tabby-rdp 0.5.0 → 0.5.2

package/dist/desk.js

@@ -11,78 +11,48 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeskTriggerDecorator = void 0;
 const core_1 = require("@angular/core");
-const tabby_core_1 = require("tabby-core");
 const tabby_terminal_1 = require("tabby-terminal");
 const desktop_service_1 = require("./desktop.service");
 const targets_1 = require("./targets");
+const deskScript_1 = require("./deskScript");
 const probe_1 = require("./probe");
-const PREFIX = Buffer.from('\x1b]7777;');
-const BEL = 0x07;
-const ST = Buffer.from('\x1b\\');
-function parse(payload) {
-    const [session, socket, cwd, kind, machine, hostname] = payload.split(';').map(f => Buffer.from(f ?? '', 'base64').toString('utf8'));
-    // Older `desk` scripts sent no kind (they only knew tmux), and no machine.
-    return {
-        session: session ?? '', socket: socket ?? '', cwd: cwd ?? '', kind: kind ?? (session ? 'tmux' : ''),
-        machine: machine?.trim() ?? '', hostname: hostname?.trim() ?? '',
-    };
-}
 /** Strips `desk` requests (and probes, see probe.ts) out of a session's output and reports them. */
 class DeskTrigger extends tabby_terminal_1.SessionMiddleware {
-    constructor(onDesk, onProbe) {
+    constructor(known, onDesk, onProbe) {
         super();
         this.onDesk = onDesk;
         this.onProbe = onProbe;
+        this.requests = new deskScript_1.DeskRequests(known);
     }
     feedFromSession(data) {
         // Tabby's OSC processor runs first and passes unknown OSCs through whole, so each request
         // arrives complete within one chunk.
-        let start = data.indexOf(PREFIX);
-        while (start !== -1) {
-            const body = start + PREFIX.length;
-            const bel = data.indexOf(BEL, body);
-            const st = data.indexOf(ST, body);
-            const end = bel === -1 ? st : st === -1 ? bel : Math.min(bel, st);
-            if (end === -1) {
-                break;
-            }
-            const payload = data.subarray(body, end).toString('utf8');
-            data = Buffer.concat([data.subarray(0, start), data.subarray(end + (end === st ? ST.length : 1))]);
-            if (payload.startsWith('desk;')) {
-                const request = parse(payload.slice('desk;'.length));
-                setTimeout(() => this.onDesk(request));
-            }
-            else if (payload.startsWith('probe;')) {
-                this.onProbe(payload.slice('probe;'.length));
-            }
-            start = data.indexOf(PREFIX, start);
+        const { output, desk, probes } = this.requests.take(data);
+        probes.forEach(id => this.onProbe(id));
+        if (desk) {
+            setTimeout(() => this.onDesk(desk));
         }
-        if (data.length) {
-            super.feedFromSession(data);
+        if (output.length) {
+            super.feedFromSession(output);
         }
     }
 }
 /** Listens for `desk` in every terminal (SSH tabs and local terminals running ssh). */
 let DeskTriggerDecorator = class DeskTriggerDecorator extends tabby_terminal_1.TerminalDecorator {
-    constructor(desktop, zone, notifications) {
+    constructor(desktop, zone) {
         super();
         this.desktop = desktop;
         this.zone = zone;
-        this.notifications = notifications;
     }
     attach(terminal) {
         const install = () => {
-            terminal.session?.middleware.push(new DeskTrigger(request => this.zone.run(() => {
+            // Only requests with a key a host gave get this far, one in a while (see DeskRequests); the service checks
+            // the rest, the `desk` setting included.
+            terminal.session?.middleware.push(new DeskTrigger(key => this.desktop.knowsDeskKey(key), request => this.zone.run(() => {
                 const pane = (0, targets_1.desktopPaneOf)(terminal);
-                if (!pane) {
-                    return;
-                }
-                if (!this.desktop.settings().desk) {
-                    // A hook left from when it was on; it goes away the next time a desktop opens there.
