typescript-virtual-container 1.4.4 → 1.4.5

package/src/VirtualUserManager/index.js

@@ -1,607 +0,0 @@
-import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
-import { EventEmitter } from "node:events";
-import * as path from "node:path";
-import { createPerfLogger } from "../utils/perfLogger";
-function resolveFastPasswordHash() {
-    const configured = process.env.SSH_MIMIC_FAST_PASSWORD_HASH;
-    return (!!configured &&
-        !["0", "false", "no", "off"].includes(configured.toLowerCase()));
-}
-const perf = createPerfLogger("VirtualUserManager");
-/**
- * Persistent user, sudoers, and active-session manager for the shell runtime.
- *
- * Passwords are hashed with scrypt by default and stored in the backing virtual filesystem.
- */
-export class VirtualUserManager extends EventEmitter {
-    vfs;
-    autoSudoForNewUsers;
-    static recordCache = new Map();
-    static fastPasswordHash = resolveFastPasswordHash();
-    usersPath = "/etc/htpasswd";
-    sudoersPath = "/etc/sudoers";
-    quotasPath = "/etc/quotas";
-    authDirPath = "/.virtual-env-js/.auth";
-    users = new Map();
-    sudoers = new Set();
-    quotas = new Map();
-    activeSessions = new Map();
-    nextTty = 0;
-    /**
-     * Creates a user manager instance backed by a virtual filesystem.
-     *
-     * @param vfs Backing virtual filesystem used for persistence.
-     * @param defaultRootPassword Initial root password used when root is created.
-     * @param autoSudoForNewUsers Whether newly created users are added to sudoers.
-     */
-    constructor(vfs, 
-    // private readonly defaultRootPassword: string = process.env
-    // .SSH_MIMIC_ROOT_PASSWORD || "root",
-    autoSudoForNewUsers = true) {
-        super();
-        this.vfs = vfs;
-        this.autoSudoForNewUsers = autoSudoForNewUsers;
-        perf.mark("constructor");
-    }
-    /**
-     * Loads users/sudoers from disk and ensures root account exists.
-     * Also creates the current system user if not already present.
-     */
-    async initialize() {
-        perf.mark("initialize");
-        this.loadFromVfs();
-        this.loadSudoersFromVfs();
-        this.loadQuotasFromVfs();
-        let changed = false;
-        if (!this.users.has("root")) {
-            this.users.set("root", this.createRecord("root", ""));
-            changed = true;
-        }
-        this.sudoers.add("root");
-        // Auto-create current system user for easier authentication
-        // const currentUser = process.env.USER || process.env.USERNAME;
-        // if (currentUser && currentUser !== "root" && !this.users.has(currentUser)) {
-        // 	const userPassword = this.defaultRootPassword;
-        // 	this.users.set(currentUser, this.createRecord(currentUser, userPassword));
-        // 	this.sudoers.add(currentUser);
-        // 	changed = true;
-        // }
-        // const homePath = `/home/root`;
-        // if (!this.vfs.exists(homePath)) {
-        // 	this.vfs.mkdir(homePath, 0o755);
-        // 	this.vfs.writeFile(
-        // 		`${homePath}/README.txt`,
-        // 		`Welcome to the virtual environment, root`,
-        // 	);
-        // }
-        if (changed) {
-            await this.persist();
-        }
-        this.emit("initialized");
-    }
-    /**
-     * Sets max allowed bytes under /home/<username>.
-     *
-     * @param username Target username.
-     * @param maxBytes Quota ceiling in bytes.
-     */
-    async setQuotaBytes(username, maxBytes) {
-        perf.mark("setQuotaBytes");
-        this.validateUsername(username);
-        if (!this.users.has(username)) {
-            throw new Error(`quota: user '${username}' does not exist`);
-        }
-        if (!Number.isFinite(maxBytes) || maxBytes < 0) {
-            throw new Error("quota: maxBytes must be a non-negative number");
-        }
-        this.quotas.set(username, Math.floor(maxBytes));
-        await this.persist();
-    }
-    /**
-     * Removes quota for a user.
