myaidev-method 0.2.7 → 0.2.9

package/dist/server/user-management/LinuxUserService.d.ts

@@ -0,0 +1,71 @@
+import { Effect, Context, Layer } from "effect";
+/**
+ * Linux User Management Service
+ *
+ * Handles creation, management, and deletion of Linux system users
+ * for multi-user isolation in MyAIDev Method web server.
+ *
+ * Security Features:
+ * - No sudo/root access granted to created users
+ * - Limited shell access (rbash or nologin)
+ * - Home directory isolation
+ * - Resource limits via ulimit
+ * - User groups for permission management
+ */
+export interface LinuxUser {
+    username: string;
+    uid: number;
+    gid: number;
+    homeDir: string;
+    shell: string;
+    created: boolean;
+}
+export interface CreateLinuxUserOptions {
+    username: string;
+    shell?: "/bin/rbash" | "/usr/sbin/nologin" | "/bin/bash";
+    createHome?: boolean;
+    groups?: string[];
+}
+export interface LinuxUserError {
+    readonly _tag: "LinuxUserError";
+    readonly message: string;
+    readonly cause?: unknown;
+}
+declare const LinuxUserService_base: Context.TagClass<LinuxUserService, "LinuxUserService", {
+    /**
+     * Create a new Linux system user
+     */
+    readonly createUser: (options: CreateLinuxUserOptions) => Effect.Effect<LinuxUser, LinuxUserError>;
+    /**
+     * Check if a Linux user exists
+     */
+    readonly userExists: (username: string) => Effect.Effect<boolean, LinuxUserError>;
+    /**
+     * Get Linux user information
+     */
+    readonly getUserInfo: (username: string) => Effect.Effect<LinuxUser, LinuxUserError>;
+    /**
+     * Delete a Linux system user
+     */
+    readonly deleteUser: (username: string, removeHome?: boolean) => Effect.Effect<void, LinuxUserError>;
+    /**
+     * Set resource limits for a user
+     */
+    readonly setResourceLimits: (username: string, limits: ResourceLimits) => Effect.Effect<void, LinuxUserError>;
+    /**
+     * Sanitize username for Linux system use
+     * Converts email-based usernames to valid Linux usernames
+     */
+    readonly sanitizeUsername: (username: string) => Effect.Effect<string, LinuxUserError>;
+}>;
+export declare class LinuxUserService extends LinuxUserService_base {
+    static Live: Layer.Layer<LinuxUserService, never, never>;
+}
+export interface ResourceLimits {
+    maxOpenFiles?: number;
+    maxProcesses?: number;
+    maxMemoryKB?: number;
+    maxCPUTime?: number;
+}
+export {};
+//# sourceMappingURL=LinuxUserService.d.ts.map

package/dist/server/user-management/LinuxUserService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinuxUserService.d.ts","sourceRoot":"","sources":["../../../src/server/user-management/LinuxUserService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAGhD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,WAAW,CAAC;IACzD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;;IAWG;;OAEG;yBACkB,CACnB,OAAO,EAAE,sBAAsB,KAC5B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC;IAE7C;;OAEG;yBACkB,CACnB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC;IAE3C;;OAEG;0BACmB,CACpB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC;IAE7C;;OAEG;yBACkB,CACnB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,OAAO,KACjB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC;IAExC;;OAEG;gCACyB,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,KACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC;IAExC;;;OAGG;+BACwB,CACzB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC;;AA9C9C,qBAAa,gBAAiB,SAAQ,qBAgDnC;IACD,MAAM,CAAC,IAAI,8CA2OR;CACJ;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/server/user-management/LinuxUserService.js

@@ -0,0 +1,192 @@
+import { Effect, Context, Layer } from "effect";
+import { execSync } from "child_process";
+const LinuxUserError = (message, cause) => ({
+    _tag: "LinuxUserError",
+    message,
+    cause,
+});
+export class LinuxUserService extends Context.Tag("LinuxUserService")() {
+    static Live = Layer.succeed(this, {
+        createUser: (options) => Effect.gen(function* () {
+            const { username, shell = "/bin/rbash", createHome = true, groups = [] } = options;
+            // Validate username format (Linux username requirements)
+            if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(username)) {
+                return yield* Effect.fail(LinuxUserError(`Invalid Linux username format: ${username}. Must start with lowercase letter or underscore, contain only lowercase letters, digits, underscores, and hyphens, and be 1-32 characters long.`));
+            }
