abstract-securefiles 0.1.0__tar.gz

abstract_securefiles-0.1.0/PKG-INFO

@@ -0,0 +1,47 @@
+Metadata-Version: 2.4
+Name: abstract_securefiles
+Version: 0.1.0
+Summary: Secure Files: share local files and folders through abstractendeavors.com (or your own server) without uploading them. Includes the desktop agent, the shared tar/resume core and the server relay.
+Author-email: putkoff <partners@abstractendeavors.com>
+License: MIT
+Project-URL: Homepage, https://abstractendeavors.com/secure-files
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: License :: OSI Approved :: MIT License
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: aiohttp>=3.9
+Provides-Extra: relay
+Requires-Dist: psycopg[binary]>=3.1; extra == "relay"
+
+# abstract_securefiles
+
+Share files and whole folders **straight from your own computer** through
+[Secure Files](https://abstractendeavors.com/secure-files) — nothing is uploaded.
+When someone opens your share link, the file streams from your computer through
+the relay, with the same passwords, download limits and resumable downloads as
+files hosted on the server. Folders download as one uncompressed `.tar`.
+
+## Install (Linux, macOS, Windows)
+
+```bash
+pipx install abstract-securefiles      # or: python -m pip install --user abstract-securefiles
+securefiles setup                      # start at login, start now, open http://127.0.0.1:47821
+```
+
+Then, on abstractendeavors.com/secure-files → **My computers** → **Add a computer**,
+enter the pairing code in the control panel (or `securefiles pair CODE`).
+Pick files/folders to share in the control panel; they appear on the website under
+`devices/<computer name>/`, where you create links, passwords and limits.
+
+Commands: `securefiles setup | serve | open | pair CODE | status | unpair | uninstall`.
+
+Secure Files is invite-only; ask the administrator for access.
+
+## Contents
+
+- `abstract_securefiles.core` — deterministic tar + HTTP Range transport shared by server and agent.
+- `abstract_securefiles.agent` — the desktop agent (local control panel on 127.0.0.1 only).
+- `abstract_securefiles.relay` — the server relay (`pip install abstract-securefiles[relay]`, run `securefiles-relay`).

abstract_securefiles-0.1.0/README.md

@@ -0,0 +1,29 @@
+# abstract_securefiles
+
+Share files and whole folders **straight from your own computer** through
+[Secure Files](https://abstractendeavors.com/secure-files) — nothing is uploaded.
+When someone opens your share link, the file streams from your computer through
+the relay, with the same passwords, download limits and resumable downloads as
+files hosted on the server. Folders download as one uncompressed `.tar`.
+
+## Install (Linux, macOS, Windows)
+
+```bash
+pipx install abstract-securefiles      # or: python -m pip install --user abstract-securefiles
+securefiles setup                      # start at login, start now, open http://127.0.0.1:47821
+```
+
+Then, on abstractendeavors.com/secure-files → **My computers** → **Add a computer**,
+enter the pairing code in the control panel (or `securefiles pair CODE`).
+Pick files/folders to share in the control panel; they appear on the website under
+`devices/<computer name>/`, where you create links, passwords and limits.
+
+Commands: `securefiles setup | serve | open | pair CODE | status | unpair | uninstall`.
+
+Secure Files is invite-only; ask the administrator for access.
+
+## Contents
+
+- `abstract_securefiles.core` — deterministic tar + HTTP Range transport shared by server and agent.
+- `abstract_securefiles.agent` — the desktop agent (local control panel on 127.0.0.1 only).
+- `abstract_securefiles.relay` — the server relay (`pip install abstract-securefiles[relay]`, run `securefiles-relay`).

