xrootd 1.0.0-beta.1 → 1.0.0-beta.3

package/dist/index.d.mts

@@ -393,6 +393,47 @@ declare class File {
   truncate(size: number): Promise<void>;
 }
 //#endregion
+//#region src/config/sec-env.d.ts
+interface SecEnvOptions {
+  /** Environment variable source. Defaults to process.env. */
+  env?: Record<string, string | undefined>;
+  /** Protocol whitelist (equivalent to XrdSecPROTOCOL). */
+  protocolFilter?: string[];
+  /** Whether to read GSI variables (X509_*, XrdSecGSI*). Defaults to true. */
+  gsi?: boolean;
+  /** Whether to read SSS variables (XrdSecSSSKT). Defaults to true. */
+  sss?: boolean;
+  /** Whether to read KRB5 variables (XrdSecKRB5INITTKN). Defaults to true. */
+  krb5?: boolean;
+  /** Whether to read PWD variables (XrdSecPWDSRVPUK etc). Defaults to true. */
+  pwd?: boolean;
+}
+/**
+ * xrootd security environment variable configuration.
+ *
+ * Maps C++ xrootd's XrdSec* / X509_* environment variables to a structured
+ * config object. Does NOT read process.env directly — the caller provides
+ * the env source via constructor options.
+ */
+declare class SecEnv {
+  readonly protocolFilter: string[];
+  readonly proxyMode: boolean;
+  readonly proxyCreds: boolean;
+  readonly sssKeytab: string | undefined;
+  readonly krb5InitToken: boolean;
+  readonly gsiCaDir: string;
+  readonly gsiCrlDir: string;
+  readonly gsiUserCert: string;
+  readonly gsiUserKey: string;
+  readonly gsiUserProxy: string;
+  readonly pwdServerPubkey: string | undefined;
+  readonly username: string | undefined;
+  readonly password: string | undefined;
+  constructor(options?: SecEnvOptions);
+  static fromEnv(env?: Record<string, string | undefined>, options?: Omit<SecEnvOptions, "env">): SecEnv;
+  private parseProtocolFilter;
+}
+//#endregion
 //#region src/client.d.ts
 interface XRootDClientOptions {
   credentials?: {
@@ -401,6 +442,8 @@ interface XRootDClientOptions {
   };
   timeout?: number;
   maxRedirects?: number;
+  /** Security environment configuration. Enables credential auto-discovery and protocol filtering. */
+  secEnv?: SecEnv;
 }
 declare class XRootDClient {
   private readonly url;
@@ -431,6 +474,31 @@ declare class XRootDClient {
   private ensureFileSystem;
 }
 //#endregion
+//#region src/config/loader.d.ts
+interface ResolvedAuthConfig {
+  username?: string;
+  password?: string;
+  sssKey?: Buffer;
+}
+/**
+ * Resolve authentication credentials from multiple sources.
+ *
+ * Priority (high → low):
+ *   1. options.credentials (explicit)
+ *   2. URL userinfo (root://user:pass@host)
+ *   3. SecEnv XrdSecUSER / XrdSecCREDS
+ *
+ * Also reads the SSS keytab file specified by SecEnv if available.