+            // Check if user already exists
+            const exists = yield* Effect.tryPromise({
+                try: async () => {
+                    try {
+                        execSync(`id -u ${username}`, { stdio: "ignore" });
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                catch: (error) => LinuxUserError("Failed to check if user exists", error),
+            });
+            if (exists) {
+                return yield* Effect.fail(LinuxUserError(`Linux user ${username} already exists`));
+            }
+            // Create user command
+            const createHomeFlag = createHome ? "--create-home" : "--no-create-home";
+            const groupsFlag = groups.length > 0 ? `--groups ${groups.join(",")}` : "";
+            const command = `sudo useradd ${createHomeFlag} --shell ${shell} ${groupsFlag} ${username}`;
+            yield* Effect.tryPromise({
+                try: async () => {
+                    execSync(command, { stdio: "pipe" });
+                },
+                catch: (error) => LinuxUserError(`Failed to create Linux user ${username}`, error),
+            });
+            // Get user info
+            const userInfo = yield* Effect.tryPromise({
+                try: async () => {
+                    const uidOutput = execSync(`id -u ${username}`, {
+                        encoding: "utf-8",
+                    }).trim();
+                    const gidOutput = execSync(`id -g ${username}`, {
+                        encoding: "utf-8",
+                    }).trim();
+                    const homeDir = createHome ? `/home/${username}` : "";
+                    return {
+                        username,
+                        uid: parseInt(uidOutput, 10),
+                        gid: parseInt(gidOutput, 10),
+                        homeDir,
+                        shell,
+                        created: true,
+                    };
+                },
+                catch: (error) => LinuxUserError(`Failed to get user info for ${username}`, error),
+            });
+            return userInfo;
+        }),
+        userExists: (username) => Effect.tryPromise({
+            try: async () => {
+                try {
+                    execSync(`id -u ${username}`, { stdio: "ignore" });
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            },
+            catch: (error) => LinuxUserError("Failed to check if user exists", error),
+        }),
+        getUserInfo: (username) => Effect.gen(function* () {
+            const exists = yield* Effect.tryPromise({
+                try: async () => {
+                    try {
+                        execSync(`id -u ${username}`, { stdio: "ignore" });
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                catch: (error) => LinuxUserError("Failed to check if user exists", error),
+            });
+            if (!exists) {
+                return yield* Effect.fail(LinuxUserError(`Linux user ${username} does not exist`));
+            }
+            const userInfo = yield* Effect.tryPromise({
+                try: async () => {
+                    const uidOutput = execSync(`id -u ${username}`, {
+                        encoding: "utf-8",
+                    }).trim();
+                    const gidOutput = execSync(`id -g ${username}`, {
+                        encoding: "utf-8",
+                    }).trim();
+                    // Get shell from /etc/passwd
+                    const passwdLine = execSync(`getent passwd ${username}`, {
+                        encoding: "utf-8",
+                    }).trim();
+                    const shell = passwdLine.split(":")[6] || "/bin/bash";
+                    // Get home directory
+                    const homeDir = passwdLine.split(":")[5] || `/home/${username}`;
+                    return {
+                        username,
+                        uid: parseInt(uidOutput, 10),
+                        gid: parseInt(gidOutput, 10),
+                        homeDir,
+                        shell,
+                        created: true,
+                    };
+                },
+                catch: (error) => LinuxUserError(`Failed to get user info for ${username}`, error),
+            });
+            return userInfo;
+        }),
+        deleteUser: (username, removeHome = true) => Effect.gen(function* () {
+            // Check if user exists
+            const exists = yield* Effect.tryPromise({
+                try: async () => {
+                    try {
+                        execSync(`id -u ${username}`, { stdio: "ignore" });