abstract_securefiles-0.1.0/pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires = ["setuptools>=61", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "abstract_securefiles"
+version = "0.1.0"
+description = "Secure Files: share local files and folders through abstractendeavors.com (or your own server) without uploading them. Includes the desktop agent, the shared tar/resume core and the server relay."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "putkoff", email = "partners@abstractendeavors.com" }]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Operating System :: POSIX :: Linux",
+    "Operating System :: MacOS",
+    "Operating System :: Microsoft :: Windows",
+    "License :: OSI Approved :: MIT License",
+]
+dependencies = ["aiohttp>=3.9"]
+
+[project.optional-dependencies]
+relay = ["psycopg[binary]>=3.1"]
+
+[project.scripts]
+securefiles = "abstract_securefiles.cli:main"
+securefiles-relay = "abstract_securefiles.relay.server:main"
+
+[project.urls]
+Homepage = "https://abstractendeavors.com/secure-files"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+abstract_securefiles = ["agent/ui/*"]

abstract_securefiles-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

abstract_securefiles-0.1.0/src/abstract_securefiles/__init__.py

@@ -0,0 +1,3 @@
+"""Secure Files: shared core, desktop agent and server relay."""
+
+__version__ = "0.1.0"

abstract_securefiles-0.1.0/src/abstract_securefiles/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+main()

abstract_securefiles-0.1.0/src/abstract_securefiles/agent/autostart.py

@@ -0,0 +1,86 @@
+"""Start the agent at login: systemd --user (Linux), launchd (macOS), Task Scheduler (Windows)."""
+from __future__ import annotations
+
+import os
+import plistlib
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+LABEL = "com.abstractendeavors.securefiles"
+UNIT = "securefiles-agent.service"
+TASK = "SecureFilesAgent"
+
+
+def _python(windowless: bool = False) -> str:
+    exe = sys.executable
+    if windowless and sys.platform == "win32":
+        candidate = Path(exe).with_name("pythonw.exe")
+        if candidate.exists():
+            return str(candidate)
+    return exe
+
+
+def _run(cmd, check=True):
+    return subprocess.run(cmd, check=check, capture_output=True, text=True)
+
+
+def install() -> str:
+    if sys.platform.startswith("linux"):
+        unit_dir = Path(os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config") / "systemd" / "user"
+        unit_dir.mkdir(parents=True, exist_ok=True)
+        (unit_dir / UNIT).write_text(
+            "[Unit]\nDescription=Secure Files agent\nAfter=network-online.target\n\n"
+            f"[Service]\nExecStart=\"{_python()}\" -m abstract_securefiles serve\n"
+            "Restart=on-failure\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n",
+            encoding="utf-8",
+        )
+        if not shutil.which("systemctl"):
+            return f"Wrote {unit_dir / UNIT}, but systemctl is missing; start it with: securefiles serve"
+        _run(["systemctl", "--user", "daemon-reload"])
+        _run(["systemctl", "--user", "enable", "--now", UNIT])
+        return f"Enabled systemd user service {UNIT} (starts at login)."
+    if sys.platform == "darwin":
+        agents = Path.home() / "Library" / "LaunchAgents"
+        agents.mkdir(parents=True, exist_ok=True)
+        plist = agents / f"{LABEL}.plist"
+        logs = Path.home() / "Library" / "Logs"
+        plist.write_bytes(plistlib.dumps({
+            "Label": LABEL,
+            "ProgramArguments": [_python(), "-m", "abstract_securefiles", "serve"],
+            "RunAtLoad": True,
+            "KeepAlive": True,
+            "StandardOutPath": str(logs / "securefiles-agent.log"),
+            "StandardErrorPath": str(logs / "securefiles-agent.log"),
+        }))
+        _run(["launchctl", "unload", str(plist)], check=False)
+        _run(["launchctl", "load", "-w", str(plist)])
+        return f"Installed LaunchAgent {plist} (starts at login)."
+    if sys.platform == "win32":
+        command = f'"{_python(windowless=True)}" -m abstract_securefiles serve'
+        _run(["schtasks", "/Create", "/F", "/SC", "ONLOGON", "/RL", "LIMITED", "/TN", TASK, "/TR", command])
+        _run(["schtasks", "/Run", "/TN", TASK], check=False)
+        return f"Created scheduled task {TASK} (starts at logon)."
+    raise RuntimeError(f"Unsupported platform: {sys.platform}")
+
+
+def uninstall() -> str:
+    if sys.platform.startswith("linux"):
+        unit = Path(os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config") / "systemd" / "user" / UNIT
+        if shutil.which("systemctl"):
+            _run(["systemctl", "--user", "disable", "--now", UNIT], check=False)
+        unit.unlink(missing_ok=True)
+        if shutil.which("systemctl"):
+            _run(["systemctl", "--user", "daemon-reload"], check=False)
+        return "Removed the systemd user service."
+    if sys.platform == "darwin":
+        plist = Path.home() / "Library" / "LaunchAgents" / f"{LABEL}.plist"
+        _run(["launchctl", "unload", "-w", str(plist)], check=False)
+        plist.unlink(missing_ok=True)
+        return "Removed the LaunchAgent."
+    if sys.platform == "win32":
+        _run(["schtasks", "/End", "/TN", TASK], check=False)
+        _run(["schtasks", "/Delete", "/F", "/TN", TASK], check=False)
+        return "Removed the scheduled task."
+    raise RuntimeError(f"Unsupported platform: {sys.platform}")

