selfguard 0.0.1 → 0.2.0

package/dist/ui/server.js

@@ -0,0 +1,325 @@
+/**
+ * Local dashboard: a tiny HTTP server on 127.0.0.1 serving a static page and a JSON API.
+ *
+ * Security:
+ * - binds to 127.0.0.1 only; the Host header must be 127.0.0.1:<port> or localhost:<port>
+ *   (blocks DNS rebinding);
+ * - every API call needs a random per-session token in the X-Selfguard-Token header, which
+ *   other websites can't send without a CORS preflight we never answer;
+ * - POSTs also need a JSON content type and a same-origin Origin header;
+ * - strict CSP: no inline scripts, no third-party anything. Untrusted text (package names,
+ *   advisory summaries) is rendered with textContent only;
+ * - actions only apply to projects selfguard already tracks.
+ */
+import { spawn } from "node:child_process";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { fchmodSync, openSync, readFileSync, rmSync } from "node:fs";
+import { createServer, request } from "node:http";
+import { fileURLToPath } from "node:url";
+import { maybeRemind } from "../announce.js";
+import { needsAttention } from "../alerts.js";
+import * as api from "../api.js";
+import { readEvents } from "../events.js";
+import { atomicWrite, ensureDir, isObject, readJsonFile } from "../fsutil.js";
+import { cliEntry } from "../hook.js";
+import { severityRank } from "../match.js";
+import { logFile, stateRoot, uiFile } from "../paths.js";
+import { groupByPackage } from "../report.js";
+import { scheduleStatus, updateWatcher } from "../schedule.js";
+import { loadRepo } from "../store.js";
+import { VERSION } from "../version.js";
+const IDLE_MS = 30 * 60 * 1000;
+const MAX_BODY = 64 * 1024;
+const STATIC = {
+    "/": { file: "index.html", type: "text/html; charset=utf-8" },
+    "/app.js": { file: "app.js", type: "text/javascript; charset=utf-8" },
+    "/app.css": { file: "app.css", type: "text/css; charset=utf-8" },
+    "/favicon.svg": { file: "favicon.svg", type: "image/svg+xml" },
+};
+const CSP = [
+    "default-src 'none'",
+    "script-src 'self'",
+    "style-src 'self'",
+    "img-src 'self' data:",
+    "connect-src 'self'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "frame-ancestors 'none'",
+].join("; ");
+const staticDir = () => fileURLToPath(new URL("./static/", import.meta.url));
+export function getOverview() {
+    const status = api.getStatus();
+    const attention = api.getAttention();
+    const totals = { malicious: 0, critical: 0, high: 0, moderate: 0, low: 0, unknown: 0 };
+    const worst = new Map();
+    for (const r of attention) {
+        for (const g of groupByPackage(r.findings)) {
+            const k = `${g.name}@${g.version}`;
+            const prev = worst.get(k);
+            if (!prev || severityRank(g.worst) < severityRank(prev))
+                worst.set(k, g.worst);
+        }
+    }
+    for (const s of worst.values())
+        totals[s]++;
+    let schedule = null;
+    if (process.platform === "darwin") {
+        try {
+            const s = scheduleStatus();
+            schedule = { enabled: s.loaded, watcher: s.watcher.loaded, watchedPaths: s.watcher.paths };
+        }
+        catch {
+            schedule = null;
+        }
+    }
+    return {
+        version: VERSION,
+        generatedAt: new Date().toISOString(),
+        settings: api.getSettings(),
+        schedule,
+        totals,
+        needsAttention: attention.filter((r) => r.findings.some(needsAttention)).map((r) => r.key),
+        trackedProjects: status.projects.length,
+        activeCheckouts: status.projects.filter((p) => p.active && p.exists).length,
+        repos: status.repos,
+        events: readEvents(80),
+    };
+}
+function send(res, status, body, type) {
+    res.writeHead(status, { "content-type": type, "content-length": Buffer.byteLength(body) });
+    res.end(body);
+}
+function sendJson(res, status, data) {
+    send(res, status, JSON.stringify(data), "application/json; charset=utf-8");
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        req.on("data", (c) => {
+            size += c.length;
+            if (size > MAX_BODY) {
+                reject(new api.ApiError("too_large", "request body too large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => {
+            try {
+                const text = Buffer.concat(chunks).toString("utf8");
+                const data = text ? JSON.parse(text) : {};
