saltcorn-samba 0.3.0

package/public/samba-tree.js

@@ -0,0 +1,292 @@
+/**
+ * Client-side directory tree for the SambaTree view template.
+ *
+ * Exposes window.saltcornSambaMount(elementId). The tree lazily loads
+ * children from /sambadir?path=... and opens files either inline (PDF/image)
+ * in the built-in viewer <div> or by redirecting to /sambalink (smb://).
+ */
+(function () {
+  "use strict";
+
+  function h(tag, attrs, children) {
+    var el = document.createElement(tag);
+    if (attrs)
+      Object.keys(attrs).forEach(function (k) {
+        if (k === "class") el.className = attrs[k];
+        else if (k === "text") el.textContent = attrs[k];
+        else if (k.slice(0, 2) === "on")
+          el.addEventListener(k.slice(2).toLowerCase(), attrs[k]);
+        else el.setAttribute(k, attrs[k]);
+      });
+    (children || []).forEach(function (c) {
+      if (c == null) return;
+      el.appendChild(typeof c === "string" ? document.createTextNode(c) : c);
+    });
+    return el;
+  }
+
+  function iconFor(item) {
+    if (item.isDir) return "📁";
+    var n = (item.name || "").toLowerCase();
+    if (n.endsWith(".pdf")) return "📄";
+    if (/\.(png|jpe?g|gif|webp|svg|bmp)$/.test(n)) return "🖼️";
+    if (/\.(docx?|odt|rtf|txt|md)$/.test(n)) return "📝";
+    if (/\.(xlsx?|ods|csv)$/.test(n)) return "📊";
+    if (/\.(zip|tar|gz|7z|rar)$/.test(n)) return "🗜️";
+    return "📎";
+  }
+
+  function isViewable(name) {
+    var n = (name || "").toLowerCase();
+    return (
+      n.endsWith(".pdf") ||
+      /\.(png|jpe?g|gif|webp|svg|bmp)$/.test(n) ||
+      /\.(txt|md|json|xml|csv|html?)$/.test(n)
+    );
+  }
+
+  function joinPath(a, b) {
+    if (!a) return b;
+    if (!b) return a;
+    return (a.replace(/\/+$/, "") + "/" + b.replace(/^\/+/, "")).replace(
+      /\/+/g,
+      "/"
+    );
+  }
+
+  function fmtSize(n) {
+    if (!n) return "";
+    var u = ["B", "KB", "MB", "GB", "TB"];
+    var i = 0;
+    while (n >= 1024 && i < u.length - 1) {
+      n /= 1024;
+      i++;
+    }
+    return n.toFixed(n >= 10 || i === 0 ? 0 : 1) + " " + u[i];
+  }
+
+  async function fetchDir(path, showHidden) {
+    var url =
+      "/sambadir?path=" +
+      encodeURIComponent(path || "") +
+      (showHidden ? "&show_hidden=1" : "");
+    var r = await fetch(url, { credentials: "same-origin" });
+    if (!r.ok) throw new Error("HTTP " + r.status);
+    return r.json();
+  }
+
+  function renderList(container, path, items, opts, viewerEl) {
+    container.innerHTML = "";
+    var ul = h("ul", { class: "samba-tree-list list-unstyled mb-0" }, []);
+
+    items.forEach(function (item) {
+      var full = joinPath(path, item.name);
+      var childrenBox = h("div", { class: "samba-tree-children ms-3" }, []);
+      var toggle = h(
+        "span",
+        {
+          class: "samba-tree-toggle me-1",
+          text: item.isDir ? "▸" : " ",
+          style: "cursor:pointer;display:inline-block;width:1em;",
+        },
+        []
+      );
+      var label = h(
+        "span",
+        {
+          class: "samba-tree-label",
+          text: iconFor(item) + " " + item.name,
+          style: "cursor:pointer;",
+          title: full,
+        },
+        []
+      );
+      var meta = h(
+        "span",
+        {
+          class: "samba-tree-meta text-muted small ms-2",
+          text: item.isDir ? "" : fmtSize(item.size),
+        },
+        []
+      );
+
+      var externalBtn = null;
+      if (opts.exposeSmbLink) {
+        externalBtn = h(
+          "a",
+          {
+            class: "samba-tree-external btn btn-sm btn-link p-0 ms-2",
+            href: "/sambalink?path=" + encodeURIComponent(full),
+            target: "_blank",
+            title: "Open in file manager",
+            text: "↗",
+          },
+          []
+        );
+      }
+
+      var openDir = function () {
+        if (childrenBox.dataset.loaded === "1") {
+          var vis = childrenBox.style.display !== "none";
+          childrenBox.style.display = vis ? "none" : "block";
+          toggle.textContent = vis ? "▸" : "▾";
+          return;
+        }
+        toggle.textContent = "…";
+        fetchDir(full, opts.showHidden)
+          .then(function (data) {
+            renderList(childrenBox, full, data.items || [], opts, viewerEl);