abstract_securefiles-0.1.0/src/abstract_securefiles/agent/config.py

@@ -0,0 +1,99 @@
+"""Per-user agent configuration (JSON) in the platform's config directory."""
+from __future__ import annotations
+
+import json
+import os
+import platform
+import secrets
+import socket
+import sys
+import threading
+from pathlib import Path
+
+DEFAULT_SERVER = "https://api.abstractendeavors.com"
+DEFAULT_PORT = 47821
+
+
+def config_dir() -> Path:
+    if sys.platform == "win32":
+        base = Path(os.environ.get("APPDATA") or Path.home() / "AppData" / "Roaming")
+        return base / "SecureFiles"
+    if sys.platform == "darwin":
+        return Path.home() / "Library" / "Application Support" / "SecureFiles"
+    return Path(os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config") / "securefiles"
+
+
+def platform_label() -> str:
+    return f"{platform.system()} {platform.release()} ({platform.machine()})"
+
+
+class Config:
+    """Thread-safe JSON config: server, pairing token, published items, UI port."""
+
+    def __init__(self, path: Path = None):
+        self.path = path or config_dir() / "config.json"
+        self._lock = threading.Lock()
+        self.data = {
+            "server": DEFAULT_SERVER,
+            "port": DEFAULT_PORT,
+            "device_name": socket.gethostname()[:60] or "my-computer",
+            "device_id": None,
+            "token": None,
+            "username": None,
+            "items": [],
+        }
+        if self.path.exists():
+            self.data.update(json.loads(self.path.read_text(encoding="utf-8")))
+
+    def save(self):
+        with self._lock:
+            self.path.parent.mkdir(parents=True, exist_ok=True)
+            tmp = self.path.with_suffix(".tmp")
+            tmp.write_text(json.dumps(self.data, indent=2), encoding="utf-8")
+            if os.name == "posix":
+                os.chmod(tmp, 0o600)
+            os.replace(tmp, self.path)
+
+    @property
+    def paired(self) -> bool:
+        return bool(self.data.get("token"))
+
+    def add_item(self, path: str) -> dict:
+        real = os.path.realpath(path)
+        if not (os.path.isfile(real) or os.path.isdir(real)):
+            raise ValueError("Not a file or folder")
+        for item in self.data["items"]:
+            if item["path"] == real:
+                return item
+        item = {
+            "id": secrets.token_urlsafe(9),
+            "path": real,
+            "name": os.path.basename(real.rstrip("/\\")) or real,
+            "kind": "folder" if os.path.isdir(real) else "file",
+        }
+        self.data["items"].append(item)
+        self.save()
+        return item
+
+    def remove_item(self, item_id: str) -> bool:
+        before = len(self.data["items"])
+        self.data["items"] = [i for i in self.data["items"] if i["id"] != item_id]
+        self.save()
+        return len(self.data["items"]) != before
+
+    def item(self, item_id: str):
+        return next((i for i in self.data["items"] if i["id"] == item_id), None)
+
+    def catalog(self) -> list:
+        out = []
+        for item in self.data["items"]:
+            size = None
+            if item["kind"] == "file":
+                try:
+                    size = os.path.getsize(item["path"])
+                except OSError:
+                    continue
+            elif not os.path.isdir(item["path"]):
+                continue
+            out.append({"id": item["id"], "name": item["name"], "kind": item["kind"], "size": size})
+        return out

