typescript-virtual-container 1.1.7 → 1.2.1

package/src/VirtualUserManager/index.ts

@@ -1,6 +1,8 @@
-import { randomBytes, randomUUID, scryptSync } from "node:crypto";
+import { createHash, randomBytes, randomUUID, scryptSync } from "node:crypto";
 import { EventEmitter } from "node:events";
 import * as path from "node:path";
+import type { PerfLogger } from "../utils/perfLogger";
+import { createPerfLogger } from "../utils/perfLogger";
 import type VirtualFileSystem from "../VirtualFileSystem";
 
 /** Persisted virtual user credential record. */
@@ -27,12 +29,24 @@ export interface VirtualActiveSession {
 	startedAt: string;
 }
 
+function resolveFastPasswordHash(): boolean {
+	const configured = process.env.SSH_MIMIC_FAST_PASSWORD_HASH;
+	return (
+		!!configured &&
+		!["0", "false", "no", "off"].includes(configured.toLowerCase())
+	);
+}
+
+const perf: PerfLogger = createPerfLogger("VirtualUserManager");
+
 /**
  * Persistent user, sudoers, and active-session manager for the shell runtime.
  *
- * Passwords are hashed with scrypt and stored in the backing virtual filesystem.
+ * Passwords are hashed with scrypt by default and stored in the backing virtual filesystem.
  */
 export class VirtualUserManager extends EventEmitter {
+	private static readonly recordCache = new Map<string, VirtualUserRecord>();
+	private static readonly fastPasswordHash = resolveFastPasswordHash();
 	private readonly usersPath = "/virtual-env-js/.auth/htpasswd";
 	private readonly sudoersPath = "/virtual-env-js/.auth/sudoers";
 	private readonly quotasPath = "/virtual-env-js/.auth/quotas";
@@ -56,6 +70,7 @@ export class VirtualUserManager extends EventEmitter {
 		private readonly autoSudoForNewUsers: boolean = true,
 	) {
 		super();
+		perf.mark("constructor");
 	}
 
 	/**
@@ -63,23 +78,30 @@ export class VirtualUserManager extends EventEmitter {
 	 * Also creates the current system user if not already present.
 	 */
 	public async initialize(): Promise<void> {
+		perf.mark("initialize");
 		this.loadFromVfs();
 		this.loadSudoersFromVfs();
 		this.loadQuotasFromVfs();
 
-		this.users.set("root", this.createRecord("root", this.defaultRootPassword));
+		let changed = false;
+		if (!this.users.has("root")) {
+			this.users.set(
+				"root",
+				this.createRecord("root", this.defaultRootPassword),
+			);
+			changed = true;
+		}
 
 		this.sudoers.add("root");
 
 		// Auto-create current system user for easier authentication
 		const currentUser = process.env.USER || process.env.USERNAME;
 		if (currentUser && currentUser !== "root" && !this.users.has(currentUser)) {
-			// Use same password as root for convenience, or a generic default
 			const userPassword = this.defaultRootPassword;
 			this.users.set(currentUser, this.createRecord(currentUser, userPassword));
 			this.sudoers.add(currentUser);
+			changed = true;
 
-			// Create home directory for the system user
 			const homePath = `/home/${currentUser}`;
 			if (!this.vfs.exists(homePath)) {
 				this.vfs.mkdir(homePath, 0o755);
@@ -90,7 +112,9 @@ export class VirtualUserManager extends EventEmitter {
 			}
 		}
 
-		await this.persist();
+		if (changed) {
+			await this.persist();
+		}
 		this.emit("initialized");
 	}
 
@@ -104,6 +128,7 @@ export class VirtualUserManager extends EventEmitter {
 		username: string,
 		maxBytes: number,
 	): Promise<void> {
+		perf.mark("setQuotaBytes");
 		this.validateUsername(username);
 		if (!this.users.has(username)) {
 			throw new Error(`quota: user '${username}' does not exist`);
@@ -123,6 +148,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @param username Target username.
 	 */
 	public async clearQuota(username: string): Promise<void> {
+		perf.mark("clearQuota");
 		this.validateUsername(username);
 		this.quotas.delete(username);
 		await this.persist();
@@ -135,6 +161,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @returns Quota in bytes, or null when unlimited.
 	 */
 	public getQuotaBytes(username: string): number | null {
+		perf.mark("getQuotaBytes");
 		return this.quotas.get(username) ?? null;
 	}
 