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                catch: (error) => LinuxUserError("Failed to check if user exists", error),
+            });
+            if (!exists) {
+                return yield* Effect.fail(LinuxUserError(`Linux user ${username} does not exist`));
+            }
+            // Delete user
+            const removeHomeFlag = removeHome ? "--remove" : "";
+            const command = `sudo userdel ${removeHomeFlag} ${username}`;
+            yield* Effect.tryPromise({
+                try: async () => {
+                    execSync(command, { stdio: "pipe" });
+                },
+                catch: (error) => LinuxUserError(`Failed to delete Linux user ${username}`, error),
+            });
+        }),
+        setResourceLimits: (username, limits) => Effect.gen(function* () {
+            // Create limits configuration file
+            const limitsContent = `
+# Resource limits for ${username}
+${username} soft nofile ${limits.maxOpenFiles || 1024}
+${username} hard nofile ${limits.maxOpenFiles || 2048}
+${username} soft nproc ${limits.maxProcesses || 256}
+${username} hard nproc ${limits.maxProcesses || 512}
+${username} soft as ${limits.maxMemoryKB || 2097152}
+${username} hard as ${limits.maxMemoryKB || 4194304}
+${username} soft cpu ${limits.maxCPUTime || 60}
+${username} hard cpu ${limits.maxCPUTime || 120}
+`.trim();
+            const limitsFilePath = `/etc/security/limits.d/${username}.conf`;
+            yield* Effect.tryPromise({
+                try: async () => {
+                    // Write limits file (requires sudo)
+                    execSync(`echo '${limitsContent}' | sudo tee ${limitsFilePath} > /dev/null`, {
+                        stdio: "pipe",
+                    });
+                },
+                catch: (error) => LinuxUserError(`Failed to set resource limits for ${username}`, error),
+            });
+        }),
+        sanitizeUsername: (username) => Effect.gen(function* () {
+            // Convert to lowercase
+            let sanitized = username.toLowerCase();
+            // Replace invalid characters with underscores
+            sanitized = sanitized.replace(/[^a-z0-9_-]/g, "_");
+            // Ensure starts with letter or underscore
+            if (!/^[a-z_]/.test(sanitized)) {
+                sanitized = `u_${sanitized}`;
+            }
+            // Truncate to 32 characters
+            sanitized = sanitized.substring(0, 32);
+            // Remove trailing hyphens or underscores
+            sanitized = sanitized.replace(/[-_]+$/, "");
+            if (sanitized.length === 0) {
+                return yield* Effect.fail(LinuxUserError(`Could not sanitize username: ${username} results in empty string`));
+            }
+            return sanitized;
+        }),
+    });
+}
+//# sourceMappingURL=LinuxUserService.js.map

package/dist/server/user-management/LinuxUserService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinuxUserService.js","sourceRoot":"","sources":["../../../src/server/user-management/LinuxUserService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAsCzC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,KAAe,EAAkB,EAAE,CAAC,CAAC;IAC5E,IAAI,EAAE,gBAAgB;IACtB,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAgDlE;IACD,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAChC,UAAU,EAAE,CAAC,OAA+B,EAAE,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,EAAE,QAAQ,EAAE,KAAK,GAAG,YAAY,EAAE,UAAU,GAAG,IAAI,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;YAEnF,yDAAyD;YACzD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,cAAc,CACZ,kCAAkC,QAAQ,kJAAkJ,CAC7L,CACF,CAAC;YACJ,CAAC;YAED,+BAA+B;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACtC,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,IAAI,CAAC;wBACH,QAAQ,CAAC,SAAS,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;wBACnD,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,gCAAgC,EAAE,KAAK,CAAC;aAC1E,CAAC,CAAC;YAEH,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,cAAc,CAAC,cAAc,QAAQ,iBAAiB,CAAC,CACxD,CAAC;YACJ,CAAC;YAED,sBAAsB;YACtB,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACzE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,OAAO,GAAG,gBAAgB,cAAc,YAAY,KAAK,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;YAE5F,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvB,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACvC,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,+BAA+B,QAAQ,EAAE,EAAE,KAAK,CAAC;aACnE,CAAC,CAAC;YAEH,gBAAgB;YAChB