torrus 0.2.2__tar.gz → 0.2.3__tar.gz

{torrus-0.2.2/src/torrus.egg-info → torrus-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: torrus
-Version: 0.2.2
+Version: 0.2.3
 Summary: Web-based SSH terminal that works behind any reverse proxy
 Author-email: Anudeep Dhavaleswarapu <anudeepd2@gmail.com>
 License-Expression: MIT

{torrus-0.2.2 → torrus-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "torrus"
-version = "0.2.2"
+version = "0.2.3"
 description = "Web-based SSH terminal that works behind any reverse proxy"
 readme = "README.md"
 requires-python = ">=3.10"

{torrus-0.2.2 → torrus-0.2.3}/src/torrus/__init__.py

@@ -1,3 +1,3 @@
 """torrus — web-based SSH terminal that works behind any reverse proxy."""
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"

{torrus-0.2.2 → torrus-0.2.3}/src/torrus/server.py

@@ -35,6 +35,11 @@ else:
 
 _SAFE_ID = re.compile(r'^[a-zA-Z0-9_\-]+$')
 _DEV_MODE = bool(os.getenv("TORRUS_DEV"))
+_DEV_ORIGINS = [
+    f"http://{host}:{port}"
+    for host in ("localhost", "127.0.0.1")
+    for port in range(5173, 5184)
+] if _DEV_MODE else []
 _ALLOW_PRIVATE_HOSTS_WITHOUT_LDAP = os.getenv(
     "TORRUS_ALLOW_PRIVATE_HOSTS_WITHOUT_LDAP", "true"
 ).lower() in {"1", "true", "yes", "on"}
@@ -88,11 +93,7 @@ def _static_dir() -> Path | None:
 
 sio = socketio.AsyncServer(
     async_mode="asgi",
-    cors_allowed_origins=(
-        ["http://localhost:5173", "http://127.0.0.1:5173"]
-        if _DEV_MODE
-        else []
-    ),
+    cors_allowed_origins=_DEV_ORIGINS,
     max_http_buffer_size=10_000_000,
     ping_timeout=60,
     ping_interval=25,
@@ -126,7 +127,7 @@ async def add_app_security_headers(request: Request, call_next):
 if _DEV_MODE:
     fastapi_app.add_middleware(
         CORSMiddleware,
-        allow_origins=["http://localhost:5173", "http://127.0.0.1:5173"],
+        allow_origins=_DEV_ORIGINS,
         allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],
@@ -802,7 +803,16 @@ async def on_sftp_open(sid, data):
     except Exception:
         logger.warning("Could not determine SFTP username for %s/%s", session_id, source_tab_id, exc_info=True)
         username = None
-    await sio.emit("sftp:open:result", {"tab_id": tab_id, "username": username, **result}, to=sid)
+    try:
+        is_root = await ssh_manager.is_root_session(session_id, source_tab_id)
+    except Exception:
+        logger.warning("Could not determine SFTP root status for %s/%s", session_id, source_tab_id, exc_info=True)
+        is_root = False
+    await sio.emit(
+        "sftp:open:result",
+        {"tab_id": tab_id, "username": username, "is_root": is_root, **result},
+        to=sid,
+    )
 
 
 @sio.on("sftp:list")
@@ -901,3 +911,30 @@ async def on_sftp_mkdir(sid, data):
         await sio.emit("sftp:mkdir:result", {"tab_id": tab_id, **result}, to=sid)
     except SFTPError as exc:
         await _emit_sftp_error(sid, tab_id, exc)
+
+
+@sio.on("sftp:chmod")
+async def on_sftp_chmod(sid, data):
+    session_id, tab_id = _sftp_request_ids(data)
+    if not _valid_id(session_id) or not _valid_id(tab_id):
+        return
+    if not await _require_auth(sid, tab_id):
+        return
+    mode = data.get("mode")
+    if isinstance(mode, bool) or not isinstance(mode, int) or not 0 <= mode <= 0o7777:
+        await sio.emit(
+            "sftp:chmod:result",
+            {"tab_id": tab_id, "ok": False, "code": "invalid_request", "message": "Invalid permission mode."},
+            to=sid,
+        )
+        return
+    try:
+        result = await sftp_manager.chmod(tab_id, data.get("path", ""), mode)
+    except SFTPError as exc:
+        await sio.emit(
+            "sftp:chmod:result",
+            {"tab_id": tab_id, "ok": False, "code": exc.code, "message": exc.message},
+            to=sid,
+        )
+        return
+    await sio.emit("sftp:chmod:result", {"tab_id": tab_id, **result}, to=sid)