-     *
-     * @param username Target username.
-     */
-    async clearQuota(username) {
-        perf.mark("clearQuota");
-        this.validateUsername(username);
-        this.quotas.delete(username);
-        await this.persist();
-    }
-    /**
-     * Gets configured quota in bytes for a user.
-     *
-     * @param username Target username.
-     * @returns Quota in bytes, or null when unlimited.
-     */
-    getQuotaBytes(username) {
-        perf.mark("getQuotaBytes");
-        return this.quotas.get(username) ?? null;
-    }
-    /**
-     * Computes current usage under /home/<username>.
-     *
-     * @param username Target username.
-     * @returns Current usage in bytes.
-     */
-    getUsageBytes(username) {
-        perf.mark("getUsageBytes");
-        const homePath = `/home/${username}`;
-        if (!this.vfs.exists(homePath)) {
-            return 0;
-        }
-        return this.vfs.getUsageBytes(homePath);
-    }
-    /**
-     * Validates that writing file content would not exceed user quota.
-     *
-     * Quotas are enforced only for writes inside /home/<username>.
-     *
-     * @param username Authenticated user.
-     * @param targetPath Target file path.
-     * @param nextContent New file content.
-     */
-    assertWriteWithinQuota(username, targetPath, nextContent) {
-        perf.mark("assertWriteWithinQuota");
-        const quota = this.quotas.get(username);
-        if (quota === undefined) {
-            return;
-        }
-        const normalizedPath = normalizeVfsPath(targetPath);
-        const homePath = normalizeVfsPath(`/home/${username}`);
-        const inUserHome = normalizedPath === homePath || normalizedPath.startsWith(`${homePath}/`);
-        if (!inUserHome) {
-            return;
-        }
-        const currentUsage = this.getUsageBytes(username);
-        let existingSize = 0;
-        if (this.vfs.exists(normalizedPath)) {
-            const existing = this.vfs.stat(normalizedPath);
-            if (existing.type === "file") {
-                existingSize = existing.size;
-            }
-        }
-        const incomingSize = Buffer.isBuffer(nextContent)
-            ? nextContent.length
-            : Buffer.byteLength(nextContent, "utf8");
-        const projectedUsage = currentUsage - existingSize + incomingSize;
-        if (projectedUsage > quota) {
-            throw new Error(`quota exceeded for '${username}': ${projectedUsage}/${quota} bytes`);
-        }
-    }
-    /**
-     * Verifies plaintext password against stored record.
-     *
-     * @param username User login name.
-     * @param password Plaintext password candidate.
-     * @returns True when credentials are valid.
-     */
-    verifyPassword(username, password) {
-        perf.mark("verifyPassword");
-        const record = this.users.get(username);
-        if (!record) {
-            // Perform a dummy hash to avoid timing leakage on unknown usernames
-            this.hashPassword(password, "");
-            return false;
-        }
-        const computed = this.hashPassword(password, record.salt);
-        const expected = record.passwordHash;
-        // timingSafeEqual prevents timing-based password oracle attacks
-        try {
-            const a = Buffer.from(computed, "hex");
-            const b = Buffer.from(expected, "hex");
-            if (a.length !== b.length)
-                return false;
-            return timingSafeEqual(a, b);
-        }
-        catch {
-            return computed === expected;
-        }
-    }
-    /**
-     * Creates user, home directory, and sudo access entry.
-     *
-     * @param username New username.
-     * @param password Initial plaintext password.
-     */
-    async addUser(username, password) {
-        perf.mark("addUser");
-        this.validateUsername(username);
-        this.validatePassword(password);
-        if (this.users.has(username)) {
-            return;
-            // throw new Error(`adduser: user '${username}' already exists`);
-        }
-        this.users.set(username, this.createRecord(username, password));
-        if (this.autoSudoForNewUsers) {
-            this.sudoers.add(username);
-        }
-        const homePath = `/home/${username}`;
-        if (!this.vfs.exists(homePath)) {
-            this.vfs.mkdir(homePath, 0o755);
-            this.vfs.writeFile(`${homePath}/README.txt`, `Welcome to the virtual environment, ${username}`);
-        }
-        await this.persist();
-        this.emit("user:add", { username });
-    }
-    /**
-     * Retrieves stored password hash for a user, or null if user does not exist.