+ */
+declare function loadAuthConfig(options: {
+  url?: XRootDUrl;
+  credentials?: {
+    username: string;
+    password?: string;
+  };
+  secEnv?: SecEnv;
+}): ResolvedAuthConfig;
+//#endregion
 //#region src/api/filesystem.d.ts
 declare class FileSystem {
   private mux;
@@ -659,5 +727,5 @@ declare function putBytes(buf: Buffer, offset: number, data: Uint8Array): number
 /** Slice `length` bytes from `buf` at `offset`, return `[slice, newOffset]`. */
 declare function getBytes(buf: Buffer, offset: number, length: number): [Buffer, number];
 //#endregion
-export { type AuthConfig, BODY_SIZE, CRED_TYPE, type ChunkInfo, ClientError, DEFAULT_PORT, type DirectoryEntry, type DirectoryList, DirlistOptions, type ErrorResponse, FHANDLE_SIZE, File, FileSystem, type Frame, Framer, HANDSHAKE_FIFTH, HANDSHAKE_FIRST, HANDSHAKE_FOURTH, HANDSHAKE_SECOND, HANDSHAKE_THIRD, type ITransport, type Location, type LocationInfo, type LoginResponse, Message, Multiplexer, OpenFlags, type OpenOptions, type OpenResponse, PROTOCOL_VERSION, type ProtocolInfo, type ProtocolResponse, REQUEST_HDR_SIZE, REQUEST_OFFSET_BODY, REQUEST_OFFSET_DLEN, REQUEST_OFFSET_REQUEST_ID, REQUEST_OFFSET_STREAM_ID, RESPONSE_HDR_SIZE, RESPONSE_OFFSET_BODY, RESPONSE_OFFSET_DLEN, RESPONSE_OFFSET_STATUS, RESPONSE_OFFSET_STREAM_ID, type RedirectResponse, RequestId, ResponseStatus, SESS_ID_SIZE, S_IFDIR, S_IFLNK, ServerError, type Session, StatFlags, type StatInfo, Transport, type WaitResponse, XRootDClient, type XRootDClientOptions, XRootDError, XRootDUrl, buildCloseRequest, buildHandshakeAndProtocol, buildLoginRequest, buildOpenRequest, buildReadRequest, buildStatRequest, buildWriteRequest, createStatInfo, get16, get32, getBytes, getString, handshake, kXR_ExpBind, kXR_ExpLogin, kXR_ableTLS, kXR_bifreqs, kXR_secreqs, kXR_wantTLS, parseErrorResponse, parseLoginResponse, parseOpenResponse, parseProtocolResponse, parseRedirectResponse, parseWaitResponse, put16, put32, putBytes, putString };
+export { type AuthConfig, BODY_SIZE, CRED_TYPE, type ChunkInfo, ClientError, DEFAULT_PORT, type DirectoryEntry, type DirectoryList, DirlistOptions, type ErrorResponse, FHANDLE_SIZE, File, FileSystem, type Frame, Framer, HANDSHAKE_FIFTH, HANDSHAKE_FIRST, HANDSHAKE_FOURTH, HANDSHAKE_SECOND, HANDSHAKE_THIRD, type ITransport, type Location, type LocationInfo, type LoginResponse, Message, Multiplexer, OpenFlags, type OpenOptions, type OpenResponse, PROTOCOL_VERSION, type ProtocolInfo, type ProtocolResponse, REQUEST_HDR_SIZE, REQUEST_OFFSET_BODY, REQUEST_OFFSET_DLEN, REQUEST_OFFSET_REQUEST_ID, REQUEST_OFFSET_STREAM_ID, RESPONSE_HDR_SIZE, RESPONSE_OFFSET_BODY, RESPONSE_OFFSET_DLEN, RESPONSE_OFFSET_STATUS, RESPONSE_OFFSET_STREAM_ID, type RedirectResponse, RequestId, type ResolvedAuthConfig, ResponseStatus, SESS_ID_SIZE, S_IFDIR, S_IFLNK, SecEnv, type SecEnvOptions, ServerError, type Session, StatFlags, type StatInfo, Transport, type WaitResponse, XRootDClient, type XRootDClientOptions, XRootDError, XRootDUrl, buildCloseRequest, buildHandshakeAndProtocol, buildLoginRequest, buildOpenRequest, buildReadRequest, buildStatRequest, buildWriteRequest, createStatInfo, get16, get32, getBytes, getString, handshake, kXR_ExpBind, kXR_ExpLogin, kXR_ableTLS, kXR_bifreqs, kXR_secreqs, kXR_wantTLS, loadAuthConfig, parseErrorResponse, parseLoginResponse, parseOpenResponse, parseProtocolResponse, parseRedirectResponse, parseWaitResponse, put16, put32, putBytes, putString };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,5 +1,8 @@