{torrus-0.2.2 → torrus-0.2.3}/src/torrus/sftp_manager.py

@@ -134,6 +134,9 @@ class SFTPManager:
     async def mkdir(self, tab_id: str, path: str) -> dict[str, Any]:
         return await self._locked(tab_id, lambda session: self._mkdir_sync(session, path))
 
+    async def chmod(self, tab_id: str, path: str, mode: int) -> dict[str, Any]:
+        return await self._locked(tab_id, lambda session: self._chmod_sync(session, path, mode))
+
     async def stream_upload(
         self,
         tab_id: str,
@@ -382,6 +385,14 @@ class SFTPManager:
         except Exception as exc:
             raise _map_error(exc, old_resolved) from exc
 
+    def _chmod_sync(self, session: SFTPSession, path: str, mode: int) -> dict[str, Any]:
+        resolved = _resolve_remote_path(session.cwd, path, session.home)
+        try:
+            session.client.chmod(resolved, mode)
+            return {"ok": True, "path": resolved, "mode": mode}
+        except Exception as exc:
+            raise _map_error(exc, resolved) from exc
+
     def _mkdir_sync(self, session: SFTPSession, path: str) -> dict[str, Any]:
         resolved = _resolve_remote_path(session.cwd, path, session.home)
         try:

{torrus-0.2.2 → torrus-0.2.3}/src/torrus/ssh_manager.py

@@ -67,6 +67,8 @@ class SSHSession:
     write_task: Optional[asyncio.Task] = None
     input_queue: asyncio.Queue[bytes] = field(default_factory=lambda: asyncio.Queue(maxsize=65536))
     output_buffer: bytearray = field(default_factory=bytearray)
+    # Probed at connection time; SFTP identity is scoped to the SSH transport.
+    is_root: bool = False
     # Recomputed during teardown: close the client only when no remaining
     # session still shares its transport.
     owns_client: bool = True
@@ -158,7 +160,7 @@ class SSHManager:
             logger.info("Connecting to %s (session=%s, tab=%s)", target, session_id, tab_id)
 
             try:
-                has_tmux = await loop.run_in_executor(
+                has_tmux, is_root = await loop.run_in_executor(
                     self._ssh_executor,
                     lambda: _connect_and_check_tmux(client, host, port, username, password),
                 )
@@ -229,6 +231,7 @@ class SSHManager:
                 host=host,
                 port=port,
                 username=username,
+                is_root=is_root,
                 cols=cols,
                 rows=rows,
             )
@@ -324,6 +327,14 @@ class SSHManager:
                 return None
             return session.host, session.port, session.username
 
+    async def is_root_session(self, session_id: str, tab_id: str) -> bool:
+        """Return whether the active SSH session has an effective UID of zero."""
+        async with self._lock:
+            session = self._sessions.get((session_id, tab_id))
+            if session is None or session.channel.closed:
+                return False
+            return session.is_root
+
     async def has_session(self, session_id: str) -> bool:
         """Return True when any active tab exists for this browser session."""
         async with self._lock:
@@ -426,6 +437,7 @@ class SSHManager:
                 host=source.host,
                 port=source.port,
                 username=source.username,
+                is_root=source.is_root,
                 cols=cols,
                 rows=rows,
                 owns_client=False,  # shared transport — do not close on destroy
@@ -636,7 +648,7 @@ def _connect_and_check_tmux(
     port: int,
     username: str,
     password: str,
-) -> bool:
+) -> tuple[bool, bool]:
     client.connect(
         hostname=host,
         port=port,
@@ -649,9 +661,9 @@ def _connect_and_check_tmux(
         allow_agent=False,
     )
     try:
-        return _check_tmux_blocking(client)
+        return _connection_probes_blocking(client)
     except Exception:
-        return False
+        return False, False
 
 
 def _check_tmux_blocking(client: paramiko.SSHClient) -> bool:
@@ -666,6 +678,21 @@ def _check_tmux_blocking(client: paramiko.SSHClient) -> bool:
                 channel.close()
 
 
+def _connection_probes_blocking(client: paramiko.SSHClient) -> tuple[bool, bool]:
+    command = "if command -v tmux >/dev/null 2>&1; then echo 1; else echo 0; fi; id -u"
+    stdin, stdout, stderr = client.exec_command(command, timeout=5)
+    try:
+        lines = stdout.read().decode(errors="replace").splitlines()
+        if len(lines) != 2:
+            return False, False
+        return lines[0].strip() == "1", lines[1].strip() == "0"
+    finally:
+        for stream in (stdin, stdout, stderr):
+            channel = getattr(stream, "channel", None)
+            if channel is not None:
+                channel.close()
+
+
 def _sanitize_replay_buffer(buf: bytes) -> bytes:
     """Strip orphaned alternate-screen content from a truncated replay buffer.