typescript-virtual-container 1.4.4 → 1.4.6

package/src/SSHMimic/index.js

@@ -1,249 +0,0 @@
-import { EventEmitter } from "node:events";
-import { Server as SshServer } from "ssh2";
-import { VirtualShell } from "../VirtualShell";
-import { createPerfLogger } from "../utils/perfLogger";
-import { runExec } from "./exec";
-import { loadOrCreateHostKey } from "./hostKey";
-/**
- * SSH server facade that wires the virtual shell runtime into ssh2 sessions.
- *
- * This class is exported as `VirtualSshServer` for public API compatibility.
- * Create an instance, call {@link SshMimic.start}, and stop it with
- * {@link SshMimic.stop} when your process exits.
- *
- * Features:
- * - Password authentication
- * - Public-key authentication
- * - Per-IP rate limiting / lockout for brute-force protection
- * - Interactive shell sessions
- * - Non-interactive exec sessions
- */
-const perf = createPerfLogger("SshMimic");
-// ── Dev-mode logger ───────────────────────────────────────────────────────────
-const DEV = !!process.env.DEV_MODE;
-const devLog = DEV ? console.log.bind(console) : () => { };
-class SshMimic extends EventEmitter {
-    port;
-    server;
-    shell;
-    /** Max failed auth attempts before an IP is temporarily locked. */
-    maxAuthAttempts;
-    /** How long (ms) a locked IP must wait before retrying. */
-    lockoutDurationMs;
-    authAttempts = new Map();
-    /**
-     * Creates a new SSH mimic server instance.
-     *
-     * @param port TCP port to bind on localhost.
-     * @param hostname Virtual hostname used for the SSH ident and default shell label.
-     * @param shell Optional preconfigured virtual shell instance to reuse.
-     * @param maxAuthAttempts Max failed attempts per IP before lockout (default: 5).
-     * @param lockoutDurationMs Lockout window in ms after exceeding attempts (default: 60 000).
-     */
-    constructor({ port, hostname = "typescript-vm", shell = new VirtualShell(hostname), maxAuthAttempts = 5, lockoutDurationMs = 60_000, }) {
-        super();
-        perf.mark("constructor");
-        this.port = port;
-        this.server = null;
-        this.shell = shell;
-        this.maxAuthAttempts = maxAuthAttempts;
-        this.lockoutDurationMs = lockoutDurationMs;
-    }
-    // ── Rate limiting ────────────────────────────────────────────────────────
-    isLockedOut(ip) {
-        const entry = this.authAttempts.get(ip);
-        if (!entry)
-            return false;
-        if (Date.now() < entry.lockedUntil)
-            return true;
-        if (entry.lockedUntil > 0) {
-            this.authAttempts.delete(ip);
-        }
-        return false;
-    }
-    recordFailure(ip) {
-        const entry = this.authAttempts.get(ip) ?? { attempts: 0, lockedUntil: 0 };
-        entry.attempts += 1;
-        if (entry.attempts >= this.maxAuthAttempts) {
-            entry.lockedUntil = Date.now() + this.lockoutDurationMs;
-            this.emit("auth:lockout", { ip, until: new Date(entry.lockedUntil) });
-        }
-        this.authAttempts.set(ip, entry);
-    }
-    recordSuccess(ip) {
-        this.authAttempts.delete(ip);
-    }
-    // ── Home directory bootstrap ─────────────────────────────────────────────
-    ensureHomeDir(authUser) {
-        const homePath = `/home/${authUser}`;
-        if (!this.shell.vfs.exists(homePath)) {
-            this.shell.vfs.mkdir(homePath, 0o755);
-            this.shell.vfs.writeFile(`${homePath}/README.txt`, `Welcome to ${this.shell.hostname}\n`);
-            void this.shell.vfs.flushMirror();
-        }
-    }
-    // ── Server lifecycle ─────────────────────────────────────────────────────
-    /**
-     * Starts server and initializes virtual filesystem, users, and handlers.
-     *
-     * @returns Promise resolved with bound listening port.
-     */
-    async start() {
-        perf.mark("start");
-        const shell = this.shell;
-        const privateKey = loadOrCreateHostKey();
-        await shell.ensureInitialized();
-        this.server = new SshServer({
-            hostKeys: [privateKey],
-            ident: `SSH-2.0-${shell.hostname}`,
-        }, (client) => {
-            let authUser = "root";
-            let remoteAddress = "unknown";
-            let sessionId = null;
-            this.emit("client:connect");
-            client.on("authentication", (ctx) => {
-                const candidateUser = ctx.username || "root";
-                remoteAddress = ctx.ip ?? remoteAddress;
-                // Rate-limit check
-                if (this.isLockedOut(remoteAddress)) {
-                    this.emit("auth:failure", {
-                        username: candidateUser,
-                        remoteAddress,
-                        reason: "lockout",
-                    });
-                    ctx.reject();
-                    return;
-                }
-                // ── Password auth ──────────────────────────────────────
-                if (ctx.method === "password") {
-                    if (!shell.users.hasPassword(candidateUser)) {
-                        authUser = candidateUser;
-                        sessionId = shell.users.registerSession(authUser, remoteAddress).id;
-                        this.recordSuccess(remoteAddress);
-                        this.emit("auth:success", { username: authUser, remoteAddress });
-                        this.ensureHomeDir(authUser);
-                        ctx.accept();
-                        return;
