diff --git a/.github/workflows/desktop-release-guard.yml b/.github/workflows/desktop-release-guard.yml index 3b5f93e63..e83f10bae 100644 --- a/.github/workflows/desktop-release-guard.yml +++ b/.github/workflows/desktop-release-guard.yml @@ -142,7 +142,7 @@ jobs: if: matrix.platform == 'linux' run: | sudo apt-get update - sudo apt-get install --yes cpio fakeroot rpm zip + sudo apt-get install --yes cpio dbus-x11 fakeroot gnome-keyring libsecret-1-0 rpm zip - name: Package desktop app from clean checkout shell: bash @@ -161,6 +161,7 @@ jobs: shell: bash run: | npm run desktop:typecheck + npm run test:native-durability -w @propr/desktop npm run desktop:test - name: Make Linux validation packages @@ -197,7 +198,14 @@ jobs: run: | sudo chown root:root "apps/desktop/out/propr-desktop-linux-${{ matrix.arch }}/chrome-sandbox" sudo chmod 4755 "apps/desktop/out/propr-desktop-linux-${{ matrix.arch }}/chrome-sandbox" - xvfb-run --auto-servernum npm run desktop:smoke + keyring_root="$(mktemp -d)" + trap 'rm -rf -- "$keyring_root"' EXIT + dbus-run-session -- bash -euo pipefail -c ' + export PROPR_DESKTOP_SMOKE_KEYRING_ROOT="$1" + export XDG_DATA_HOME="$1" + eval "$(printf "%s\n" "propr-packaged-smoke" | gnome-keyring-daemon --unlock --components=secrets)" + xvfb-run --auto-servernum npm run desktop:smoke + ' bash "$keyring_root" - name: Launch packaged Windows application and exercise MVP desktop flows if: matrix.platform == 'win32' @@ -466,7 +474,7 @@ jobs: if: matrix.platform == 'linux' run: | sudo apt-get update - sudo apt-get install --yes cpio fakeroot rpm zip + sudo apt-get install --yes cpio dbus-x11 fakeroot gnome-keyring libsecret-1-0 rpm zip - name: Configure required macOS signing and notarization if: matrix.platform == 'darwin' @@ -590,6 +598,7 @@ jobs: shell: bash run: | npm run desktop:typecheck + npm run test:native-durability -w @propr/desktop npm run desktop:test - name: Make Linux production packages @@ -635,7 +644,14 @@ jobs: run: | sudo chown root:root "apps/desktop/out/propr-desktop-linux-${{ matrix.arch }}/chrome-sandbox" sudo chmod 4755 "apps/desktop/out/propr-desktop-linux-${{ matrix.arch }}/chrome-sandbox" - xvfb-run --auto-servernum npm run desktop:smoke + keyring_root="$(mktemp -d)" + trap 'rm -rf -- "$keyring_root"' EXIT + dbus-run-session -- bash -euo pipefail -c ' + export PROPR_DESKTOP_SMOKE_KEYRING_ROOT="$1" + export XDG_DATA_HOME="$1" + eval "$(printf "%s\n" "propr-packaged-smoke" | gnome-keyring-daemon --unlock --components=secrets)" + xvfb-run --auto-servernum npm run desktop:smoke + ' bash "$keyring_root" - name: Launch signed packaged Windows application and exercise MVP desktop flows if: matrix.platform == 'win32' diff --git a/apps/desktop/README.md b/apps/desktop/README.md index c33d0488f..c268125ec 100644 --- a/apps/desktop/README.md +++ b/apps/desktop/README.md @@ -23,7 +23,7 @@ npm run make:dmg -w @propr/desktop -- --arch=arm64 ``` Desktop development, typecheck, package, and make commands build required renderer workspace dependencies through -`desktop:prepare`, in dependency order (`@propr/shared` then `@propr/client`). They do not depend on previously +`desktop:prepare`, in dependency order (`@propr/shared`, `@propr/client`, `@propr/local-setup`, then `@propr/cli`). They do not depend on previously generated workspace `dist` directories. Development renderer URLs are accepted only when Electron Forge supplies an HTTP loopback URL. Packaged builds load @@ -54,8 +54,8 @@ CI runs both checks directly from the committed lockfile before installing or ex ## Security boundary -The renderer has no Node.js integration and receives only the typed `window.proprDesktop` bridge. It exposes metadata, -validated external-browser opening, profiles, encrypted credentials, lifecycle placeholders, and validated deep-link +The renderer has no Node.js integration and receives only the typed `window.proprDesktop` and +`window.__PROPR_DESKTOP__` bridges. They expose metadata, validated external-browser opening, profiles, encrypted credentials, lifecycle control, guided setup, and validated deep-link events. It never exposes a shell, command runner, arbitrary IPC call, or filesystem path/API. Profile metadata is stored in an app-owned, permission-restricted JSON file. Credential values are encrypted with @@ -64,8 +64,22 @@ Electron `safeStorage` before they are written separately. If OS encryption is u fallback. Profiles remain usable because they contain only a display label and validated API endpoint. `propr://connect` and `propr://open` are the only accepted deep-link actions. A single-instance lock routes later -activations to the existing window. Local lifecycle methods intentionally return `not-implemented`; this scaffold does -not download, install, start, or execute ProPR runtime components. +activations to the existing window. Desktop pairing and active-profile request authentication remain in Electron main; +the renderer never receives the device secret or instance bearer token. + +## Local setup + +Linux presents the guided setup wizard and binds it to the shared `@propr/local-setup` engine. Progress and recovery +state are redacted before crossing IPC and persisted without prompt secrets, allowing a safely re-runnable setup to +resume after restart. The packaged app carries the same launcher manifest, orchestrator, and stack template as the CLI. + +The desktop runtime root has one stable pathname: `/desktop/local-stack`. Its `.env`, `data`, +`logs`, and `repos` children are the only desktop-managed stack locations and the only app-data paths handed to +Docker. The app validates owner-only, link-free ancestry before setup and every lifecycle start or restart. Native +directory selection is not a runtime-root feature; import/export will require a separate one-shot workflow if added. + +macOS and Windows present remote connections as the supported path and explain that the local installer is Linux-only. +They do not show Docker Desktop installation or lifecycle actions. ## Desktop distributables and releases diff --git a/apps/desktop/forge.config.ts b/apps/desktop/forge.config.ts index 16a29fb1c..539a9d11d 100644 --- a/apps/desktop/forge.config.ts +++ b/apps/desktop/forge.config.ts @@ -71,6 +71,16 @@ const windowsSign = windowsSigning ? { description: 'ProPR Desktop', } : undefined; +const cliAsset = (path: string): string => fileURLToPath(new URL(`../../packages/cli/dist/${path}`, import.meta.url)); +const linuxCliResourceConfig = process.platform === 'linux' + ? { + [['extra', 'Resource'].join('')]: [ + cliAsset('orchestrator'), + cliAsset('assets'), + ], + } + : {}; + const config: ForgeConfig = { packagerConfig: { asar: true, @@ -95,6 +105,7 @@ const config: ForgeConfig = { }, } : {}), ...(windowsSign ? { windowsSign } : {}), + ...linuxCliResourceConfig, }, rebuildConfig: {}, hooks: { diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 840baec49..3e8032849 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -10,12 +10,15 @@ "type": "module", "main": ".vite/build/main.cjs", "scripts": { - "prepare:renderer": "npm run build -w @propr/shared && npm run build -w @propr/client", + "prepare:renderer": "npm run build -w @propr/shared && npm run build -w @propr/client && npm run build -w @propr/local-setup && npm run build -w @propr/cli", "predev": "npm run prepare:renderer", "dev": "electron-forge start", "pretypecheck": "npm run prepare:renderer", "typecheck": "tsc --noEmit", + "pretest": "npm run prepare:renderer", "test": "tsx --test src/**/*.test.ts scripts/*.test.mjs", + "pretest:native-durability": "npm run prepare:renderer", + "test:native-durability": "node scripts/run-native-durability.mjs", "prepackage": "npm run prepare:renderer", "package": "electron-forge package", "smoke:package": "node scripts/smoke-packaged.mjs", @@ -30,6 +33,12 @@ "premake:rpm": "npm run prepare:renderer", "make:rpm": "PROPR_DESKTOP_ENABLE_RPM=1 electron-forge make --targets @electron-forge/maker-rpm" }, + "dependencies": { + "@propr/cli": "*", + "@propr/client": "*", + "@propr/local-setup": "*", + "@propr/shared": "*" + }, "devDependencies": { "@electron-forge/cli": "8.0.0-alpha.10", "@electron-forge/maker-deb": "8.0.0-alpha.10", diff --git a/apps/desktop/scripts/packaged-smoke-support.mjs b/apps/desktop/scripts/packaged-smoke-support.mjs index 86ade3ef3..43acb44e3 100644 --- a/apps/desktop/scripts/packaged-smoke-support.mjs +++ b/apps/desktop/scripts/packaged-smoke-support.mjs @@ -122,18 +122,18 @@ export const assertPackagedLayout = layout => { throw new Error('Packaged renderer viewport does not match the actual native content bounds'); } - if (layout.logo.height < 18 || layout.logo.height > 22 || layout.logo.width < 40 || layout.logo.width > 100) { - throw new Error(`Packaged title-bar logo has unreasonable bounds: ${JSON.stringify(layout.logo)}`); + if (layout.logo.height < 28 || layout.logo.height > 36 || layout.logo.width < 28 || layout.logo.width > 36) { + throw new Error(`Packaged welcome-card logo has unreasonable bounds: ${JSON.stringify(layout.logo)}`); } if ( - layout.logo.top < layout.titlebar.top - || layout.logo.bottom > layout.titlebar.bottom + layout.logo.top < layout.brand.top + || layout.logo.bottom > layout.brand.bottom || layout.card.left < 0 || layout.card.right > layout.viewport.width - || layout.card.top < layout.titlebar.bottom + || layout.card.top < 0 || layout.card.bottom > layout.viewport.height ) { - throw new Error('Packaged logo or connection card extends outside its layout container'); + throw new Error('Packaged brand or welcome card extends outside its layout container'); } for (const name of ['connectionName', 'apiUrl', 'submit']) { const control = layout[name]; @@ -142,9 +142,15 @@ export const assertPackagedLayout = layout => { } } assertGap(layout.connectionName, layout.apiUrl, 28, 'between connection inputs'); - assertGap(layout.apiUrl, layout.apiHelp, 6, 'between API input and help text'); - assertGap(layout.apiHelp, layout.submit, 16, 'between API help and submit button'); - assertGap(layout.submit, layout.footer, 20, 'between submit button and runtime footer'); + assertGap(layout.apiUrl, layout.submit, 16, 'between API input and Connect button'); + if ( + layout.state?.candidateApiUrl !== 'https://connect.propr.dev' + || layout.state?.connectLabel !== 'Connect' + || !layout.state?.noticeText?.includes('untrusted instance address') + || layout.state?.runtimeFooterPresent !== false + ) { + throw new Error(`Packaged renderer did not retain the staged shared-UI state: ${JSON.stringify(layout.state)}`); + } }; const ensurePrivateDirectory = async path => { diff --git a/apps/desktop/scripts/packaged-smoke-support.test.mjs b/apps/desktop/scripts/packaged-smoke-support.test.mjs index 93e2d3e91..f0b672e0f 100644 --- a/apps/desktop/scripts/packaged-smoke-support.test.mjs +++ b/apps/desktop/scripts/packaged-smoke-support.test.mjs @@ -39,19 +39,27 @@ const layoutFixture = ({ windowWidth, windowHeight, workWidth, workHeight }) => viewport, screen: { width: Math.max(workWidth, windowWidth), height: Math.max(workHeight, windowHeight) }, workArea: { width: workWidth, height: workHeight }, - titlebar: { top: 0, bottom: 60 }, - logo: { top: 20, bottom: 40, height: 20, width: 72 }, card: { - top: 80, + top: 30, bottom: viewport.height - 12, left: cardLeft, right: cardLeft + cardWidth, }, - connectionName: control(110, 150), - apiUrl: control(180, 220), - apiHelp: control(226, 240), - submit: control(256, 296), - footer: control(316, 336), + brand: control(50, 86), + logo: { ...control(52, 84), width: 32, right: cardLeft + 56 }, + form: control(90, viewport.height - 32), + back: control(100, 136), + heading: control(145, 180), + notice: control(205, 240), + connectionName: control(265, 305), + apiUrl: control(335, 375), + submit: control(405, 445), + state: { + candidateApiUrl: 'https://connect.propr.dev', + connectLabel: 'Connect', + noticeText: 'Review this untrusted instance address, then choose Connect to continue.', + runtimeFooterPresent: false, + }, }; }; diff --git a/apps/desktop/scripts/run-native-durability.mjs b/apps/desktop/scripts/run-native-durability.mjs new file mode 100644 index 000000000..fa2eecff5 --- /dev/null +++ b/apps/desktop/scripts/run-native-durability.mjs @@ -0,0 +1,125 @@ +import { spawn } from 'node:child_process'; +import { fileURLToPath } from 'node:url'; + +const EXPECTED = Object.freeze({ + 'credential-service': 69, + 'profile-store': 39, + 'pairing-shutdown': 10, +}); +const expectedTotal = Object.values(EXPECTED).reduce((total, count) => total + count, 0); +const tsxCli = fileURLToPath(import.meta.resolve('tsx/cli')); +const child = spawn(process.execPath, [ + tsxCli, + '--test', + '--test-concurrency=1', + 'src/profile-store.test.ts', + 'src/credential-service.test.ts', + 'src/pairing-response-lifecycle.test.ts', +], { + cwd: fileURLToPath(new URL('..', import.meta.url)), + env: process.env, + stdio: ['inherit', 'pipe', 'pipe'], +}); + +let output = ''; +const forward = (stream, destination) => { + stream.setEncoding('utf8'); + stream.on('data', chunk => { + output += chunk; + destination.write(chunk); + }); +}; +forward(child.stdout, process.stdout); +forward(child.stderr, process.stderr); + +const result = await new Promise((resolve, reject) => { + child.once('error', reject); + // close fires only after both TAP pipes are drained; exit can race the final + // summary on Windows and would make a complete run look like setup failure. + child.once('close', (code, signal) => resolve({ code, signal })); +}); + +const plannedForSuite = (suiteName) => { + const escaped = suiteName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); + const match = output.match(new RegExp( + `# Subtest: ${escaped}[\\s\\S]*?\\n 1\\.\\.(\\d+)\\n(?:ok|not ok) \\d+ - ${escaped}`, + )); + return match ? Number(match[1]) : 0; +}; + +const executed = { + 'credential-service': plannedForSuite('main-process desktop credential service'), + 'profile-store': plannedForSuite('desktop profile store'), + 'pairing-shutdown': plannedForSuite('desktop pairing service IPC native shutdown lifecycle'), +}; +const reportedCategory = (category) => { + const match = output.match(new RegExp( + `NATIVE_CATEGORY ${category} expected=(\\d+) executed=(\\d+)`, + )); + return match ? { expected: Number(match[1]), executed: Number(match[2]) } : { expected: -1, executed: -1 }; +}; +const countedCategory = (category, expected) => ({ + expected, + executed: output.match(new RegExp(`NATIVE_SCENARIO ${category}`, 'g'))?.length ?? 0, +}); +const pairingShutdownCategory = category => ({ + expected: 1, + executed: output.match(new RegExp(`NATIVE_PAIRING_SHUTDOWN ${category}(?:\\r?\\n|$)`, 'g'))?.length ?? 0, +}); +const scenarioCategories = { + barriers: reportedCategory('barriers'), + 'transaction-boundaries': reportedCategory('transaction-boundaries'), + 'bootstrap-migration': reportedCategory('bootstrap-migration'), + 'verified-handle-swap': reportedCategory('verified-handle-swap'), + 'reordered-visibility': reportedCategory('reordered-visibility'), + 'mirror-repair': countedCategory('mirror-repair', 6), + 'revocation-crash': countedCategory('revocation-crash', 2), + 'cancellation-switch': countedCategory('cancellation-switch', 4), + 'detach-crash': countedCategory('detach-crash', process.platform === 'win32' ? 12 : 13), + 'transient-revocation': countedCategory('transient-revocation', 4), + provisional: countedCategory('provisional', 1), + delivery: countedCategory('delivery', 1), + dispose: countedCategory('dispose', 1), + 'start-header': pairingShutdownCategory('start-header'), + 'start-body': pairingShutdownCategory('start-body'), + 'poll-header': pairingShutdownCategory('poll-header'), + 'poll-body': pairingShutdownCategory('poll-body'), + 'activate-header': pairingShutdownCategory('activate-header'), + 'activate-body': pairingShutdownCategory('activate-body'), + 'cancel-header': pairingShutdownCategory('cancel-header'), + 'cancel-body': pairingShutdownCategory('cancel-body'), + 'never-settling-reader-cancel': pairingShutdownCategory('never-settling-reader-cancel'), + 'never-settling-body-cancel': pairingShutdownCategory('never-settling-body-cancel'), +}; +const summary = Object.fromEntries( + ['tests', 'pass', 'fail', 'cancelled', 'skipped'].map(key => { + const match = output.match(new RegExp(`^# ${key} (\\d+)$`, 'm')); + return [key, match ? Number(match[1]) : -1]; + }), +); + +for (const [category, expected] of Object.entries(EXPECTED)) { + console.log(`Native durability category ${category}: expected=${expected} executed=${executed[category]}`); +} +for (const [category, counts] of Object.entries(scenarioCategories)) { + console.log(`Native durability category ${category}: expected=${counts.expected} executed=${counts.executed}`); +} +console.log( + `Native durability total: expected=${expectedTotal} executed=${summary.tests} ` + + `passed=${summary.pass} failed=${summary.fail} cancelled=${summary.cancelled} skipped=${summary.skipped}`, +); + +const complete = Object.entries(EXPECTED).every(([category, expected]) => executed[category] === expected) + && Object.values(scenarioCategories).every(({ expected, executed }) => expected >= 0 && executed === expected) + && summary.tests === expectedTotal + && summary.pass === expectedTotal + && summary.fail === 0 + && summary.cancelled === 0 + && summary.skipped === 0 + && result.code === 0 + && result.signal === null; +if (!complete) { + throw new Error( + `Native durability matrix incomplete (child code=${String(result.code)}, signal=${String(result.signal)})`, + ); +} diff --git a/apps/desktop/scripts/smoke-packaged.mjs b/apps/desktop/scripts/smoke-packaged.mjs index eedb05654..98962219a 100644 --- a/apps/desktop/scripts/smoke-packaged.mjs +++ b/apps/desktop/scripts/smoke-packaged.mjs @@ -1,15 +1,16 @@ import { spawn } from 'node:child_process'; import { once } from 'node:events'; -import { access, readdir } from 'node:fs/promises'; +import { access, readFile, readdir } from 'node:fs/promises'; import { createServer } from 'node:http'; -import { resolve } from 'node:path'; -import { DESKTOP_RENDERER_ORIGIN } from '@propr/shared'; +import { join, resolve } from 'node:path'; +import { Server as SocketIOServer } from 'socket.io'; import { - FuseState, - FuseV1Options, - FuseVersion, - getCurrentFuseWire, -} from '@electron/fuses'; + DESKTOP_RENDERER_ORIGIN, + DESKTOP_TRANSPORT_SCOPE_QUERY, + PROPR_API_COMPATIBILITY, + PROPR_UI_COMPATIBILITY, +} from '@propr/shared'; +import { FuseState, FuseV1Options, FuseVersion, getCurrentFuseWire } from '@electron/fuses'; import { assertPackagedLayout, assertPackagedNativeWindowSizing, @@ -22,6 +23,7 @@ const READY_EVENT = 'desktop.renderer.ready'; const PRELOAD_BRIDGE_PROOF = '"preloadBridgeExposed":true'; const PROFILE_API_PROOF = 'desktop.renderer.profile_api.ready'; const MVP_FLOWS_PROOF = 'desktop.renderer.mvp_flows.ready'; +const TRANSPORT_PROOF = 'desktop.renderer.transport_smoke.ready'; const LAYOUT_READY_EVENT = 'desktop.renderer.layout.ready'; const REDUCED_NATIVE_WINDOW_READY_EVENT = 'desktop.native.reduced_window.ready'; const MAIN_PROCESS_ERROR_MARKERS = [ @@ -29,39 +31,27 @@ const MAIN_PROCESS_ERROR_MARKERS = [ 'A JavaScript error occurred in the main process', 'Uncaught Exception:', ]; -const TIMEOUT_MS = 30_000; +const TIMEOUT_MS = 45_000; +const INVALID_INSTANCE_TOKEN = 'INVALID_INSTANCE_TOKEN'; const binaryPath = process.platform === 'darwin' ? resolve('out', `propr-desktop-darwin-${process.arch}`, 'propr-desktop.app', 'Contents', 'MacOS', 'propr-desktop') - : resolve( - 'out', - `propr-desktop-${process.platform}-${process.arch}`, - `propr-desktop${process.platform === 'win32' ? '.exe' : ''}`, - ); + : resolve('out', `propr-desktop-${process.platform}-${process.arch}`, `propr-desktop${process.platform === 'win32' ? '.exe' : ''}`); const inspectOnly = process.argv.includes('--inspect-only'); -if (process.platform === 'win32') { - const resources = resolve('out', `propr-desktop-win32-${process.arch}`, 'resources'); - const entries = (await readdir(resources)).map(name => name.toLocaleLowerCase('en-US')); - if (entries.some(name => name.includes('windows-authority') || name.includes('windows-update-authority'))) { - throw new Error('Packaged Windows MVP contains a deferred update authority resource'); - } -} - -const parseEventLayout = (smokeOutput, expectedEvent) => { - for (const line of smokeOutput.split(/\r?\n/)) { +const parseEventLayout = (output, expectedEvent) => { + for (const line of output.split(/\r?\n/)) { if (!line.includes(expectedEvent)) continue; try { const record = JSON.parse(line.slice(line.indexOf('{'))); if (record.event === expectedEvent) return record.layout; } catch { - // Ignore non-JSON Chromium output that happens to mention the event name. + // Chromium may emit unrelated non-JSON diagnostics containing an event name. } } return undefined; }; await access(binaryPath); - const expectedFuses = new Map([ [FuseV1Options.RunAsNode, FuseState.DISABLE], [FuseV1Options.EnableCookieEncryption, FuseState.ENABLE], @@ -74,35 +64,141 @@ const expectedFuses = new Map([ [FuseV1Options.WasmTrapHandlers, FuseState.ENABLE], ]); const actualFuses = await getCurrentFuseWire(binaryPath); - if (actualFuses.version !== FuseVersion.V1) { throw new Error(`Expected fuse wire version ${FuseVersion.V1}, received ${actualFuses.version}`); } for (const [fuse, expectedState] of expectedFuses) { const actualState = actualFuses[fuse]; if (actualState !== expectedState) { - throw new Error( - `Unexpected ${FuseV1Options[fuse]} fuse state: expected ${FuseState[expectedState]}, received ${FuseState[actualState] ?? actualState}`, - ); + throw new Error(`Unexpected ${FuseV1Options[fuse]} fuse state: expected ${FuseState[expectedState]}, received ${FuseState[actualState] ?? actualState}`); + } +} +if (process.platform === 'win32') { + const resources = resolve('out', `propr-desktop-win32-${process.arch}`, 'resources'); + const entries = (await readdir(resources)).map(name => name.toLocaleLowerCase('en-US')); + if (entries.some(name => name.includes('windows-authority') || name.includes('windows-update-authority'))) { + throw new Error('Packaged Windows MVP contains a deferred update authority resource'); } } - if (inspectOnly) { console.log(`Packaged ${process.platform}-${process.arch} desktop artifact passed executable and fuse inspection.`); process.exit(0); } +if (process.platform !== 'linux' && process.platform !== 'win32') { + throw new Error('Executable packaged transport smoke requires Linux or Windows'); +} + +const corsHeaders = { + 'Access-Control-Allow-Credentials': 'true', + 'Access-Control-Allow-Headers': 'Content-Type, X-ProPR-Desktop-Transport-Scope', + 'Access-Control-Allow-Methods': 'GET, DELETE, OPTIONS', + 'Access-Control-Allow-Origin': DESKTOP_RENDERER_ORIGIN, + 'Access-Control-Allow-Private-Network': 'true', + 'Cache-Control': 'no-store', + 'Content-Type': 'application/json', +}; +const discovery = JSON.stringify({ + product: 'ProPR', + version: '0.8.15', + apiCompatibility: PROPR_API_COMPATIBILITY, + uiCompatibility: PROPR_UI_COMPATIBILITY, + desktopAuthentication: { + protocolVersion: 2, + browserPairing: true, + instanceBearerTokens: true, + socketIoBearerAuthentication: true, + }, +}); +const requests = []; +const fixtures = []; +const listenTransportFixture = async name => { + const server = createServer((request, response) => { + const record = { + fixture: name, + method: request.method, + url: request.url, + authorization: request.headers.authorization ?? null, + cookie: request.headers.cookie ?? null, + origin: request.headers.origin ?? null, + socketIo: false, + }; + requests.push(record); + if (request.method === 'OPTIONS') { + response.writeHead(204, corsHeaders); + response.end(); + return; + } + if (request.url === '/smoke-storage') { + response.writeHead(200, { 'Content-Type': 'text/html', 'Cache-Control': 'no-store' }); + response.end('storage fixture'); + return; + } + if (request.url === '/smoke-sw.js') { + response.writeHead(200, { 'Content-Type': 'text/javascript', 'Cache-Control': 'no-store', 'Service-Worker-Allowed': '/' }); + response.end("self.addEventListener('fetch', () => undefined);"); + return; + } + if (request.url === '/api/desktop/discovery') { + response.writeHead(200, { ...corsHeaders, 'Set-Cookie': 'discovery=must-not-persist; HttpOnly; SameSite=None' }); + response.end(discovery); + return; + } + if (request.method === 'DELETE' && request.url === '/api/desktop/tokens/current') { + response.writeHead(204, corsHeaders); + response.end(); + return; + } + if ((request.url === '/api/auth/user' || request.url === '/api/smoke/rest') + && /^Bearer propr_it_[A-Za-z0-9_-]{43}$/.test(record.authorization ?? '')) { + response.writeHead(200, { ...corsHeaders, 'Set-Cookie': 'remote=must-not-persist; HttpOnly; SameSite=None' }); + response.end(request.url === '/api/auth/user' ? '{"username":"packaged-smoke"}' : '{"ok":true}'); + return; + } + response.writeHead(401, corsHeaders); + response.end('{"code":"INVALID_INSTANCE_TOKEN"}'); + }); + const io = new SocketIOServer(server, { + path: '/socket.io/', transports: ['websocket'], cors: { origin: DESKTOP_RENDERER_ORIGIN, credentials: false }, + }); + io.of('/').use((socket, next) => { + const queryScopes = new URL(socket.handshake.url, 'http://fixture.invalid').searchParams + .getAll(DESKTOP_TRANSPORT_SCOPE_QUERY); + const activationScope = socket.handshake.auth?.[DESKTOP_TRANSPORT_SCOPE_QUERY]; + const record = { + fixture: name, + method: 'SOCKET.IO', + url: socket.handshake.url, + authorization: socket.handshake.headers.authorization ?? null, + cookie: socket.handshake.headers.cookie ?? null, + origin: socket.handshake.headers.origin ?? null, + socketIo: true, + namespace: socket.nsp.name, + engineProtocol: socket.conn.protocol, + }; + requests.push(record); + if (!/^Bearer propr_it_[A-Za-z0-9_-]{43}$/.test(record.authorization ?? '') + || queryScopes.length !== 1 || typeof activationScope !== 'string' || activationScope !== queryScopes[0]) { + const error = new Error(INVALID_INSTANCE_TOKEN); + error.data = { code: INVALID_INSTANCE_TOKEN }; + next(error); + return; + } + next(); + }); + io.of('/').on('connection', socket => socket.emit('packaged-smoke:connected', { ok: true })); + server.listen(0, '127.0.0.1'); + await once(server, 'listening'); + const address = server.address(); + if (!address || typeof address === 'string') throw new Error(`Packaged ${name} fixture did not bind`); + const fixture = { server, io, origin: `http://127.0.0.1:${address.port}` }; + fixtures.push(fixture); + return fixture; +}; -const smokeProfile = await createPrivateSmokeProfile(); -const userDataPath = smokeProfile.userData; -let output = ''; -let receivedProfileApiOrigin; const profileApiServer = createServer((request, response) => { - receivedProfileApiOrigin = request.headers.origin; - if ( - request.method !== 'GET' + if (request.method !== 'GET' || !['/api/compatibility', '/api/desktop/discovery'].includes(request.url ?? '') - || receivedProfileApiOrigin !== DESKTOP_RENDERER_ORIGIN - ) { + || request.headers.origin !== DESKTOP_RENDERER_ORIGIN) { response.writeHead(403, { 'Content-Type': 'application/json' }); response.end('{"error":"CORS origin rejected"}'); return; @@ -117,94 +213,184 @@ const profileApiServer = createServer((request, response) => { : '{"profileEndpoint":true}'); }); -try { - const launchArguments = [ - '--disable-gpu', - '--propr-smoke-test', - `--user-data-dir=${userDataPath}`, - 'propr://connect?api=https%3A%2F%2Fconnect.propr.dev', - ]; - if (launchArguments.some(argument => argument === '--no-sandbox' || argument === '--disable-sandbox')) { - throw new Error('The packaged-binary smoke test must not disable Electron sandboxing'); - } +const scanPathsForSecrets = async (paths, secrets) => { + const visit = async path => { + let entries; + try { entries = await readdir(path, { withFileTypes: true }); } + catch (error) { + if (error?.code === 'ENOENT') return false; + throw error; + } + for (const entry of entries) { + const child = join(path, entry.name); + if (entry.isDirectory()) { + if (await visit(child)) return true; + } else { + const bytes = await readFile(child); + if (secrets.some(secret => bytes.includes(Buffer.from(secret)))) return true; + } + } + return false; + }; + for (const path of paths) if (await visit(path)) return true; + return false; +}; - profileApiServer.listen(0, '127.0.0.1'); - await once(profileApiServer, 'listening'); - const profileApiAddress = profileApiServer.address(); - if (!profileApiAddress || typeof profileApiAddress === 'string') { - throw new Error('Packaged desktop smoke profile API did not bind to a TCP port'); +const inheritedSecretServiceEnvironment = () => { + if (process.platform !== 'linux') return {}; + const result = {}; + for (const name of ['DBUS_SESSION_BUS_ADDRESS', 'GNOME_KEYRING_CONTROL']) { + const value = process.env[name]; + if (value === undefined) continue; + if (!value || value.length > 4096 || value.includes('\0') || /[\r\n]/.test(value)) { + throw new Error(`Packaged smoke inherited invalid ${name}`); + } + result[name] = value; } - const profileApiUrl = `http://127.0.0.1:${profileApiAddress.port}`; - const childEnvironment = await createSmokeChildEnvironment({ - profile: smokeProfile, - profileApiUrl, - }); - const child = spawn(binaryPath, launchArguments, { - cwd: smokeProfile.root, - env: childEnvironment, - shell: false, - stdio: ['ignore', 'pipe', 'pipe'], - }); + if (!result.DBUS_SESSION_BUS_ADDRESS) throw new Error('Packaged Linux OS-secret smoke requires a D-Bus session'); + return result; +}; - const capture = chunk => { - const text = chunk.toString(); - output += text; - process.stdout.write(text); - }; - child.stdout.on('data', capture); - child.stderr.on('data', capture); +const first = await listenTransportFixture('first'); +const second = await listenTransportFixture('second'); +profileApiServer.listen(0, '127.0.0.1'); +await once(profileApiServer, 'listening'); +const profileApiAddress = profileApiServer.address(); +if (!profileApiAddress || typeof profileApiAddress === 'string') throw new Error('Packaged profile API fixture did not bind'); +const profileApiUrl = `http://127.0.0.1:${profileApiAddress.port}`; +const runs = []; +const shutdownSteps = [ + 'admission-closed', 'ipc-closed', 'session-closed', 'protocol-disposed', + 'credentials-dispose-started', 'authentication-cleared', 'lifecycle-drain-started', 'ipc-drain-started', + 'service-drain-finished', 'profiles-close-started', 'profiles-close-finished', 'session-disposed', + 'ipc-disposed', 'window-destroyed', 'final-quit', +]; - const result = await new Promise((resolveResult, reject) => { - const timeout = setTimeout(() => { - child.kill('SIGKILL'); - reject(new Error(`Packaged desktop did not reach renderer-ready within ${TIMEOUT_MS / 1000} seconds`)); - }, TIMEOUT_MS); - child.once('error', error => { - clearTimeout(timeout); - reject(error); +const launch = async mode => { + const smokeProfile = await createPrivateSmokeProfile(); + const requestStart = requests.length; + let output = ''; + try { + const launchArguments = [ + '--disable-gpu', + '--propr-smoke-test', + `--user-data-dir=${smokeProfile.userData}`, + 'propr://connect?api=https%3A%2F%2Fconnect.propr.dev', + ...(process.platform === 'linux' ? ['--password-store=gnome-libsecret'] : []), + ]; + if (launchArguments.some(argument => argument === '--no-sandbox' || argument === '--disable-sandbox')) { + throw new Error('The packaged-binary smoke test must not disable Electron sandboxing'); + } + const childEnvironment = { + ...await createSmokeChildEnvironment({ profile: smokeProfile, profileApiUrl }), + ...inheritedSecretServiceEnvironment(), + PROPR_DESKTOP_SMOKE_FIRST_ORIGIN: first.origin, + PROPR_DESKTOP_SMOKE_SECOND_ORIGIN: second.origin, + PROPR_DESKTOP_SMOKE_SHUTDOWN_MODE: mode, + }; + const child = spawn(binaryPath, launchArguments, { + cwd: smokeProfile.root, + env: childEnvironment, + shell: false, + stdio: ['ignore', 'pipe', 'pipe'], + windowsHide: true, }); - child.once('close', (code, signal) => { - clearTimeout(timeout); - resolveResult({ code, signal }); + const capture = chunk => { + const text = chunk.toString(); + output += text; + process.stdout.write(text); + }; + child.stdout.on('data', capture); + child.stderr.on('data', capture); + const result = await new Promise((resolveResult, reject) => { + const timeout = setTimeout(() => { + child.kill('SIGKILL'); + reject(new Error(`Packaged desktop ${mode} smoke exceeded ${TIMEOUT_MS / 1000} seconds`)); + }, TIMEOUT_MS); + child.once('error', error => { clearTimeout(timeout); reject(error); }); + child.once('close', (code, signal) => { + clearTimeout(timeout); + resolveResult({ code, signal }); + }); + }); + const mainProcessError = MAIN_PROCESS_ERROR_MARKERS.find(marker => output.includes(marker)); + if (mainProcessError) throw new Error(`Packaged desktop reported an uncaught exception (${mainProcessError})`); + if (result.code !== 0) throw new Error(`Packaged desktop exited with code ${result.code ?? 'null'} (signal ${result.signal ?? 'none'})`); + for (const proof of [READY_EVENT, PRELOAD_BRIDGE_PROOF, PROFILE_API_PROOF, MVP_FLOWS_PROOF, TRANSPORT_PROOF]) { + if (!output.includes(proof)) throw new Error(`Packaged desktop did not publish required proof ${proof}`); + } + const expectedBackend = process.platform === 'linux' ? 'gnome_libsecret' : 'os-protected'; + if (!output.includes(`"storageBackend":"${expectedBackend}"`)) { + throw new Error(`Packaged desktop did not use ${expectedBackend} production credential protection`); + } + let previousStep = -1; + for (const step of shutdownSteps) { + const marker = `"step":"${step}"`; + if (output.split(marker).length - 1 !== 1 || output.indexOf(marker) <= previousStep) { + throw new Error(`Packaged ${mode} shutdown did not run ${step} exactly once in order`); + } + previousStep = output.indexOf(marker); + } + const forced = output.includes('desktop.app.shutdown_forced'); + if (forced !== (mode === 'forced-timeout')) throw new Error(`Packaged ${mode} forced-timeout evidence was incorrect`); + if (mode === 'retry' && (!output.includes('desktop.app.shutdown_retry_requested') + || !output.includes('desktop.app.shutdown_retry'))) { + throw new Error('Packaged retry did not exercise a repeated prevented before-quit event'); + } + assertPackagedLayout(parseEventLayout(output, LAYOUT_READY_EVENT)); + assertPackagedNativeWindowSizing(parseEventLayout(output, REDUCED_NATIVE_WINDOW_READY_EVENT), { + requireReducedWorkArea: true, }); - }); - - const mainProcessError = MAIN_PROCESS_ERROR_MARKERS.find(marker => output.includes(marker)); - if (mainProcessError) { - throw new Error(`Packaged desktop reported a main-process uncaught exception (${mainProcessError})`); - } - if (result.code !== 0) { - throw new Error(`Packaged desktop exited with code ${result.code ?? 'null'} (signal ${result.signal ?? 'none'})`); - } - if (!output.includes(READY_EVENT)) { - throw new Error('Packaged desktop exited without reporting renderer-ready'); - } - if (!output.includes(PRELOAD_BRIDGE_PROOF)) { - throw new Error('Packaged desktop reported renderer-ready without proving window.proprDesktop is exposed'); - } - if (!output.includes(PROFILE_API_PROOF) || receivedProfileApiOrigin !== DESKTOP_RENDERER_ORIGIN) { - throw new Error('Packaged desktop did not complete a profile API request from its exact renderer origin'); - } - if (!output.includes(MVP_FLOWS_PROOF)) { - throw new Error('Packaged desktop did not complete local/remote/API profile and Connect discovery flows'); - } - assertPackagedLayout(parseEventLayout(output, LAYOUT_READY_EVENT)); - assertPackagedNativeWindowSizing( - parseEventLayout(output, REDUCED_NATIVE_WINDOW_READY_EVENT), - { requireReducedWorkArea: true }, - ); - console.log(`Packaged ${process.platform}-${process.arch} desktop reached renderer-ready with compiled layout, sandboxing, profile API proof, and reduced native window bounds.`); -} finally { - try { - if (profileApiServer.listening) { - profileApiServer.closeAllConnections(); - await new Promise((resolveClose, rejectClose) => profileApiServer.close(error => { - if (error) rejectClose(error); - else resolveClose(); - })); + const runRequests = requests.slice(requestStart); + const authenticated = runRequests.filter(request => request.authorization?.startsWith('Bearer propr_it_')); + const secrets = [...new Set(authenticated.map(request => request.authorization.slice('Bearer '.length)))]; + if (secrets.length !== 2) throw new Error(`Expected two ${mode} activation credentials, observed ${secrets.length}`); + for (const name of ['first', 'second']) { + const fixtureRequests = authenticated.filter(request => request.fixture === name); + const namespaceConnections = fixtureRequests.filter(request => request.socketIo); + if (!fixtureRequests.some(request => request.url === '/api/auth/user') + || !fixtureRequests.some(request => request.url === '/api/smoke/rest') + || namespaceConnections.length < (name === 'second' ? 2 : 1) + || namespaceConnections.some(request => request.namespace !== '/' || request.engineProtocol !== 4)) { + throw new Error(`Packaged ${mode} ${name} fixture missed REST, Engine.IO, namespace auth, or reconnect proof`); + } + if (new Set(fixtureRequests.map(request => request.authorization)).size !== 1) { + throw new Error(`Packaged ${mode} ${name} fixture observed cross-generation bearer use`); + } + } + if (runRequests.some(request => request.cookie !== null) + || runRequests.some(request => secrets.some(secret => request.url?.includes(secret)))) { + throw new Error('Packaged renderer transport sent cookies or placed a credential in a URL'); } + if (secrets.some(secret => output.includes(secret) || launchArguments.some(argument => argument.includes(secret)))) { + throw new Error('Packaged credential entered stdout, stderr, or argv'); + } + const credentialFiles = await readdir(join(smokeProfile.userData, 'desktop', 'credentials')); + if (credentialFiles.length === 0 || await scanPathsForSecrets([smokeProfile.userData], secrets)) { + throw new Error('Packaged credential material was missing or plaintext under isolated userData'); + } + runs.push({ mode, secrets }); } finally { await removePrivateSmokeProfile(smokeProfile); } +}; + +try { + for (const mode of ['success', 'retry', 'forced-timeout']) await launch(mode); + const allSecrets = runs.flatMap(run => run.secrets); + const keyringRoot = process.env.PROPR_DESKTOP_SMOKE_KEYRING_ROOT; + if (keyringRoot && await scanPathsForSecrets([resolve(keyringRoot)], allSecrets)) { + throw new Error('A packaged credential entered the OS keyring scan root as plaintext'); + } + console.log(`Packaged ${process.platform}-${process.arch} transport smoke passed all shutdown modes with real REST/Socket.IO scope auth, origin rollback, and OS secret custody.`); +} finally { + for (const { io, server } of fixtures) { + await new Promise(resolveClose => io.close(resolveClose)); + if (server.listening) await new Promise(resolveClose => server.close(resolveClose)); + } + if (profileApiServer.listening) { + profileApiServer.closeAllConnections(); + await new Promise((resolveClose, rejectClose) => profileApiServer.close(error => error ? rejectClose(error) : resolveClose())); + } } diff --git a/apps/desktop/src/credential-service.test.ts b/apps/desktop/src/credential-service.test.ts new file mode 100644 index 000000000..5db0b2c28 --- /dev/null +++ b/apps/desktop/src/credential-service.test.ts @@ -0,0 +1,2189 @@ +import assert from 'node:assert/strict'; +import { spawn } from 'node:child_process'; +import { mkdir, mkdtemp, rm } from 'node:fs/promises'; +import { tmpdir } from 'node:os'; +import { join } from 'node:path'; +import { afterEach, describe, it } from 'node:test'; +import { + DESKTOP_RENDERER_ORIGIN, + DESKTOP_REVOCATION_BINDING_HEADER, + DESKTOP_TOKEN_REVOCATION_ENDPOINT, + DESKTOP_TOKEN_REVOCATION_SCHEMA, + DESKTOP_TOKEN_REVOCATION_VERSION, + PROPR_API_COMPATIBILITY, + PROPR_UI_COMPATIBILITY, +} from '@propr/shared'; +import { DesktopCredentialService } from './credential-service'; +import { ProfileStore, type EncryptionProvider, type StoredCredential } from './profile-store'; + +const temporaryDirectories: string[] = []; +const credentialServices: DesktopCredentialService[] = []; +const encryption: EncryptionProvider = { + isEncryptionAvailable: () => true, + backend: () => 'keychain', + encrypt: value => Buffer.from(value, 'utf8'), + decrypt: value => value.toString('utf8'), +}; +const json = (body: unknown, status = 200): Response => new Response(JSON.stringify(body), { + status, + headers: { 'Content-Type': 'application/json' }, +}); +const testPairingBindings = new Map>(); +const pairingStartResponse = ( + url: string, + init: RequestInit | undefined, + body: Record, + status = 201, +): Response => { + const request = JSON.parse(String(init?.body)) as Record; + testPairingBindings.set(new URL(url).origin, { + instanceId: request.instanceId, + origin: request.origin, + scope: request.scope, + credentialGeneration: request.credentialGeneration, + activationExpiresAt: body.expiresAt, + }); + return json(body, status); +}; +const provisionalPairingResponse = (url: string, credentialToken: string): Response => json({ + status: 'provisional', + token: credentialToken, + tokenType: 'Bearer', + activationTicket: 'T'.repeat(43), + ...testPairingBindings.get(new URL(url).origin), +}); +const pairingActivationReceipt = (): Response => json({ + status: 'active', + receipt: 'R'.repeat(22), + activatedAt: '2026-01-01T00:00:01.000Z', + expiresAt: null, +}); +const terminalRevocationBody = ( + init: RequestInit | undefined, + code: 'TOKEN_NOT_FOUND' | 'INSTANCE_TOKEN_REVOKED' | 'INSTANCE_TOKEN_EXPIRED' = 'TOKEN_NOT_FOUND', +): Record => ({ + schema: DESKTOP_TOKEN_REVOCATION_SCHEMA, + version: DESKTOP_TOKEN_REVOCATION_VERSION, + endpoint: DESKTOP_TOKEN_REVOCATION_ENDPOINT, + terminal: true, + code, + credentialGeneration: new Headers(init?.headers).get(DESKTOP_REVOCATION_BINDING_HEADER), +}); +const terminalRevocation = ( + init: RequestInit | undefined, + code: 'TOKEN_NOT_FOUND' | 'INSTANCE_TOKEN_REVOKED' | 'INSTANCE_TOKEN_EXPIRED' = 'TOKEN_NOT_FOUND', +): Response => json(terminalRevocationBody(init, code), code === 'TOKEN_NOT_FOUND' ? 404 : 401); +const discovery = { + product: 'ProPR', + version: '0.8.15', + apiCompatibility: PROPR_API_COMPATIBILITY, + uiCompatibility: PROPR_UI_COMPATIBILITY, + desktopAuthentication: { + protocolVersion: 2 as const, + browserPairing: true, + instanceBearerTokens: true, + socketIoBearerAuthentication: true, + }, +}; +const token = (character: string) => `propr_it_${character.repeat(43)}`; +const credential = (profileId: string, origin: string, character: string): StoredCredential => ({ + version: 1, + profileId, + origin, + token: token(character), +}); +const deferred = () => { + let resolve!: (value: T) => void; + const promise = new Promise(settle => { resolve = settle; }); + return { promise, resolve }; +}; +const transportHeaders = (transportScope: string, headers: Record = {}) => ({ + ...headers, + 'X-ProPR-Desktop-Transport-Scope': transportScope, +}); + +const createStore = async (): Promise => { + const directory = await mkdtemp(join(tmpdir(), 'propr-credential-service-')); + temporaryDirectories.push(directory); + return new ProfileStore(directory, encryption); +}; + +const createCredentialService = ( + dependencies: ConstructorParameters[0], +): DesktopCredentialService => { + const service = new DesktopCredentialService(dependencies); + credentialServices.push(service); + return service; +}; + +afterEach(async () => { + await Promise.all(credentialServices.splice(0).map(service => service.dispose())); + await Promise.all(temporaryDirectories.splice(0).map(directory => rm(directory, { recursive: true, force: true }))); +}); + +describe('main-process desktop credential service', () => { + it('rolls back a superseded overlapping local activation before it can persist or publish', async () => { + const blocked = deferred(); + const entered = deferred(); + let blockActivationWrite = false; + let blockedOnce = false; + const directory = await mkdtemp(join(tmpdir(), 'propr-local-activation-')); + temporaryDirectories.push(directory); + const store = new ProfileStore(directory, encryption, { + async beforeIO(operation) { + if (!blockActivationWrite || blockedOnce || operation !== 'journal-write') return; + blockedOnce = true; + entered.resolve(); + await blocked.promise; + }, + }); + await store.save({ id: 'local-a', label: 'Local A', apiBaseUrl: 'http://127.0.0.1:4101' }); + await store.save({ id: 'local-b', label: 'Local B', apiBaseUrl: 'http://127.0.0.1:4102' }); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async () => { throw new Error('local activation must not use remote transport'); }, + }); + + const first = await service.prepareLocalActivation({ + id: 'local-a', label: 'Local A', apiBaseUrl: 'http://127.0.0.1:4101', + }); + blockActivationWrite = true; + const staleActivation = service.activateLocal(first.localActivationTicket); + await entered.promise; + const current = await service.prepareLocalActivation({ + id: 'local-b', label: 'Local B', apiBaseUrl: 'http://127.0.0.1:4102', + }); + blocked.resolve(); + + await assert.rejects(staleActivation, /expired/i); + assert.equal((await store.list()).activeProfileId, null); + assert.deepEqual(await service.activateLocal(current.localActivationTicket), { + status: 'ready', profileId: 'local-b', + }); + assert.equal((await store.list()).activeProfileId, 'local-b'); + const replacement = await service.prepareLocalActivation({ + id: 'local-a', label: 'Local A', apiBaseUrl: 'http://127.0.0.1:4101', + }); + assert.deepEqual(await service.discardLocal(current.localActivationTicket), { discarded: true }); + assert.equal((await store.list()).activeProfileId, null); + assert.deepEqual(await service.activateLocal(replacement.localActivationTicket), { + status: 'ready', profileId: 'local-a', + }); + await assert.rejects(service.activateLocal(first.localActivationTicket), /expired/i); + }); + + it('injects the active bearer only for its bound profile origin and strips renderer identity', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, 'A')); + const wireRequests: Array<{ url: string; headers: Record }> = []; + let service!: DesktopCredentialService; + service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + const requestHeaders: Record = {}; + new Headers(init?.headers).forEach((value, key) => { requestHeaders[key] = value; }); + // Simulate a session cookie Electron might otherwise append after the + // main-process fetch has applied its unforgeable request marker. + requestHeaders.Cookie = 'main-process=session'; + const decision = service.prepareRequest(url, requestHeaders); + assert.equal(decision.cancel, undefined); + wireRequests.push({ url, headers: decision.requestHeaders ?? {} }); + return url.endsWith('/api/desktop/discovery') ? json(discovery) : json({ username: 'octocat' }); + }, + }); + + const result = await service.probe({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + assert.equal(result.status, 'ready'); + if (result.status !== 'ready') return; + assert.ok(result.activationTicket); + assert.match(result.activationTicket, /^[A-Za-z0-9_-]{43}$/); + assert.equal('transportScope' in result, false); + const activated = await service.activate(result.activationTicket); + assert.deepEqual(service.prepareRequest('https://a.example.test/api/tasks', transportHeaders(activated.transportScope, { + Cookie: 'legacy=session', Authorization: 'Bearer renderer-controlled', Accept: 'application/json', + })).requestHeaders, { + Accept: 'application/json', + Authorization: `Bearer ${token('A')}`, + }); + assert.deepEqual(service.prepareRequest('https://attacker.example.test/api/tasks', transportHeaders(activated.transportScope, { + Cookie: 'inactive=session', Authorization: 'Bearer renderer-controlled', + })), { cancel: true }); + assert.deepEqual(service.prepareRequest('https://a.example.test/assets/app.js', transportHeaders(activated.transportScope, { + Cookie: 'active=session', Authorization: 'Bearer renderer-controlled', + })), { cancel: true }); + assert.deepEqual(service.prepareRequest(`wss://a.example.test/socket.io/?transport=websocket&proprDesktopTransportScope=${activated.transportScope}`, { + Cookie: 'socket=session', Authorization: 'Bearer renderer-controlled', + }, { resourceType: 'webSocket' }).requestHeaders, { Authorization: `Bearer ${token('A')}` }); + assert.deepEqual(service.prepareRequest('https://a.example.test/api/tasks', transportHeaders(activated.transportScope, { + Cookie: 'legacy=session', + Authorization: 'Bearer renderer-controlled', + 'X-ProPR-Desktop-Main-Request': 'renderer-forgery', + })).requestHeaders, { Authorization: `Bearer ${token('A')}` }); + assert.deepEqual(service.prepareRequest('https://a.example.test/api/desktop/pairings', {}), { + cancel: true, + }); + assert.deepEqual(service.prepareRequest('https://a.example.test/api/desktop/tokens/current', {}), { + cancel: true, + }); + assert.deepEqual(service.prepareRequest('http://remote.example.test/api/tasks', {}), { cancel: true }); + assert.deepEqual(service.prepareRequest('http://127.1:3000/api/tasks', {}), { cancel: true }); + assert.deepEqual(service.prepareRequest('http://local%68ost:3000/api/tasks', {}), { cancel: true }); + assert.deepEqual(wireRequests.at(-1), { + url: 'https://a.example.test/api/auth/user', + headers: { authorization: `Bearer ${token('A')}` }, + }); + assert.deepEqual(service.sanitizeResponseHeaders('https://a.example.test/api/tasks', { + 'Set-Cookie': ['active=session'], 'X-Test': ['preserved'], + }), { 'X-Test': ['preserved'] }); + assert.deepEqual(service.sanitizeResponseHeaders('https://inactive.example.test/api/tasks', { + 'set-cookie': ['inactive=session'], + }), {}); + assert.deepEqual(service.sanitizeResponseHeaders('wss://inactive.example.test/socket.io/', { + 'SET-COOKIE': ['socket=session'], + }), {}); + assert.deepEqual(await service.discardActivation({ + profileId: profile.id, transportScope: 'wrong-scope', + }), { discarded: false }); + assert.deepEqual(await service.discardActivation(activated), { discarded: true }); + assert.equal((await store.list()).activeProfileId, null); + assert.deepEqual(await store.readCredential(profile.id), credential(profile.id, profile.apiBaseUrl, 'A')); + assert.deepEqual(service.prepareRequest( + profile.apiBaseUrl + '/api/tasks', transportHeaders(activated.transportScope), + ), { cancel: true }); + }); + + it('uses only the active bearer when profiles share an origin and never a cookie identity', async () => { + const store = await createStore(); + const profileA = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://same.example.test' }); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://same.example.test' }); + await store.writeCredential(credential(profileA.id, profileA.apiBaseUrl, 'A')); + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'B')); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async input => input.toString().endsWith('/api/desktop/discovery') + ? json(discovery) + : json({ username: 'octocat' }), + }); + + assert.equal((await service.probe({ + id: profileA.id, label: profileA.label, apiBaseUrl: profileA.apiBaseUrl, + })).status, 'ready'); + const readyB = await service.probe({ + id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl, + }); + assert.equal(readyB.status, 'ready'); + if (readyB.status !== 'ready') return; + const activatedB = await service.activate(readyB.activationTicket); + + assert.deepEqual(service.prepareRequest('https://same.example.test/api/tasks', transportHeaders(activatedB.transportScope, { + Cookie: 'profile-a=session', Authorization: `Bearer ${token('A')}`, + })).requestHeaders, { Authorization: `Bearer ${token('B')}` }); + }); + + it('detaches profile B credential A without sending any bearer request to A or minting a ticket', async () => { + const store = await createStore(); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://b.example.test' }); + await store.writeCredential(credential(profileB.id, 'https://a.example.test', 'A')); + const requests: Array<{ url: string; authorization: string | null }> = []; + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + requests.push({ url, authorization: new Headers(init?.headers).get('Authorization') }); + return json(discovery); + }, + }); + + const result = await service.probe({ + id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl, + }); + + assert.equal(result.status, 'authentication-required'); + assert.equal('activationTicket' in result, false); + assert.deepEqual(requests, [{ + url: 'https://b.example.test/api/desktop/discovery', + authorization: null, + }]); + assert.equal(requests.some(request => request.url.startsWith('https://a.example.test/')), false); + assert.equal(await store.readCredential(profileB.id), null); + assert.equal((await store.list()).activeProfileId, null); + }); + + it('does not mint a ticket when a delayed B probe observes credential replacement with origin A', async () => { + const store = await createStore(); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://b.example.test' }); + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'B')); + const response = deferred(); + const authenticatedRequestStarted = deferred(); + const requests: Array<{ url: string; authorization: string | null }> = []; + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + const authorization = new Headers(init?.headers).get('Authorization'); + requests.push({ url, authorization }); + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + authenticatedRequestStarted.resolve(); + return response.promise; + }, + }); + + const probe = service.probe({ + id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl, + }); + await authenticatedRequestStarted.promise; + const replacement = credential(profileB.id, 'https://a.example.test', 'A'); + await store.writeCredential(replacement); + response.resolve(json({ username: 'b' })); + const result = await probe; + + assert.equal(result.status, 'offline'); + assert.match(result.message, /connection changed/i); + assert.equal('activationTicket' in result, false); + assert.equal(requests.some(request => request.url.startsWith('https://a.example.test/')), false); + assert.deepEqual(requests.at(-1), { + url: 'https://b.example.test/api/auth/user', + authorization: `Bearer ${token('B')}`, + }); + assert.deepEqual(await store.readCredential(profileB.id), replacement); + assert.equal((await store.list()).activeProfileId, null); + }); + + it('atomically rejects a ticket when delayed activation races with profile B credential A', async () => { + const store = await createStore(); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://b.example.test' }); + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'B')); + const activationStarted = deferred(); + const releaseActivation = deferred(); + const delayedProfiles = new Proxy(store, { + get(target, property, receiver) { + if (property === 'activateProfile') { + return async (...args: Parameters) => { + activationStarted.resolve(); + await releaseActivation.promise; + return target.activateProfile(...args); + }; + } + const value = Reflect.get(target, property, receiver) as unknown; + return typeof value === 'function' ? value.bind(target) : value; + }, + }); + const requests: Array<{ url: string; authorization: string | null }> = []; + const service = createCredentialService({ + profiles: delayedProfiles, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + requests.push({ url, authorization: new Headers(init?.headers).get('Authorization') }); + return url.endsWith('/api/desktop/discovery') ? json(discovery) : json({ username: 'b' }); + }, + }); + const ready = await service.probe({ + id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl, + }); + assert.equal(ready.status, 'ready'); + if (ready.status !