+            childrenBox.dataset.loaded = "1";
+            childrenBox.style.display = "block";
+            toggle.textContent = "▾";
+          })
+          .catch(function (e) {
+            childrenBox.innerHTML =
+              '<div class="text-danger small">Error: ' + e.message + "</div>";
+            childrenBox.dataset.loaded = "1";
+            toggle.textContent = "▸";
+          });
+      };
+
+      var openFile = function () {
+        if (!viewerEl) return;
+        if (opts.pdfInline && isViewable(item.name)) {
+          var url =
+            "/sambafile?path=" +
+            encodeURIComponent(full) +
+            "&disposition=inline";
+          var isImg = /\.(png|jpe?g|gif|webp|svg|bmp)$/i.test(item.name);
+          viewerEl.innerHTML = "";
+          var header = h(
+            "div",
+            { class: "samba-viewer-header d-flex align-items-center mb-2" },
+            [
+              h("strong", { text: item.name }, []),
+              h(
+                "a",
+                {
+                  href: url,
+                  target: "_blank",
+                  class: "btn btn-sm btn-outline-secondary ms-auto me-2",
+                  text: "Open in new tab",
+                },
+                []
+              ),
+              h(
+                "a",
+                {
+                  href:
+                    "/sambafile?path=" +
+                    encodeURIComponent(full) +
+                    "&disposition=attachment",
+                  class: "btn btn-sm btn-outline-secondary me-2",
+                  text: "Download",
+                },
+                []
+              ),
+              opts.exposeSmbLink
+                ? h(
+                    "a",
+                    {
+                      href: "/sambalink?path=" + encodeURIComponent(full),
+                      target: "_blank",
+                      class: "btn btn-sm btn-outline-primary",
+                      text: "Open in file manager",
+                    },
+                    []
+                  )
+                : null,
+            ]
+          );
+          viewerEl.appendChild(header);
+          if (isImg) {
+            viewerEl.appendChild(
+              h(
+                "img",
+                {
+                  src: url,
+                  style:
+                    "max-width:100%;max-height:70vh;border:1px solid #dee2e6;border-radius:4px;",
+                },
+                []
+              )
+            );
+          } else {
+            viewerEl.appendChild(
+              h(
+                "iframe",
+                {
+                  src: url,
+                  style:
+                    "width:100%;height:70vh;border:1px solid #dee2e6;border-radius:4px;",
+                },
+                []
+              )
+            );
+          }
+        } else {
+          // Not inline-viewable – fall back to the external link page.
+          window.open(
+            "/sambalink?path=" + encodeURIComponent(full),
+            "_blank"
+          );
+        }
+      };
+
+      label.addEventListener("click", function () {
+        if (item.isDir) openDir();
+        else openFile();
+      });
+      toggle.addEventListener("click", function () {
+        if (item.isDir) openDir();
+      });
+
+      var lineChildren = [toggle, label, meta];
+      if (externalBtn) lineChildren.push(externalBtn);
+
+      var li = h("li", { class: "samba-tree-item" }, [
+        h("div", { class: "samba-tree-line d-flex align-items-center" }, lineChildren),
+        childrenBox,
+      ]);
+      childrenBox.style.display = "none";
+      ul.appendChild(li);
+    });
+
+    if (!items.length) {
+      container.appendChild(
+        h(
+          "div",
+          { class: "text-muted small fst-italic p-2", text: "(empty)" },
+          []
+        )
+      );
+    } else {
+      container.appendChild(ul);
+    }
+  }
+
+  function mount(elId) {
+    var el = document.getElementById(elId);
+    if (!el || el.dataset.mounted === "1") return;
+    el.dataset.mounted = "1";
+    var viewer = document.getElementById(elId + "-viewer");
+    var opts = {};
+    try {
+      opts = JSON.parse(el.getAttribute("data-opts") || "{}");
+    } catch (_) {
+      opts = {};
+    }
+    el.innerHTML =