 import net from "node:net";
 import tls from "node:tls";
+import { createCipheriv } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
 //#region src/protocol/constants.ts
 const RequestId = {
 	Auth: 3e3,
@@ -637,13 +640,15 @@ function buildRmRequest(streamId, path) {
 function buildMvRequest(streamId, source, target) {
 	const srcBytes = strToBytes(source);
 	const tgtBytes = strToBytes(target);
-	const msg = new Message(24 + srcBytes.length + tgtBytes.length);
+	const spaceSep = new Uint8Array([32]);
+	const msg = new Message(24 + srcBytes.length + 1 + tgtBytes.length);
 	msg.writeBytes(streamIdToBytes(streamId));
 	msg.writeInt16BE(RequestId.Mv);
 	msg.writeBytes(/* @__PURE__ */ new Uint8Array(14));
 	msg.writeInt16BE(srcBytes.length & 65535);
-	msg.writeInt32BE(srcBytes.length + tgtBytes.length);
+	msg.writeInt32BE(srcBytes.length + 1 + tgtBytes.length);
 	msg.writeBytes(srcBytes);
+	msg.writeBytes(spaceSep);
 	msg.writeBytes(tgtBytes);
 	return msg.getBuffer();
 }
@@ -1189,19 +1194,21 @@ const authProtocols = /* @__PURE__ */ new Map();
 function registerAuthProtocol(name, factory) {
 	authProtocols.set(name, factory);
 }
-async function doAuthentication(mux, secReqs, params) {
+async function doAuthentication(mux, secReqs, params, options) {
 	if (!secReqs || secReqs.trim().length === 0) return {
 		prot: "",
 		uid: 0,
 		gid: 0
 	};
 	const supportedProtocols = secReqs.split(",").map((s) => s.trim());
-	for (const protoName of supportedProtocols) {
+	const filter = options?.protocolFilter;
+	const candidates = filter?.length ? supportedProtocols.filter((p) => filter.includes(p)) : supportedProtocols;
+	for (const protoName of candidates) {
 		const factory = authProtocols.get(protoName);
 		if (!factory) continue;
 		return await executeAuth(mux, factory(), params);
 	}
-	throw new XRootDError(ServerError.AuthFailed, `No supported authentication protocol. Server requires: ${secReqs}`);
+	throw new XRootDError(ServerError.AuthFailed, `No supported authentication protocol. Server requires: ${secReqs}` + (filter ? `. Allowed: ${filter.join(",")}` : ""));
 }
 async function executeAuth(mux, protocol, params) {
 	const creds = await protocol.getCredentials(params);
@@ -1254,6 +1261,79 @@ var HostAuth = class {
 	}
 };
 //#endregion
+//#region src/utils/crc32.ts
+function crc32(data) {
+	let crc = 4294967295;
+	for (let i = 0; i < data.length; i++) {
+		crc ^= data[i];
+		for (let j = 0; j < 8; j++) crc = crc >>> 1 ^ (crc & 1 ? 3988292384 : 0);
+	}
+	return (crc ^ 4294967295) >>> 0;
+}
+//#endregion
+//#region src/security/sss.ts
+function pkcs5Pad(data, blockSize) {
+	const padLen = blockSize - data.length % blockSize;
+	const padded = Buffer.alloc(data.length + padLen);
+	data.copy(padded);
+	padded.fill(padLen, data.length);
+	return padded;
+}
+/**
+* SSS (Simple Shared Secret) authentication protocol.
+*
+* Uses Blowfish-ECB encryption + CRC32 checksum.
+* Note: Requires Node.js with legacy OpenSSL provider for Blowfish support.
+* Run with: NODE_OPTIONS=--openssl-legacy-provider
+*
+* Or use the static create() method which checks if Blowfish is available.