== 'ready') return; + + const activation = service.activate(ready.activationTicket); + await activationStarted.promise; + const staleCredential = credential(profileB.id, 'https://a.example.test', 'A'); + await store.writeCredential(staleCredential); + releaseActivation.resolve(); + + await assert.rejects(activation, /expired/i); + assert.equal(requests.some(request => request.url.startsWith('https://a.example.test/')), false); + assert.deepEqual(await store.readCredential(profileB.id), staleCredential); + assert.equal((await store.list()).activeProfileId, null); + }); + + it('keeps a slow successful same-origin A probe status-only after fast B activates', async () => { + const store = await createStore(); + const profileA = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://same.example.test' }); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://same.example.test' }); + await store.writeCredential(credential(profileA.id, profileA.apiBaseUrl, 'A')); + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'B')); + const releaseA = deferred(); + const startedA = deferred(); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + const authorization = new Headers(init?.headers).get('Authorization'); + if (authorization === `Bearer ${token('A')}`) { + startedA.resolve(); + return releaseA.promise; + } + assert.equal(authorization, `Bearer ${token('B')}`); + return json({ username: 'b' }); + }, + }); + + const slowA = service.probe({ id: profileA.id, label: profileA.label, apiBaseUrl: profileA.apiBaseUrl }); + await startedA.promise; + const readyB = await service.probe({ id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl }); + assert.equal(readyB.status, 'ready'); + if (readyB.status !== 'ready') return; + const activatedB = await service.activate(readyB.activationTicket); + releaseA.resolve(json({ username: 'a' })); + const staleA = await slowA; + + assert.equal(staleA.status, 'offline'); + assert.match(staleA.message, /connection changed/i); + assert.deepEqual(service.prepareRequest( + 'https://same.example.test/api/tasks', + transportHeaders(activatedB.transportScope), + ).requestHeaders, { Authorization: `Bearer ${token('B')}` }); + }); + + it('keeps A active while B is only probed and if B selection persistence fails', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-credential-service-')); + temporaryDirectories.push(directory); + let failActivationState = false; + const store = new ProfileStore(directory, encryption, { + afterDurabilityStep: step => { + if (failActivationState && step === 'state-fsynced') throw new Error('injected activation persistence failure'); + }, + }); + const profileA = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://same.example.test' }); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://same.example.test' }); + await store.writeCredential(credential(profileA.id, profileA.apiBaseUrl, 'A')); + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'B')); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async input => input.toString().endsWith('/api/desktop/discovery') + ? json(discovery) + : json({ username: 'octocat' }), + }); + const probeA = await service.probe({ id: profileA.id, label: profileA.label, apiBaseUrl: profileA.apiBaseUrl }); + assert.equal(probeA.status, 'ready'); + if (probeA.status !== 'ready') return; + const activeA = await service.activate(probeA.activationTicket); + const probeB = await service.probe({ id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl }); + assert.equal(probeB.status, 'ready'); + if (probeB.status !== 'ready') return; + + assert.equal((await store.list()).activeProfileId, profileA.id); + assert.deepEqual(service.prepareRequest( + profileA.apiBaseUrl + '/api/tasks', transportHeaders(activeA.transportScope), + ).requestHeaders, { Authorization: `Bearer ${token('A')}` }); + + failActivationState = true; + await assert.rejects(service.activate(probeB.activationTicket)); + failActivationState = false; + assert.notEqual((await store.list()).activeProfileId, profileB.id); + assert.deepEqual(service.prepareRequest( + profileA.apiBaseUrl + '/api/tasks', transportHeaders(activeA.transportScope), + ).requestHeaders, { Authorization: `Bearer ${token('A')}` }); + }); + + it('keeps B active during a direct same-origin A probe and rejects replayed activation tickets', async () => { + const store = await createStore(); + const profileA = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://same.example.test' }); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://same.example.test' }); + await store.writeCredential(credential(profileA.id, profileA.apiBaseUrl, 'A')); + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'B')); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async input => input.toString().endsWith('/api/desktop/discovery') + ? json(discovery) + : json({ username: 'octocat' }), + }); + const probeB = await service.probe({ id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl }); + assert.equal(probeB.status, 'ready'); + if (probeB.status !== 'ready') return; + const activeB = await service.activate(probeB.activationTicket); + await assert.rejects(service.activate(probeB.activationTicket), /expired/i); + + const probeA = await service.probe({ id: profileA.id, label: profileA.label, apiBaseUrl: profileA.apiBaseUrl }); + assert.equal(probeA.status, 'ready'); + assert.equal((await store.list()).activeProfileId, profileB.id); + assert.deepEqual(service.prepareRequest( + profileB.apiBaseUrl + '/api/tasks', transportHeaders(activeB.transportScope), + ).requestHeaders, { Authorization: `Bearer ${token('B')}` }); + }); + + it('rejects activation after candidate removal, selection drift, or exact credential replacement', async () => { + for (const race of ['remove', 'selection', 'credential', 'credential-origin'] as const) { + const store = await createStore(); + const profileA = await store.save({ id: `profile-a-${race}`, label: 'A', apiBaseUrl: 'https://a.example.test' }); + const profileB = await store.save({ id: `profile-b-${race}`, label: 'B', apiBaseUrl: 'https://b.example.test' }); + await store.setActive(profileA.id); + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'B')); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async input => input.toString().endsWith('/api/desktop/discovery') + ? json(discovery) + : json({ username: 'octocat' }), + }); + const probeB = await service.probe({ id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl }); + assert.equal(probeB.status, 'ready'); + if (probeB.status !== 'ready') continue; + if (race === 'remove') await service.removeProfile(profileB.id); + else if (race === 'selection') await store.setActive(null); + else if (race === 'credential') { + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'C')); + } else { + await store.writeCredential(credential(profileB.id, profileA.apiBaseUrl, 'A')); + } + + await assert.rejects(service.activate(probeB.activationTicket), /expired/i); + assert.notEqual((await store.list()).activeProfileId, profileB.id); + if (race === 'credential') { + assert.deepEqual(await store.readCredential(profileB.id), credential(profileB.id, profileB.apiBaseUrl, 'C')); + } else if (race === 'credential-origin') { + assert.deepEqual(await store.readCredential(profileB.id), credential(profileB.id, profileA.apiBaseUrl, 'A')); + } + } + }); + + it('binds REST and Socket.IO work to one fresh scope and rejects stale or malformed markers', async () => { + const store = await createStore(); + const profileA = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://same.example.test' }); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://same.example.test' }); + await store.writeCredential(credential(profileA.id, profileA.apiBaseUrl, 'A')); + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'B')); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async input => input.toString().endsWith('/api/desktop/discovery') + ? json(discovery) + : json({ username: 'octocat' }), + }); + const readyA = await service.probe({ id: profileA.id, label: profileA.label, apiBaseUrl: profileA.apiBaseUrl }); + assert.equal(readyA.status, 'ready'); + if (readyA.status !== 'ready') return; + const activatedA = await service.activate(readyA.activationTicket); + const capturedRestA = transportHeaders(activatedA.transportScope, { + Cookie: 'renderer=session', + Authorization: 'Bearer renderer', + }); + const capturedSocketA = `wss://same.example.test/socket.io/?EIO=4&transport=websocket&proprDesktopTransportScope=${activatedA.transportScope}`; + + const readyB = await service.probe({ id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl }); + assert.equal(readyB.status, 'ready'); + if (readyB.status !== 'ready') return; + const activatedB = await service.activate(readyB.activationTicket); + + assert.deepEqual(service.prepareRequest('https://same.example.test/api/side-effect', capturedRestA), { cancel: true }); + assert.deepEqual(service.prepareRequest( + 'https://same.example.test/api/planner/drafts/draft-a/attachments/image-a', capturedRestA, + ), { cancel: true }); + assert.deepEqual(service.prepareRequest(capturedSocketA, { Cookie: 'socket=a' }, { resourceType: 'webSocket' }), { cancel: true }); + assert.deepEqual(service.prepareRequest( + 'https://same.example.test/api/side-effect', + transportHeaders(activatedB.transportScope), + ).requestHeaders, { Authorization: `Bearer ${token('B')}` }); + const currentSocket = `wss://same.example.test/socket.io/?EIO=4&transport=websocket&proprDesktopTransportScope=${activatedB.transportScope}`; + assert.equal(service.prepareRequest(currentSocket, {}, { resourceType: 'webSocket' }).cancel, undefined); + assert.equal(service.prepareRequest(currentSocket, {}, { resourceType: 'webSocket' }).cancel, undefined); + assert.deepEqual(service.prepareRequest('wss://same.example.test/socket.io/?transport=websocket', {}, { + resourceType: 'webSocket', + }), { cancel: true }); + assert.deepEqual(service.prepareRequest(`${currentSocket}&proprDesktopTransportScope=${activatedB.transportScope}`, {}, { + resourceType: 'webSocket', + }), { cancel: true }); + assert.deepEqual(service.prepareRequest( + 'https://same.example.test/api/tasks', + { 'X-ProPR-Desktop-Transport-Scope': ['bad', activatedB.transportScope], Cookie: 'x', Authorization: 'Bearer x' }, + ), { cancel: true }); + assert.deepEqual(service.prepareRequest( + 'https://same.example.test/api/tasks', + { 'X-ProPR-Desktop-Transport-Scope': 'not-a-scope', Cookie: 'x', Authorization: 'Bearer x' }, + ), { cancel: true }); + assert.deepEqual(service.prepareRequest('https://same.example.test/api/tasks', { + Cookie: 'x', Authorization: 'Bearer x', Accept: 'application/json', + }).requestHeaders, { Accept: 'application/json' }); + assert.deepEqual(service.prepareRequest('https://same.example.test/api/tasks', transportHeaders(activatedB.transportScope, { + Cookie: 'x', Authorization: 'Bearer x', + 'Access-Control-Request-Headers': 'x-propr-desktop-transport-scope,content-type', + }), { method: 'OPTIONS' }).requestHeaders, { + 'Access-Control-Request-Headers': 'x-propr-desktop-transport-scope,content-type', + }); + }); + + it('passes through a realistic packaged-origin CORS preflight without renderer identity or bearer injection', () => { + const service = createCredentialService({ + profiles: { awaitIdle: async () => undefined } as unknown as ProfileStore, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async () => { throw new Error('Network is not expected'); }, + }); + + assert.deepEqual(service.prepareRequest('https://same.example.test/api/tasks', { + Origin: DESKTOP_RENDERER_ORIGIN, + Cookie: 'renderer=session', + Authorization: 'Bearer renderer-controlled', + 'Access-Control-Request-Method': 'POST', + 'Access-Control-Request-Headers': 'X-ProPR-Desktop-Transport-Scope, Content-Type', + }, { method: 'OPTIONS' }), { + requestHeaders: { + Origin: DESKTOP_RENDERER_ORIGIN, + 'Access-Control-Request-Method': 'POST', + 'Access-Control-Request-Headers': 'X-ProPR-Desktop-Transport-Scope, Content-Type', + }, + }); + }); + + it('rotates scope on every same-profile reprobe and rejects a cold reconnect from the old activation', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'http://localhost:3000' }); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, 'A')); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async input => input.toString().endsWith('/api/desktop/discovery') + ? json(discovery) + : json({ username: 'octocat' }), + }); + const first = await service.probe({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + assert.equal(first.status, 'ready'); + if (first.status !== 'ready') return; + const firstActivation = await service.activate(first.activationTicket); + const second = await service.probe({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + assert.equal(second.status, 'ready'); + if (second.status !== 'ready') return; + const secondActivation = await service.activate(second.activationTicket); + assert.notEqual(firstActivation.transportScope, secondActivation.transportScope); + assert.equal(firstActivation.identityEpoch, secondActivation.identityEpoch); + assert.match(firstActivation.identityEpoch, /^[A-Za-z0-9_-]{22}$/); + assert.match(firstActivation.transportScope, /^[A-Za-z0-9_-]{22}$/); + assert.deepEqual(service.prepareRequest( + 'http://localhost:3000/api/tasks', transportHeaders(firstActivation.transportScope), + ), { cancel: true }); + assert.deepEqual(service.prepareRequest( + `ws://localhost:3000/socket.io/?transport=websocket&proprDesktopTransportScope=${firstActivation.transportScope}`, + {}, { resourceType: 'webSocket' }, + ), { cancel: true }); + assert.equal(service.prepareRequest( + `ws://localhost:3000/socket.io/?transport=websocket&proprDesktopTransportScope=${secondActivation.transportScope}`, + {}, { resourceType: 'webSocket' }, + ).requestHeaders?.Authorization, `Bearer ${token('A')}`); + }); + + it('never sends an A-origin bearer after the profile URL is edited to an attacker origin', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, 'A')); + const requests: Array<{ url: string; authorization: string | null }> = []; + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + requests.push({ url, authorization: new Headers(init?.headers).get('Authorization') }); + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + return new Response(null, { status: 204 }); + }, + }); + + const result = await service.probe({ + id: profile.id, + label: profile.label, + apiBaseUrl: 'https://attacker.example.test', + }); + + assert.equal(result.status, 'authentication-required'); + assert.equal(requests.filter(request => request.url.startsWith('https://attacker.example.test')) + .every(request => request.authorization === null), true); + assert.equal(requests.some(request => request.url === 'https://a.example.test/api/desktop/tokens/current'), false); + assert.deepEqual(await store.readCredential(profile.id), credential(profile.id, profile.apiBaseUrl, 'A')); + }); + + it('preserves a re-paired credential and current connection after a stale definitive probe response', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const oldCredential = credential(profile.id, profile.apiBaseUrl, 'A'); + const replacement = credential(profile.id, profile.apiBaseUrl, 'B'); + await store.writeCredential(oldCredential); + const oldProbeResponse = deferred(); + const oldProbePending = deferred(); + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + const authorization = new Headers(init?.headers).get('Authorization'); + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + if (url.endsWith('/api/desktop/pairings')) return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'C'.repeat(43), + approvalUrl: 'https://a.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) return provisionalPairingResponse(url, replacement.token); + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url.endsWith('/api/auth/user') && authorization === `Bearer ${oldCredential.token}`) { + oldProbePending.resolve(); + return oldProbeResponse.promise; + } + if (url.endsWith('/api/auth/user') && authorization === `Bearer ${replacement.token}`) { + return json({ username: 'replacement' }); + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + + const staleProbe = service.probe({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + await oldProbePending.promise; + await service.pair({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + const current = await service.probe({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + assert.equal(current.status, 'ready'); + const currentActivation = current.status === 'ready' ? await service.activate(current.activationTicket) : null; + + oldProbeResponse.resolve(json({ code: 'INVALID_INSTANCE_TOKEN' }, 401)); + const staleResult = await staleProbe; + + assert.equal(staleResult.status, 'offline'); + assert.match(staleResult.message, /connection changed.*try again/i); + assert.deepEqual(await store.readCredential(profile.id), replacement); + if (!currentActivation) return; + assert.deepEqual(service.prepareRequest('https://a.example.test/api/tasks', transportHeaders(currentActivation.transportScope, {})).requestHeaders, { + Authorization: `Bearer ${replacement.token}`, + }); + }); + + it('preserves a replacement credential at a changed origin after a stale definitive probe response', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const oldCredential = credential(profile.id, profile.apiBaseUrl, 'A'); + const replacement = credential(profile.id, 'https://b.example.test', 'B'); + await store.writeCredential(oldCredential); + const oldProbeResponse = deferred(); + const oldProbePending = deferred(); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + const authorization = new Headers(init?.headers).get('Authorization'); + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + if (url === 'https://a.example.test/api/desktop/tokens/current') return new Response(null, { status: 204 }); + if (url.endsWith('/api/auth/user') && authorization === `Bearer ${oldCredential.token}`) { + oldProbePending.resolve(); + return oldProbeResponse.promise; + } + if (url === 'https://b.example.test/api/auth/user' + && authorization === `Bearer ${replacement.token}`) return json({ username: 'replacement' }); + throw new Error(`Unexpected request: ${url}`); + }, + }); + + const staleProbe = service.probe({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + await oldProbePending.promise; + const changed = await service.saveProfile({ + id: profile.id, + label: profile.label, + apiBaseUrl: replacement.origin, + }); + await store.writeCredential(replacement); + const current = await service.probe({ id: changed.id, label: changed.label, apiBaseUrl: changed.apiBaseUrl }); + assert.equal(current.status, 'ready'); + const currentActivation = current.status === 'ready' ? await service.activate(current.activationTicket) : null; + + oldProbeResponse.resolve(json({ code: 'INVALID_INSTANCE_TOKEN' }, 401)); + const staleResult = await staleProbe; + + assert.equal(staleResult.status, 'offline'); + assert.match(staleResult.message, /connection changed.*try again/i); + assert.deepEqual(await store.readCredential(profile.id), replacement); + if (!currentActivation) return; + assert.deepEqual(service.prepareRequest('https://b.example.test/api/tasks', transportHeaders(currentActivation.transportScope, {})).requestHeaders, { + Authorization: `Bearer ${replacement.token}`, + }); + }); + + for (const failure of ['browser-launch', 'cancellation', 'expiry', 'polling', 'secure-storage'] as const) { + it(`preserves the active profile and credential when an origin edit fails during ${failure}`, async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-credential-service-')); + temporaryDirectories.push(directory); + let rejectReplacementEncryption = false; + const provider: EncryptionProvider = { + ...encryption, + encrypt: value => { + const stored = JSON.parse(value) as StoredCredential; + if (rejectReplacementEncryption && stored.token === token('B')) { + throw new Error('keychain encrypt failed'); + } + return Buffer.from(value, 'utf8'); + }, + }; + const store = new ProfileStore(directory, provider); + const profile = await store.save({ + id: 'profile-a', label: 'Working A', apiBaseUrl: 'https://a.example.test', + }); + const oldCredential = credential(profile.id, profile.apiBaseUrl, 'A'); + await store.writeCredential(oldCredential); + await store.setActive(profile.id); + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + const requests: Array<{ url: string; authorization: string | null }> = []; + let service!: DesktopCredentialService; + service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => { + if (failure === 'browser-launch') throw new Error('Browser launch failed.'); + if (failure === 'cancellation') service.cancelPairing(profile.id); + }, + fetch: async (input, init) => { + const url = input.toString(); + const authorization = new Headers(init?.headers).get('Authorization'); + requests.push({ url, authorization }); + if (url === 'https://a.example.test/api/desktop/discovery') return json(discovery); + if (url === 'https://a.example.test/api/auth/user') return json({ username: 'working-a' }); + if (url === 'https://b.example.test/api/desktop/pairings') return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'C'.repeat(43), + approvalUrl: 'https://b.example.test/approve', + expiresAt: new Date(pairingNow + (failure === 'expiry' ? -1 : 10_000)).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) { + if (failure === 'polling') throw new Error('Pairing poll failed.'); + return provisionalPairingResponse(url, token('B')); + } + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url === 'https://b.example.test/api/desktop/tokens/current') { + return new Response(null, { status: 204 }); + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + const ready = await service.probe({ + id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl, + }); + assert.equal(ready.status, 'ready'); + if (ready.status !== 'ready') return; + const activated = await service.activate(ready.activationTicket); + rejectReplacementEncryption = failure === 'secure-storage'; + + await assert.rejects(service.pair({ + id: profile.id, + label: 'Proposed B', + apiBaseUrl: 'https://b.example.test', + })); + + assert.deepEqual(await store.list(), { profiles: [profile], activeProfileId: profile.id }); + assert.deepEqual(await store.readCredential(profile.id), oldCredential); + assert.deepEqual(service.prepareRequest( + 'https://a.example.test/api/tasks', + transportHeaders(activated.transportScope), + ).requestHeaders, { Authorization: `Bearer ${oldCredential.token}` }); + assert.equal(requests.some(request => request.url === 'https://a.example.test/api/desktop/tokens/current' + && request.authorization === `Bearer ${oldCredential.token}`), false); + }); + } + + it('commits an edited profile and replacement credential before revoking the old token', async () => { + const store = await createStore(); + const profile = await store.save({ + id: 'profile-a', label: 'Working A', apiBaseUrl: 'https://a.example.test', + }); + const oldCredential = credential(profile.id, profile.apiBaseUrl, 'A'); + const replacement = credential(profile.id, 'https://b.example.test', 'B'); + await store.writeCredential(oldCredential); + await store.setActive(profile.id); + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + const revocationSnapshot = deferred<{ + state: Awaited>; + credential: StoredCredential | null; + }>(); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url === 'https://b.example.test/api/desktop/pairings') return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'C'.repeat(43), + approvalUrl: 'https://b.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) return provisionalPairingResponse(url, replacement.token); + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url === 'https://a.example.test/api/desktop/tokens/current') { + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${oldCredential.token}`); + revocationSnapshot.resolve({ + state: await store.list(), + credential: await store.readCredential(profile.id), + }); + return new Response(null, { status: 204 }); + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + + await service.pair({ + id: profile.id, + label: 'Connected B', + apiBaseUrl: replacement.origin, + }); + + const stateAtRevocation = await revocationSnapshot.promise; + assert.equal(stateAtRevocation.state.profiles[0]?.label, 'Connected B'); + assert.equal(stateAtRevocation.state.profiles[0]?.apiBaseUrl, replacement.origin); + assert.equal(stateAtRevocation.state.activeProfileId, null); + assert.deepEqual(stateAtRevocation.credential, replacement); + assert.deepEqual(await store.readCredential(profile.id), replacement); + }); + + it('durably journals a provisional delivery before server activation and local publication', async () => { + const store = await createStore(); + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + const replacement = credential('profile-delivery', 'https://a.example.test', 'B'); + let activationChecked = false; + const service = createCredentialService({ + profiles: store, + clientName: 'Delivery ordering test', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/pairings')) return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'C'.repeat(43), + approvalUrl: 'https://a.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }); + if (url.endsWith('/poll')) return provisionalPairingResponse(url, replacement.token); + if (url.endsWith('/activate')) { + const pending = await store.pendingRevocations(); + assert.equal(pending.length, 1); + assert.equal(pending[0]?.deferred, true); + assert.deepEqual(pending[0]?.credential, replacement); + assert.equal(await store.readCredential(replacement.profileId), null); + activationChecked = true; + return pairingActivationReceipt(); + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + + await service.pair({ + id: replacement.profileId, + label: 'Delivered B', + apiBaseUrl: replacement.origin, + }); + assert.equal(activationChecked, true); + assert.deepEqual(await store.readCredential(replacement.profileId), replacement); + assert.deepEqual(await store.pendingRevocations(), []); + console.log('NATIVE_SCENARIO delivery'); + }); + + it('retries an encrypted pending A revocation across failure, restart, remote success, and local cleanup failure', async () => { + const store = await createStore(); + const profile = await store.save({ + id: 'profile-a', label: 'Working A', apiBaseUrl: 'https://a.example.test', + }); + const credentialA = credential(profile.id, profile.apiBaseUrl, 'A'); + const credentialB = credential(profile.id, profile.apiBaseUrl, 'B'); + await store.writeCredential(credentialA); + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + const diagnostics: Array<{ code: string; status?: number }> = []; + let expectedProbeToken = credentialA.token; + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + reportRevocationFailure: value => diagnostics.push(value), + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/pairings')) return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'C'.repeat(43), + approvalUrl: 'https://a.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) return provisionalPairingResponse(url, credentialB.token); + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url.endsWith('/api/desktop/tokens/current')) { + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${credentialA.token}`); + return json({ error: 'offline' }, 503); + } + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + if (url.endsWith('/api/auth/user')) { + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${expectedProbeToken}`); + return json({ username: 'credential-b' }); + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + + const readyA = await service.probe({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + assert.equal(readyA.status, 'ready'); + if (readyA.status !== 'ready') return; + const activeA = await service.activate(readyA.activationTicket); + await service.pair({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + assert.deepEqual(await store.readCredential(profile.id), credentialB); + assert.equal((await store.pendingRevocations()).length, 1); + assert.deepEqual(diagnostics, [{ code: 'http', status: 503 }]); + assert.equal(JSON.stringify(diagnostics).includes(credentialA.token), false); + assert.deepEqual(service.prepareRequest( + `${profile.apiBaseUrl}/api/tasks`, transportHeaders(activeA.transportScope), + ), { cancel: true }); + expectedProbeToken = credentialB.token; + const ready = await service.probe({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + assert.equal(ready.status, 'ready'); + if (ready.status !== 'ready') return; + const activeB = await service.activate(ready.activationTicket); + assert.deepEqual(service.prepareRequest( + `${profile.apiBaseUrl}/api/tasks`, transportHeaders(activeB.transportScope), + ).requestHeaders, { Authorization: `Bearer ${credentialB.token}` }); + + const offlineDiagnostics: Array<{ code: string; status?: number }> = []; + const offlineRestart = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + reportRevocationFailure: value => offlineDiagnostics.push(value), + fetch: async () => { throw new Error('offline'); }, + }); + await offlineRestart.initialize(); + assert.deepEqual(offlineDiagnostics, [{ code: 'network' }]); + assert.equal((await store.pendingRevocations()).length, 1); + + let failCleanup = true; + const cleanupFailingProfiles = new Proxy(store, { + get(target, property) { + if (property === 'completePendingRevocation') return async () => { + if (failCleanup) { + failCleanup = false; + throw new Error('injected cleanup failure'); + } + return false; + }; + const value = Reflect.get(target, property); + return typeof value === 'function' ? value.bind(target) : value; + }, + }); + const cleanupDiagnostics: Array<{ code: string; status?: number }> = []; + const remoteSucceeded = createCredentialService({ + profiles: cleanupFailingProfiles, + clientName: 'Test desktop', + openExternal: async () => undefined, + reportRevocationFailure: value => cleanupDiagnostics.push(value), + fetch: async () => new Response(null, { status: 204 }), + }); + await remoteSucceeded.initialize(); + assert.deepEqual(cleanupDiagnostics, [{ code: 'local-cleanup' }]); + assert.equal((await store.pendingRevocations()).length, 1); + + let terminalRetries = 0; + const onlineRestart = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async (_input, init) => { + terminalRetries += 1; + return terminalRevocation(init); + }, + }); + await onlineRestart.initialize(); + await onlineRestart.initialize(); + assert.equal(terminalRetries, 1); + assert.deepEqual(await store.pendingRevocations(), []); + assert.deepEqual(await store.readCredential(profile.id), credentialB); + + const uncertainDirectory = await mkdtemp(join(tmpdir(), 'propr-credential-service-')); + temporaryDirectories.push(uncertainDirectory); + let failCommitFlush = false; + let armedCommitFlushes = 0; + const uncertainStore = new ProfileStore(uncertainDirectory, encryption, { + beforeIO: operation => { + if (failCommitFlush && operation === 'journal-commit-flush') { + armedCommitFlushes += 1; + if (armedCommitFlushes === 2) throw new Error('injected journal commit flush failure'); + } + }, + }); + const uncertainProfile = await uncertainStore.save({ + id: 'profile-uncertain', label: 'A', apiBaseUrl: 'https://a.example.test', + }); + const uncertainA = credential(uncertainProfile.id, uncertainProfile.apiBaseUrl, 'A'); + const uncertainB = credential(uncertainProfile.id, uncertainProfile.apiBaseUrl, 'B'); + await uncertainStore.writeCredential(uncertainA); + const uncertainRevocations: string[] = []; + const uncertainService = createCredentialService({ + profiles: uncertainStore, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/pairings')) return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'C'.repeat(43), + approvalUrl: 'https://a.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) return provisionalPairingResponse(url, uncertainB.token); + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url.endsWith('/api/desktop/tokens/current')) { + uncertainRevocations.push(new Headers(init?.headers).get('Authorization') ?? ''); + return new Response(null, { status: 204 }); + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + failCommitFlush = true; + await assert.rejects( + uncertainService.pair({ + id: uncertainProfile.id, + label: 'B', + apiBaseUrl: uncertainProfile.apiBaseUrl, + }), + /injected journal commit flush failure/, + ); + failCommitFlush = false; + assert.deepEqual(uncertainRevocations, [], 'verified B must not be revoked after C becomes observable'); + const uncertainRestart = new ProfileStore(uncertainDirectory, encryption); + assert.deepEqual(await uncertainRestart.readCredential(uncertainProfile.id), uncertainB); + assert.equal((await uncertainRestart.pendingRevocations()).length, 1); + }); + + const nativeRevocationCrashModes = ['during-revoke', 'after-remote-success'] as const; + assert.equal(nativeRevocationCrashModes.length, 2); + for (const crashMode of nativeRevocationCrashModes) { + it(`recovers B and retries idempotently after a real process crash ${crashMode}`, async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-credential-service-')); + temporaryDirectories.push(directory); + const setup = new ProfileStore(directory, encryption); + const profile = await setup.save({ + id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test', + }); + const credentialA = credential(profile.id, profile.apiBaseUrl, 'A'); + const credentialB = credential(profile.id, profile.apiBaseUrl, 'B'); + await setup.writeCredential(credentialA); + const baseline = await setup.readProfileCredential(profile.id); + await setup.commitPairedProfile( + { id: profile.id, label: 'B', apiBaseUrl: profile.apiBaseUrl }, + credentialB, baseline, () => true, + ); + assert.equal((await setup.pendingRevocations()).length, 1); + + const child = spawn(process.execPath, [ + '--import', 'tsx', join(import.meta.dirname, 'pending-revocation-crash-fixture.ts'), + directory, crashMode, + ], { stdio: 'ignore' }); + const result = await new Promise<{ code: number | null; signal: NodeJS.Signals | null }>(resolve => { + child.once('exit', (code, signal) => resolve({ code, signal })); + }); + assert.equal( + result.signal === 'SIGKILL' || (process.platform === 'win32' && result.code !== 0), + true, + `${crashMode}: child did not terminate at the requested revocation boundary`, + ); + + const restarted = new ProfileStore(directory, encryption); + assert.deepEqual(await restarted.readCredential(profile.id), credentialB); + assert.equal((await restarted.pendingRevocations()).length, 1); + let retries = 0; + const retryingService = createCredentialService({ + profiles: restarted, + clientName: 'Restarted desktop', + openExternal: async () => undefined, + fetch: async (_input, init) => { + retries += 1; + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${credentialA.token}`); + return terminalRevocation(init); + }, + }); + await retryingService.initialize(); + await retryingService.initialize(); + assert.equal(retries, 1); + assert.deepEqual(await restarted.pendingRevocations(), []); + assert.deepEqual(await restarted.readCredential(profile.id), credentialB); + console.log('NATIVE_SCENARIO revocation-crash'); + }); + } + + for (const [name, response] of [ + ['204 success', (_init: RequestInit | undefined) => new Response(null, { status: 204 })], + ['404 TOKEN_NOT_FOUND', (init: RequestInit | undefined) => terminalRevocation(init)], + ['401 INSTANCE_TOKEN_REVOKED', (init: RequestInit | undefined) => terminalRevocation(init, 'INSTANCE_TOKEN_REVOKED')], + ['401 INSTANCE_TOKEN_EXPIRED', (init: RequestInit | undefined) => terminalRevocation(init, 'INSTANCE_TOKEN_EXPIRED')], + ] as const) { + it(`cleans durable retry material only for endpoint-bound terminal ${name}`, async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-terminal', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const old = credential(profile.id, profile.apiBaseUrl, 'A'); + await store.writeCredential(old); + await store.removeCredential(profile.id); + const pending = await store.pendingRevocations(); + assert.equal(pending.length, 1); + const service = createCredentialService({ + profiles: store, + clientName: 'Terminal contract test', + openExternal: async () => undefined, + fetch: async (input, init) => { + assert.equal(input.toString(), `${old.origin}${DESKTOP_TOKEN_REVOCATION_ENDPOINT}`); + assert.equal(new Headers(init?.headers).get(DESKTOP_REVOCATION_BINDING_HEADER), pending[0].credentialGeneration); + return response(init); + }, + }); + await service.initialize(); + assert.deepEqual(await store.pendingRevocations(), []); + }); + } + + const retryableRevocationResponses: ReadonlyArray<[ + string, + (init: RequestInit | undefined) => Response, + ]> = [ + ['empty 401', () => new Response(null, { status: 401 })], + ['empty 404', () => new Response(null, { status: 404 })], + ['HTML route 404', () => new Response('

not found

', { status: 404, headers: { 'Content-Type': 'text/html' } })], + ['malformed JSON', () => new Response('{', { status: 404, headers: { 'Content-Type': 'application/json' } })], + ['wrong content type', init => new Response(JSON.stringify(terminalRevocationBody(init)), { + status: 404, headers: { 'Content-Type': 'text/plain' }, + })], + ['wrong schema version', init => json({ ...terminalRevocationBody(init), version: 2 }, 404)], + ['wrong credential generation', init => json({ + ...terminalRevocationBody(init), credentialGeneration: 'Z'.repeat(22), + }, 404)], + ['unknown terminal code', init => json({ ...terminalRevocationBody(init), code: 'INVALID_INSTANCE_TOKEN' }, 404)], + ['status/code mismatch', init => json(terminalRevocationBody(init), 401)], + ['redirect', () => Response.redirect('https://proxy.example.test/moved', 302)], + ['redirected 204', () => { + const result = new Response(null, { status: 204 }); + Object.defineProperty(result, 'redirected', { value: true }); + return result; + }], + ['wrong endpoint 204', () => { + const result = new Response(null, { status: 204 }); + Object.defineProperty(result, 'url', { value: 'https://proxy.example.test/api/desktop/tokens/current' }); + return result; + }], + ['server failure', () => json({ code: 'DESKTOP_AUTH_FAILED' }, 503)], + ['oversized JSON', init => json({ ...terminalRevocationBody(init), padding: 'x'.repeat(2_048) }, 404)], + ]; + for (const [name, response] of retryableRevocationResponses) { + it(`retains encrypted retry material for ${name}`, async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-retryable', label: 'A', apiBaseUrl: 'https://a.example.test' }); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, 'A')); + await store.removeCredential(profile.id); + const diagnostics: Array<{ code: string; status?: number }> = []; + const service = createCredentialService({ + profiles: store, + clientName: 'Retryable contract test', + openExternal: async () => undefined, + reportRevocationFailure: diagnostic => diagnostics.push(diagnostic), + fetch: async (_input, init) => response(init), + }); + await service.initialize(); + assert.equal((await store.pendingRevocations()).length, 1); + assert.deepEqual(diagnostics, [{ code: 'http', status: response(undefined).status }]); + assert.equal(JSON.stringify(diagnostics).includes(token('A')), false); + }); + } + + const streamingRevocationCases: ReadonlyArray<[ + string, + boolean, + (init: RequestInit | undefined) => Response, + ]> = [ + ['chunked 2048-byte terminal JSON', true, init => { + const jsonBody = JSON.stringify(terminalRevocationBody(init)); + const body = new TextEncoder().encode(jsonBody + ' '.repeat(2_048 - Buffer.byteLength(jsonBody))); + return new Response(new ReadableStream({ + start(controller) { + controller.enqueue(body.slice(0, 1_024)); + controller.enqueue(body.slice(1_024)); + controller.close(); + }, + }), { status: 404, headers: { 'Content-Type': 'application/json' } }); + }], + ['chunked 2049-byte terminal JSON', false, init => { + const jsonBody = JSON.stringify(terminalRevocationBody(init)); + const body = new TextEncoder().encode(jsonBody + ' '.repeat(2_049 - Buffer.byteLength(jsonBody))); + return new Response(new ReadableStream({ + start(controller) { + controller.enqueue(body.slice(0, 2_048)); + controller.enqueue(body.slice(2_048)); + controller.close(); + }, + }), { status: 404, headers: { 'Content-Type': 'application/json' } }); + }], + ['terminal JSON without Content-Length', true, init => { + const body = new TextEncoder().encode(JSON.stringify(terminalRevocationBody(init))); + return new Response(new ReadableStream({ + start(controller) { + controller.enqueue(body.slice(0, 7)); + controller.enqueue(body.slice(7)); + controller.close(); + }, + }), { status: 404, headers: { 'Content-Type': 'application/json' } }); + }], + ['deceptive short Content-Length', false, init => { + const body = JSON.stringify(terminalRevocationBody(init)); + return new Response(body, { + status: 404, + headers: { 'Content-Type': 'application/json', 'Content-Length': String(Buffer.byteLength(body) - 1) }, + }); + }], + ['extra chunk after declared Content-Length', false, init => { + const body = new TextEncoder().encode(JSON.stringify(terminalRevocationBody(init))); + return new Response(new ReadableStream({ + start(controller) { + controller.enqueue(body); + controller.enqueue(new TextEncoder().encode(' ')); + controller.close(); + }, + }), { + status: 404, + headers: { 'Content-Type': 'application/json', 'Content-Length': String(body.byteLength) }, + }); + }], + ['malformed UTF-8', false, () => new Response(new ReadableStream({ + start(controller) { + controller.enqueue(Uint8Array.from([0xc3, 0x28])); + controller.close(); + }, + }), { status: 404, headers: { 'Content-Type': 'application/json' } })], + ['premature body error', false, () => new Response(new ReadableStream({ + start(controller) { + controller.enqueue(new TextEncoder().encode('{')); + controller.error(new Error('injected body failure')); + }, + }), { status: 404, headers: { 'Content-Type': 'application/json' } })], + ]; + + for (const [name, completes, response] of streamingRevocationCases) { + it(`${completes ? 'accepts' : 'retains'} encrypted retry material for ${name}`, async () => { + const store = await createStore(); + const profile = await store.save({ + id: 'profile-streaming', label: 'A', apiBaseUrl: 'https://a.example.test', + }); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, 'A')); + await store.removeCredential(profile.id); + const service = createCredentialService({ + profiles: store, + clientName: 'Streaming terminal contract test', + openExternal: async () => undefined, + fetch: async (_input, init) => response(init), + }); + + const initialized = await service.initialize(); + + assert.equal((await store.pendingRevocations()).length, completes ? 0 : 1); + assert.equal(initialized.status, completes ? 'ready' : 'degraded'); + }); + } + + it('bounds a one-byte slowloris body and retains its encrypted retry material', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-slowloris', label: 'A', apiBaseUrl: 'https://a.example.test' }); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, 'A')); + await store.removeCredential(profile.id); + let bodyCancelled = false; + const service = createCredentialService({ + profiles: store, + clientName: 'Slowloris terminal contract test', + openExternal: async () => undefined, + revocationDeadlines: { headerMs: 50, bodyMs: 25, recordMs: 75, aggregateMs: 100 }, + fetch: async () => new Response(new ReadableStream({ + start(controller) { controller.enqueue(new TextEncoder().encode('{')); }, + cancel() { bodyCancelled = true; }, + }), { status: 404, headers: { 'Content-Type': 'application/json' } }), + }); + + const initialized = await service.initialize(); + + assert.deepEqual(initialized, { status: 'degraded', retryPending: true }); + assert.equal(bodyCancelled, true); + assert.equal((await store.pendingRevocations()).length, 1); + }); + + it('dispose aborts a stalled header fetch, deduplicates its generation, and leaves no later activity', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-dispose-fetch', label: 'A', apiBaseUrl: 'https://a.example.test' }); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, 'A')); + await store.removeCredential(profile.id); + const fetchStarted = deferred(); + let fetchCalls = 0; + let fetchAborted = false; + const service = createCredentialService({ + profiles: store, + clientName: 'Dispose fetch barrier test', + openExternal: async () => undefined, + fetch: async (_input, init) => await new Promise((_resolve, reject) => { + fetchCalls += 1; + fetchStarted.resolve(); + const signal = init?.signal; + assert.ok(signal); + const abort = () => { + fetchAborted = true; + reject(Object.assign(new Error('aborted'), { name: 'AbortError' })); + }; + if (signal.aborted) abort(); + else signal.addEventListener('abort', abort, { once: true }); + }), + }); + + const first = service.initialize(); + const duplicate = service.initialize(); + await fetchStarted.promise; + await service.dispose(); + await Promise.all([first, duplicate]); + const callsAtDispose = fetchCalls; + await new Promise(resolve => setTimeout(resolve, 20)); + + assert.equal(fetchAborted, true); + assert.equal(fetchCalls, 1); + assert.equal(fetchCalls, callsAtDispose); + assert.equal((await store.pendingRevocations()).length, 1); + await assert.rejects( + service.removeProfile(profile.id), + /credential service is closed/i, + ); + }); + + it('dispose cancels a headers-then-stall body and retains exact encrypted material', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-dispose-body', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const old = credential(profile.id, profile.apiBaseUrl, 'A'); + await store.writeCredential(old); + await store.removeCredential(profile.id); + const bodyStarted = deferred(); + let bodyCancelled = false; + let networkCalls = 0; + const service = createCredentialService({ + profiles: store, + clientName: 'Dispose body barrier test', + openExternal: async () => undefined, + fetch: async () => { + networkCalls += 1; + return new Response(new ReadableStream({ + start(controller) { + controller.enqueue(new TextEncoder().encode('{')); + bodyStarted.resolve(); + }, + cancel() { bodyCancelled = true; }, + }), { status: 404, headers: { 'Content-Type': 'application/json' } }); + }, + }); + + const initialization = service.initialize(); + await bodyStarted.promise; + await service.dispose(); + await initialization; + const callsAtDispose = networkCalls; + await new Promise(resolve => setTimeout(resolve, 20)); + + const pending = await store.pendingRevocations(); + assert.equal(bodyCancelled, true); + assert.equal(networkCalls, callsAtDispose); + assert.equal(pending.length, 1); + assert.deepEqual(pending[0].credential, old); + }); + + it('dispose waits for terminal journal cleanup and no file operation runs afterward', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-credential-service-')); + temporaryDirectories.push(directory); + const journalWriteStarted = deferred(); + const releaseJournalWrite = deferred(); + let barrierArmed = false; + let ioOperations = 0; + const store = new ProfileStore(directory, encryption, { + beforeIO: operation => { + ioOperations += 1; + if (barrierArmed && operation === 'journal-write') { + barrierArmed = false; + journalWriteStarted.resolve(); + return releaseJournalWrite.promise; + } + }, + }); + const profile = await store.save({ id: 'profile-dispose-journal', label: 'A', apiBaseUrl: 'https://a.example.test' }); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, 'A')); + await store.removeCredential(profile.id); + barrierArmed = true; + let networkCalls = 0; + const service = createCredentialService({ + profiles: store, + clientName: 'Dispose journal barrier test', + openExternal: async () => undefined, + fetch: async () => { + networkCalls += 1; + return new Response(null, { status: 204 }); + }, + }); + + const initialization = service.initialize(); + await journalWriteStarted.promise; + let disposed = false; + const disposal = service.dispose().then(() => { disposed = true; }); + await Promise.resolve(); + assert.equal(disposed, false); + releaseJournalWrite.resolve(); + await Promise.all([initialization, disposal]); + const ioAtDispose = ioOperations; + const networkAtDispose = networkCalls; + await new Promise(resolve => setTimeout(resolve, 20)); + + assert.equal(ioOperations, ioAtDispose); + assert.equal(networkCalls, networkAtDispose); + assert.deepEqual(await store.pendingRevocations(), []); + console.log('NATIVE_SCENARIO dispose'); + }); + + it('bounds aggregate startup across stalled records and recovers all encrypted records later', async () => { + const store = await createStore(); + for (const [id, character] of [['profile-startup-a', 'A'], ['profile-startup-b', 'B']] as const) { + const profile = await store.save({ id, label: id, apiBaseUrl: `https://${character.toLowerCase()}.example.test` }); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, character)); + await store.removeCredential(profile.id); + } + let stalledCalls = 0; + const offline = createCredentialService({ + profiles: store, + clientName: 'Bounded startup test', + openExternal: async () => undefined, + revocationDeadlines: { headerMs: 100, bodyMs: 50, recordMs: 125, aggregateMs: 500 }, + fetch: async (_input, init) => await new Promise((_resolve, reject) => { + stalledCalls += 1; + const signal = init?.signal; + assert.ok(signal); + const abort = () => reject(Object.assign(new Error('aborted'), { name: 'AbortError' })); + if (signal.aborted) abort(); + else signal.addEventListener('abort', abort, { once: true }); + }), + }); + const startedAt = Date.now(); + + const initialization = await offline.initialize(); + + assert.deepEqual(initialization, { status: 'degraded', retryPending: true }); + assert.ok(Date.now() - startedAt < 1_500); + assert.equal(stalledCalls, 2); + assert.equal((await store.pendingRevocations()).length, 2); + await offline.dispose(); + + let recoveryCalls = 0; + const online = createCredentialService({ + profiles: store, + clientName: 'Later online recovery test', + openExternal: async () => undefined, + fetch: async () => { + recoveryCalls += 1; + return new Response(null, { status: 204 }); + }, + }); + assert.deepEqual(await online.initialize(), { status: 'ready', retryPending: false }); + assert.equal(recoveryCalls, 2); + assert.deepEqual(await store.pendingRevocations(), []); + }); + + it('retries a crash-left provisional pairing credential on startup', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-provisional', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const provisional = await store.journalPendingRevocation( + credential(profile.id, profile.apiBaseUrl, 'C'), + ); + assert.equal('stored' in provisional, false); + if ('stored' in provisional) return; + assert.equal(provisional.deferred, true); + let calls = 0; + const restarted = createCredentialService({ + profiles: store, + clientName: 'Restarted after provisional crash', + openExternal: async () => undefined, + fetch: async (_input, init) => { + calls += 1; + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${token('C')}`); + return new Response(null, { status: 204 }); + }, + }); + await restarted.initialize(); + assert.equal(calls, 1); + assert.deepEqual(await store.pendingRevocations(), []); + console.log('NATIVE_SCENARIO transient-revocation'); + console.log('NATIVE_SCENARIO provisional'); + }); + + it('ignores delayed A invalidation after B connects and preserves tokens for authorization/transient codes', async () => { + const store = await createStore(); + const profileA = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://b.example.test' }); + await store.writeCredential(credential(profileA.id, profileA.apiBaseUrl, 'A')); + await store.writeCredential(credential(profileB.id, profileB.apiBaseUrl, 'B')); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async input => input.toString().endsWith('/api/desktop/discovery') + ? json(discovery) + : json({ username: 'octocat' }), + }); + const readyA = await service.probe({ id: profileA.id, label: profileA.label, apiBaseUrl: profileA.apiBaseUrl }); + const activatedA = readyA.status === 'ready' ? await service.activate(readyA.activationTicket) : null; + const readyB = await service.probe({ id: profileB.id, label: profileB.label, apiBaseUrl: profileB.apiBaseUrl }); + assert.equal(readyA.status, 'ready'); + assert.equal(readyB.status, 'ready'); + if (readyA.status !== 'ready' || readyB.status !== 'ready') return; + const activatedB = await service.activate(readyB.activationTicket); + if (!activatedA) return; + + assert.deepEqual(await service.invalidate({ + profileId: profileA.id, + transportScope: activatedA.transportScope, + code: 'INVALID_INSTANCE_TOKEN', + }), { invalidated: false }); + assert.deepEqual(await service.invalidate({ + profileId: profileB.id, + transportScope: activatedB.transportScope, + code: 'AUTHORIZATION_CHANGED', + }), { invalidated: false }); + assert.deepEqual(await service.invalidate({ + profileId: profileB.id, + transportScope: activatedB.transportScope, + code: 'AUTHENTICATION_FAILED', + }), { invalidated: false }); + assert.ok(await store.readCredential(profileA.id)); + assert.ok(await store.readCredential(profileB.id)); + + assert.deepEqual(await service.invalidate({ + profileId: profileB.id, + transportScope: activatedB.transportScope, + code: 'INVALID_INSTANCE_TOKEN', + }), { invalidated: true }); + await service.initialize(); + assert.ok(await store.readCredential(profileA.id)); + assert.equal(await store.readCredential(profileB.id), null); + }); + + it('preserves a replacement written while an old transient token revocation is pending', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-credential-service-')); + temporaryDirectories.push(directory); + let service!: DesktopCredentialService; + let cancelOldPairingOnWrite = true; + const cancellingEncryption: EncryptionProvider = { + ...encryption, + encrypt: value => { + const stored = JSON.parse(value) as StoredCredential; + if (cancelOldPairingOnWrite && stored.token === token('C')) { + cancelOldPairingOnWrite = false; + service.cancelPairing(stored.profileId); + } + return Buffer.from(value, 'utf8'); + }, + }; + const store = new ProfileStore(directory, cancellingEncryption); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const revocationStarted = deferred(); + const releaseRevocation = deferred(); + let pairingNumber = 0; + let currentPairing = 0; + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/pairings')) { + currentPairing = ++pairingNumber; + return pairingStartResponse(url, init, { + pairingId: `dpr_${String.fromCharCode(64 + currentPairing).repeat(22)}`, + deviceSecret: String.fromCharCode(66 + currentPairing).repeat(43), + approvalUrl: 'https://a.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + } + if (url.endsWith('/poll')) { + const character = currentPairing === 1 ? 'C' : 'D'; + return provisionalPairingResponse(url, token(character)); + } + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url.endsWith('/api/desktop/tokens/current')) { + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${token('C')}`); + revocationStarted.resolve(); + return releaseRevocation.promise; + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + + const oldPairing = assert.rejects( + service.pair({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }), + /cancelled/i, + ); + await revocationStarted.promise; + await service.pair({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + releaseRevocation.resolve(new Response(null, { status: 204 })); + await oldPairing; + + assert.deepEqual(await store.readCredential(profile.id), credential(profile.id, profile.apiBaseUrl, 'D')); + }); + + it('keeps an exactly persisted cancelled pairing token pending when revocation fails', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-credential-service-')); + temporaryDirectories.push(directory); + let service!: DesktopCredentialService; + const cancellingEncryption: EncryptionProvider = { + ...encryption, + encrypt: value => { + const stored = JSON.parse(value) as StoredCredential; + if (stored.token === token('C')) service.cancelPairing(stored.profileId); + return Buffer.from(value, 'utf8'); + }, + }; + const store = new ProfileStore(directory, cancellingEncryption); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/pairings')) return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://a.