@@ -145,6 +172,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @returns Current usage in bytes.
 	 */
 	public getUsageBytes(username: string): number {
+		perf.mark("getUsageBytes");
 		const homePath = `/home/${username}`;
 		if (!this.vfs.exists(homePath)) {
 			return 0;
@@ -167,6 +195,7 @@ export class VirtualUserManager extends EventEmitter {
 		targetPath: string,
 		nextContent: string | Buffer,
 	): void {
+		perf.mark("assertWriteWithinQuota");
 		const quota = this.quotas.get(username);
 		if (quota === undefined) {
 			return;
@@ -209,6 +238,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @returns True when credentials are valid.
 	 */
 	public verifyPassword(username: string, password: string): boolean {
+		perf.mark("verifyPassword");
 		const record = this.users.get(username);
 		if (!record) {
 			return false;
@@ -224,6 +254,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @param password Initial plaintext password.
 	 */
 	public async addUser(username: string, password: string): Promise<void> {
+		perf.mark("addUser");
 		this.validateUsername(username);
 		this.validatePassword(password);
 
@@ -255,6 +286,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @param password New plaintext password.
 	 */
 	public async setPassword(username: string, password: string): Promise<void> {
+		perf.mark("setPassword");
 		this.validateUsername(username);
 		this.validatePassword(password);
 
@@ -272,6 +304,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @param username Username to remove.
 	 */
 	public async deleteUser(username: string): Promise<void> {
+		perf.mark("deleteUser");
 		this.validateUsername(username);
 
 		if (username === "root") {
@@ -295,6 +328,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @returns True when user can run sudo.
 	 */
 	public isSudoer(username: string): boolean {
+		perf.mark("isSudoer");
 		return this.sudoers.has(username);
 	}
 
@@ -304,6 +338,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @param username Username to promote.
 	 */
 	public async addSudoer(username: string): Promise<void> {
+		perf.mark("addSudoer");
 		this.validateUsername(username);
 		if (!this.users.has(username)) {
 			throw new Error(`sudoers: user '${username}' does not exist`);
@@ -319,6 +354,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @param username Username to demote.
 	 */
 	public async removeSudoer(username: string): Promise<void> {
+		perf.mark("removeSudoer");
 		this.validateUsername(username);
 		if (username === "root") {
 			throw new Error("sudoers: cannot remove root");
@@ -339,6 +375,7 @@ export class VirtualUserManager extends EventEmitter {
 		username: string,
 		remoteAddress: string,
 	): VirtualActiveSession {
+		perf.mark("registerSession");
 		const session: VirtualActiveSession = {
 			id: randomUUID(),
 			username,
@@ -361,6 +398,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @param sessionId Session identifier; ignored when nullish.
 	 */
 	public unregisterSession(sessionId: string | null | undefined): void {
+		perf.mark("unregisterSession");
 		if (!sessionId) {
 			return;
 		}
@@ -388,6 +426,7 @@ export class VirtualUserManager extends EventEmitter {
 		username: string,
 		remoteAddress: string,
 	): void {
+		perf.mark("updateSession");
 		if (!sessionId) {
 			return;
 		}
@@ -410,6 +449,7 @@ export class VirtualUserManager extends EventEmitter {
 	 * @returns Snapshot of active session descriptors.
 	 */
 	public listActiveSessions(): VirtualActiveSession[] {
+		perf.mark("listActiveSessions");
 		return Array.from(this.activeSessions.values()).sort((left, right) =>
 			left.startedAt.localeCompare(right.startedAt),
 		);
@@ -488,47 +528,84 @@ export class VirtualUserManager extends EventEmitter {
 			this.vfs.mkdir(this.authDirPath, 0o700);
 		}
 
-		const content = Array.from(this.users.values())
+		const authContent = Array.from(this.users.values())
 			.sort((left, right) => left.username.localeCompare(right.username))
 			.map((record) =>
 				[record.username, record.salt, record.passwordHash].join(":"),
 			)
 			.join("\n");
-
-		this.vfs.writeFile(
-			this.usersPath,
-			content.length > 0 ? `${content}\n` : "",
-			{ mode: 0o600 },
-		);
 		const sudoersContent = Array.from(this.sudoers.values()).sort().join("\n");
-		this.vfs.writeFile(
-			this.sudoersPath,
-			sudoersContent.length > 0 ? `${sudoersContent}\n` : "",
-			{ mode: 0o600 },
-		);
 		const quotasContent = Array.from(this.quotas.entries())
 			.sort(([left], [right]) => left.localeCompare(right))
 			.map(([username, maxBytes]) => `${username}:${maxBytes}`)
 			.join("\n");
-		this.vfs.writeFile(
-			this.quotasPath,
-			quotasContent.length > 0 ? `${quotasContent}\n` : "",
-			{ mode: 0o600 },
-		);
-		await this.vfs.flushMirror();
+
+		let changed = false;
+		changed =
+			this.writeIfChanged(
+				this.usersPath,
+				authContent.length > 0 ? `${authContent}\n` : "",
+				0o600,
+			) || changed;
+		changed =
+			this.writeIfChanged(
+				this.sudoersPath,
+				sudoersContent.length > 0 ? `${sudoersContent}\n` : "",
+				0o600,
+			) || changed;
+		changed =
+			this.writeIfChanged(
+				this.quotasPath,
+				quotasContent.length > 0 ? `${quotasContent}\n` : "",
+				0o600,
+			) || changed;
+
+		if (changed) {
+			await this.vfs.flushMirror();
+		}
+	}
+
+	private writeIfChanged(
+		targetPath: string,
+		content: string,
+		mode: number,
+	): boolean {
+		if (this.vfs.exists(targetPath)) {
+			const existing = this.vfs.readFile(targetPath);
+			if (existing === content) {
+				this.vfs.chmod(targetPath, mode);
+				return false;
+			}
+		}
+
+		this.vfs.writeFile(targetPath, content, { mode });
+		return true;
 	}
 