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACxC,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,QAAQ,EAAE,EAAE;wBAC9C,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,QAAQ,EAAE,EAAE;wBAC9C,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAEtD,OAAO;wBACL,QAAQ;wBACR,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;wBAC5B,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;wBAC5B,OAAO;wBACP,KAAK;wBACL,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,+BAA+B,QAAQ,EAAE,EAAE,KAAK,CAAC;aACnE,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QAEJ,UAAU,EAAE,CAAC,QAAgB,EAAE,EAAE,CAC/B,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,IAAI,CAAC;oBACH,QAAQ,CAAC,SAAS,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,gCAAgC,EAAE,KAAK,CAAC;SAC1E,CAAC;QAEJ,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACtC,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,IAAI,CAAC;wBACH,QAAQ,CAAC,SAAS,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;wBACnD,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,gCAAgC,EAAE,KAAK,CAAC;aAC1E,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,cAAc,CAAC,cAAc,QAAQ,iBAAiB,CAAC,CACxD,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACxC,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,QAAQ,EAAE,EAAE;wBAC9C,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,QAAQ,EAAE,EAAE;wBAC9C,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC,IAAI,EAAE,CAAC;oBAEV,6BAA6B;oBAC7B,MAAM,UAAU,GAAG,QAAQ,CAAC,iBAAiB,QAAQ,EAAE,EAAE;wBACvD,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;oBAEtD,qBAAqB;oBACrB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,QAAQ,EAAE,CAAC;oBAEhE,OAAO;wBACL,QAAQ;wBACR,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;wBAC5B,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;wBAC5B,OAAO;wBACP,KAAK;wBACL,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,+BAA+B,QAAQ,EAAE,EAAE,KAAK,CAAC;aACnE,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QAEJ,UAAU,EAAE,CAAC,QAAgB,EAAE,aAAsB,IAAI,EAAE,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,uBAAuB;YACvB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACtC,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,IAAI,CAAC;wBACH,QAAQ,CAAC,SAAS,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;wBACnD,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,gCAAgC,EAAE,KAAK,CAAC;aAC1E,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,cAAc,CAAC,cAAc,QAAQ,iBAAiB,CAAC,CACxD,CAAC;YACJ,CAAC;YAED,cAAc;YACd,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,gBAAgB,cAAc,IAAI,QAAQ,EAAE,CAAC;YAE7D,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvB,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACvC,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,+BAA+B,QAAQ,EAAE,EAAE,KAAK,CAAC;aACnE,CAAC,CAAC;QACL,CAAC,CAAC;QAEJ,iBAAiB,EAAE,CAAC,QAAgB,EAAE,MAAsB,EAAE,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,mCAAmC;YACnC,MAAM,aAAa,GAAG;wBACN,QAAQ;EAC9B,QAAQ,gBAAgB,MAAM,CAAC,YAAY,IAAI,IAAI;EACnD,QAAQ,gBAAgB,MAAM,CAAC,YAAY,IAAI,IAAI;EACnD,QAAQ,eAAe,MAAM,CAAC,YAAY,IAAI,GAAG;EACjD,QAAQ,eAAe,MAAM,CAAC,YAAY,IAAI,GAAG;EACjD,QAAQ,YAAY,MAAM,CAAC,WAAW,IAAI,OAAO;EACjD,QAAQ,YAAY,MAAM,CAAC,WAAW,IAAI,OAAO;EACjD,QAAQ,aAAa,MAAM,CAAC,UAAU,IAAI,EAAE;EAC5C,QAAQ,aAAa,MAAM,CAAC,UAAU,IAAI,GAAG;CAC9C,CAAC,IAAI,EAAE,CAAC;YAED,MAAM,cAAc,GAAG,0BAA0B,QAAQ,OAAO,CAAC;YAEjE,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvB,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,oCAAoC;oBACpC,QAAQ,CAAC,SAAS,aAAa,gBAAgB,cAAc,cAAc,EAAE;wBAC3E,KAAK,EAAE,MAAM;qBACd,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CACZ,qCAAqC,QAAQ,EAAE,EAC/C,KAAK,CACN;aACJ,CAAC,CAAC;QACL,CAAC,CAAC;QAEJ,gBAAgB,EAAE,CAAC,QAAgB,EAAE,EAAE,CACrC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,uBAAuB;YACvB,IAAI,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YAEvC,8CAA8C;YAC9C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAEnD,0CAA0C;YAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,SAAS,GAAG,KAAK,SAAS,EAAE,CAAC;YAC/B,CAAC;YAED,4BAA4B;YAC5B,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAEvC,yCAAyC;YACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAE5C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,cAAc,CACZ,gCAAgC,QAAQ,0BAA0B,CACnE,CACF,CAAC;YACJ,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;KACL,CAAC,CAAC"}

package/dist/server/user-management/QuotaService.d.ts

@@ -0,0 +1,59 @@
+import { Effect, Context, Layer } from "effect";
+/**
+ * Quota Management Service
+ *
+ * Manages disk quotas and resource limits for Linux users.
