node-command 2.0.11 → 2.0.12

package/lib/setup.mjs

@@ -479,6 +479,42 @@ const PARTIAL_SYSTEM_FORBIDDEN_PATHS = [
   '/var/lib/nodecommand/nc'
 ];
 
+/** Files a rejected/expired enrollment may leave in the system config tree. */
+const PARTIAL_ENROLLMENT_CONFIG_ENTRIES = new Set(['.nc-cli.lock', 'nc-device-key.pem', 'nc-enroll-state.json']);
+
+/** The exact residue that identifies the narrow recoverable enrollment shape. */
+const PARTIAL_ENROLLMENT_REQUIRED = ['nc-device-key.pem', 'nc-enroll-state.json'];
+
+/**
+ * True only for the exact canonical system root carrying the residue of a
+ * rejected/expired enrollment: a root-owned config directory with the device
+ * key and enrollment state, no host environment, and no application payload.
+ * Discovery uses this so the abandoned tree is a removal target; removal
+ * revalidates every entry before deleting anything.
+ * @param {string} root
+ * @param {typeof fs} [io]
+ */
+function partialEnrollmentSystemRoot(root, io = fs) {
+  if (path.resolve(root) !== PARTIAL_SYSTEM_ROOT) return false;
+  const lstat = io.lstatSync || fs.lstatSync;
+  const readdir = io.readdirSync || fs.readdirSync;
+  try {
+    if (!readdir(PARTIAL_SYSTEM_ROOT).every((name) => PARTIAL_SYSTEM_ENTRIES.has(name))) return false;
+    const config = path.join(PARTIAL_SYSTEM_ROOT, 'config');
+    const configInfo = lstat(config);
+    if (configInfo.isSymbolicLink() || !configInfo.isDirectory()) return false;
+    const names = readdir(config);
+    if (!names.every((name) => PARTIAL_ENROLLMENT_CONFIG_ENTRIES.has(name))) return false;
+    if (!PARTIAL_ENROLLMENT_REQUIRED.every((name) => names.includes(name))) return false;
+    return PARTIAL_ENROLLMENT_REQUIRED.every((name) => {
+      const entry = lstat(path.join(config, name));
+      return !entry.isSymbolicLink() && entry.isFile();
+    });
+  } catch {
+    return false;
+  }
+}
+
 /**
  * True when `root` is the canonical per-user tree for the current account and
  * is not a protected system root. This is the cheap path/ownership gate; the
@@ -522,8 +558,43 @@ export function isPartialSystemRemovalCandidate(root, { platform = os.platform()
   return path.resolve(root) === PARTIAL_SYSTEM_ROOT;
 }
 