+*/
+var SSSAuth = class {
+	name = "sss";
+	entity = {
+		prot: "sss",
+		uid: 0,
+		gid: 0
+	};
+	complete = false;
+	key;
+	constructor(key) {
+		if (key.length !== 8) throw new Error("SSS key must be 8 bytes");
+		this.key = key;
+	}
+	static isSupported() {
+		try {
+			createCipheriv("bf-ecb", Buffer.alloc(8), null).final();
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async getCredentials(params) {
+		const password = params.password || "";
+		const passwordBytes = new TextEncoder().encode(password);
+		const crc = crc32(passwordBytes);
+		const payload = Buffer.alloc(passwordBytes.length + 4);
+		Buffer.from(passwordBytes).copy(payload, 0);
+		payload.writeUInt32BE(crc, passwordBytes.length);
+		const cipher = createCipheriv("bf-ecb", this.key, null);
+		const padded = pkcs5Pad(payload, 8);
+		const encrypted = Buffer.concat([cipher.update(padded), cipher.final()]);
+		this.entity.name = params.username;
+		return new Uint8Array(encrypted);
+	}
+	async processChallenge(_challenge) {
+		this.complete = true;
+		return /* @__PURE__ */ new Uint8Array(0);
+	}
+	isComplete() {
+		return this.complete;
+	}
+	getEntity() {
+		return this.entity;
+	}
+};
+//#endregion
 //#region src/api/types.ts
 const StatFlags = {
 	XBitSet: 1,
@@ -1383,7 +1463,7 @@ var File = class {
 			const { errnum, errmsg } = parseErrorResponse(frame.body);
 			throw new XRootDError(errnum, errmsg);
 		}
-		if (frame.status === ResponseStatus.Ok) return new Uint8Array(frame.body);
+		if (frame.status === ResponseStatus.Ok || frame.status === ResponseStatus.Oksofar) return new Uint8Array(frame.body);
 		throw new XRootDError(ServerError.ServerError, `Unexpected read response status: ${frame.status}`);
 	}
 	async write(offset, data) {
@@ -1394,7 +1474,7 @@ var File = class {
 			const { errnum, errmsg } = parseErrorResponse(frame.body);
 			throw new XRootDError(errnum, errmsg);
 		}
-		if (frame.status === ResponseStatus.Ok) return frame.dlen;
+		if (frame.status === ResponseStatus.Ok) return frame.dlen > 0 ? frame.dlen : data.length;
 		throw new XRootDError(ServerError.ServerError, `Unexpected write response status: ${frame.status}`);
 	}
 	async close() {
@@ -1492,6 +1572,32 @@ var FileSystem = class {
 	}
 };
 //#endregion
+//#region src/config/loader.ts
+/**
+* Resolve authentication credentials from multiple sources.
+*
+* Priority (high → low):
+*   1. options.credentials (explicit)
+*   2. URL userinfo (root://user:pass@host)
+*   3. SecEnv XrdSecUSER / XrdSecCREDS
+*
+* Also reads the SSS keytab file specified by SecEnv if available.