+      '<div class="text-muted small p-2">Loading…</div>';
+    fetchDir(opts.startPath || "", opts.showHidden)
+      .then(function (data) {
+        renderList(el, opts.startPath || "", data.items || [], opts, viewer);
+      })
+      .catch(function (e) {
+        el.innerHTML =
+          '<div class="alert alert-danger">Samba: ' + e.message + "</div>";
+      });
+  }
+
+  window.saltcornSambaMount = mount;
+})();

package/public/samba.css

@@ -0,0 +1,69 @@
+/* ---- shared tree styles ---- */
+.samba-tree-container { font-size: .95rem; }
+.samba-tree-list { padding-left: 0; margin: 0; }
+.samba-tree-item { padding: 2px 0; }
+.samba-tree-line:hover { background: rgba(0,0,0,.03); border-radius: 3px; }
+.samba-tree-label { user-select: none; }
+.samba-tree-toggle { color: #666; font-family: monospace; }
+.samba-tree-meta { flex-shrink: 0; }
+.samba-tree-external { text-decoration: none; }
+.samba-viewer { min-height: 0; }
+
+/* ---- file manager ---- */
+.samba-fm .card-header { background: transparent; }
+.samba-fm-toolbar { background: #fafafa; display: flex; align-items: center; flex-wrap: wrap; gap: .25rem; }
+.samba-fm-toolbar .breadcrumb { background: transparent; padding: 0; margin: 0; font-size: .9rem; }
+.samba-fm-table thead th {
+  position: sticky; top: 0; background: #fff; z-index: 1;
+  border-bottom: 2px solid #dee2e6;
+  font-weight: 600;
+}
+.samba-fm-table tbody tr:hover { background: rgba(13,110,253,.04); }
+.samba-fm-icon { text-align: center; }
+.samba-fm-name { text-decoration: none; color: inherit; }
+.samba-fm-name:hover { text-decoration: underline; color: #0d6efd; }
+.samba-fm-viewer:empty { display: none; }
+.samba-fm-viewer iframe { background: #fff; }
+
+/* ---- modal ---- */
+.samba-modal-backdrop {
+  position: fixed; inset: 0;
+  background: rgba(0,0,0,.45);
+  display: flex; align-items: center; justify-content: center;
+  z-index: 2000;
+}
+.samba-modal {
+  width: min(560px, 92vw);
+  max-height: 90vh; overflow: auto;
+  background: #fff;
+  box-shadow: 0 10px 40px rgba(0,0,0,.25);
+}
+.samba-modal-body { padding: 1rem 1.25rem; }
+.samba-modal-footer { padding: .75rem 1rem; background: #f8f9fa; }
+
+/* ---- toast ---- */
+.samba-toast {
+  position: fixed; right: 1rem; bottom: 1rem;
+  background: #212529; color: #fff;
+  padding: .6rem 1rem; border-radius: 6px;
+  box-shadow: 0 6px 20px rgba(0,0,0,.25);
+  z-index: 2100;
+  transition: opacity .25s, transform .25s;
+  max-width: 420px;
+}
+.samba-toast-success { background: #198754; }
+.samba-toast-error { background: #dc3545; }
+.samba-toast-hide { opacity: 0; transform: translateY(10px); }
+
+/* ---- upload drop zone ---- */
+.samba-drop {
+  cursor: pointer;
+  transition: background .15s, border-color .15s;
+  border-style: dashed !important;
+}
+.samba-drop:hover, .samba-drop-active {
+  background: rgba(13,110,253,.06);
+  border-color: #0d6efd !important;
+  color: #0d6efd;
+}
+.samba-picked ul { max-height: 12rem; overflow: auto; }

package/smb-client.js

@@ -0,0 +1,279 @@
+/**
+ * SMB client wrapper – provides a small, connection-pooled interface
+ * around @marsaud/smb2 with security-conscious path handling.
+ *
+ * All paths that come from the browser MUST be validated with
+ * `sanitizeRelativePath` before being combined with the base_path.
+ */
+
+const path = require("path");
+const SMB2 = require("@marsaud/smb2");
+
+// ---------------------------------------------------------------------------
+// Path helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Validate a single file/directory name component (no path separators!).
+ * Rejects empty, dot-only, path separators, control chars, and reserved
+ * Windows device names. Returns the trimmed name on success, throws on
+ * invalid input.
+ */
+function sanitizeFilename(name) {
+  if (name === undefined || name === null) throw new Error("Filename required");
+  if (typeof name !== "string") throw new Error("Filename must be a string");
+  const trimmed = name.trim();
+  if (!trimmed) throw new Error("Filename must not be empty");
+  // reject leading/trailing whitespace on non-empty names (Windows problem)
+  if (name !== trimmed)
+    throw new Error("Filename must not start or end with whitespace");
+  if (trimmed.length > 255) throw new Error("Filename too long");
+  if (trimmed === "." || trimmed === "..")