-                    this.notifications.info('`desk` is off: turn it on in the menu under Remote Desktop › Settings');
-                    return;
+                if (pane) {
+                    this.desktop.openConsole(pane, request);
                 }
-                this.desktop.openConsole(pane, request);
             }), id => (0, probe_1.probeArrived)(id, terminal)));
         };
         install();
@@ -92,6 +62,5 @@ let DeskTriggerDecorator = class DeskTriggerDecorator extends tabby_terminal_1.T
 exports.DeskTriggerDecorator = DeskTriggerDecorator;
 exports.DeskTriggerDecorator = DeskTriggerDecorator = __decorate([
     (0, core_1.Injectable)(),
-    __metadata("design:paramtypes", [desktop_service_1.RemoteDesktopService, core_1.NgZone, tabby_core_1.NotificationsService])
+    __metadata("design:paramtypes", [desktop_service_1.RemoteDesktopService, core_1.NgZone])
 ], DeskTriggerDecorator);
-//# sourceMappingURL=desk.js.map

package/dist/deskScript.js

@@ -1,8 +1,171 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MACHINE_ID_COMMAND = void 0;
+exports.MACHINE_ID_COMMAND = exports.DeskGate = exports.DeskRequests = exports.DESK_COOLDOWN_MS = void 0;
+exports.parseDeskRequest = parseDeskRequest;
+exports.deskKeyDigest = deskKeyDigest;
+exports.takeDeskMessages = takeDeskMessages;
 exports.shq = shq;
 exports.consoleScript = consoleScript;
+const crypto_1 = require("crypto");
+/** desk's key: 128 random bits in hex, made by the setup (remoteSetup.ts). */
+const DESK_KEY = /^[0-9a-f]{32}$/;
+/** A request's fields, from what follows `desk;`. */
+function parseDeskRequest(payload) {
+    const [session, socket, cwd, kind, machine, hostname, key] = payload.split(';').map(f => Buffer.from(f, 'base64').toString('utf8'));
+    return {
+        session: session ?? '', socket: socket ?? '', cwd: cwd ?? '', kind: kind ?? '',
+        machine: machine?.trim() ?? '', hostname: hostname?.trim() ?? '', key: DESK_KEY.test(key ?? '') ? key : '',
+    };
+}
+/** What the plugin keeps of a host's desk key: its SHA-256, so that the config never holds the key. '' for no key. */
+function deskKeyDigest(key) {
+    return key && DESK_KEY.test(key) ? (0, crypto_1.createHash)('sha256').update(key).digest('hex') : '';
+}
+const PREFIX = Buffer.from('\x1b]7777;');
+const DESK = Buffer.from('desk;');
+const PROBE = Buffer.from('probe;');
+const BEL = 0x07;
+const ESC = 0x1b;
+/** Whether `data` has `prefix` at `at`, before `end`. */
+function startsAt(data, prefix, at, end) {
+    return end - at >= prefix.length && data.compare(prefix, 0, prefix.length, at, at + prefix.length) === 0;
+}
+/**
+ * Takes the plugin's OSC 7777 messages out of a chunk of terminal output: one `desk` request (output can repeat one any
+ * number of times; one is all a chunk gets), the last one that `counts` (its key: see DeskRequests), so that a
+ * look-alike after it can't stand in its place; how many others were looked at and didn't count; and probes (see
+ * probe.ts).
+ */
+function takeDeskMessages(data, counts = () => true) {
+    const kept = [];
+    const probes = [];
+    // Where each desk request's fields are (start, end), read from the last one back once all are out of the output.
+    const desks = [];
+    let from = 0;
+    for (let start = data.indexOf(PREFIX); start !== -1; start = data.indexOf(PREFIX, from)) {
+        const body = start + PREFIX.length;
+        // The first BEL or ST (ESC \) ends it; one pass, so many messages in a chunk cost no more than its length.
+        let end = body;
+        while (end < data.length && data[end] !== BEL && !(data[end] === ESC && data[end + 1] === 0x5c)) {
+            end++;
+        }
+        if (end >= data.length) {
+            break;
+        }
+        kept.push(data.subarray(from, start));
+        from = end + (data[end] === BEL ? 1 : 2);
+        if (startsAt(data, DESK, body, end)) {
+            desks.push(body + DESK.length, end);
+        }
+        else if (startsAt(data, PROBE, body, end)) {
+            probes.push(data.subarray(body + PROBE.length, end).toString('utf8'));
+        }
+    }
+    let desk = null;
+    let ignored = 0;
+    for (let i = desks.length - 2; i >= 0 && !desk; i -= 2) {
+        const request = parseDeskRequest(data.subarray(desks[i], desks[i + 1]).toString('utf8'));
+        if (counts(request)) {
+            desk = request;
+        }
+        else {
+            ignored++;
+        }
+    }
+    const output = from === 0 ? data : Buffer.concat([...kept, data.subarray(from)]);
+    return { output, desk, ignored, probes };
+}
+/** How long a pane ignores `desk` requests after handling one. */
+exports.DESK_COOLDOWN_MS = 2000;
+/** How many keys' lookups a chunk of output keeps, to look each of them up once (see DeskRequests.take). */
+const KEYS_KEPT = 16;
+/**
+ * The time the cooldowns go by: a clock that only goes forward. The time of day can step back (set by hand, or
+ * corrected after sleep), which would keep `desk` quiet for as long as the step.