+                resolve(isObject(data) ? data : {});
+            }
+            catch {
+                reject(new api.ApiError("invalid", "invalid JSON body"));
+            }
+        });
+        req.on("error", reject);
+    });
+}
+function tokenOk(given, token) {
+    if (typeof given !== "string")
+        return false;
+    const a = Buffer.from(given);
+    const b = Buffer.from(token);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** Only act on projects selfguard already tracks (never arbitrary paths). */
+function trackedPath(body) {
+    const path = body.path;
+    if (typeof path !== "string" || !loadRepo(path))
+        throw new api.ApiError("not_tracked", "not a tracked project");
+    return path;
+}
+async function route(method, url, req) {
+    const p = url.pathname;
+    if (method === "GET") {
+        if (p === "/api/ping")
+            return { ok: true, version: VERSION };
+        if (p === "/api/overview")
+            return getOverview();
+        if (p === "/api/repo")
+            return api.getRepoDetail(url.searchParams.get("key") ?? "");
+        if (p === "/api/vuln")
+            return api.getVulnerability(url.searchParams.get("id") ?? "");
+    }
+    if (method === "POST") {
+        const body = await readBody(req);
+        if (p === "/api/scan")
+            return api.scanPath(trackedPath(body), { notify: false });
+        if (p === "/api/sync") {
+            const { outcomes: _o, ...r } = await api.sync({ notify: true });
+            try {
+                updateWatcher(api.watchTargets());
+            }
+            catch {
+                /* watcher is best effort */
+            }
+            return r;
+        }
+        if (p === "/api/forget")
+            return api.forget(trackedPath(body), { exclude: true });
+        if (p === "/api/settings")
+            return api.updateSettings({ remind: body.remind, activeDays: body.activeDays });
+        if (p === "/api/remind")
+            return { sent: await maybeRemind(api.getAttention(), { force: true }) };
+    }
+    throw new api.ApiError("not_found", "no such endpoint");
+}
+const STATUS = { not_found: 404, not_tracked: 404, busy: 409, too_large: 413 };
+export function createUiServer(token, onActivity = () => { }) {
+    const server = createServer((req, res) => {
+        const port = server.address()?.port ?? 0;
+        res.setHeader("x-content-type-options", "nosniff");
+        res.setHeader("referrer-policy", "no-referrer");
+        res.setHeader("x-frame-options", "DENY");
+        res.setHeader("cache-control", "no-store");
+        res.setHeader("cross-origin-opener-policy", "same-origin");
+        res.setHeader("cross-origin-resource-policy", "same-origin");
+        res.setHeader("content-security-policy", CSP);
+        const host = req.headers.host ?? "";
+        if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) {
+            send(res, 421, "wrong host", "text/plain; charset=utf-8");
+            return;
+        }
+        const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+        const method = req.method ?? "GET";
+        if (!url.pathname.startsWith("/api/")) {
+            const asset = STATIC[url.pathname];
+            if (!asset || (method !== "GET" && method !== "HEAD")) {
+                send(res, 404, "not found", "text/plain; charset=utf-8");
+                return;
+            }
+            try {
+                send(res, 200, readFileSync(`${staticDir()}${asset.file}`), asset.type);
+            }
+            catch {
+                send(res, 500, "dashboard files missing", "text/plain; charset=utf-8");
+            }
+            return;
+        }
+        if (!tokenOk(req.headers["x-selfguard-token"], token)) {
+            sendJson(res, 401, { error: { code: "unauthorized", message: "missing or wrong token; reopen with selfguard ui" } });
+            return;
+        }
+        if (method === "POST") {
+            const origin = req.headers.origin;
+            const type = req.headers["content-type"] ?? "";
+            if ((origin !== undefined && origin !== `http://${host}`) || !type.startsWith("application/json")) {
+                sendJson(res, 403, { error: { code: "forbidden", message: "cross-origin request refused" } });
+                return;
+            }
+        }
+        onActivity();