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) { + return provisionalPairingResponse(url, token('C')); + } + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url.endsWith('/api/desktop/tokens/current')) return json({ error: 'unavailable' }, 500); + throw new Error(`Unexpected request: ${url}`); + }, + }); + + await assert.rejects( + service.pair({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }), + /cancelled/i, + ); + assert.equal(await store.readCredential(profile.id), null); + const pending = await store.pendingRevocations(); + assert.equal(pending.length, 1); + assert.equal(pending[0].credential.token, token('C')); + console.log('NATIVE_SCENARIO transient-revocation'); + }); + + it('detaches a removed profile locally before deferred revoke and preserves a later replacement', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const storedCredential = credential(profile.id, profile.apiBaseUrl, 'A'); + await store.writeCredential(storedCredential); + await store.setActive(profile.id); + const revocationStarted = deferred(); + const releaseRevocation = deferred(); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + if (url.endsWith('/api/auth/user')) { + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${storedCredential.token}`); + return json({ username: 'octocat' }); + } + if (url.endsWith('/api/desktop/tokens/current')) { + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${storedCredential.token}`); + revocationStarted.resolve(); + return releaseRevocation.promise; + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + + const ready = await service.probe(profile); + assert.equal(ready.status, 'ready'); + if (ready.status !== 'ready') return; + const active = await service.activate(ready.activationTicket); + const pending = await service.probe(profile); + assert.equal(pending.status, 'ready'); + if (pending.status !== 'ready') return; + + let rendererSuccessPublished = false; + let removalError: unknown; + const failedRemoval = service.removeProfile(profile.id, async origin => { + assert.equal(origin, profile.apiBaseUrl); + throw new Error('origin storage clear failed'); + }).then(result => { + rendererSuccessPublished = true; + return result; + }); + await assert.rejects(failedRemoval, error => { + removalError = error; + return error instanceof Error && /origin storage clear failed/.test(error.message); + }); + + assert.equal(rendererSuccessPublished, false); + assert.doesNotMatch(String(removalError), new RegExp(storedCredential.token)); + assert.deepEqual(await store.list(), { profiles: [profile], activeProfileId: profile.id }); + assert.deepEqual(await store.readCredential(profile.id), storedCredential); + assert.deepEqual(await store.pendingRevocations(), []); + assert.deepEqual(service.prepareRequest( + `${profile.apiBaseUrl}/api/tasks`, transportHeaders(active.transportScope), + ), { cancel: true }); + await assert.rejects( + service.activate(pending.activationTicket), + /Desktop activation expired/, + ); + + const reconstructedReady = await service.probe(profile); + assert.equal(reconstructedReady.status, 'ready'); + if (reconstructedReady.status !== 'ready') return; + const reconstructed = await service.activate(reconstructedReady.activationTicket); + assert.equal(reconstructed.profileId, profile.id); + assert.notEqual(reconstructed.transportScope, active.transportScope); + assert.equal('token' in reconstructed, false); + assert.deepEqual(await store.readCredential(profile.id), storedCredential); + + const removal = service.removeProfile(profile.id); + await revocationStarted.promise; + assert.equal((await store.list()).profiles.some(item => item.id === profile.id), false); + assert.equal(await store.readCredential(profile.id), null); + assert.deepEqual(service.prepareRequest( + `${profile.apiBaseUrl}/api/tasks`, transportHeaders(reconstructed.transportScope), + ), { cancel: true }); + + const replacementProfile = await service.saveProfile({ + id: profile.id, + label: 'Replacement', + apiBaseUrl: profile.apiBaseUrl, + }); + const replacementCredential = credential(profile.id, profile.apiBaseUrl, 'B'); + await store.writeCredential(replacementCredential); + releaseRevocation.resolve(new Response(null, { status: 204 })); + await removal; + // Drain the serialized retry queue before the test removes its keychain + // directory; removeProfile intentionally does not wait on the network. + await service.initialize(); + + assert.equal((await store.list()).profiles.find(item => item.id === profile.id)?.label, replacementProfile.label); + assert.deepEqual(await store.readCredential(profile.id), replacementCredential); + }); + + it('never lets a delayed A-to-B revoke overwrite a later C save, pairing, selection, or credential', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + await store.setActive(profile.id); + await store.writeCredential(credential(profile.id, profile.apiBaseUrl, 'A')); + const revokeStarted = deferred(); + const releaseRevoke = deferred(); + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url === 'https://a.example.test/api/desktop/tokens/current') { + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${token('A')}`); + revokeStarted.resolve(); + return releaseRevoke.promise; + } + if (url.endsWith('/api/desktop/pairings')) return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://c.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) { + return provisionalPairingResponse(url, token('C')); + } + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + if (url.endsWith('/api/auth/user')) return json({ username: 'c' }); + throw new Error(`Unexpected request: ${url}`); + }, + }); + + const staleBSave = service.saveProfile({ + id: profile.id, label: 'B', apiBaseUrl: 'https://b.example.test', + }); + await revokeStarted.promise; + const profileC = await service.saveProfile({ + id: profile.id, label: 'C', apiBaseUrl: 'https://c.example.test', + }); + await service.pair({ id: profile.id, label: 'C', apiBaseUrl: profileC.apiBaseUrl }); + const probeC = await service.probe({ id: profile.id, label: 'C', apiBaseUrl: profileC.apiBaseUrl }); + assert.equal(probeC.status, 'ready'); + if (probeC.status !== 'ready') return; + await service.activate(probeC.activationTicket); + + releaseRevoke.resolve(new Response(null, { status: 204 })); + await staleBSave; + + const finalState = await store.list(); + assert.equal(finalState.profiles.find(item => item.id === profile.id)?.label, 'C'); + assert.equal(finalState.profiles.find(item => item.id === profile.id)?.apiBaseUrl, 'https://c.example.test'); + assert.equal(finalState.activeProfileId, profile.id); + assert.deepEqual(await store.readCredential(profile.id), credential(profile.id, 'https://c.example.test', 'C')); + }); + + it('returns connection-changed and preserves a re-paired credential for an old ready invalidation', async () => { + const store = await createStore(); + const profile = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const oldCredential = credential(profile.id, profile.apiBaseUrl, 'A'); + const replacement = credential(profile.id, profile.apiBaseUrl, 'B'); + await store.writeCredential(oldCredential); + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + if (url.endsWith('/api/auth/user')) { + assert.equal(new Headers(init?.headers).get('Authorization'), `Bearer ${oldCredential.token}`); + return json({ username: 'old-user' }); + } + if (url.endsWith('/api/desktop/pairings')) return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'C'.repeat(43), + approvalUrl: 'https://a.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) { + return provisionalPairingResponse(url, replacement.token); + } + if (url.endsWith('/activate')) return pairingActivationReceipt(); + throw new Error(`Unexpected request: ${url}`); + }, + }); + const ready = await service.probe({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + assert.equal(ready.status, 'ready'); + if (ready.status !== 'ready') return; + const activated = await service.activate(ready.activationTicket); + + await service.pair({ id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl }); + assert.deepEqual(await service.invalidate({ + profileId: profile.id, + transportScope: activated.transportScope, + code: 'INVALID_INSTANCE_TOKEN', + }), { invalidated: false }); + + assert.deepEqual(await store.readCredential(profile.id), replacement); + }); + + for (const race of ['delete', 'switch'] as const) { + it(`revokes a transient completion instead of persisting when pairing races with ${race}`, async () => { + const store = await createStore(); + const profileA = await store.save({ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }); + const profileB = await store.save({ id: 'profile-b', label: 'B', apiBaseUrl: 'https://b.example.test' }); + let service!: DesktopCredentialService; + let raced = false; + let raceOperation: Promise = Promise.resolve(); + const revocations: string[] = []; + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + let listCalls = 0; + const profiles = { + list: async () => { + const result = await store.list(); + listCalls += 1; + if (listCalls === 2 && !raced) { + raced = true; + raceOperation = race === 'delete' + ? service.removeProfile(profileA.id) + : service.setActiveProfile(profileB.id); + } + return result; + }, + saveAndDetachCredential: (input: Parameters[0]) => + store.saveAndDetachCredential(input), + commitPairedProfile: (...args: Parameters) => { + if (!raced) { + raced = true; + raceOperation = race === 'delete' + ? service.removeProfile(profileA.id) + : service.setActiveProfile(profileB.id); + } + return store.commitPairedProfile(...args); + }, + detachProfile: (profileId: string) => store.detachProfile(profileId), + setActive: (profileId: string | null) => store.setActive(profileId), + activateProfile: (...args: Parameters) => store.activateProfile(...args), + activateLocalProfile: (...args: Parameters) => + store.activateLocalProfile(...args), + restoreLocalProfile: (...args: Parameters) => + store.restoreLocalProfile(...args), + security: () => store.security(), + readCredential: (profileId: string) => store.readCredential(profileId), + readProfileCredential: (profileId: string) => store.readProfileCredential(profileId), + writeCredential: (value: StoredCredential) => store.writeCredential(value), + removeCredential: (profileId: string) => store.removeCredential(profileId), + removeCredentialIfCurrent: (...args: Parameters) => + store.removeCredentialIfCurrent(...args), + journalPendingRevocation: (value: StoredCredential) => store.journalPendingRevocation(value), + releasePendingRevocation: (...args: Parameters) => + store.releasePendingRevocation(...args), + pendingRevocations: () => store.pendingRevocations(), + completePendingRevocation: (...args: Parameters) => + store.completePendingRevocation(...args), + awaitIdle: () => store.awaitIdle(), + }; + service = createCredentialService({ + profiles, + clientName: 'Test desktop', + pairingTiming: { + now: () => pairingNow, + sleep: async () => undefined, + }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/pairings')) return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://a.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) { + return provisionalPairingResponse(url, token('C')); + } + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url.endsWith('/api/desktop/tokens/current')) { + revocations.push(new Headers(init?.headers).get('Authorization') ?? ''); + return new Response(null, { status: 204 }); + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + + await assert.rejects( + service.pair({ id: profileA.id, label: profileA.label, apiBaseUrl: profileA.apiBaseUrl }), + /cancelled/i, + ); + await raceOperation; + assert.equal(await store.readCredential(profileA.id), null); + assert.deepEqual(revocations, [`Bearer ${token('C')}`]); + console.log('NATIVE_SCENARIO transient-revocation'); + }); + } + + const pairedPublishBoundaries = ['state-written', 'state-fsynced'] as const; + const pairedPublishRaces = ['cancel', 'switch'] as const; + assert.equal(pairedPublishBoundaries.length * pairedPublishRaces.length, 4); + for (const boundary of pairedPublishBoundaries) { + for (const race of pairedPublishRaces) { + it(`keeps durable A when ${race} linearizes at paired ${boundary} before publish`, async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-credential-service-')); + temporaryDirectories.push(directory); + const reached = deferred(); + const release = deferred(); + let armed = false; + const store = new ProfileStore(directory, encryption, { + afterDurabilityStep: async step => { + if (!armed || step !== boundary) return; + armed = false; + reached.resolve(); + await release.promise; + }, + }); + const profileA = await store.save({ + id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test', + }); + const profileB = await store.save({ + id: 'profile-b', label: 'Other', apiBaseUrl: 'https://b.example.test', + }); + const credentialA = credential(profileA.id, profileA.apiBaseUrl, 'A'); + await store.writeCredential(credentialA); + await store.setActive(profileA.id); + const pairingNow = Date.parse('2026-01-01T00:00:00.000Z'); + const revocations: string[] = []; + const service = createCredentialService({ + profiles: store, + clientName: 'Test desktop', + pairingTiming: { now: () => pairingNow, sleep: async () => undefined }, + openExternal: async () => undefined, + fetch: async (input, init) => { + const url = input.toString(); + if (url.endsWith('/api/desktop/pairings')) return pairingStartResponse(url, init, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'C'.repeat(43), + approvalUrl: 'https://a.example.test/approve', + expiresAt: new Date(pairingNow + 10_000).toISOString(), + interval: 1, + }, 201); + if (url.endsWith('/poll')) { + return provisionalPairingResponse(url, token('C')); + } + if (url.endsWith('/activate')) return pairingActivationReceipt(); + if (url.endsWith('/api/desktop/tokens/current')) { + revocations.push(new Headers(init?.headers).get('Authorization') ?? ''); + return new Response(null, { status: 204 }); + } + throw new Error(`Unexpected request: ${url}`); + }, + }); + armed = true; + const pairing = service.pair({ + id: profileA.id, label: 'Proposed B', apiBaseUrl: profileA.apiBaseUrl, + }); + await reached.promise; + const raced = race === 'cancel' + ? Promise.resolve(service.cancelPairing(profileA.id)) + : service.setActiveProfile(profileB.id); + release.resolve(); + + await assert.rejects(pairing, /cancelled/i); + await raced; + const restarted = new ProfileStore(directory, encryption); + const snapshot = await restarted.readProfileCredential(profileA.id); + assert.equal(snapshot.profile?.label, 'A'); + assert.deepEqual(snapshot.credential, credentialA); + assert.equal((await restarted.list()).activeProfileId, race === 'cancel' ? profileA.id : profileB.id); + assert.deepEqual(revocations, [`Bearer ${token('C')}`]); + assert.deepEqual(service.prepareRequest( + `${profileA.apiBaseUrl}/api/tasks`, transportHeaders('AAAAAAAAAAAAAAAAAAAAAA'), + ), { cancel: true }); + console.log('NATIVE_SCENARIO cancellation-switch'); + }); + } + } +}); diff --git a/apps/desktop/src/credential-service.ts b/apps/desktop/src/credential-service.ts new file mode 100644 index 000000000..55c180cf6 --- /dev/null +++ b/apps/desktop/src/credential-service.ts @@ -0,0 +1,1411 @@ +import { randomBytes } from 'node:crypto'; +import { + ProprClient, + ProprClientError, + type PairingProtocolRequestOptions, + type ProprDesktopPairingOptions, +} from '@propr/client'; +import { + DESKTOP_REVOCATION_BINDING_HEADER, + DESKTOP_TOKEN_REVOCATION_ENDPOINT, + DESKTOP_TOKEN_REVOCATION_SCHEMA, + DESKTOP_TOKEN_REVOCATION_VERSION, + DESKTOP_TOKEN_TERMINAL_CODES, + DESKTOP_TRANSPORT_SCOPE_HEADER, + DESKTOP_TRANSPORT_SCOPE_QUERY, + canonicalProprHttpUrlOrigin, +} from '@propr/shared'; +import { + type DesktopProfileInput, + type DesktopConnectionResult, + type DesktopActivatedConnection, + type DesktopAccessInvalidation, + type DesktopConnectionScope, +} from './shared/contract'; +import { normalizeApiBaseUrl } from './security'; +import type { PendingCredentialRevocation, ProfileStore, StoredCredential } from './profile-store'; + +const DEFINITIVE_INVALID_CODES = new Set([ + 'INVALID_INSTANCE_TOKEN', + 'INSTANCE_TOKEN_EXPIRED', + 'INSTANCE_TOKEN_REVOKED', +]); + +export interface CredentialServiceDependencies { + profiles: Pick; + fetch: typeof globalThis.fetch; + openExternal(url: string): Promise; + clientName: string; + /** Deterministic pairing timing for protocol tests. Production uses the client defaults. */ + pairingTiming?: Pick; + /** Deterministic service/native lifecycle proof; production uses fixed protocol defaults. */ + pairingProtocol?: PairingProtocolRequestOptions; + /** Tests may shorten, but never enlarge, the production revocation deadlines. */ + revocationDeadlines?: Partial; + reportRevocationFailure?(diagnostic: { + code: 'network' | 'http' | 'local-cleanup'; + status?: number; + }): void; +} + +export interface CredentialServiceInitialization { + status: 'ready' | 'degraded'; + retryPending: boolean; +} + +interface RevocationDeadlines { + headerMs: number; + bodyMs: number; + recordMs: number; + aggregateMs: number; +} + +interface ActiveCredential extends StoredCredential { + identityEpoch: string; + profileGeneration: number; + selectionGeneration: number; + transportScope: string; +} + +interface PendingActivation { + ticket: string; + probeTicket: number; + profileId: string; + origin: string; + profileGeneration: number; + selectionGeneration: number; + activeProfileId: string | null; + credential: StoredCredential; + identityEpoch: string; +} + +interface PendingLocalActivation { + ticket: string; + probeTicket: number; + profileId: string; + origin: string; + profileGeneration: number; + selectionGeneration: number; +} + +interface ActiveLocalActivation { + ticket: string; + profileId: string; + previousActiveProfileId: string | null; + selectionGeneration: number; +} + +type RequestHeaders = Record; +export interface DesktopRequestDecision { + cancel?: true; + requestHeaders?: RequestHeaders; +} + +const headerName = (headers: RequestHeaders, name: string): string | undefined => + Object.keys(headers).find(key => key.toLowerCase() === name.toLowerCase()); + +const removeHeader = (headers: RequestHeaders, name: string): void => { + for (const existing of Object.keys(headers)) { + if (existing.toLowerCase() === name.toLowerCase()) delete headers[existing]; + } +}; + +const headerValues = (headers: RequestHeaders, name: string): string[] => { + const values: string[] = []; + for (const [key, value] of Object.entries(headers)) { + if (key.toLowerCase() !== name.toLowerCase()) continue; + if (Array.isArray(value)) values.push(...value); + else values.push(value); + } + return values; +}; + +const TRANSPORT_SCOPE_PATTERN = /^[A-Za-z0-9_-]{22}$/; +const MAX_REVOCATION_RESPONSE_BYTES = 2_048; +const TERMINAL_REVOCATION_CODES = new Set(DESKTOP_TOKEN_TERMINAL_CODES); +const REVOCATION_DEADLINES: RevocationDeadlines = { + headerMs: 8_000, + bodyMs: 2_000, + recordMs: 10_000, + aggregateMs: 12_000, +}; + +const boundedRevocationDeadlines = ( + requested: Partial | undefined, +): RevocationDeadlines => Object.fromEntries( + Object.entries(REVOCATION_DEADLINES).map(([key, maximum]) => { + const value = requested?.[key as keyof RevocationDeadlines] ?? maximum; + if (!Number.isSafeInteger(value) || value < 1 || value > maximum) { + throw new Error('Invalid desktop revocation deadline'); + } + return [key, value]; + }), +) as unknown as RevocationDeadlines; + +const linkedAbortController = (signals: readonly AbortSignal[]): { + controller: AbortController; + dispose: () => void; +} => { + const controller = new AbortController(); + const onAbort = (event: Event): void => { + const signal = event.target as AbortSignal; + if (!controller.signal.aborted) controller.abort(signal.reason); + }; + for (const signal of signals) { + if (signal.aborted) { + controller.abort(signal.reason); + break; + } + signal.addEventListener('abort', onAbort, { once: true }); + } + return { + controller, + dispose: () => signals.forEach(signal => signal.removeEventListener('abort', onAbort)), + }; +}; + +const requestOrigin = (value: string): { origin: string; pathname: string; url: URL } | null => { + try { + const httpValue = value.replace(/^ws:/i, 'http:').replace(/^wss:/i, 'https:'); + const url = new URL(value); + if (url.protocol === 'ws:') url.protocol = 'http:'; + if (url.protocol === 'wss:') url.protocol = 'https:'; + if (url.username || url.password || !['http:', 'https:'].includes(url.protocol)) return null; + if (canonicalProprHttpUrlOrigin(httpValue) !== url.origin) return null; + return { origin: url.origin, pathname: url.pathname, url }; + } catch { + return null; + } +}; + +const parseCode = async (response: Response): Promise => { + try { + const value = await response.clone().json() as { code?: unknown }; + return typeof value.code === 'string' ? value.code : undefined; + } catch { + return undefined; + } +}; + +const isEndpointBoundTerminalRevocation = async ( + response: Response, + credential: StoredCredential, + credentialGeneration: string, + signal: AbortSignal, + abortNetwork: () => void, + bodyDeadlineMs: number, +): Promise => { + if (response.redirected) return false; + if (response.url) { + try { + const url = new URL(response.url); + if (url.href !== `${credential.origin}${DESKTOP_TOKEN_REVOCATION_ENDPOINT}`) return false; + } catch { + return false; + } + } + if (response.ok) return true; + if (response.status !== 401 && response.status !== 404) return false; + const contentType = response.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase(); + if (contentType !== 'application/json') return false; + const declaredLength = response.headers.get('content-length'); + if (declaredLength !== null + && (!/^(?:0|[1-9][0-9]*)$/.test(declaredLength) + || Number(declaredLength) > MAX_REVOCATION_RESPONSE_BYTES)) return false; + if (!response.body) return false; + const reader = response.body.getReader(); + const chunks: Uint8Array[] = []; + let received = 0; + let deadline: ReturnType | undefined; + let rejectAbort!: (reason: unknown) => void; + const aborted = new Promise((_resolve, reject) => { rejectAbort = reject; }); + const onAbort = (): void => rejectAbort(signal.reason ?? new Error('Desktop revocation body was cancelled')); + if (signal.aborted) onAbort(); + else signal.addEventListener('abort', onAbort, { once: true }); + deadline = setTimeout(() => { + abortNetwork(); + rejectAbort(new Error('Desktop revocation body timed out')); + }, bodyDeadlineMs); + let text: string; + try { + while (true) { + const part = await Promise.race([reader.read(), aborted]); + if (part.done) break; + if (!(part.value instanceof Uint8Array) || part.value.byteLength === 0) { + abortNetwork(); + return false; + } + received += part.value.byteLength; + if (received > MAX_REVOCATION_RESPONSE_BYTES) { + abortNetwork(); + return false; + } + chunks.push(Uint8Array.from(part.value)); + } + if (declaredLength !== null && Number(declaredLength) !== received) { + abortNetwork(); + return false; + } + const bytes = new Uint8Array(received); + let offset = 0; + for (const chunk of chunks) { + bytes.set(chunk, offset); + offset += chunk.byteLength; + } + text = new TextDecoder('utf-8', { fatal: true }).decode(bytes); + } catch { + abortNetwork(); + return false; + } finally { + if (deadline) clearTimeout(deadline); + signal.removeEventListener('abort', onAbort); + if (signal.aborted) { + // Invoking both primitives is important for native fetch and deterministic + // ReadableStream tests. Network abort is the authoritative bounded wait. + let cancelDeadline: ReturnType | undefined; + try { + await Promise.race([ + reader.cancel(), + new Promise(resolve => { + cancelDeadline = setTimeout(resolve, Math.min(bodyDeadlineMs, 100)); + }), + ]); + } catch { + // The owning network controller is already aborted. + } finally { + if (cancelDeadline) clearTimeout(cancelDeadline); + } + } + try { reader.releaseLock(); } catch { /* A hostile stream may retain a pending read. */ } + } + let raw: unknown; + try { + raw = JSON.parse(text) as unknown; + } catch { + abortNetwork(); + return false; + } + if (!raw || typeof raw !== 'object' || Array.isArray(raw)) { + abortNetwork(); + return false; + } + const body = raw as Record; + const expectedKeys = [ + 'schema', 'version', 'endpoint', 'terminal', 'code', 'credentialGeneration', + ]; + if (Object.keys(body).length !== expectedKeys.length + || expectedKeys.some(key => !(key in body))) { + abortNetwork(); + return false; + } + if (body.schema !== DESKTOP_TOKEN_REVOCATION_SCHEMA + || body.version !== DESKTOP_TOKEN_REVOCATION_VERSION + || body.endpoint !== DESKTOP_TOKEN_REVOCATION_ENDPOINT + || body.terminal !== true + || body.credentialGeneration !== credentialGeneration + || typeof body.code !== 'string' + || !TERMINAL_REVOCATION_CODES.has(body.code)) { + abortNetwork(); + return false; + } + const terminal = response.status === 404 + ? body.code === 'TOKEN_NOT_FOUND' + : body.code === 'INSTANCE_TOKEN_REVOKED' || body.code === 'INSTANCE_TOKEN_EXPIRED'; + if (!terminal) abortNetwork(); + return terminal; +}; + +const authenticationSummary = (capabilities: { + browserPairing: boolean; + instanceBearerTokens: boolean; + socketIoBearerAuthentication: boolean; +}): string => capabilities.browserPairing + && capabilities.instanceBearerTokens + && capabilities.socketIoBearerAuthentication + ? 'Browser approval · REST and Socket.IO bearer access' + : 'Secure desktop pairing is unavailable'; + +export class DesktopCredentialService { + readonly #profiles: CredentialServiceDependencies['profiles']; + readonly #fetch: typeof globalThis.fetch; + readonly #openExternal: (url: string) => Promise; + readonly #clientName: string; + readonly #pairingTiming: Pick; + readonly #pairingProtocol: PairingProtocolRequestOptions; + readonly #reportRevocationFailure: NonNullable; + readonly #revocationDeadlines: RevocationDeadlines; + readonly #internalRequestKey = randomBytes(32).toString('base64url'); + readonly #lifecycleController = new AbortController(); + readonly #profileGenerations = new Map(); + readonly #pairingControllers = new Map(); + #selectionGeneration = 0; + #latestProbeTicket = 0; + #pendingActivation: PendingActivation | null = null; + #pendingLocalActivation: PendingLocalActivation | null = null; + #activeLocalActivation: ActiveLocalActivation | null = null; + #localActivationMutationTicket: string | null = null; + #active: ActiveCredential | null = null; + #publishingPair = false; + #publishWaiters: Array<() => void> = []; + #retryRequested = false; + #retryIncludeDeferred = false; + #revocationWorker: Promise | null = null; + readonly #backgroundTasks = new Set>(); + readonly #operationTasks = new Set>(); + readonly #operationControllers = new Set(); + #closed = false; + #disposePromise: Promise | null = null; + + constructor(dependencies: CredentialServiceDependencies) { + this.#profiles = dependencies.profiles; + this.#fetch = dependencies.fetch; + this.#openExternal = dependencies.openExternal; + this.#clientName = dependencies.clientName; + this.#pairingTiming = dependencies.pairingTiming ?? {}; + this.#pairingProtocol = dependencies.pairingProtocol ?? {}; + this.#reportRevocationFailure = dependencies.reportRevocationFailure ?? (() => undefined); + this.#revocationDeadlines = boundedRevocationDeadlines(dependencies.revocationDeadlines); + } + + async initialize(): Promise { + const operation = this.#beginOperation(); + try { + const worker = this.#requestPendingRevocationRetry(true); + let startupTimer: ReturnType | undefined; + try { + return await Promise.race([ + worker, + new Promise(resolve => { + startupTimer = setTimeout( + () => resolve({ status: 'degraded', retryPending: true }), + this.#revocationDeadlines.aggregateMs, + ); + }), + ]); + } finally { + if (startupTimer) clearTimeout(startupTimer); + } + } finally { + operation.done(); + } + } + + awaitIdle(): Promise { + return this.#awaitIdle(); + } + + async listProfiles() { + const operation = this.#beginOperation(); + try { + return await this.#profiles.list(); + } finally { + operation.done(); + } + } + + async storageSecurity() { + const operation = this.#beginOperation(); + try { + return this.#profiles.security(); + } finally { + operation.done(); + } + } + + async retryPendingRevocations(): Promise { + const operation = this.#beginOperation(); + try { + return await this.#requestPendingRevocationRetry(true); + } finally { + operation.done(); + } + } + + dispose(): Promise { + if (this.#disposePromise) return this.#disposePromise; + this.#closed = true; + this.#active = null; + this.#pendingActivation = null; + this.#pendingLocalActivation = null; + this.#activeLocalActivation = null; + this.#lifecycleController.abort(new Error('Desktop credential service disposed')); + for (const controller of this.#operationControllers) controller.abort(new Error('Desktop credential service disposed')); + for (const controller of this.#pairingControllers.values()) controller.abort(); + this.#pairingControllers.clear(); + this.#disposePromise = (async () => { + await this.#awaitIdle(); + await this.#profiles.awaitIdle(); + })(); + return this.#disposePromise; + } + + async saveProfile( + input: DesktopProfileInput, + beforeOriginChangeCommit?: (previousOrigin: string, nextOrigin: string) => Promise, + ) { + const operation = this.#beginOperation(); + try { + await this.#waitForPairPublish(); + this.#schedulePendingRevocationRetry(); + const before = input.id + ? (await this.#profiles.list()).profiles.find(profile => profile.id === input.id) + : undefined; + const nextOrigin = normalizeApiBaseUrl(input.apiBaseUrl ?? ''); + if (!nextOrigin) throw new Error('Invalid desktop API URL'); + let invalidatedBeforeSave = false; + if (before && before.apiBaseUrl !== nextOrigin) { + this.#invalidateProfileOperations(before.id); + invalidatedBeforeSave = true; + } + const transaction = await this.#profiles.saveAndDetachCredential(input, beforeOriginChangeCommit); + if (transaction.originChanged && !invalidatedBeforeSave) { + this.#invalidateProfileOperations(transaction.profile.id); + } + if (transaction.detachedCredential) this.#clearActiveIfCredential(transaction.detachedCredential); + if (transaction.originChanged && this.#active?.profileId === transaction.profile.id) this.#active = null; + this.#schedulePendingRevocationRetry(); + return transaction.profile; + } finally { + operation.done(); + } + } + + async removeProfile( + profileId: string, + beforeCommit?: (origin: string) => Promise, + ): Promise { + const operation = this.#beginOperation(); + try { + if (this.#publishingPair) await this.#waitForPairPublish(); + this.#invalidateProfileOperations(profileId); + this.#schedulePendingRevocationRetry(); + const detached = await this.#profiles.detachProfile(profileId, beforeCommit); + if (!detached) return null; + if (detached.credential) this.#clearActiveIfCredential(detached.credential); + this.#schedulePendingRevocationRetry(); + return detached.profile.apiBaseUrl; + } finally { + operation.done(); + } + } + + async setActiveProfile(profileId: string | null): Promise { + const operation = this.#beginOperation(); + try { + if (this.#publishingPair) await this.#waitForPairPublish(); + this.#selectionGeneration += 1; + this.#latestProbeTicket += 1; + this.#pendingActivation = null; + this.#pendingLocalActivation = null; + this.#activeLocalActivation = null; + for (const controller of this.#pairingControllers.values()) controller.abort(); + this.#pairingControllers.clear(); + this.#active = null; + this.#schedulePendingRevocationRetry(); + await this.#profiles.setActive(profileId); + } finally { + operation.done(); + } + } + + async cancelPairing(profileId: string): Promise { + const operation = this.#beginOperation(); + try { + if (this.#publishingPair) await this.#waitForPairPublish(); + this.#cancelPairingNow(profileId); + } finally { + operation.done(); + } + } + + async prepareLocalActivation(input: DesktopProfileInput): Promise<{ localActivationTicket: string }> { + const operation = this.#beginOperation(); + try { + if (!input.id) throw new Error('Desktop profile id is required'); + const origin = normalizeApiBaseUrl(input.apiBaseUrl ?? ''); + if (!origin || origin !== input.apiBaseUrl) throw new Error('Invalid desktop API URL'); + const hostname = new URL(origin).hostname.toLowerCase(); + if (hostname !== 'localhost' && hostname !== '127.0.0.1' && hostname !== '[::1]') { + throw new Error('Local desktop activation requires a loopback profile'); + } + const probeTicket = ++this.#latestProbeTicket; + this.#pendingActivation = null; + // Reserve the generation before the first await. Once a newer local + // attempt reaches main, an older durable activation can no longer win + // while this request waits for a pairing publication to settle. + this.#pendingLocalActivation = null; + await this.#waitForPairPublish(); + if (this.#closed || this.#latestProbeTicket !== probeTicket) { + throw new Error('Local desktop activation expired. Check the connection again.'); + } + const localActivationTicket = randomBytes(32).toString('base64url'); + this.#pendingLocalActivation = { + ticket: localActivationTicket, + probeTicket, + profileId: input.id, + origin, + profileGeneration: this.#generation(input.id), + selectionGeneration: this.#selectionGeneration, + }; + return { localActivationTicket }; + } finally { + operation.done(); + } + } + + async activateLocal( + localActivationTicket: unknown, + beforeCommit?: (previousOrigin: string | undefined, nextOrigin: string) => Promise, + ): Promise<{ status: 'ready'; profileId: string }> { + const operation = this.#beginOperation(); + try { + await this.#waitForPairPublish(); + if (typeof localActivationTicket !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(localActivationTicket)) { + throw new Error('Invalid local desktop activation ticket'); + } + const pending = this.#pendingLocalActivation; + if (!pending || pending.ticket !== localActivationTicket || !this.#pendingLocalIsCurrent(pending)) { + throw new Error('Local desktop activation expired. Check the connection again.'); + } + // Consume before the durable mutation so a concurrent replay cannot + // share the same trusted activation decision. + this.#pendingLocalActivation = null; + this.#localActivationMutationTicket = pending.ticket; + const activated = await this.#profiles.activateLocalProfile( + pending.profileId, + pending.origin, + () => this.#pendingLocalIsCurrent(pending), + beforeCommit, + ); + if (!activated) { + throw new Error('Local desktop activation expired. Check the connection again.'); + } + if (!this.#pendingLocalIsCurrent(pending) + || this.#localActivationMutationTicket !== pending.ticket) { + await this.#profiles.restoreLocalProfile( + pending.profileId, + activated.previousActiveProfileId, + () => this.#selectionGeneration === pending.selectionGeneration + && this.#localActivationMutationTicket === pending.ticket, + ); + throw new Error('Local desktop activation expired. Check the connection again.'); + } + this.#selectionGeneration += 1; + this.#active = null; + this.#activeLocalActivation = { + ticket: pending.ticket, + profileId: pending.profileId, + previousActiveProfileId: activated.previousActiveProfileId, + selectionGeneration: this.#selectionGeneration, + }; + return { status: 'ready', profileId: pending.profileId }; + } finally { + operation.done(); + } + } + + async discardLocal(localActivationTicket: unknown): Promise<{ discarded: boolean }> { + const operation = this.#beginOperation(); + try { + if (typeof localActivationTicket !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(localActivationTicket)) { + return { discarded: false }; + } + const active = this.#activeLocalActivation; + if (!active || active.ticket !== localActivationTicket + || active.selectionGeneration !== this.#selectionGeneration) return { discarded: false }; + // Consume before awaiting. A newer activation changes either this exact + // memory authority or the selection generation, making rollback a no-op. + this.#activeLocalActivation = null; + const discarded = await this.#profiles.restoreLocalProfile( + active.profileId, + active.previousActiveProfileId, + () => this.#activeLocalActivation === null + && this.#selectionGeneration === active.selectionGeneration + && this.#localActivationMutationTicket === active.ticket, + ); + return { discarded }; + } finally { + operation.done(); + } + } + + #cancelPairingNow(profileId: string): void { + const generation = this.#bumpGeneration(profileId); + // Cancelling an in-progress edit must not disable the still-committed + // credential for an active profile. + if (this.#active?.profileId === profileId) this.#active.profileGeneration = generation; + this.#pairingControllers.get(profileId)?.abort(); + this.#pairingControllers.delete(profileId); + } + + async pair(input: DesktopProfileInput): Promise<{ paired: true }> { + const operation = this.#beginOperation(); + try { + await this.#waitForPairPublish(); + this.#schedulePendingRevocationRetry(); + if (!input.id) throw new Error('Desktop profile id is required'); + if (!this.#profiles.security().available) { + throw new Error('OS-backed secure storage is required for desktop pairing.'); + } + const origin = normalizeApiBaseUrl(input.apiBaseUrl ?? ''); + if (!origin) throw new Error('Invalid desktop API URL'); + const label = input.label?.trim(); + if (!label || label.length > 80) throw new Error('Profile label must contain 1 to 80 characters'); + const proposed = { ...input, id: input.id, label, apiBaseUrl: origin }; + const baseline = await this.#profiles.readProfileCredential(proposed.id); + this.#cancelPairingNow(proposed.id); + if (this.#pendingActivation?.profileId === proposed.id) this.#pendingActivation = null; + const controller = new AbortController(); + this.#pairingControllers.set(proposed.id, controller); + const profileGeneration = this.#generation(proposed.id); + const selectionGeneration = this.#selectionGeneration; + const credentialGeneration = randomBytes(16).toString('base64url'); + let transient: StoredCredential | null = null; + let transientRevocation: PendingCredentialRevocation | null = null; + let provisional: Awaited> | null = null; + let publicationStarted = false; + const client = this.#client(proposed.apiBaseUrl); + + try { + const completed = await client.pairDesktop(this.#clientName, { + ...this.#pairingTiming, + binding: { + instanceId: proposed.id, + origin: proposed.apiBaseUrl, + scope: 'desktop-instance', + credentialGeneration, + }, + signal: controller.signal, + onApprovalRequired: async approvalUrl => { + this.#assertPairingCurrent( + proposed.id, proposed.apiBaseUrl, profileGeneration, selectionGeneration, controller.signal, + ); + await this.#openExternal(approvalUrl); + }, + }); + provisional = completed; + transient = { + version: 1, + profileId: proposed.id, + origin: proposed.apiBaseUrl, + token: completed.token, + }; + const journaled = await this.#profiles.journalPendingRevocation(transient, credentialGeneration); + if ('stored' in journaled) { + throw new Error('OS-backed secure storage is required for desktop pairing.'); + } + transientRevocation = journaled; + this.#assertPairingCurrent( + proposed.id, proposed.apiBaseUrl, profileGeneration, selectionGeneration, controller.signal, + ); + let activationError: unknown; + for (let attempt = 0; attempt < 2; attempt += 1) { + try { + await client.activateDesktopPairing(completed, controller.signal); + activationError = undefined; + break; + } catch (error) { + activationError = error; + if (controller.signal.aborted) break; + } + } + if (activationError) throw activationError; + this.#assertPairingCurrent( + proposed.id, proposed.apiBaseUrl, profileGeneration, selectionGeneration, controller.signal, + ); + const committed = await this.#profiles.commitPairedProfile( + proposed, + transient, + baseline, + () => !controller.signal.aborted + && this.#generation(proposed.id) === profileGeneration + && this.#selectionGeneration === selectionGeneration, + () => this.#beginPairPublish( + proposed.id, profileGeneration, selectionGeneration, controller.signal, + ), + () => { + publicationStarted = true; + if (this.#active?.profileId === proposed.id) this.#active = null; + }, + transientRevocation.id, + ); + if (committed && 'stored' in committed) { + throw new Error('OS-backed secure storage is required for desktop pairing.'); + } + if (!committed) throw new ProprClientError('Desktop pairing was cancelled.', { kind: 'aborted' }); + transient = null; + transientRevocation = null; + this.#schedulePendingRevocationRetry(); + return { paired: true }; + } catch (error) { + if (transient && !transientRevocation && !publicationStarted) { + try { + const journaled = await this.#profiles.journalPendingRevocation(transient, credentialGeneration); + if (!('stored' in journaled)) transientRevocation = journaled; + } catch { + // Preserve the original pairing/storage error. A retry is attempted + // below whenever durable material was established. + } + } + if (transientRevocation && !publicationStarted) { + let cancelled = false; + if (provisional) { + try { + await client.cancelDesktopPairing(provisional, operation.signal); + cancelled = await this.#profiles.completePendingRevocation( + transientRevocation.id, + transientRevocation.credential, + transientRevocation.credentialGeneration, + ); + } catch { + // The encrypted rollback remains authoritative until either exact + // cancellation or the endpoint-bound revocation worker confirms it. + } + } + if (!cancelled) { + const released = await this.#profiles.releasePendingRevocation( + transientRevocation.id, + transientRevocation.credentialGeneration, + ); + if (released) await this.#requestPendingRevocationRetry(); + } + } + if (controller.signal.aborted || operation.signal.aborted + || (error instanceof ProprClientError && error.kind === 'aborted')) { + throw new Error('Desktop pairing was cancelled.'); + } + throw error; + } finally { + if (this.#pairingControllers.get(proposed.id) === controller) this.#pairingControllers.delete(proposed.id); + } + } finally { + operation.done(); + } + } + + async probe(input: DesktopProfileInput): Promise { + const operation = this.#beginOperation(); + try { + await this.#waitForPairPublish(); + this.#schedulePendingRevocationRetry(); + if (!input.id) throw new Error('Desktop profile id is required'); + const origin = normalizeApiBaseUrl(input.apiBaseUrl ?? ''); + if (!origin || origin !== input.apiBaseUrl) throw new Error('Invalid desktop API URL'); + const probeTicket = ++this.#latestProbeTicket; + this.#pendingActivation = null; + this.#pendingLocalActivation = null; + const operationGeneration = this.#generation(input.id); + const operationSelection = this.#selectionGeneration; + const discoveryClient = this.#client(origin); + let discovery; + try { + discovery = await discoveryClient.discoverDesktop(8_000, operation.signal); + } catch (error) { + return { + status: 'offline', + message: error instanceof Error + ? `ProPR could not discover this instance. ${error.message}` + : 'ProPR could not discover this instance.', + }; + } + const authentication = authenticationSummary(discovery.desktopAuthentication); + if (!discovery.compatibility.compatible) { + return { status: 'incompatible', message: discovery.compatibility.message, version: discovery.version }; + } + if (!this.#profiles.security().available) { + return { + status: 'authentication-required', + message: 'OS-backed secure storage is unavailable. Enable your system keychain before pairing.', + version: discovery.version, + authentication, + }; + } + + const initial = await this.#profiles.readProfileCredential(input.id); + if (this.#generation(input.id) !== operationGeneration + || this.#selectionGeneration !== operationSelection + || this.#latestProbeTicket !== probeTicket) { + return { status: 'offline', message: 'This connection changed while it was being checked. Try again.' }; + } + if (initial.profile?.apiBaseUrl !== origin) { + return { + status: 'authentication-required', + message: discovery.desktopAuthentication.browserPairing + ? 'Approve this desktop in your browser to continue.' + : 'This instance does not support secure desktop pairing.', + version: discovery.version, + authentication, + }; + } + const credential = initial.credential; + if (!credential) { + return { + status: 'authentication-required', + message: discovery.desktopAuthentication.browserPairing + ? 'Approve this desktop in your browser to continue.' + : 'This instance does not support secure desktop pairing.', + version: discovery.version, + authentication, + }; + } + if (credential.origin !== origin) { + const removed = await this.#profiles.removeCredentialIfCurrent( + credential, + origin, + () => this.#generation(input.id!) === operationGeneration + && this.#selectionGeneration === operationSelection + && this.#latestProbeTicket === probeTicket, + ); + if (!removed) { + return { status: 'offline', message: 'This connection changed while it was being checked. Try again.' }; + } + this.#clearActiveIfCredential(credential); + this.#schedulePendingRevocationRetry(); + return { + status: 'authentication-required', + message: discovery.desktopAuthentication.browserPairing + ? 'Approve this desktop in your browser to continue.' + : 'This instance does not support secure desktop pairing.', + version: discovery.version, + authentication, + }; + } + + let response: Response; + try { + response = await this.#authenticatedFetch( + credential, '/api/auth/user', { cache: 'no-store', signal: operation.signal }, 8_000, + ); + } catch { + return { status: 'offline', message: 'The instance was discovered but authentication could not be checked.' }; + } + if (response.ok) { + const current = await this.#profiles.readProfileCredential(input.id); + if (this.#generation(input.id) !== operationGeneration + || this.#selectionGeneration !== operationSelection + || this.#latestProbeTicket !== probeTicket + || current.profile?.apiBaseUrl !== origin + || current.credential?.origin !== origin) { + return { status: 'offline', message: 'This connection changed while it was being checked. Try again.' }; + } + if (!current.credential + || current.credential.version !== credential.version + || current.credential.profileId !== credential.profileId + || current.credential.origin !== credential.origin + || current.credential.token !== credential.token) { + return { status: 'offline', message: 'This connection changed while it was being checked. Try again.' }; + } + const activationTicket = randomBytes(32).toString('base64url'); + this.#pendingActivation = { + ticket: activationTicket, + probeTicket, + profileId: input.id, + origin, + profileGeneration: operationGeneration, + selectionGeneration: operationSelection, + activeProfileId: current.activeProfileId, + credential: { ...credential }, + identityEpoch: current.identityEpoch!, + }; + return { status: 'ready', version: discovery.version, authentication, activationTicket }; + } + + const code = await parseCode(response); + if (code && DEFINITIVE_INVALID_CODES.has(code)) { + const removed = await this.#profiles.removeCredentialIfCurrent( + credential, + origin, + () => this.#generation(input.id!) === operationGeneration + && this.#selectionGeneration === operationSelection + && this.#latestProbeTicket === probeTicket, + ); + if (!removed) { + return { status: 'offline', message: 'This connection changed while it was being checked. Try again.' }; + } + this.#clearActiveIfCredential(credential); + this.#schedulePendingRevocationRetry(); + return { + status: 'authentication-required', + message: 'Access to this instance was revoked or expired. Pair again to continue.', + version: discovery.version, + authentication, + }; + } + if (response.status === 401 || response.status === 403) { + return { + status: 'offline', + message: 'The credential is still paired, but current authorization could not be confirmed. Try again.', + }; + } + return { status: 'offline', message: `The instance returned HTTP ${response.status} while checking authentication.` }; + } finally { + operation.done(); + } + } + + async activate(activationTicket: unknown): Promise { + const operation = this.#beginOperation(); + try { + await this.#waitForPairPublish(); + this.#schedulePendingRevocationRetry(); + if (typeof activationTicket !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(activationTicket)) { + throw new Error('Invalid desktop activation ticket'); + } + const pending = this.#pendingActivation; + // Consume before awaiting so concurrent calls and replays can never share a + // credential-bearing activation decision. + this.#pendingActivation = null; + if (!pending || pending.ticket !== activationTicket || !this.#pendingIsCurrent(pending)) { + throw new Error('Desktop activation expired. Check the connection again.'); + } + + const activated = await this.#profiles.activateProfile( + pending.credential, + pending.identityEpoch, + pending.origin, + pending.activeProfileId, + () => this.#pendingIsCurrent(pending), + ); + if (activated !== pending.identityEpoch || !this.#pendingIsCurrent(pending)) { + this.#active = null; + throw new Error('Desktop activation expired. Check the connection again.'); + } + + const transportScope = randomBytes(16).toString('base64url'); + this.#selectionGeneration += 1; + for (const controller of this.#pairingControllers.values()) controller.abort(); + this.#pairingControllers.clear(); + this.#active = { + ...pending.credential, + identityEpoch: pending.identityEpoch, + profileGeneration: pending.profileGeneration, + selectionGeneration: this.#selectionGeneration, + transportScope, + }; + this.#activeLocalActivation = null; + return { + status: 'ready', + profileId: pending.profileId, + transportScope, + identityEpoch: pending.identityEpoch, + }; + } finally { + operation.done(); + } + } + + async invalidate(value: DesktopAccessInvalidation): Promise<{ invalidated: boolean }> { + const operation = this.#beginOperation(); + try { + await this.#waitForPairPublish(); + this.#schedulePendingRevocationRetry(); + if (!DEFINITIVE_INVALID_CODES.has(value.code)) return { invalidated: false }; + const active = this.#active; + if (!active || active.profileId !== value.profileId + || active.transportScope !== value.transportScope + || this.#generation(active.profileId) !== active.profileGeneration + || this.#selectionGeneration !== active.selectionGeneration) return { invalidated: false }; + this.#active = null; + const invalidationGeneration = this.#bumpGeneration(active.profileId); + const removed = await this.#profiles.removeCredentialIfCurrent( + active, + active.origin, + () => this.#generation(active.profileId) === invalidationGeneration, + ); + if (removed) this.#schedulePendingRevocationRetry(); + return { invalidated: removed }; + } finally { + operation.done(); + } + } + + async discardActivation(value: DesktopConnectionScope): Promise<{ discarded: boolean }> { + const operation = this.#beginOperation(); + try { + await this.#waitForPairPublish(); + this.#schedulePendingRevocationRetry(); + const active = this.#active; + if (!active || typeof value?.profileId !== 'string' || typeof value?.transportScope !== 'string' + || active.profileId !== value.profileId || active.transportScope !== value.transportScope + || this.#generation(active.profileId) !== active.profileGeneration + || this.#selectionGeneration !== active.selectionGeneration) return { discarded: false }; + this.#active = null; + this.#selectionGeneration += 1; + this.#latestProbeTicket += 1; + this.#pendingActivation = null; + await this.#profiles.setActive(null); + return { discarded: true }; + } finally { + operation.done(); + } + } + + prepareRequest( + url: string, + originalHeaders: RequestHeaders, + details: { method?: string; resourceType?: string } = {}, + ): DesktopRequestDecision { + if (this.#closed) return { cancel: true }; + const headers = { ...originalHeaders }; + if (/^(?:https?|wss?):/i.test(url)) { + const httpUrl = url.replace(/^ws:/i, 'http:').replace(/^wss:/i, 'https:'); + if (!canonicalProprHttpUrlOrigin(httpUrl)) return { cancel: true }; + } + const internalHeader = headerName(headers, 'x-propr-desktop-main-request'); + const trustedMainRequest = internalHeader !== undefined + && headers[internalHeader] === this.#internalRequestKey; + if (internalHeader) delete headers[internalHeader]; + + const scopeValues = headerValues(headers, DESKTOP_TRANSPORT_SCOPE_HEADER); + removeHeader(headers, DESKTOP_TRANSPORT_SCOPE_HEADER); + + // The packaged renderer has no cookie identity on any remote HTTP(S) or + // WS(S) origin. It also cannot supply its own bearer. Main-process bearer + // requests are distinguished by the per-process secret marker above. + removeHeader(headers, 'cookie'); + if (!trustedMainRequest) removeHeader(headers, 'authorization'); + + const target = requestOrigin(url); + if (target && target.url.protocol === 'http:' && !normalizeApiBaseUrl(target.origin)) { + return { cancel: true }; + } + if (trustedMainRequest) return { requestHeaders: headers }; + + const markedRestRequest = scopeValues.length > 0; + if (markedRestRequest && (scopeValues.length !== 1 || !TRANSPORT_SCOPE_PATTERN.test(scopeValues[0]))) { + return { cancel: true }; + } + if (!trustedMainRequest && target + && (target.pathname.startsWith('/api/desktop/pairings') + || target.pathname.startsWith('/api/desktop/tokens'))) return { cancel: true }; + + const active = this.#active; + const activeIsCurrent = active !== null + && this.#generation(active.profileId) === active.profileGeneration + && this.#selectionGeneration === active.selectionGeneration; + const isApiRequest = target?.pathname.startsWith('/api/') === true; + const isSocketUpgrade = target?.pathname === '/socket.io/' + && target.url.searchParams.get('transport') === 'websocket' + && (details.resourceType === 'webSocket' + || headerValues(originalHeaders, 'upgrade').some(value => value.toLowerCase() === 'websocket')); + + if (isSocketUpgrade && target) { + const queryScopes = target.url.searchParams.getAll(DESKTOP_TRANSPORT_SCOPE_QUERY); + if (queryScopes.length !== 1 || !TRANSPORT_SCOPE_PATTERN.test(queryScopes[0]) + || !activeIsCurrent || target.origin !== active.origin + || queryScopes[0] !== active.transportScope) return { cancel: true }; + headers.Authorization = `Bearer ${active.token}`; + return { requestHeaders: headers }; + } + + if (!markedRestRequest) return { requestHeaders: headers }; + if (!target || !isApiRequest || !activeIsCurrent || target.origin !== active.origin + || scopeValues[0] !== active.transportScope) return { cancel: true }; + if (details.method?.toUpperCase() === 'OPTIONS') return { requestHeaders: headers }; + headers.Authorization = `Bearer ${active.token}`; + return { requestHeaders: headers }; + } + + authorizeRequest(url: string, originalHeaders: RequestHeaders): RequestHeaders { + return this.prepareRequest(url, originalHeaders).requestHeaders ?? {}; + } + + sanitizeResponseHeaders(url: string, originalHeaders: RequestHeaders): RequestHeaders { + const headers = { ...originalHeaders }; + const target = requestOrigin(url); + if (target) removeHeader(headers, 'set-cookie'); + return headers; + } + + #client(origin: string): ProprClient { + return new ProprClient({ + baseUrl: origin, + authentication: { type: 'none' }, + fetch: this.