instabox 0.6.0 → 0.6.2

package/skills/instabox-basic-setup/scripts/lib.mjs

@@ -3,6 +3,7 @@
 // The one rule every function here keeps: a credential's value is never
 // returned to the agent, stored in a file or printed. Code that looks at a
 // secret returns names, places and sizes only.
+import { isIP } from 'node:net';
 import { spawnSync } from 'node:child_process';
 import { lstatSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -82,9 +83,23 @@ export const WELL_KNOWN = new Set([
   'DIGITALOCEAN_ACCESS_TOKEN',
 ]);
 
-// Names the Vault refuses for env items (docs/vault.md).
-const RESERVED = new Set(['HOME', 'PATH', 'USER', 'LOGNAME', 'SHELL', 'TERM', 'XDG_RUNTIME_DIR', 'DBUS_SESSION_BUS_ADDRESS']);
-export function vaultEnvNameOK(name) {
+// Reserved Secret variable names (internal/secrets/validate.go).
+const RESERVED = new Set([
+  'HOME',
+  'PATH',
+  'USER',
+  'LOGNAME',
+  'SHELL',
+  'TERM',
+  'XDG_RUNTIME_DIR',
+  'DBUS_SESSION_BUS_ADDRESS',
+  'SSL_CERT_FILE',
+  'SSL_CERT_DIR',
+  'REQUESTS_CA_BUNDLE',
+  'CURL_CA_BUNDLE',
+  'NODE_EXTRA_CA_CERTS',
+]);
+export function secretNameOK(name) {
   return (
     /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
     name.length <= 128 &&
@@ -100,12 +115,13 @@ export const isSecretName = (name) => SECRET_NAME.test(name);
 export const MACOS_ONLY =
   /\/opt\/homebrew|\/usr\/local\/Cellar|\/usr\/local\/Homebrew|\/Applications\/|\/Library\/|\bosxkeychain\b|\bUseKeychain\b|\bpbcopy\b|\bpbpaste\b|\bosascript\b|\breattach-to-user-namespace\b|\bterminal-notifier\b|\bafplay\b|\/System\/|\.orbstack\/|1password.*agent\.sock|\bsecurity (?:find|add)-[a-z-]*password\b/i;
 
-// The Vault's limits (docs/vault.md, pkg/instaboxapi MaxVaultValueBytes); the server's own
-// come from `instabox usage --json` (.limits.vault) when it answers.
-export const VAULT_MAX_VALUE = 64 * 1024;
-export const VAULT_MAX_TOTAL = 256 * 1024;
-export const VAULT_MAX_ITEMS = 100;
+// Org Secret limits; the server may override these in .limits.vault (legacy wire name).
+export const SECRET_MAX_VALUE = 64 * 1024;
+export const SECRET_MAX_TOTAL = 256 * 1024;
+export const SECRET_MAX_ITEMS = 100;
 
+export const FILE_MAX_VALUE = 64 * 1024;
+export const FILE_MAX_TOTAL = 512 * 1024;
 export const BOX_HOME = '/data/home';
 
 // Runs a command without a shell; never throws. stdout is returned to the caller only:
@@ -184,43 +200,49 @@ export function human(bytes) {
   return `${v >= 10 ? Math.round(v) : v.toFixed(1)} ${u[i]}`;
 }
 
-// The Vault item name for a file item: its path with / as -, as `instabox vault set-file` does.
-export function vaultFileName(path) {
-  return path
-    .replace(/^\./, '')
-    .replaceAll('/', '-')
-    .replace(/[^A-Za-z0-9._-]/g, '-')
-    .replace(/^-+|-+$/g, '')
-    .slice(0, 128);
-}
-
-// A Vault file path must be relative, clean, without .. components (docs/vault.md).
-export function vaultPathOK(p) {
-  if (!p || p.startsWith('/') || p.length > 255 || /[\0\\\n]/.test(p)) return false;
+// Paths are relative to the guest home. Config copying never follows symlinks.
+export function configPathOK(p) {
+  if (typeof p !== 'string' || !p || p.startsWith('/') || p.length > 255 || /[\x00-\x1f\x7f\\]/.test(p)) return false;
   return p.split('/').every((c) => c !== '' && c !== '.' && !c.startsWith('..'));
 }
 
-// A selector as the plan writes it: `*` (every box) or `key=value,key=value`.
-export function parseSelector(s) {
-  s = s.trim();
-  if (s === '*' || s === '') return {};
-  const out = {};
-  for (const part of s.split(',')) {
-    const m = part.trim().match(/^([A-Za-z0-9_.-]{1,63})=([^,]{0,512})$/);
-    if (!m) throw new Error(`selector ${JSON.stringify(s)}: write * or key=value,key=value`);
-    out[m[1]] = m[2];
-  }
-  if (Object.keys(out).length > 32) throw new Error('selector: 32 labels at most');
-  return out;
+export function deliveryPolicy(delivery, hosts = []) {
+  if (!['env', 'proxy'].includes(delivery) || !Array.isArray(hosts)) throw new Error('delivery must be env or proxy');
+  if (delivery === 'env' && hosts.length) throw new Error('env delivery cannot enforce hosts; use -');
+  if (delivery === 'proxy' && (!hosts.length || hosts.length > 32))
+    throw new Error('proxy delivery requires 1-32 exact hosts');
+  const normalized = hosts.map((name) => {
+    if (typeof name !== 'string') throw new Error('hosts must be exact public DNS names');
+    const h = name.toLowerCase().replace(/\.$/, '');
+    if (
+      h.length > 253 ||
+      !h.includes('.') ||
+      isIP(h) ||
+      /(?:^|\.)(?:local|localhost)$/.test(h) ||
+      h.split('.').some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))
+    ) {
+      throw new Error('hosts must be exact public DNS names without a scheme, port, path, IP address or wildcard');
+    }
+    return h;
+  });
+  return { delivery, hosts: [...new Set(normalized)].sort() };
 }
 
-export function selectorString(sel) {
-  const e = Object.entries(sel || {}).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-  return e.length ? e.map(([k, v]) => `${k}=${v}`).join(',') : '*';
+export function validID(s) {
+  return typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(s);
 }
-
-export function sameSelector(a, b) {
-  return selectorString(a) === selectorString(b);
+export function secretIdentity(s) {
+  return {
+    id: s.id,
+    name: s.name,
+    orgId: s.orgId,
+    version: s.version,
+    delivery: s.delivery,
+    hosts: [...(s.hosts || [])].sort(),
+  };
+}
+export function sameSecret(a, b) {
+  return !!a && !!b && JSON.stringify(secretIdentity(a)) === JSON.stringify(secretIdentity(b));
 }
 
 // True when the module is the script node was started with (not imported by a test).