+        route(method, url, req).then((data) => sendJson(res, 200, data), (e) => {
+            const code = e instanceof api.ApiError ? e.code : "error";
+            const message = e instanceof Error ? e.message : String(e);
+            sendJson(res, e instanceof api.ApiError ? (STATUS[code] ?? 400) : 500, { error: { code, message } });
+        });
+    });
+    return server;
+}
+function urlOf(i) {
+    return `http://127.0.0.1:${i.port}/#t=${i.token}`;
+}
+function ping(i) {
+    return new Promise((resolve) => {
+        const req = request({ host: "127.0.0.1", port: i.port, path: "/api/ping", headers: { "x-selfguard-token": i.token }, timeout: 1500 }, (res) => {
+            res.resume();
+            resolve(res.statusCode === 200);
+        });
+        req.on("error", () => resolve(false));
+        req.on("timeout", () => {
+            req.destroy();
+            resolve(false);
+        });
+        req.end();
+    });
+}
+async function runningInstance() {
+    const i = readJsonFile(uiFile());
+    if (!i || !isObject(i) || typeof i.port !== "number" || typeof i.token !== "string" || typeof i.pid !== "number")
+        return null;
+    return (await ping(i)) ? i : null;
+}
+function openBrowser(url) {
+    const cmd = process.platform === "darwin" ? "/usr/bin/open" : "xdg-open";
+    const child = spawn(cmd, [url], { stdio: "ignore", detached: true });
+    child.on("error", () => { });
+    child.unref();
+}
+/** Serve in this process until idle for 30 minutes (or Ctrl+C). */
+export async function serve(port, onReady) {
+    const token = randomBytes(24).toString("base64url");
+    let timer;
+    const server = createUiServer(token, () => bump());
+    const stop = () => {
+        server.close();
+        const current = readJsonFile(uiFile());
+        if (current?.pid === process.pid)
+            rmSync(uiFile(), { force: true });
+    };
+    const bump = () => {
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(stop, IDLE_MS);
+        timer.unref();
+    };
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, "127.0.0.1", resolve);
+    });
+    const instance = { pid: process.pid, port: server.address().port, token };
+    atomicWrite(uiFile(), JSON.stringify(instance));
+    bump();
+    process.once("SIGINT", () => {
+        stop();
+        process.exit(0);
+    });
+    process.once("SIGTERM", () => {
+        stop();
+        process.exit(0);
+    });
+    onReady(instance);
+    await new Promise((resolve) => server.once("close", () => resolve()));
+}
+/**
+ * `selfguard ui`: reuse a running dashboard or start one in the background, then open it.
+ * With `foreground`, serve in this process instead (used by `ui --serve`).
+ */
+export async function runUi(opts) {
+    if (opts.foreground) {
+        await serve(opts.port, (i) => {
+            // The URL carries the session token: only show it on a terminal, never in the log file.
+            opts.log(process.stdout.isTTY ? `selfguard dashboard: ${urlOf(i)}` : `${new Date().toISOString()} ui: listening on 127.0.0.1:${i.port}`);
+            if (opts.open)
+                openBrowser(urlOf(i));
+        });
+        return;
+    }
+    let instance = await runningInstance();
+    if (!instance) {
+        ensureDir(stateRoot());
+        rmSync(uiFile(), { force: true });
+        const logFd = openSync(logFile(), "a", 0o600);
+        fchmodSync(logFd, 0o600);
+        const child = spawn(process.execPath, [cliEntry(), "ui", "--serve", "--no-open", "--port", String(opts.port)], {
+            detached: true,
+            stdio: ["ignore", logFd, logFd],
+            env: process.env,
+        });
+        child.unref();
+        for (let i = 0; i < 50 && !instance; i++) {
+            await new Promise((r) => setTimeout(r, 100));
+            instance = await runningInstance();
+        }
+        if (!instance)
+            throw new Error("the dashboard did not start; see ~/.selfguard/selfguard.log");
+    }
+    const url = urlOf(instance);
+    opts.log(`Dashboard: ${url}`);
+    opts.log("It stops by itself after 30 minutes without use.");
+    if (opts.open)
+        openBrowser(url);
+}

package/dist/ui/static/app.css

@@ -0,0 +1,263 @@
+:root {
+  --bg: #f6f7f9;
+  --panel: #ffffff;
+  --text: #1b1f24;
+  --muted: #5f6b7a;
+  --border: #e3e7ec;
+  --hover: #f1f4f8;
+  --accent: #1f6feb;