#mainFetch, + defaultTimeoutMs: 8_000, + pairingProtocol: this.#pairingProtocol, + }); + } + + #authenticatedFetch( + credential: StoredCredential, + path: string, + init: RequestInit, + timeoutMs: number, + ): Promise { + const client = new ProprClient({ + baseUrl: credential.origin, + authentication: { type: 'bearer', getAccessToken: () => credential.token }, + fetch: this.#mainFetch, + }); + return client.fetch(client.url(path), { ...init, redirect: 'manual' }, { timeoutMs }); + } + + readonly #mainFetch: typeof globalThis.fetch = (input, init) => { + const headers = new Headers(init?.headers); + headers.set('X-ProPR-Desktop-Main-Request', this.#internalRequestKey); + return this.#fetch(input, { ...init, headers }); + }; + + #schedulePendingRevocationRetry(includeDeferred = false): void { + this.#requestPendingRevocationRetry(includeDeferred); + } + + #requestPendingRevocationRetry( + includeDeferred = false, + ): Promise { + if (this.#closed) return Promise.resolve({ status: 'degraded', retryPending: true }); + this.#retryRequested = true; + this.#retryIncludeDeferred ||= includeDeferred; + if (this.#revocationWorker) return this.#revocationWorker; + const worker = this.#runPendingRevocationWorker(); + this.#revocationWorker = worker; + this.#backgroundTasks.add(worker); + const settled = (): void => { + this.#backgroundTasks.delete(worker); + if (this.#revocationWorker === worker) this.#revocationWorker = null; + }; + worker.then(settled, settled); + return worker; + } + + async #runPendingRevocationWorker(): Promise { + const aggregate = linkedAbortController([this.#lifecycleController.signal]); + const aggregateTimer = setTimeout( + () => aggregate.controller.abort(new Error('Desktop revocation aggregate deadline exceeded')), + this.#revocationDeadlines.aggregateMs, + ); + const attemptedGenerations = new Set(); + let retryPending = false; + try { + while (this.#retryRequested && !this.#closed && !aggregate.controller.signal.aborted) { + this.#retryRequested = false; + const includeDeferred = this.#retryIncludeDeferred; + this.#retryIncludeDeferred = false; + let pending: PendingCredentialRevocation[]; + try { + pending = await this.#profiles.pendingRevocations(includeDeferred); + } catch { + retryPending = true; + this.#reportFixedRevocationFailure({ code: 'local-cleanup' }); + continue; + } + for (const entry of pending) { + if (attemptedGenerations.has(entry.credentialGeneration)) continue; + if (this.#closed || aggregate.controller.signal.aborted) { + retryPending = true; + this.#reportFixedRevocationFailure({ code: 'network' }); + break; + } + attemptedGenerations.add(entry.credentialGeneration); + const result = await this.#retryPendingRevocation(entry, aggregate.controller.signal); + if (result === 'complete') continue; + retryPending = true; + if (result === 'network') { + this.#reportFixedRevocationFailure({ code: 'network' }); + } else if (typeof result === 'object') { + this.#reportFixedRevocationFailure({ code: 'http', status: result.status }); + } else { + this.#reportFixedRevocationFailure({ code: 'local-cleanup' }); + } + } + } + if (aggregate.controller.signal.aborted || this.#closed) retryPending = true; + return { status: retryPending ? 'degraded' : 'ready', retryPending }; + } finally { + clearTimeout(aggregateTimer); + aggregate.dispose(); + } + } + + async #retryPendingRevocation( + entry: PendingCredentialRevocation, + aggregateSignal: AbortSignal, + ): Promise<'complete' | 'network' | 'local-cleanup' | { status: number; type: 'http' }> { + const record = linkedAbortController([ + this.#lifecycleController.signal, + aggregateSignal, + ]); + const recordTimer = setTimeout( + () => record.controller.abort(new Error('Desktop revocation record deadline exceeded')), + this.#revocationDeadlines.recordMs, + ); + try { + const headers = new Headers({ + Authorization: `Bearer ${entry.credential.token}`, + [DESKTOP_REVOCATION_BINDING_HEADER]: entry.credentialGeneration, + }); + let response: Response; + const headerTimer = setTimeout( + () => record.controller.abort(new Error('Desktop revocation header deadline exceeded')), + this.#revocationDeadlines.headerMs, + ); + try { + response = await this.#mainFetch( + `${entry.credential.origin}${DESKTOP_TOKEN_REVOCATION_ENDPOINT}`, + { + method: 'DELETE', + headers, + credentials: 'omit', + cache: 'no-store', + redirect: 'manual', + signal: record.controller.signal, + }, + ); + } catch { + return 'network'; + } finally { + clearTimeout(headerTimer); + } + if (!await isEndpointBoundTerminalRevocation( + response, + entry.credential, + entry.credentialGeneration, + record.controller.signal, + () => record.controller.abort(new Error('Desktop revocation response rejected')), + this.#revocationDeadlines.bodyMs, + )) { + return { type: 'http', status: response.status }; + } + record.controller.abort(); + try { + const completed = await this.#profiles.completePendingRevocation( + entry.id, entry.credential, entry.credentialGeneration, + ); + return completed ? 'complete' : 'local-cleanup'; + } catch { + return 'local-cleanup'; + } + } finally { + record.controller.abort(); + clearTimeout(recordTimer); + record.dispose(); + } + } + + async #awaitIdle(): Promise { + while (this.#backgroundTasks.size > 0 || this.#operationTasks.size > 0) { + await Promise.allSettled([...this.#backgroundTasks, ...this.#operationTasks]); + } + } + + #reportFixedRevocationFailure(diagnostic: { + code: 'network' | 'http' | 'local-cleanup'; + status?: number; + }): void { + try { + this.#reportRevocationFailure(diagnostic); + } catch { + // Diagnostics must never alter durable retry state or task settlement. + } + } + + #assertOpen(): void { + if (this.#closed) throw new Error('Desktop credential service is closed'); + } + + #beginOperation(): { signal: AbortSignal; done: () => void } { + this.#assertOpen(); + const linked = linkedAbortController([this.#lifecycleController.signal]); + const controller = linked.controller; + let settle!: () => void; + const task = new Promise(resolve => { settle = resolve; }); + this.#operationTasks.add(task); + this.#operationControllers.add(controller); + let finished = false; + return { + signal: controller.signal, + done: () => { + if (finished) return; + finished = true; + linked.dispose(); + this.#operationControllers.delete(controller); + this.#operationTasks.delete(task); + settle(); + }, + }; + } + + #beginPairPublish( + profileId: string, + profileGeneration: number, + selectionGeneration: number, + signal: AbortSignal, + ): (() => void) | null { + if (this.#publishingPair || signal.aborted + || this.#generation(profileId) !== profileGeneration + || this.#selectionGeneration !== selectionGeneration) return null; + this.#publishingPair = true; + let released = false; + return () => { + if (released) return; + released = true; + this.#publishingPair = false; + const waiters = this.#publishWaiters.splice(0); + waiters.forEach(waiter => waiter()); + }; + } + + #waitForPairPublish(): Promise { + if (!this.#publishingPair) return Promise.resolve(); + return new Promise(resolve => this.#publishWaiters.push(resolve)); + } + + #generation(profileId: string): number { + return this.#profileGenerations.get(profileId) ?? 0; + } + + #pendingIsCurrent(pending: PendingActivation): boolean { + return !this.#closed + && this.#latestProbeTicket === pending.probeTicket + && this.#generation(pending.profileId) === pending.profileGeneration + && this.#selectionGeneration === pending.selectionGeneration; + } + + #pendingLocalIsCurrent(pending: PendingLocalActivation): boolean { + return !this.#closed + && this.#latestProbeTicket === pending.probeTicket + && this.#generation(pending.profileId) === pending.profileGeneration + && this.#selectionGeneration === pending.selectionGeneration; + } + + #clearActiveIfCredential(credential: StoredCredential): void { + if (this.#active?.profileId === credential.profileId + && this.#active.origin === credential.origin + && this.#active.token === credential.token) this.#active = null; + } + + #bumpGeneration(profileId: string): number { + const generation = this.#generation(profileId) + 1; + this.#profileGenerations.set(profileId, generation); + return generation; + } + + #invalidateProfileOperations(profileId: string): void { + this.#bumpGeneration(profileId); + if (this.#pendingActivation?.profileId === profileId) this.#pendingActivation = null; + if (this.#active?.profileId === profileId) this.#active = null; + this.#pairingControllers.get(profileId)?.abort(); + this.#pairingControllers.delete(profileId); + } + + #assertPairingCurrent( + profileId: string, + origin: string, + profileGeneration: number, + selectionGeneration: number, + signal: AbortSignal, + ): void { + if (signal.aborted || this.#generation(profileId) !== profileGeneration + || this.#selectionGeneration !== selectionGeneration) { + throw new ProprClientError('Desktop pairing was cancelled.', { kind: 'aborted' }); + } + if (normalizeApiBaseUrl(origin) !== origin) throw new Error('Invalid desktop API URL'); + } + +} diff --git a/apps/desktop/src/desktop-host.test.ts b/apps/desktop/src/desktop-host.test.ts new file mode 100644 index 000000000..3c7a7344b --- /dev/null +++ b/apps/desktop/src/desktop-host.test.ts @@ -0,0 +1,54 @@ +import assert from 'node:assert/strict'; +import { realpathSync } from 'node:fs'; +import { mkdir, mkdtemp, realpath, rm, symlink, writeFile } from 'node:fs/promises'; +import { tmpdir } from 'node:os'; +import { join } from 'node:path'; +import { describe, it } from 'node:test'; +import { resolvePackagedSetupResources } from './desktop-host'; + +const createResources = async (): Promise => { + const root = await mkdtemp(join(realpathSync(tmpdir()), 'propr-desktop-resources-')); + await mkdir(join(root, 'orchestrator')); + await mkdir(join(root, 'assets')); + await writeFile(join(root, 'orchestrator', 'orchestrator.mjs'), 'export {};\n'); + await writeFile(join(root, 'assets', 'env.example.txt'), 'PROPR_DATA_DIR=data\n'); + return root; +}; + +describe('packaged desktop setup resources', () => { + it('returns canonical regular resources beneath resourcesPath', async () => { + const root = await createResources(); + try { + const resources = await resolvePackagedSetupResources(root); + assert.equal( + await realpath(resources.orchestratorPath), + await realpath(join(root, 'orchestrator', 'orchestrator.mjs')), + ); + assert.equal( + await realpath(resources.stackTemplatePath), + await realpath(join(root, 'assets', 'env.example.txt')), + ); + } finally { + await rm(root, { recursive: true, force: true }); + } + }); + + it('rejects linked resource ancestors and linked files', async () => { + const root = await createResources(); + const outside = await mkdtemp(join(realpathSync(tmpdir()), 'propr-desktop-resource-target-')); + try { + await rm(join(root, 'orchestrator'), { recursive: true }); + await symlink(outside, join(root, 'orchestrator')); + await writeFile(join(outside, 'orchestrator.mjs'), 'export {};\n'); + await assert.rejects(resolvePackagedSetupResources(root), /symbolic links/); + + await rm(join(root, 'orchestrator')); + await mkdir(join(root, 'orchestrator')); + await symlink(join(outside, 'orchestrator.mjs'), join(root, 'orchestrator', 'orchestrator.mjs')); + await assert.rejects(resolvePackagedSetupResources(root), /symbolic links/); + } finally { + await rm(root, { recursive: true, force: true }); + await rm(outside, { recursive: true, force: true }); + } + }); +}); diff --git a/apps/desktop/src/desktop-host.ts b/apps/desktop/src/desktop-host.ts new file mode 100644 index 000000000..20d8c18d7 --- /dev/null +++ b/apps/desktop/src/desktop-host.ts @@ -0,0 +1,149 @@ +import { ConfigManager } from '@propr/cli/dist/config/index.js'; +import { loginWithGithubCli } from '@propr/cli/dist/auth/githubLogin.js'; +import { configureStackTemplatePath } from '@propr/cli/dist/commands/initStack.js'; +import { createDefaultActions } from '@propr/cli/dist/commands/setup/hostActions.js'; +import { configureOrchestratorAssetPath, getHostConfig } from '@propr/cli/dist/orchestrator/index.js'; +import { localhostServiceUrl } from '@propr/cli/dist/utils/dockerPort.js'; +import { lstat, realpath } from 'node:fs/promises'; +import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'; +import type { SetupActions } from '@propr/local-setup'; +import type { LocalLifecycleHost } from './lifecycle'; +import { bindRootOperations, RootDirectoryAuthority } from './setup-capabilities'; + +export interface DesktopLocalHost { + actions: SetupActions; + config: ConfigManager; + lifecycle: LocalLifecycleHost; + resolveApiBaseUrl(rootDir: string, signal?: AbortSignal): Promise; +} + +const canonicalResource = async ( + root: string, + segments: readonly string[], + expected: 'file' | 'directory', +): Promise => { + let current = root; + for (let index = 0; index < segments.length; index += 1) { + current = join(current, segments[index]); + const stats = await lstat(current); + if (stats.isSymbolicLink()) throw new Error('Packaged local-setup resources must not contain symbolic links'); + const isLast = index === segments.length - 1; + if ((!isLast || expected === 'directory') && !stats.isDirectory()) { + throw new Error('Packaged local-setup resource directory is invalid'); + } + if (isLast && expected === 'file' && !stats.isFile()) { + throw new Error('Packaged local-setup resource file is invalid'); + } + } + const canonical = await realpath(current); + const scope = relative(root, canonical); + if (!scope || scope === '..' || scope.startsWith(`..${sep}`) || isAbsolute(scope)) { + throw new Error('Packaged local-setup resource escaped resourcesPath'); + } + return canonical; +}; + +export const resolvePackagedSetupResources = async (resourcesPath: string): Promise<{ + orchestratorPath: string; + stackTemplatePath: string; +}> => { + const root = await realpath(resourcesPath); + const rootStats = await lstat(root); + if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) throw new Error('Packaged resourcesPath is invalid'); + const [orchestratorPath, stackTemplatePath] = await Promise.all([ + canonicalResource(root, ['orchestrator', 'orchestrator.mjs'], 'file'), + canonicalResource(root, ['assets', 'env.example.txt'], 'file'), + ]); + return { orchestratorPath, stackTemplatePath }; +}; + +/** Bind the portable setup engine to the same launcher used by the CLI. */ +export async function createDesktopLocalHost(resourcesPath?: string, defaultRootDir?: string, appDataDir = defaultRootDir ? dirname(defaultRootDir) : undefined): Promise { + if (resourcesPath) { + const packagedResources = await resolvePackagedSetupResources(resourcesPath); + configureOrchestratorAssetPath(packagedResources.orchestratorPath); + configureStackTemplatePath(packagedResources.stackTemplatePath); + } + const config = new ConfigManager(); + await config.init(); + const defaultActions = createDefaultActions(config); + const actions: SetupActions = { + ...defaultActions, + async loginWithGithub({ onLog, signal } = {}) { + // A packaged GUI has no controlling terminal. Reuse an existing gh + // session, but leave an actionable recovery step instead of launching an + // invisible interactive process when the user is not signed in. + const result = await loginWithGithubCli(config, { interactive: false, onLog, signal }); + if (!result.ok) onLog?.(result.message); + return result.ok; + }, + async startStack(params) { + params.signal?.throwIfAborted(); + params.assertRootAuthority?.(); + const { orch, cfg } = await getHostConfig({ configManager: config, root: params.rootDir, readRoot: params.rootOperationsDir }); + params.assertRootAuthority?.(); + const recovered = await orch.recoverStackAsync(cfg, { + ui: params.ui ?? config.getUiEnabled() ?? true, + docs: params.docs ?? cfg.docsEnabled, + signal: params.signal, + onLog: params.onLog, + assertRootAuthority: params.assertRootAuthority, + }); + params.assertRootAuthority?.(); + if (!recovered.recovered) await defaultActions.startStack(params); + }, + }; + + const root = (): string => { + if (!defaultRootDir) throw new Error('No fixed local ProPR runtime root is configured'); + return resolve(defaultRootDir); + }; + + const withFixedRoot = async (operation: (authority: RootDirectoryAuthority, displayRoot: string) => Promise): Promise => { + const displayRoot = root(); + const authority = RootDirectoryAuthority.open(displayRoot, true, appDataDir); + try { return await operation(authority, displayRoot); } finally { authority.close(); } + }; + + return { + actions, + config, + async resolveApiBaseUrl(rootDir, signal) { + return withFixedRoot(async (authority, displayRoot) => { + if (resolve(rootDir) !== displayRoot) throw new Error('The local profile root is not the fixed desktop runtime root'); + signal?.throwIfAborted(); + authority.validate(); + const { cfg } = await getHostConfig({ configManager: config, root: displayRoot, readRoot: authority.operationPath() }); + authority.validate(); + signal?.throwIfAborted(); + return localhostServiceUrl(cfg.apiPort); + }); + }, + lifecycle: { + async running(signal) { + return withFixedRoot(async (authority, displayRoot) => { + signal?.throwIfAborted(); + authority.validate(); + const { orch, cfg } = await getHostConfig({ configManager: config, root: displayRoot, readRoot: authority.operationPath() }); + authority.validate(); + return orch.isLifecycleStackRunningAsync(cfg, { signal, assertRootAuthority: () => authority.validate() }); + }); + }, + async start(signal) { + await withFixedRoot((authority, displayRoot) => bindRootOperations(actions, displayRoot, authority).startStack({ rootDir: displayRoot, signal })); + }, + async stop(signal) { + await withFixedRoot(async (authority, displayRoot) => { + signal?.throwIfAborted(); + authority.validate(); + const { orch, cfg } = await getHostConfig({ configManager: config, root: displayRoot, readRoot: authority.operationPath() }); + authority.validate(); + const { failed } = await orch.stopLifecycleStackAsync(cfg, { signal, assertRootAuthority: () => authority.validate() }); + authority.validate(); + signal?.throwIfAborted(); + if (failed.length) throw new Error(`Could not stop ${failed.join(', ')}`); + }); + }, + }, + }; +} diff --git a/apps/desktop/src/desktop-session.ts b/apps/desktop/src/desktop-session.ts index 1beb2fd79..0e0eadfb2 100644 --- a/apps/desktop/src/desktop-session.ts +++ b/apps/desktop/src/desktop-session.ts @@ -16,3 +16,21 @@ export const logoutDesktopSession = async ( throw new Error(`Desktop logout failed with HTTP ${response.status}`); } }; + +/** Remove legacy browser identity/state so named bearer profiles cannot inherit it. */ +export const clearDesktopInstanceCookies = async ( + desktopSession: Pick, + apiBaseUrls: readonly unknown[], +): Promise => { + const origins = new Set(); + for (const value of apiBaseUrls) { + if (typeof value !== 'string') throw new Error('Invalid desktop API URL'); + const normalized = normalizeApiBaseUrl(value); + if (!normalized || normalized !== value) throw new Error('Invalid desktop API URL'); + origins.add(normalized); + } + await Promise.all([...origins].map(origin => desktopSession.clearStorageData({ + origin, + storages: ['cookies', 'localstorage', 'indexdb', 'cachestorage', 'serviceworkers'], + }))); +}; diff --git a/apps/desktop/src/ipc-lifecycle.test.ts b/apps/desktop/src/ipc-lifecycle.test.ts new file mode 100644 index 000000000..7e4c9ce9e --- /dev/null +++ b/apps/desktop/src/ipc-lifecycle.test.ts @@ -0,0 +1,500 @@ +import assert from 'node:assert/strict'; +import { describe, it } from 'node:test'; +import type { App, IpcMain, IpcMainInvokeEvent, Session } from 'electron'; +import type { DesktopCredentialService } from './credential-service'; +import { registerIpcHandlers } from './ipc'; +import type { LocalLifecycleController } from './lifecycle'; +import type { DesktopLogger } from './logger'; +import { DesktopOperationCoordinator } from './operation-coordinator'; +import type { ProfileStore } from './profile-store'; +import type { DesktopSetupController } from './setup-controller'; +import { IPC_CHANNELS } from './shared/contract'; +import { createDesktopShutdownCoordinator } from './shutdown'; + +const deferred = () => { + let resolve!: (value: T) => void; + const promise = new Promise(settle => { resolve = settle; }); + return { promise, resolve }; +}; + +describe('desktop IPC shutdown gate', () => { + it('clears old and new origin storage through the real save IPC before a same-ID URL commit', async () => { + const handlers = new Map unknown>(); + const cleared: Array[0]> = []; + let cleanupObservedBeforeSave = false; + const credentials = { + saveProfile: async ( + input: { id: string; label: string; apiBaseUrl: string }, + beforeCommit: (previousOrigin: string, nextOrigin: string) => Promise, + ) => { + await beforeCommit('https://old.example.test', input.apiBaseUrl); + cleanupObservedBeforeSave = cleared.length === 2; + return input; + }, + } as unknown as DesktopCredentialService; + registerIpcHandlers({ + app: { getName: () => 'ProPR', getVersion: () => '0.8.15', isPackaged: true } as unknown as App, + ipcMain: { + handle: (channel: string, handler: (...args: any[]) => unknown) => { handlers.set(channel, handler); }, + removeHandler: (channel: string) => { handlers.delete(channel); }, + } as unknown as IpcMain, + profiles: {} as ProfileStore, + credentials, + lifecycle: {} as LocalLifecycleController, + logger: { log: () => undefined } as unknown as DesktopLogger, + desktopSession: { + clearStorageData: async (options: Parameters[0]) => { cleared.push(options); }, + } as unknown as Session, + devServerUrl: undefined, + packagedRendererUrl: 'propr-renderer://app/index.html', + openExternal: async () => undefined, + }); + const event = { senderFrame: { url: 'propr-renderer://app/index.html' } } as unknown as IpcMainInvokeEvent; + + await Promise.resolve(handlers.get(IPC_CHANNELS.profilesSave)!(event, { + id: 'profile-a', label: 'A edited', apiBaseUrl: 'https://new.example.test', + })); + + assert.equal(cleanupObservedBeforeSave, true); + assert.deepEqual(cleared, [ + { + origin: 'https://old.example.test', + storages: ['cookies', 'localstorage', 'indexdb', 'cachestorage', 'serviceworkers'], + }, + { + origin: 'https://new.example.test', + storages: ['cookies', 'localstorage', 'indexdb', 'cachestorage', 'serviceworkers'], + }, + ]); + }); + + it('clears both origins when activation edits the active profile URL without changing its ID', async () => { + const handlers = new Map unknown>(); + const ipcMain = { + handle: (channel: string, handler: (...args: any[]) => unknown) => { handlers.set(channel, handler); }, + removeHandler: (channel: string) => { handlers.delete(channel); }, + } as unknown as IpcMain; + const before = { + id: 'profile-a', label: 'A', apiBaseUrl: 'https://old.example.test', + createdAt: '2026-08-30T00:00:00.000Z', updatedAt: '2026-08-30T00:00:00.000Z', + }; + const after = { + ...before, + apiBaseUrl: 'https://new.example.test', + updatedAt: '2026-08-30T00:01:00.000Z', + }; + let listCalls = 0; + const credentials = { + listProfiles: async () => ({ + profiles: [listCalls++ === 0 ? before : after], + activeProfileId: 'profile-a', + }), + activate: async () => ({ + status: 'ready', profileId: 'profile-a', transportScope: 'scope-b', identityEpoch: 'B'.repeat(22), + }), + } as unknown as DesktopCredentialService; + const cleared: Array[0]> = []; + const desktopSession = { + clearStorageData: async (options: Parameters[0]) => { + cleared.push(options); + }, + } as unknown as Session; + registerIpcHandlers({ + app: { + getName: () => 'ProPR', getVersion: () => '0.8.15', isPackaged: true, + } as unknown as App, + ipcMain, + profiles: {} as ProfileStore, + credentials, + lifecycle: {} as LocalLifecycleController, + logger: { log: () => undefined } as unknown as DesktopLogger, + desktopSession, + devServerUrl: undefined, + packagedRendererUrl: 'propr-renderer://app/index.html', + openExternal: async () => undefined, + }); + const event = { + senderFrame: { url: 'propr-renderer://app/index.html' }, + } as unknown as IpcMainInvokeEvent; + + const activated = await Promise.resolve( + handlers.get(IPC_CHANNELS.connectionActivate)!(event, 'T'.repeat(43)), + ); + + assert.deepEqual(activated, { + status: 'ready', profileId: 'profile-a', transportScope: 'scope-b', identityEpoch: 'B'.repeat(22), + }); + assert.equal(listCalls, 2); + assert.deepEqual(cleared, [ + { + origin: 'https://old.example.test', + storages: ['cookies', 'localstorage', 'indexdb', 'cachestorage', 'serviceworkers'], + }, + { + origin: 'https://new.example.test', + storages: ['cookies', 'localstorage', 'indexdb', 'cachestorage', 'serviceworkers'], + }, + ]); + }); + + it('rejects activation and discards its exact scope when origin storage clearing fails', async () => { + const handlers = new Map unknown>(); + const ipcMain = { + handle: (channel: string, handler: (...args: any[]) => unknown) => { handlers.set(channel, handler); }, + removeHandler: (channel: string) => { handlers.delete(channel); }, + } as unknown as IpcMain; + const profiles = [ + { + id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test', + createdAt: '2026-08-30T00:00:00.000Z', updatedAt: '2026-08-30T00:00:00.000Z', + }, + { + id: 'profile-b', label: 'B', apiBaseUrl: 'https://b.example.test', + createdAt: '2026-08-30T00:00:00.000Z', updatedAt: '2026-08-30T00:00:00.000Z', + }, + ]; + let listCalls = 0; + const discarded: Array<{ profileId: string; transportScope: string }> = []; + const credentials = { + listProfiles: async () => ({ + profiles, + activeProfileId: listCalls++ === 0 ? 'profile-a' : 'profile-b', + }), + activate: async () => ({ + status: 'ready', profileId: 'profile-b', transportScope: 'scope-b', identityEpoch: 'B'.repeat(22), + }), + discardActivation: async (scope: { profileId: string; transportScope: string }) => { + discarded.push(scope); + return { discarded: true }; + }, + } as unknown as DesktopCredentialService; + let clearCalls = 0; + const desktopSession = { + clearStorageData: async () => { + clearCalls += 1; + if (clearCalls === 2) throw new Error('storage clear failed'); + }, + } as unknown as Session; + registerIpcHandlers({ + app: { + getName: () => 'ProPR', getVersion: () => '0.8.15', isPackaged: true, + } as unknown as App, + ipcMain, + profiles: {} as ProfileStore, + credentials, + lifecycle: {} as LocalLifecycleController, + logger: { log: () => undefined } as unknown as DesktopLogger, + desktopSession, + devServerUrl: undefined, + packagedRendererUrl: 'propr-renderer://app/index.html', + openExternal: async () => undefined, + }); + const event = { + senderFrame: { url: 'propr-renderer://app/index.html' }, + } as unknown as IpcMainInvokeEvent; + + await assert.rejects( + Promise.resolve(handlers.get(IPC_CHANNELS.connectionActivate)!(event, 'T'.repeat(43))), + /Desktop operation failed/, + ); + assert.equal(clearCalls, 2); + assert.deepEqual(discarded, [{ profileId: 'profile-b', transportScope: 'scope-b' }]); + }); + + it('discards the exact activation when the post-commit profile read fails', async () => { + const handlers = new Map unknown>(); + const ipcMain = { + handle: (channel: string, handler: (...args: any[]) => unknown) => { handlers.set(channel, handler); }, + removeHandler: (channel: string) => { handlers.delete(channel); }, + } as unknown as IpcMain; + let listCalls = 0; + let discardCalls = 0; + const discardActivation = async (scope: { profileId: string; transportScope: string }) => { + discardCalls += 1; + assert.deepEqual(scope, { profileId: 'profile-b', transportScope: 'scope-b' }); + return { discarded: true }; + }; + const credentials = { + listProfiles: async () => { + listCalls += 1; + if (listCalls === 2) throw new Error('post-activation profile read failed'); + return { profiles: [], activeProfileId: null }; + }, + activate: async () => ({ + status: 'ready', profileId: 'profile-b', transportScope: 'scope-b', identityEpoch: 'B'.repeat(22), + }), + discardActivation, + } as unknown as DesktopCredentialService; + const desktopSession = { + clearStorageData: async () => { throw new Error('storage clearing should not start'); }, + } as unknown as Session; + registerIpcHandlers({ + app: { getName: () => 'ProPR', getVersion: () => '0.8.15', isPackaged: true } as unknown as App, + ipcMain, + profiles: {} as ProfileStore, + credentials, + lifecycle: {} as LocalLifecycleController, + logger: { log: () => undefined } as unknown as DesktopLogger, + desktopSession, + devServerUrl: undefined, + packagedRendererUrl: 'propr-renderer://app/index.html', + openExternal: async () => undefined, + }); + const event = { senderFrame: { url: 'propr-renderer://app/index.html' } } as unknown as IpcMainInvokeEvent; + + await assert.rejects( + Promise.resolve(handlers.get(IPC_CHANNELS.connectionActivate)!(event, 'T'.repeat(43))), + /Desktop operation failed/, + ); + assert.equal(listCalls, 2); + assert.equal(discardCalls, 1); + }); + + it('clears a profile origin before committing removal and retains it when cleanup fails', async () => { + const handlers = new Map unknown>(); + const ipcMain = { + handle: (channel: string, handler: (...args: any[]) => unknown) => { handlers.set(channel, handler); }, + removeHandler: (channel: string) => { handlers.delete(channel); }, + } as unknown as IpcMain; + let removalCommitted = false; + const credentials = { + removeProfile: async ( + _profileId: string, + beforeCommit: (origin: string) => Promise, + ) => { + await beforeCommit('https://a.example.test'); + removalCommitted = true; + return 'https://a.example.test'; + }, + } as unknown as DesktopCredentialService; + const desktopSession = { + clearStorageData: async () => { throw new Error('origin storage clear failed'); }, + } as unknown as Session; + registerIpcHandlers({ + app: { getName: () => 'ProPR', getVersion: () => '0.8.15', isPackaged: true } as unknown as App, + ipcMain, + profiles: {} as ProfileStore, + credentials, + lifecycle: {} as LocalLifecycleController, + logger: { log: () => undefined } as unknown as DesktopLogger, + desktopSession, + devServerUrl: undefined, + packagedRendererUrl: 'propr-renderer://app/index.html', + openExternal: async () => undefined, + }); + const event = { senderFrame: { url: 'propr-renderer://app/index.html' } } as unknown as IpcMainInvokeEvent; + + await assert.rejects( + Promise.resolve(handlers.get(IPC_CHANNELS.profilesRemove)!(event, 'profile-a')), + /Desktop operation failed/, + ); + assert.equal(removalCommitted, false); + }); + + it('replaces every handler with a fixed closing failure and drains admitted work before disposal', async () => { + const handlers = new Map unknown>(); + const ipcMain = { + handle: (channel: string, handler: (...args: any[]) => unknown) => { handlers.set(channel, handler); }, + removeHandler: (channel: string) => { handlers.delete(channel); }, + } as unknown as IpcMain; + const listResult = deferred<{ profiles: []; activeProfileId: null }>(); + let listCalls = 0; + const credentials = { + listProfiles: async () => { + listCalls += 1; + return listResult.promise; + }, + } as unknown as DesktopCredentialService; + const registered = registerIpcHandlers({ + app: { + getName: () => 'ProPR', + getVersion: () => '0.8.15', + isPackaged: true, + } as unknown as App, + ipcMain, + profiles: {} as ProfileStore, + credentials, + lifecycle: {} as LocalLifecycleController, + logger: { log: () => undefined } as unknown as DesktopLogger, + desktopSession: {} as Session, + devServerUrl: undefined, + packagedRendererUrl: 'propr-renderer://app/index.html', + openExternal: async () => undefined, + }); + const event = { + senderFrame: { url: 'propr-renderer://app/index.html' }, + } as unknown as IpcMainInvokeEvent; + const invoke = (channel: string) => Promise.resolve(handlers.get(channel)!(event)); + + const admitted = invoke(IPC_CHANNELS.profilesList); + await Promise.resolve(); + registered.close(); + await assert.rejects(invoke(IPC_CHANNELS.profilesList), /DESKTOP_CLOSING/); + assert.equal(listCalls, 1); + + let idle = false; + const draining = registered.awaitIdle().then(() => { idle = true; }); + await Promise.resolve(); + assert.equal(idle, false); + listResult.resolve({ profiles: [], activeProfileId: null }); + await admitted; + await draining; + + registered.dispose(); + assert.equal(handlers.size, 0); + }); + + it('bounds a stuck drain, prevents quit retries, and tears down each authority once', async () => { + const order: string[] = []; + const events: string[] = []; + let quitCalls = 0; + const shutdown = createDesktopShutdownCoordinator({ + credentials: { dispose: async () => { order.push('credentials'); } }, + lifecycle: { shutdown: async () => { order.push('lifecycle'); } }, + setup: { shutdown: async () => { order.push('setup'); } }, + operations: { shutdown: async cleanup => cleanup() }, + ipc: { + close: () => { order.push('ipc-close'); }, + awaitIdle: () => new Promise(() => undefined), + dispose: () => { order.push('ipc-dispose'); }, + }, + profiles: { close: async () => { order.push('profiles-close'); } }, + sessionSecurity: { + close: () => { order.push('session-close'); }, + dispose: () => { order.push('session-dispose'); }, + }, + disposeRendererProtocol: () => { order.push('protocol-dispose'); }, + getWindow: () => ({ + isDestroyed: () => false, + destroy: () => { order.push('window-destroy'); }, + }), + quit: () => { quitCalls += 1; }, + onStarted: () => { order.push('started'); }, + log: (_level, event) => { events.push(event); }, + }, { drainTimeoutMs: 5 }); + let prevented = 0; + shutdown.beforeQuit({ preventDefault: () => { prevented += 1; } }); + shutdown.beforeQuit({ preventDefault: () => { prevented += 1; } }); + await shutdown.awaitFinished(); + + assert.equal(prevented, 2); + assert.equal(quitCalls, 1); + assert.equal(events.filter(event => event === 'desktop.app.shutdown_retry').length, 1); + assert.equal(events.filter(event => event === 'desktop.app.shutdown_forced').length, 1); + for (const step of ['ipc-close', 'session-close', 'protocol-dispose', 'profiles-close', + 'session-dispose', 'ipc-dispose', 'window-destroy']) { + assert.equal(order.filter(value => value === step).length, 1, `${step} was not exactly once`); + } + assert.equal(order.indexOf('profiles-close') > order.indexOf('protocol-dispose'), true); + assert.deepEqual(order.slice(-4), ['profiles-close', 'session-dispose', 'ipc-dispose', 'window-destroy']); + }); + + for (const category of ['profile', 'pairing', 'session', 'setup'] as const) { + it(`runs an admitted ${category} handler through the production before-quit drain`, async () => { + const handlers = new Map unknown>(); + const ipcMain = { + handle: (channel: string, handler: (...args: any[]) => unknown) => { handlers.set(channel, handler); }, + removeHandler: (channel: string) => { handlers.delete(channel); }, + } as unknown as IpcMain; + const barrier = deferred(); + const started = deferred(); + let underlyingCalls = 0; + const begin = (): Promise => { + underlyingCalls += 1; + started.resolve(undefined); + return barrier.promise; + }; + const credentials = { + listProfiles: category === 'profile' ? begin : async () => ({ profiles: [], activeProfileId: null }), + pair: category === 'pairing' ? begin : async () => ({ paired: true }), + dispose: async () => undefined, + } as unknown as DesktopCredentialService; + const desktopSession = { + fetch: category === 'session' + ? async () => await begin() as Response + : async () => new Response(null, { status: 204 }), + } as unknown as Session; + const coordinator = new DesktopOperationCoordinator(); + const setup = { + start: category === 'setup' ? begin : async () => ({ phase: 'idle' }), + shutdown: async () => undefined, + } as unknown as DesktopSetupController; + const registered = registerIpcHandlers({ + app: { + getName: () => 'ProPR', getVersion: () => '0.8.15', isPackaged: true, + } as unknown as App, + ipcMain, + profiles: {} as ProfileStore, + credentials, + lifecycle: {} as LocalLifecycleController, + setup, + coordinator, + logger: { log: () => undefined } as unknown as DesktopLogger, + desktopSession, + devServerUrl: undefined, + packagedRendererUrl: 'propr-renderer://app/index.html', + openExternal: async () => undefined, + }); + const event = { + senderFrame: { url: 'propr-renderer://app/index.html' }, + } as unknown as IpcMainInvokeEvent; + const invoke = (channel: string, ...args: unknown[]) => + Promise.resolve(handlers.get(channel)!(event, ...args)); + const channel = category === 'profile' + ? IPC_CHANNELS.profilesList + : category === 'pairing' + ? IPC_CHANNELS.authenticationPair + : category === 'session' + ? IPC_CHANNELS.authLogout + : IPC_CHANNELS.setupStart; + const args = category === 'pairing' + ? [{ id: 'profile-a', label: 'A', apiBaseUrl: 'https://a.example.test' }] + : category === 'session' + ? ['https://a.example.test'] + : category === 'setup' ? [{}] : []; + const admitted = invoke(channel, ...args); + await started.promise; + + const order: string[] = []; + const shutdown = createDesktopShutdownCoordinator({ + credentials: { dispose: async () => { order.push('credentials-dispose'); } }, + lifecycle: { shutdown: async () => { order.push('lifecycle-shutdown'); } }, + setup: { shutdown: async () => { order.push('setup-shutdown'); } }, + operations: coordinator, + ipc: { + close: () => { order.push('ipc-close'); registered.close(); }, + awaitIdle: () => { order.push('ipc-drain'); return registered.awaitIdle(); }, + dispose: () => { order.push('ipc-dispose'); registered.dispose(); }, + }, + profiles: { close: async () => { order.push('profiles-close'); } }, + sessionSecurity: { + close: () => { order.push('session-close'); }, + dispose: () => { order.push('session-dispose'); }, + }, + disposeRendererProtocol: () => { order.push('protocol-dispose'); }, + getWindow: () => ({ + isDestroyed: () => false, + destroy: () => { order.push('window-destroy'); }, + }), + quit: () => { order.push('app-quit'); }, + onStarted: () => { order.push('shutdown-started'); }, + log: () => undefined, + }); + shutdown.beforeQuit({ preventDefault: () => undefined }); + await assert.rejects(invoke(channel, ...args), /DESKTOP_CLOSING/); + assert.equal(underlyingCalls, 1); + + if (category === 'profile') barrier.resolve({ profiles: [], activeProfileId: null }); + else if (category === 'pairing') barrier.resolve({ paired: true }); + else if (category === 'session') barrier.resolve(new Response(null, { status: 204 })); + else barrier.resolve({ phase: 'cancelled' }); + await admitted; + await shutdown.awaitFinished(); + + assert.equal(handlers.size, 0); + assert.equal(order.indexOf('profiles-close') > order.indexOf('ipc-drain'), true); + assert.equal(order.indexOf('session-dispose') > order.indexOf('profiles-close'), true); + assert.deepEqual(order.slice(-3), ['ipc-dispose', 'window-destroy', 'app-quit']); + }); + } +}); diff --git a/apps/desktop/src/ipc.ts b/apps/desktop/src/ipc.ts index 93245534b..975bcb4d9 100644 --- a/apps/desktop/src/ipc.ts +++ b/apps/desktop/src/ipc.ts @@ -1,9 +1,11 @@ import type { App, IpcMain, IpcMainInvokeEvent, Session } from 'electron'; -import { shell } from 'electron'; -import { logoutDesktopSession } from './desktop-session'; +import { clearDesktopInstanceCookies, logoutDesktopSession } from './desktop-session'; +import type { DesktopCredentialService } from './credential-service'; import type { DesktopLogger } from './logger'; +import type { DesktopOperationCoordinator } from './operation-coordinator'; import type { LocalLifecycleController } from './lifecycle'; import type { ProfileStore } from './profile-store'; +import type { DesktopSetupController } from './setup-controller'; import { isSafeExternalUrl, isTrustedRendererUrl } from './security'; import { IPC_CHANNELS } from './shared/contract'; @@ -11,31 +13,56 @@ interface RegisterIpcOptions { app: App; ipcMain: IpcMain; profiles: ProfileStore; + credentials: DesktopCredentialService; lifecycle: LocalLifecycleController; + setup?: DesktopSetupController; logger: DesktopLogger; desktopSession: Session; devServerUrl: string | undefined; packagedRendererUrl: string; + coordinator?: DesktopOperationCoordinator; + openExternal(url: string): Promise; + /** @internal Deterministic admitted-work accounting for lifecycle proof. */ + observeInvocation?(phase: 'entry' | 'exit', channel: string): void; } type Handler = (event: IpcMainInvokeEvent, ...args: any[]) => unknown; -export const registerIpcHandlers = (options: RegisterIpcOptions): void => { +export interface RegisteredIpcHandlers { + close(): void; + awaitIdle(): Promise; + dispose(): void; +} + +const closingError = (): Error => new Error('DESKTOP_CLOSING'); + +export const registerIpcHandlers = (options: RegisterIpcOptions): RegisteredIpcHandlers => { + const channels = new Set(); + const active = new Set>(); + let closing = false; const trusted = (event: IpcMainInvokeEvent): boolean => { const senderUrl = event.senderFrame?.url ?? ''; return isTrustedRendererUrl(senderUrl, options.devServerUrl, options.packagedRendererUrl); }; const handle = (channel: string, handler: Handler): void => { + channels.add(channel); options.ipcMain.handle(channel, async (event, ...args) => { + if (closing) throw closingError(); if (!trusted(event)) { options.logger.log('warn', 'desktop.ipc.rejected', { channel }); throw new Error('Untrusted desktop IPC sender'); } + options.observeInvocation?.('entry', channel); + const invocation = Promise.resolve().then(() => handler(event, ...args)); + active.add(invocation); try { - return await handler(event, ...args); + return await invocation; } catch (error) { options.logger.log('error', 'desktop.ipc.failed', { channel, error }); - throw error; + throw new Error('Desktop operation failed. Review the protected desktop log for details.'); + } finally { + active.delete(invocation); + options.observeInvocation?.('exit', channel); } }); }; @@ -50,18 +77,123 @@ export const registerIpcHandlers = (options: RegisterIpcOptions): void => { handle(IPC_CHANNELS.authLogout, (_event, apiBaseUrl) => logoutDesktopSession(options.desktopSession, apiBaseUrl)); handle(IPC_CHANNELS.openExternal, async (_event, value: unknown) => { if (typeof value !== 'string' || !isSafeExternalUrl(value)) throw new Error('External URL is not allowed'); - await shell.openExternal(value); + await options.openExternal(value); + }); + handle(IPC_CHANNELS.storageSecurity, () => options.credentials.storageSecurity()); + handle(IPC_CHANNELS.profilesList, () => options.credentials.listProfiles()); + handle(IPC_CHANNELS.profilesSave, (_event, input) => options.credentials.saveProfile( + input, + (previousOrigin, nextOrigin) => clearDesktopInstanceCookies( + options.desktopSession, + [previousOrigin, nextOrigin], + ), + )); + handle(IPC_CHANNELS.profilesRemove, (_event, profileId) => options.credentials.removeProfile( + profileId, + origin => clearDesktopInstanceCookies(options.desktopSession, [origin]), + )); + handle(IPC_CHANNELS.profilesSetActive, async (_event, profileId) => { + const current = await options.credentials.listProfiles(); + const previous = current.profiles.find(profile => profile.id === current.activeProfileId); + const next = current.profiles.find(profile => profile.id === profileId); + if (profileId !== null && !next) throw new Error('Desktop profile does not exist'); + await clearDesktopInstanceCookies(options.desktopSession, [ + ...(previous ? [previous.apiBaseUrl] : []), + ...(next ? [next.apiBaseUrl] : []), + ]); + await options.credentials.setActiveProfile(profileId); }); - handle(IPC_CHANNELS.storageSecurity, () => options.profiles.security()); - handle(IPC_CHANNELS.profilesList, () => options.profiles.list()); - handle(IPC_CHANNELS.profilesSave, (_event, input) => options.profiles.save(input)); - handle(IPC_CHANNELS.profilesRemove, (_event, profileId) => options.profiles.remove(profileId)); - handle(IPC_CHANNELS.profilesSetActive, (_event, profileId) => options.profiles.setActive(profileId)); - handle(IPC_CHANNELS.credentialsRead, (_event, profileId) => options.profiles.readCredential(profileId)); - handle(IPC_CHANNELS.credentialsWrite, (_event, profileId, value) => options.profiles.writeCredential(profileId, value)); - handle(IPC_CHANNELS.credentialsRemove, (_event, profileId) => options.profiles.removeCredential(profileId)); - handle(IPC_CHANNELS.lifecycleStatus, () => options.lifecycle.status()); - handle(IPC_CHANNELS.lifecycleStart, () => options.lifecycle.start()); - handle(IPC_CHANNELS.lifecycleStop, () => options.lifecycle.stop()); - handle(IPC_CHANNELS.lifecycleRestart, () => options.lifecycle.restart()); + handle(IPC_CHANNELS.authenticationPair, (_event, profile) => options.credentials.pair(profile)); + handle(IPC_CHANNELS.authenticationCancel, (_event, profileId) => options.credentials.cancelPairing(profileId)); + handle(IPC_CHANNELS.connectionPrepareLocal, (_event, profile) => options.credentials.prepareLocalActivation(profile)); + handle(IPC_CHANNELS.connectionActivateLocal, (_event, localActivationTicket) => options.credentials.activateLocal( + localActivationTicket, + (previousOrigin, nextOrigin) => clearDesktopInstanceCookies( + options.desktopSession, + [previousOrigin, nextOrigin].filter((origin): origin is string => origin !== undefined), + ), + )); + handle(IPC_CHANNELS.connectionDiscardLocal, (_event, localActivationTicket) => + options.credentials.discardLocal(localActivationTicket)); + handle(IPC_CHANNELS.connectionProbe, (_event, profile) => options.credentials.probe(profile)); + handle(IPC_CHANNELS.connectionActivate, async (_event, activationTicket) => { + const before = await options.credentials.listProfiles(); + const activated = await options.credentials.activate(activationTicket); + try { + const after = await options.credentials.listProfiles(); + const previousOrigin = before.profiles.find(profile => profile.id === before.activeProfileId)?.apiBaseUrl; + const activatedOrigin = after.profiles.find(profile => profile.id === after.activeProfileId)?.apiBaseUrl; + await clearDesktopInstanceCookies( + options.desktopSession, + [previousOrigin, activatedOrigin].filter((origin): origin is string => origin !== undefined), + ); + return activated; + } catch (error) { + await options.credentials.discardActivation({ + profileId: activated.profileId, + transportScope: activated.transportScope, + }); + throw error; + } + }); + handle(IPC_CHANNELS.connectionDiscard, (_event, value) => options.credentials.discardActivation(value)); + handle(IPC_CHANNELS.connectionInvalidate, (_event, value) => options.credentials.invalidate(value)); + handle(IPC_CHANNELS.lifecycleStatus, () => options.coordinator + ? options.coordinator.run('status', signal => options.lifecycle.status(signal)) + : options.lifecycle.status()); + handle(IPC_CHANNELS.lifecycleStart, () => options.coordinator + ? options.coordinator.run('start', signal => options.lifecycle.start(signal)) + : options.lifecycle.start()); + handle(IPC_CHANNELS.lifecycleStop, () => options.coordinator + ? options.coordinator.run('stop', signal => options.lifecycle.stop(signal)) + : options.lifecycle.stop()); + handle(IPC_CHANNELS.lifecycleRestart, () => options.coordinator + ? options.coordinator.run('restart', signal => options.lifecycle.restart(signal)) + : options.lifecycle.restart()); + handle(IPC_CHANNELS.discovery, () => []); + if (options.setup && options.coordinator) { + const setup = options.setup; + const coordinator = options.coordinator; + handle(IPC_CHANNELS.setupStatus, (_event, ...args) => { + if (args.length) throw new Error('Invalid local setup status request'); + return setup.status(); + }); + handle(IPC_CHANNELS.setupStart, (_event, ...args) => { + if (args.length !== 1) throw new Error('Invalid local setup start request'); + return coordinator.run('setup', signal => setup.start(args[0], signal)); + }); + handle(IPC_CHANNELS.setupRetry, (_event, ...args) => { + if (args.length > 1) throw new Error('Invalid local setup retry request'); + return coordinator.run('setup', signal => setup.retry(args[0], signal)); + }); + handle(IPC_CHANNELS.setupCancel, (_event, ...args) => { + if (args.length) throw new Error('Invalid local setup cancellation request'); + return coordinator.cancel(() => setup.cancel()); + }); + handle(IPC_CHANNELS.setupSelectPrivateKey, (_event, ...args) => { + if (args.length) throw new Error('Invalid private-key selection request'); + return coordinator.run('setup', signal => setup.selectPrivateKey(signal)); + }); + handle(IPC_CHANNELS.setupAcquireWebhookSecret, (_event, ...args) => { + if (args.length) throw new Error('Invalid webhook-secret acquisition request'); + return coordinator.run('setup', signal => setup.acquireWebhookSecret(signal)); + }); + } + return { + close() { + if (closing) return; + closing = true; + for (const channel of channels) { + options.ipcMain.removeHandler(channel); + options.ipcMain.handle(channel, () => Promise.reject(closingError())); + } + }, + async awaitIdle() { + while (active.size > 0) await Promise.allSettled([...active]); + }, + dispose() { + closing = true; + for (const channel of channels) options.ipcMain.removeHandler(channel); + }, + }; }; diff --git a/apps/desktop/src/lifecycle.test.ts b/apps/desktop/src/lifecycle.test.ts new file mode 100644 index 000000000..4c4f8c279 --- /dev/null +++ b/apps/desktop/src/lifecycle.test.ts @@ -0,0 +1,26 @@ +import assert from 'node:assert/strict'; +import { describe, it } from 'node:test'; +import { LocalLifecycleController } from './lifecycle'; + +describe('desktop local lifecycle presentation boundary', () => { + it('keeps raw host diagnostics in main and returns only a fixed bounded status', async () => { + const diagnostics: unknown[] = []; + const controller = new LocalLifecycleController({ + async running() { throw new Error('docker /home/alice/stack/.env TOKEN=sentinel'); }, + async start() { throw new Error('HostConfig.Binds=/home/alice/stack'); }, + async stop() {}, + }, (_event, fields) => diagnostics.push(fields)); + const status = await controller.status(); + assert.equal(status.state, 'error'); + assert.ok((status.detail?.length ?? 0) < 160); + assert.doesNotMatch(status.detail ?? '', /alice|HostConfig|TOKEN|sentinel/); + await assert.rejects(controller.start(), error => { + assert.ok(error instanceof Error); + assert.doesNotMatch(error.message, /alice|HostConfig|TOKEN|sentinel/); + return true; + }); + assert.equal(diagnostics.length, 2); + assert.match(((diagnostics[0] as { error: Error }).error).message, /alice/); + assert.match(((diagnostics[1] as { error: Error }).error).message, /HostConfig/); + }); +}); diff --git a/apps/desktop/src/lifecycle.ts b/apps/desktop/src/lifecycle.ts index a302635fc..d4c0fcd28 100644 --- a/apps/desktop/src/lifecycle.ts +++ b/apps/desktop/src/lifecycle.ts @@ -1,26 +1,56 @@ import type { LocalLifecycleOperationResult, LocalLifecycleStatus } from './shared/contract'; -/** - * Stable renderer-facing lifecycle boundary. Runtime installation and process - * control are deliberately absent until the user-approved setup work lands. - */ +export interface LocalLifecycleHost { + running(signal?: AbortSignal): Promise; + start(signal?: AbortSignal): Promise; + stop(signal?: AbortSignal): Promise; +} + +const lifecycleFailure = 'Local runtime operation failed. Review the protected desktop log for details.'; + export class LocalLifecycleController { #status: LocalLifecycleStatus = { state: 'disconnected' }; + readonly #host?: LocalLifecycleHost; + readonly #diagnose?: (event: string, fields: Record) => void; - status(): LocalLifecycleStatus { + constructor(host?: LocalLifecycleHost, diagnose?: (event: string, fields: Record) => void) { + this.#host = host; + this.#diagnose = diagnose; + } + + async status(signal?: AbortSignal): Promise { + if (!this.#host) return { ...this.#status }; + try { + this.#status = { state: await this.#host.running(signal) ? 'connected' : 'disconnected' }; + } catch (error) { + this.#diagnose?.('desktop.lifecycle.status_failed', { error }); + this.#status = { state: 'error', detail: lifecycleFailure }; + } return { ...this.#status }; } - start(): LocalLifecycleOperationResult { - return this.#unsupported(); + async start(signal?: AbortSignal): Promise { + return this.#operate('starting', 'connected', () => this.#host?.start(signal)); } - stop(): LocalLifecycleOperationResult { - return this.#unsupported(); + async stop(signal?: AbortSignal): Promise { + return this.#operate('stopping', 'disconnected', () => this.#host?.stop(signal)); } - restart(): LocalLifecycleOperationResult { - return this.#unsupported(); + async restart(signal?: AbortSignal): Promise { + if (!this.#host) return this.#unsupported(); + this.#status = { state: 'stopping' }; + try { + await this.#host.stop(signal); + this.#status = { state: 'starting' }; + await this.#host.start(signal); + this.#status = { state: 'connected' }; + return { ok: true, status: { ...this.#status } }; + } catch (error) { + this.#diagnose?.('desktop.lifecycle.restart_failed', { error }); + this.#status = { state: 'error', detail: lifecycleFailure }; + throw new Error(lifecycleFailure); + } } async shutdown(): Promise { @@ -37,4 +67,22 @@ export class LocalLifecycleController { }, }; } + + async #operate( + transitional: 'starting' | 'stopping', + completed: 'connected' | 'disconnected', + operation: () => Promise | undefined, + ): Promise { + if (!this.#host) return this.#unsupported(); + this.#status = { state: transitional }; + try { + await operation(); + this.#status = { state: completed }; + return { ok: true, status: { ...this.#status } }; + } catch (error) { + this.#diagnose?.(`desktop.lifecycle.${transitional}_failed`, { error }); + this.#status = { state: 'error', detail: lifecycleFailure }; + throw new Error(lifecycleFailure); + } + } } diff --git a/apps/desktop/src/logger.ts b/apps/desktop/src/logger.ts index ff6396db1..e0e38f468 100644 --- a/apps/desktop/src/logger.ts +++ b/apps/desktop/src/logger.ts @@ -1,5 +1,6 @@ import { appendFile, mkdir } from 'node:fs/promises'; import { dirname } from 'node:path'; +import { redactDesktopValue } from './secret-redaction'; export type LogLevel = 'debug' | 'info' | 'warn' | 'error'; @@ -7,10 +8,6 @@ export interface DesktopLogger { log(level: LogLevel, event: string, fields?: Record): void; } -const serializeError = (value: unknown): unknown => value instanceof Error - ? { name: value.name, message: value.message, stack: value.stack } - : value; - export const createDesktopLogger = ( logPath: string, onWriteFailure?: () => void, @@ -21,7 +18,7 @@ export const createDesktopLogger = ( timestamp: new Date().toISOString(), level, event, - ...Object.fromEntries(Object.entries(fields).map(([key, value]) => [key, serializeError(value)])), + ...redactDesktopValue(fields) as Record, }); const consoleMethod = level === 'error' ? console.error : level === 'warn' ? console.warn : console.log; consoleMethod(record); @@ -36,7 +33,7 @@ export const createDesktopLogger = ( } catch { // Keep the fixed logger diagnostic available even if the smoke-only sink also fails. } - console.error(JSON.stringify({ level: 'error', event: 'desktop.log.write_failed', error: serializeError(error) })); + console.error(JSON.stringify({ level: 'error', event: 'desktop.log.write_failed', error: redactDesktopValue(error) })); }); }; return { log }; diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts index 910c57b46..2bdb7f961 100644 --- a/apps/desktop/src/main.ts +++ b/apps/desktop/src/main.ts @@ -1,14 +1,27 @@ import { lstatSync } from 'node:fs'; import { isAbsolute, join, relative, resolve } from 'node:path'; import { pathToFileURL } from 'node:url'; -import { app, BrowserWindow, ipcMain, net, protocol, safeStorage, screen, session, shell } from 'electron'; +import { app, BrowserWindow, dialog, ipcMain, net, protocol, safeStorage, screen, session, shell } from 'electron'; import type { Rectangle } from 'electron'; import { DESKTOP_RENDERER_ORIGIN } from '@propr/shared'; +import type { SetupActions } from '@propr/local-setup'; import { DeepLinkDelivery } from './deep-link-delivery'; +import { DesktopCredentialService } from './credential-service'; +import { createDesktopLocalHost } from './desktop-host'; import { registerIpcHandlers } from './ipc'; import { LocalLifecycleController } from './lifecycle'; import { createDesktopLogger, type DesktopLogger } from './logger'; +import { DesktopOperationCoordinator } from './operation-coordinator'; +import { + packagedTransportSmoke, + runPackagedTransportSmoke, + type PackagedTransportSmoke, +} from './packaged-transport-smoke'; import { ProfileStore, type EncryptionProvider } from './profile-store'; +import { DesktopSetupController } from './setup-controller'; +import { promptForWebhookSecret } from './secure-secret-prompt'; +import { redactDesktopValue } from './secret-redaction'; +import { createDesktopShutdownCoordinator } from './shutdown'; import { deepLinkFromArguments, isSafeExternalUrl, @@ -60,6 +73,12 @@ try { process.exit(1); } const packagedSmokeTest = packagedSmokeUserDataDirectory !