abstract_securefiles-0.1.0/src/abstract_securefiles/agent/relay_client.py

@@ -0,0 +1,139 @@
+"""Outbound connection to the Secure Files relay.
+
+Keeps one WebSocket open (control only), publishes the catalog of shared
+items, and answers each "send" request by streaming the item (honouring the
+downloader's Range) as an HTTPS upload. Reconnects with backoff forever.
+"""
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import os
+from typing import Optional
+
+import aiohttp
+
+from .. import __version__
+from ..core import build_payload
+from .config import Config, platform_label
+
+log = logging.getLogger("securefiles.agent")
+
+PROTOCOL = 1
+
+
+class RelayClient:
+    def __init__(self, config: Config):
+        self.config = config
+        self.state = "not paired"
+        self.last_error: Optional[str] = None
+        self.ws: Optional[aiohttp.ClientWebSocketResponse] = None
+        self.session: Optional[aiohttp.ClientSession] = None
+        self._wake = asyncio.Event()
+        self._task: Optional[asyncio.Task] = None
+        self.active_transfers = 0
+
+    def start(self):
+        self._task = asyncio.get_running_loop().create_task(self._run())
+
+    def reconnect(self):
+        """Drop the current connection (e.g. after pairing/unpairing) and connect again."""
+        self._wake.set()
+        if self.ws is not None and not self.ws.closed:
+            asyncio.get_running_loop().create_task(self.ws.close())
+
+    async def publish_catalog(self):
+        if self.ws is not None and not self.ws.closed:
+            await self.ws.send_str(json.dumps({"type": "catalog", "items": self.config.catalog()}))
+
+    async def _run(self):
+        backoff = 2
+        timeout = aiohttp.ClientTimeout(total=None, sock_connect=20)
+        async with aiohttp.ClientSession(timeout=timeout) as session:
+            self.session = session
+            while True:
+                if not self.config.paired:
+                    self.state = "not paired"
+                    self._wake.clear()
+                    await self._wake.wait()
+                    continue
+                server = self.config.data["server"].rstrip("/")
+                url = server.replace("https://", "wss://", 1).replace("http://", "ws://", 1) + "/secure-files/relay/agent"
+                try:
+                    self.state = "connecting"
+                    async with session.ws_connect(url, headers=self._auth(), heartbeat=30) as ws:
+                        self.ws = ws
+                        self.state = "connected"
+                        self.last_error = None
+                        backoff = 2
+                        await ws.send_str(json.dumps({
+                            "type": "hello", "protocol": PROTOCOL, "version": __version__,
+                            "platform": platform_label(), "items": self.config.catalog(),
+                        }))
+                        async for msg in ws:
+                            if msg.type != aiohttp.WSMsgType.TEXT:
+                                continue
+                            data = json.loads(msg.data)
+                            if data.get("type") == "send":
+                                asyncio.get_running_loop().create_task(self._transfer(data))
+                except aiohttp.WSServerHandshakeError as exc:
+                    self.last_error = "This device was removed from your account; pair it again." \
+                        if exc.status == 401 else f"Relay refused the connection ({exc.status})"
+                except (aiohttp.ClientError, OSError, asyncio.TimeoutError) as exc:
+                    self.last_error = f"Cannot reach {server}: {exc}"
+                finally:
+                    self.ws = None
+                if self.config.paired:
+                    self.state = "reconnecting"
+                    self._wake.clear()
+                    try:
+                        await asyncio.wait_for(self._wake.wait(), backoff)
+                    except asyncio.TimeoutError:
+                        pass
+                    backoff = min(backoff * 2, 60)
+
+    def _auth(self) -> dict:
+        return {"Authorization": f"Bearer {self.config.data['token']}"}
+
+    async def _report(self, transfer: str, status: int, message: str):
+        if self.ws is not None and not self.ws.closed:
+            await self.ws.send_str(json.dumps({"type": "error", "transfer": transfer,
+                                               "status": status, "message": message}))
+
+    async def _transfer(self, request: dict):
+        transfer = str(request.get("transfer"))
+        item = self.config.item(str(request.get("item")))
+        if not item or not os.path.exists(item["path"]):
+            await self._report(transfer, 404, "This item is no longer shared from that computer.")
+            return
+        name = f"{item['name']}.tar" if item["kind"] == "folder" else item["name"]
+        loop = asyncio.get_running_loop()
+        try:
+            payload = await loop.run_in_executor(
+                None, build_payload, item["path"], name, request.get("range"), request.get("if_range"))
+        except OSError as exc:
+            await self._report(transfer, 500, f"Could not read the item: {exc}")
+            return
+
+        async def body():
+            iterator = iter(payload.body)
+            while True:
+                chunk = await loop.run_in_executor(None, next, iterator, None)
+                if chunk is None:
+                    return
+                yield chunk
+
+        headers = dict(self._auth())
+        headers["X-SF-Status"] = str(payload.status)
+        for key, value in payload.headers.items():
+            headers[f"X-SF-{key}"] = value
+        url = f"{self.config.data['server'].rstrip('/')}/secure-files/relay/upload/{transfer}"
+        self.active_transfers += 1
+        try:
+            async with self.session.post(url, data=body(), headers=headers) as resp:
+                await resp.read()
+        except (aiohttp.ClientError, OSError) as exc:
+            log.info("transfer %s ended early: %s", transfer, exc)
+        finally:
+            self.active_transfers -= 1