+  --malicious: #8b1a1a;
+  --critical: #c62828;
+  --high: #e4572e;
+  --moderate: #c88a04;
+  --low: #6b7785;
+  --ok: #1a7f37;
+  --radius: 10px;
+  color-scheme: light dark;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #0f1216;
+    --panel: #171b21;
+    --text: #e6e9ee;
+    --muted: #8f9aa7;
+    --border: #262c35;
+    --hover: #1e242c;
+    --accent: #4c8dff;
+    --malicious: #ff6b6b;
+    --critical: #ff5c5c;
+    --high: #ff8a5c;
+    --moderate: #e7b43c;
+    --low: #8f9aa7;
+    --ok: #3fb950;
+  }
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--text);
+  font: 14px/1.45 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+}
+
+.muted { color: var(--muted); }
+.mono { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 12.5px; }
+
+.topbar {
+  position: sticky;
+  top: 0;
+  z-index: 5;
+  display: flex;
+  align-items: center;
+  gap: 16px;
+  padding: 10px 24px;
+  background: var(--panel);
+  border-bottom: 1px solid var(--border);
+}
+.brand { display: flex; align-items: center; gap: 8px; font-weight: 650; font-size: 15px; }
+.status-line { flex: 1; color: var(--muted); font-size: 13px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+
+.btn {
+  border: 1px solid var(--border);
+  background: var(--panel);
+  color: var(--text);
+  border-radius: 7px;
+  padding: 6px 12px;
+  font: inherit;
+  font-size: 13px;
+  cursor: pointer;
+}
+.btn:hover { background: var(--hover); }
+.btn:disabled { opacity: .55; cursor: progress; }
+.btn.primary { background: var(--accent); border-color: var(--accent); color: #fff; }
+.btn.danger { color: var(--critical); }
+.btn.small { padding: 3px 9px; font-size: 12px; }
+
+main { max-width: 1320px; margin: 0 auto; padding: 20px 24px 40px; }
+
+.hero {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 24px;
+  flex-wrap: wrap;
+  margin-bottom: 18px;
+}
+.hero h1 { margin: 0 0 2px; font-size: 22px; font-weight: 650; }
+.hero p { margin: 0; }
+.hero.bad h1 { color: var(--critical); }
+.hero.ok h1 { color: var(--ok); }
+
+.tiles { display: flex; gap: 10px; flex-wrap: wrap; }
+.tile {
+  min-width: 96px;
+  padding: 10px 14px;
+  background: var(--panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.tile .n { font-size: 22px; font-weight: 650; font-variant-numeric: tabular-nums; }
+.tile .l { font-size: 12px; color: var(--muted); text-transform: uppercase; letter-spacing: .04em; }
+.tile.zero .n { color: var(--muted); font-weight: 500; }
+.tile[data-sev="malicious"]:not(.zero) .n { color: var(--malicious); }
+.tile[data-sev="critical"]:not(.zero) .n { color: var(--critical); }
+.tile[data-sev="high"]:not(.zero) .n { color: var(--high); }
+.tile[data-sev="moderate"]:not(.zero) .n { color: var(--moderate); }
+
+.layout { display: grid; grid-template-columns: minmax(300px, 400px) 1fr; gap: 16px; align-items: start; }
+@media (max-width: 900px) { .layout { grid-template-columns: 1fr; } }
+
+.panel { background: var(--panel); border: 1px solid var(--border); border-radius: var(--radius); }
+.repos-panel { position: sticky; top: 64px; max-height: calc(100vh - 84px); display: flex; flex-direction: column; }
+.panel-head { padding: 10px; border-bottom: 1px solid var(--border); display: grid; gap: 8px; }
+.tabs { display: flex; gap: 4px; }
+.tabs button {
+  flex: 1;
+  border: 0;
+  background: transparent;
+  color: var(--muted);
+  padding: 6px 8px;
+  border-radius: 6px;
+  font: inherit;
+  font-size: 13px;
+  cursor: pointer;
+}
+.tabs button[aria-selected="true"] { background: var(--hover); color: var(--text); font-weight: 600; }
+.tabs .count { margin-left: 4px; font-variant-numeric: tabular-nums; opacity: .8; }
+input[type="search"], select, input[type="number"] {
+  width: 100%;
+  border: 1px solid var(--border);
+  background: var(--bg);
+  color: var(--text);
+  border-radius: 7px;
+  padding: 6px 10px;
+  font: inherit;
+}
+
+.repo-list { list-style: none; margin: 0; padding: 4px; overflow: auto; }
+.repo-list li button {
+  width: 100%;
+  display: grid;
+  grid-template-columns: 10px 1fr auto;
+  gap: 10px;
+  align-items: center;
+  text-align: left;
+  border: 0;
+  background: transparent;
+  color: inherit;
+  padding: 9px 10px;
+  border-radius: 7px;
+  font: inherit;
+  cursor: pointer;
+}
+.repo-list li button:hover { background: var(--hover); }
+.repo-list li button[aria-current="true"] { background: var(--hover); box-shadow: inset 3px 0 0 var(--accent); }