== null; +const transportSmoke = packagedTransportSmoke(packagedSmokeTest); +const inertSetupActions = new Proxy({} as SetupActions, { + get() { + return () => { throw new Error('Local setup is unavailable in this desktop mode'); }; + }, +}); let mainWindow: BrowserWindow | null = null; const initialDeepLink = deepLinkFromArguments(process.argv); const deepLinkDelivery = new DeepLinkDelivery( @@ -68,6 +87,9 @@ const deepLinkDelivery = new DeepLinkDelivery( ); let logger: DesktopLogger | null = null; let shutdownStarted = false; +let setupController: DesktopSetupController | null = null; +const operationCoordinator = new DesktopOperationCoordinator(); + if (process.platform === 'win32') { app.setAppUserModelId('dev.propr.desktop'); } @@ -77,7 +99,7 @@ const log = (level: 'debug' | 'info' | 'warn' | 'error', event: string, fields?: if (logger) { logger.log(level, event, fields); } else { - console.error(JSON.stringify({ timestamp: new Date().toISOString(), level, event, ...fields })); + console.error(JSON.stringify(redactDesktopValue({ timestamp: new Date().toISOString(), level, event, ...fields }))); } }; @@ -107,21 +129,42 @@ const deliverDeepLink = (value: string): void => { deepLinkDelivery.deliver(value); }; -const configureSessionSecurity = (): void => { +const configureSessionSecurity = (credentials: DesktopCredentialService): { + close(): void; + dispose(): void; +} => { const desktopSession = session.defaultSession; desktopSession.setPermissionCheckHandler(() => false); desktopSession.setPermissionRequestHandler((_webContents, _permission, callback) => callback(false)); + desktopSession.webRequest.onBeforeSendHeaders((details, callback) => { + callback(credentials.prepareRequest(details.url, details.requestHeaders, { + method: details.method, + resourceType: details.resourceType, + })); + }); desktopSession.webRequest.onHeadersReceived((details, callback) => { callback({ responseHeaders: { - ...details.responseHeaders, + ...credentials.sanitizeResponseHeaders(details.url, details.responseHeaders ?? {}), 'Content-Security-Policy': [rendererContentSecurityPolicy(!app.isPackaged)], }, }); }); + return { + close() { + desktopSession.webRequest.onBeforeSendHeaders((_details, callback) => callback({ cancel: true })); + desktopSession.webRequest.onHeadersReceived((_details, callback) => callback({ cancel: true })); + }, + dispose() { + desktopSession.setPermissionCheckHandler(null); + desktopSession.setPermissionRequestHandler(null); + desktopSession.webRequest.onBeforeSendHeaders(null); + desktopSession.webRequest.onHeadersReceived(null); + }, + }; }; -const configurePackagedRendererProtocol = (): void => { +const configurePackagedRendererProtocol = (): (() => void) => { protocol.handle(PACKAGED_RENDERER_SCHEME, request => { const requestUrl = new URL(request.url); if (requestUrl.hostname !== PACKAGED_RENDERER_HOST) { @@ -141,9 +184,11 @@ const configurePackagedRendererProtocol = (): void => { } return net.fetch(pathToFileURL(filePath).href); }); + return () => { void protocol.unhandle(PACKAGED_RENDERER_SCHEME); }; }; const openAllowedExternalUrl = async (url: string): Promise => { + if (shutdownStarted) return; if (!isSafeExternalUrl(url)) { log('warn', 'desktop.external_url.rejected'); return; @@ -156,20 +201,22 @@ const inspectPackagedLayout = async (window: BrowserWindow): Promise .desktop-profile-form'); const labels = form ? Array.from(form.querySelectorAll(':scope > label')) : []; elements = { - titlebar: document.querySelector('.desktop-titlebar'), - logo: document.querySelector('.desktop-titlebar img[alt="ProPR"]'), card, + brand: card?.querySelector(':scope > .desktop-brand'), + logo: card?.querySelector(':scope > .desktop-brand img'), + form, + back: form?.querySelector(':scope > .desktop-back-button'), + heading: form?.querySelector(':scope > h2'), + notice: form?.querySelector(':scope > .desktop-version-note'), connectionName: labels[0]?.querySelector('input'), apiUrl: labels[1]?.querySelector('input'), - apiHelp: labels[1]?.querySelector('span'), submit: form?.querySelector(':scope > button[type="submit"]'), - footer: card?.lastElementChild, }; - if (Object.values(elements).every(Boolean) && elements.footer.textContent.includes('Runtime:')) break; + if (Object.values(elements).every(Boolean) && elements.apiUrl.value === 'https://connect.propr.dev') break; await new Promise(resolve => setTimeout(resolve, 25)); } while (performance.now() < deadline); @@ -191,6 +238,12 @@ const inspectPackagedLayout = async (window: BrowserWindow): Promise element.textContent?.trim().startsWith('Runtime:')), + }, ...Object.fromEntries(Object.entries(elements).map(([name, element]) => [name, bounds(element)])), }; })()`); @@ -233,7 +286,7 @@ const inspectPackagedReducedNativeWindow = (): Record => { } }; -const createMainWindow = async (): Promise => { +const createMainWindow = async (smoke: PackagedTransportSmoke | null = null): Promise => { const workArea = selectInitialWindowWorkArea(screen); const window = new BrowserWindow( createBrowserWindowOptions(join(__dirname, 'preload.cjs'), !app.isPackaged, workArea), @@ -268,12 +321,14 @@ const createMainWindow = async (): Promise => { if (validatedDevUrl) { await window.loadURL(new URL('renderer.html', validatedDevUrl).href); } else { - await window.loadURL(packagedRendererUrl); + const rendererUrl = new URL(packagedRendererUrl); + if (smoke) rendererUrl.hash = 'packaged-transport-smoke'; + await window.loadURL(rendererUrl.href); } await readyToShow; const preloadBridgeExposed = await window.webContents.executeJavaScript( - "typeof window.proprDesktop === 'object' && window.proprDesktop !== null", + "typeof window.proprDesktop === 'object' && window.proprDesktop !== null && typeof window.__PROPR_DESKTOP__ === 'object'", ); if (preloadBridgeExposed !== true) { throw new Error('Desktop preload bridge was not exposed to the renderer'); @@ -306,49 +361,51 @@ const createMainWindow = async (): Promise => { } if (packagedSmokeTest) { const profileFlow = await window.webContents.executeJavaScript(`(async () => { - const bridge = window.proprDesktop; - const local = await bridge.profiles.save({ label: 'Local setup', apiBaseUrl: 'http://localhost:4000' }); - const remote = await bridge.profiles.save({ label: 'ProPR Connect', apiBaseUrl: 'https://connect.propr.dev' }); - await bridge.profiles.setActive(remote.id); - const profiles = await bridge.profiles.list(); - const lifecycle = await bridge.lifecycle.start(); + const bridge = window.__PROPR_DESKTOP__; + const legacyBridge = window.proprDesktop; const deadline = performance.now() + 2000; - let connectDeepLink = false; + let stagedConnectCandidate = false; do { - const labels = Array.from(document.querySelectorAll('.desktop-connection-card form > label')); - connectDeepLink = labels[1]?.querySelector('input')?.value === 'https://connect.propr.dev'; - if (connectDeepLink) break; + const labels = Array.from(document.querySelectorAll('.desktop-profile-form label')); + const urlLabel = labels.find(label => label.textContent?.includes('Instance URL')); + stagedConnectCandidate = urlLabel?.querySelector('input')?.value === 'https://connect.propr.dev' + && Array.from(document.querySelectorAll('button')).some(button => button.textContent?.trim() === 'Connect'); + if (stagedConnectCandidate) break; await new Promise(resolve => setTimeout(resolve, 25)); } while (performance.now() < deadline); + const profiles = await bridge.profiles.list(); + const activeProfileId = await bridge.profiles.getActiveId(); + const setup = await bridge.localSetup.status(); return { - active: profiles.activeProfileId === remote.id, - local: profiles.profiles.some(profile => profile.id === local.id && profile.apiBaseUrl === 'http://localhost:4000'), - remote: profiles.profiles.some(profile => profile.id === remote.id && profile.apiBaseUrl === 'https://connect.propr.dev'), - lifecycleBoundary: lifecycle.ok === false && lifecycle.code === 'not-implemented', - connectDeepLink, + noPersistedCandidate: profiles.length === 0, + noActiveCandidate: activeProfileId === null, + noLifecycleOrDockerAuthority: !('lifecycle' in bridge) && !('docker' in bridge), + legacyRemoteOnlyLifecycleInvariant: bridge.platform === 'linux' + || (!('lifecycle' in legacyBridge) && !('docker' in legacyBridge)), + remoteOnlySetup: setup.phase === 'unsupported' && setup.capability?.kind === 'remote-only', + stagedConnectCandidate, }; })()`); - if (!profileFlow?.active || !profileFlow?.local || !profileFlow?.remote - || !profileFlow?.lifecycleBoundary || !profileFlow?.connectDeepLink) { - throw new Error('Packaged desktop local/remote/API profile flow failed'); + if (!profileFlow?.noPersistedCandidate || !profileFlow?.noActiveCandidate + || !profileFlow?.noLifecycleOrDockerAuthority || !profileFlow?.legacyRemoteOnlyLifecycleInvariant + || !profileFlow?.remoteOnlySetup + || !profileFlow?.stagedConnectCandidate) { + throw new Error('Packaged desktop staged Connect flow failed'); } - log('info', 'desktop.renderer.mvp_flows.ready', { connectDiscovery: true }); + log('info', 'desktop.renderer.mvp_flows.ready', { connectCandidateStaged: true }); log('info', PACKAGED_LAYOUT_READY_EVENT, { layout: await inspectPackagedLayout(window) }); log('info', PACKAGED_REDUCED_NATIVE_WINDOW_READY_EVENT, { layout: inspectPackagedReducedNativeWindow(), }); } log('info', 'desktop.renderer.ready', { preloadBridgeExposed: true }); - if (packagedSmokeTest) { - app.quit(); - } else { - window.show(); - } + if (!packagedSmokeTest) window.show(); return window; }; app.on('open-url', (event, url) => { event.preventDefault(); + if (shutdownStarted) return; const normalized = normalizeDeepLink(url); if (normalized) deliverDeepLink(normalized); }); @@ -358,6 +415,7 @@ if (!hasSingleInstanceLock) { app.quit(); } else { app.on('second-instance', (_event, argv) => { + if (shutdownStarted) return; const deepLink = deepLinkFromArguments(argv); if (deepLink) deliverDeepLink(deepLink); if (mainWindow) { @@ -374,8 +432,7 @@ if (!hasSingleInstanceLock) { () => packagedSmokeEvidence?.write('desktop.log.write_failed'), ); log('info', 'desktop.app.ready', { version: app.getVersion(), platform: process.platform }); - configureSessionSecurity(); - configurePackagedRendererProtocol(); + const disposeRendererProtocol = configurePackagedRendererProtocol(); const encryption: EncryptionProvider = { isEncryptionAvailable: () => safeStorage.isEncryptionAvailable(), @@ -391,29 +448,120 @@ if (!hasSingleInstanceLock) { decrypt: value => safeStorage.decryptString(value), }; const profiles = new ProfileStore(app.getPath('userData'), encryption); - const lifecycle = new LocalLifecycleController(); - registerIpcHandlers({ + const credentials = new DesktopCredentialService({ + profiles, + fetch: session.defaultSession.fetch.bind(session.defaultSession) as typeof globalThis.fetch, + openExternal: async url => { await shell.openExternal(url); }, + clientName: `ProPR Desktop (${process.platform})`, + reportRevocationFailure: diagnostic => { + log('warn', 'desktop.credential_revocation.retry_pending', diagnostic); + }, + }); + const sessionSecurity = configureSessionSecurity(credentials); + const credentialInitialization = await credentials.initialize(); + if (credentialInitialization.status === 'degraded') { + log('warn', 'desktop.credential_revocation.startup_degraded', { + retryPending: credentialInitialization.retryPending, + }); + } + const defaultRootDir = join(app.getPath('userData'), 'desktop', 'local-stack'); + const localHost = process.platform === 'linux' && !packagedSmokeTest + ? await createDesktopLocalHost(app.isPackaged ? process.resourcesPath : undefined, defaultRootDir, app.getPath('userData')) + : null; + const lifecycle = new LocalLifecycleController( + localHost?.lifecycle, + (event, fields) => log('error', event, fields), + ); + setupController = new DesktopSetupController({ + actions: localHost?.actions ?? inertSetupActions, + platform: packagedSmokeTest ? 'darwin' : process.platform, + appDataDir: app.getPath('userData'), + statePath: join(app.getPath('userData'), 'desktop', 'setup-state.json'), + defaultRootDir, + keyStorageDir: join(app.getPath('userData'), 'desktop', 'setup-keys'), + async selectPrivateKey() { + const options = { + title: 'Choose the GitHub App private key', + properties: ['openFile'] as Array<'openFile'>, + filters: [{ name: 'Private keys', extensions: ['pem', 'key'] }], + }; + const selected = mainWindow ? await dialog.showOpenDialog(mainWindow, options) : await dialog.showOpenDialog(options); + return selected.canceled ? null : selected.filePaths[0] ?? null; + }, + promptWebhookSecret: promptForWebhookSecret, + resolveApiBaseUrl: localHost?.resolveApiBaseUrl ?? (async () => { throw new Error('Local setup is unavailable'); }), + async registerProfile({ name, apiBaseUrl }, signal) { + signal?.throwIfAborted(); + const existing = (await profiles.list()).profiles.find(profile => profile.apiBaseUrl === apiBaseUrl); + signal?.throwIfAborted(); + const saved = await profiles.save({ id: existing?.id, label: name, apiBaseUrl }, signal); + signal?.throwIfAborted(); + return { + id: saved.id, + name: saved.label, + baseUrl: saved.apiBaseUrl, + kind: 'local', + lastConnectedAt: saved.updatedAt, + }; + }, + emit(snapshot) { + const target = mainWindow; + if (target && !target.isDestroyed()) target.webContents.send(IPC_CHANNELS.setupProgress, snapshot); + }, + diagnose(event, fields) { log('error', event, fields); }, + }); + const registeredIpc = registerIpcHandlers({ app, ipcMain, profiles, + credentials, lifecycle, + setup: setupController, logger, desktopSession: session.defaultSession, devServerUrl, packagedRendererUrl, + coordinator: operationCoordinator, + openExternal: async url => { await shell.openExternal(url); }, }); - app.on('before-quit', event => { - if (shutdownStarted) return; - event.preventDefault(); - shutdownStarted = true; - void lifecycle.shutdown().finally(() => { - log('info', 'desktop.app.shutdown'); - app.quit(); - }); - }); + const shutdownLifecycle = transportSmoke?.shutdownMode === 'forced-timeout' + ? { shutdown: () => new Promise(() => undefined) } + : lifecycle; + const shutdown = createDesktopShutdownCoordinator({ + credentials, + lifecycle: shutdownLifecycle, + setup: setupController, + operations: operationCoordinator, + ipc: registeredIpc, + profiles, + sessionSecurity, + disposeRendererProtocol, + getWindow: () => mainWindow, + quit: () => app.quit(), + onStarted: () => { shutdownStarted = true; }, + log, + }, transportSmoke?.shutdownMode === 'forced-timeout' ? { drainTimeoutMs: 250 } : undefined); + app.on('before-quit', event => shutdown.beforeQuit(event)); - mainWindow = await createMainWindow(); + mainWindow = await createMainWindow(transportSmoke); + if (transportSmoke) { + await runPackagedTransportSmoke({ + window: mainWindow, + profiles, + credentials, + desktopSession: session.defaultSession, + smoke: transportSmoke, + log: (event, fields) => log('info', event, fields), + }); + } + if (packagedSmokeTest) { + app.quit(); + if (transportSmoke?.shutdownMode === 'retry') { + log('info', 'desktop.app.shutdown_retry_requested'); + app.quit(); + } + } const updateConfig = __PROPR_DESKTOP_UPDATE_MANIFEST_URL__ ? { @@ -439,6 +587,7 @@ if (!hasSingleInstanceLock) { } app.on('activate', () => { + if (shutdownStarted) return; if (BrowserWindow.getAllWindows().length === 0) { void createMainWindow().then(window => { mainWindow = window; diff --git a/apps/desktop/src/operation-coordinator.test.ts b/apps/desktop/src/operation-coordinator.test.ts new file mode 100644 index 000000000..0d428194c --- /dev/null +++ b/apps/desktop/src/operation-coordinator.test.ts @@ -0,0 +1,161 @@ +import assert from 'node:assert/strict'; +import { describe, it } from 'node:test'; +import { DesktopOperationCoordinator, coordinatorBusyError, coordinatorShutdownError } from './operation-coordinator'; + +const deferred = () => { + let resolve!: (value: T) => void; + const promise = new Promise(done => { resolve = done; }); + return { promise, resolve }; +}; + +describe('desktop main-process operation coordinator', () => { + it('rejects setup-vs-lifecycle races before the second host action', async () => { + const coordinator = new DesktopOperationCoordinator(); + const release = deferred(); + let lifecycleActions = 0; + const setup = coordinator.run('setup', async () => release.promise); + await assert.rejects(coordinator.run('start', async () => { lifecycleActions += 1; }), new RegExp(coordinatorBusyError)); + assert.equal(lifecycleActions, 0); + release.resolve(); + await setup; + }); + + it('allows cancellation only for setup and awaits its cleanup settlement', async () => { + const coordinator = new DesktopOperationCoordinator(); + const cleaned = deferred(); + let cancelCalled = false; + const setup = coordinator.run('setup', signal => new Promise(resolve => { + const abort = () => { void cleaned.promise.then(resolve); }; + if (signal.aborted) abort(); + else signal.addEventListener('abort', abort, { once: true }); + })); + const cancellation = coordinator.cancel(async () => { cancelCalled = true; await cleaned.promise; }); + await Promise.resolve(); + assert.equal(cancelCalled, true); + let settled = false; + void cancellation.then(() => { settled = true; }); + await Promise.resolve(); + assert.equal(settled, false); + cleaned.resolve(); + await Promise.all([setup, cancellation]); + }); + + it('coalesces concurrent cancellation requests into one cleanup', async () => { + const coordinator = new DesktopOperationCoordinator(); + const cleaned = deferred(); + const setup = coordinator.run('setup', signal => new Promise(resolve => { + const abort = () => resolve(); + if (signal.aborted) abort(); else signal.addEventListener('abort', abort, { once: true }); + })); + let cleanupCalls = 0; + const cancel = () => { cleanupCalls += 1; return cleaned.promise; }; + const first = coordinator.cancel(cancel); + const second = coordinator.cancel(cancel); + await setup; + assert.equal(cleanupCalls, 1); + cleaned.resolve(); + await Promise.all([first, second]); + }); + + it('retains exclusive cancellation authority after aborted setup settles until cleanup finishes', async () => { + const coordinator = new DesktopOperationCoordinator(); + const cleanup = deferred(); + let setupSettled = false; + let overlappingMutations = 0; + const setup = coordinator.run('setup', signal => new Promise(resolve => { + const abort = () => resolve(); + if (signal.aborted) abort(); + else signal.addEventListener('abort', abort, { once: true }); + })); + void setup.then(() => { setupSettled = true; }); + + const cancellation = coordinator.cancel(() => cleanup.promise); + await setup; + await Promise.resolve(); + assert.equal(setupSettled, true, 'the setup promise must settle before the race attempt'); + + await assert.rejects( + coordinator.run('start', async () => { overlappingMutations += 1; }), + new RegExp(coordinatorBusyError), + ); + await assert.rejects( + coordinator.run('setup', async () => { overlappingMutations += 1; }), + new RegExp(coordinatorBusyError), + ); + assert.equal(overlappingMutations, 0); + + cleanup.resolve(); + await cancellation; + await coordinator.run('start', async () => { overlappingMutations += 1; }); + assert.equal(overlappingMutations, 1); + }); + + it('makes shutdown idempotent, aborts active work, and rejects late operations', async () => { + const coordinator = new DesktopOperationCoordinator(); + let aborted = false; + const active = coordinator.run('stop', signal => new Promise(resolve => { + const abort = () => { aborted = true; resolve(); }; + if (signal.aborted) abort(); + else signal.addEventListener('abort', abort, { once: true }); + })); + let cleanup = 0; + const shutdown = coordinator.shutdown(async () => { cleanup += 1; }); + assert.equal(coordinator.shutdown(async () => { cleanup += 10; }), shutdown); + await Promise.all([active, shutdown]); + assert.equal(aborted, true); + assert.equal(cleanup, 1); + await assert.rejects(coordinator.run('start', async () => undefined), new RegExp(coordinatorShutdownError)); + }); + + it('runs shutdown cleanup only after the aborted host operation settles', async () => { + const coordinator = new DesktopOperationCoordinator(); + const release = deferred(); + let cleanupStarted = false; + const active = coordinator.run('start', signal => new Promise(resolve => { + const abort = () => { void release.promise.then(resolve); }; + if (signal.aborted) abort(); + else signal.addEventListener('abort', abort, { once: true }); + })); + const shutdown = coordinator.shutdown(async () => { cleanupStarted = true; }); + await Promise.resolve(); + assert.equal(cleanupStarted, false); + release.resolve(); + await Promise.all([active, shutdown]); + assert.equal(cleanupStarted, true); + }); + + it('awaits in-flight cancellation cleanup before shutdown cleanup', async () => { + const coordinator = new DesktopOperationCoordinator(); + const cancelled = deferred(); + const setup = coordinator.run('setup', signal => new Promise(resolve => { + const abort = () => resolve(); + if (signal.aborted) abort(); else signal.addEventListener('abort', abort, { once: true }); + })); + const cancel = coordinator.cancel(() => cancelled.promise); + let shutdownCleanup = false; + const shutdown = coordinator.shutdown(async () => { shutdownCleanup = true; }); + await setup; + await Promise.resolve(); + assert.equal(shutdownCleanup, false); + cancelled.resolve(); + await Promise.all([cancel, shutdown]); + assert.equal(shutdownCleanup, true); + }); + + it('settles cancel-vs-shutdown races only after shared setup cleanup', async () => { + const coordinator = new DesktopOperationCoordinator(); + const cleanup = deferred(); + const setup = coordinator.run('setup', signal => new Promise(resolve => { + const abort = () => { void cleanup.promise.then(resolve); }; + if (signal.aborted) abort(); else signal.addEventListener('abort', abort, { once: true }); + })); + const cancel = coordinator.cancel(() => cleanup.promise); + const shutdown = coordinator.shutdown(() => cleanup.promise); + let settled = false; + void Promise.all([cancel, shutdown]).then(() => { settled = true; }); + await Promise.resolve(); + assert.equal(settled, false); + cleanup.resolve(); + await Promise.all([setup, cancel, shutdown]); + }); +}); diff --git a/apps/desktop/src/operation-coordinator.ts b/apps/desktop/src/operation-coordinator.ts new file mode 100644 index 000000000..0e458c168 --- /dev/null +++ b/apps/desktop/src/operation-coordinator.ts @@ -0,0 +1,65 @@ +export type DesktopHostOperation = 'setup' | 'start' | 'stop' | 'restart' | 'status' | 'cancel'; + +export const coordinatorBusyError = 'Another local runtime operation is already in progress.'; +export const coordinatorShutdownError = 'ProPR Desktop is shutting down.'; + +interface ActiveOperation { + kind: DesktopHostOperation; + controller: AbortController; + promise: Promise; +} + +/** Single main-process gate for every local setup/lifecycle host action. */ +export class DesktopOperationCoordinator { + #active: ActiveOperation | null = null; + #cancellation: Promise | null = null; + #shutdown: Promise | null = null; + + run(kind: DesktopHostOperation, operation: (signal: AbortSignal) => Promise): Promise { + if (this.#shutdown) return Promise.reject(new Error(coordinatorShutdownError)); + if (this.#active || this.#cancellation) return Promise.reject(new Error(coordinatorBusyError)); + const controller = new AbortController(); + const active = { kind, controller, promise: Promise.resolve() } as ActiveOperation; + const promise = Promise.resolve().then(() => operation(controller.signal)).finally(() => { + if (this.#active === active) this.#active = null; + }); + active.promise = promise; + this.#active = active; + return promise; + } + + async cancel(cancelSetup: () => Promise): Promise { + if (this.#shutdown) throw new Error(coordinatorShutdownError); + if (this.#cancellation) return this.#cancellation; + const cancellation = (async () => { + const active = this.#active; + if (!active) return this.run('cancel', async () => cancelSetup()); + if (active.kind !== 'setup') throw new Error(coordinatorBusyError); + active.controller.abort(); + const cleanup = cancelSetup(); + await Promise.allSettled([active.promise, cleanup]); + return cleanup; + })(); + this.#cancellation = cancellation; + try { + return await cancellation; + } finally { + if (this.#cancellation === cancellation) this.#cancellation = null; + } + } + + shutdown(cleanup: () => Promise): Promise { + if (this.#shutdown) return this.#shutdown; + const active = this.#active; + const cancellation = this.#cancellation; + active?.controller.abort(); + this.#shutdown = (async () => { + await Promise.allSettled([ + ...(active ? [active.promise] : []), + ...(cancellation ? [cancellation] : []), + ]); + await cleanup(); + })(); + return this.#shutdown; + } +} diff --git a/apps/desktop/src/packaged-transport-smoke.ts b/apps/desktop/src/packaged-transport-smoke.ts new file mode 100644 index 000000000..9b7bb7072 --- /dev/null +++ b/apps/desktop/src/packaged-transport-smoke.ts @@ -0,0 +1,231 @@ +import { randomBytes } from 'node:crypto'; +import { BrowserWindow, crashReporter, type Session } from 'electron'; +import { DESKTOP_RENDERER_ORIGIN, DESKTOP_TRANSPORT_SCOPE_HEADER } from '@propr/shared'; +import type { DesktopCredentialService } from './credential-service'; +import { clearDesktopInstanceCookies } from './desktop-session'; +import type { ProfileStore } from './profile-store'; +import { normalizeApiBaseUrl } from './security'; + +export interface PackagedTransportSmoke { + firstOrigin: string; + secondOrigin: string; + shutdownMode: 'success' | 'retry' | 'forced-timeout'; +} + +export const packagedTransportSmoke = (authorized: boolean): PackagedTransportSmoke | null => { + const raw = [ + process.env.PROPR_DESKTOP_SMOKE_FIRST_ORIGIN, + process.env.PROPR_DESKTOP_SMOKE_SECOND_ORIGIN, + process.env.PROPR_DESKTOP_SMOKE_SHUTDOWN_MODE, + ]; + if (raw.every(value => value === undefined)) return null; + if (!authorized || raw.some(value => value === undefined)) { + throw new Error('Packaged transport smoke inputs require an authorized complete smoke invocation'); + } + const firstOrigin = normalizeApiBaseUrl(raw[0]!); + const secondOrigin = normalizeApiBaseUrl(raw[1]!); + const shutdownMode = raw[2]; + const loopback = (origin: string | null): origin is string => origin !== null + && new URL(origin).hostname === '127.0.0.1'; + if (!loopback(firstOrigin) || !loopback(secondOrigin) || firstOrigin === secondOrigin + || (shutdownMode !== 'success' && shutdownMode !== 'retry' && shutdownMode !== 'forced-timeout')) { + throw new Error('Packaged transport smoke requires distinct canonical loopback fixtures and a bounded shutdown mode'); + } + return { firstOrigin, secondOrigin, shutdownMode }; +}; + +interface RunPackagedTransportSmokeOptions { + window: BrowserWindow; + profiles: ProfileStore; + credentials: DesktopCredentialService; + desktopSession: Session; + smoke: PackagedTransportSmoke; + log(event: string, fields: Record): void; +} + +/** Execute transport and custody evidence against the actual packaged renderer and Electron session. */ +export const runPackagedTransportSmoke = async ({ + window, + profiles, + credentials, + desktopSession, + smoke, + log, +}: RunPackagedTransportSmokeOptions): Promise => { + const profileId = 'packaged-transport-smoke'; + const tokenA = `propr_it_${randomBytes(32).toString('base64url')}`; + const tokenB = `propr_it_${randomBytes(32).toString('base64url')}`; + const security = profiles.security(); + if (!security.available || security.backend === 'basic_text') { + throw new Error('Packaged transport smoke requires the production OS credential backend'); + } + const profileA = await profiles.save({ + id: profileId, label: 'Packaged transport A', apiBaseUrl: smoke.firstOrigin, + }); + const storedA = await profiles.writeCredential({ + version: 1, profileId, origin: smoke.firstOrigin, token: tokenA, + }); + if (!storedA.stored) throw new Error('Production credential encryption was unavailable'); + + const storageWindows = await Promise.all([smoke.firstOrigin, smoke.secondOrigin].map(async origin => { + const storageWindow = new BrowserWindow({ + show: false, + webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true, webSecurity: true }, + }); + await storageWindow.loadURL(`${origin}/smoke-storage`); + return { origin, window: storageWindow }; + })); + const seedStorage = async (): Promise => { + await Promise.all(storageWindows.map(item => item.window.webContents.executeJavaScript(`(async () => { + document.cookie = 'packaged-smoke-cookie=present; SameSite=Lax'; + localStorage.setItem('packaged-smoke-local', 'present'); + await new Promise((resolve, reject) => { + const request = indexedDB.open('packaged-smoke-indexeddb', 1); + request.onupgradeneeded = () => request.result.createObjectStore('proof'); + request.onsuccess = () => { request.result.close(); resolve(true); }; + request.onerror = () => reject(request.error); + }); + const cache = await caches.open('packaged-smoke-cache'); + await cache.put('/packaged-smoke-cache-entry', new Response('present')); + await navigator.serviceWorker.register('/smoke-sw.js'); + await navigator.serviceWorker.ready; + return true; + })()`))); + }; + const storageState = async (expected: 'present' | 'absent'): Promise => { + const states = await Promise.all(storageWindows.map(async item => { + const rendererState = await item.window.webContents.executeJavaScript(`(async () => ({ + cookie: document.cookie.includes('packaged-smoke-cookie=present'), + localStorage: localStorage.getItem('packaged-smoke-local') === 'present', + indexedDB: (await indexedDB.databases()).some(database => database.name === 'packaged-smoke-indexeddb'), + cacheStorage: (await caches.keys()).includes('packaged-smoke-cache'), + serviceWorker: (await navigator.serviceWorker.getRegistrations()).some(registration => registration.scope.startsWith(location.origin)), + }))()`); + const cookies = await desktopSession.cookies.get({ url: item.origin }); + return { ...rendererState, cookie: rendererState.cookie || cookies.length > 0 } as Record; + })); + return states.every(state => Object.values(state).every(value => value === (expected === 'present'))); + }; + + try { + await window.webContents.executeJavaScript(`new Promise((resolve, reject) => { + const started = Date.now(); + const poll = () => { + if (window.__proprPackagedTransportSmoke) return resolve(true); + if (Date.now() - started > 5000) return reject(new Error('Packaged renderer smoke harness timed out')); + setTimeout(poll, 20); + }; + poll(); + })`); + const profileForRendererA = { + id: profileId, name: profileA.label, baseUrl: smoke.firstOrigin, kind: 'remote', + }; + const first = await window.webContents.executeJavaScript(`(async () => { + const smoke = window.__proprPackagedTransportSmoke; + const first = await smoke.activate(${JSON.stringify(profileForRendererA)}); + await smoke.rest(); + const socketId = await smoke.connectSocket(); + const rotated = await smoke.activate(${JSON.stringify(profileForRendererA)}); + let staleRestRejected = false; + try { + const response = await fetch(${JSON.stringify(`${smoke.firstOrigin}/api/smoke/rest`)}, { + headers: { ${JSON.stringify(DESKTOP_TRANSPORT_SCOPE_HEADER)}: first.transportScope }, + credentials: 'include', + }); + staleRestRejected = !response.ok; + } catch { staleRestRejected = true; } + await smoke.expectSocketRejected(socketId); + await smoke.rest(); + localStorage.setItem('packaged-smoke-local', 'non-secret sentinel'); + sessionStorage.setItem('packaged-smoke-session', 'non-secret sentinel'); + return { first, rotated, socketId, staleRestRejected, rendererOrigin: location.origin }; + })()`); + if (first?.rendererOrigin !== DESKTOP_RENDERER_ORIGIN || first?.first?.profileId !== profileId + || first?.first?.transportScope === first?.rotated?.transportScope + || first?.first?.contractsContainSecret !== false || first?.rotated?.contractsContainSecret !== false + || first?.staleRestRejected !== true) { + throw new Error('Packaged renderer protocol or first transport proof failed'); + } + await seedStorage(); + if (!await storageState('present')) throw new Error('Packaged origin storage fixture was incomplete'); + + let cleanupFailed = false; + try { + await credentials.saveProfile({ + id: profileId, label: 'Packaged transport B', apiBaseUrl: smoke.secondOrigin, + }, async () => { throw new Error('packaged cleanup failure'); }); + } catch (error) { + cleanupFailed = error instanceof Error && error.message === 'packaged cleanup failure'; + } + const rollback = await profiles.readProfileCredential(profileId); + if (!cleanupFailed || rollback.profile?.apiBaseUrl !== smoke.firstOrigin + || rollback.credential?.origin !== smoke.firstOrigin || rollback.credential.token !== tokenA + || !await storageState('present')) { + throw new Error('Origin cleanup failure did not preserve complete durable A'); + } + let precommitStorageCleared = false; + await credentials.saveProfile({ + id: profileId, label: 'Packaged transport B', apiBaseUrl: smoke.secondOrigin, + }, async (previousOrigin, nextOrigin) => { + await clearDesktopInstanceCookies(desktopSession, [previousOrigin, nextOrigin]); + precommitStorageCleared = await storageState('absent'); + if (!precommitStorageCleared) throw new Error('Complete origin storage was not cleared before commit'); + }); + if (!precommitStorageCleared || !await storageState('absent')) { + throw new Error('Same-ID URL edit did not clear both complete Electron origin stores'); + } + const storedB = await profiles.writeCredential({ + version: 1, profileId, origin: smoke.secondOrigin, token: tokenB, + }); + if (!storedB.stored) throw new Error('Replacement credential encryption was unavailable'); + + const profileForRendererB = { + id: profileId, name: 'Packaged transport B', baseUrl: smoke.secondOrigin, kind: 'remote', + }; + const second = await window.webContents.executeJavaScript(`(async () => { + const smoke = window.__proprPackagedTransportSmoke; + const activated = await smoke.activate(${JSON.stringify(profileForRendererB)}); + const socketId = await smoke.connectSocket(); + await smoke.reconnectSocket(socketId); + const staleClassification = await smoke.handleStaleInvalidation( + ${JSON.stringify(profileId)}, ${JSON.stringify(first.rotated.transportScope)} + ); + smoke.disconnectSocket(${JSON.stringify(first.socketId)}); + await smoke.rest(); + const persisted = await window.__PROPR_DESKTOP__.profiles.list(); + const rendererEvidence = smoke.rendererEvidence(); + return { + activated, + staleClassification, + persisted, + rendererEvidence, + rendererPersistenceContainsSecret: JSON.stringify([persisted, rendererEvidence]).includes('propr_it_'), + }; + })()`); + const secretInMainMetadata = [tokenA, tokenB].some(secret => + process.argv.some(argument => argument.includes(secret)) + || JSON.stringify(crashReporter.getParameters()).includes(secret)); + if (second?.staleClassification !== 'retryable' || second?.activated?.profileId !== profileId + || second?.activated?.contractsContainSecret !== false + || second?.rendererPersistenceContainsSecret !== false || secretInMainMetadata) { + throw new Error('Packaged replacement scope or secret-custody proof failed'); + } + log('desktop.renderer.transport_smoke.ready', { + customProtocol: true, + restBearer: true, + socketIo: true, + engineIoHandshake: true, + namespaceAuthentication: true, + reconnectAndErrorHandling: true, + scopeRotation: true, + allOriginStorageCleared: true, + cleanupRollbackAndRetry: true, + staleScopeRejected: true, + secretCustody: true, + productionCredentialRoundTrip: true, + storageBackend: security.backend, + }); + } finally { + for (const item of storageWindows) if (!item.window.isDestroyed()) item.window.destroy(); + } +}; diff --git a/apps/desktop/src/pairing-response-lifecycle.test.ts b/apps/desktop/src/pairing-response-lifecycle.test.ts new file mode 100644 index 000000000..e24f42e8a --- /dev/null +++ b/apps/desktop/src/pairing-response-lifecycle.test.ts @@ -0,0 +1,466 @@ +import assert from 'node:assert/strict'; +import { mkdtemp, readFile, readdir, rm } from 'node:fs/promises'; +import { tmpdir } from 'node:os'; +import { join, relative } from 'node:path'; +import { describe, it } from 'node:test'; +import type { App, IpcMain, IpcMainInvokeEvent, Session } from 'electron'; +import type { PairingProtocolRequestOptions } from '@propr/client'; +import { DesktopCredentialService } from './credential-service'; +import { registerIpcHandlers } from './ipc'; +import type { LocalLifecycleController } from './lifecycle'; +import type { DesktopLogger } from './logger'; +import { ProfileStore, type EncryptionProvider } from './profile-store'; +import { IPC_CHANNELS } from './shared/contract'; +import { createDesktopShutdownCoordinator } from './shutdown'; + +type Endpoint = 'start' | 'poll' | 'activate' | 'cancel'; +type BarrierPhase = 'header' | 'body' | 'reader-cancel' | 'body-cancel'; + +interface Scenario { + name: string; + endpoint: Endpoint; + phase: BarrierPhase; +} + +const scenarios: readonly Scenario[] = [ + { name: 'start-header', endpoint: 'start', phase: 'header' }, + { name: 'start-body', endpoint: 'start', phase: 'body' }, + { name: 'poll-header', endpoint: 'poll', phase: 'header' }, + { name: 'poll-body', endpoint: 'poll', phase: 'body' }, + { name: 'activate-header', endpoint: 'activate', phase: 'header' }, + { name: 'activate-body', endpoint: 'activate', phase: 'body' }, + { name: 'cancel-header', endpoint: 'cancel', phase: 'header' }, + { name: 'cancel-body', endpoint: 'cancel', phase: 'body' }, + { name: 'never-settling-reader-cancel', endpoint: 'activate', phase: 'reader-cancel' }, + { name: 'never-settling-body-cancel', endpoint: 'activate', phase: 'body-cancel' }, +]; + +const encryption: EncryptionProvider = { + isEncryptionAvailable: () => true, + backend: () => 'keychain', + encrypt: value => Buffer.from(Buffer.from(value, 'utf8').toString('base64url'), 'utf8'), + decrypt: value => Buffer.from(value.toString(), 'base64url').toString('utf8'), +}; + +const json = (body: unknown, status = 200): Response => new Response(JSON.stringify(body), { + status, + headers: { 'Content-Type': 'application/json' }, +}); + +const deferred = () => { + let resolve!: (value: T | PromiseLike) => void; + let reject!: (reason?: unknown) => void; + const promise = new Promise((settle, fail) => { resolve = settle; reject = fail; }); + return { promise, resolve, reject }; +}; + +class ProtocolClock { + #now = 0; + #nextId = 1; + readonly #timers = new Map void }>(); + + readonly source: NonNullable = { + now: () => this.#now, + setTimeout: (callback, milliseconds) => { + const id = this.#nextId++; + this.#timers.set(id, { at: this.#now + milliseconds, callback }); + return id as unknown as ReturnType; + }, + clearTimeout: timer => { this.#timers.delete(timer as unknown as number); }, + }; + + get pending(): number { return this.#timers.size; } + + async advance(milliseconds: number): Promise { + const target = this.#now + milliseconds; + while (true) { + const due = [...this.#timers.entries()] + .filter(([, timer]) => timer.at <= target) + .sort(([leftId, left], [rightId, right]) => left.at - right.at || leftId - rightId)[0]; + if (!due) break; + this.#now = due[1].at; + this.#timers.delete(due[0]); + due[1].callback(); + await Promise.resolve(); + await Promise.resolve(); + } + this.#now = target; + await Promise.resolve(); + await Promise.resolve(); + } +} + +const bounded = async (promise: Promise, milliseconds = 1_000): Promise => { + let timer: ReturnType | undefined; + try { + return await Promise.race([ + promise, + new Promise((_resolve, reject) => { + timer = setTimeout(() => reject(new Error('desktop shutdown did not settle')), milliseconds); + }), + ]); + } finally { + if (timer) clearTimeout(timer); + } +}; + +const durableBytes = async (root: string): Promise> => { + const snapshot: Record = {}; + const visit = async (directory: string): Promise => { + for (const entry of await readdir(directory, { withFileTypes: true })) { + const path = join(directory, entry.name); + if (entry.isDirectory()) await visit(path); + else snapshot[relative(root, path)] = (await readFile(path)).toString('base64'); + } + }; + await visit(root); + return Object.fromEntries(Object.entries(snapshot).sort(([left], [right]) => left.localeCompare(right))); +}; + +const immediate = (): Promise => new Promise(resolve => setImmediate(resolve)); + +describe('desktop pairing service IPC native shutdown lifecycle', () => { + assert.equal(scenarios.length, 10); + + for (const scenario of scenarios) { + it(`${scenario.name} drains through the real service, IPC gate, and before-quit order`, async () => { + const directory = await mkdtemp(join(tmpdir(), `propr-${scenario.name}-`)); + const clock = new ProtocolClock(); + const barrier = deferred(); + const lateHeader = deferred(); + const lateCancellation = deferred(); + const cancellationStarted = deferred(); + const protocolNow = Date.parse('2026-01-01T00:00:00.000Z'); + const expiresAt = new Date(protocolNow + 10_000).toISOString(); + const profileId = `profile-${scenario.name}`; + const origin = 'https://a.example.test'; + const provisionalToken = `propr_it_${'C'.repeat(43)}`; + const counts = { + fetchStart: 0, + fetchAbort: 0, + bodyPull: 0, + bodyCancel: 0, + profileRead: 0, + profileWrite: 0, + profileIO: 0, + ipcEntry: 0, + ipcExit: 0, + rendererPublication: 0, + sessionNetwork: 0, + }; + const order: string[] = []; + const unhandled: unknown[] = []; + const onUnhandled = (error: unknown): void => { unhandled.push(error); }; + process.on('unhandledRejection', onUnhandled); + + const rawStore = new ProfileStore(directory, encryption, { + beforeIO: () => { counts.profileIO += 1; }, + }); + const readMethods = new Set([ + 'list', 'readCredential', 'readProfileCredential', 'pendingRevocations', 'security', + ]); + const store = new Proxy(rawStore, { + get(target, property) { + const value = Reflect.get(target, property, target) as unknown; + if (typeof value !== 'function') return value; + return (...args: unknown[]) => { + if (readMethods.has(String(property))) counts.profileRead += 1; + else counts.profileWrite += 1; + return (value as (...values: unknown[]) => unknown).apply(target, args); + }; + }, + }) as ProfileStore; + + let targetSignal: AbortSignal | undefined; + let pairingBinding: Record = {}; + let activationFailures = 0; + let cancellationCanSettle = false; + const stalledBody = (beforeReader: boolean): Response => new Response( + new ReadableStream({ + pull() { + counts.bodyPull += 1; + if (!beforeReader) barrier.resolve(undefined); + }, + cancel() { + counts.bodyCancel += 1; + if (beforeReader) barrier.resolve(undefined); + cancellationStarted.resolve(undefined); + return lateCancellation.promise; + }, + }), + { + headers: { + 'Content-Type': 'application/json', + ...(beforeReader ? { 'Content-Length': '4097' } : {}), + }, + }, + ); + + const fetchImplementation: typeof globalThis.fetch = async (input, init) => { + counts.fetchStart += 1; + const url = input.toString(); + const signal = init?.signal ?? undefined; + signal?.addEventListener('abort', () => { counts.fetchAbort += 1; }, { once: true }); + const endpoint: Endpoint = url.endsWith('/poll') + ? 'poll' + : url.endsWith('/activate') + ? 'activate' + : url.endsWith('/cancel') + ? 'cancel' + : 'start'; + if (endpoint === scenario.endpoint) { + targetSignal = signal; + if (scenario.phase === 'header') { + barrier.resolve(undefined); + return lateHeader.promise; + } + if (scenario.phase === 'body-cancel') return stalledBody(true); + return stalledBody(false); + } + if (endpoint === 'start') { + const request = JSON.parse(String(init?.body)) as Record; + pairingBinding = { + instanceId: request.instanceId, + origin: request.origin, + scope: request.scope, + credentialGeneration: request.credentialGeneration, + }; + return json({ + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: `${origin}/approve`, + expiresAt, + interval: 1, + }, 201); + } + if (endpoint === 'poll') { + return json({ + status: 'provisional', + token: provisionalToken, + tokenType: 'Bearer', + activationTicket: 'T'.repeat(43), + activationExpiresAt: expiresAt, + ...pairingBinding, + }); + } + if (endpoint === 'activate') { + if (scenario.endpoint === 'cancel') { + activationFailures += 1; + return json({ code: 'ACTIVATION_FAILED', error: 'activation failed' }, 500); + } + return json({ + status: 'active', + receipt: 'R'.repeat(22), + activatedAt: '2026-01-01T00:00:01.000Z', + expiresAt: null, + }); + } + return json({ status: 'cancelled', cancelledAt: '2026-01-01T00:00:01.000Z' }); + }; + + const handlers = new Map unknown>(); + let service!: DesktopCredentialService; + try { + const profile = await store.save({ id: profileId, label: scenario.name, apiBaseUrl: origin }); + service = new DesktopCredentialService({ + profiles: store, + clientName: `Native ${scenario.name}`, + openExternal: async () => undefined, + fetch: fetchImplementation, + pairingTiming: { now: () => protocolNow, sleep: async () => undefined }, + pairingProtocol: { + overallTimeoutMs: 1_000, + deadlines: { headerMs: 500, bodyMs: 500, cancellationMs: 100 }, + clock: clock.source, + reportDiagnostic: () => undefined, + }, + }); + assert.deepEqual(await service.initialize(), { status: 'ready', retryPending: false }); + + const desktopSession = { + fetch: async () => { counts.sessionNetwork += 1; return new Response(null, { status: 204 }); }, + clearStorageData: async () => undefined, + } as unknown as Session; + const registered = registerIpcHandlers({ + app: { + getName: () => 'ProPR', getVersion: () => '0.8.15', isPackaged: true, + } as unknown as App, + ipcMain: { + handle: (channel: string, handler: (...args: any[]) => unknown) => { handlers.set(channel, handler); }, + removeHandler: (channel: string) => { handlers.delete(channel); }, + } as unknown as IpcMain, + profiles: store, + credentials: service, + lifecycle: {} as LocalLifecycleController, + logger: { log: () => undefined } as unknown as DesktopLogger, + desktopSession, + devServerUrl: undefined, + packagedRendererUrl: 'propr-renderer://app/index.html', + openExternal: async () => undefined, + observeInvocation: phase => { counts[phase === 'entry' ? 'ipcEntry' : 'ipcExit'] += 1; }, + }); + const event = { + senderFrame: { url: 'propr-renderer://app/index.html' }, + } as unknown as IpcMainInvokeEvent; + const invoke = (channel: string, ...args: unknown[]): Promise => + Promise.resolve(handlers.get(channel)!(event, ...args)); + + const admitted = invoke(IPC_CHANNELS.authenticationPair, { + id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl, + }).then(value => { + counts.rendererPublication += 1; + return { status: 'fulfilled' as const, value }; + }, error => ({ status: 'rejected' as const, error })); + await bounded(barrier.promise); + + const provisionalCouldExist = ['activate', 'cancel'].includes(scenario.endpoint); + const pendingBeforeShutdown = await store.pendingRevocations(); + assert.equal(pendingBeforeShutdown.length, provisionalCouldExist ? 1 : 0); + if (provisionalCouldExist) { + assert.deepEqual(pendingBeforeShutdown[0].credential, { + version: 1, profileId, origin, token: provisionalToken, + }); + } + assert.equal(await store.readCredential(profileId), null); + + let windowDestroyed = false; + let shutdownFinished = false; + let finalQuitCalls = 0; + let allowedFinalQuits = 0; + let shutdown!: ReturnType; + shutdown = createDesktopShutdownCoordinator({ + credentials: { + dispose: () => { order.push('credentials-dispose'); return service.dispose(); }, + }, + lifecycle: { + shutdown: async () => { order.push('lifecycle-shutdown'); }, + }, + ipc: { + close: () => { order.push('ipc-close'); registered.close(); }, + awaitIdle: () => { order.push('ipc-drain'); return registered.awaitIdle(); }, + dispose: () => { order.push('ipc-dispose'); registered.dispose(); }, + }, + profiles: { + close: () => { order.push('profiles-close'); return store.close(); }, + }, + sessionSecurity: { + close: () => { order.push('session-close'); }, + dispose: () => { order.push('session-dispose'); }, + }, + disposeRendererProtocol: () => { order.push('protocol-dispose'); }, + getWindow: () => ({ + isDestroyed: () => windowDestroyed, + destroy: () => { windowDestroyed = true; order.push('window-destroy'); }, + }), + quit: () => { + finalQuitCalls += 1; + order.push('app-quit'); + let finalQuitPrevented = false; + shutdown.beforeQuit({ preventDefault: () => { finalQuitPrevented = true; } }); + if (!finalQuitPrevented) { + allowedFinalQuits += 1; + shutdownFinished = true; + } + }, + onStarted: () => { order.push('shutdown-started'); }, + log: () => undefined, + }); + let prevented = 0; + shutdown.beforeQuit({ preventDefault: () => { prevented += 1; } }); + assert.equal(prevented, 1); + assert.equal(shutdown.started, true); + assert.deepEqual(order.slice(0, 4), [ + 'shutdown-started', 'ipc-close', 'session-close', 'protocol-dispose', + ]); + + const callsBeforeLate = { + fetchStart: counts.fetchStart, + profileRead: counts.profileRead, + profileWrite: counts.profileWrite, + sessionNetwork: counts.sessionNetwork, + }; + await Promise.all([ + assert.rejects(invoke(IPC_CHANNELS.profilesList), /DESKTOP_CLOSING/), + assert.rejects(invoke(IPC_CHANNELS.authenticationPair, { + id: profile.id, label: profile.label, apiBaseUrl: profile.apiBaseUrl, + }), /DESKTOP_CLOSING/), + assert.rejects(invoke(IPC_CHANNELS.authLogout, origin), /DESKTOP_CLOSING/), + ]); + assert.deepEqual({ + fetchStart: counts.fetchStart, + profileRead: counts.profileRead, + profileWrite: counts.profileWrite, + sessionNetwork: counts.sessionNetwork, + }, callsBeforeLate); + + const cancellationExpected = scenario.phase !== 'header'; + if (cancellationExpected) { + await bounded(cancellationStarted.promise); + shutdown.beforeQuit({ preventDefault: () => { prevented += 1; } }); + assert.equal(prevented, 2, 'repeated before-quit was not prevented during cancellation'); + cancellationCanSettle = true; + await clock.advance(99); + await Promise.resolve(); + assert.equal(shutdownFinished, false, 'untrusted cancellation escaped its 100ms budget'); + await clock.advance(1); + } else { + shutdown.beforeQuit({ preventDefault: () => { prevented += 1; } }); + assert.equal(prevented, 2, 'repeated before-quit was not prevented during header drain'); + } + await bounded(shutdown.awaitFinished()); + const original = await bounded(admitted); + assert.equal(original.status, 'rejected'); + if (original.status === 'rejected') assert.match(String(original.error), /Desktop operation failed/i); + assert.equal(targetSignal?.aborted, true); + assert.equal(counts.rendererPublication, 0); + assert.equal(counts.ipcEntry, 1); + assert.equal(counts.ipcExit, 1); + assert.equal(handlers.size, 0); + assert.equal(windowDestroyed, true); + assert.equal(shutdownFinished, true); + assert.equal(finalQuitCalls, 1); + assert.equal(allowedFinalQuits, 1); + assert.equal(activationFailures, scenario.endpoint === 'cancel' ? 2 : 0); + for (const step of [ + 'shutdown-started', 'ipc-close', 'session-close', 'protocol-dispose', + 'credentials-dispose', 'lifecycle-shutdown', 'ipc-drain', 'profiles-close', + 'session-dispose', 'ipc-dispose', 'window-destroy', 'app-quit', + ]) { + assert.equal(order.filter(entry => entry === step).length, 1, `${step} ran more than once`); + } + assert.equal(order.indexOf('profiles-close') > order.indexOf('ipc-drain'), true); + assert.equal(order.indexOf('session-dispose') > order.indexOf('profiles-close'), true); + assert.equal(order.indexOf('window-destroy') > order.indexOf('ipc-dispose'), true); + assert.equal(order.at(-1), 'app-quit'); + await bounded(service.awaitIdle()); + await bounded(registered.awaitIdle()); + assert.deepEqual(service.prepareRequest(`${origin}/api/tasks`, {}), { cancel: true }); + assert.equal(clock.pending, 0); + + let extraQuitPrevented = false; + shutdown.beforeQuit({ preventDefault: () => { extraQuitPrevented = true; } }); + assert.equal(extraQuitPrevented, true, 'more than the deliberate final quit was allowed'); + assert.equal(finalQuitCalls, 1); + assert.equal(allowedFinalQuits, 1); + + const countsAtDispose = { ...counts }; + const bytesAtDispose = await durableBytes(directory); + if (scenario.phase === 'header') lateHeader.reject(new Error('late private header failure')); + if (cancellationCanSettle) lateCancellation.reject(new Error('late private cancellation failure')); + await clock.advance(2_000); + await immediate(); + await immediate(); + + assert.deepEqual(counts, countsAtDispose); + assert.deepEqual(await durableBytes(directory), bytesAtDispose); + assert.deepEqual(unhandled, []); + assert.equal(clock.pending, 0); + console.log(`NATIVE_PAIRING_SHUTDOWN ${scenario.name}`); + } finally { + process.removeListener('unhandledRejection', onUnhandled); + await service?.dispose().catch(() => undefined); + await rm(directory, { recursive: true, force: true }); + } + }); + } +}); diff --git a/apps/desktop/src/pending-revocation-crash-fixture.ts b/apps/desktop/src/pending-revocation-crash-fixture.ts new file mode 100644 index 000000000..3617dd7d5 --- /dev/null +++ b/apps/desktop/src/pending-revocation-crash-fixture.ts @@ -0,0 +1,37 @@ +import { DesktopCredentialService } from './credential-service'; +import { ProfileStore, type EncryptionProvider } from './profile-store'; + +const [directory, mode] = process.argv.slice(2) as [string, 'during-revoke' | 'after-remote-success']; +const encryption: EncryptionProvider = { + isEncryptionAvailable: () => true, + backend: () => 'keychain', + encrypt: value => Buffer.from(value, 'utf8'), + decrypt: value => value.toString('utf8'), +}; +const store = new ProfileStore(directory, encryption); +const profiles = mode === 'after-remote-success' + ? new Proxy(store, { + get(target, property) { + if (property === 'completePendingRevocation') return async () => { + process.kill(process.pid, 'SIGKILL'); + return false; + }; + const value = Reflect.get(target, property); + return typeof value === 'function' ? value.bind(target) : value; + }, + }) + : store; +const service = new DesktopCredentialService({ + profiles, + clientName: 'Crash fixture', + openExternal: async () => undefined, + fetch: async (_input, init) => { + const authorization = new Headers(init?.headers).get('Authorization'); + if (authorization !