+ */
+const monotonic = () => performance.now();
+/**
+ * A terminal's `desk` requests as its output brings them, before any goes further: only one with a key `known` (a key
+ * some host's setup gave this plugin, see RemoteDesktopService.knowsDeskKey), and then none for the cooldown. Output
+ * can carry any number of look-alikes, in one chunk or in many, and each request let through takes a turn of Tabby's
+ * window (and, past the key check there, commands on a host): the others end here, as they are read. Those without a
+ * known key get a line in the developer console, at most one per cooldown.
+ */
+class DeskRequests {
+    constructor(known, cooldownMs = exports.DESK_COOLDOWN_MS, now = monotonic, warn = message => console.warn(message)) {
+        this.known = known;
+        this.cooldownMs = cooldownMs;
+        this.now = now;
+        this.warn = warn;
+        this.quietUntil = 0;
+        this.unknown = 0;
+        this.warnAfter = 0;
+    }
+    /** Takes the plugin's messages out of a chunk of output (see takeDeskMessages): the request to act on, if any. */
+    take(data) {
+        // A flood repeats a few keys, one or several in turn: each is looked up once per chunk. A few are kept, not all
+        // of them (a flood of different ones costs a lookup each whatever is kept, and holds no more memory for it),
+        // and the last one besides, so that one repeated past them isn't looked up again each time either.
+        const looked = new Map();
+        let last = null;
+        const counts = (request) => {
+            if (last?.key === request.key) {
+                return last.known;
+            }
+            let known = looked.get(request.key);
+            if (known === undefined) {
+                known = !!request.key && this.known(request.key);
+                if (looked.size < KEYS_KEPT) {
+                    looked.set(request.key, known);
+                }
+            }
+            last = { key: request.key, known };
+            return known;
+        };
+        const { output, desk, ignored, probes } = takeDeskMessages(data, counts);
+        const now = this.now();
+        this.unknown += ignored;
+        if (this.unknown && now >= this.warnAfter) {
+            this.warn(`desk: ignored ${this.unknown === 1 ? 'a request' : `${this.unknown} requests`} without a key from a host whose desktop this Tabby set desk up on`);
+            this.unknown = 0;
+            this.warnAfter = now + this.cooldownMs;
+        }
+        if (!desk || now < this.quietUntil) {
+            return { output, desk: null, probes };
+        }
+        this.quietUntil = now + this.cooldownMs;
+        return { output, desk, probes };
+    }
+}
+exports.DeskRequests = DeskRequests;
+/**
+ * One `desk` request at a time per pane, and none for a moment after one: output can repeat a request any number of
+ * times, and each one costs commands on the host (and a `ps` here, for a local terminal).
+ */
+class DeskGate {
+    constructor(cooldownMs = exports.DESK_COOLDOWN_MS, now = monotonic) {
+        this.cooldownMs = cooldownMs;
+        this.now = now;
+        this.busy = false;
+        this.until = 0;
+    }
+    /** Runs `task`, unless one runs or the last one ended less than the cooldown ago (false: dropped). */
+    async run(task) {
+        if (this.busy || this.now() < this.until) {
+            return false;
+        }
+        this.busy = true;
+        try {
+            await task();
+        }
+        finally {
+            this.busy = false;
+            this.until = this.now() + this.cooldownMs;
+        }
+        return true;
+    }
+}
+exports.DeskGate = DeskGate;
 /** Remote command printing what `desk` sends as `machine`. */
 exports.MACHINE_ID_COMMAND = 'cat /etc/machine-id 2>/dev/null || hostname';
 /** Single-quotes a value for sh. */
@@ -10,8 +173,10 @@ function shq(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 /**
- * Remote script: open a maximized terminal on the headless desktop, attached to the given tmux
- * session (unless something already is), or in the given folder. Prints `RD_OK …` or `RD_ERR …`.