+    throw new Error("Filename must not be '.' or '..'");
+  if (/[\\/]/.test(trimmed)) throw new Error("Filename must not contain slashes");
+  if (/[\x00-\x1f]/.test(trimmed)) throw new Error("Filename must not contain control characters");
+  // Reject characters SMB / Windows disallow in filenames
+  if (/[<>:"|?*]/.test(trimmed))
+    throw new Error('Filename must not contain any of: < > : " | ? *');
+  if (trimmed.endsWith(".") || trimmed.endsWith(" "))
+    throw new Error("Filename must not end with a dot or space");
+  // Windows reserved device names (case-insensitive, with or without extension)
+  const base = trimmed.split(".")[0].toUpperCase();
+  const RESERVED = new Set([
+    "CON", "PRN", "AUX", "NUL",
+    "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
+    "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
+  ]);
+  if (RESERVED.has(base)) throw new Error("Filename uses a reserved device name");
+  return trimmed;
+}
+
+/**
+ * Reject path traversal, absolute paths, drive letters, NUL bytes, and other
+ * suspicious content. Returns a normalised POSIX-style relative path (no
+ * leading/trailing separators). Throws on invalid input.
+ */
+function sanitizeRelativePath(rel) {
+  if (rel === undefined || rel === null || rel === "") return "";
+  if (typeof rel !== "string") throw new Error("Path must be a string");
+  if (rel.length > 4096) throw new Error("Path too long");
+  if (rel.includes("\0")) throw new Error("Illegal NUL byte in path");
+  // Convert backslashes to forward slashes first (do NOT collapse yet)
+  let p = rel.replace(/\\/g, "/");
+  // Reject Windows drive letters and UNC paths BEFORE collapsing slashes
+  if (/^[a-zA-Z]:/.test(p)) throw new Error("Drive letters not allowed");
+  if (p.startsWith("//")) throw new Error("UNC paths not allowed");
+  // Now collapse multiple slashes and strip leading slash
+  p = p.replace(/\/+/g, "/");
+  if (p.startsWith("/")) p = p.slice(1);
+  // Reject explicit traversal segments
+  const parts = p.split("/").filter((s) => s !== "" && s !== ".");
+  for (const seg of parts) {
+    if (seg === "..") throw new Error("Path traversal not allowed");
+  }
+  return parts.join("/");
+}
+
+/** Convert a POSIX-style relative path into the SMB backslash form. */
+function toSmbPath(rel) {
+  return rel.replace(/\//g, "\\");
+}
+
+// ---------------------------------------------------------------------------
+// SMB client factory
+// ---------------------------------------------------------------------------
+
+/**
+ * Build a fresh SMB2 client from the plugin configuration.
+ *
+ *   config = {
+ *     server:   "192.168.1.10",     // host or IP of the samba server
+ *     share:    "documents",        // share name (no slashes)
+ *     domain:   "WORKGROUP",        // optional
+ *     username: "reader",
+ *     password: "secret",
+ *     base_path:"",                 // optional subdirectory to lock into
+ *     port:     445,                // optional
+ *   }
+ *
+ * The returned object exposes: readdir(rel), stat(rel), readFile(rel),
+ * createReadStream(rel), disconnect(), plus helpers `resolve(rel)` and
+ * `basePath`.