== `Bearer propr_it_${'A'.repeat(43)}`) { + throw new Error('Pending revocation used the wrong credential'); + } + if (mode === 'during-revoke') process.kill(process.pid, 'SIGKILL'); + return new Response(null, { status: 204 }); + }, +}); +await service.initialize(); diff --git a/apps/desktop/src/preload-bridge.test.ts b/apps/desktop/src/preload-bridge.test.ts index 81db36bef..dccf81156 100644 --- a/apps/desktop/src/preload-bridge.test.ts +++ b/apps/desktop/src/preload-bridge.test.ts @@ -1,42 +1,60 @@ import assert from 'node:assert/strict'; import { describe, it } from 'node:test'; -import { createDesktopBridge, type PreloadIpc } from './preload-bridge'; +import { createDesktopBridge, createDesktopRendererBridge, probeDesktopProfile, type PreloadIpc } from './preload-bridge'; import { IPC_CHANNELS } from './shared/contract'; +import { PROPR_API_COMPATIBILITY } from '@propr/shared'; class FakeIpc implements PreloadIpc { readonly invocations: Array<{ channel: string; args: unknown[] }> = []; - readonly listeners = new Map void>(); + readonly listeners = new Map void>(); async invoke(channel: string, ...args: unknown[]): Promise { this.invocations.push({ channel, args }); return undefined; } - on(channel: string, listener: (event: unknown, value: string) => void): void { + on(channel: string, listener: (event: unknown, value: any) => void): void { this.listeners.set(channel, listener); } - removeListener(channel: string, listener: (event: unknown, value: string) => void): void { + removeListener(channel: string, listener: (event: unknown, value: any) => void): void { if (this.listeners.get(channel) === listener) this.listeners.delete(channel); } } +const setupRequest = { + sessionId: '00000000-0000-4000-8000-000000000000', root: { mode: 'default' as const }, reinitialize: false, agents: [], + github: { mode: 'demo' as const }, intake: { mode: 'keep' as const }, whitelist: null, repository: null, +}; + describe('desktop preload bridge', () => { it('exposes only the narrow frozen namespaces', () => { - const bridge = createDesktopBridge(new FakeIpc()); - assert.deepEqual(Object.keys(bridge).sort(), ['app', 'auth', 'credentials', 'external', 'lifecycle', 'profiles', 'storage']); + const bridge = createDesktopBridge(new FakeIpc(), 'linux'); + assert.deepEqual(Object.keys(bridge).sort(), [ + 'app', 'auth', 'authentication', 'connection', 'external', 'lifecycle', 'profiles', 'storage', + ]); assert.equal(Object.isFrozen(bridge), true); assert.equal(Object.values(bridge).every(Object.isFrozen), true); assert.equal('fs' in bridge, false); assert.equal('exec' in bridge, false); }); - it('maps profile and credential operations to fixed channels', async () => { + for (const platform of ['darwin', 'win32'] as const) { + it(`does not expose legacy local lifecycle authority on ${platform}`, async () => { + const ipc = new FakeIpc(); + const bridge = createDesktopBridge(ipc, platform); + assert.equal('lifecycle' in bridge, false); + assert.equal('docker' in bridge, false); + assert.deepEqual(ipc.invocations, []); + }); + } + + it('maps profile operations to fixed channels without a credential namespace', async () => { const ipc = new FakeIpc(); - const bridge = createDesktopBridge(ipc); + const bridge = createDesktopBridge(ipc, 'linux'); await bridge.auth.logout('http://localhost:4000'); await bridge.profiles.save({ label: 'Local', apiBaseUrl: 'http://localhost:4000' }); - await bridge.credentials.write('profile-1', 'secret'); + assert.ok(bridge.lifecycle); await bridge.lifecycle.start(); assert.deepEqual(ipc.invocations, [ { channel: IPC_CHANNELS.authLogout, args: ['http://localhost:4000'] }, @@ -44,11 +62,26 @@ describe('desktop preload bridge', () => { channel: IPC_CHANNELS.profilesSave, args: [{ label: 'Local', apiBaseUrl: 'http://localhost:4000' }], }, - { channel: IPC_CHANNELS.credentialsWrite, args: ['profile-1', 'secret'] }, { channel: IPC_CHANNELS.lifecycleStart, args: [] }, ]); }); + it('exposes setup through fixed invocations and strips Electron events from progress', async () => { + const ipc = new FakeIpc(); + const bridge = createDesktopRendererBridge(ipc, 'linux'); + const received: unknown[] = []; + bridge.localSetup.onProgress(snapshot => received.push(snapshot)); + await bridge.localSetup.start(setupRequest); + ipc.listeners.get(IPC_CHANNELS.setupProgress)?.( + { sender: 'must-not-leak' }, + { phase: 'running', capability: { supported: true, kind: 'local', platform: 'linux' }, sessionId: setupRequest.sessionId, logs: [] }, + ); + + assert.deepEqual(ipc.invocations, [{ channel: IPC_CHANNELS.setupStart, args: [setupRequest] }]); + assert.deepEqual(received, [{ phase: 'running', capability: { supported: true, kind: 'local', platform: 'linux' }, sessionId: setupRequest.sessionId, logs: [] }]); + assert.equal('invoke' in bridge, false); + }); + it('does not expose Electron event objects to deep-link listeners', () => { const ipc = new FakeIpc(); const bridge = createDesktopBridge(ipc); @@ -60,6 +93,71 @@ describe('desktop preload bridge', () => { assert.equal(ipc.listeners.has(IPC_CHANNELS.deepLink), true); }); + it('probes completed local profiles through the injectable connection boundary', async () => { + const profile = { id: 'local', name: 'This computer', baseUrl: 'http://127.0.0.1:4000', kind: 'local' as const }; + const requests: string[] = []; + const result = await probeDesktopProfile(profile, async input => { + requests.push(input.toString()); + return new Response(JSON.stringify({ apiCompatibility: PROPR_API_COMPATIBILITY, version: '0.8.15' }), { + status: 200, + headers: { 'content-type': 'application/json' }, + }); + }); + assert.deepEqual(requests, ['http://127.0.0.1:4000/api/compatibility']); + assert.equal(result.status, 'ready'); + + const injected = async () => ({ status: 'ready' as const, version: 'injected' }); + const bridge = createDesktopRendererBridge(new FakeIpc(), 'linux', injected); + assert.deepEqual(await bridge.connection.probe(profile), { status: 'ready', version: 'injected' }); + }); + + it('keeps remote probing out of the local setup lane and bounds local failures', async () => { + const remoteRequests: string[] = []; + const remote = await probeDesktopProfile({ id: 'remote', name: 'Remote', baseUrl: 'https://example.com', kind: 'remote' }, async input => { + remoteRequests.push(input.toString()); + return new Response(JSON.stringify({ apiCompatibility: PROPR_API_COMPATIBILITY, version: '0.8.15' }), { status: 200 }); + }); + assert.equal(remote.status, 'ready'); + assert.deepEqual(remoteRequests, ['https://example.com/api/compatibility']); + const local = await probeDesktopProfile({ id: 'local', name: 'Local', baseUrl: 'http://localhost:4000', kind: 'local' }, async () => { + throw new Error(`/home/alice/secret ${'x'.repeat(10_000)}`); + }); + assert.equal(local.status, 'offline'); + assert.ok((local.message?.length ?? 0) < 200); + assert.doesNotMatch(local.message ?? '', /alice|secret|home/); + }); + + for (const platform of ['darwin', 'win32'] as const) { + it(`keeps ${platform} remote-only while supporting production remote activation and browser sign-in`, async () => { + const ipc = new FakeIpc(); + const bridge = createDesktopRendererBridge(ipc, platform); + const remote = { id: 'remote-1', name: 'Team server', baseUrl: 'https://team.example.com', kind: 'remote' as const }; + + assert.equal((await bridge.localSetup.status()).capability.kind, 'remote-only'); + await assert.rejects(bridge.localSetup.start(setupRequest), /Local setup is unavailable/); + await bridge.profiles.setActiveId(remote.id); + await bridge.authentication.authenticate(remote); + await bridge.connection.probe(remote); + await bridge.connection.activate('activation-ticket'); + + assert.deepEqual(ipc.invocations, [ + { channel: IPC_CHANNELS.profilesSetActive, args: [remote.id] }, + { + channel: IPC_CHANNELS.authenticationPair, + args: [{ id: remote.id, label: remote.name, apiBaseUrl: remote.baseUrl }], + }, + { + channel: IPC_CHANNELS.connectionProbe, + args: [{ id: remote.id, label: remote.name, apiBaseUrl: remote.baseUrl }], + }, + { channel: IPC_CHANNELS.connectionActivate, args: ['activation-ticket'] }, + ]); + assert.equal(ipc.listeners.has(IPC_CHANNELS.setupProgress), false); + assert.equal('lifecycle' in bridge, false); + assert.equal('docker' in bridge, false); + }); + } + it('buffers startup and second-instance deep links until the renderer subscribes', () => { const ipc = new FakeIpc(); const bridge = createDesktopBridge(ipc); @@ -76,4 +174,31 @@ describe('desktop preload bridge', () => { 'propr://open?path=%2Ftasks', ]); }); + + it('routes the typed renderer bridge through the ordered host buffer across remounts', () => { + const ipc = new FakeIpc(); + const host = createDesktopBridge(ipc); + const renderer = createDesktopRendererBridge(ipc, 'linux', undefined, host.app.onDeepLink); + const receiveDeepLink = ipc.listeners.get(IPC_CHANNELS.deepLink); + assert.ok(receiveDeepLink); + + receiveDeepLink({}, 'propr://connect?api=https%3A%2F%2Ffirst.example'); + receiveDeepLink({}, 'propr://open?path=%2Ftasks'); + const received: string[] = []; + const unsubscribe = renderer.app.onDeepLink(value => received.push(value)); + assert.deepEqual(received, [ + 'propr://connect?api=https%3A%2F%2Ffirst.example', + 'propr://open?path=%2Ftasks', + ]); + + unsubscribe(); + receiveDeepLink({}, 'propr://connect?api=https%3A%2F%2Fsecond.example'); + const unsubscribeAfterRemount = renderer.app.onDeepLink(value => received.push(value)); + assert.deepEqual(received, [ + 'propr://connect?api=https%3A%2F%2Ffirst.example', + 'propr://open?path=%2Ftasks', + 'propr://connect?api=https%3A%2F%2Fsecond.example', + ]); + unsubscribeAfterRemount(); + }); }); diff --git a/apps/desktop/src/preload-bridge.ts b/apps/desktop/src/preload-bridge.ts index 3bba8300e..3d73f6a79 100644 --- a/apps/desktop/src/preload-bridge.ts +++ b/apps/desktop/src/preload-bridge.ts @@ -1,16 +1,29 @@ -import type { DesktopBridge } from './shared/contract'; +import type { + DesktopConnectionResult, + DesktopBridge, + DesktopPlatformView, + DesktopProfile, + DesktopProfileView, + DesktopRendererBridge, + DesktopSetupSnapshot, +} from './shared/contract'; import { IPC_CHANNELS } from './shared/contract'; +import { evaluateProprApiCompatibility } from '@propr/shared'; +import { normalizeApiBaseUrl } from './security'; export interface PreloadIpc { invoke(channel: string, ...args: unknown[]): Promise; - on(channel: string, listener: (event: unknown, value: string) => void): void; - removeListener(channel: string, listener: (event: unknown, value: string) => void): void; + on(channel: string, listener: (event: unknown, value: any) => void): void; + removeListener(channel: string, listener: (event: unknown, value: any) => void): void; } const invoke = (ipc: PreloadIpc, channel: string, ...args: unknown[]): Promise => ipc.invoke(channel, ...args) as Promise; -export const createDesktopBridge = (ipc: PreloadIpc): DesktopBridge => { +export const createDesktopBridge = ( + ipc: PreloadIpc, + platform: NodeJS.Platform = process.platform, +): DesktopBridge => { const deepLinkListeners = new Set<(url: string) => void>(); const pendingDeepLinks: string[] = []; ipc.on(IPC_CHANNELS.deepLink, (_event, value) => { @@ -45,19 +58,200 @@ export const createDesktopBridge = (ipc: PreloadIpc): DesktopBridge => { remove: (profileId) => invoke(ipc, IPC_CHANNELS.profilesRemove, profileId), setActive: (profileId) => invoke(ipc, IPC_CHANNELS.profilesSetActive, profileId), }, - credentials: { - read: (profileId) => invoke(ipc, IPC_CHANNELS.credentialsRead, profileId), - write: (profileId, value) => invoke(ipc, IPC_CHANNELS.credentialsWrite, profileId, value), - remove: (profileId) => invoke(ipc, IPC_CHANNELS.credentialsRemove, profileId), + authentication: { + pair: (profile) => invoke(ipc, IPC_CHANNELS.authenticationPair, profile), + cancel: (profileId) => invoke(ipc, IPC_CHANNELS.authenticationCancel, profileId), }, - lifecycle: { + connection: { + probe: (profile) => invoke(ipc, IPC_CHANNELS.connectionProbe, profile), + activate: (activationTicket) => invoke(ipc, IPC_CHANNELS.connectionActivate, activationTicket), + discard: (value) => invoke(ipc, IPC_CHANNELS.connectionDiscard, value), + invalidate: (value) => invoke(ipc, IPC_CHANNELS.connectionInvalidate, value), + }, + ...(platform === 'linux' ? { lifecycle: { status: () => invoke(ipc, IPC_CHANNELS.lifecycleStatus), start: () => invoke(ipc, IPC_CHANNELS.lifecycleStart), stop: () => invoke(ipc, IPC_CHANNELS.lifecycleStop), restart: () => invoke(ipc, IPC_CHANNELS.lifecycleRestart), - }, + } } : {}), }; Object.values(bridge).forEach(Object.freeze); return Object.freeze(bridge); }; + +const platformView = (platform: NodeJS.Platform): DesktopPlatformView => + platform === 'darwin' ? 'macos' : platform === 'win32' ? 'windows' : 'linux'; + +const isLoopback = (baseUrl: string): boolean => { + try { + const hostname = new URL(baseUrl).hostname.toLowerCase(); + return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'; + } catch { + return false; + } +}; + +const profileView = (profile: DesktopProfile): DesktopProfileView => ({ + id: profile.id, + name: profile.label, + baseUrl: profile.apiBaseUrl, + kind: isLoopback(profile.apiBaseUrl) ? 'local' : 'remote', + lastConnectedAt: profile.updatedAt, +}); + +const bounded = (value: string, maximum = 512): string => value.slice(0, maximum); + +/** Compatibility probe for confirmed local or remote profile origins. */ +export const probeDesktopProfile = async ( + profile: DesktopProfileView, + fetchImpl: typeof fetch = globalThis.fetch, +): Promise => { + const baseUrl = normalizeApiBaseUrl(profile.baseUrl); + if (!baseUrl || baseUrl !== profile.baseUrl) { + return { status: 'offline', message: 'This profile does not contain a valid ProPR instance origin.' }; + } + if (profile.kind === 'local' && !isLoopback(baseUrl)) { + return { status: 'offline', message: 'This local profile does not use a loopback address.' }; + } + try { + const response = await fetchImpl(`${baseUrl}/api/compatibility`, { + credentials: 'include', + cache: 'no-store', + signal: AbortSignal.timeout(8_000), + }); + if (response.status === 401 || response.status === 403) { + return { status: 'authentication-required', message: 'Sign in to continue to this instance.' }; + } + if (response.status === 404) return { status: 'ready' }; + if (!response.ok) return { status: 'offline', message: `The instance returned HTTP ${response.status}.` }; + const metadata = await response.json() as { apiCompatibility?: string; version?: string }; + const compatibility = evaluateProprApiCompatibility(metadata); + const version = compatibility.apiVersion ? bounded(compatibility.apiVersion, 64) : undefined; + if (compatibility.compatible || compatibility.reason === 'missing') { + return { status: 'ready', version }; + } + return { status: 'incompatible', message: bounded(compatibility.message), version }; + } catch { + return { status: 'offline', message: 'ProPR Desktop could not reach this instance. Check that it is running and try again.' }; + } +}; + +/** Build the shared renderer adapter without exposing raw IPC or credentials. */ +export const createDesktopRendererBridge = ( + ipc: PreloadIpc, + platform: NodeJS.Platform = process.platform, + connectionProbe?: (profile: DesktopProfileView) => Promise, + onDeepLink: DesktopBridge['app']['onDeepLink'] = () => () => undefined, +): DesktopRendererBridge => { + const platformName = platformView(platform); + const progressListeners = new Set<(snapshot: DesktopSetupSnapshot) => void>(); + if (platformName === 'linux') { + ipc.on(IPC_CHANNELS.setupProgress, (_event, snapshot: DesktopSetupSnapshot) => { + progressListeners.forEach(listener => listener(snapshot)); + }); + } + const remoteOnlySnapshot = (): DesktopSetupSnapshot => ({ + phase: 'unsupported', + capability: { + supported: false, + kind: 'remote-only', + platform, + reason: 'Local setup is available only on Linux. Connect to a remote ProPR instance.', + }, + sessionId: '00000000-0000-4000-8000-000000000000', + logs: [], + }); + const localSetupUnavailable = async (): Promise => { + throw new Error('Local setup is unavailable on this platform. Connect to a remote ProPR instance.'); + }; + + const bridge: DesktopRendererBridge = { + isDesktop: true, + platform: platformName, + app: { onDeepLink: listener => onDeepLink(listener) }, + profiles: { + list: async () => { + const result = await invoke<{ profiles: DesktopProfile[] }>(ipc, IPC_CHANNELS.profilesList); + return result.profiles.map(profileView); + }, + save: async (profile) => { + await invoke(ipc, IPC_CHANNELS.profilesSave, { + id: profile.id, + label: profile.name, + apiBaseUrl: profile.baseUrl, + }); + }, + remove: (profileId) => invoke(ipc, IPC_CHANNELS.profilesRemove, profileId), + getActiveId: async () => (await invoke<{ activeProfileId: string | null }>(ipc, IPC_CHANNELS.profilesList)).activeProfileId, + setActiveId: (profileId) => invoke(ipc, IPC_CHANNELS.profilesSetActive, profileId), + }, + discovery: { discover: () => invoke(ipc, IPC_CHANNELS.discovery) }, + authentication: { + authenticate: async profile => { + const apiBaseUrl = normalizeApiBaseUrl(profile.baseUrl); + if (profile.kind !== 'remote' || !apiBaseUrl || apiBaseUrl !== profile.baseUrl) { + throw new Error('Remote sign-in requires a canonical remote profile.'); + } + await invoke(ipc, IPC_CHANNELS.authenticationPair, { + id: profile.id, + label: profile.name, + apiBaseUrl, + }); + }, + cancel: profileId => invoke(ipc, IPC_CHANNELS.authenticationCancel, profileId), + }, + externalBrowser: { open: (url) => invoke(ipc, IPC_CHANNELS.openExternal, url) }, + localSetup: platformName === 'linux' ? { + status: () => invoke(ipc, IPC_CHANNELS.setupStatus), + start: (request) => invoke(ipc, IPC_CHANNELS.setupStart, request), + retry: (request) => invoke(ipc, IPC_CHANNELS.setupRetry, request), + cancel: () => invoke(ipc, IPC_CHANNELS.setupCancel), + selectPrivateKey: () => invoke(ipc, IPC_CHANNELS.setupSelectPrivateKey), + acquireWebhookSecret: () => invoke(ipc, IPC_CHANNELS.setupAcquireWebhookSecret), + onProgress: (listener) => { + progressListeners.add(listener); + return () => progressListeners.delete(listener); + }, + } : { + status: async () => remoteOnlySnapshot(), + start: localSetupUnavailable, + retry: localSetupUnavailable, + cancel: localSetupUnavailable, + selectPrivateKey: localSetupUnavailable, + acquireWebhookSecret: localSetupUnavailable, + onProgress: () => () => undefined, + }, + connection: { + probe: async profile => { + if (connectionProbe) return connectionProbe(profile); + const input = { id: profile.id, label: profile.name, apiBaseUrl: profile.baseUrl }; + if (profile.kind !== 'local') return invoke(ipc, IPC_CHANNELS.connectionProbe, input); + const prepared = await invoke<{ localActivationTicket: string }>( + ipc, + IPC_CHANNELS.connectionPrepareLocal, + input, + ); + const result = await probeDesktopProfile(profile); + return result.status === 'ready' + ? { ...result, localActivationTicket: prepared.localActivationTicket } + : result; + }, + activateLocal: localActivationTicket => invoke( + ipc, + IPC_CHANNELS.connectionActivateLocal, + localActivationTicket, + ), + discardLocal: localActivationTicket => invoke( + ipc, + IPC_CHANNELS.connectionDiscardLocal, + localActivationTicket, + ), + activate: activationTicket => invoke(ipc, IPC_CHANNELS.connectionActivate, activationTicket), + discard: value => invoke(ipc, IPC_CHANNELS.connectionDiscard, value), + invalidate: value => invoke(ipc, IPC_CHANNELS.connectionInvalidate, value), + }, + }; + Object.values(bridge).filter(value => typeof value === 'object').forEach(Object.freeze); + return Object.freeze(bridge); +}; diff --git a/apps/desktop/src/preload.ts b/apps/desktop/src/preload.ts index ba4f4d45b..60afc251d 100644 --- a/apps/desktop/src/preload.ts +++ b/apps/desktop/src/preload.ts @@ -1,4 +1,9 @@ import { contextBridge, ipcRenderer } from 'electron'; -import { createDesktopBridge } from './preload-bridge'; +import { createDesktopBridge, createDesktopRendererBridge } from './preload-bridge'; -contextBridge.exposeInMainWorld('proprDesktop', createDesktopBridge(ipcRenderer)); +const desktopBridge = createDesktopBridge(ipcRenderer); +contextBridge.exposeInMainWorld('proprDesktop', desktopBridge); +contextBridge.exposeInMainWorld( + '__PROPR_DESKTOP__', + createDesktopRendererBridge(ipcRenderer, process.platform, undefined, desktopBridge.app.onDeepLink), +); diff --git a/apps/desktop/src/profile-store-crash-fixture.ts b/apps/desktop/src/profile-store-crash-fixture.ts new file mode 100644 index 000000000..cd2b88520 --- /dev/null +++ b/apps/desktop/src/profile-store-crash-fixture.ts @@ -0,0 +1,93 @@ +import { readFile, unlink, writeFile } from 'node:fs/promises'; +import { join } from 'node:path'; +import { ProfileStore, type EncryptionProvider, type ProfileStoreDurabilityStep } from './profile-store'; + +const [directory, requestedStep] = process.argv.slice(2) as [string, string]; +const crashStep = requestedStep.split(':').at(-1) as ProfileStoreDurabilityStep; +const encryption: EncryptionProvider = { + isEncryptionAvailable: () => true, + backend: () => 'keychain', + encrypt: value => Buffer.from(Buffer.from(value, 'utf8').toString('base64url'), 'utf8'), + decrypt: value => Buffer.from(value.toString(), 'base64url').toString('utf8'), +}; +const store = new ProfileStore(directory, encryption, { + afterDurabilityStep: step => { + if (!requestedStep.startsWith('visibility:') && step === crashStep) process.kill(process.pid, 'SIGKILL'); + }, +}); +if (requestedStep.startsWith('recovery:')) { + await store.list(); + throw new Error(`Recovery fixture did not reach ${crashStep}`); +} +const desktop = join(directory, 'desktop'); +const stateA = requestedStep.startsWith('visibility:') + ? await readFile(join(desktop, 'profiles.json')) + : null; +const journalsA = requestedStep.startsWith('visibility:') + ? await Promise.all([0, 1].map(async index => { + try { return await readFile(join(desktop, `profiles.journal.${index}`)); } catch { return null; } + })) + : []; +const baseline = await store.readProfileCredential('profile-1'); +if (requestedStep.startsWith('detach:')) { + await store.detachProfile('profile-1'); + throw new Error(`Detach fixture did not reach ${crashStep}`); +} +await store.commitPairedProfile( + { id: 'profile-1', label: 'Replacement', apiBaseUrl: 'https://propr.example.com' }, + { + version: 1, + profileId: 'profile-1', + origin: 'https://propr.example.com', + token: `propr_it_${'B'.repeat(43)}`, + }, + baseline, + () => true, +); +if (requestedStep.startsWith('visibility:')) { + const mode = requestedStep.slice('visibility:'.length); + const stateB = JSON.parse(await readFile(join(desktop, 'profiles.json'), 'utf8')) as { + credentialSlots: Record; + }; + if (mode === 'pointer-rollback' && stateA) { + await writeFile(join(desktop, 'profiles.json'), stateA); + } else if (mode === 'pointer-corruption' || mode === 'mirror-malformed') { + await writeFile(join(desktop, 'profiles.json'), '{corrupt'); + } else if (mode === 'mirror-missing') { + await unlink(join(desktop, 'profiles.json')); + } else if (mode === 'mirror-truncated') { + await writeFile(join(desktop, 'profiles.json'), '{"version":3'); + } else if (mode === 'mirror-stale' && stateA) { + await writeFile(join(desktop, 'profiles.json'), stateA); + } else if (mode === 'mirror-schema-invalid') { + const contents = JSON.parse(await readFile(join(desktop, 'profiles.json'), 'utf8')) as Record; + await writeFile(join(desktop, 'profiles.json'), JSON.stringify({ + ...contents, version: 99, + })); + } else if (mode === 'mirror-attacker') { + const contents = JSON.parse(await readFile(join(desktop, 'profiles.json'), 'utf8')) as Record; + const profiles = contents.profiles as Array>; + await writeFile(join(desktop, 'profiles.json'), JSON.stringify({ + ...contents, profiles: profiles.map(profile => ({ ...profile, label: 'Attacker' })), + })); + } else if (mode === 'missing-target') { + await unlink(join(desktop, 'credentials', stateB.credentialSlots['profile-1'])); + } else if (mode === 'state-before-journal') { + for (const [index, bytes] of journalsA.entries()) { + const path = join(desktop, `profiles.journal.${index}`); + if (bytes) await writeFile(path, bytes); + else await unlink(path).catch(() => undefined); + } + } else if (mode === 'alternate-slot-rollback') { + const state = JSON.parse(await readFile(join(desktop, 'profiles.json'), 'utf8')) as { generation: string }; + const newest = Number(BigInt(state.generation) % 2n); + const older = (newest + 1) % 2; + await writeFile( + join(desktop, `profiles.journal.${newest}`), + await readFile(join(desktop, `profiles.journal.${older}`)), + ); + } else { + throw new Error(`Unknown visibility mode: ${mode}`); + } + process.kill(process.pid, 'SIGKILL'); +} diff --git a/apps/desktop/src/profile-store.test.ts b/apps/desktop/src/profile-store.test.ts index c4807df05..6cd64b108 100644 --- a/apps/desktop/src/profile-store.test.ts +++ b/apps/desktop/src/profile-store.test.ts @@ -1,11 +1,33 @@ import assert from 'node:assert/strict'; -import { mkdtemp, readFile, rm } from 'node:fs/promises'; +import { spawn } from 'node:child_process'; +import { createHash } from 'node:crypto'; +import { mkdir, mkdtemp, readFile, readdir, rename, rm, unlink, writeFile } from 'node:fs/promises'; import { tmpdir } from 'node:os'; import { join } from 'node:path'; import { afterEach, describe, it } from 'node:test'; -import { ProfileStore, type EncryptionProvider } from './profile-store'; +import { PROPR_API_ORIGIN_PARITY_CASES } from '@propr/shared'; +import { + flushFileData, + ProfileStore, + type EncryptionProvider, + type ProfileStoreDurabilityStep, + type ProfileStoreIOOperation, +} from './profile-store'; const temporaryDirectories: string[] = []; +const NATIVE_VISIBILITY_SCENARIOS = [ + 'pointer-rollback', 'pointer-corruption', 'missing-target', 'state-before-journal', + 'mirror-missing', 'mirror-truncated', 'mirror-malformed', 'mirror-stale', + 'mirror-schema-invalid', 'mirror-attacker', 'alternate-slot-rollback', +] as const; +const RECOVERY_KILL_STEPS: ProfileStoreDurabilityStep[] = [ + 'state-written', 'state-fsynced', + 'journal-written', 'journal-fsynced', 'journal-closed', 'journal-reopened', + 'journal-prepared-verified', 'journal-committed', 'journal-commit-fsynced', + 'journal-commit-verified', 'journal-commit-closed', 'state-renamed', + ...(process.platform === 'win32' ? [] : ['state-directory-fsynced'] as const), +]; +const RECOVERY_KILL_MODES = ['bootstrap', 'migration-v1', 'migration-v2'] as const; const createDirectory = async (): Promise => { const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-test-')); @@ -20,15 +42,74 @@ const encryption = (available = true, backend = 'keychain'): EncryptionProvider decrypt: value => Buffer.from(value.toString(), 'base64url').toString('utf8'), }); +const credential = (profileId: string, tokenCharacter = 'A') => ({ + version: 1 as const, + profileId, + origin: 'https://propr.example.com', + token: `propr_it_${tokenCharacter.repeat(43)}`, +}); + +const bounded = (promise: Promise, milliseconds = 1_000): Promise => { + let timer: ReturnType | undefined; + const timeout = new Promise((_resolve, reject) => { + timer = setTimeout(() => reject(new Error('Profile store operation did not settle')), milliseconds); + }); + return Promise.race([promise, timeout]).finally(() => { + if (timer) clearTimeout(timer); + }); +}; + +const legacyProfile = { + id: 'profile-1', label: 'Legacy', apiBaseUrl: 'https://propr.example.com', + createdAt: '2026-08-29T00:00:00.000Z', updatedAt: '2026-08-29T00:00:00.000Z', +}; + +const seedRecoveryMode = async ( + directory: string, + mode: (typeof RECOVERY_KILL_MODES)[number], +): Promise => { + if (mode === 'bootstrap') return; + const desktop = join(directory, 'desktop'); + const credentials = join(desktop, 'credentials'); + await mkdir(credentials, { recursive: true }); + if (mode === 'migration-v1') { + await writeFile(join(desktop, 'profiles.json'), JSON.stringify({ + version: 1, activeProfileId: legacyProfile.id, profiles: [legacyProfile], + })); + await writeFile( + join(credentials, `${legacyProfile.id}.bin`), + encryption().encrypt(JSON.stringify(credential(legacyProfile.id))), + ); + return; + } + const slot = `${legacyProfile.id}.00000000-0000-4000-8000-000000000001.bin`; + await writeFile(join(credentials, slot), encryption().encrypt(JSON.stringify(credential(legacyProfile.id)))); + await writeFile(join(desktop, 'profiles.json'), JSON.stringify({ + version: 2, + activeProfileId: legacyProfile.id, + profiles: [legacyProfile], + credentialSlots: { [legacyProfile.id]: slot }, + })); +}; + afterEach(async () => { await Promise.all(temporaryDirectories.splice(0).map(directory => rm(directory, { recursive: true, force: true }))); }); describe('desktop profile store', () => { + it('matches the shared canonical origin parity table at the persistence boundary', async () => { + const store = new ProfileStore(await createDirectory(), encryption()); + let index = 0; + for (const [name, input, expected] of PROPR_API_ORIGIN_PARITY_CASES) { + const save = store.save({ id: `parity-${index++}`, label: name, apiBaseUrl: input }); + if (expected === null) await assert.rejects(save, /HTTPS|URL/, name); + else assert.equal((await save).apiBaseUrl, expected, name); + } + }); it('persists validated profiles and active selection', async () => { const directory = await createDirectory(); const store = new ProfileStore(directory, encryption()); - const profile = await store.save({ label: ' Local ', apiBaseUrl: 'http://localhost:4000///' }); + const profile = await store.save({ label: ' Local ', apiBaseUrl: 'http://localhost:4000/' }); const ipv6Profile = await store.save({ label: 'IPv6', apiBaseUrl: 'http://[::1]:4000/' }); await store.setActive(profile.id); assert.deepEqual(await store.list(), { profiles: [profile, ipv6Profile], activeProfileId: profile.id }); @@ -39,39 +120,211 @@ describe('desktop profile store', () => { it('encrypts credentials before writing app-owned storage', async () => { const directory = await createDirectory(); + const barrierProof = join(directory, 'writable-file-barrier-proof'); + const barrierBytes = Buffer.from('native writable fsync proof'); + await writeFile(barrierProof, barrierBytes); + await flushFileData(barrierProof); + assert.deepEqual(await readFile(barrierProof), barrierBytes); + const store = new ProfileStore(directory, encryption()); const profile = await store.save({ label: 'Secure', apiBaseUrl: 'https://propr.example.com' }); - assert.deepEqual(await store.writeCredential(profile.id, 'top-secret'), { stored: true }); - assert.deepEqual(await store.readCredential(profile.id), { available: true, value: 'top-secret' }); - const onDisk = await readFile(join(directory, 'desktop', 'credentials', `${profile.id}.bin`), 'utf8'); - assert.equal(onDisk, Buffer.from('top-secret', 'utf8').toString('base64url')); - assert.equal(onDisk.includes('top-secret'), false); - assert.notEqual(onDisk, 'top-secret'); + const storedCredential = credential(profile.id); + assert.deepEqual(await store.writeCredential(storedCredential), { stored: true }); + assert.deepEqual(await store.readCredential(profile.id), storedCredential); + const files = await readdir(join(directory, 'desktop', 'credentials')); + assert.equal(files.length, 1); + const onDisk = await readFile(join(directory, 'desktop', 'credentials', files[0]), 'utf8'); + assert.equal(onDisk.includes(storedCredential.token), false); + }); + + it('atomically refuses activation when the credential origin differs from the profile origin', async () => { + const store = new ProfileStore(await createDirectory(), encryption()); + const profile = await store.save({ + id: 'profile-b', label: 'B', apiBaseUrl: 'https://b.example.test', + }); + const staleCredential = { + ...credential(profile.id), + origin: 'https://a.example.test', + }; + await store.writeCredential(staleCredential); + + const activated = await store.activateProfile( + staleCredential, + (await store.readProfileCredential(profile.id)).identityEpoch!, + profile.apiBaseUrl, + null, + () => true, + ); + + assert.equal(activated, null); + assert.equal((await store.list()).activeProfileId, null); + assert.deepEqual(await store.readCredential(profile.id), staleCredential); }); it('serializes concurrent credential writes with last-write semantics', async () => { const store = new ProfileStore(await createDirectory(), encryption()); - const first = store.writeCredential('profile-1', 'first'); - const second = store.writeCredential('profile-1', 'second'); + const first = store.writeCredential(credential('profile-1', 'A')); + const secondCredential = credential('profile-1', 'B'); + const second = store.writeCredential(secondCredential); assert.deepEqual(await Promise.all([first, second]), [{ stored: true }, { stored: true }]); - assert.deepEqual(await store.readCredential('profile-1'), { available: true, value: 'second' }); + assert.deepEqual(await store.readCredential('profile-1'), secondCredential); }); it('orders concurrent credential writes and removals by invocation', async () => { const store = new ProfileStore(await createDirectory(), encryption()); await Promise.all([ - store.writeCredential('profile-1', 'remove-me'), + store.writeCredential(credential('profile-1')), store.removeCredential('profile-1'), ]); - assert.deepEqual(await store.readCredential('profile-1'), { available: true, value: null }); + assert.equal(await store.readCredential('profile-1'), null); await Promise.all([ store.removeCredential('profile-1'), - store.writeCredential('profile-1', 'keep-me'), + store.writeCredential(credential('profile-1', 'B')), + ]); + assert.deepEqual(await store.readCredential('profile-1'), credential('profile-1', 'B')); + }); + + it('serializes concurrent paired replacements without mixing profile and credential generations', async () => { + const store = new ProfileStore(await createDirectory(), encryption()); + const profile = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + await store.writeCredential(credential(profile.id, 'A')); + const baseline = await store.readProfileCredential(profile.id); + const [first, second] = await Promise.all([ + store.commitPairedProfile( + { id: profile.id, label: 'Replacement B', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'B'), baseline, () => true, + ), + store.commitPairedProfile( + { id: profile.id, label: 'Replacement C', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'C'), baseline, () => true, + ), ]); - assert.deepEqual(await store.readCredential('profile-1'), { available: true, value: 'keep-me' }); + assert.equal(first && !('stored' in first) ? first.profile.label : null, 'Replacement B'); + assert.equal(second, null); + assert.equal((await store.list()).profiles[0].label, 'Replacement B'); + assert.deepEqual(await store.readCredential(profile.id), credential(profile.id, 'B')); + }); + + it('commits encrypted pending revocation material atomically with B and unlinks A only after durable completion', async () => { + const directory = await createDirectory(); + const store = new ProfileStore(directory, encryption()); + const profile = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + const credentialA = credential(profile.id, 'A'); + await store.writeCredential(credentialA); + const baseline = await store.readProfileCredential(profile.id); + + const committed = await store.commitPairedProfile( + { id: profile.id, label: 'Replacement', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'B'), baseline, () => true, + ); + assert.ok(committed && !('stored' in committed)); + if (!committed || 'stored' in committed) return; + assert.notEqual(committed.identityEpoch, baseline.identityEpoch); + + const pending = await store.pendingRevocations(); + assert.equal(pending.length, 1); + assert.deepEqual(pending[0].credential, credentialA); + assert.equal(pending[0].credentialGeneration, baseline.identityEpoch); + assert.notEqual(pending[0].credentialGeneration, committed.identityEpoch); + assert.deepEqual(await store.readCredential(profile.id), credential(profile.id, 'B')); + const desktop = join(directory, 'desktop'); + for (const file of await readdir(desktop)) { + if (!file.startsWith('profiles.')) continue; + const contents = await readFile(join(desktop, file), 'utf8'); + assert.equal(contents.includes(credentialA.token), false); + assert.equal(contents.includes(credential(profile.id, 'B').token), false); + } + assert.equal((await readdir(join(desktop, 'credentials'))).length, 2); + + assert.equal(await store.completePendingRevocation( + pending[0].id, credentialA, pending[0].credentialGeneration, + ), true); + assert.deepEqual(await store.readCredential(profile.id), credential(profile.id, 'B')); + assert.deepEqual(await store.pendingRevocations(), []); + assert.equal((await readdir(join(desktop, 'credentials'))).length, 1); + }); + + it('migrates legacy fixed credentials through the atomic state pointer and removes the old slot', async () => { + const directory = await createDirectory(); + const desktop = join(directory, 'desktop'); + const credentials = join(desktop, 'credentials'); + await mkdir(credentials, { recursive: true }); + const profile = { + id: 'profile-1', label: 'Legacy', apiBaseUrl: 'https://propr.example.com', + createdAt: '2026-08-29T00:00:00.000Z', updatedAt: '2026-08-29T00:00:00.000Z', + }; + await writeFile(join(desktop, 'profiles.json'), JSON.stringify({ + version: 1, activeProfileId: profile.id, profiles: [profile], + })); + const legacyCredential = credential(profile.id, 'A'); + await writeFile(join(credentials, `${profile.id}.bin`), encryption().encrypt(JSON.stringify(legacyCredential))); + + const store = new ProfileStore(directory, encryption()); + const migrated = await store.readProfileCredential(profile.id); + assert.deepEqual({ ...migrated, identityEpoch: undefined }, { + profile, credential: legacyCredential, identityEpoch: undefined, activeProfileId: profile.id, + }); + assert.match(migrated.identityEpoch ?? '', /^[A-Za-z0-9_-]{22}$/); + const state = JSON.parse(await readFile(join(desktop, 'profiles.json'), 'utf8')) as { + version: number; credentialSlots: Record; + }; + assert.equal(state.version, 3); + assert.match(state.credentialSlots[profile.id], /^profile-1\.[0-9a-f-]{36}\.bin$/); + assert.deepEqual(await readdir(credentials), [state.credentialSlots[profile.id]]); + }); + + it('migrates the exact-head numeric unsealed journal only when its valid mirror matches exactly', async () => { + const directory = await createDirectory(); + const desktop = join(directory, 'desktop'); + await mkdir(join(desktop, 'credentials'), { recursive: true }); + const profile = { + id: 'profile-1', label: 'Legacy journal', apiBaseUrl: 'https://propr.example.com', + createdAt: '2026-08-29T00:00:00.000Z', updatedAt: '2026-08-29T00:00:00.000Z', + }; + const state = { + version: 3, generation: 7, activeProfileId: null, profiles: [profile], + credentialSlots: {}, credentialEpochs: {}, pendingRevocations: {}, + }; + const payload = { version: 1, state, encryptedSlots: {} }; + const checksum = createHash('sha256').update(JSON.stringify(payload)).digest('base64url'); + await writeFile(join(desktop, 'profiles.json'), JSON.stringify(state)); + await writeFile(join(desktop, 'profiles.journal.1'), JSON.stringify({ ...payload, checksum })); + + const restarted = new ProfileStore(directory, encryption()); + assert.deepEqual(await restarted.list(), { profiles: [profile], activeProfileId: null }); + const migrated = await readFile(join(desktop, 'profiles.journal.0'), 'utf8'); + assert.equal(migrated.startsWith('C{"version":2'), true); + assert.equal(migrated.includes(profile.label), false); + }); + + it('settles conditional credential removal and profile removal in the former lock-order interleaving', async () => { + const store = new ProfileStore(await createDirectory(), encryption()); + const profile = await store.save({ + id: 'profile-1', label: 'Remote', apiBaseUrl: 'https://propr.example.com', + }); + const storedCredential = credential(profile.id); + await store.writeCredential(storedCredential); + + // Both calls are deliberately made in one turn. Previously the conditional + // removal could own the state queue while remove() owned the credential + // queue and awaited the state operation queued behind it. + const conditional = store.removeCredentialIfCurrent( + storedCredential, + profile.apiBaseUrl, + () => true, + ); + const removal = store.remove(profile.id); + + assert.deepEqual(await bounded(Promise.all([conditional, removal])), [true, undefined]); + assert.deepEqual(await store.list(), { profiles: [], activeProfileId: null }); + assert.equal(await store.readCredential(profile.id), null); }); it('refuses plaintext fallback when encryption is unavailable or basic_text', async () => { @@ -79,14 +332,83 @@ describe('desktop profile store', () => { const directory = await createDirectory(); const store = new ProfileStore(directory, provider); assert.equal(store.security().available, false); - assert.deepEqual(await store.writeCredential('profile-1', 'secret'), { + assert.deepEqual(await store.writeCredential(credential('profile-1')), { + stored: false, + reason: 'encryption-unavailable', + }); + assert.equal(await store.readCredential('profile-1'), null); + } + }); + + it('keeps metadata usable without an OS secret backend while every secret write fails closed', async () => { + for (const backend of ['unavailable', 'basic_text']) { + const directory = await createDirectory(); + const secret = credential('profile-1'); + let encryptionCalls = 0; + const provider: EncryptionProvider = { + isEncryptionAvailable: () => backend === 'basic_text', + backend: () => backend, + encrypt: () => { encryptionCalls += 1; throw new Error('must not encrypt through an unavailable backend'); }, + decrypt: () => { encryptionCalls += 1; throw new Error('must not decrypt through an unavailable backend'); }, + }; + const store = new ProfileStore(directory, provider); + + assert.deepEqual(await store.list(), { profiles: [], activeProfileId: null }); + const profile = await store.save({ + id: secret.profileId, + label: 'Headless local profile', + apiBaseUrl: 'http://127.0.0.1:4000', + }); + await store.setActive(profile.id); + assert.deepEqual(await store.list(), { profiles: [profile], activeProfileId: profile.id }); + assert.deepEqual(await store.writeCredential(secret), { stored: false, reason: 'encryption-unavailable', }); - assert.deepEqual(await store.readCredential('profile-1'), { available: false, value: null }); + assert.deepEqual(await store.journalPendingRevocation(secret), { + stored: false, + reason: 'encryption-unavailable', + }); + assert.equal(await store.readCredential(profile.id), null); + assert.equal(encryptionCalls, 0); + + const desktop = join(directory, 'desktop'); + const names = await readdir(desktop); + assert.equal(names.some(name => name.startsWith('profiles.journal.')), false); + assert.doesNotMatch(await readFile(join(desktop, 'profiles.json'), 'utf8'), /propr_it_|basic_text/); } }); + it('lists non-sensitive metadata without decrypting existing credential material', async () => { + const directory = await createDirectory(); + const setup = new ProfileStore(directory, encryption()); + const profile = await setup.save({ + id: 'profile-1', label: 'Remote metadata', apiBaseUrl: 'https://propr.example.com', + }); + await setup.writeCredential(credential(profile.id)); + await setup.close(); + let secretBackendCalls = 0; + const unavailable: EncryptionProvider = { + isEncryptionAvailable: () => false, + backend: () => 'unavailable', + encrypt: () => { secretBackendCalls += 1; throw new Error('unavailable'); }, + decrypt: () => { secretBackendCalls += 1; throw new Error('unavailable'); }, + }; + const headless = new ProfileStore(directory, unavailable); + + assert.deepEqual(await headless.list(), { profiles: [profile], activeProfileId: null }); + assert.equal(secretBackendCalls, 0); + assert.deepEqual(await headless.writeCredential(credential(profile.id, 'B')), { + stored: false, + reason: 'encryption-unavailable', + }); + await assert.rejects( + headless.save({ id: profile.id, label: 'Changed', apiBaseUrl: profile.apiBaseUrl }), + /recovery state is unavailable/, + ); + assert.equal(secretBackendCalls, 0); + }); + it('rejects unsafe endpoints and path-like profile identifiers', async () => { const directory = await createDirectory(); const store = new ProfileStore(directory, encryption()); @@ -101,6 +423,692 @@ describe('desktop profile store', () => { ); assert.deepEqual((await store.list()).profiles, [profile]); assert.doesNotMatch(await readFile(join(directory, 'desktop', 'profiles.json'), 'utf8'), /\/base/); - await assert.rejects(store.writeCredential('../escape', 'secret'), /Invalid desktop profile id/); + await assert.rejects(store.writeCredential(credential('../escape')), /Invalid desktop profile id/); }); + + for (const failure of ['corrupt-json', 'decrypt'] as const) { + it(`removes an active profile despite a ${failure} credential failure`, async () => { + const directory = await createDirectory(); + let rejectCredential = false; + const provider: EncryptionProvider = { + ...encryption(), + decrypt: value => { + const plaintext = Buffer.from(value.toString(), 'base64url').toString('utf8'); + if (rejectCredential && plaintext.includes('"token":"propr_it_')) { + if (failure === 'decrypt') throw new Error('keychain decrypt failed'); + return '{not-json'; + } + return plaintext; + }, + }; + const store = new ProfileStore(directory, provider); + const profile = await store.save({ id: 'profile-1', label: 'Remote', apiBaseUrl: 'https://propr.example.com' }); + await store.writeCredential(credential(profile.id)); + await store.setActive(profile.id); + rejectCredential = true; + + const detached = await store.detachProfile(profile.id); + + assert.equal(detached?.profile.id, profile.id); + assert.equal(detached?.credential, null); + assert.deepEqual(await store.list(), { profiles: [], activeProfileId: null }); + assert.equal(await store.readCredential(profile.id), null); + }); + } + + it('preserves the complete profile and credential when state publication fails before commit', async () => { + const directory = await createDirectory(); + let failStateFsync = false; + const store = new ProfileStore(directory, encryption(), { + afterDurabilityStep: step => { + if (failStateFsync && step === 'state-fsynced') throw new Error('injected state fsync failure'); + }, + }); + const profile = await store.save({ id: 'profile-1', label: 'Remote', apiBaseUrl: 'https://propr.example.com' }); + const storedCredential = credential(profile.id); + await store.writeCredential(storedCredential); + await store.setActive(profile.id); + failStateFsync = true; + + await assert.rejects(store.detachProfile(profile.id), /injected state fsync failure/); + failStateFsync = false; + assert.deepEqual(await store.list(), { profiles: [profile], activeProfileId: profile.id }); + assert.deepEqual(await store.readCredential(profile.id), storedCredential); + }); + + it('preserves the complete profile and credential when precommit origin cleanup fails', async () => { + const directory = await createDirectory(); + const store = new ProfileStore(directory, encryption()); + const profile = await store.save({ id: 'profile-1', label: 'Remote', apiBaseUrl: 'https://propr.example.com' }); + const storedCredential = credential(profile.id); + await store.writeCredential(storedCredential); + await store.setActive(profile.id); + + await assert.rejects( + store.detachProfile(profile.id, async origin => { + assert.equal(origin, profile.apiBaseUrl); + throw new Error('origin storage clear failed'); + }), + /origin storage clear failed/, + ); + + assert.deepEqual(await store.list(), { profiles: [profile], activeProfileId: profile.id }); + assert.deepEqual(await store.readCredential(profile.id), storedCredential); + + const observed: string[][] = []; + await assert.rejects(store.saveAndDetachCredential({ + id: profile.id, label: 'Edited', apiBaseUrl: 'https://edited.example.com', + }, async (previousOrigin, nextOrigin) => { + observed.push([previousOrigin, nextOrigin]); + throw new Error('origin edit storage clear failed'); + }), /origin edit storage clear failed/); + assert.deepEqual(observed, [[profile.apiBaseUrl, 'https://edited.example.com']]); + assert.deepEqual(await store.list(), { profiles: [profile], activeProfileId: profile.id }); + assert.deepEqual(await store.readCredential(profile.id), storedCredential); + assert.deepEqual(await store.pendingRevocations(), []); + }); + + it('keeps A authoritative across every injected pre-commit paired replacement failure', async () => { + const directory = await createDirectory(); + let failure: string | null = null; + const store = new ProfileStore(directory, encryption(), { + afterDurabilityStep: step => { + if (step === failure) throw new Error(`injected ${step}`); + }, + }); + const profile = await store.save({ id: 'profile-1', label: 'Remote', apiBaseUrl: 'https://propr.example.com' }); + const credentialA = credential(profile.id, 'A'); + await store.writeCredential(credentialA); + await store.setActive(profile.id); + const baseline = await store.readProfileCredential(profile.id); + for (const step of [ + 'credential-encrypted', 'credential-written', 'credential-fsynced', + 'credential-renamed', + ...(process.platform === 'win32' ? [] : ['credential-directory-fsynced'] as const), + 'state-written', 'state-fsynced', + 'journal-written', 'journal-fsynced', 'journal-closed', 'journal-reopened', + 'journal-prepared-verified', + ]) { + failure = step; + await assert.rejects(store.commitPairedProfile( + { id: profile.id, label: 'Replacement', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'B'), baseline, () => true, + ), /injected/); + failure = null; + const restarted = new ProfileStore(directory, encryption()); + assert.deepEqual(await restarted.readCredential(profile.id), credentialA, step); + assert.deepEqual(await restarted.list(), { profiles: [profile], activeProfileId: profile.id }, step); + } + }); + + it('fails closed before C and preserves fully verified B when the C flush fails', async () => { + const failures: ProfileStoreIOOperation[] = [ + 'credential-write', 'credential-flush', 'credential-replace', + 'mirror-write', 'mirror-flush', 'metadata-flush', + 'journal-write', 'journal-flush', 'journal-reopen', 'journal-verify', 'journal-commit', + ]; + let completedFailures = 0; + for (const operation of failures) { + const directory = await createDirectory(); + let injected: ProfileStoreIOOperation | null = null; + let published = false; + const store = new ProfileStore(directory, encryption(), { + beforeIO: current => { + if (current === injected) throw new Error(`injected ${current} failure`); + }, + }); + const profile = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + const credentialA = credential(profile.id, 'A'); + await store.writeCredential(credentialA); + await store.setActive(profile.id); + const baseline = await store.readProfileCredential(profile.id); + injected = operation; + await assert.rejects(store.commitPairedProfile( + { id: profile.id, label: 'Replacement', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'B'), baseline, () => true, undefined, () => { published = true; }, + ), /injected/); + injected = null; + assert.equal(published, false, operation); + const restarted = new ProfileStore(directory, encryption()); + assert.equal((await restarted.list()).profiles[0].label, 'Original', operation); + assert.deepEqual(await restarted.readCredential(profile.id), credentialA, operation); + assert.deepEqual(await restarted.pendingRevocations(), [], operation); + completedFailures += 1; + } + + const directory = await createDirectory(); + let injected: ProfileStoreIOOperation | null = null; + let published = false; + const store = new ProfileStore(directory, encryption(), { + beforeIO: current => { + if (current === injected) throw new Error(`injected ${current} failure`); + }, + }); + const profile = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + await store.writeCredential(credential(profile.id, 'A')); + const baseline = await store.readProfileCredential(profile.id); + injected = 'journal-commit-flush'; + await assert.rejects(store.commitPairedProfile( + { id: profile.id, label: 'Replacement', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'B'), baseline, () => true, undefined, () => { published = true; }, + ), /injected journal-commit-flush/); + injected = null; + assert.equal(published, true); + const restarted = new ProfileStore(directory, encryption()); + assert.equal((await restarted.list()).profiles[0].label, 'Replacement'); + assert.deepEqual(await restarted.readCredential(profile.id), credential(profile.id, 'B')); + assert.equal((await restarted.pendingRevocations()).length, 1); + completedFailures += 1; + + const corruptDirectory = await createDirectory(); + const corruptDesktop = join(corruptDirectory, 'desktop'); + let corruptPrepared = false; + const corruptingStore = new ProfileStore(corruptDirectory, encryption(), { + afterDurabilityStep: async step => { + if (!corruptPrepared || step !== 'journal-closed') return; + corruptPrepared = false; + for (const name of ['profiles.journal.0', 'profiles.journal.1']) { + const path = join(corruptDesktop, name); + try { + const bytes = await readFile(path); + if (bytes[0] !== 'P'.charCodeAt(0)) continue; + bytes[Math.min(20, bytes.length - 1)] ^= 1; + await writeFile(path, bytes); + return; + } catch (error) { + if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; + } + } + throw new Error('prepared journal was not found'); + }, + }); + const corruptProfile = await corruptingStore.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + const corruptA = credential(corruptProfile.id, 'A'); + await corruptingStore.writeCredential(corruptA); + const corruptBaseline = await corruptingStore.readProfileCredential(corruptProfile.id); + corruptPrepared = true; + await assert.rejects(corruptingStore.commitPairedProfile( + { id: corruptProfile.id, label: 'Replacement', apiBaseUrl: corruptProfile.apiBaseUrl }, + credential(corruptProfile.id, 'B'), corruptBaseline, () => true, + ), /Desktop profile recovery state is unavailable/); + const corruptRestart = new ProfileStore(corruptDirectory, encryption()); + assert.equal((await corruptRestart.list()).profiles[0].label, 'Original'); + assert.deepEqual(await corruptRestart.readCredential(corruptProfile.id), corruptA); + completedFailures += 1; + console.log(`NATIVE_CATEGORY barriers expected=${failures.length + 2} executed=${completedFailures}`); + }); + + it('treats mirror replace and directory-flush failures after the journal commit as recoverable mirror failures', async () => { + for (const operation of ['mirror-replace', 'metadata-flush'] as const) { + const directory = await createDirectory(); + let injected: ProfileStoreIOOperation | null = null; + let journalCommitted = false; + const store = new ProfileStore(directory, encryption(), { + afterDurabilityStep: step => { if (step === 'journal-commit-fsynced') journalCommitted = true; }, + beforeIO: current => { + if (journalCommitted && current === injected) throw new Error(`injected ${current} failure`); + }, + }); + const profile = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + await store.writeCredential(credential(profile.id, 'A')); + const baseline = await store.readProfileCredential(profile.id); + journalCommitted = false; + injected = operation; + const result = await store.commitPairedProfile( + { id: profile.id, label: 'Replacement', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'B'), baseline, () => true, + ); + assert.ok(result && !('stored' in result), operation); + injected = null; + const restarted = new ProfileStore(directory, encryption()); + assert.equal((await restarted.list()).profiles[0].label, 'Replacement', operation); + assert.deepEqual(await restarted.readCredential(profile.id), credential(profile.id, 'B'), operation); + } + }); + + it('recovers real process crashes as complete A before the pointer commit and complete B after it', async () => { + const steps: ProfileStoreDurabilityStep[] = [ + 'credential-encrypted', 'credential-written', 'credential-fsynced', 'credential-renamed', + ...