+*/
+function loadAuthConfig(options) {
+	const { url, credentials, secEnv } = options;
+	const username = credentials?.username ?? url?.user ?? secEnv?.username;
+	const password = credentials?.password ?? url?.password ?? secEnv?.password;
+	let sssKey;
+	if (secEnv?.sssKeytab) try {
+		sssKey = readFileSync(secEnv.sssKeytab);
+	} catch {}
+	return {
+		username,
+		password,
+		sssKey
+	};
+}
+//#endregion
 //#region src/client.ts
 var XRootDClient = class {
 	url;
@@ -1516,15 +1622,22 @@ var XRootDClient = class {
 		});
 		if (this.options.timeout) this.mux.setTimeout(this.options.timeout);
 		this.session = await handshake(this.mux, url, { username: this.options.credentials?.username });
+		const secEnv = this.options.secEnv;
+		const authConfig = loadAuthConfig({
+			url,
+			credentials: this.options.credentials,
+			secEnv
+		});
 		registerAuthProtocol("host", () => new HostAuth());
-		if (this.session.secReqs && this.options.credentials) {
+		if (authConfig.sssKey && SSSAuth.isSupported()) registerAuthProtocol("sss", () => new SSSAuth(authConfig.sssKey));
+		if (this.session.secReqs && (authConfig.username || authConfig.password)) {
 			const secEntity = await doAuthentication(this.mux, this.session.secReqs, {
 				host: url.host,
 				port: url.port,
-				username: this.options.credentials.username,
-				password: this.options.credentials.password,
+				username: authConfig.username,
+				password: authConfig.password,
 				sessid: this.session.sessid
-			});
+			}, { protocolFilter: secEnv?.protocolFilter });
 			this.session.secEntity = secEntity;
 		}
 		this.fs = new FileSystem(this.mux);
@@ -1611,6 +1724,69 @@ var XRootDClient = class {
 	}
 };
 //#endregion
-export { BODY_SIZE, CRED_TYPE, ClientError, DEFAULT_PORT, DirlistOptions, FHANDLE_SIZE, File, FileSystem, Framer, HANDSHAKE_FIFTH, HANDSHAKE_FIRST, HANDSHAKE_FOURTH, HANDSHAKE_SECOND, HANDSHAKE_THIRD, Message, Multiplexer, OpenFlags, PROTOCOL_VERSION, REQUEST_HDR_SIZE, REQUEST_OFFSET_BODY, REQUEST_OFFSET_DLEN, REQUEST_OFFSET_REQUEST_ID, REQUEST_OFFSET_STREAM_ID, RESPONSE_HDR_SIZE, RESPONSE_OFFSET_BODY, RESPONSE_OFFSET_DLEN, RESPONSE_OFFSET_STATUS, RESPONSE_OFFSET_STREAM_ID, RequestId, ResponseStatus, SESS_ID_SIZE, S_IFDIR, S_IFLNK, ServerError, StatFlags, Transport, XRootDClient, XRootDError, XRootDUrl, buildCloseRequest, buildHandshakeAndProtocol, buildLoginRequest, buildOpenRequest, buildReadRequest, buildStatRequest, buildWriteRequest, createStatInfo, get16, get32, getBytes, getString, handshake, kXR_ExpBind, kXR_ExpLogin, kXR_ableTLS, kXR_bifreqs, kXR_secreqs, kXR_wantTLS, parseErrorResponse, parseLoginResponse, parseOpenResponse, parseProtocolResponse, parseRedirectResponse, parseWaitResponse, put16, put32, putBytes, putString };
+//#region src/config/sec-env.ts
+/**
+* xrootd security environment variable configuration.
+*
+* Maps C++ xrootd's XrdSec* / X509_* environment variables to a structured
+* config object. Does NOT read process.env directly — the caller provides
+* the env source via constructor options.