-     *
-     * @param username Target username.
-     * @returns Password hash in hex encoding, or null when user is not found.
-     */
-    getPasswordHash(username) {
-        perf.mark("getPasswordHash");
-        const record = this.users.get(username);
-        return record ? record.passwordHash : null;
-    }
-    /**
-     * Updates the password for an existing user account.
-     *
-     * @param username Username to update.
-     * @param password New plaintext password (must be non-empty).
-     * @throws When the user does not exist or the password is empty.
-     */
-    async setPassword(username, password) {
-        perf.mark("setPassword");
-        this.validateUsername(username);
-        this.validatePassword(password);
-        if (!this.users.has(username)) {
-            throw new Error(`passwd: user '${username}' does not exist`);
-        }
-        this.users.set(username, this.createRecord(username, password));
-        await this.persist();
-    }
-    /**
-     * Deletes an existing non-root user account and revokes sudo access.
-     *
-     * @param username Username to remove.
-     * @throws When `username` is `"root"` or the user does not exist.
-     */
-    async deleteUser(username) {
-        perf.mark("deleteUser");
-        this.validateUsername(username);
-        if (username === "root") {
-            throw new Error("deluser: cannot delete root");
-        }
-        if (!this.users.delete(username)) {
-            throw new Error(`deluser: user '${username}' does not exist`);
-        }
-        this.sudoers.delete(username);
-        this.emit("user:delete", { username });
-        await this.persist();
-    }
-    /**
-     * Checks whether user is member of sudoers set.
-     *
-     * @param username Username to test.
-     * @returns True when user can run sudo.
-     */
-    isSudoer(username) {
-        perf.mark("isSudoer");
-        return this.sudoers.has(username);
-    }
-    /**
-     * Grants sudo privileges to an existing user.
-     *
-     * @param username Username to promote.
-     * @throws When the user does not exist.
-     */
-    async addSudoer(username) {
-        perf.mark("addSudoer");
-        this.validateUsername(username);
-        if (!this.users.has(username)) {
-            throw new Error(`sudoers: user '${username}' does not exist`);
-        }
-        this.sudoers.add(username);
-        await this.persist();
-    }
-    /**
-     * Revokes sudo privileges from a user. Root cannot be demoted.
-     *
-     * @param username Username to demote.
-     * @throws When `username` is `"root"`.
-     */
-    async removeSudoer(username) {
-        perf.mark("removeSudoer");
-        this.validateUsername(username);
-        if (username === "root") {
-            throw new Error("sudoers: cannot remove root");
-        }
-        this.sudoers.delete(username);
-        await this.persist();
-    }
-    /**
-     * Registers a new active session and allocates a virtual TTY identifier.
-     *
-     * Called by the SSH server when a client is authenticated. The returned
-     * descriptor is visible in `who` output and `listActiveSessions()`.
-     *
-     * @param username      Authenticated username bound to the session.
-     * @param remoteAddress IP address or hostname of the connecting client.
-     * @returns The newly created `VirtualActiveSession` descriptor.
-     */
-    registerSession(username, remoteAddress) {
-        perf.mark("registerSession");
-        const session = {
-            id: randomUUID(),
-            username,
-            tty: `pts/${this.nextTty++}`,
-            remoteAddress,
-            startedAt: new Date().toISOString(),
-        };
-        this.activeSessions.set(session.id, session);
-        this.emit("session:register", {
-            sessionId: session.id,
-            username,
-            remoteAddress,
-        });
-        return session;
-    }
-    /**
-     * Removes an active session record when the connection closes.
-     *
-     * Safe to call with a `null` or `undefined` session ID — it will be a no-op.