+ * Provides storage limits to prevent individual users from
+ * consuming excessive disk space.
+ *
+ * Features:
+ * - Disk quota management (requires quota system on host)
+ * - Directory size tracking
+ * - Resource limit enforcement
+ * - Usage monitoring
+ */
+export interface DiskQuota {
+    softLimitMB: number;
+    hardLimitMB: number;
+}
+export interface QuotaUsage {
+    usedMB: number;
+    softLimitMB: number;
+    hardLimitMB: number;
+    percentUsed: number;
+    isOverSoftLimit: boolean;
+    isOverHardLimit: boolean;
+}
+export interface QuotaError {
+    readonly _tag: "QuotaError";
+    readonly message: string;
+    readonly cause?: unknown;
+}
+declare const QuotaService_base: Context.TagClass<QuotaService, "QuotaService", {
+    /**
+     * Set disk quota for a user
+     * Note: Requires quota support on the filesystem
+     */
+    readonly setDiskQuota: (username: string, quota: DiskQuota) => Effect.Effect<void, QuotaError>;
+    /**
+     * Get current quota usage for a user
+     */
+    readonly getQuotaUsage: (username: string) => Effect.Effect<QuotaUsage, QuotaError>;
+    /**
+     * Check if quota system is available
+     */
+    readonly isQuotaAvailable: () => Effect.Effect<boolean, QuotaError>;
+    /**
+     * Get directory size for a user (fallback if quota not available)
+     */
+    readonly getDirectorySize: (dirPath: string) => Effect.Effect<number, QuotaError>;
+    /**
+     * Enforce storage limits (alternative to disk quotas)
+     */
+    readonly checkStorageLimit: (username: string, homeDir: string, limitMB: number) => Effect.Effect<boolean, QuotaError>;
+}>;
+export declare class QuotaService extends QuotaService_base {
+    static Live: Layer.Layer<QuotaService, never, never>;
+}
+export {};
+//# sourceMappingURL=QuotaService.d.ts.map

package/dist/server/user-management/QuotaService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuotaService.d.ts","sourceRoot":"","sources":["../../../src/server/user-management/QuotaService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAGhD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;;IAWG;;;OAGG;2BACoB,CACrB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,KACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;IAEpC;;OAEG;4BACqB,CACtB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC;IAE1C;;OAEG;+BACwB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC;IAEnE;;OAEG;+BACwB,CACzB,OAAO,EAAE,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC;IAEtC;;OAEG;gCACyB,CAC1B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC;;AAtC3C,qBAAa,YAAa,SAAQ,iBAwC/B;IACD,MAAM,CAAC,IAAI,0CA0KR;CACJ"}

package/dist/server/user-management/QuotaService.js

@@ -0,0 +1,148 @@
+import { Effect, Context, Layer } from "effect";
+import { execSync } from "child_process";
+const QuotaError = (message, cause) => ({
+    _tag: "QuotaError",
+    message,
+    cause,
+});
+export class QuotaService extends Context.Tag("QuotaService")() {
+    static Live = Layer.succeed(this, {
+        setDiskQuota: (username, quota) => Effect.gen(function* () {
+            // Check if quota is available
+            const quotaAvailable = yield* Effect.tryPromise({
+                try: async () => {
+                    try {
+                        execSync("which setquota", { stdio: "ignore" });
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                catch: (error) => QuotaError("Failed to check quota availability", error),
+            });
+            if (!quotaAvailable) {
+                return yield* Effect.fail(QuotaError("Quota system not available. Install quota tools: sudo apt-get install quota"));
+            }
+            // Set quota using setquota command
+            // Format: setquota -u username soft_blocks hard_blocks soft_inodes hard_inodes filesystem
+            const softBlocks = quota.softLimitMB * 1024; // Convert MB to blocks (1 block = 1KB)
+            const hardBlocks = quota.hardLimitMB * 1024;
+            const softInodes = 10000; // Reasonable inode limit
+            const hardInodes = 15000;
+            const filesystem = "/"; // Primary filesystem
+            yield* Effect.tryPromise({
+                try: async () => {
+                    const command = `sudo setquota -u ${username} ${softBlocks} ${hardBlocks} ${softInodes} ${hardInodes} ${filesystem}`;
+                    execSync(command, { stdio: "pipe" });
+                },
+                catch: (error) => QuotaError(`Failed to set disk quota for ${username}`, error),
+            });
+        }),
+        getQuotaUsage: (username) => Effect.gen(function* () {
+            // Check if quota is available
+            const quotaAvailable = yield* Effect.tryPromise({
+                try: async () => {
+                    try {
+                        execSync("which quota", { stdio: "ignore" });