+*/
+var SecEnv = class SecEnv {
+	protocolFilter;
+	proxyMode;
+	proxyCreds;
+	sssKeytab;
+	krb5InitToken;
+	gsiCaDir;
+	gsiCrlDir;
+	gsiUserCert;
+	gsiUserKey;
+	gsiUserProxy;
+	pwdServerPubkey;
+	username;
+	password;
+	constructor(options = {}) {
+		const env = options.env ?? process.env;
+		this.protocolFilter = options.protocolFilter ?? this.parseProtocolFilter(env);
+		this.proxyMode = truthy(env["XrdSecPROXY"]);
+		this.proxyCreds = truthy(env["XrdSecPROXYCREDS"]);
+		this.sssKeytab = options.sss !== false ? env["XrdSecSSSKT"] ?? env["XrdSecsssKT"] : void 0;
+		this.krb5InitToken = options.krb5 !== false ? truthy(env["XrdSecKRB5INITTKN"]) : false;
+		if (options.gsi !== false) {
+			const home = homedir();
+			this.gsiCaDir = env["XrdSecGSICADIR"] ?? env["X509_CERT_DIR"] ?? "/etc/grid-security/certificates";
+			this.gsiCrlDir = env["XrdSecGSICRLDIR"] ?? env["X509_CERT_DIR"] ?? "/etc/grid-security/certificates";
+			this.gsiUserCert = env["XrdSecGSIUSERCERT"] ?? env["X509_USER_CERT"] ?? `${home}/.globus/usercert.pem`;
+			this.gsiUserKey = env["XrdSecGSIUSERKEY"] ?? env["X509_USER_KEY"] ?? `${home}/.globus/userkey.pem`;
+			this.gsiUserProxy = env["XrdSecGSIUSERPROXY"] ?? env["X509_USER_PROXY"] ?? `/tmp/x509up_u${process.getuid?.() ?? 0}`;
+		} else {
+			this.gsiCaDir = "";
+			this.gsiCrlDir = "";
+			this.gsiUserCert = "";
+			this.gsiUserKey = "";
+			this.gsiUserProxy = "";
+		}
+		this.pwdServerPubkey = options.pwd !== false ? env["XrdSecPWDSRVPUK"] : void 0;
+		this.username = env["XrdSecUSER"];
+		this.password = env["XrdSecCREDS"];
+	}
+	static fromEnv(env, options) {
+		return new SecEnv({
+			...options,
+			env: env ?? process.env
+		});
+	}
+	parseProtocolFilter(env) {
+		const raw = env["XrdSecPROTOCOL"];
+		if (!raw) return [];
+		return raw.split(",").map((s) => s.trim()).filter(Boolean);
+	}
+};
+function truthy(val) {
+	return val !== void 0 && val !== "0" && val !== "";
+}
+//#endregion
+export { BODY_SIZE, CRED_TYPE, ClientError, DEFAULT_PORT, DirlistOptions, FHANDLE_SIZE, File, FileSystem, Framer, HANDSHAKE_FIFTH, HANDSHAKE_FIRST, HANDSHAKE_FOURTH, HANDSHAKE_SECOND, HANDSHAKE_THIRD, Message, Multiplexer, OpenFlags, PROTOCOL_VERSION, REQUEST_HDR_SIZE, REQUEST_OFFSET_BODY, REQUEST_OFFSET_DLEN, REQUEST_OFFSET_REQUEST_ID, REQUEST_OFFSET_STREAM_ID, RESPONSE_HDR_SIZE, RESPONSE_OFFSET_BODY, RESPONSE_OFFSET_DLEN, RESPONSE_OFFSET_STATUS, RESPONSE_OFFSET_STREAM_ID, RequestId, ResponseStatus, SESS_ID_SIZE, S_IFDIR, S_IFLNK, SecEnv, ServerError, StatFlags, Transport, XRootDClient, XRootDError, XRootDUrl, buildCloseRequest, buildHandshakeAndProtocol, buildLoginRequest, buildOpenRequest, buildReadRequest, buildStatRequest, buildWriteRequest, createStatInfo, get16, get32, getBytes, getString, handshake, kXR_ExpBind, kXR_ExpLogin, kXR_ableTLS, kXR_bifreqs, kXR_secreqs, kXR_wantTLS, loadAuthConfig, parseErrorResponse, parseLoginResponse, parseOpenResponse, parseProtocolResponse, parseRedirectResponse, parseWaitResponse, put16, put32, putBytes, putString };
 
 //# sourceMappingURL=index.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xrootd",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.3",
   "description": "A TypeScript client library for the XRootD protocol",
   "main": "dist/index.mjs",
   "types": "dist/index.d.mts",
@@ -11,7 +11,6 @@
     }
   },
   "scripts": {
-    "preinstall": "npx only-allow pnpm",
     "build": "tsdown",
     "dev": "tsdown --watch",
     "typecheck": "tsc --noEmit",