dsh-ssh-manage 0.2.1 → 0.3.0

package/lib/storage.js

@@ -3,6 +3,8 @@ import * as fs from 'node:fs/promises'
 import path from 'node:path'
 
 const KEY_BYTES = 32
+const storeLocks = new Map()
+const keyCreations = new Map()
 
 export function storagePaths(paths = {}) {
   const stateDir = paths.stateDir || path.join(paths.home || process.env.HOME || process.cwd(), '.dsh', '.ssh-manager')
@@ -15,6 +17,23 @@ export function storagePaths(paths = {}) {
   }
 }
 
+/**
+ * Serialize one async read-modify-write sequence per store key. Callers must
+ * only take the lock around their own read/write pair; the unlocked helpers in
+ * the vault, metadata and SSH config modules exist so nested locks never wait
+ * on themselves.
+ */
+export function withStoreLock(key, fn) {
+  const previous = storeLocks.get(key) ?? Promise.resolve()
+  const next = previous.then(() => fn())
+  const tail = next.then(() => undefined, () => undefined)
+  storeLocks.set(key, tail)
+  void tail.then(() => {
+    if (storeLocks.get(key) === tail) storeLocks.delete(key)
+  })
+  return next
+}
+
 export async function atomicWriteFile(filePath, data, mode = 0o600) {
   await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 })
   const temporary = `${filePath}.tmp-${process.pid}-${randomBytes(6).toString('hex')}`
@@ -28,23 +47,51 @@ export async function atomicWriteFile(filePath, data, mode = 0o600) {
   }
 }
 
+function decodeKey(raw) {
+  if (Buffer.isBuffer(raw) && raw.length === KEY_BYTES) return raw
+  const decoded = Buffer.from(String(raw).trim(), 'base64')
+  if (decoded.length !== KEY_BYTES) throw new Error('SSH manager key has an invalid length')
+  return decoded
+}
+
+async function readKey(keyPath) {
+  const raw = await fs.readFile(keyPath)
+  await fs.chmod(keyPath, 0o600).catch(() => {})
+  return decodeKey(raw)
+}
+
+/** Create the key exactly once per path in this process; adopt another writer's key on EEXIST. */
+function createKeyOnce(keyPath) {
+  const pending = keyCreations.get(keyPath)
+  if (pending) return pending
+  const creation = (async () => {
+    const key = randomBytes(KEY_BYTES)
+    await fs.mkdir(path.dirname(keyPath), { recursive: true, mode: 0o700 })
+    try {
+      await fs.writeFile(keyPath, key.toString('base64'), { encoding: 'utf8', mode: 0o600, flag: 'wx' })
+      return key
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error
+      // Another process created the key first: never overwrite an existing key.
+      return await readKey(keyPath)
+    }
+  })()
+  keyCreations.set(keyPath, creation)
+  const forget = () => {
+    if (keyCreations.get(keyPath) === creation) keyCreations.delete(keyPath)
+  }
+  void creation.then(forget, forget)
+  return creation
+}
+
 export async function loadOrCreateKey(paths) {
   const resolved = storagePaths(paths)
   try {
-    const raw = await fs.readFile(resolved.keyPath)
-    await fs.chmod(resolved.keyPath, 0o600).catch(() => {})
-    if (raw.length === KEY_BYTES) return raw
-    const decoded = Buffer.from(raw.toString('utf8').trim(), 'base64')
-    if (decoded.length !== KEY_BYTES) throw new Error('SSH manager key has an invalid length')
-    return decoded
+    return await readKey(resolved.keyPath)
   } catch (error) {
     if (error?.code !== 'ENOENT') throw error
-    const key = randomBytes(KEY_BYTES)
-    await atomicWriteFile(resolved.keyPath, key.toString('base64'), 0o600)
-    // The base64 representation is easier to inspect safely while retaining 256 bits.
-    const encoded = await fs.readFile(resolved.keyPath, 'utf8')
-    return Buffer.from(encoded.trim(), 'base64')
   }
+  return createKeyOnce(resolved.keyPath)
 }
 
 export async function readJson(filePath, fallback) {

package/lib/vault.js

@@ -1,5 +1,5 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
-import { atomicWriteFile, loadOrCreateKey, readJson, storagePaths } from './storage.js'
+import { atomicWriteFile, loadOrCreateKey, readJson, storagePaths, withStoreLock } from './storage.js'
 
 const ALGORITHM = 'aes-256-gcm'
 const IV_BYTES = 12
@@ -41,7 +41,8 @@ export function decryptRecords(payload, key) {
   }
 }
 
-export async function loadVault(paths) {
+/** Read the vault without taking the store lock; callers that mutate must hold it. */
+async function loadVaultUnlocked(paths) {
   const resolved = storagePaths(paths)
   const key = await loadOrCreateKey(resolved)
   const payload = await readJson(resolved.vaultPath, null)
@@ -49,7 +50,8 @@ export async function loadVault(paths) {
   return { paths: resolved, key, records }
 }
 
-export async function saveVault(paths, records) {
+/** Write the vault without taking the store lock; callers that read-modify-write must hold it. */
+async function saveVaultUnlocked(paths, records) {
   const resolved = storagePaths(paths)
   const key = await loadOrCreateKey(resolved)
   const payload = encryptRecords(normalizeRecords(records), key)
@@ -57,22 +59,38 @@ export async function saveVault(paths, records) {
   return { saved: true }
 }
 
+function vaultLockKey(paths) {
+  return `vault:${storagePaths(paths).stateDir}`
+}
+
+export async function loadVault(paths) {
+  return loadVaultUnlocked(paths)
+}
+
+export async function saveVault(paths, records) {
+  return withStoreLock(vaultLockKey(paths), () => saveVaultUnlocked(paths, records))
+}
+
 export async function setPassword(paths, alias, password) {
   const key = assertAlias(alias)
   if (typeof password !== 'string' || password.length === 0) throw new Error('Password is required')
-  const vault = await loadVault(paths)
-  vault.records[key] = password
-  await saveVault(vault.paths, vault.records)
-  return { saved: true, host: key }
+  return withStoreLock(vaultLockKey(paths), async () => {
+    const vault = await loadVaultUnlocked(paths)
+    vault.records[key] = password
+    await saveVaultUnlocked(vault.paths, vault.records)
+    return { saved: true, host: key }
+  })
 }
 
 export async function removePassword(paths, alias) {
   const key = assertAlias(alias)
-  const vault = await loadVault(paths)
-  const removed = Object.prototype.hasOwnProperty.call(vault.records, key)
-  delete vault.records[key]
-  if (removed) await saveVault(vault.paths, vault.records)
-  return { removed }
+  return withStoreLock(vaultLockKey(paths), async () => {
+    const vault = await loadVaultUnlocked(paths)
+    const removed = Object.prototype.hasOwnProperty.call(vault.records, key)
+    delete vault.records[key]
+    if (removed) await saveVaultUnlocked(vault.paths, vault.records)
+    return { removed }
+  })
 }
 
 export async function hasPassword(paths, alias) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ssh-manage",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "A DSH sidebar plugin for managing SSH host profiles with a real interactive PTY terminal.",
   "license": "MIT",
   "private": false,