-                    }
-                    if (!ctx.password ||
-                        ctx.password === "" ||
-                        !shell.users.verifyPassword(candidateUser, ctx.password)) {
-                        this.recordFailure(remoteAddress);
-                        this.emit("auth:failure", {
-                            username: candidateUser,
-                            remoteAddress,
-                        });
-                        ctx.reject();
-                        return;
-                    }
-                    authUser = candidateUser;
-                    sessionId = shell.users.registerSession(authUser, remoteAddress).id;
-                    this.recordSuccess(remoteAddress);
-                    this.emit("auth:success", { username: authUser, remoteAddress });
-                    this.ensureHomeDir(authUser);
-                    ctx.accept();
-                    return;
-                }
-                // ── Public-key auth ────────────────────────────────────
-                if (ctx.method === "publickey") {
-                    const authorizedKeys = shell.users.getAuthorizedKeys(candidateUser);
-                    if (authorizedKeys.length === 0) {
-                        // No keys configured — reject cleanly
-                        ctx.reject();
-                        return;
-                    }
-                    const incomingKey = ctx.key;
-                    const keyMatches = authorizedKeys.some((k) => k.algo === incomingKey.algo && k.data.equals(incomingKey.data));
-                    if (!keyMatches) {
-                        this.recordFailure(remoteAddress);
-                        this.emit("auth:failure", {
-                            username: candidateUser,
-                            remoteAddress,
-                            method: "publickey",
-                        });
-                        ctx.reject();
-                        return;
-                    }
-                    // Key matched — if this is a signature check step, accept
-                    if (ctx.signature) {
-                        authUser = candidateUser;
-                        sessionId = shell.users.registerSession(authUser, remoteAddress).id;
-                        this.recordSuccess(remoteAddress);
-                        this.emit("auth:success", {
-                            username: authUser,
-                            remoteAddress,
-                            method: "publickey",
-                        });
-                        this.ensureHomeDir(authUser);
-                        ctx.accept();
-                    }
-                    else {
-                        // Key exists but no signature yet — ssh2 will call again with signature
-                        ctx.accept();
-                    }
-                    return;
-                }
-                ctx.reject(["password", "publickey"]);
-            });
-            client.on("close", () => {
-                shell.users.unregisterSession(sessionId);
-                this.emit("client:disconnect", { user: authUser });
-                sessionId = null;
-            });
-            client.on("ready", () => {
-                client.on("session", (accept) => {
-                    const session = accept();
-                    const terminalSize = { cols: 80, rows: 24 };
-                    session.on("pty", (acceptPty, _rejectPty, info) => {
-                        terminalSize.cols = info?.cols ?? terminalSize.cols;
-                        terminalSize.rows = info?.rows ?? terminalSize.rows;
-                        acceptPty();
-                    });
-                    session.on("window-change", (_acceptChange, _rejectChange, info) => {
-                        terminalSize.cols = info?.cols ?? terminalSize.cols;
-                        terminalSize.rows = info?.rows ?? terminalSize.rows;
-                    });
-                    session.on("shell", (acceptShell) => {
-                        const stream = acceptShell();
-                        shell?.startInteractiveSession(stream, authUser, sessionId, remoteAddress, terminalSize);
-                    });
-                    session.on("exec", (acceptExec, _rejectExec, info) => {
-                        const stream = acceptExec();
-                        if (stream) {
-                            runExec(stream, info.command.trim(), authUser, shell.hostname, shell);
-                        }
-                    });
-                });
-            });
-        });
-        return new Promise((resolve, reject) => {
-            this.server?.once("error", (err) => reject(err));
-            this.server?.listen(this.port, "0.0.0.0", () => {
-                devLog(`SSH Mimic listening on port ${this.port}`);
-                this.emit("start", { port: this.port });
-                resolve(this.port);
-            });
-        });
-    }
-    /**
-     * Stops server if running.
-     */
-    stop() {
-        perf.mark("stop");
-        if (this.server) {
-            this.server.close(() => {
-                devLog("SSH Mimic stopped");
-                this.emit("stop");
-            });
-        }
-    }
-    /**
-     * Manually clears the rate-limit record for an IP address.
-     * Useful in tests or admin tooling.
-     */
-    clearLockout(ip) {
-        this.authAttempts.delete(ip);
-    }
-}
-export { SftpMimic } from "./sftp";
-export { SshMimic };