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                catch: (error) => QuotaError("Failed to check quota availability", error),
+            });
+            if (!quotaAvailable) {
+                // Fallback: Calculate directory size
+                const homeDir = `/home/${username}`;
+                const usedMB = yield* Effect.tryPromise({
+                    try: async () => {
+                        const output = execSync(`sudo du -sm ${homeDir}`, {
+                            encoding: "utf-8",
+                        });
+                        return parseInt(output.split("\t")[0] || "0", 10);
+                    },
+                    catch: (error) => QuotaError(`Failed to calculate directory size for ${username}`, error),
+                });
+                return {
+                    usedMB,
+                    softLimitMB: 1024, // Default 1GB soft limit
+                    hardLimitMB: 2048, // Default 2GB hard limit
+                    percentUsed: (usedMB / 2048) * 100,
+                    isOverSoftLimit: usedMB > 1024,
+                    isOverHardLimit: usedMB > 2048,
+                };
+            }
+            // Get quota usage using quota command
+            const usage = yield* Effect.tryPromise({
+                try: async () => {
+                    const output = execSync(`sudo quota -u ${username} --show-mntpoint`, {
+                        encoding: "utf-8",
+                    });
+                    // Parse quota output
+                    // Expected format:
+                    // Disk quotas for user username (uid 1001):
+                    //     Filesystem  blocks   quota   limit   grace   files   quota   limit   grace
+                    //     /dev/sda1    1024    1024000 2048000         100     10000   15000
+                    const lines = output.trim().split("\n");
+                    if (lines.length < 3) {
+                        throw new Error("Invalid quota output format");
+                    }
+                    const dataLine = (lines[2] || "").trim().split(/\s+/);
+                    const usedBlocks = parseInt(dataLine[1] || "0", 10);
+                    const softBlocks = parseInt(dataLine[2] || "0", 10);
+                    const hardBlocks = parseInt(dataLine[3] || "0", 10);
+                    const usedMB = Math.round(usedBlocks / 1024);
+                    const softLimitMB = Math.round(softBlocks / 1024);
+                    const hardLimitMB = Math.round(hardBlocks / 1024);
+                    return {
+                        usedMB,
+                        softLimitMB,
+                        hardLimitMB,
+                        percentUsed: (usedMB / hardLimitMB) * 100,
+                        isOverSoftLimit: usedMB > softLimitMB,
+                        isOverHardLimit: usedMB > hardLimitMB,
+                    };
+                },
+                catch: (error) => QuotaError(`Failed to get quota usage for ${username}`, error),
+            });
+            return usage;
+        }),
+        isQuotaAvailable: () => Effect.tryPromise({
+            try: async () => {
+                try {
+                    execSync("which quota", { stdio: "ignore" });
+                    execSync("which setquota", { stdio: "ignore" });
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            },
+            catch: (error) => QuotaError("Failed to check quota availability", error),
+        }),
+        getDirectorySize: (dirPath) => Effect.tryPromise({
+            try: async () => {
+                const output = execSync(`sudo du -sm ${dirPath}`, {
+                    encoding: "utf-8",
+                });
+                return parseInt(output.split("\t")[0] || "0", 10);
+            },
+            catch: (error) => QuotaError(`Failed to get directory size for ${dirPath}`, error),
+        }),
+        checkStorageLimit: (username, homeDir, limitMB) => Effect.gen(function* () {
+            const usedMB = yield* Effect.tryPromise({
+                try: async () => {
+                    const output = execSync(`sudo du -sm ${homeDir}`, {
+                        encoding: "utf-8",
+                    });
+                    return parseInt(output.split("\t")[0] || "0", 10);
+                },
+                catch: (error) => QuotaError(`Failed to check storage for ${username}`, error),
+            });
+            return usedMB <= limitMB;
+        }),
+    });
+}
+//# sourceMappingURL=QuotaService.js.map