+/** A real installation is proven by a readable, owner-matching host env. */
+function requireHostEnvironment(root, { uid, io, refused, owner }) {
+  for (const [file, directory] of [['config', true], [path.join('config', 'nc-client.env'), false]]) {
+    const info = io.lstatSync(path.join(root, file));
+    if (info.isSymbolicLink() || (directory ? !info.isDirectory() : !info.isFile())) {
+      throw refused(`the ${file} marker is missing or not a regular ${directory ? 'directory' : 'file'}`);
+    }
+    if (info.uid !== uid) throw refused(`the ${file} marker is not owned by ${owner}`);
+  }
+  io.accessSync(path.join(root, 'config', 'nc-client.env'), fs.constants.R_OK);
+}
+
+/**
+ * A rejected/expired enrollment leaves only the device key and enrollment
+ * state (plus this process's own CLI lock) in config/. A host environment, an
+ * app payload or any unknown file means this is not the narrow recoverable
+ * shape, so removal fails closed.
+ */
+function requirePartialEnrollment(root, { uid, io, refused, owner }) {
+  const config = path.join(root, 'config');
+  const info = io.lstatSync(config);
+  if (info.isSymbolicLink() || !info.isDirectory()) throw refused('the config marker is missing or not a regular directory');
+  if (info.uid !== uid) throw refused(`the config marker is not owned by ${owner}`);
+  const names = io.readdirSync(config);
+  for (const name of names) {
+    if (!PARTIAL_ENROLLMENT_CONFIG_ENTRIES.has(name)) throw refused(`unexpected config entry "${name}"`);
+    const entry = io.lstatSync(path.join(config, name));
+    if (entry.isSymbolicLink() || !entry.isFile()) throw refused(`config entry "${name}" is not a regular file`);
+    if (entry.uid !== uid) throw refused(`config entry "${name}" is not owned by ${owner}`);
+  }
+  for (const name of PARTIAL_ENROLLMENT_REQUIRED) {
+    if (!names.includes(name)) throw refused(`the partial-enrollment marker "${name}" is missing`);
+  }
+}
+
 /** Shared bounded removal of an already-authorized root. */
-function removeBoundedRoot(root, { uid, allowedEntries, io, refused, owner }) {
+function removeBoundedRoot(root, { uid, allowedEntries, io, refused, owner, verifyConfig = requireHostEnvironment }) {
   const resolved = path.resolve(root);
   if (io.realpathSync(resolved) !== resolved) throw refused('a symlinked ancestor is not removable');
   const rootInfo = io.lstatSync(resolved);
@@ -536,14 +607,7 @@ function removeBoundedRoot(root, { uid, allowedEntries, io, refused, owner }) {
     if (info.isSymbolicLink()) throw refused(`top-level entry "${name}" is a symlink`);
     if (info.uid !== uid) throw refused(`top-level entry "${name}" is not owned by ${owner}`);
   }
-  for (const [file, directory] of [['config', true], [path.join('config', 'nc-client.env'), false]]) {
-    const info = io.lstatSync(path.join(resolved, file));
-    if (info.isSymbolicLink() || (directory ? !info.isDirectory() : !info.isFile())) {
-      throw refused(`the ${file} marker is missing or not a regular ${directory ? 'directory' : 'file'}`);
-    }
-    if (info.uid !== uid) throw refused(`the ${file} marker is not owned by ${owner}`);
-  }
-  io.accessSync(path.join(resolved, 'config', 'nc-client.env'), fs.constants.R_OK);
+  verifyConfig(resolved, { uid, io, refused, owner });
   for (const name of entries) {
     io.rmSync(path.join(resolved, name), { recursive: true, force: true });
   }
@@ -609,12 +673,22 @@ export function removePartialSystemRoot(root, { platform = os.platform(), getuid
       }
       throw refused(`${file} exists; a real installation requires its packaged maintenance`);
     }
-    removeBoundedRoot(path.resolve(root), {
+    const resolved = path.resolve(root);
+    const hostEnvMarker = path.join(resolved, 'config', 'nc-client.env');
+    let verifyConfig = requireHostEnvironment;
+    try {
+      io.lstatSync(hostEnvMarker);
+    } catch (err) {
+      if (err?.code !== 'ENOENT') throw refused(`the host environment marker at ${hostEnvMarker} cannot be verified`);
+      verifyConfig = requirePartialEnrollment;
+    }
+    removeBoundedRoot(resolved, {
       uid: 0,
       allowedEntries: PARTIAL_SYSTEM_ENTRIES,
       io,
       refused,
-      owner: 'root'
+      owner: 'root',
+      verifyConfig
     });
   } catch (err) {
     if (err?.code === 'PARTIAL_SYSTEM_REMOVAL_REFUSED') throw err;
@@ -719,6 +793,8 @@ export function findRemovalTargets({ io = {}, ...rest } = {}) {
     const status = probeRemovalRoot(root, io);
     if (status === 'install' && !install.includes(root)) install.push(root);
     else if (status === 'unreadable' && !unreadable.includes(root)) unreadable.push(root);
+    else if (status === 'foreign' && !install.includes(root) && isPartialSystemRemovalCandidate(root, rest) &&
+      partialEnrollmentSystemRoot(root, io)) install.push(root);
   }
   // The paired relation is only actionable when its root is itself readable.
   // An unverifiable/foreign paired root is reported through `unreadable`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-command",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {