tmux-ide 2.1.4 → 2.6.0

package/src/lib/auth/auth-service.test.ts

@@ -1,178 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from "bun:test";
-import * as crypto from "node:crypto";
-import { AuthService } from "./auth-service.ts";
-
-describe("AuthService", () => {
-  let auth: AuthService;
-  const SECRET = "test-secret-key-for-jwt";
-
-  beforeEach(() => {
-    auth = new AuthService(SECRET);
-  });
-
-  afterEach(() => {
-    auth.dispose();
-  });
-
-  // ---- JWT ----------------------------------------------------------------
-
-  describe("JWT sign/verify round-trip", () => {
-    it("generates and verifies a valid token", () => {
-      const token = auth.generateToken("alice");
-      const result = auth.verifyToken(token);
-      expect(result.valid).toBe(true);
-      expect(result.userId).toBe("alice");
-    });
-
-    it("works with different user IDs", () => {
-      const token = auth.generateToken("bob@example.com");
-      const result = auth.verifyToken(token);
-      expect(result.valid).toBe(true);
-      expect(result.userId).toBe("bob@example.com");
-    });
-  });
-
-  describe("expired token rejected", () => {
-    it("rejects a token with exp in the past", () => {
-      // Create a service with extremely short expiry by manipulating the token
-      // We'll manually craft a token with an expired timestamp
-      const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString(
-        "base64url",
-      );
-      const payload = Buffer.from(
-        JSON.stringify({
-          userId: "alice",
-          iat: Math.floor(Date.now() / 1000) - 7200,
-          exp: Math.floor(Date.now() / 1000) - 3600, // expired 1 hour ago
-        }),
-      ).toString("base64url");
-      const sigInput = header + "." + payload;
-      const sig = crypto.createHmac("sha256", SECRET).update(sigInput).digest("base64url");
-      const expiredToken = `${header}.${payload}.${sig}`;
-
-      const result = auth.verifyToken(expiredToken);
-      expect(result.valid).toBe(false);
-    });
-  });
-
-  describe("tampered token rejected", () => {
-    it("rejects a token with modified payload", () => {
-      const token = auth.generateToken("alice");
-      const parts = token.split(".");
-
-      // Tamper with payload — change userId
-      const payload = JSON.parse(Buffer.from(parts[1]!, "base64url").toString());
-      payload.userId = "eve";
-      parts[1] = Buffer.from(JSON.stringify(payload)).toString("base64url");
-      const tampered = parts.join(".");
-
-      const result = auth.verifyToken(tampered);
-      expect(result.valid).toBe(false);
-    });
-
-    it("rejects a token with modified signature", () => {
-      const token = auth.generateToken("alice");
-      const parts = token.split(".");
-      // Flip a character in the signature
-      const sig = parts[2]!;
-      parts[2] = sig[0] === "A" ? "B" + sig.slice(1) : "A" + sig.slice(1);
-      const tampered = parts.join(".");
-
-      const result = auth.verifyToken(tampered);
-      expect(result.valid).toBe(false);
-    });
-
-    it("rejects a token signed with a different secret", () => {
-      const other = new AuthService("different-secret");
-      const token = other.generateToken("alice");
-      other.dispose();
-
-      const result = auth.verifyToken(token);
-      expect(result.valid).toBe(false);
-    });
-
-    it("rejects garbage strings", () => {
-      expect(auth.verifyToken("not.a.jwt").valid).toBe(false);
-      expect(auth.verifyToken("").valid).toBe(false);
-      expect(auth.verifyToken("only-one-part").valid).toBe(false);
-    });
-  });
-
-  // ---- SSH challenge-response -------------------------------------------
-
-  describe("SSH challenge with test keypair", () => {
-    // Generate an Ed25519 keypair for testing
-    function makeTestKey() {
-      const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
-
-      // Export raw 32-byte public key
-      const rawPub = publicKey.export({ type: "spki", format: "der" });
-      // Last 32 bytes of the DER encoding are the raw key
-      const raw32 = rawPub.subarray(rawPub.length - 32);
-
-      // Build SSH wire format: uint32(len) + "ssh-ed25519" + uint32(32) + raw32
-      const alg = Buffer.from("ssh-ed25519");
-      const algLenBuf = Buffer.alloc(4);
-      algLenBuf.writeUInt32BE(alg.length);
-      const keyLenBuf = Buffer.alloc(4);
-      keyLenBuf.writeUInt32BE(32);
-      const sshPubBuf = Buffer.concat([algLenBuf, alg, keyLenBuf, raw32]);
-      const sshPubStr = `ssh-ed25519 ${sshPubBuf.toString("base64")} test@test`;
-
-      return { publicKey, privateKey, sshPubStr };
-    }
-
-    it("creates a challenge and verifies a valid signature", async () => {
-      const { privateKey, sshPubStr } = makeTestKey();
-
-      // Create challenge
-      const { challengeId, challenge } = auth.createChallenge("testuser");
-      expect(challengeId).toBeTruthy();
-      expect(challenge).toBeTruthy();
-
-      // Sign the challenge
-      const challengeBuf = Buffer.from(challenge, "base64");
-      const signature = crypto.sign(null, challengeBuf, privateKey);
-
-      // authenticateWithSSHKey checks authorized_keys which won't exist in test,
-      // so we just verify the signature verification path works by checking
-      // that it gets past signature verification (fails at authorization)
-      const result = await auth.authenticateWithSSHKey({
-        publicKey: sshPubStr,
-        challengeId,
-        signature: signature.toString("base64"),
-      });
-
-      // Expect "not authorized" — which means signature verification passed
-      expect(result.success).toBe(false);
-      expect(result.error).toBe("SSH key not authorized for this user");
-    });
-
-    it("rejects an invalid signature", async () => {
-      const { sshPubStr } = makeTestKey();
-
-      const { challengeId } = auth.createChallenge("testuser");
-
-      // Send garbage signature (wrong length for ed25519 = 64 bytes)
-      const result = await auth.authenticateWithSSHKey({
-        publicKey: sshPubStr,
-        challengeId,
-        signature: Buffer.alloc(64).toString("base64"),
-      });
-
-      expect(result.success).toBe(false);
-      expect(result.error).toBe("Invalid SSH key signature");
-    });
-
-    it("rejects an expired/unknown challenge ID", async () => {
-      const result = await auth.authenticateWithSSHKey({
-        publicKey: "ssh-ed25519 AAAA test",
-        challengeId: "nonexistent-id",
-        signature: Buffer.alloc(64).toString("base64"),
-      });
-
-      expect(result.success).toBe(false);
-      expect(result.error).toBe("Invalid or expired challenge");
-    });
-  });
-});

package/src/lib/auth/auth-service.ts

@@ -1,227 +0,0 @@
-// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
-import * as crypto from "node:crypto";
-import { readFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-import { logger } from "../log.ts";
-
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-
-interface AuthChallenge {
-  challengeId: string;
-  challenge: Buffer;
-  timestamp: number;
-  userId: string;
-}
-
-export interface AuthResult {
-  success: boolean;
-  userId?: string;
-  token?: string;
-  error?: string;
-}
-
-interface SSHKeyAuth {
-  publicKey: string;
-  signature: string;
-  challengeId: string;
-}
-
-// ---------------------------------------------------------------------------
-// JWT helpers (HMAC-SHA256, no external dependency)
-// ---------------------------------------------------------------------------
-
-function base64url(buf: Buffer | string): string {
-  const b = typeof buf === "string" ? Buffer.from(buf) : buf;
-  return b.toString("base64url");
-}
-
-function decodeBase64url(str: string): Buffer {
-  return Buffer.from(str, "base64url");
-}
-
-function signJwt(payload: Record<string, unknown>, secret: string, expiresInSec: number): string {
-  const header = { alg: "HS256", typ: "JWT" };
-  const now = Math.floor(Date.now() / 1000);
-  const body = { ...payload, iat: now, exp: now + expiresInSec };
-
-  const segments = [base64url(JSON.stringify(header)), base64url(JSON.stringify(body))];
-  const sigInput = segments.join(".");
-  const sig = crypto.createHmac("sha256", secret).update(sigInput).digest();
-  segments.push(base64url(sig));
-  return segments.join(".");
-}
-
-function verifyJwt(
-  token: string,
-  secret: string,
-): { valid: true; payload: Record<string, unknown> } | { valid: false } {
-  const parts = token.split(".");
-  if (parts.length !== 3) return { valid: false };
-
-  const sigInput = parts[0] + "." + parts[1];
-  const expected = crypto.createHmac("sha256", secret).update(sigInput).digest();
-  const actual = decodeBase64url(parts[2]!);
-
-  if (expected.length !== actual.length || !crypto.timingSafeEqual(expected, actual)) {
-    return { valid: false };
-  }
-
-  try {
-    const payload = JSON.parse(decodeBase64url(parts[1]!).toString()) as Record<string, unknown>;
-    if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1000)) {
-      return { valid: false };
-    }
-    return { valid: true, payload };
-  } catch {
-    return { valid: false };
-  }
-}
-
-// ---------------------------------------------------------------------------
-// AuthService
-// ---------------------------------------------------------------------------
-
-const TOKEN_EXPIRY_SEC = 24 * 60 * 60; // 24 hours
-const CHALLENGE_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
-
-export class AuthService {
-  private challenges = new Map<string, AuthChallenge>();
-  private jwtSecret: string;
-  private cleanupTimer: ReturnType<typeof setInterval>;
-
-  constructor(secret?: string) {
-    this.jwtSecret = secret ?? process.env.JWT_SECRET ?? crypto.randomBytes(64).toString("hex");
-    this.cleanupTimer = setInterval(() => this.cleanupExpiredChallenges(), 60_000);
-  }
-
-  dispose(): void {
-    clearInterval(this.cleanupTimer);
-  }
-
-  private cleanupExpiredChallenges(): void {
-    const now = Date.now();
-    for (const [id, ch] of this.challenges) {
-      if (now - ch.timestamp > CHALLENGE_TIMEOUT_MS) {
-        this.challenges.delete(id);
-      }
-    }
-  }
-
-  // ---- JWT ----------------------------------------------------------------
-
-  generateToken(userId: string): string {
-    return signJwt({ userId }, this.jwtSecret, TOKEN_EXPIRY_SEC);
-  }
-
-  verifyToken(token: string): { valid: boolean; userId?: string } {
-    const result = verifyJwt(token, this.jwtSecret);
-    if (!result.valid) return { valid: false };
-    return { valid: true, userId: result.payload.userId as string };
-  }
-
-  // ---- SSH challenge-response --------------------------------------------
-
-  createChallenge(userId: string): { challengeId: string; challenge: string } {
-    const challengeId = crypto.randomUUID();
-    const challenge = crypto.randomBytes(32);
-
-    this.challenges.set(challengeId, {
-      challengeId,
-      challenge,
-      timestamp: Date.now(),
-      userId,
-    });
-
-    return { challengeId, challenge: challenge.toString("base64") };
-  }
-
-  async authenticateWithSSHKey(auth: SSHKeyAuth): Promise<AuthResult> {
-    const challenge = this.challenges.get(auth.challengeId);
-    if (!challenge) {
-      return { success: false, error: "Invalid or expired challenge" };
-    }
-
-    const sigBuf = Buffer.from(auth.signature, "base64");
-    if (!this.verifySSHSignature(challenge.challenge, sigBuf, auth.publicKey)) {
-      return { success: false, error: "Invalid SSH key signature" };
-    }
-
-    const authorized = this.checkSSHKeyAuthorization(challenge.userId, auth.publicKey);
-    if (!authorized) {
-      return { success: false, error: "SSH key not authorized for this user" };
-    }
-
-    this.challenges.delete(auth.challengeId);
-    const token = this.generateToken(challenge.userId);
-    return { success: true, userId: challenge.userId, token };
-  }
-
-  // ---- SSH helpers -------------------------------------------------------
-
-  private verifySSHSignature(challenge: Buffer, signature: Buffer, publicKeyStr: string): boolean {
-    try {
-      const parts = publicKeyStr.trim().split(" ");
-      if (parts.length < 2) return false;
-
-      const keyType = parts[0];
-      const keyData = parts[1]!;
-
-      if (keyType !== "ssh-ed25519") {
-        logger.warn("auth", `Unsupported key type: ${keyType}`);
-        return false;
-      }
-
-      if (signature.length !== 64) return false;
-
-      const sshBuf = Buffer.from(keyData, "base64");
-      let offset = 0;
-      const algLen = sshBuf.readUInt32BE(offset);
-      offset += 4 + algLen;
-      const keyLen = sshBuf.readUInt32BE(offset);
-      offset += 4;
-      if (keyLen !== 32) return false;
-
-      const rawPub = sshBuf.subarray(offset, offset + 32);
-      const pubKey = crypto.createPublicKey({
-        key: Buffer.concat([
-          Buffer.from([0x30, 0x2a]),
-          Buffer.from([0x30, 0x05]),
-          Buffer.from([0x06, 0x03, 0x2b, 0x65, 0x70]),
-          Buffer.from([0x03, 0x21, 0x00]),
-          rawPub,
-        ]),
-        format: "der",
-        type: "spki",
-      });
-
-      return crypto.verify(null, challenge, pubKey, signature);
-    } catch (err) {
-      logger.error("auth", "SSH signature verification failed", {
-        error: String(err),
-      });
-      return false;
-    }
-  }
-
-  private checkSSHKeyAuthorization(userId: string, publicKey: string): boolean {
-    try {
-      const home = userId === process.env.USER ? homedir() : `/home/${userId}`;
-      const authKeysPath = join(home, ".ssh", "authorized_keys");
-      if (!existsSync(authKeysPath)) return false;
-
-      const authorizedKeys = readFileSync(authKeysPath, "utf-8");
-      const parts = publicKey.trim().split(" ");
-      const keyData = parts.length > 1 ? parts[1]! : parts[0]!;
-      return authorizedKeys.includes(keyData);
-    } catch {
-      return false;
-    }
-  }
-
-  getCurrentUser(): string {
-    return process.env.USER ?? process.env.USERNAME ?? "unknown";
-  }
-}

package/src/lib/auth/middleware.test.ts

@@ -1,119 +0,0 @@
-// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
-import { describe, it, expect, beforeEach, afterEach } from "bun:test";
-import { Hono } from "hono";
-import { AuthService } from "./auth-service.ts";
-import { authMiddleware, validateWsToken } from "./middleware.ts";
-import type { AuthConfig } from "./types.ts";
-
-describe("authMiddleware", () => {
-  let auth: AuthService;
-  const SECRET = "test-middleware-secret";
-
-  beforeEach(() => {
-    auth = new AuthService(SECRET);
-  });
-
-  afterEach(() => {
-    auth.dispose();
-  });
-
-  function buildApp(config: AuthConfig): Hono {
-    const app = new Hono();
-    app.use("/*", authMiddleware(auth, config));
-    app.get("/health", (c) => c.json({ ok: true }));
-    app.get("/api/auth/challenge", (c) => c.json({ bypassed: true }));
-    app.get("/api/sessions", (c) => c.json({ sessions: [] }));
-    return app;
-  }
-
-  describe("method = none (backward compatible)", () => {
-    it("passes through all requests without auth", async () => {
-      const app = buildApp({ method: "none", token_expiry: 86400 });
-      const res = await app.request("/api/sessions");
-      expect(res.status).toBe(200);
-    });
-  });
-
-  describe("method = ssh", () => {
-    const config: AuthConfig = { method: "ssh", token_expiry: 86400 };
-
-    it("bypasses /health", async () => {
-      const app = buildApp(config);
-      const res = await app.request("/health");
-      expect(res.status).toBe(200);
-    });
-
-    it("bypasses /api/auth/* routes", async () => {
-      const app = buildApp(config);
-      const res = await app.request("/api/auth/challenge");
-      expect(res.status).toBe(200);
-      const body = await res.json();
-      expect(body.bypassed).toBe(true);
-    });
-
-    it("rejects requests without Authorization header", async () => {
-      const app = buildApp(config);
-      const res = await app.request("/api/sessions");
-      expect(res.status).toBe(401);
-    });
-
-    it("rejects requests with invalid token", async () => {
-      const app = buildApp(config);
-      const res = await app.request("/api/sessions", {
-        headers: { Authorization: "Bearer invalid-token" },
-      });
-      expect(res.status).toBe(401);
-    });
-
-    it("allows requests with valid token", async () => {
-      const app = buildApp(config);
-      const token = auth.generateToken("alice");
-      const res = await app.request("/api/sessions", {
-        headers: { Authorization: `Bearer ${token}` },
-      });
-      expect(res.status).toBe(200);
-    });
-
-    it("rejects requests with non-Bearer auth", async () => {
-      const app = buildApp(config);
-      const res = await app.request("/api/sessions", {
-        headers: { Authorization: "Basic dXNlcjpwYXNz" },
-      });
-      expect(res.status).toBe(401);
-    });
-  });
-});
-
-describe("validateWsToken", () => {
-  let auth: AuthService;
-  const SECRET = "test-ws-secret";
-
-  beforeEach(() => {
-    auth = new AuthService(SECRET);
-  });
-
-  afterEach(() => {
-    auth.dispose();
-  });
-
-  it("returns 'anonymous' when method is none", () => {
-    const result = validateWsToken(auth, { method: "none", token_expiry: 86400 }, null);
-    expect(result).toBe("anonymous");
-  });
-
-  it("returns null when method is ssh and no token provided", () => {
-    const result = validateWsToken(auth, { method: "ssh", token_expiry: 86400 }, null);
-    expect(result).toBeNull();
-  });
-
-  it("returns userId for valid token", () => {
-    const token = auth.generateToken("bob");
-    const result = validateWsToken(auth, { method: "ssh", token_expiry: 86400 }, token);
-    expect(result).toBe("bob");
-  });
-
-  it("returns null for invalid token", () => {
-    const result = validateWsToken(auth, { method: "ssh", token_expiry: 86400 }, "bad-token");
-    expect(result).toBeNull();
-  });
-});

package/src/lib/auth/middleware.ts

@@ -1,56 +0,0 @@
-// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
-import type { Context, Next, MiddlewareHandler } from "hono";
-import { AuthService } from "./auth-service.ts";
-import type { AuthConfig } from "./types.ts";
-
-/**
- * Hono middleware that checks Authorization Bearer header.
- *
- * - Bypasses /health and /api/auth/* routes.
- * - When method is "none" (default), passes through everything (backward compatible).
- * - Otherwise validates the JWT and sets c.set("userId", ...).
- */
-export function authMiddleware(authService: AuthService, config: AuthConfig): MiddlewareHandler {
-  return async (c: Context, next: Next) => {
-    // Backward compatible: no auth required when method is "none"
-    if (config.method === "none") {
-      return next();
-    }
-
-    const path = new URL(c.req.url).pathname;
-
-    // Bypass health and auth endpoints
-    if (path === "/health" || path.startsWith("/api/auth/")) {
-      return next();
-    }
-
-    const authHeader = c.req.header("Authorization");
-    if (!authHeader?.startsWith("Bearer ")) {
-      return c.json({ error: "Missing or invalid Authorization header" }, 401);
-    }
-
-    const token = authHeader.slice(7);
-    const result = authService.verifyToken(token);
-    if (!result.valid) {
-      return c.json({ error: "Invalid or expired token" }, 401);
-    }
-
-    c.set("userId", result.userId);
-    return next();
-  };
-}
-
-/**
- * Validate a JWT token from a query parameter (for WebSocket upgrade).
- * Returns the userId if valid, null otherwise.
- */
-export function validateWsToken(
-  authService: AuthService,
-  config: AuthConfig,
-  token: string | null,
-): string | null {
-  if (config.method === "none") return "anonymous";
-  if (!token) return null;
-  const result = authService.verifyToken(token);
-  return result.valid ? (result.userId ?? null) : null;
-}

package/src/lib/auth/types.ts

@@ -1,13 +0,0 @@
-// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
-import { z } from "zod";
-
-export const AuthConfigSchema = z.object({
-  /** Auth method: "none" disables auth (default), "ssh" enables SSH key challenge-response. */
-  method: z.enum(["none", "ssh"]).default("none"),
-  /** JWT secret — auto-generated if omitted. */
-  secret: z.string().optional(),
-  /** Token expiry in seconds (default 86400 = 24h). */
-  token_expiry: z.number().min(60).default(86400),
-});
-
-export type AuthConfig = z.infer<typeof AuthConfigSchema>;