abstract_securefiles-0.1.0/src/abstract_securefiles/agent/server.py

@@ -0,0 +1,156 @@
+"""Local control panel for the desktop agent (127.0.0.1 only)."""
+from __future__ import annotations
+
+import logging
+import os
+import string
+import sys
+from importlib import resources
+
+import aiohttp
+from aiohttp import web
+
+from .. import __version__
+from .config import Config, platform_label
+from .relay_client import RelayClient
+
+log = logging.getLogger("securefiles.agent")
+
+MAX_LIST = 3000
+
+
+def _local_only(port: int):
+    allowed = {f"127.0.0.1:{port}", f"localhost:{port}", f"[::1]:{port}"}
+
+    @web.middleware
+    async def guard(request: web.Request, handler):
+        # Host check defeats DNS rebinding; the custom header on writes defeats
+        # cross-site form posts (browsers can't add it without a CORS preflight).
+        if request.host not in allowed:
+            return web.Response(status=403, text="Secure Files agent: local access only")
+        if request.method not in ("GET", "HEAD") and request.headers.get("X-SF-Local") != "1":
+            return web.Response(status=403, text="missing X-SF-Local header")
+        return await handler(request)
+
+    return guard
+
+
+def _roots() -> list:
+    if sys.platform == "win32":
+        return [f"{d}:\\" for d in string.ascii_uppercase if os.path.exists(f"{d}:\\")]
+    roots = ["/"]
+    for extra in ("/media", "/mnt", "/Volumes"):
+        if os.path.isdir(extra):
+            roots.append(extra)
+    return roots
+
+
+def make_app(config: Config, relay: RelayClient) -> web.Application:
+    app = web.Application(middlewares=[_local_only(config.data["port"])])
+
+    async def index(_request):
+        html = resources.files("abstract_securefiles").joinpath("agent/ui/index.html").read_text(encoding="utf-8")
+        return web.Response(text=html, content_type="text/html")
+
+    async def state(_request):
+        d = config.data
+        return web.json_response({
+            "version": __version__,
+            "platform": platform_label(),
+            "server": d["server"],
+            "device_name": d["device_name"],
+            "username": d.get("username"),
+            "paired": config.paired,
+            "connection": relay.state,
+            "error": relay.last_error,
+            "active_transfers": relay.active_transfers,
+            "items": d["items"],
+            "home": os.path.expanduser("~"),
+            "roots": _roots(),
+        })
+
+    async def pair(request):
+        body = await request.json()
+        code = str(body.get("code") or "").strip().upper().replace(" ", "").replace("-", "")
+        server = str(body.get("server") or config.data["server"]).strip().rstrip("/")
+        name = str(body.get("device_name") or config.data["device_name"]).strip()[:60]
+        if not code:
+            return web.json_response({"message": "Enter the pairing code from the website"}, status=400)
+        try:
+            async with aiohttp.ClientSession() as session:
+                async with session.post(f"{server}/secure-files/devices/claim",
+                                        json={"code": code, "name": name, "platform": platform_label()}) as resp:
