "").toLowerCase();
+  return normalized === "localhost" ||
+    normalized === "127.0.0.1" ||
+    normalized === "::1" ||
+    normalized === "";
+}
+
+function extractToken({ request, url, body }) {
+  const authorization = request.headers.authorization || "";
+  if (authorization.toLowerCase().startsWith("bearer ")) {
+    return authorization.slice(7).trim();
+  }
+  return request.headers[TOKEN_HEADER] ||
+    url.searchParams.get("token") ||
+    body._token ||
+    "";
+}
+
+function redactSecret(value) {
+  if (value.length <= 10) {
+    return "***";
+  }
+  return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}

package/src/lib/server-state.js

@@ -0,0 +1,53 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+export const DEFAULT_PUBLIC_URL = "http://127.0.0.1:8787";
+const SERVER_STATE_FILE = "server.json";
+
+export async function writeServerState(store, state) {
+  const next = {
+    schemaVersion: 1,
+    url: normalizePublicBaseUrl(state.url),
+    host: state.host,
+    port: state.port,
+    requestedPort: state.requestedPort,
+    portFallback: Boolean(state.portFallback),
+    pid: process.pid,
+    updatedAt: new Date().toISOString()
+  };
+  await mkdir(store.home, { recursive: true });
+  await writeFile(serverStatePath(store), `${JSON.stringify(next, null, 2)}\n`, "utf8");
+  return next;
+}
+
+export async function readServerState(store) {
+  try {
+    const parsed = JSON.parse(await readFile(serverStatePath(store), "utf8"));
+    if (typeof parsed.url !== "string" || !/^https?:\/\//.test(parsed.url)) {
+      return null;
+    }
+    return {
+      ...parsed,
+      url: normalizePublicBaseUrl(parsed.url)
+    };
+  } catch {
+    return null;
+  }
+}
+
+export async function resolvePublicBaseUrl(store, options = {}) {
+  const configured = options.url || process.env.ARTIFACTY_URL;
+  if (configured) {
+    return normalizePublicBaseUrl(configured);
+  }
+  const state = await readServerState(store);
+  return state?.url || DEFAULT_PUBLIC_URL;
+}
+
+export function serverStatePath(store) {
+  return path.join(store.home, SERVER_STATE_FILE);
+}
+
+function normalizePublicBaseUrl(value) {
+  return String(value || DEFAULT_PUBLIC_URL).replace(/\/+$/, "");
+}

package/src/lib/service.js

@@ -0,0 +1,105 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+
+const DEFAULT_LABEL = "com.artifacty.server";
+
+export async function serviceCommand(action, options = {}) {
+  const plistPath = path.resolve(options.plistPath || path.join(homedir(), "Library", "LaunchAgents", `${DEFAULT_LABEL}.plist`));
+  const plist = createLaunchAgentPlist(options);
+
+  if (action === "plist") {
+    return { action, path: plistPath, content: plist, dryRun: true };
+  }
+
+  if (action === "install") {
+    const existing = await readFile(plistPath, "utf8").catch(() => "");
+    const changed = existing !== plist;
+    if (!options.dryRun) {
+      await mkdir(path.dirname(plistPath), { recursive: true });
+      await writeFile(plistPath, plist, "utf8");
+    }
+    return {
+      action,
+      path: plistPath,
+      changed,
+      dryRun: Boolean(options.dryRun),
+      content: options.dryRun ? plist : undefined,
+      nextSteps: [
+        `launchctl load ${plistPath}`,
+        `launchctl unload ${plistPath}`
+      ]
+    };
+  }
+
+  if (action === "uninstall") {
+    const existed = existsSync(plistPath);
+    if (!options.dryRun) {
+      await rm(plistPath, { force: true });
+    }
+    return {
+      action,
+      path: plistPath,
+      changed: existed,
+      dryRun: Boolean(options.dryRun)
+    };
+  }
+
+  throw new Error("service requires action: plist, install, or uninstall");
+}
+
+export function createLaunchAgentPlist(options = {}) {
+  const projectDir = path.resolve(options.projectDir || process.cwd());
+  const nodePath = process.execPath;
+  const serverPath = path.resolve(options.serverPath || path.join(projectDir, "src", "server.js"));
+  const host = options.host || process.env.ARTIFACTY_HOST || "127.0.0.1";
+  const port = options.port || process.env.ARTIFACTY_PORT;
+  const home = path.resolve(options.home || process.env.ARTIFACTY_HOME || path.join(homedir(), ".artifacty"));
+  const logDir = path.join(home, "logs");
+  const portArguments = port
+    ? `    <string>--port</string>
+    <string>${escapeXml(port)}</string>
+`
+    : "";
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${DEFAULT_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(nodePath)}</string>
+    <string>${escapeXml(serverPath)}</string>
+    <string>--host</string>
+    <string>${escapeXml(host)}</string>
+${portArguments}    <string>--home</string>
+    <string>${escapeXml(home)}</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>ARTIFACTY_HOME</key>
+    <string>${escapeXml(home)}</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(path.join(logDir, "server.out.log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(path.join(logDir, "server.err.log"))}</string>
+</dict>
+</plist>
+`;
+}
+
+function escapeXml(value) {
+  return String(value)
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;");
+}