+ */
+function buildClient(config) {
+  if (!config) throw new Error("Samba plugin is not configured");
+  const { server, share, domain, username, password, port } = config;
+  if (!server) throw new Error("Samba: server missing");
+  if (!share) throw new Error("Samba: share missing");
+  if (/[\\/]/.test(share)) throw new Error("Samba: share must not contain slashes");
+
+  const shareStr = `\\\\${server}${port ? ":" + port : ""}\\${share}`;
+  const smb = new SMB2({
+    share: shareStr,
+    domain: domain || "WORKGROUP",
+    username: username || "guest",
+    password: password || "",
+    autoCloseTimeout: 10000,
+  });
+
+  const basePath = sanitizeRelativePath(config.base_path || "");
+
+  /** Combine base + user-supplied relative into a validated SMB path. */
+  function resolve(rel) {
+    const safe = sanitizeRelativePath(rel);
+    const combined = [basePath, safe].filter(Boolean).join("/");
+    return toSmbPath(combined);
+  }
+
+  return {
+    basePath,
+    resolve,
+    readdir(rel) {
+      return new Promise((res, rej) => {
+        smb.readdir(resolve(rel), { stats: true }, (err, files) =>
+          err ? rej(err) : res(files)
+        );
+      });
+    },
+    stat(rel) {
+      return new Promise((res, rej) => {
+        // marsaud-smb2 does not export a proper stat; emulate via readdir of parent
+        const target = resolve(rel);
+        const parent = target.includes("\\")
+          ? target.slice(0, target.lastIndexOf("\\"))
+          : "";
+        const name = target.includes("\\")
+          ? target.slice(target.lastIndexOf("\\") + 1)
+          : target;
+        smb.readdir(parent, { stats: true }, (err, files) => {
+          if (err) return rej(err);
+          const match = files.find((f) => f.name === name);
+          if (!match) return rej(new Error("Not found"));
+          res(match);
+        });
+      });
+    },
+    readFile(rel) {
+      return new Promise((res, rej) => {
+        smb.readFile(resolve(rel), (err, data) =>
+          err ? rej(err) : res(data)
+        );
+      });
+    },
+    writeFile(rel, data) {
+      return new Promise((res, rej) => {
+        smb.writeFile(resolve(rel), data, (err) =>
+          err ? rej(err) : res()
+        );
+      });
+    },
+    exists(rel) {
+      return new Promise((res) => {
+        smb.exists(resolve(rel), (err, ok) => res(err ? false : !!ok));
+      });
+    },
+    unlink(rel) {
+      return new Promise((res, rej) => {
+        smb.unlink(resolve(rel), (err) => (err ? rej(err) : res()));
+      });
+    },
+    rmdir(rel) {
+      return new Promise((res, rej) => {
+        smb.rmdir(resolve(rel), (err) => (err ? rej(err) : res()));
+      });
+    },
+    mkdir(rel) {
+      return new Promise((res, rej) => {
+        smb.mkdir(resolve(rel), (err) => (err ? rej(err) : res()));
+      });
+    },
+    rename(oldRel, newRel) {
+      return new Promise((res, rej) => {
+        smb.rename(resolve(oldRel), resolve(newRel), (err) =>
+          err ? rej(err) : res()
+        );
+      });
+    },
+    createReadStream(rel) {
+      return new Promise((res, rej) => {
+        smb.createReadStream(resolve(rel), (err, stream) =>
+          err ? rej(err) : res(stream)
+        );
+      });
+    },
+    disconnect() {
+      try {
+        smb.disconnect();
+      } catch (_) {
+        // ignore
+      }
+    },
+  };
+}
+
+/**
+ * Execute a callback with a fresh SMB client and always disconnect afterwards.
+ * Prefer this helper over building a long-lived client because SMB sessions
+ * can time out and marsaud-smb2 does not handle reconnects well.
+ */
+async function withClient(config, fn) {
+  const client = buildClient(config);
+  try {
+    return await fn(client);
+  } finally {
+    client.disconnect();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// URL helpers
+// ---------------------------------------------------------------------------
+
+/** Build a browser-openable smb:// URL for external file managers. */
+function toSmbUrl(config, rel) {
+  const safe = sanitizeRelativePath(rel);
+  const basePath = sanitizeRelativePath(config.base_path || "");
+  const parts = [basePath, safe].filter(Boolean).join("/");
+  const encoded = parts.split("/").map(encodeURIComponent).join("/");
+  return `smb://${config.server}/${encodeURIComponent(config.share)}${
+    encoded ? "/" + encoded : ""
+  }`;
+}
+
+/** Guess a MIME type from a filename – kept tiny and dependency-free. */
+function mimeFromName(name) {
+  const ext = String(name || "").toLowerCase().split(".").pop();
+  const map = {
+    pdf: "application/pdf",
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    svg: "image/svg+xml",
+    txt: "text/plain; charset=utf-8",
+    md: "text/markdown; charset=utf-8",
+    csv: "text/csv; charset=utf-8",
+    json: "application/json",
+    xml: "application/xml",
+    html: "text/html; charset=utf-8",
+    zip: "application/zip",
+    doc: "application/msword",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xls: "application/vnd.ms-excel",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ppt: "application/vnd.ms-powerpoint",
+    pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  };
+  return map[ext] || "application/octet-stream";
+}
+
+module.exports = {
+  buildClient,
+  withClient,
+  sanitizeRelativePath,
+  sanitizeFilename,
+  toSmbPath,
+  toSmbUrl,
+  mimeFromName,
+};