package/dist/server/user-management/QuotaService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuotaService.js","sourceRoot":"","sources":["../../../src/server/user-management/QuotaService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAoCzC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,KAAe,EAAc,EAAE,CAAC,CAAC;IACpE,IAAI,EAAE,YAAY;IAClB,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAwC1D;IACD,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAChC,YAAY,EAAE,CAAC,QAAgB,EAAE,KAAgB,EAAE,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,8BAA8B;YAC9B,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC9C,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,IAAI,CAAC;wBACH,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;wBAChD,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,UAAU,CAAC,oCAAoC,EAAE,KAAK,CAAC;aAC1D,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,UAAU,CACR,6EAA6E,CAC9E,CACF,CAAC;YACJ,CAAC;YAED,mCAAmC;YACnC,0FAA0F;YAC1F,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,uCAAuC;YACpF,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;YAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,yBAAyB;YACnD,MAAM,UAAU,GAAG,KAAK,CAAC;YACzB,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,qBAAqB;YAE7C,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvB,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,OAAO,GAAG,oBAAoB,QAAQ,IAAI,UAAU,IAAI,UAAU,IAAI,UAAU,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;oBACrH,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACvC,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,UAAU,CAAC,gCAAgC,QAAQ,EAAE,EAAE,KAAK,CAAC;aAChE,CAAC,CAAC;QACL,CAAC,CAAC;QAEJ,aAAa,EAAE,CAAC,QAAgB,EAAE,EAAE,CAClC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,8BAA8B;YAC9B,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC9C,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,IAAI,CAAC;wBACH,QAAQ,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;wBAC7C,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,UAAU,CAAC,oCAAoC,EAAE,KAAK,CAAC;aAC1D,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,qCAAqC;gBACrC,MAAM,OAAO,GAAG,SAAS,QAAQ,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;oBACtC,GAAG,EAAE,KAAK,IAAI,EAAE;wBACd,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,OAAO,EAAE,EAAE;4BAChD,QAAQ,EAAE,OAAO;yBAClB,CAAC,CAAC;wBACH,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;oBACpD,CAAC;oBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,UAAU,CACR,0CAA0C,QAAQ,EAAE,EACpD,KAAK,CACN;iBACJ,CAAC,CAAC;gBAEH,OAAO;oBACL,MAAM;oBACN,WAAW,EAAE,IAAI,EAAE,yBAAyB;oBAC5C,WAAW,EAAE,IAAI,EAAE,yBAAyB;oBAC5C,WAAW,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,GAAG;oBAClC,eAAe,EAAE,MAAM,GAAG,IAAI;oBAC9B,eAAe,EAAE,MAAM,GAAG,IAAI;iBAC/B,CAAC;YACJ,CAAC;YAED,sCAAsC;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACrC,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,MAAM,GAAG,QAAQ,CAAC,iBAAiB,QAAQ,kBAAkB,EAAE;wBACnE,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC;oBAEH,qBAAqB;oBACrB,mBAAmB;oBACnB,4CAA4C;oBAC5C,iFAAiF;oBACjF,yEAAyE;oBAEzE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;oBACjD,CAAC;oBAED,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACtD,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;oBACpD,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;oBACpD,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;oBAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;oBAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;oBAClD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;oBAElD,OAAO;wBACL,MAAM;wBACN,WAAW;wBACX,WAAW;wBACX,WAAW,EAAE,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,GAAG;wBACzC,eAAe,EAAE,MAAM,GAAG,WAAW;wBACrC,eAAe,EAAE,MAAM,GAAG,WAAW;qBACtC,CAAC;gBACJ,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,UAAU,CAAC,iCAAiC,QAAQ,EAAE,EAAE,KAAK,CAAC;aACjE,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEJ,gBAAgB,EAAE,GAAG,EAAE,CACrB,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,IAAI,CAAC;oBACH,QAAQ,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAC7C,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAChD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,oCAAoC,EAAE,KAAK,CAAC;SAC1E,CAAC;QAEJ,gBAAgB,EAAE,CAAC,OAAe,EAAE,EAAE,CACpC,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,OAAO,EAAE,EAAE;oBAChD,QAAQ,EAAE,OAAO;iBAClB,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,UAAU,CAAC,oCAAoC,OAAO,EAAE,EAAE,KAAK,CAAC;SACnE,CAAC;QAEJ,iBAAiB,EAAE,CAAC,QAAgB,EAAE,OAAe,EAAE,OAAe,EAAE,EAAE,CACxE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACtC,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,OAAO,EAAE,EAAE;wBAChD,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpD,CAAC;gBACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,UAAU,CAAC,+BAA+B,QAAQ,EAAE,EAAE,KAAK,CAAC;aAC/D,CAAC,CAAC;YAEH,OAAO,MAAM,IAAI,OAAO,CAAC;QAC3B,CAAC,CAAC;KACL,CAAC,CAAC"}

package/dist/server/user-management/UserManagementService.d.ts

@@ -0,0 +1,74 @@
+import { Effect, Context, Layer } from "effect";
+import { LinuxUserService, LinuxUser } from "./LinuxUserService";
+import { DirectoryService } from "./DirectoryService";
+import { QuotaService, DiskQuota } from "./QuotaService";
+/**
+ * User Management Service
+ *
+ * High-level orchestration service that coordinates Linux user creation,
+ * directory setup, and resource management for multi-user environments.