-     *
-     * @param sessionId Session UUID returned by `registerSession()`, or nullish.
-     */
-    unregisterSession(sessionId) {
-        perf.mark("unregisterSession");
-        if (!sessionId) {
-            return;
-        }
-        const session = this.activeSessions.get(sessionId);
-        this.activeSessions.delete(sessionId);
-        if (session) {
-            this.emit("session:unregister", {
-                sessionId,
-                username: session.username,
-            });
-        }
-        this.activeSessions.delete(sessionId);
-    }
-    /**
-     * Updates the username and remote address metadata for an active session.
-     *
-     * Called internally by `su` and `sudo` when the effective user changes
-     * within a session. Silently ignored when the session ID is nullish or
-     * unknown.
-     *
-     * @param sessionId     Session UUID to update, or nullish for no-op.
-     * @param username      New effective username.
-     * @param remoteAddress New remote address (usually unchanged).
-     */
-    updateSession(sessionId, username, remoteAddress) {
-        perf.mark("updateSession");
-        if (!sessionId) {
-            return;
-        }
-        const session = this.activeSessions.get(sessionId);
-        if (!session) {
-            return;
-        }
-        this.activeSessions.set(sessionId, {
-            ...session,
-            username,
-            remoteAddress,
-        });
-    }
-    /**
-     * Returns a snapshot of all currently active sessions, sorted by start time.
-     *
-     * Used by `who`, `ps`, `uptime`, and the `HoneyPot` auditor.
-     *
-     * @returns Array of `VirtualActiveSession` descriptors.
-     */
-    listActiveSessions() {
-        perf.mark("listActiveSessions");
-        return Array.from(this.activeSessions.values()).sort((left, right) => left.startedAt.localeCompare(right.startedAt));
-    }
-    /**
-     * Returns a sorted list of all registered usernames.
-     *
-     * @returns Array of username strings sorted alphabetically.
-     */
-    listUsers() {
-        return Array.from(this.users.keys()).sort();
-    }
-    loadFromVfs() {
-        this.users.clear();
-        if (!this.vfs.exists(this.usersPath)) {
-            return;
-        }
-        const raw = this.vfs.readFile(this.usersPath);
-        for (const line of raw.split("\n")) {
-            const trimmed = line.trim();
-            if (trimmed.length === 0) {
-                continue;
-            }
-            const parts = trimmed.split(":");
-            if (parts.length < 3) {
-                continue;
-            }
-            const [username, salt, passwordHash] = parts;
-            if (!username || !salt || !passwordHash) {
-                continue;
-            }
-            this.users.set(username, { username, salt, passwordHash });
-        }
-    }
-    loadSudoersFromVfs() {
-        this.sudoers.clear();
-        if (!this.vfs.exists(this.sudoersPath)) {
-            return;
-        }
-        const raw = this.vfs.readFile(this.sudoersPath);
-        for (const line of raw.split("\n")) {
-            const username = line.trim();
-            if (username.length > 0) {
-                this.sudoers.add(username);
-            }
-        }
-    }
-    loadQuotasFromVfs() {
-        this.quotas.clear();
-        if (!this.vfs.exists(this.quotasPath)) {
-            return;
-        }
-        const raw = this.vfs.readFile(this.quotasPath);
-        for (const line of raw.split("\n")) {
-            const trimmed = line.trim();
-            if (trimmed.length === 0) {
-                continue;
-            }
-            const [username, value] = trimmed.split(":");
-            const bytes = Number.parseInt(value ?? "", 10);
-            if (!username || !Number.isFinite(bytes) || bytes < 0) {
-                continue;
-            }
-            this.quotas.set(username, bytes);
-        }
-    }
-    async persist() {
-        if (!this.vfs.exists(this.authDirPath)) {
-            this.vfs.mkdir(this.authDirPath, 0o700);
-        }
-        const authContent = Array.from(this.users.values())
-            .sort((left, right) => left.username.localeCompare(right.username))
-            .map((record) => [record.username, record.salt, record.passwordHash].join(":"))