package/src/SSHMimic/loginBanner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"loginBanner.d.ts","sourceRoot":"","sources":["loginBanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGvD,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,gBAAgB,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,eAAe,EAC3B,SAAS,EAAE,gBAAgB,GAAG,IAAI,GAChC,MAAM,CAuBR"}

package/src/SSHMimic/loginBanner.js

@@ -1,22 +0,0 @@
-import { formatLoginDate } from "./loginFormat";
-export function buildLoginBanner(hostname, properties, lastLogin) {
-    const lines = [
-        `Linux ${hostname} ${properties.kernel} ${properties.arch}`,
-        "",
-        "The programs included with the Fortune GNU/Linux system are free software;",
-        "the exact distribution terms for each program are described in the",
-        "individual files in /usr/share/doc/*/copyright.",
-        "",
-        "Fortune GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent",
-        "permitted by applicable law.",
-    ];
-    if (lastLogin) {
-        const when = new Date(lastLogin.at);
-        const displayed = Number.isNaN(when.getTime())
-            ? lastLogin.at
-            : formatLoginDate(when);
-        lines.push(`Last login: ${displayed} from ${lastLogin.from || "unknown"}`);
-    }
-    lines.push("");
-    return `${lines.map((line) => `${line}\r\n`).join("")}`;
-}

package/src/SSHMimic/loginFormat.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"loginFormat.d.ts","sourceRoot":"","sources":["loginFormat.ts"],"names":[],"mappings":"AAAA,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CASlD"}

package/src/SSHMimic/loginFormat.js

@@ -1,10 +0,0 @@
-export function formatLoginDate(date) {
-    const weekday = date.toLocaleString("en-US", { weekday: "short" });
-    const month = date.toLocaleString("en-US", { month: "short" });
-    const day = date.getDate().toString().padStart(2, "0");
-    const hh = date.getHours().toString().padStart(2, "0");
-    const mm = date.getMinutes().toString().padStart(2, "0");
-    const ss = date.getSeconds().toString().padStart(2, "0");
-    const year = date.getFullYear();
-    return `${weekday} ${month} ${day} ${hh}:${mm}:${ss} ${year}`;
-}

package/src/SSHMimic/prompt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["prompt.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAC1B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACb,MAAM,CASR"}

package/src/SSHMimic/prompt.js

@@ -1,9 +0,0 @@
-export function buildPrompt(user, host, cwdName) {
-    const isRoot = user === "root";
-    const colorUser = isRoot ? "\u001b[31;1m" : "\u001b[35;1m";
-    const colorWhite = "\u001b[37;1m";
-    const colorBlue = "\u001b[34;1m";
-    const colorReset = "\u001b[0m";
-    const symbol = isRoot ? "#" : "$";
-    return `${colorWhite}[${colorUser}${user}${colorWhite}@${colorBlue}${host}${colorReset} ${cwdName}${colorWhite}]${colorReset}${symbol} `;
-}

package/src/SSHMimic/sftp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sftp.d.ts","sourceRoot":"","sources":["sftp.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAI3C,OAAO,KAAK,iBAAiB,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAmIhE,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC3B;AAED,qBAAa,SAAU,SAAQ,YAAY;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,OAAO,CAAiC;gBAEpC,EACX,IAAI,EACJ,QAA0B,EAC1B,KAAK,EACL,GAAG,EACH,KAAK,GACL,EAAE,gBAAgB;IAwBnB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,QAAQ;IAIH,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAwK9B,IAAI,IAAI,IAAI;IAUnB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAiB1B;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,kBAAkB;CA6a1B"}