+ *
+ * This service integrates:
+ * - LinuxUserService: System user creation and management
+ * - DirectoryService: Home directory and Claude config setup
+ * - QuotaService: Disk quotas and resource limits
+ *
+ * Workflow:
+ * 1. Sanitize and validate username
+ * 2. Create Linux system user
+ * 3. Set up home directory structure
+ * 4. Configure Claude Code environment
+ * 5. Apply resource limits and quotas
+ * 6. Return complete user setup information
+ */
+export interface CreateUserRequest {
+    username: string;
+    email: string;
+    claudeApiKey?: string;
+    diskQuotaMB?: number;
+    shell?: "/bin/rbash" | "/usr/sbin/nologin" | "/bin/bash";
+}
+export interface UserSetupResult {
+    linuxUser: LinuxUser;
+    homeDir: string;
+    claudeConfigPath: string;
+    workspacePath: string;
+    quotaApplied: boolean;
+    limitsApplied: boolean;
+}
+export interface UserManagementError {
+    readonly _tag: "UserManagementError";
+    readonly message: string;
+    readonly cause?: unknown;
+}
+declare const UserManagementService_base: Context.TagClass<UserManagementService, "UserManagementService", {
+    /**
+     * Create a complete user environment
+     * - Creates Linux user
+     * - Sets up home directory
+     * - Configures Claude Code
+     * - Applies quotas and limits
+     */
+    readonly createUser: (request: CreateUserRequest) => Effect.Effect<UserSetupResult, UserManagementError>;
+    /**
+     * Delete user and clean up all resources
+     */
+    readonly deleteUser: (username: string) => Effect.Effect<void, UserManagementError>;
+    /**
+     * Get user information
+     */
+    readonly getUserInfo: (username: string) => Effect.Effect<LinuxUser, UserManagementError>;
+    /**
+     * Update user quotas
+     */
+    readonly updateQuota: (username: string, quota: DiskQuota) => Effect.Effect<void, UserManagementError>;
+    /**
+     * Check if username is available
+     */
+    readonly isUsernameAvailable: (username: string) => Effect.Effect<boolean, UserManagementError>;
+}>;
+export declare class UserManagementService extends UserManagementService_base {
+    static Live: Layer.Layer<UserManagementService, never, LinuxUserService | DirectoryService | QuotaService>;
+}
+export {};
+//# sourceMappingURL=UserManagementService.d.ts.map

package/dist/server/user-management/UserManagementService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserManagementService.d.ts","sourceRoot":"","sources":["../../../src/server/user-management/UserManagementService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,WAAW,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;;IAcG;;;;;;OAMG;yBACkB,CACnB,OAAO,EAAE,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAExD;;OAEG;yBACkB,CACnB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAE7C;;OAEG;0BACmB,CACpB,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC;IAElD;;OAEG;0BACmB,CACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,KACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAE7C;;OAEG;kCAC2B,CAC5B,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC;;AAzCpD,qBAAa,qBAAsB,SAAQ,0BA2CxC;IACD,MAAM,CAAC,IAAI,gGAwOT;CACH"}