-            .join("\n");
-        const sudoersContent = Array.from(this.sudoers.values()).sort().join("\n");
-        const quotasContent = Array.from(this.quotas.entries())
-            .sort(([left], [right]) => left.localeCompare(right))
-            .map(([username, maxBytes]) => `${username}:${maxBytes}`)
-            .join("\n");
-        let changed = false;
-        changed =
-            this.writeIfChanged(this.usersPath, authContent.length > 0 ? `${authContent}\n` : "", 0o600) || changed;
-        changed =
-            this.writeIfChanged(this.sudoersPath, sudoersContent.length > 0 ? `${sudoersContent}\n` : "", 0o600) || changed;
-        changed =
-            this.writeIfChanged(this.quotasPath, quotasContent.length > 0 ? `${quotasContent}\n` : "", 0o600) || changed;
-        if (changed) {
-            await this.vfs.flushMirror();
-        }
-    }
-    writeIfChanged(targetPath, content, mode) {
-        if (this.vfs.exists(targetPath)) {
-            const existing = this.vfs.readFile(targetPath);
-            if (existing === content) {
-                this.vfs.chmod(targetPath, mode);
-                return false;
-            }
-        }
-        this.vfs.writeFile(targetPath, content, { mode });
-        return true;
-    }
-    createRecord(username, password) {
-        // Cache key is a hash of the inputs — never store plaintext password in memory
-        const cacheKey = createHash("sha256").update(username).update(":").update(password).digest("hex");
-        const cached = VirtualUserManager.recordCache.get(cacheKey);
-        if (cached) {
-            return cached;
-        }
-        const salt = randomBytes(16).toString("hex");
-        const record = {
-            username,
-            salt,
-            // Hash uses the generated salt — verifyPassword must use record.salt
-            passwordHash: this.hashPassword(password, salt),
-        };
-        VirtualUserManager.recordCache.set(cacheKey, record);
-        return record;
-    }
-    /**
-     * Returns `true` when the user has a non-empty password set.
-     *
-     * A user with no password (or whose password hash matches the empty-string
-     * hash) is allowed to authenticate without a credential check.
-     *
-     * @param username Target username.
-     */
-    hasPassword(username) {
-        perf.mark("hasPassword");
-        const record = this.users.get(username);
-        if (!record)
-            return false;
-        // Empty password hash computed with the record's own salt
-        const emptyHash = this.hashPassword("", record.salt);
-        if (record.passwordHash === emptyHash)
-            return false;
-        return !!record.passwordHash;
-    }
-    /**
-     * Hashes a plaintext password using scrypt (or SHA-256 in fast-hash mode).
-     *
-     * Set `SSH_MIMIC_FAST_PASSWORD_HASH=1` to switch to SHA-256 for test
-     * environments where scrypt latency is undesirable.
-     *
-     * @param password Plaintext password string.
-     * @returns Hex-encoded hash string.
-     */
-    /**
-     * Hash a password with an optional salt.
-     * When salt is provided (verify path), the same salt is used for a
-     * deterministic hash. When omitted (create path), an empty salt is used
-     * for backward compat — callers should pass the stored salt on verify.
-     */
-    hashPassword(password, salt = "") {
-        if (VirtualUserManager.fastPasswordHash) {
-            return createHash("sha256")
-                .update(salt)
-                .update(password)
-                .digest("hex");
-        }
-        return scryptSync(password, salt || "", 32).toString("hex");
-    }
-    validateUsername(username) {
-        if (!username || username.trim() === "") {
-            throw new Error("invalid username");
-        }
-        if (!/^[a-z_][a-z0-9_-]{0,31}$/i.test(username)) {
-            throw new Error("invalid username");
-        }
-    }
-    validatePassword(password) {
-        if (!password || password.trim() === "") {
-            throw new Error("invalid password");
-        }
-    }
-    authorizedKeys = new Map();
-    /**
-     * Adds an SSH public key for a user, enabling public-key authentication.
-     *
-     * @param username Target user.