(process.platform === 'win32' ? [] : ['credential-directory-fsynced'] as const), + 'state-written', 'state-fsynced', 'journal-written', 'journal-fsynced', + 'journal-closed', 'journal-reopened', 'journal-prepared-verified', + 'journal-committed', 'journal-commit-fsynced', 'journal-commit-verified', + 'journal-commit-closed', 'state-renamed', + ...(process.platform === 'win32' ? [] : ['state-directory-fsynced'] as const), + ]; + assert.equal(steps.length, process.platform === 'win32' ? 16 : 18); + let completed = 0; + for (const step of steps) { + const directory = await createDirectory(); + const setup = new ProfileStore(directory, encryption()); + const profileA = await setup.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + const credentialA = credential(profileA.id, 'A'); + await setup.writeCredential(credentialA); + const child = spawn(process.execPath, [ + '--import', 'tsx', join(import.meta.dirname, 'profile-store-crash-fixture.ts'), directory, step, + ], { stdio: 'ignore' }); + const result = await new Promise<{ code: number | null; signal: NodeJS.Signals | null }>(resolve => { + child.once('exit', (code, signal) => resolve({ code, signal })); + }); + assert.equal( + result.signal === 'SIGKILL' || (process.platform === 'win32' && result.code !== 0), + true, + `${step}: child did not crash at the requested boundary`, + ); + + const restarted = new ProfileStore(directory, encryption()); + const snapshot = await restarted.readProfileCredential(profileA.id); + const committed = step === 'journal-committed' + || step === 'journal-commit-fsynced' + || step === 'journal-commit-verified' + || step === 'journal-commit-closed' + || step === 'state-renamed' + || step === 'state-directory-fsynced'; + assert.equal(snapshot.profile?.label, committed ? 'Replacement' : 'Original', step); + assert.deepEqual(snapshot.credential, credential(profileA.id, committed ? 'B' : 'A'), step); + assert.equal((await restarted.pendingRevocations()).length, committed ? 1 : 0, step); + const files = await readdir(join(directory, 'desktop', 'credentials')); + assert.equal(files.length, committed ? 2 : 1, `${step}: recovery did not retain exactly the authoritative and pending slots`); + const desktopFiles = await readdir(join(directory, 'desktop')); + assert.equal(desktopFiles.some(file => file.endsWith('.tmp')), false, `${step}: recovery left staging files`); + completed += 1; + } + assert.equal(completed, steps.length, 'a native durability boundary fixture was skipped'); + console.log(`NATIVE_CATEGORY transaction-boundaries expected=${steps.length} executed=${completed}`); + }); + + it('recovers profile deletion crashes as active A or detached pending A at the journal commit', async () => { + const steps = RECOVERY_KILL_STEPS; + let completed = 0; + for (const step of steps) { + const directory = await createDirectory(); + const setup = new ProfileStore(directory, encryption()); + const profile = await setup.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + const credentialA = credential(profile.id, 'A'); + await setup.writeCredential(credentialA); + await setup.setActive(profile.id); + const child = spawn(process.execPath, [ + '--import', 'tsx', join(import.meta.dirname, 'profile-store-crash-fixture.ts'), + directory, `detach:${step}`, + ], { stdio: 'ignore' }); + const result = await new Promise<{ code: number | null; signal: NodeJS.Signals | null }>(resolve => { + child.once('exit', (code, signal) => resolve({ code, signal })); + }); + assert.equal( + result.signal === 'SIGKILL' || (process.platform === 'win32' && result.code !== 0), + true, + `${step}: detach child did not crash at the requested boundary`, + ); + const committed = step === 'journal-committed' + || step === 'journal-commit-fsynced' + || step === 'journal-commit-verified' + || step === 'journal-commit-closed' + || step === 'state-renamed' + || step === 'state-directory-fsynced'; + const restarted = new ProfileStore(directory, encryption()); + const snapshot = await restarted.readProfileCredential(profile.id); + assert.equal(snapshot.profile?.id ?? null, committed ? null : profile.id, step); + assert.deepEqual(snapshot.credential, committed ? null : credentialA, step); + const pending = await restarted.pendingRevocations(); + assert.equal(pending.length, committed ? 1 : 0, step); + if (committed) assert.deepEqual(pending[0].credential, credentialA, step); + console.log('NATIVE_SCENARIO detach-crash'); + completed += 1; + } + assert.equal(completed, steps.length); + }); + + it('recovers every first bootstrap and v1/v2 migration child-process kill without activating prepared B', async () => { + let completed = 0; + for (const mode of RECOVERY_KILL_MODES) { + for (const step of RECOVERY_KILL_STEPS) { + const directory = await createDirectory(); + await seedRecoveryMode(directory, mode); + const child = spawn(process.execPath, [ + '--import', 'tsx', join(import.meta.dirname, 'profile-store-crash-fixture.ts'), + directory, `recovery:${mode}:${step}`, + ], { stdio: 'ignore' }); + const result = await new Promise<{ code: number | null; signal: NodeJS.Signals | null }>(resolve => { + child.once('exit', (code, signal) => resolve({ code, signal })); + }); + assert.equal( + result.signal === 'SIGKILL' || (process.platform === 'win32' && result.code !== 0), + true, + `${mode}/${step}: child did not crash at the requested boundary`, + ); + + const desktop = join(directory, 'desktop'); + const committed = step === 'journal-committed' + || step === 'journal-commit-fsynced' + || step === 'journal-commit-verified' + || step === 'journal-commit-closed' + || step === 'state-renamed' + || step === 'state-directory-fsynced'; + const journals = await Promise.all([0, 1].map(async index => { + try { return await readFile(join(desktop, `profiles.journal.${index}`), 'utf8'); } catch { return null; } + })); + if (committed) assert.equal(journals.some(value => value?.startsWith('C')), true, `${mode}/${step}`); + else assert.equal(journals.some(value => value?.startsWith('C')), false, `${mode}/${step}`); + + for (let restart = 0; restart < 3; restart += 1) { + const recovered = new ProfileStore(directory, encryption()); + if (mode === 'bootstrap') { + assert.deepEqual(await recovered.list(), { profiles: [], activeProfileId: null }, `${mode}/${step}/${restart}`); + } else { + const snapshot = await recovered.readProfileCredential(legacyProfile.id); + assert.deepEqual(snapshot.profile, legacyProfile, `${mode}/${step}/${restart}`); + assert.deepEqual(snapshot.credential, credential(legacyProfile.id), `${mode}/${step}/${restart}`); + assert.equal(snapshot.activeProfileId, legacyProfile.id, `${mode}/${step}/${restart}`); + assert.match(snapshot.identityEpoch ?? '', /^[A-Za-z0-9_-]{22}$/, `${mode}/${step}/${restart}`); + } + const state = JSON.parse(await readFile(join(desktop, 'profiles.json'), 'utf8')) as { version: number }; + assert.equal(state.version, 3, `${mode}/${step}/${restart}`); + } + completed += 1; + } + } + assert.equal(completed, RECOVERY_KILL_MODES.length * RECOVERY_KILL_STEPS.length); + console.log(`NATIVE_CATEGORY bootstrap-migration expected=${completed} executed=${completed}`); + }); + + it('binds verified prepared bytes to one handle across same-size swaps and path-restoration ABA', async () => { + let completed = 0; + for (const restoreOriginalPath of [false, true]) { + const directory = await createDirectory(); + const desktop = join(directory, 'desktop'); + let swapPrepared = false; + let attackerPath = ''; + const store = new ProfileStore(directory, encryption(), { + afterDurabilityStep: async step => { + if (!swapPrepared || step !== 'journal-prepared-verified') return; + swapPrepared = false; + const state = JSON.parse(await readFile(join(desktop, 'profiles.json'), 'utf8')) as { generation: string }; + const preparedPath = join(desktop, `profiles.journal.${Number((BigInt(state.generation) + 1n) % 2n)}`); + const preparedContents = await readFile(preparedPath, 'utf8'); + assert.equal(preparedContents[0], 'P'); + const envelope = JSON.parse(preparedContents.slice(1)) as { + version: 2; generation: string; encryptedPayload: string; checksum: string; + }; + const payload = JSON.parse(encryption().decrypt(Buffer.from(envelope.encryptedPayload, 'base64url'))) as { + state: { profiles: Array<{ label: string }>; credentialSlots: Record }; + encryptedSlots: Record; + }; + payload.state.profiles[0].label = 'Attacker!!!'; + const slot = payload.state.credentialSlots['profile-1']; + const attackerCredential = JSON.parse( + encryption().decrypt(Buffer.from(payload.encryptedSlots[slot], 'base64url')), + ) as ReturnType; + attackerCredential.token = `propr_it_${'X'.repeat(43)}`; + payload.encryptedSlots[slot] = encryption().encrypt(JSON.stringify(attackerCredential)).toString('base64url'); + const encryptedPayload = encryption().encrypt(JSON.stringify(payload)).toString('base64url'); + const attackerContents = `P${JSON.stringify({ + ...envelope, + encryptedPayload, + checksum: createHash('sha256').update(encryptedPayload).digest('base64url'), + })}\n`; + assert.equal(Buffer.byteLength(attackerContents), Buffer.byteLength(preparedContents)); + const heldPath = `${preparedPath}.held`; + attackerPath = restoreOriginalPath ? `${preparedPath}.attacker` : preparedPath; + await rename(preparedPath, heldPath); + await writeFile(preparedPath, attackerContents, { mode: 0o600 }); + if (restoreOriginalPath) { + await rename(preparedPath, attackerPath); + await rename(heldPath, preparedPath); + } + }, + }); + const profile = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + const credentialA = credential(profile.id, 'A'); + await store.writeCredential(credentialA); + const baseline = await store.readProfileCredential(profile.id); + swapPrepared = true; + const transaction = store.commitPairedProfile( + { id: profile.id, label: 'Replacement', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'B'), baseline, () => true, + ); + if (restoreOriginalPath) { + const committed = await transaction; + assert.ok(committed && !('stored' in committed)); + } else { + await assert.rejects(transaction, /Desktop profile recovery state is unavailable/); + } + assert.equal((await readFile(attackerPath, 'utf8')).startsWith('P'), true); + + const restarted = new ProfileStore(directory, encryption()); + const snapshot = await restarted.readProfileCredential(profile.id); + assert.equal(snapshot.profile?.label, restoreOriginalPath ? 'Replacement' : 'Original'); + assert.deepEqual(snapshot.credential, credential(profile.id, restoreOriginalPath ? 'B' : 'A')); + assert.notEqual(snapshot.profile?.label, 'Attacker!!!'); + assert.notDeepEqual(snapshot.credential, credential(profile.id, 'X')); + completed += 1; + } + assert.equal(completed, 2); + console.log(`NATIVE_CATEGORY verified-handle-swap expected=2 executed=${completed}`); + }); + + for (const visibility of ['pointer-rollback', 'missing-target', 'state-before-journal'] as const) { + it(`recovers a ${visibility} durability view as complete A or complete B`, async () => { + const directory = await createDirectory(); + const desktop = join(directory, 'desktop'); + const credentialsDirectory = join(desktop, 'credentials'); + const store = new ProfileStore(directory, encryption()); + const profileA = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + const credentialA = credential(profileA.id, 'A'); + await store.writeCredential(credentialA); + const stateA = await readFile(join(desktop, 'profiles.json')); + const journalsA = await Promise.all([0, 1].map(async index => { + try { return await readFile(join(desktop, `profiles.journal.${index}`)); } catch { return null; } + })); + const baseline = await store.readProfileCredential(profileA.id); + await store.commitPairedProfile( + { id: profileA.id, label: 'Replacement', apiBaseUrl: profileA.apiBaseUrl }, + credential(profileA.id, 'B'), baseline, () => true, + ); + const stateB = JSON.parse(await readFile(join(desktop, 'profiles.json'), 'utf8')) as { + credentialSlots: Record; + }; + + if (visibility === 'pointer-rollback') { + await writeFile(join(desktop, 'profiles.json'), stateA); + } else if (visibility === 'missing-target') { + await unlink(join(credentialsDirectory, stateB.credentialSlots[profileA.id])); + } else { + for (const [index, bytes] of journalsA.entries()) { + const path = join(desktop, `profiles.journal.${index}`); + if (bytes) await writeFile(path, bytes); + else await unlink(path).catch(() => undefined); + } + } + + const restarted = new ProfileStore(directory, encryption()); + const recovered = await restarted.readProfileCredential(profileA.id); + const expectsB = visibility !== 'state-before-journal'; + assert.equal(recovered.profile?.label, expectsB ? 'Replacement' : 'Original'); + assert.deepEqual(recovered.credential, credential(profileA.id, expectsB ? 'B' : 'A')); + const activeSlotFiles = (await readdir(credentialsDirectory)).filter(file => file.endsWith('.bin')); + assert.equal(activeSlotFiles.length, expectsB ? 2 : 1); + }); + } + + for (const mirrorView of [ + 'missing', 'truncated', 'malformed', 'stale', 'schema-invalid', 'attacker-modified', + ] as const) { + it(`recovers the authoritative encrypted journal before a ${mirrorView} mirror`, async () => { + const directory = await createDirectory(); + const desktop = join(directory, 'desktop'); + const mirror = join(desktop, 'profiles.json'); + const store = new ProfileStore(directory, encryption()); + const profile = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + await store.writeCredential(credential(profile.id, 'A')); + const stale = await readFile(mirror); + const baseline = await store.readProfileCredential(profile.id); + await store.commitPairedProfile( + { id: profile.id, label: 'Replacement', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'B'), baseline, () => true, + ); + const current = JSON.parse(await readFile(mirror, 'utf8')) as Record; + if (mirrorView === 'missing') await unlink(mirror); + else if (mirrorView === 'truncated') await writeFile(mirror, '{"version":3'); + else if (mirrorView === 'malformed') await writeFile(mirror, 'not-json'); + else if (mirrorView === 'stale') await writeFile(mirror, stale); + else if (mirrorView === 'schema-invalid') { + await writeFile(mirror, JSON.stringify({ + ...current, version: 99, + })); + } else { + const profiles = current.profiles as Array>; + await writeFile(mirror, JSON.stringify({ + ...current, + profiles: profiles.map(value => ({ ...value, label: 'Attacker' })), + })); + } + + const restarted = new ProfileStore(directory, encryption()); + assert.equal((await restarted.list()).profiles[0].label, 'Replacement', mirrorView); + assert.deepEqual(await restarted.readCredential(profile.id), credential(profile.id, 'B'), mirrorView); + assert.equal((await restarted.pendingRevocations()).length, 1, mirrorView); + assert.equal((await readFile(mirror, 'utf8')).includes('Attacker'), false, mirrorView); + console.log('NATIVE_SCENARIO mirror-repair'); + }); + } + + it('fails with one fixed redacted error when neither mirror nor journal authenticates', async () => { + const directory = await createDirectory(); + const desktop = join(directory, 'desktop'); + const store = new ProfileStore(directory, encryption()); + const profile = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + await store.writeCredential(credential(profile.id, 'A')); + for (const name of ['profiles.journal.0', 'profiles.journal.1']) { + const path = join(desktop, name); + try { + const bytes = await readFile(path); + if (bytes[0] === 'C'.charCodeAt(0)) bytes[Math.min(20, bytes.length - 1)] ^= 1; + await writeFile(path, bytes); + } catch (error) { + if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; + } + } + await assert.rejects( + new ProfileStore(directory, encryption()).list(), + error => (error as Error).message === 'Desktop profile recovery state is unavailable', + ); + await writeFile(join(desktop, 'profiles.json'), '{attacker'); + const restarted = new ProfileStore(directory, encryption()); + await assert.rejects(restarted.list(), error => { + assert.equal((error as Error).message, 'Desktop profile recovery state is unavailable'); + assert.equal((error as Error).message.includes(profile.id), false); + return true; + }); + + const ioDirectory = await createDirectory(); + const ioStore = new ProfileStore(ioDirectory, encryption()); + await ioStore.save({ + id: 'profile-io', label: 'I/O failure', apiBaseUrl: 'https://propr.example.com', + }); + const ioMirror = join(ioDirectory, 'desktop', 'profiles.json'); + await unlink(ioMirror); + await mkdir(ioMirror); + await assert.rejects(new ProfileStore(ioDirectory, encryption()).list(), error => { + assert.equal((error as Error).message, 'Desktop profile recovery state is unavailable'); + assert.equal((error as Error).message.includes('EISDIR'), false); + assert.equal((error as Error).message.includes(ioMirror), false); + return true; + }); + }); + + it('selects a lossless newest valid generation and survives alternate-slot rollback', async () => { + const directory = await createDirectory(); + const desktop = join(directory, 'desktop'); + const store = new ProfileStore(directory, encryption()); + const profile = await store.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + await store.writeCredential(credential(profile.id, 'A')); + const baseline = await store.readProfileCredential(profile.id); + await store.commitPairedProfile( + { id: profile.id, label: 'Replacement', apiBaseUrl: profile.apiBaseUrl }, + credential(profile.id, 'B'), baseline, () => true, + ); + const mirror = JSON.parse(await readFile(join(desktop, 'profiles.json'), 'utf8')) as { generation: string }; + const newest = Number(BigInt(mirror.generation) % 2n); + const older = (newest + 1) % 2; + await writeFile( + join(desktop, `profiles.journal.${newest}`), + await readFile(join(desktop, `profiles.journal.${older}`)), + ); + const restarted = new ProfileStore(directory, encryption()); + const recovered = await restarted.readProfileCredential(profile.id); + assert.equal(recovered.profile?.label, 'Original'); + assert.deepEqual(recovered.credential, credential(profile.id, 'A')); + }); + + it('runs every native child-termination visibility fixture with an explicit scenario count', async () => { + assert.equal(NATIVE_VISIBILITY_SCENARIOS.length, 11); + if (process.env.PROPR_NATIVE_WINDOWS_DURABILITY_REQUIRED === '1') { + assert.equal(process.platform, 'win32', 'native Windows durability cannot run on a non-Windows host'); + assert.equal(process.arch, 'x64', 'native Windows durability must execute x64 production Node'); + } + let completed = 0; + for (const visibility of NATIVE_VISIBILITY_SCENARIOS) { + const directory = await createDirectory(); + const setup = new ProfileStore(directory, encryption()); + const profileA = await setup.save({ + id: 'profile-1', label: 'Original', apiBaseUrl: 'https://propr.example.com', + }); + await setup.writeCredential(credential(profileA.id, 'A')); + const child = spawn(process.execPath, [ + '--import', 'tsx', join(import.meta.dirname, 'profile-store-crash-fixture.ts'), + directory, `visibility:${visibility}`, + ], { stdio: 'ignore' }); + const result = await new Promise<{ code: number | null; signal: NodeJS.Signals | null }>(resolve => { + child.once('exit', (code, signal) => resolve({ code, signal })); + }); + assert.equal(result.code === 0, false, `${visibility}: Windows child did not terminate`); + + const restarted = new ProfileStore(directory, encryption()); + const snapshot = await restarted.readProfileCredential(profileA.id); + const expectsB = visibility !== 'state-before-journal' && visibility !== 'alternate-slot-rollback'; + assert.equal(snapshot.profile?.label, expectsB ? 'Replacement' : 'Original', visibility); + assert.deepEqual(snapshot.credential, credential(profileA.id, expectsB ? 'B' : 'A'), visibility); + assert.equal((await restarted.pendingRevocations()).length, expectsB ? 1 : 0, visibility); + completed += 1; + } + assert.equal(completed, NATIVE_VISIBILITY_SCENARIOS.length, 'a native visibility fixture was skipped'); + console.log( + `NATIVE_CATEGORY reordered-visibility expected=${NATIVE_VISIBILITY_SCENARIOS.length} executed=${completed}`, + ); + }); + + it('removes an orphan credential before allowing same-ID recreation', async () => { + const directory = await createDirectory(); + const store = new ProfileStore(directory, encryption()); + await store.writeCredential(credential('profile-1')); + + assert.equal(await store.detachProfile('profile-1'), null); + const recreated = await store.save({ id: 'profile-1', label: 'Recreated', apiBaseUrl: 'https://propr.example.com' }); + + assert.equal(recreated.id, 'profile-1'); + assert.equal(await store.readCredential('profile-1'), null); + }); + }); diff --git a/apps/desktop/src/profile-store.ts b/apps/desktop/src/profile-store.ts index 4115c1f92..fd23015c2 100644 --- a/apps/desktop/src/profile-store.ts +++ b/apps/desktop/src/profile-store.ts @@ -1,9 +1,20 @@ -import { randomUUID } from 'node:crypto'; -import { chmod, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises'; +import { createHash, randomBytes, randomUUID } from 'node:crypto'; +import { constants } from 'node:fs'; +import { + chmod, + lstat, + mkdir, + open, + readFile, + readdir, + rename, + stat, + unlink, + writeFile, + type FileHandle, +} from 'node:fs/promises'; import { join } from 'node:path'; import type { - CredentialReadResult, - CredentialWriteResult, DesktopProfile, DesktopProfileInput, DesktopProfileList, @@ -14,10 +25,97 @@ import { normalizeApiBaseUrl } from './security'; const PROFILE_ID_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/; const MAX_CREDENTIAL_LENGTH = 65_536; -interface PersistedState { +export interface StoredCredential { version: 1; + profileId: string; + origin: string; + token: string; +} + +export interface DetachedProfile { + profile: DesktopProfile; + credential: StoredCredential | null; +} + +export interface SavedProfileTransaction { + profile: DesktopProfile; + detachedCredential: StoredCredential | null; + originChanged: boolean; +} + +export interface PairedProfileTransaction { + profile: DesktopProfile; + identityEpoch: string; + originChanged: boolean; +} + +export interface ProfileCredentialSnapshot { + profile: DesktopProfile | null; + credential: StoredCredential | null; + identityEpoch: string | null; + activeProfileId: string | null; +} + +interface LegacyPersistedState { + version: 1; + activeProfileId: string | null; + profiles: DesktopProfile[]; +} + +interface VersionTwoPersistedState { + version: 2; activeProfileId: string | null; profiles: DesktopProfile[]; + credentialSlots: Record; +} + +interface PendingRevocationRecord { + version: 1; + profileId: string; + origin: string; + slot: string; + credentialGeneration: string; + deferred: boolean; +} + +interface PersistedState { + version: 3; + generation: string; + activeProfileId: string | null; + profiles: DesktopProfile[]; + credentialSlots: Record; + credentialEpochs: Record; + pendingRevocations: Record; +} + +interface JournalPayload { + version: 1; + state: PersistedState; + encryptedSlots: Record; +} + +interface LegacyJournalRecord extends JournalPayload { + checksum: string; +} + +interface JournalRecord { + version: 2; + generation: string; + encryptedPayload: string; + checksum: string; +} + +interface AuthenticatedJournal { + generation: bigint; + state: PersistedState; + encryptedSlots: Record; +} + +export interface PendingCredentialRevocation { + id: string; + credential: StoredCredential; + credentialGeneration: string; + deferred: boolean; } export interface EncryptionProvider { @@ -27,12 +125,82 @@ export interface EncryptionProvider { decrypt(value: Buffer): string; } +export type ProfileStoreDurabilityStep = + | 'credential-encrypted' + | 'credential-written' + | 'credential-fsynced' + | 'credential-renamed' + | 'credential-directory-fsynced' + | 'state-written' + | 'state-fsynced' + | 'journal-written' + | 'journal-fsynced' + | 'journal-closed' + | 'journal-reopened' + | 'journal-prepared-verified' + | 'journal-committed' + | 'journal-commit-fsynced' + | 'journal-commit-verified' + | 'journal-commit-closed' + | 'state-renamed' + | 'state-directory-fsynced' + | 'old-credential-removed'; + +export interface ProfileStoreOptions { + afterDurabilityStep?(step: ProfileStoreDurabilityStep): void | Promise; + beforeIO?(operation: ProfileStoreIOOperation): void | Promise; +} + +export type ProfileStoreIOOperation = + | 'credential-write' + | 'credential-flush' + | 'credential-replace' + | 'journal-write' + | 'journal-flush' + | 'journal-reopen' + | 'journal-commit' + | 'journal-commit-flush' + | 'journal-verify' + | 'mirror-write' + | 'mirror-flush' + | 'mirror-replace' + | 'metadata-flush'; + const emptyState = (): PersistedState => ({ - version: 1, + version: 3, + generation: '0', activeProfileId: null, profiles: [], + credentialSlots: {}, + credentialEpochs: {}, + pendingRevocations: {}, }); +const hasCredentialMaterial = (state: PersistedState): boolean => + Object.keys(state.credentialSlots).length > 0 + || Object.keys(state.credentialEpochs).length > 0 + || Object.keys(state.pendingRevocations).length > 0; + +const SLOT_PATTERN = /^([a-zA-Z0-9][a-zA-Z0-9_-]{0,63})\.[0-9a-f-]{36}\.bin$/i; +const IDENTITY_EPOCH_PATTERN = /^[A-Za-z0-9_-]{22}$/; +const MAX_PENDING_REVOCATIONS = 64; +const MAX_JOURNAL_BYTES = (MAX_PENDING_REVOCATIONS + 1) * (MAX_CREDENTIAL_LENGTH * 2 + 4_096); +const RECOVERY_ERROR = 'Desktop profile recovery state is unavailable'; + +/** + * Flush an existing file through a writable handle. Windows rejects fsync on + * the read-only handle Node creates for `open(path, 'r')`; O_WRONLY is the + * minimum access libuv needs for FlushFileBuffers and works on POSIX too. + */ +export const flushFileData = async (path: string): Promise => { + const handle = await open(path, constants.O_WRONLY); + try { + await handle.sync(); + } finally { + await handle.close(); + } +}; + const validDate = (value: unknown): value is string => typeof value === 'string' && !Number.isNaN(Date.parse(value)); @@ -50,11 +218,23 @@ const validProfile = (value: unknown): value is DesktopProfile => { && validDate(profile.updatedAt); }; -const parseState = (contents: string): PersistedState => { +const validCredentialSlots = (value: unknown): value is Record => { + if (!value || typeof value !== 'object' || Array.isArray(value)) return false; + const slots = new Set(); + for (const [profileId, slot] of Object.entries(value as Record)) { + if (!PROFILE_ID_PATTERN.test(profileId) || typeof slot !== 'string' + || SLOT_PATTERN.exec(slot)?.[1] !== profileId || slots.has(slot)) return false; + slots.add(slot); + } + return true; +}; + +const parseState = (contents: string): PersistedState | VersionTwoPersistedState | LegacyPersistedState => { const value = JSON.parse(contents) as unknown; if (!value || typeof value !== 'object') throw new Error('Desktop profile store is invalid'); const state = value as Record; - if (state.version !== 1 || !Array.isArray(state.profiles) || !state.profiles.every(validProfile)) { + if ((state.version !== 1 && state.version !== 2 && state.version !== 3) + || !Array.isArray(state.profiles) || !state.profiles.every(validProfile)) { throw new Error('Desktop profile store is invalid'); } if (state.activeProfileId !== null && ( @@ -63,7 +243,96 @@ const parseState = (contents: string): PersistedState => { )) { throw new Error('Desktop active profile is invalid'); } - return state as unknown as PersistedState; + if (state.version === 2 && !validCredentialSlots(state.credentialSlots)) { + throw new Error('Desktop credential state is invalid'); + } + if (state.version === 3) { + if (!((typeof state.generation === 'string' && /^(?:0|[1-9][0-9]{0,30})$/.test(state.generation)) + || (Number.isSafeInteger(state.generation) && (state.generation as number) >= 0)) + || !validCredentialSlots(state.credentialSlots) + || !state.credentialEpochs || typeof state.credentialEpochs !== 'object' + || Array.isArray(state.credentialEpochs) + || !state.pendingRevocations || typeof state.pendingRevocations !== 'object' + || Array.isArray(state.pendingRevocations)) throw new Error('Desktop credential state is invalid'); + const slots = state.credentialSlots as Record; + const epochs = state.credentialEpochs as Record; + if (Object.keys(slots).length !== Object.keys(epochs).length + || Object.entries(epochs).some(([profileId, epoch]) => !(profileId in slots) + || typeof epoch !== 'string' || !IDENTITY_EPOCH_PATTERN.test(epoch))) { + throw new Error('Desktop credential identity state is invalid'); + } + const pending = Object.entries(state.pendingRevocations as Record); + if (pending.length > MAX_PENDING_REVOCATIONS) throw new Error('Desktop revocation state is invalid'); + const pendingSlots = new Set(); + for (const [id, raw] of pending) { + if (!/^[0-9a-f-]{36}$/i.test(id) || !raw || typeof raw !== 'object' || Array.isArray(raw)) { + throw new Error('Desktop revocation state is invalid'); + } + const record = raw as Record; + if (record.credentialGeneration === undefined && typeof record.slot === 'string') { + record.credentialGeneration = createHash('sha256') + .update(record.slot) + .digest() + .subarray(0, 16) + .toString('base64url'); + } + if (record.deferred === undefined) record.deferred = false; + if (record.version !== 1 || typeof record.profileId !== 'string' + || !PROFILE_ID_PATTERN.test(record.profileId) || typeof record.origin !== 'string' + || normalizeApiBaseUrl(record.origin) !== record.origin || typeof record.slot !== 'string' + || typeof record.credentialGeneration !== 'string' + || !IDENTITY_EPOCH_PATTERN.test(record.credentialGeneration) + || typeof record.deferred !== 'boolean' + || SLOT_PATTERN.exec(record.slot)?.[1] !== record.profileId + || Object.values(slots).includes(record.slot) || pendingSlots.has(record.slot)) { + throw new Error('Desktop revocation state is invalid'); + } + pendingSlots.add(record.slot); + } + state.generation = String(state.generation); + } + return state as unknown as PersistedState | VersionTwoPersistedState | LegacyPersistedState; +}; + +const journalChecksum = (value: string | Buffer): string => + createHash('sha256').update(value).digest('base64url'); + +const parseLegacyJournal = (contents: string): LegacyJournalRecord => { + const value = JSON.parse(contents) as unknown; + if (!value || typeof value !== 'object') throw new Error('Desktop transaction journal is invalid'); + const record = value as LegacyJournalRecord; + const rawPayload = { version: 1 as const, state: record.state, encryptedSlots: record.encryptedSlots }; + if (record.checksum !== journalChecksum(JSON.stringify(rawPayload))) { + throw new Error('Desktop transaction journal checksum failed'); + } + const state = parseState(JSON.stringify(record.state)); + if (record.version !== 1 || state.version !== 3 || !record.encryptedSlots + || typeof record.encryptedSlots !== 'object' || Array.isArray(record.encryptedSlots) + || Object.entries(record.encryptedSlots).some(([slot, bytes]) => !SLOT_PATTERN.test(slot) + || typeof bytes !== 'string' || !/^[A-Za-z0-9_-]*$/.test(bytes))) { + throw new Error('Desktop transaction journal is invalid'); + } + const payload: JournalPayload = { version: 1, state, encryptedSlots: record.encryptedSlots }; + return { ...payload, checksum: record.checksum }; +}; + +const parseJournalEnvelope = (contents: string): JournalRecord => { + if (Buffer.byteLength(contents) > MAX_JOURNAL_BYTES) throw new Error('Desktop transaction journal is invalid'); + const value = JSON.parse(contents) as unknown; + if (!value || typeof value !== 'object' || Array.isArray(value)) { + throw new Error('Desktop transaction journal is invalid'); + } + const record = value as Record; + if (record.version !== 2 || typeof record.generation !== 'string' + || !/^(?:0|[1-9][0-9]{0,30})$/.test(record.generation) + || typeof record.encryptedPayload !== 'string' + || record.encryptedPayload.length === 0 + || !/^[A-Za-z0-9_-]+$/.test(record.encryptedPayload) + || typeof record.checksum !== 'string' + || record.checksum !== journalChecksum(record.encryptedPayload)) { + throw new Error('Desktop transaction journal is invalid'); + } + return record as unknown as JournalRecord; }; const encryptionStatus = (encryption: EncryptionProvider): StorageSecurity => { @@ -97,35 +366,96 @@ const normalizedProfileInput = (input: DesktopProfileInput): Omit(); #mutation = Promise.resolve(); - readonly #credentialMutations = new Map>(); + #closed = false; + #closePromise: Promise | null = null; - constructor(userDataPath: string, encryption: EncryptionProvider) { + constructor(userDataPath: string, encryption: EncryptionProvider, options: ProfileStoreOptions = {}) { this.#directory = join(userDataPath, 'desktop'); this.#statePath = join(this.#directory, 'profiles.json'); + this.#journalPaths = [ + join(this.#directory, 'profiles.journal.0'), + join(this.#directory, 'profiles.journal.1'), + ]; this.#credentialsDirectory = join(this.#directory, 'credentials'); this.#encryption = encryption; + this.#options = options; } security(): StorageSecurity { return encryptionStatus(this.#encryption); } - async list(): Promise { - const state = await this.#readState(); - return { - profiles: state.profiles.map(profile => ({ ...profile })), - activeProfileId: state.activeProfileId, - }; + /** Resolves after every queued recovery, mutation, and cleanup operation has settled. */ + awaitIdle(): Promise { + return this.#mutation; + } + + close(): Promise { + if (this.#closePromise) return this.#closePromise; + this.#closed = true; + this.#closePromise = this.awaitIdle(); + return this.#closePromise; + } + + list(): Promise { + if (!this.security().available) { + return this.#metadata(async () => { + try { + const state = parseState(await readFile(this.#statePath, 'utf8')); + return { + profiles: state.profiles.map(profile => ({ ...profile })), + activeProfileId: state.activeProfileId, + }; + } catch (error) { + if ((error as NodeJS.ErrnoException).code === 'ENOENT') { + return { profiles: [], activeProfileId: null }; + } + throw new Error(RECOVERY_ERROR); + } + }); + } + return this.#mutate(async () => { + const state = await this.#readState(); + return { + profiles: state.profiles.map(profile => ({ ...profile })), + activeProfileId: state.activeProfileId, + }; + }); } - save(input: DesktopProfileInput): Promise { + save(input: DesktopProfileInput, signal?: AbortSignal): Promise { + signal?.throwIfAborted(); + return this.saveAndDetachCredential( + input, + undefined, + signal ? () => !signal.aborted : undefined, + ).then(result => result.profile); + } + + saveAndDetachCredential( + input: DesktopProfileInput, + beforeOriginChangeCommit?: (previousOrigin: string, nextOrigin: string) => Promise, + isCurrent?: () => boolean, + ): Promise { return this.#mutate(async () => { const normalized = normalizedProfileInput(input); const state = await this.#readState(); const existing = state.profiles.find(profile => profile.id === normalized.id); + const originChanged = existing !== undefined && existing.apiBaseUrl !== normalized.apiBaseUrl; + if (originChanged) { + await beforeOriginChangeCommit?.(existing.apiBaseUrl, normalized.apiBaseUrl); + } + let detachedCredential: StoredCredential | null = null; + if (!existing || originChanged) { + detachedCredential = (await this.#moveCredentialToPending(state, normalized.id))?.credential ?? null; + if (originChanged && state.activeProfileId === normalized.id) state.activeProfileId = null; + } const now = new Date().toISOString(); const profile: DesktopProfile = { ...normalized, @@ -133,22 +463,203 @@ export class ProfileStore { updatedAt: now, }; state.profiles = [...state.profiles.filter(item => item.id !== profile.id), profile]; - await this.#writeState(state); - return { ...profile }; + const durable = await this.#writeState(state, isCurrent); + if (!durable) throw new DOMException('The desktop profile save was cancelled.', 'AbortError'); + return { profile: { ...profile }, detachedCredential: durable ? detachedCredential : null, originChanged }; + }); + } + + commitPairedProfile( + input: DesktopProfileInput, + credential: StoredCredential, + expected: ProfileCredentialSnapshot, + isCurrent: () => boolean, + beginPublish?: () => (() => void) | null, + onPublished?: () => void, + pendingRevocationId?: string, + ): Promise { + const normalized = normalizedProfileInput(input); + if (credential.version !== 1 + || credential.profileId !== normalized.id + || credential.origin !== normalized.apiBaseUrl + || typeof credential.token !== 'string' + || credential.token.length > MAX_CREDENTIAL_LENGTH + || !/^propr_it_[A-Za-z0-9_-]{43}$/.test(credential.token)) { + throw new Error('Credential does not match the paired desktop profile'); + } + if (!this.security().available) return Promise.resolve({ stored: false, reason: 'encryption-unavailable' }); + + return this.#mutate(async () => { + const state = await this.#readState(); + const existing = state.profiles.find(profile => profile.id === normalized.id) ?? null; + const existingCredential = await this.#readCredentialFile(state, normalized.id); + const existingEpoch = state.credentialEpochs[normalized.id] ?? null; + if (!isCurrent() + || state.activeProfileId !== expected.activeProfileId + || !this.#sameProfile(existing, expected.profile) + || !this.#sameOptionalCredential(existingCredential, expected.credential) + || existingEpoch !== expected.identityEpoch) return null; + + const now = new Date().toISOString(); + const profile: DesktopProfile = { + ...normalized, + createdAt: existing?.createdAt ?? now, + updatedAt: now, + }; + const originChanged = existing !== null && existing.apiBaseUrl !== profile.apiBaseUrl; + + const previousSlot = state.credentialSlots[profile.id]; + const pending = pendingRevocationId ? state.pendingRevocations[pendingRevocationId] : undefined; + if (pendingRevocationId && !pending) return null; + const stagedSlot = pending?.slot ?? await this.#stageCredential(credential); + const identityEpoch = pending?.credentialGeneration ?? randomBytes(16).toString('base64url'); + const stagedByThisCall = !pending; + if (pending) { + const pendingCredential = await this.#readCredentialSlot(pending.slot, pending.profileId); + if (pending.profileId !== credential.profileId || pending.origin !== credential.origin + || !this.#sameCredential(pendingCredential, credential)) { + throw new Error('Pending desktop credential does not match the paired profile'); + } + } + let committed = false; + try { + if (!isCurrent()) return null; + // Promote B and detach A through the same pending transition used by + // deletion, origin edits and explicit credential replacement. These + // are only in-memory changes until the single journal commit below. + if (pendingRevocationId) delete state.pendingRevocations[pendingRevocationId]; + if (previousSlot) await this.#moveCredentialToPending(state, profile.id); + state.profiles = [...state.profiles.filter(item => item.id !== profile.id), profile]; + if (originChanged && state.activeProfileId === profile.id) state.activeProfileId = null; + // The staged slot is durable while the old state still names A. This + // single atomic state-file rename is the only A -> B commit point. + state.credentialSlots[profile.id] = stagedSlot; + state.credentialEpochs[profile.id] = identityEpoch; + const durable = await this.#writeState(state, isCurrent, beginPublish, onPublished); + if (durable === null) return null; + committed = true; + return { + profile: { ...profile }, + identityEpoch, + originChanged, + }; + } finally { + if (!committed && stagedByThisCall) { + await this.#unlinkSlot(stagedSlot).catch(() => undefined); + } + } }); } remove(profileId: string): Promise { + return this.detachProfile(profileId).then(() => undefined); + } + + detachProfile( + profileId: string, + beforeCommit?: (origin: string) => Promise, + ): Promise { assertProfileId(profileId); - const stateMutation = this.#mutate(async () => { + return this.#mutate(async () => { const state = await this.#readState(); + const profile = state.profiles.find(item => item.id === profileId); + if (profile) await beforeCommit?.(profile.apiBaseUrl); + const previousSlot = state.credentialSlots[profileId]; + const credential = (await this.#moveCredentialToPending(state, profileId))?.credential ?? null; + if (!profile && !previousSlot) return null; state.profiles = state.profiles.filter(profile => profile.id !== profileId); if (state.activeProfileId === profileId) state.activeProfileId = null; + const durable = await this.#writeState(state); + if (!profile) return null; + return { profile: { ...profile }, credential: durable ? credential : null }; + }); + } + + activateProfile( + expected: StoredCredential, + expectedIdentityEpoch: string, + expectedProfileOrigin: string, + expectedActiveProfileId: string | null, + isCurrent: () => boolean, + ): Promise { + const profileId = expected?.profileId; + assertProfileId(profileId); + if (normalizeApiBaseUrl(expectedProfileOrigin) !== expectedProfileOrigin) { + throw new Error('Invalid desktop API URL'); + } + if (expectedActiveProfileId !== null) assertProfileId(expectedActiveProfileId); + return this.#mutate(async () => { + const state = await this.#readState(); + const profile = state.profiles.find(item => item.id === profileId); + const credential = await this.#readCredentialFile(state, profileId); + if (!isCurrent() + || state.activeProfileId !== expectedActiveProfileId + || profile?.apiBaseUrl !== expectedProfileOrigin + || expected.origin !== expectedProfileOrigin + || credential?.origin !== profile.apiBaseUrl + || state.credentialEpochs[profileId] !== expectedIdentityEpoch + || !this.#sameCredential(credential, expected)) return null; + + const previousActiveProfileId = state.activeProfileId; + state.activeProfileId = profileId; + await this.#writeState(state); + if (isCurrent()) return expectedIdentityEpoch; + + // A generation/selection change that occurred during the atomic file + // replacement must not leave the candidate selected. + state.activeProfileId = previousActiveProfileId; await this.#writeState(state); + return null; }); - return this.#mutateCredential(profileId, async () => { - await stateMutation; - await this.#removeCredentialFile(profileId); + } + + activateLocalProfile( + profileId: string, + expectedProfileOrigin: string, + isCurrent: () => boolean, + beforeCommit?: (previousOrigin: string | undefined, nextOrigin: string) => Promise, + ): Promise<{ previousActiveProfileId: string | null } | null> { + assertProfileId(profileId); + if (normalizeApiBaseUrl(expectedProfileOrigin) !== expectedProfileOrigin) { + throw new Error('Invalid desktop API URL'); + } + return this.#mutate(async () => { + const state = await this.#readState(); + const profile = state.profiles.find(item => item.id === profileId); + if (!isCurrent() || profile?.apiBaseUrl !== expectedProfileOrigin) return null; + + const previousActiveProfileId = state.activeProfileId; + const previousOrigin = state.profiles.find(item => item.id === previousActiveProfileId)?.apiBaseUrl; + await beforeCommit?.(previousOrigin, expectedProfileOrigin); + if (!isCurrent()) return null; + state.activeProfileId = profileId; + await this.#writeState(state); + if (isCurrent()) return { previousActiveProfileId }; + + // A newer trusted activation generation won while the durable replace + // was in flight. Restore the pre-attempt selection before releasing the + // serialized profile boundary, so stale renderer work cannot persist. + state.activeProfileId = previousActiveProfileId; + await this.#writeState(state); + return null; + }); + } + + restoreLocalProfile( + profileId: string, + previousActiveProfileId: string | null, + isCurrent: () => boolean, + ): Promise { + assertProfileId(profileId); + if (previousActiveProfileId !== null) assertProfileId(previousActiveProfileId); + return this.#mutate(async () => { + const state = await this.#readState(); + if (!isCurrent() || state.activeProfileId !== profileId + || (previousActiveProfileId !== null + && !state.profiles.some(profile => profile.id === previousActiveProfileId))) return false; + state.activeProfileId = previousActiveProfileId; + await this.#writeState(state); + return isCurrent(); }); } @@ -164,61 +675,978 @@ export class ProfileStore { }); } - async readCredential(profileId: string): Promise { + readCredential(profileId: string): Promise { + assertProfileId(profileId); + if (!this.security().available) return Promise.resolve(null); + return this.#mutate(async () => this.#readCredentialFile(await this.#readState(), profileId)); + } + + readProfileCredential(profileId: string): Promise { assertProfileId(profileId); - if (!this.security().available) return { available: false, value: null }; + return this.#mutate(async () => { + const state = await this.#readState(); + const profile = state.profiles.find(item => item.id === profileId) ?? null; + const credential = this.security().available + ? await this.#readCredentialFile(state, profileId) + : null; + return { + profile: profile ? { ...profile } : null, + credential, + identityEpoch: state.credentialEpochs[profileId] ?? null, + activeProfileId: state.activeProfileId, + }; + }); + } + + async #readCredentialFile(state: PersistedState, profileId: string): Promise { + const slot = state.credentialSlots[profileId]; + if (!slot) return null; + return this.#readCredentialSlot(slot, profileId); + } + + async #readCredentialSlot(slot: string, profileId: string): Promise { try { - const encrypted = await readFile(this.#credentialPath(profileId)); - return { available: true, value: this.#encryption.decrypt(encrypted) }; + const encrypted = await readFile(join(this.#credentialsDirectory, slot)); + const value = JSON.parse(this.#encryption.decrypt(encrypted)) as unknown; + if (!value || typeof value !== 'object') return null; + const credential = value as Record; + if (credential.version !== 1 || credential.profileId !== profileId + || typeof credential.origin !== 'string' + || normalizeApiBaseUrl(credential.origin) !== credential.origin + || typeof credential.token !== 'string' + || !/^propr_it_[A-Za-z0-9_-]{43}$/.test(credential.token)) return null; + return credential as unknown as StoredCredential; } catch (error) { - if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { available: true, value: null }; + if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null; + if (error instanceof SyntaxError) return null; throw error; } } - async writeCredential(profileId: string, value: string): Promise { + async #moveCredentialToPending( + state: PersistedState, + profileId: string, + ): Promise<(Omit & { credential: StoredCredential | null }) | null> { + const slot = state.credentialSlots[profileId]; + if (!slot) return null; + if (Object.keys(state.pendingRevocations).length >= MAX_PENDING_REVOCATIONS) { + throw new Error('Pending desktop credential revocations must complete before changing profiles.'); + } + let credential: StoredCredential | null = null; + try { + credential = await this.#readCredentialSlot(slot, profileId); + } catch { + // The slot bytes were authenticated by the prior committed journal. Keep + // them durable even while a keychain/backend read is temporarily failing. + } + const credentialGeneration = state.credentialEpochs[profileId]; + const profile = state.profiles.find(item => item.id === profileId); + if (!credentialGeneration || (!credential && !profile)) { + throw new Error('Desktop credential cannot be safely detached for revocation.'); + } + const id = randomUUID(); + state.pendingRevocations[id] = { + version: 1, + profileId, + origin: credential?.origin ?? profile!.apiBaseUrl, + slot, + credentialGeneration, + deferred: false, + }; + delete state.credentialSlots[profileId]; + delete state.credentialEpochs[profileId]; + return { id, credential, credentialGeneration, deferred: false }; + } + + #sameCredential(actual: StoredCredential | null, expected: StoredCredential): boolean { + return actual !== null + && actual.version === expected.version + && actual.profileId === expected.profileId + && actual.origin === expected.origin + && actual.token === expected.token; + } + + #sameOptionalCredential(actual: StoredCredential | null, expected: StoredCredential | null): boolean { + return expected === null ? actual === null : this.#sameCredential(actual, expected); + } + + #sameProfile(actual: DesktopProfile | null, expected: DesktopProfile | null): boolean { + return expected === null ? actual === null : actual !== null + && actual.id === expected.id + && actual.label === expected.label + && actual.apiBaseUrl === expected.apiBaseUrl + && actual.createdAt === expected.createdAt + && actual.updatedAt === expected.updatedAt; + } + + async writeCredential(credential: StoredCredential): Promise<{ stored: true } | { stored: false; reason: 'encryption-unavailable' }> { + const profileId = credential?.profileId; assertProfileId(profileId); - if (typeof value !== 'string' || value.length === 0 || value.length > MAX_CREDENTIAL_LENGTH) { + if (credential.version !== 1 || normalizeApiBaseUrl(credential.origin) !== credential.origin + || typeof credential.token !== 'string' || credential.token.length > MAX_CREDENTIAL_LENGTH + || !/^propr_it_[A-Za-z0-9_-]{43}$/.test(credential.token)) { throw new Error('Credential must contain 1 to 65536 characters'); } if (!this.security().available) return { stored: false, reason: 'encryption-unavailable' }; - return this.#mutateCredential(profileId, async () => { - await this.#ensureDirectories(); - const target = this.#credentialPath(profileId); - const temporary = `${target}.${process.pid}.tmp`; - await writeFile(temporary, this.#encryption.encrypt(value), { mode: 0o600 }); - await rename(temporary, target); - await chmod(target, 0o600).catch(() => undefined); + return this.#mutate(async () => { + const state = await this.#readState(); + const previousSlot = state.credentialSlots[profileId]; + if (previousSlot) await this.#moveCredentialToPending(state, profileId); + const stagedSlot = await this.#stageCredential(credential); + let committed = false; + try { + state.credentialSlots[profileId] = stagedSlot; + state.credentialEpochs[profileId] = randomBytes(16).toString('base64url'); + const durable = await this.#writeState(state); + committed = true; + if (!durable) return { stored: true }; + } finally { + if (!committed) { + await this.#unlinkSlot(stagedSlot).catch(() => undefined); + } + } return { stored: true }; }); } removeCredential(profileId: string): Promise { assertProfileId(profileId); - return this.#mutateCredential(profileId, () => this.#removeCredentialFile(profileId)); + return this.#mutate(async () => { + const state = await this.#readState(); + if (!await this.#moveCredentialToPending(state, profileId)) return; + await this.#writeState(state); + }); + } + + removeCredentialIfCurrent( + expected: StoredCredential, + expectedProfileOrigin: string, + isCurrent: () => boolean, + ): Promise { + const profileId = expected?.profileId; + assertProfileId(profileId); + if (normalizeApiBaseUrl(expectedProfileOrigin) !== expectedProfileOrigin) { + throw new Error('Invalid desktop API URL'); + } + return this.#mutate(async () => { + const state = await this.#readState(); + const profile = state.profiles.find(item => item.id === profileId); + const credential = await this.#readCredentialFile(state, profileId); + if (!isCurrent() + || profile?.apiBaseUrl !== expectedProfileOrigin + || !credential + || credential.version !== expected.version + || credential.profileId !== expected.profileId + || credential.origin !== expected.origin + || credential.token !== expected.token) return false; + await this.#moveCredentialToPending(state, profileId); + await this.#writeState(state); + return true; + }); } - async #removeCredentialFile(profileId: string): Promise { - await unlink(this.#credentialPath(profileId)).catch(error => { - if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; + journalPendingRevocation( + credential: StoredCredential, + credentialGeneration?: string, + ): Promise { + const profileId = credential?.profileId; + assertProfileId(profileId); + if (credential.version !== 1 || normalizeApiBaseUrl(credential.origin) !== credential.origin + || typeof credential.token !== 'string' || credential.token.length > MAX_CREDENTIAL_LENGTH + || !/^propr_it_[A-Za-z0-9_-]{43}$/.test(credential.token)) { + throw new Error('Invalid desktop credential revocation material'); + } + if (credentialGeneration !== undefined && !IDENTITY_EPOCH_PATTERN.test(credentialGeneration)) { + throw new Error('Invalid desktop credential generation'); + } + if (!this.security().available) return Promise.resolve({ stored: false, reason: 'encryption-unavailable' }); + return this.#mutate(async () => { + const state = await this.#readState(); + for (const [id, record] of Object.entries(state.pendingRevocations)) { + if (record.profileId !== profileId || record.origin !== credential.origin) continue; + const existing = await this.#readCredentialSlot(record.slot, record.profileId); + if (this.#sameCredential(existing, credential)) { + return { + id, + credential: { ...credential }, + credentialGeneration: record.credentialGeneration, + deferred: record.deferred, + }; + } + } + if (Object.keys(state.pendingRevocations).length >= MAX_PENDING_REVOCATIONS) { + throw new Error('Pending desktop credential revocations must complete before pairing again.'); + } + const slot = await this.#stageCredential(credential); + const id = randomUUID(); + const generation = credentialGeneration ?? randomBytes(16).toString('base64url'); + let committed = false; + try { + state.pendingRevocations[id] = { + version: 1, + profileId, + origin: credential.origin, + slot, + credentialGeneration: generation, + deferred: true, + }; + await this.#writeState(state); + committed = true; + return { id, credential: { ...credential }, credentialGeneration: generation, deferred: true }; + } finally { + if (!committed) await this.#unlinkSlot(slot).catch(() => undefined); + } + }); + } + + releasePendingRevocation(id: string, credentialGeneration: string): Promise { + if (!/^[0-9a-f-]{36}$/i.test(id) || !IDENTITY_EPOCH_PATTERN.test(credentialGeneration)) { + throw new Error('Invalid desktop revocation release'); + } + return this.#mutate(async () => { + const state = await this.#readState(); + const record = state.pendingRevocations[id]; + if (!record || record.credentialGeneration !== credentialGeneration) return false; + if (!record.deferred) return true; + record.deferred = false; + await this.#writeState(state); + return true; + }); + } + + pendingRevocations(includeDeferred = true): Promise { + if (!this.security().available) return Promise.resolve([]); + return this.#mutate(async () => { + const state = await this.#readState(); + const pending: PendingCredentialRevocation[] = []; + for (const [id, record] of Object.entries(state.pendingRevocations)) { + if (record.deferred && !includeDeferred) continue; + const credential = await this.#readCredentialSlot(record.slot, record.profileId); + if (!credential || credential.origin !== record.origin) { + throw new Error('Desktop pending revocation material is unavailable'); + } + pending.push({ + id, + credential, + credentialGeneration: record.credentialGeneration, + deferred: record.deferred, + }); + } + return pending; + }); + } + + completePendingRevocation( + id: string, + expected: StoredCredential, + expectedCredentialGeneration?: string, + ): Promise { + if (!/^[0-9a-f-]{36}$/i.test(id)) throw new Error('Invalid desktop revocation id'); + return this.#mutate(async () => { + const state = await this.#readState(); + const record = state.pendingRevocations[id]; + if (!record || record.profileId !== expected.profileId || record.origin !== expected.origin + || (expectedCredentialGeneration !== undefined + && record.credentialGeneration !