+                    data = await resp.json(content_type=None)
+                    if resp.status != 200:
+                        return web.json_response({"message": data.get("message") or f"Pairing failed ({resp.status})"},
+                                                 status=400)
+        except aiohttp.ClientError as exc:
+            return web.json_response({"message": f"Cannot reach {server}: {exc}"}, status=502)
+        config.data.update(server=server, device_name=data.get("device_name") or name,
+                           device_id=data["device_id"], token=data["token"], username=data.get("username"))
+        config.save()
+        relay.reconnect()
+        return await state(request)
+
+    async def unpair(request):
+        config.data.update(device_id=None, token=None, username=None)
+        config.save()
+        relay.reconnect()
+        return await state(request)
+
+    async def browse(request):
+        path = request.query.get("path") or os.path.expanduser("~")
+        real = os.path.realpath(path)
+        if not os.path.isdir(real):
+            return web.json_response({"message": "Not a folder"}, status=400)
+        dirs, files = [], []
+        try:
+            entries = sorted(os.scandir(real), key=lambda e: e.name.lower())
+        except OSError as exc:
+            return web.json_response({"message": str(exc)}, status=403)
+        for entry in entries[:MAX_LIST]:
+            try:
+                if entry.is_dir():
+                    dirs.append({"name": entry.name, "path": entry.path})
+                elif entry.is_file():
+                    files.append({"name": entry.name, "path": entry.path, "size": entry.stat().st_size})
+            except OSError:
+                continue
+        parent = os.path.dirname(real)
+        return web.json_response({"path": real, "parent": parent if parent != real else None,
+                                  "dirs": dirs, "files": files, "truncated": len(entries) > MAX_LIST})
+
+    async def share(request):
+        body = await request.json()
+        try:
+            config.add_item(str(body.get("path") or ""))
+        except ValueError as exc:
+            return web.json_response({"message": str(exc)}, status=400)
+        await relay.publish_catalog()
+        return await state(request)
+
+    async def unshare(request):
+        config.remove_item(request.match_info["item_id"])
+        await relay.publish_catalog()
+        return await state(request)
+
+    app.router.add_get("/", index)
+    app.router.add_get("/api/state", state)
+    app.router.add_post("/api/pair", pair)
+    app.router.add_post("/api/unpair", unpair)
+    app.router.add_get("/api/browse", browse)
+    app.router.add_post("/api/items", share)
+    app.router.add_delete("/api/items/{item_id}", unshare)
+    return app
+
+
+async def run(config: Config):
+    relay = RelayClient(config)
+    relay.start()
+    runner = web.AppRunner(make_app(config, relay), access_log=None)
+    await runner.setup()
+    site = web.TCPSite(runner, "127.0.0.1", config.data["port"])
+    await site.start()
+    log.info("Secure Files agent %s on http://127.0.0.1:%s", __version__, config.data["port"])
+    import asyncio
+    await asyncio.Event().wait()