gcb-host 0.8.1 → 0.10.0

package/lib/token-lock.d.ts

@@ -0,0 +1,34 @@
+/** The directory holding the token's lock. It persists so a bind mount can provide it. */
+export declare function tokenLockPath(path: string): string;
+/**
+ * Run `fn` while holding the token's lock.
+ *
+ * @param path - The token path.
+ * @param fn - The work to do under the lock.
+ * @returns Whatever `fn` returns.
+ */
+export declare function withTokenLock<T>(path: string, fn: () => Promise<T>): Promise<T>;
+/**
+ * Open the token for an in-place write through a validated descriptor.
+ *
+ * @param path - The token path.
+ * @returns An open writable descriptor.
+ */
+export declare function openTokenForWrite(path: string): number;
+/**
+ * Open, replace and close the token while its caller holds the lock.
+ *
+ * @param path - The token path.
+ * @param token - The new refresh token.
+ */
+export declare function writeTokenLocked(path: string, token: string): void;
+/**
+ * Replace the token contents through an already-open descriptor.
+ *
+ * Callers hold the token lock; the descriptor prevents a path swap from redirecting the write.
+ *
+ * @param fd - An open token descriptor.
+ * @param token - The new refresh token.
+ */
+export declare function writeTokenThrough(fd: number, token: string): void;
+//# sourceMappingURL=token-lock.d.ts.map

package/lib/token-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-lock.d.ts","sourceRoot":"","sources":["../src/token-lock.ts"],"names":[],"mappings":"AA2BA,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAmBD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA2CrF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAetD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOlE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjE"}

package/lib/token-lock.js

@@ -0,0 +1,135 @@
+/**
+ * Cross-process coordination for the one writable secret: the authorized person's refresh token.
+ *
+ * The daemon renews it and `gcb authorize` replaces it. Both hold the same lock for the whole read
+ * → exchange → write sequence, so a reader never sees a token another process is rewriting. The
+ * lock directory is mounted beside the token in the sidecar; it must exist on both sides.
+ */
+import { closeSync, fchmodSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync, constants as fsConstants, } from 'node:fs';
+import { join } from 'node:path';
+const LOCK_TIMEOUT_MS = 120_000;
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+/** The directory holding the token's lock. It persists so a bind mount can provide it. */
+export function tokenLockPath(path) {
+    return `${path}.lock`;
+}
+/** Create the persistent lock directory, or reject a path that is not a real directory. */
+function ensureLockDirectory(path) {
+    const lock = tokenLockPath(path);
+    try {
+        const stat = lstatSync(lock);
+        if (!stat.isDirectory() || stat.isSymbolicLink()) {
+            throw new Error(`${lock} is not a real directory`);
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+        mkdirSync(lock, { recursive: true, mode: 0o700 });
+    }
+    return lock;
+}
+/**
+ * Run `fn` while holding the token's lock.
+ *
+ * @param path - The token path.
+ * @param fn - The work to do under the lock.
+ * @returns Whatever `fn` returns.
+ */
+export async function withTokenLock(path, fn) {
+    const lock = ensureLockDirectory(path);
+    const held = join(lock, 'held');
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let fd;
+    for (;;) {
+        try {
+            fd = openSync(held, 'wx', 0o600);
+            try {
+                writeFileSync(fd, `${process.pid}\n`);
+            }
+            catch (error) {
+                closeSync(fd);
+                unlinkSync(held);
+                throw new Error(`could not initialize the lock on ${path}: ${error.message}`, {
+                    cause: error,
+                });
+            }
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST') {
+                throw new Error(`could not lock ${path}: ${error.message}`, { cause: error });
+            }
+            if (Date.now() >= deadline) {
+                throw new Error(`timed out waiting for the lock on ${path}; if no authorize or broker is running, remove ${held} and retry`, { cause: error });
+            }
+            await sleep(25);
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        closeSync(fd);
+        try {
+            if (readFileSync(held, 'utf8').trim() === String(process.pid)) {
+                unlinkSync(held);
+            }
+        }
+        catch {
+            // Another process already removed a stale lock; nothing to release.
+        }
+    }
+}
+/**
+ * Open the token for an in-place write through a validated descriptor.
+ *
+ * @param path - The token path.
+ * @returns An open writable descriptor.
+ */
+export function openTokenForWrite(path) {
+    const fd = openSync(path, fsConstants.O_WRONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0));
+    try {
+        if (!fstatSync(fd).isFile()) {
+            throw new Error(`${path} is not a regular file`);
+        }
+        fchmodSync(fd, 0o600);
+        return fd;
+    }
+    catch (error) {
+        closeSync(fd);
+        throw error;
+    }
+}
+/**
+ * Open, replace and close the token while its caller holds the lock.
+ *
+ * @param path - The token path.
+ * @param token - The new refresh token.
+ */
+export function writeTokenLocked(path, token) {
+    const fd = openTokenForWrite(path);
+    try {
+        writeTokenThrough(fd, token);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * Replace the token contents through an already-open descriptor.
+ *
+ * Callers hold the token lock; the descriptor prevents a path swap from redirecting the write.
+ *
+ * @param fd - An open token descriptor.
+ * @param token - The new refresh token.
+ */
+export function writeTokenThrough(fd, token) {
+    ftruncateSync(fd, 0);
+    writeFileSync(fd, `${token}\n`);
+    fchmodSync(fd, 0o600);
+}
+//# sourceMappingURL=token-lock.js.map

package/lib/token-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-lock.js","sourceRoot":"","sources":["../src/token-lock.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,aAAa,EACb,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,aAAa,EACb,SAAS,IAAI,WAAW,GACzB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,eAAe,GAAG,OAAO,CAAA;AAC/B,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,GAAG,IAAI,OAAO,CAAA;AACvB,CAAC;AAED,2FAA2F;AAC3F,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,IAAY,EAAE,EAAoB;IACvE,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAA;IAC7C,IAAI,EAAsB,CAAA;IAC1B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;YAChC,IAAI,CAAC;gBACH,aAAa,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,EAAE,CAAC,CAAA;gBACb,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,EAAE;oBACvF,KAAK,EAAE,KAAK;iBACb,CAAC,CAAA;YACJ,CAAC;YACD,MAAK;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;YAC1F,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,kDAAkD,IAAI,YAAY,EAC3G,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAA;IACnB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,IAAI,CAAC;YACH,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,UAAU,CAAC,IAAI,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,EAAE,GAAG,QAAQ,CACjB,IAAI,EACJ,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CACrF,CAAA;IACD,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAA;QAClD,CAAC;QACD,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC;QACH,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU,EAAE,KAAa;IACzD,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACpB,aAAa,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,CAAA;IAC/B,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;AACvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gcb-host",
-  "version": "0.8.1",
+  "version": "0.10.0",
   "type": "module",
   "description": "Host-side gcb broker, configuration, providers and administration commands.",
   "repository": {
@@ -27,7 +27,7 @@
     "lib"
   ],
   "dependencies": {
-    "gcb-core": "0.8.1",
+    "gcb-core": "0.10.0",
     "node-fetch-native": "^1.6.7",
     "x-fetch": "^0.3.0",
     "yaml": "^2.9.1"