 	private createRecord(username: string, password: string): VirtualUserRecord {
+		const cacheKey = `${username}:${password}`;
+		const cached = VirtualUserManager.recordCache.get(cacheKey);
+		if (cached) {
+			return cached;
+		}
+
 		const salt = randomBytes(16).toString("hex");
-		return {
+		const record = {
 			username,
 			salt,
 			passwordHash: this.hashPassword(password, salt),
 		};
+
+		VirtualUserManager.recordCache.set(cacheKey, record);
+		return record;
 	}
 
 	private hashPassword(password: string, salt: string): string {
-		return scryptSync(password, salt, 64).toString("hex");
+		if (VirtualUserManager.fastPasswordHash) {
+			return createHash("sha256").update(`${salt}:${password}`).digest("hex");
+		}
+
+		return scryptSync(password, salt, 32).toString("hex");
 	}
 
 	private validateUsername(username: string): void {

package/src/index.ts

@@ -1,14 +1,14 @@
-import { HoneyPot } from "./Honeypot";
-import { SshClient } from "./SSHClient";
+import { HoneyPot } from "./Honeypot/index";
+import { SshClient } from "./SSHClient/index";
 import { SftpMimic, SshMimic } from "./SSHMimic/index";
-import VirtualFileSystem from "./VirtualFileSystem";
-import { VirtualShell } from "./VirtualShell";
-import { VirtualUserManager } from "./VirtualUserManager";
+import VirtualFileSystem from "./VirtualFileSystem/index";
+import { VirtualShell } from "./VirtualShell/index";
+import { VirtualUserManager } from "./VirtualUserManager/index";
 
 export type {
 	AuditLogEntry,
 	HoneyPotStats,
-} from "./Honeypot";
+} from "./Honeypot/index";
 export type {
 	CommandContext,
 	CommandMode,

package/src/utils/perfLogger.ts

@@ -0,0 +1,72 @@
+export type PerfLogger = {
+	enabled: boolean;
+	mark: (label: string) => void;
+	done: (label?: string) => void;
+};
+
+function isTruthyEnv(value: string | undefined): boolean {
+	return value === "1" || value === "true";
+}
+
+function nowMs(): number {
+	if (
+		typeof performance !== "undefined" &&
+		typeof performance.now === "function"
+	) {
+		return performance.now();
+	}
+
+	return Date.now();
+}
+
+export function isPerfLoggingEnabled(): boolean {
+	return (
+		isTruthyEnv(process.env.DEV_MODE) || isTruthyEnv(process.env.RENDER_PERF)
+	);
+}
+
+export function createPerfLogger(scope: string): PerfLogger {
+	const enabled = isPerfLoggingEnabled();
+	if (!enabled) {
+		return {
+			enabled,
+			mark: () => undefined,
+			done: () => undefined,
+		};
+	}
+
+	const startedAt = nowMs();
+
+	const mark = (label: string): void => {
+		const elapsedMs = nowMs() - startedAt;
+		console.log(`[perf][${scope}] ${label}: ${elapsedMs.toFixed(1)}ms`);
+	};
+
+	const done = (label = "done"): void => {
+		mark(label);
+	};
+
+	return {
+		enabled,
+		mark,
+		done,
+	};
+}
+
+export async function withPerf<T>(
+	scope: string,
+	label: string,
+	work: () => Promise<T>,
+): Promise<T> {
+	const perf = createPerfLogger(scope);
+	if (!perf.enabled) {
+		return work();
+	}
+
+	perf.mark(`${label}:start`);
+	try {
+		return await work();
+	} finally {
+		perf.done(`${label}:done`);
+	}
+}