+ * Remote script: open a maximized terminal on the headless desktop, attached to the given shared session (unless
+ * something already is), or in the given folder. Only sessions of this user's own: a trd-pty session by its id (trd-pty
+ * looks it up in its private folder and checks who serves it), or a tmux server whose socket this user owns, in tmux's
+ * folder for them. Prints `RD_OK …` or `RD_ERR …`.
  */
 function consoleScript(request) {
     return `SESS=${shq(request.session)}
@@ -23,14 +188,40 @@ command -v gnome-terminal >/dev/null 2>&1 || { echo "RD_ERR gnome-terminal is no
 W=$(systemctl --user show-environment 2>/dev/null | sed -n 's/^WAYLAND_DISPLAY=//p')
 export WAYLAND_DISPLAY=${"$"}{W:-wayland-0}
 TRD="$HOME/.local/share/tabby-rdp/bin/trd-pty"
-if [ "$KIND" = native ] && [ -n "$SESS" ] && [ -x "$TRD" ] && [ "$("$TRD" clients "$SESS")" -ge 1 ]; then
+# A tmux client attaches to whatever server answers on the socket it is given, and another user can let anyone in to
+# theirs. So only a socket of this user's, in tmux's folder for them (theirs, no access for others, as tmux makes it),
+# with no symbolic link on the way, and every folder above it root's or this user's, where others can't rename or
+# replace anything (or only their own entries: sticky, like /tmp): nobody else can swap the path out before the attach,
+# later, finds the socket again. (ls -n's first and third fields, its mode and owner, are the portable way to read them.)
+own_tmux () {
+    [ -S "$1" ] && [ ! -L "$1" ] && [ -O "$1" ] && [ "$(readlink -f "$1" 2>/dev/null)" = "$1" ] || return 1
+    ot_uid=$(id -u)
+    ot_dir=${"$"}{1%/*}
+    [ "${"$"}{ot_dir##*/}" = "tmux-$ot_uid" ] && [ -O "$ot_dir" ] || return 1
+    case $(ls -ld "$ot_dir") in d???------*) ;; *) return 1 ;; esac
+    ot_up=${"$"}{ot_dir%/*}
+    while :; do
+        set -- $(ls -ldn "$ot_up/")
+        [ "$3" = "$ot_uid" ] || [ "$3" = 0 ] || return 1
+        case $1 in d????[!w]??[!w]*|d????????[tT]*) ;; *) return 1 ;; esac
+        case $ot_up in '') return 0 ;; /*) ot_up=${"$"}{ot_up%/*} ;; *) return 1 ;; esac
+    done
+}
+# Session names as trd-pty and tmux make them (tmux never puts : or . in one); anything else opens a terminal in the
+# folder instead. A tmux name is otherwise any: it only picks among the sessions of a server of this user's own.
+case $KIND in
+    native) case $SESS in ''|*[!0-9a-f]*) KIND= ;; esac ;;
+    tmux) case $SESS in ''|*[:.]*) KIND= ;; esac ;;
+    *) KIND= ;;
+esac
+if [ "$KIND" = native ] && [ -x "$TRD" ] && [ "$("$TRD" clients "$SESS")" -ge 1 ]; then
     # The console itself is one attached terminal; a second one means a desktop terminal is already attached.
     if [ "$("$TRD" clients "$SESS")" -ge 2 ]; then
         echo "RD_OK attached"; exit 0
     fi
     gnome-terminal --maximize -- "$TRD" attach "$SESS" >/dev/null 2>&1 \
         && echo "RD_OK opened" || echo "RD_ERR could not open a terminal"
-elif [ -n "$SESS" ] && [ -S "$SOCK" ] && tmux -S "$SOCK" has-session -t "=$SESS" 2>/dev/null; then
+elif [ "$KIND" = tmux ] && own_tmux "$SOCK" && tmux -S "$SOCK" has-session -t "=$SESS" 2>/dev/null; then
     # The console itself is one client; a second one means a desktop terminal is already attached.
     if [ "$(tmux -S "$SOCK" list-clients -t "=$SESS" 2>/dev/null | wc -l)" -ge 2 ]; then
         echo "RD_OK attached"; exit 0
@@ -44,4 +235,3 @@ else
 fi
 `;
 }
-//# sourceMappingURL=deskScript.js.map