+.repo-list .name { font-weight: 550; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.repo-list .meta { font-size: 12px; color: var(--muted); }
+.repo-list .empty { padding: 24px 12px; color: var(--muted); text-align: center; }
+
+.dot { width: 10px; height: 10px; border-radius: 50%; background: var(--ok); }
+.dot[data-sev="malicious"] { background: var(--malicious); box-shadow: 0 0 0 3px color-mix(in srgb, var(--malicious) 25%, transparent); }
+.dot[data-sev="critical"] { background: var(--critical); }
+.dot[data-sev="high"] { background: var(--high); }
+.dot[data-sev="moderate"] { background: var(--moderate); }
+.dot[data-sev="low"], .dot[data-sev="unknown"] { background: var(--low); }
+.dot[data-sev="error"] { background: transparent; border: 2px solid var(--moderate); }
+
+.badge {
+  display: inline-block;
+  padding: 1px 7px;
+  border-radius: 999px;
+  font-size: 11px;
+  font-weight: 650;
+  letter-spacing: .03em;
+  text-transform: uppercase;
+  color: #fff;
+  background: var(--low);
+  white-space: nowrap;
+}
+.badge[data-sev="malicious"] { background: var(--malicious); }
+.badge[data-sev="critical"] { background: var(--critical); }
+.badge[data-sev="high"] { background: var(--high); }
+.badge[data-sev="moderate"] { background: var(--moderate); }
+.chip {
+  display: inline-block;
+  padding: 1px 7px;
+  border-radius: 999px;
+  border: 1px solid var(--border);
+  font-size: 11.5px;
+  color: var(--muted);
+  white-space: nowrap;
+}
+.chip.ok { color: var(--ok); border-color: color-mix(in srgb, var(--ok) 40%, var(--border)); }
+
+.detail-panel { padding: 18px 20px; min-height: 320px; }
+.detail-panel h2 { margin: 0; font-size: 18px; }
+.detail-panel h3 { margin: 22px 0 8px; font-size: 13px; text-transform: uppercase; letter-spacing: .05em; color: var(--muted); }
+.detail-head { display: flex; align-items: center; gap: 10px; justify-content: space-between; flex-wrap: wrap; }
+
+table { width: 100%; border-collapse: collapse; }
+th, td { text-align: left; padding: 8px 8px; border-bottom: 1px solid var(--border); vertical-align: top; }
+th { font-size: 12px; color: var(--muted); font-weight: 600; }
+tr.dim td { opacity: .6; }
+td.fix { white-space: nowrap; }
+.fix-ok { color: var(--ok); font-weight: 600; }
+.fix-none { color: var(--moderate); }
+.fix-remove { color: var(--malicious); font-weight: 650; }
+
+details.adv summary { cursor: pointer; color: var(--muted); font-size: 12.5px; }
+details.adv ul { margin: 6px 0 0; padding-left: 16px; }
+details.adv li { margin: 3px 0; }
+a { color: var(--accent); text-decoration: none; }
+a:hover { text-decoration: underline; }
+
+.checkouts { display: grid; gap: 6px; }
+.checkout {
+  display: grid;
+  grid-template-columns: 1fr auto;
+  gap: 8px;
+  align-items: center;
+  padding: 8px 10px;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+}
+.checkout .path { font-size: 12px; color: var(--muted); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.checkout .actions { display: flex; gap: 6px; }
+.checkout.inactive { opacity: .65; }
+
+.feed { list-style: none; padding: 0; margin: 0; }
+.feed li { display: grid; grid-template-columns: 22px 1fr auto; gap: 8px; padding: 8px 0; border-bottom: 1px solid var(--border); }
+.feed .icon { font-size: 14px; text-align: center; }
+.feed .when { color: var(--muted); font-size: 12px; white-space: nowrap; }
+.feed .pkgs { color: var(--muted); font-size: 12.5px; }
+
+.settings { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 12px; }
+.setting { border: 1px solid var(--border); border-radius: 8px; padding: 10px 12px; }
+.setting label { display: block; font-weight: 600; margin-bottom: 4px; }
+.setting p { margin: 6px 0 0; font-size: 12.5px; color: var(--muted); }
+
+.notice { padding: 10px 12px; border-radius: 8px; background: var(--hover); margin-top: 10px; font-size: 13px; }
+.notice code { font-size: 12px; }
+
+.toast {
+  position: fixed;
+  bottom: 20px;
+  left: 50%;
+  transform: translateX(-50%);
+  background: var(--text);
+  color: var(--bg);
+  padding: 8px 14px;
+  border-radius: 8px;
+  font-size: 13px;
+  box-shadow: 0 6px 20px rgba(0, 0, 0, .2);
+}
+
+.small { font-size: 12px; }
+.gap-left { margin-left: 6px; }
+.gap-top { margin-top: 8px; }
+.tabs.scope { flex: 0 0 auto; }
+.tabs.scope button { white-space: nowrap; }
+h3.inline { margin: 0 !important; }