-     * @param algo Key algorithm (e.g. "ssh-rsa", "ssh-ed25519").
-     * @param data Raw key data as a Buffer (the base64-decoded key bytes).
-     */
-    addAuthorizedKey(username, algo, data) {
-        perf.mark("addAuthorizedKey");
-        const keys = this.authorizedKeys.get(username) ?? [];
-        keys.push({ algo, data });
-        this.authorizedKeys.set(username, keys);
-        this.emit("key:add", { username, algo });
-    }
-    /**
-     * Removes all authorized keys for a user.
-     *
-     * @param username Target user.
-     */
-    removeAuthorizedKeys(username) {
-        this.authorizedKeys.delete(username);
-        this.emit("key:remove", { username });
-    }
-    /**
-     * Returns the list of authorized keys for a user.
-     * Returns an empty array when no keys are registered.
-     *
-     * @param username Target user.
-     */
-    getAuthorizedKeys(username) {
-        return this.authorizedKeys.get(username) ?? [];
-    }
-}
-function normalizeVfsPath(targetPath) {
-    const normalized = path.posix.normalize(targetPath);
-    return normalized.startsWith("/") ? normalized : `/${normalized}`;
-}

package/src/commands/adduser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adduser.d.ts","sourceRoot":"","sources":["adduser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGpE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,EAAE,WAuF5B,CAAC"}

package/src/commands/adduser.js

@@ -1,89 +0,0 @@
-/**
- * Add a new user interactively.
- *
- * Usage: `adduser <username>`
- *
- * Prompts for:
- *   New password: ****
- *   Retype new password: ****
- *
- * Mirrors the real `adduser` behaviour — password is never passed on the
- * command line. Root-only.
- */
-export const adduserCommand = {
-    name: "adduser",
-    description: "Add a new user",
-    category: "users",
-    params: ["<username>"],
-    run: ({ authUser, shell, args }) => {
-        if (authUser !== "root") {
-            return { stderr: "adduser: permission denied\n", exitCode: 1 };
-        }
-        const username = args[0];
-        if (!username) {
-            return {
-                stderr: "Usage: adduser <username>\n",
-                exitCode: 1,
-            };
-        }
-        // Reject if user already exists
-        if (shell.users.listUsers().includes(username)) {
-            return {
-                stderr: `adduser: user '${username}' already exists\n`,
-                exitCode: 1,
-            };
-        }
-        let newPassword = "";
-        let step = "new";
-        const onPassword = async (input, sh) => {
-            if (step === "new") {
-                if (input.length < 1) {
-                    return {
-                        result: {
-                            stderr: "adduser: password cannot be empty\n",
-                            exitCode: 1,
-                        },
-                    };
-                }
-                newPassword = input;
-                step = "retype";
-                return { result: null, nextPrompt: "Retype new password: " };
-            }
-            // step === "retype"
-            if (input !== newPassword) {
-                return {
-                    result: {
-                        stderr: "adduser: passwords do not match — user not created\n",
-                        exitCode: 1,
-                    },
-                };
-            }
-            await sh.users.addUser(username, newPassword);
-            return {
-                result: {
-                    stdout: `${[
-                        `Adding user '${username}' ...`,
-                        `Adding new group '${username}' (1001) ...`,
-                        `Adding new user '${username}' (1001) with group '${username}' ...`,
-                        `Creating home directory '/home/${username}' ...`,
-                        `passwd: password set for '${username}'`,
-                        `adduser: done.`,
-                    ].join("\n")}\n`,
-                    exitCode: 0,
-                },
-            };
-        };
-        return {
-            sudoChallenge: {
-                username,
-                targetUser: username,
-                commandLine: null,
-                loginShell: false,
-                prompt: "New password: ",
-                mode: "passwd",
-                onPassword,
-            },
-            exitCode: 0,
-        };
-    },
-};

package/src/commands/alias.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"alias.d.ts","sourceRoot":"","sources":["alias.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,WAkC1B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,WAoB5B,CAAC"}