== expectedCredentialGeneration)) return false; + const actual = await this.#readCredentialSlot(record.slot, record.profileId); + if (!this.#sameCredential(actual, expected)) return false; + delete state.pendingRevocations[id]; + await this.#writeState(state); + await this.#unlinkSlot(record.slot); + await this.#step('old-credential-removed').catch(() => undefined); + return true; }); } async #readState(): Promise { try { - return parseState(await readFile(this.#statePath, 'utf8')); + const state = parseState(await readFile(this.#statePath, 'utf8')); + if (state.version !== 3) throw new Error('Desktop profile store recovery was not completed'); + return state; } catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return emptyState(); throw error; } } - async #writeState(state: PersistedState): Promise { + async #writeState( + state: PersistedState, + isCurrent?: () => boolean, + beginPublish?: () => (() => void) | null, + onPublished?: () => void, + ): Promise { + await this.#ensureDirectories(); + if (!this.security().available) { + if (hasCredentialMaterial(state)) throw new Error(RECOVERY_ERROR); + return this.#writeMetadataState(state, isCurrent, beginPublish, onPublished); + } + const previousGeneration = state.generation; + state.generation = (BigInt(state.generation) + 1n).toString(); + const temporary = `${this.#statePath}.${process.pid}.${randomUUID()}.tmp`; + let releasePublish: (() => void) | undefined; + try { + await this.#io('mirror-write'); + await writeFile(temporary, `${JSON.stringify(state, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 }); + await this.#step('state-written'); + await this.#io('mirror-flush'); + await this.#fsyncFile(temporary); + await this.#step('state-fsynced'); + if (beginPublish) { + const release = beginPublish(); + if (!release) { + state.generation = previousGeneration; + return null; + } + releasePublish = release; + } else if (isCurrent && !isCurrent()) { + state.generation = previousGeneration; + return null; + } + + // The alternating, self-contained journal is the durable commit point. + // It uses a write-through file handle supported by Windows and embeds only + // already OS-encrypted credential bytes, so recovery does not depend on a + // directory flush, rename visibility, or the new slot directory entry. + await this.#writeJournal(state, onPublished); + + // profiles.json is a convenient atomic mirror. Once the journal is synced, + // failure or rollback of this rename cannot make the prior state authoritative. + try { + await this.#io('mirror-replace'); + await rename(temporary, this.#statePath); + await this.#step('state-renamed').catch(() => undefined); + const directoryDurable = await this.#flushDirectoryIfSupported(this.#directory); + if (directoryDurable) await this.#step('state-directory-fsynced').catch(() => undefined); + } catch { + // The journal is authoritative and #recover repairs this mirror before + // the next read or mutation. + } + await chmod(this.#statePath, 0o600).catch(() => undefined); + return true; + } finally { + releasePublish?.(); + await unlink(temporary).catch(() => undefined); + } + } + + /** + * Profiles and selection are non-sensitive. When the OS secret backend is + * unavailable they remain usable through the private atomic mirror, but no + * credential slot or authenticated secret journal may enter this lane. + */ + async #writeMetadataState( + state: PersistedState, + isCurrent?: () => boolean, + beginPublish?: () => (() => void) | null, + onPublished?: () => void, + ): Promise { + const previousGeneration = state.generation; + state.generation = (BigInt(state.generation) + 1n).toString(); + const temporary = `${this.#statePath}.${process.pid}.${randomUUID()}.tmp`; + let releasePublish: (() => void) | undefined; + try { + await this.#io('mirror-write'); + await writeFile(temporary, `${JSON.stringify(state, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 }); + await this.#step('state-written'); + await this.#io('mirror-flush'); + await this.#fsyncFile(temporary); + await this.#step('state-fsynced'); + if (beginPublish) { + const release = beginPublish(); + if (!release) { + state.generation = previousGeneration; + return null; + } + releasePublish = release; + } else if (isCurrent && !isCurrent()) { + state.generation = previousGeneration; + return null; + } + await this.#io('mirror-replace'); + await rename(temporary, this.#statePath); + onPublished?.(); + await this.#step('state-renamed').catch(() => undefined); + const directoryDurable = await this.#flushDirectoryIfSupported(this.#directory); + if (directoryDurable) await this.#step('state-directory-fsynced').catch(() => undefined); + await chmod(this.#statePath, 0o600).catch(() => undefined); + return true; + } finally { + releasePublish?.(); + await unlink(temporary).catch(() => undefined); + } + } + + async #writeJournal(state: PersistedState, onPublished?: () => void): Promise { + const referenced = new Set([ + ...Object.values(state.credentialSlots), + ...Object.values(state.pendingRevocations).map(record => record.slot), + ]); + const encryptedSlots: Record = {}; + for (const slot of referenced) { + encryptedSlots[slot] = (await readFile(join(this.#credentialsDirectory, slot))).toString('base64url'); + } + const payload: JournalPayload = { + version: 1, + state: JSON.parse(JSON.stringify(state)) as PersistedState, + encryptedSlots, + }; + const encryptedPayload = this.#encryption.encrypt(JSON.stringify(payload)).toString('base64url'); + const record: JournalRecord = { + version: 2, + generation: String(state.generation), + encryptedPayload, + checksum: journalChecksum(encryptedPayload), + }; + const path = this.#journalPaths[Number(BigInt(state.generation) % BigInt(this.#journalPaths.length))]; + const preparedContents = `P${JSON.stringify(record)}\n`; + if (Buffer.byteLength(preparedContents) > MAX_JOURNAL_BYTES) { + throw new Error('Desktop transaction journal exceeds its bounded size'); + } + const preparationHandle = await open( + path, + constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC, + 0o600, + ); + try { + await this.#io('journal-write'); + await preparationHandle.writeFile(preparedContents, 'utf8'); + await this.#step('journal-written'); + + await this.#io('journal-flush'); + await preparationHandle.sync(); + await this.#step('journal-fsynced'); + } finally { + await preparationHandle.close(); + } + await this.#step('journal-closed'); + + // Verification deliberately reopens the prepared slot through a writable + // handle and does not use an in-memory authentication cache. The same held + // handle remains bound to the verified bytes through C publication. + await this.#io('journal-reopen'); + const verificationHandle = await open(path, constants.O_RDWR); + try { + await this.#step('journal-reopened'); + const verifiedContents = await this.#readHandleContents(verificationHandle); + await this.#io('journal-verify'); + if (verifiedContents !== preparedContents) throw new Error(RECOVERY_ERROR); + const prepared = await this.#authenticateJournal(verifiedContents, false, false); + if (prepared.generation !== BigInt(state.generation) + || JSON.stringify(prepared.state) !== JSON.stringify(state) + || JSON.stringify(prepared.encryptedSlots) !== JSON.stringify(encryptedSlots)) { + throw new Error(RECOVERY_ERROR); + } + await this.#step('journal-prepared-verified'); + + // Refuse a pathname replacement before the authority transition. The + // marker is nevertheless written through the already verified handle, + // so a same-user same-size/generation replacement can never receive C. + await this.#io('journal-commit'); + await this.#assertHandleStillNamesPath(verificationHandle, path, preparedContents.length); + const written = await verificationHandle.write(Buffer.from('C'), 0, 1, 0); + if (written.bytesWritten !== 1) throw new Error('Desktop transaction journal commit failed'); + // From this point B may be observed after a crash even if the explicit + // flush reports failure. Notify the shared gate before anything fallible + // so the fully verified B credential is never revoked as transient. + onPublished?.(); + await this.#step('journal-committed'); + await this.#io('journal-commit-flush'); + await verificationHandle.sync(); + await this.#step('journal-commit-fsynced'); + const committedContents = await this.#readHandleContents(verificationHandle); + if (committedContents !== `C${preparedContents.slice(1)}`) throw new Error(RECOVERY_ERROR); + const committed = await this.#authenticateJournal(committedContents, true, false); + if (committed.generation !== prepared.generation + || JSON.stringify(committed.state) !== JSON.stringify(prepared.state) + || JSON.stringify(committed.encryptedSlots) !== JSON.stringify(prepared.encryptedSlots)) { + throw new Error(RECOVERY_ERROR); + } + await this.#step('journal-commit-verified'); + } finally { + await verificationHandle.close(); + } + await this.#step('journal-commit-closed'); + await chmod(path, 0o600).catch(() => undefined); + } + + async #readHandleContents(handle: FileHandle): Promise { + const info = await handle.stat({ bigint: true }); + if (info.size > BigInt(MAX_JOURNAL_BYTES) || info.size > BigInt(Number.MAX_SAFE_INTEGER)) { + throw new Error(RECOVERY_ERROR); + } + const bytes = Buffer.alloc(Number(info.size)); + let offset = 0; + while (offset < bytes.length) { + const result = await handle.read(bytes, offset, bytes.length - offset, offset); + if (result.bytesRead === 0) throw new Error(RECOVERY_ERROR); + offset += result.bytesRead; + } + return bytes.toString('utf8'); + } + + async #assertHandleStillNamesPath(handle: FileHandle, path: string, expectedSize: number): Promise { + const [held, named] = await Promise.all([ + handle.stat({ bigint: true }), + lstat(path, { bigint: true }), + ]); + if (named.isSymbolicLink() || !named.isFile() + || held.dev !== named.dev || held.ino !== named.ino + || held.size !== BigInt(expectedSize) || named.size !== held.size + || held.mode !== named.mode || held.uid !== named.uid || held.gid !== named.gid + || held.nlink !== named.nlink || held.nlink !== 1n) { + throw new Error(RECOVERY_ERROR); + } + } + + async #stageCredential(credential: StoredCredential): Promise { + await this.#ensureDirectories(); + const slot = `${credential.profileId}.${randomUUID()}.bin`; + const target = join(this.#credentialsDirectory, slot); + const temporary = `${target}.${process.pid}.${randomUUID()}.tmp`; + try { + const encrypted = this.#encryption.encrypt(JSON.stringify(credential)); + await this.#step('credential-encrypted'); + await this.#io('credential-write'); + await writeFile(temporary, encrypted, { mode: 0o600 }); + await this.#step('credential-written'); + await this.#io('credential-flush'); + await this.#fsyncFile(temporary); + await this.#step('credential-fsynced'); + await this.#io('credential-replace'); + await rename(temporary, target); + await this.#step('credential-renamed'); + const directoryDurable = await this.#flushDirectoryIfSupported(this.#credentialsDirectory); + if (directoryDurable) await this.#step('credential-directory-fsynced'); + await chmod(target, 0o600).catch(() => undefined); + return slot; + } finally { + await unlink(temporary).catch(() => undefined); + } + } + + async #authenticateJournal( + contents: string, + committedOnly: boolean, + useCache = true, + ): Promise { + const marker = contents[0]; + if ((committedOnly && marker !== 'C') || (!committedOnly && marker !== 'P' && marker !== 'C')) { + throw new Error('Desktop transaction journal is incomplete'); + } + const envelope = parseJournalEnvelope(contents.slice(1)); + const cached = useCache ? this.#authenticatedJournalCache.get(envelope.checksum) : undefined; + if (cached) { + if (cached.generation !== BigInt(envelope.generation)) throw new Error(RECOVERY_ERROR); + return { + generation: cached.generation, + state: JSON.parse(JSON.stringify(cached.state)) as PersistedState, + encryptedSlots: { ...cached.encryptedSlots }, + }; + } + let plaintext: string; + try { + plaintext = this.#encryption.decrypt(Buffer.from(envelope.encryptedPayload, 'base64url')); + } catch { + throw new Error('Desktop transaction journal authentication failed'); + } + let raw: unknown; + try { + raw = JSON.parse(plaintext) as unknown; + } catch { + throw new Error('Desktop transaction journal authentication failed'); + } + if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error(RECOVERY_ERROR); + const candidate = raw as Record; + const state = parseState(JSON.stringify(candidate.state)); + if (candidate.version !== 1 || state.version !== 3 + || typeof candidate.encryptedSlots !== 'object' || candidate.encryptedSlots === null + || Array.isArray(candidate.encryptedSlots) + || envelope.generation !== String(state.generation)) throw new Error(RECOVERY_ERROR); + const encryptedSlots = candidate.encryptedSlots as Record; + const referenced = new Set([ + ...Object.values(state.credentialSlots), + ...Object.values(state.pendingRevocations).map(record => record.slot), + ]); + if (Object.keys(encryptedSlots).length !== referenced.size + || Object.keys(encryptedSlots).some(slot => !referenced.has(slot))) throw new Error(RECOVERY_ERROR); + + const authenticatedSlots: Record = {}; + for (const slot of referenced) { + const encoded = encryptedSlots[slot]; + if (typeof encoded !== 'string' || encoded.length === 0 + || encoded.length > Math.ceil(MAX_CREDENTIAL_LENGTH * 2) + || !/^[A-Za-z0-9_-]+$/.test(encoded)) throw new Error(RECOVERY_ERROR); + const bytes = Buffer.from(encoded, 'base64url'); + if (bytes.toString('base64url') !== encoded) throw new Error(RECOVERY_ERROR); + let credential: StoredCredential | null = null; + try { + credential = JSON.parse(this.#encryption.decrypt(bytes)) as StoredCredential; + } catch { + if (!this.#wasPreviouslyAuthenticatedSlot(state, slot, encoded)) throw new Error(RECOVERY_ERROR); + } + const profileId = SLOT_PATTERN.exec(slot)?.[1]; + if (credential && (credential.version !== 1 || credential.profileId !== profileId + || typeof credential.origin !== 'string' + || normalizeApiBaseUrl(credential.origin) !== credential.origin + || typeof credential.token !== 'string' + || !/^propr_it_[A-Za-z0-9_-]{43}$/.test(credential.token))) throw new Error(RECOVERY_ERROR); + const pending = Object.values(state.pendingRevocations).find(record => record.slot === slot); + if (credential && pending + && (pending.profileId !== credential.profileId || pending.origin !== credential.origin)) { + throw new Error(RECOVERY_ERROR); + } + authenticatedSlots[slot] = encoded; + } + const authenticated = { generation: BigInt(envelope.generation), state, encryptedSlots: authenticatedSlots }; + this.#authenticatedJournalCache.set(envelope.checksum, { + generation: authenticated.generation, + state: JSON.parse(JSON.stringify(state)) as PersistedState, + encryptedSlots: { ...authenticatedSlots }, + }); + return authenticated; + } + + #wasPreviouslyAuthenticatedSlot(state: PersistedState, slot: string, encoded: string): boolean { + const currentPending = Object.values(state.pendingRevocations).find(record => record.slot === slot); + const currentProfileId = SLOT_PATTERN.exec(slot)?.[1]; + for (const cached of this.#authenticatedJournalCache.values()) { + if (cached.encryptedSlots[slot] !== encoded) continue; + const priorPending = Object.values(cached.state.pendingRevocations).find(record => record.slot === slot); + if (currentPending && priorPending + && currentPending.profileId === priorPending.profileId + && currentPending.origin === priorPending.origin + && currentPending.credentialGeneration === priorPending.credentialGeneration) return true; + if (currentPending && currentProfileId + && cached.state.credentialSlots[currentProfileId] === slot + && cached.state.credentialEpochs[currentProfileId] === currentPending.credentialGeneration + && cached.state.profiles.find(profile => profile.id === currentProfileId)?.apiBaseUrl + === currentPending.origin) return true; + if (!currentPending && currentProfileId + && state.credentialSlots[currentProfileId] === slot + && cached.state.credentialSlots[currentProfileId] === slot + && state.credentialEpochs[currentProfileId] === cached.state.credentialEpochs[currentProfileId]) return true; + } + return false; + } + + async #recover(): Promise { await this.#ensureDirectories(); - const temporary = `${this.#statePath}.${process.pid}.tmp`; - await writeFile(temporary, `${JSON.stringify(state, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 }); - await rename(temporary, this.#statePath); - await chmod(this.#statePath, 0o600).catch(() => undefined); + if (!this.security().available) { + await this.#recoverMetadataOnly(); + return; + } + const journalRecords: AuthenticatedJournal[] = []; + const legacyJournalRecords: LegacyJournalRecord[] = []; + const preparedJournalRecords: AuthenticatedJournal[] = []; + let invalidCommittedJournal = false; + let invalidPreparedJournal = false; + let sawPreparedJournal = false; + let sawNonPreparedJournal = false; + for (const path of this.#journalPaths) { + try { + const info = await stat(path); + if (info.size > MAX_JOURNAL_BYTES) throw new Error('Desktop transaction journal is invalid'); + const contents = await readFile(path, 'utf8'); + if (contents.startsWith('C') || contents.startsWith('P')) { + if (contents.startsWith('C')) { + sawNonPreparedJournal = true; + try { + journalRecords.push(await this.#authenticateJournal(contents, true)); + } catch { + invalidCommittedJournal = true; + } + } else { + sawPreparedJournal = true; + try { + preparedJournalRecords.push(await this.#authenticateJournal(contents, false, false)); + } catch { + invalidPreparedJournal = true; + } + } + // A prepared record is deliberately not authoritative. The other + // alternating slot (or the legacy mirror before the first commit) + // remains the complete recovery point. + } else { + sawNonPreparedJournal = true; + legacyJournalRecords.push(parseLegacyJournal(contents)); + } + } catch (error) { + const code = (error as NodeJS.ErrnoException).code; + if (code === 'ENOENT') continue; + if (error instanceof SyntaxError + || (error instanceof Error && error.message.startsWith('Desktop transaction journal'))) { + sawNonPreparedJournal = true; + continue; + } + throw new Error(RECOVERY_ERROR); + } + } + journalRecords.sort((left, right) => left.generation < right.generation ? -1 : left.generation > right.generation ? 1 : 0); + const authoritativeJournal = journalRecords.at(-1); + + let parsed: PersistedState | VersionTwoPersistedState | LegacyPersistedState | null = null; + let mirrorMissing = false; + try { + parsed = parseState(await readFile(this.#statePath, 'utf8')); + } catch (error) { + const code = (error as NodeJS.ErrnoException).code; + mirrorMissing = code === 'ENOENT'; + if (code && code !== 'ENOENT') throw new Error(RECOVERY_ERROR); + if (!(error instanceof SyntaxError) + && !(error instanceof Error && error.message.startsWith('Desktop ')) + && !mirrorMissing) throw new Error(RECOVERY_ERROR); + } + + let state: PersistedState; + if (authoritativeJournal) { + state = authoritativeJournal.state; + for (const [slot, encoded] of Object.entries(authoritativeJournal.encryptedSlots)) { + const expectedBytes = Buffer.from(encoded, 'base64url'); + try { + const actualBytes = await readFile(join(this.#credentialsDirectory, slot)); + if (actualBytes.equals(expectedBytes)) continue; + } catch (error) { + if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw new Error(RECOVERY_ERROR); + } + try { + await this.#writeThroughFile(join(this.#credentialsDirectory, slot), expectedBytes); + } catch { + throw new Error(RECOVERY_ERROR); + } + } + const mirrorMatches = parsed?.version === 3 + && JSON.stringify(parsed) === JSON.stringify(state); + if (!mirrorMatches) { + try { + await this.#writeStateMirror(state); + } catch { + throw new Error(RECOVERY_ERROR); + } + } + } else { + if (!parsed) { + const preparedIsOnlyCanonicalEmptyBootstrap = sawPreparedJournal + && !invalidPreparedJournal + && preparedJournalRecords.length > 0 + && preparedJournalRecords.every(record => record.generation === 1n + && JSON.stringify(record.state) === JSON.stringify({ ...emptyState(), generation: '1' }) + && Object.keys(record.encryptedSlots).length === 0); + if (mirrorMissing && !invalidCommittedJournal && legacyJournalRecords.length === 0 + && (!sawPreparedJournal || preparedIsOnlyCanonicalEmptyBootstrap)) { + // An authenticated generation-1 empty P is the one narrow prepared + // bootstrap exception. It is never made authoritative: recovery + // reconstructs empty A and retries publication. Any A-to-B P remains + // ignored and cannot manufacture a missing mirror authority. + parsed = { version: 1, activeProfileId: null, profiles: [] }; + } else { + throw new Error(RECOVERY_ERROR); + } + } + if (invalidCommittedJournal || (sawNonPreparedJournal && legacyJournalRecords.length === 0)) { + throw new Error(RECOVERY_ERROR); + } + if (legacyJournalRecords.length > 0) { + legacyJournalRecords.sort((left, right) => { + const leftGeneration = BigInt(left.state.generation); + const rightGeneration = BigInt(right.state.generation); + return leftGeneration < rightGeneration ? -1 : leftGeneration > rightGeneration ? 1 : 0; + }); + const legacy = legacyJournalRecords.at(-1)!; + if (parsed.version !== 3 || JSON.stringify(parsed) !== JSON.stringify(legacy.state)) { + throw new Error(RECOVERY_ERROR); + } + state = legacy.state; + for (const [slot, encoded] of Object.entries(legacy.encryptedSlots)) { + await this.#writeThroughFile(join(this.#credentialsDirectory, slot), Buffer.from(encoded, 'base64url')); + } + await this.#writeState(state); + } else if (parsed.version === 1) { + state = { + version: 3, + generation: '0', + activeProfileId: parsed.activeProfileId, + profiles: parsed.profiles.map(profile => ({ ...profile })), + credentialSlots: {}, + credentialEpochs: {}, + pendingRevocations: {}, + }; + const entries = await readdir(this.#credentialsDirectory, { withFileTypes: true }); + for (const entry of entries) { + const match = /^([a-zA-Z0-9][a-zA-Z0-9_-]{0,63})\.bin$/.exec(entry.name); + if (!match || !entry.isFile()) continue; + const profileId = match[1]; + const bytes = await readFile(join(this.#credentialsDirectory, entry.name)); + const slot = `${profileId}.${randomUUID()}.bin`; + const slotPath = join(this.#credentialsDirectory, slot); + await writeFile(slotPath, bytes, { mode: 0o600 }); + await this.#fsyncFile(slotPath); + state.credentialSlots[profileId] = slot; + state.credentialEpochs[profileId] = randomBytes(16).toString('base64url'); + } + await this.#flushDirectoryIfSupported(this.#credentialsDirectory); + await this.#writeState(state); + } else if (parsed.version === 2) { + state = { + version: 3, + generation: '0', + activeProfileId: parsed.activeProfileId, + profiles: parsed.profiles.map(profile => ({ ...profile })), + credentialSlots: { ...parsed.credentialSlots }, + credentialEpochs: Object.fromEntries( + Object.keys(parsed.credentialSlots).map(profileId => [profileId, randomBytes(16).toString('base64url')]), + ), + pendingRevocations: {}, + }; + await this.#writeState(state); + } else { + state = parsed; + // A v3 file predating journal creation is migrated into the durable + // write-through protocol before any unreferenced slot cleanup. + await this.#writeState(state); + } + } + + const referenced = new Set([ + ...Object.values(state.credentialSlots), + ...Object.values(state.pendingRevocations).map(record => record.slot), + ]); + const entries = await readdir(this.#credentialsDirectory, { withFileTypes: true }); + for (const entry of entries) { + if (entry.isFile() && entry.name.endsWith('.tmp')) { + await unlink(join(this.#credentialsDirectory, entry.name)); + } + } + const stateEntries = await readdir(this.#directory, { withFileTypes: true }); + for (const entry of stateEntries) { + if (entry.isFile() && /^profiles\.json\..+\.tmp$/.test(entry.name)) { + await unlink(join(this.#directory, entry.name)); + } + } + await this.#flushDirectoryIfSupported(this.#credentialsDirectory); + await this.#flushDirectoryIfSupported(this.#directory); + for (const slot of referenced) { + try { + await readFile(join(this.#credentialsDirectory, slot)); + } catch (error) { + if ((error as NodeJS.ErrnoException).code === 'ENOENT') { + throw new Error('Desktop credential state is incomplete'); + } + throw error; + } + } + for (const entry of entries) { + if (!entry.isFile() || referenced.has(entry.name)) continue; + if (/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}(?:\.[0-9a-f-]{36})?\.bin$/i.test(entry.name)) { + await unlink(join(this.#credentialsDirectory, entry.name)); + } + } + await this.#flushDirectoryIfSupported(this.#credentialsDirectory); + await this.#flushDirectoryIfSupported(this.#directory); + } + + async #recoverMetadataOnly(): Promise { + for (const path of this.#journalPaths) { + try { + await lstat(path); + throw new Error(RECOVERY_ERROR); + } catch (error) { + if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; + } + } + const credentialEntries = await readdir(this.#credentialsDirectory, { withFileTypes: true }); + if (credentialEntries.some(entry => entry.isFile() && !entry.name.endsWith('.tmp'))) { + throw new Error(RECOVERY_ERROR); + } + let parsed: PersistedState | VersionTwoPersistedState | LegacyPersistedState; + try { + parsed = parseState(await readFile(this.#statePath, 'utf8')); + } catch (error) { + if ((error as NodeJS.ErrnoException).code === 'ENOENT') return; + throw new Error(RECOVERY_ERROR); + } + if ((parsed.version === 2 && Object.keys(parsed.credentialSlots).length > 0) + || (parsed.version === 3 && hasCredentialMaterial(parsed))) { + throw new Error(RECOVERY_ERROR); + } + if (parsed.version !== 3) { + const state: PersistedState = { + version: 3, + generation: '0', + activeProfileId: parsed.activeProfileId, + profiles: parsed.profiles.map(profile => ({ ...profile })), + credentialSlots: {}, + credentialEpochs: {}, + pendingRevocations: {}, + }; + await this.#writeMetadataState(state); + } + } + + async #writeStateMirror(state: PersistedState): Promise { + const temporary = `${this.#statePath}.${process.pid}.${randomUUID()}.recovery.tmp`; + try { + await this.#io('mirror-write'); + await writeFile(temporary, `${JSON.stringify(state, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 }); + await this.#io('mirror-flush'); + await this.#fsyncFile(temporary); + await this.#io('mirror-replace'); + await rename(temporary, this.#statePath); + await this.#flushDirectoryIfSupported(this.#directory); + } finally { + await unlink(temporary).catch(() => undefined); + } + } + + async #writeThroughFile(path: string, bytes: Buffer): Promise { + const handle = await open( + path, + constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC, + 0o600, + ); + try { + await this.#io('journal-write'); + await handle.writeFile(bytes); + await this.#io('journal-flush'); + await handle.sync(); + } finally { + await handle.close(); + } + await this.#io('journal-verify'); + if (!(await readFile(path)).equals(bytes)) throw new Error(RECOVERY_ERROR); + } + + async #fsyncFile(path: string): Promise { + await flushFileData(path); + } + + async #fsyncDirectory(path: string): Promise { + const handle = await open(path, 'r'); + try { await handle.sync(); } finally { await handle.close(); } + } + + async #flushDirectoryIfSupported(path: string): Promise { + await this.#io('metadata-flush'); + // Node does not expose a supported Windows directory FlushFileBuffers + // handle. No authority transition depends on it: the committed journal is + // self-contained and can recreate both renamed credential entries and the + // profiles.json mirror. POSIX platforms still require and perform fsync. + if (process.platform === 'win32') return false; + await this.#fsyncDirectory(path); + return true; + } + + async #unlinkSlot(slot: string): Promise { + await unlink(join(this.#credentialsDirectory, slot)).catch(error => { + if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; + }); + } + + #step(step: ProfileStoreDurabilityStep): Promise { + return Promise.resolve(this.#options.afterDurabilityStep?.(step)); + } + + #io(operation: ProfileStoreIOOperation): Promise { + return Promise.resolve(this.#options.beforeIO?.(operation)); } async #ensureDirectories(): Promise { @@ -227,24 +1655,22 @@ export class ProfileStore { await chmod(this.#credentialsDirectory, 0o700).catch(() => undefined); } - #credentialPath(profileId: string): string { - return join(this.#credentialsDirectory, `${profileId}.bin`); - } - #mutate(operation: () => Promise): Promise { - const result = this.#mutation.then(operation, operation); + if (this.#closed) return Promise.reject(new Error('Desktop profile store is closed')); + const recoveredOperation = async () => { + await this.#recover(); + return operation(); + }; + const result = this.#mutation.then(recoveredOperation, recoveredOperation); this.#mutation = result.then(() => undefined, () => undefined); return result; } - #mutateCredential(profileId: string, operation: () => Promise): Promise { - const previous = this.#credentialMutations.get(profileId) ?? Promise.resolve(); - const result = previous.then(operation, operation); - const settled = result.then(() => undefined, () => undefined); - this.#credentialMutations.set(profileId, settled); - void settled.then(() => { - if (this.#credentialMutations.get(profileId) === settled) this.#credentialMutations.delete(profileId); - }); + #metadata(operation: () => Promise): Promise { + if (this.#closed) return Promise.reject(new Error('Desktop profile store is closed')); + const result = this.#mutation.then(operation, operation); + this.#mutation = result.then(() => undefined, () => undefined); return result; } + } diff --git a/apps/desktop/src/release-workflow.test.ts b/apps/desktop/src/release-workflow.test.ts index 13f7ca1a1..c59929645 100644 --- a/apps/desktop/src/release-workflow.test.ts +++ b/apps/desktop/src/release-workflow.test.ts @@ -242,8 +242,8 @@ describe('desktop trusted release workflow', () => { assert.match(section, /- platform: darwin\n\s+arch: arm64\n\s+runner: macos-15/, `${jobName} is missing native macOS arm64`); assert.match( section, - /- name: Typecheck and test (?:unsigned|production) desktop runtime\n\s+shell: bash\n\s+run: \|\n\s+npm run desktop:typecheck\n\s+npm run desktop:test/, - `${jobName} must run the complete desktop tests without a platform condition`, + /- name: Typecheck and test (?:unsigned|production) desktop runtime\n\s+shell: bash\n\s+run: \|\n\s+npm run desktop:typecheck\n\s+npm run test:native-durability -w @propr\/desktop\n\s+npm run desktop:test/, + `${jobName} must run the native durability gate and complete desktop tests without a platform condition`, ); assert.match(section, /Prove private-snapshot native DMG mounting is available/); assert.match(section, /release-artifacts\.mjs probe-dmg-private-snapshot-isolation/); diff --git a/apps/desktop/src/secret-redaction.test.ts b/apps/desktop/src/secret-redaction.test.ts new file mode 100644 index 000000000..be9af9152 --- /dev/null +++ b/apps/desktop/src/secret-redaction.test.ts @@ -0,0 +1,39 @@ +import assert from 'node:assert/strict'; +import { describe, it } from 'node:test'; +import { redactDesktopValue } from './secret-redaction'; + +describe('desktop secret boundary redaction', () => { + it('redacts credentials, key material and paths, authorization, and environment assignments recursively', () => { + const value = redactDesktopValue({ + tokenLine: 'token=ghp_1234567890abcdef', + authorizationLine: 'Authorization: Bearer relay-credential-value', + environment: 'GH_WEBHOOK_SECRET=webhook-value HOST_GH_PRIVATE_KEY=/home/me/github-app.pem', + docker: 'HostConfig.Binds=["/mnt/runtime/propr-data:/var/lib/propr"] SAFE_MODE=development', + key: '-----BEGIN PRIVATE KEY-----\nprivate-key-content\n-----END PRIVATE KEY-----', + nested: new Error('failed at /home/me/keys/github-app.pem'), + }); + const serialized = JSON.stringify(value); + for (const secret of ['ghp_1234567890abcdef', 'relay-credential-value', 'webhook-value', '/home/me/github-app.pem', '/mnt/runtime/propr-data', 'development', 'private-key-content']) { + assert.doesNotMatch(serialized, new RegExp(secret.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))); + } + assert.match(serialized, /REDACTED/); + }); + + it('supports exact contextual redaction for unstructured webhook secrets and private-key paths', () => { + const secret = 'w3bh00k-16chars!'; + assert.equal(secret.length, 16); + const path = '/secure/custom-name.bin'; + const serialized = JSON.stringify(redactDesktopValue(new Error(`${secret} ${path}`), 0, [secret, path])); + assert.doesNotMatch(serialized, /w3bh00k-16chars|custom-name/); + assert.match(serialized, /\"name\":\"Error\"/); + assert.match(serialized, /\"message\":\"\[REDACTED\] \[REDACTED\]\"/); + assert.match(serialized, /\"stack\":/); + }); + + it('does not globally redact one-character contextual strings', () => { + const redacted = redactDesktopValue(new Error('x remains diagnostic context'), 0, ['x']) as Record; + assert.equal(redacted.name, 'Error'); + assert.equal(redacted.message, 'x remains diagnostic context'); + assert.equal(typeof redacted.stack, 'string'); + }); +}); diff --git a/apps/desktop/src/secret-redaction.ts b/apps/desktop/src/secret-redaction.ts new file mode 100644 index 000000000..ce1ddb842 --- /dev/null +++ b/apps/desktop/src/secret-redaction.ts @@ -0,0 +1,43 @@ +const REDACTED = '[REDACTED]'; +const REDACTED_PATH = '[REDACTED_PATH]'; + +const redactString = (value: string): string => value + .replace(/-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/gi, REDACTED) + .replace(/\bBearer\s+[^\s,;"']+/gi, `Bearer ${REDACTED}`) + .replace(/\bgh[pousr]_[A-Za-z0-9_]{8,}\b/g, REDACTED) + .replace(/\b((?:authorization|token|secret|password|private[_-]?key|webhook[_-]?secret)\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi, `$1${REDACTED}`) + .replace(/\b((?:GH|GITHUB|PROPR|HOST)_[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY)[A-Z0-9_]*\s*=\s*)(?:"[^"]*"|'[^']*'|[^\s]+)/g, `$1${REDACTED}`) + .replace(/\b([A-Z][A-Z0-9_]{1,63}\s*=\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/g, `$1${REDACTED}`) + .replace(/(?:\/[A-Za-z0-9._~ -]+)+\/(?:[^\s"']*?(?:private[-_]?key|github[-_]?app)[^\s"']*|[^\s"']+\.(?:pem|key))\b/gi, REDACTED) + .replace(/(^|[\s"'(=:[,{])\/(?!\/)[^\s"'(),;\]}]+/g, `$1${REDACTED_PATH}`) + .replace(/(^|[\s"'(=])[A-Za-z]:\\(?:[^\s"')]+\\)*[^\s"')]+/g, `$1${REDACTED_PATH}`); + +export const redactDesktopText = (value: string, secrets: readonly string[] = []): string => { + let redacted = value; + for (const secret of secrets) { + if (secret.length >= 3) redacted = redacted.split(secret).join(REDACTED); + } + return redactString(redacted).slice(0, 8_192); +}; + +export const redactDesktopValue = (value: unknown, depth = 0, secrets: readonly string[] = []): unknown => { + if (depth > 12) return '[TRUNCATED]'; + if (typeof value === 'string') return redactDesktopText(value, secrets); + if (value instanceof Error) { + return { + name: redactDesktopText(value.name, secrets), + message: redactDesktopText(value.message, secrets), + stack: value.stack ? redactDesktopText(value.stack, secrets) : undefined, + }; + } + if (Array.isArray(value)) return value.slice(0, 500).map(item => redactDesktopValue(item, depth + 1, secrets)); + if (value && typeof value === 'object') { + return Object.fromEntries(Object.entries(value as Record).slice(0, 500).map(([key, item]) => [ + key, + /(?:authorization|token|secret|password|private.?key)/i.test(key) ? REDACTED : redactDesktopValue(item, depth + 1, secrets), + ])); + } + return value; +}; + +export const safeRendererError = 'Local setup failed unexpectedly. Review the protected desktop log for details.'; diff --git a/apps/desktop/src/secure-secret-prompt.test.ts b/apps/desktop/src/secure-secret-prompt.test.ts new file mode 100644 index 000000000..5ffa64b48 --- /dev/null +++ b/apps/desktop/src/secure-secret-prompt.test.ts @@ -0,0 +1,34 @@ +import assert from 'node:assert/strict'; +import { chmod, mkdtemp, writeFile } from 'node:fs/promises'; +import { tmpdir } from 'node:os'; +import { delimiter, join } from 'node:path'; +import { describe, it } from 'node:test'; +import { promptForWebhookSecret } from './secure-secret-prompt'; +import { MIN_WEBHOOK_SECRET_LENGTH } from './webhook-secret-policy'; + +describe('secure native webhook-secret prompt', { + skip: process.platform === 'win32' + ? 'The guided native secret prompt is POSIX-only; Windows desktop is remote-only.' + : false, +}, () => { + it('rejects 15 characters and accepts the shortest 16-character secret', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-secret-prompt-')); + const executable = join(directory, 'zenity'); + await writeFile(executable, '#!/usr/bin/env node\nprocess.stdout.write(process.env.PROPR_TEST_WEBHOOK_SECRET ?? "");\n', { mode: 0o700 }); + await chmod(executable, 0o700); + const previousPath = process.env.PATH; + const previousSecret = process.env.PROPR_TEST_WEBHOOK_SECRET; + process.env.PATH = `${directory}${delimiter}${previousPath ?? ''}`; + try { + process.env.PROPR_TEST_WEBHOOK_SECRET = 'a'.repeat(MIN_WEBHOOK_SECRET_LENGTH - 1); + await assert.rejects(promptForWebhookSecret(), /invalid value/); + process.env.PROPR_TEST_WEBHOOK_SECRET = 'b'.repeat(MIN_WEBHOOK_SECRET_LENGTH); + assert.equal(await promptForWebhookSecret(), 'b'.repeat(MIN_WEBHOOK_SECRET_LENGTH)); + } finally { + if (previousPath === undefined) delete process.env.PATH; + else process.env.PATH = previousPath; + if (previousSecret === undefined) delete process.env.PROPR_TEST_WEBHOOK_SECRET; + else process.env.PROPR_TEST_WEBHOOK_SECRET = previousSecret; + } + }); +}); diff --git a/apps/desktop/src/secure-secret-prompt.ts b/apps/desktop/src/secure-secret-prompt.ts new file mode 100644 index 000000000..3825d99a6 --- /dev/null +++ b/apps/desktop/src/secure-secret-prompt.ts @@ -0,0 +1,51 @@ +import { spawn } from 'node:child_process'; +import { isValidWebhookSecret } from './webhook-secret-policy'; + +interface PromptCommand { + command: string; + args: string[]; +} + +const commands: PromptCommand[] = [ + { command: 'zenity', args: ['--password', '--title=ProPR Desktop', '--text=Enter the GitHub webhook signing secret'] }, + { command: 'kdialog', args: ['--password', 'Enter the GitHub webhook signing secret', '--title', 'ProPR Desktop'] }, +]; + +const runPrompt = ({ command, args }: PromptCommand, signal?: AbortSignal): Promise<{ unavailable: boolean; value: string | null }> => + new Promise((resolve, reject) => { + signal?.throwIfAborted(); + const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }); + let output = Buffer.alloc(0); + const abort = () => { + child.kill('SIGKILL'); + reject(signal?.reason instanceof Error ? signal.reason : Object.assign(new Error('The native secret prompt was cancelled.'), { name: 'AbortError' })); + }; + signal?.addEventListener('abort', abort, { once: true }); + child.once('close', () => signal?.removeEventListener('abort', abort)); + child.stdout.on('data', (chunk: Buffer) => { + output = Buffer.concat([output, chunk]); + if (output.length > 2048) child.kill('SIGKILL'); + }); + child.once('error', error => { + if ((error as NodeJS.ErrnoException).code === 'ENOENT') resolve({ unavailable: true, value: null }); + else reject(new Error('The native secret prompt failed.')); + }); + child.once('close', code => { + if (code === 1) return resolve({ unavailable: false, value: null }); + if (code !== 0 || output.length > 2048) return reject(new Error('The native secret prompt failed.')); + const value = output.toString('utf8').replace(/[\r\n]+$/, ''); + if (!isValidWebhookSecret(value)) return reject(new Error('The native secret prompt returned an invalid value.')); + resolve({ unavailable: false, value }); + }); + }); + +/** Acquire a one-shot secret in Electron main without sending its bytes through renderer IPC. */ +export async function promptForWebhookSecret(signal?: AbortSignal): Promise { + signal?.throwIfAborted(); + for (const command of commands) { + const result = await runPrompt(command, signal); + signal?.throwIfAborted(); + if (!result.unavailable) return result.value; + } + throw new Error('No supported native secret prompt is installed. Install zenity or kdialog and try again.'); +} diff --git a/apps/desktop/src/security.test.ts b/apps/desktop/src/security.test.ts index 0a88499f1..437a8ab41 100644 --- a/apps/desktop/src/security.test.ts +++ b/apps/desktop/src/security.test.ts @@ -3,6 +3,7 @@ import { describe, it } from 'node:test'; import { deepLinkFromArguments, applyDevelopmentRendererCsp, + connectApiBaseUrlFromDeepLink, dashboardPathFromDeepLink, isSafeExternalUrl, isTrustedRendererUrl, @@ -15,7 +16,7 @@ import { describe('desktop URL security', () => { it('only accepts HTTPS and loopback HTTP API endpoints', () => { - assert.equal(normalizeApiBaseUrl('https://propr.example.com///'), 'https://propr.example.com'); + assert.equal(normalizeApiBaseUrl('https://propr.example.com///'), null); assert.equal(normalizeApiBaseUrl('http://localhost:4000/'), 'http://localhost:4000'); assert.equal(normalizeApiBaseUrl('http://127.0.0.1:4000'), 'http://127.0.0.1:4000'); assert.equal(normalizeApiBaseUrl('http://[::1]:4000/'), 'http://[::1]:4000'); @@ -73,6 +74,10 @@ describe('desktop URL security', () => { assert.equal(normalizeDeepLink('propr://delete-everything'), null); assert.equal(normalizeDeepLink('https://propr.example.com'), null); assert.equal(normalizeDeepLink('propr://user:secret@connect'), null); + assert.equal(connectApiBaseUrlFromDeepLink(link), 'https://propr.example.com'); + assert.equal(normalizeDeepLink('propr://connect?api=http%3A%2F%2Fexample.com'), null); + assert.equal(normalizeDeepLink('propr://connect?api=https%3A%2F%2Fpropr.example.com&token=secret'), null); + assert.equal(normalizeDeepLink('propr://connect?api=https%3A%2F%2Fuser%3Asecret%40propr.example.com'), null); }); it('accepts a normal internal dashboard route from an open deep link', () => { @@ -150,8 +155,7 @@ describe('desktop URL security', () => { assert.match(policy, /frame-src 'none'/); assert.doesNotMatch(policy, /unsafe-eval/); assert.match(policy, /script-src 'self'(?:;|$)/); - assert.match(policy, /http:\/\/\[::1\]:\*/); - assert.match(policy, /ws:\/\/\[::1\]:\*/); + assert.match(policy, /connect-src 'self' https: http: ws: wss:/); }); it('relaxes inline scripts only while Vite serves the development renderer', () => { diff --git a/apps/desktop/src/security.ts b/apps/desktop/src/security.ts index 8b1695840..94d1a3c69 100644 --- a/apps/desktop/src/security.ts +++ b/apps/desktop/src/security.ts @@ -1,7 +1,9 @@ import { DESKTOP_PROTOCOL } from './shared/contract'; - -// WHATWG URL.hostname retains brackets around IPv6 literals. -const LOOPBACK_HOSTS = new Set(['127.0.0.1', '[::1]', 'localhost']); +import { + canonicalProprHttpUrlOrigin, + isProprLoopbackHostname, + normalizeProprApiOrigin, +} from '@propr/shared'; const DEEP_LINK_ACTIONS = new Set(['connect', 'open']); const DESKTOP_DASHBOARD_ORIGIN = 'https://desktop.propr.invalid'; const RESERVED_DASHBOARD_PARAMETERS = new Set([ @@ -93,27 +95,39 @@ export const dashboardPathFromDeepLink = (value: string): string | null => { return normalizeDesktopDashboardPath(entries[0][1]); }; +export const connectApiBaseUrlFromDeepLink = (value: string): string | null => { + if (value.length > 2_048 || /[\u0000-\u001F\u007F]/.test(value)) return null; + const url = parseUrl(value); + if ( + !url + || url.protocol !== `${DESKTOP_PROTOCOL}:` + || url.hostname !== 'connect' + || hasCredentials(url) + || url.port + || url.hash + || (url.pathname !== '' && url.pathname !== '/') + ) return null; + const entries = [...url.searchParams.entries()]; + if (entries.length !== 1 || entries[0][0] !== 'api') return null; + return normalizeApiBaseUrl(entries[0][1]); +}; + export const normalizeApiBaseUrl = (value: string): string | null => { - const url = parseUrl(value.trim()); - if (!url || hasCredentials(url) || url.hash || url.search) return null; - if (url.protocol === 'http:' && !LOOPBACK_HOSTS.has(url.hostname)) return null; - if (url.protocol !== 'http:' && url.protocol !== 'https:') return null; - if (url.pathname.replace(/\//g, '') !== '') return null; - return url.origin; + return normalizeProprApiOrigin(value); }; export const isSafeExternalUrl = (value: string): boolean => { const url = parseUrl(value); if (!url || hasCredentials(url)) return false; - return url.protocol === 'https:' - || (url.protocol === 'http:' && LOOPBACK_HOSTS.has(url.hostname)); + return canonicalProprHttpUrlOrigin(value) === url.origin; }; export const validatedDevServerUrl = (value: string | undefined): URL | null => { if (!value) return null; const url = parseUrl(value); - if (!url || url.protocol !== 'http:' || !LOOPBACK_HOSTS.has(url.hostname) || hasCredentials(url)) return null; + if (!url || url.protocol !== 'http:' || !isProprLoopbackHostname(url.hostname) || hasCredentials(url)) return null; if (url.pathname !== '/' || url.search || url.hash) return null; + if (canonicalProprHttpUrlOrigin(value) !== url.origin) return null; return url; }; @@ -125,7 +139,11 @@ export const isTrustedRendererUrl = ( const candidateUrl = parseUrl(candidate); if (!candidateUrl) return false; const devUrl = validatedDevServerUrl(devServerUrl); - if (devUrl) return candidateUrl.origin === devUrl.origin; + if (devUrl) { + return !hasCredentials(candidateUrl) + && canonicalProprHttpUrlOrigin(candidate) === candidateUrl.origin + && candidateUrl.origin === devUrl.origin; + } const packagedUrl = parseUrl(packagedRendererUrl); if (!packagedUrl || hasCredentials(candidateUrl) || candidateUrl.search) return false; return candidateUrl.protocol === packagedUrl.protocol @@ -140,6 +158,8 @@ export const normalizeDeepLink = (value: string): string | null => { if (!DEEP_LINK_ACTIONS.has(url.hostname) || url.port || url.hash) return null; const dashboardPath = url.hostname === 'open' ? dashboardPathFromDeepLink(value) : null; if (url.hostname === 'open' && dashboardPath === null) return null; + const connectApiBaseUrl = url.hostname === 'connect' ? connectApiBaseUrlFromDeepLink(value) : null; + if (url.hostname === 'connect' && connectApiBaseUrl === null) return null; const canonicalCandidate = url.href; if (canonicalCandidate.length > 2_048 || /[\u0000-\u001F\u007F]/.test(canonicalCandidate)) return null; @@ -147,6 +167,10 @@ export const normalizeDeepLink = (value: string): string | null => { url.hostname === 'open' && dashboardPathFromDeepLink(canonicalCandidate) !== dashboardPath ) return null; + if ( + url.hostname === 'connect' + && connectApiBaseUrlFromDeepLink(canonicalCandidate) !== connectApiBaseUrl + ) return null; return canonicalCandidate; }; @@ -164,7 +188,9 @@ export const rendererContentSecurityPolicy = (development = false): string => [ "style-src 'self' 'unsafe-inline'", "img-src 'self' data: blob: https:", "font-src 'self' data:", - "connect-src 'self' https: http://127.0.0.1:* http://[::1]:* http://localhost:* ws://127.0.0.1:* ws://[::1]:* ws://localhost:* wss:", + // Electron main applies the shared canonical origin rule before any request; + // scheme sources are required here because CSP cannot express IPv4 127/8. + "connect-src 'self' https: http: ws: wss:", "object-src 'none'", "base-uri 'none'", "form-action 'none'", diff --git a/apps/desktop/src/setup-capabilities.ts b/apps/desktop/src/setup-capabilities.ts new file mode 100644 index 000000000..808ff1662 --- /dev/null +++ b/apps/desktop/src/setup-capabilities.ts @@ -0,0 +1,387 @@ +import { randomBytes } from 'node:crypto'; +import { + closeSync, + constants, + fchmodSync, + fstatSync, + lstatSync, + mkdirSync, + openSync, + readFileSync, + realpathSync, + unlinkSync, + type BigIntStats, +} from 'node:fs'; +import { lstat, realpath, stat } from 'node:fs/promises'; +import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'; +import { + ensurePrivateDirectory, + writePrivateFileAtomic, +} from '@propr/local-setup'; +import type { DesktopFilesystemSelection, DesktopSecretSelection } from './shared/contract'; +import type { SetupActions } from '@propr/local-setup'; +import { isValidWebhookSecret } from './webhook-secret-policy'; + +type SelectionKind = 'private-key'; + +interface SelectionRecord { + kind: SelectionKind; + sessionId: string; + originalPath: string; + canonicalPath: string; + device: bigint; + inode: bigint; + expiresAt: number; +} + +interface SecretRecord { + sessionId: string; + value: string; + expiresAt: number; +} + +const MAX_KEY_BYTES = 1024 * 1024; +const TTL_MS = 5 * 60_000; +const O_CLOEXEC = (constants as unknown as Record).O_CLOEXEC ?? (process.platform === 'linux' ? 0o2000000 : 0); + +export class SetupCapabilityError extends Error { + constructor(message = 'The selected file, directory, or secret is no longer approved. Select it again.') { + super(message); + this.name = 'SetupCapabilityError'; + } +} + +const safePath = (value: string): string => { + if (!isAbsolute(value) || value.includes('\0')) throw new SetupCapabilityError(); + return resolve(value); +}; + +const assertOwner = (uid: bigint): void => { + if (typeof process.getuid === 'function' && uid !== BigInt(process.getuid())) throw new SetupCapabilityError('The selection must be owned by the current user.'); +}; + +export class RootDirectoryAuthority { + readonly path: string; + readonly #privateBoundary: string; + readonly #descriptor: number; + readonly #device: bigint; + readonly #inode: bigint; + readonly #operationPath: string; + #closed = false; + + private constructor(path: string, privateBoundary: string, descriptor: number, device: bigint, inode: bigint) { + this.path = path; + this.#privateBoundary = privateBoundary; + this.#descriptor = descriptor; + this.#device = device; + this.#inode = inode; + this.#operationPath = `/proc/${process.pid}/fd/${descriptor}`; + } + + static open(path: string, create = false, privateBoundary = dirname(path)): RootDirectoryAuthority { + const canonical = safePath(path); + const boundary = safePath(privateBoundary); + ensurePrivateAncestry(boundary, canonical, create); + const descriptor = openSync(canonical, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW | O_CLOEXEC); + try { + const info = fstatSync(descriptor, { bigint: true }); + if (!info.isDirectory()) throw new SetupCapabilityError('The approved setup root is not a directory.'); + assertOwner(info.uid); + return new RootDirectoryAuthority(canonical, boundary, descriptor, info.dev, info.ino); + } catch (error) { + closeSync(descriptor); + throw error; + } + } + + validate(): void { + if (this.#closed) throw new SetupCapabilityError('The setup directory authority expired. Select it again.'); + ensurePrivateAncestry(this.#privateBoundary, this.path, false); + const anchored = fstatSync(this.#descriptor, { bigint: true }); + let current; + try { current = lstatSync(this.path, { bigint: true }); } catch { + throw new SetupCapabilityError('The selected setup directory changed. Select it again.'); + } + if (!anchored.isDirectory() || !current.isDirectory() || current.isSymbolicLink() + || anchored.dev !== this.#device || anchored.ino !== this.#inode + || current.dev !== this.#device || current.ino !== this.#inode + || realpathSync(this.path) !== this.path) { + throw new SetupCapabilityError('The selected setup directory changed. Select it again.'); + } + assertOwner(current.uid); + for (const name of ['.env', 'data', 'logs', 'repos']) { + const child = join(this.#operationPath, name); + let info; + try { info = lstatSync(child, { bigint: true }); } catch (error) { + if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue; + throw error; + } + if (info.isSymbolicLink()) throw new SetupCapabilityError('The setup directory contains an unsafe managed path.'); + assertOwner(info.uid); + if (name === '.env') { + if (!info.isFile() || info.nlink !== 1n) throw new SetupCapabilityError('The setup environment must be a non-linked regular file.'); + enforceModeNoFollow(child, info, 0o600, false); + } else { + const anchoredRoot = realpathSync(this.#operationPath); + const childRelative = relative(anchoredRoot, realpathSync(child)); + if (!info.isDirectory() || childRelative.startsWith('..') || isAbsolute(childRelative)) { + throw new SetupCapabilityError('The setup directory contains an unsafe managed path.'); + } + enforceModeNoFollow(child, info, 0o700, true); + } + } + } + + /** Stable main-process-only path for descriptor-relative managed operations. */ + operationPath(): string { + this.validate(); + return this.#operationPath; + } + + close(): void { + if (this.#closed) return; + this.#closed = true; + closeSync(this.#descriptor); + } +} + +/** + * Establish and revalidate the fixed runtime root beneath Electron's app-data + * boundary. Every app-owned component is an owner-only real directory; links + * and path replacement are rejected before a Docker lifecycle handoff. + */ +function ensurePrivateAncestry(boundaryPath: string, rootPath: string, create: boolean): void { + const boundary = resolve(boundaryPath); + const root = resolve(rootPath); + const suffix = relative(boundary, root); + if (!suffix || suffix.startsWith('..') || isAbsolute(suffix)) throw new SetupCapabilityError('The fixed setup root is outside the app-data boundary.'); + const components = suffix ? suffix.split(sep).filter(Boolean) : []; + let cursor = boundary; + const paths = [boundary, ...components.map(component => (cursor = join(cursor, component)))]; + for (let index = 0; index < paths.length; index += 1) { + const current = paths[index]; + let info; + try { + info = lstatSync(current, { bigint: true }); + } catch (error) { + if (!create || (error as NodeJS.ErrnoException).code !== 'ENOENT' || index === 0) throw error; + mkdirSync(current, { mode: 0o700 }); + info = lstatSync(current, { bigint: true }); + } + if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(current) !== current) { + throw new SetupCapabilityError('The fixed setup root ancestry must contain only real directories.'); + } + assertOwner(info.uid); + enforceModeNoFollow(current, info, 0o700, true); + } +} + +function enforceModeNoFollow( + path: string, + expected: BigIntStats, + mode: number, + directory: boolean, +): void { + const descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | O_CLOEXEC | (directory ? constants.O_DIRECTORY : 0)); + try { + const opened = fstatSync(descriptor, { bigint: true }); + if (opened.dev !== expected.dev || opened.ino !== expected.ino + || (directory ? !opened.isDirectory() : !opened.isFile())) { + throw new SetupCapabilityError('The fixed setup root identity changed during validation.'); + } + assertOwner(opened.uid); + if ((opened.mode & 0o777n) !== BigInt(mode)) fchmodSync(descriptor, mode); + } finally { + closeSync(descriptor); + } +} + +/** + * Bind setup host actions to the held Linux directory descriptor. Only display + * paths cross the setup engine; host I/O receives the descriptor-rooted path, + * and Docker gets a fresh authority assertion at each container handoff. + */ +export function bindRootOperations( + actions: SetupActions, + displayRoot: string, + authority: RootDirectoryAuthority, +): SetupActions { + const guard = () => authority.validate(); + const operationRoot = authority.operationPath(); + const mapPath = (value: string, from: string, to: string): string => value === from || value.startsWith(`${from}${sep}`) + ? `${to}${value.slice(from.length)}` + : value; + const transform = (value: unknown, from: string, to: string): unknown => { + if (typeof value === 'string') return mapPath(value, from, to); + if (typeof value === 'function') { + return (...args: unknown[]) => Reflect.apply(value, undefined, args.map(argument => transform(argument, to, from))); + } + if (Array.isArray(value)) return value.map(item => transform(item, from, to)); + if (value && typeof value === 'object' && Object.getPrototypeOf(value) === Object.prototype) { + return Object.fromEntries(Object.entries(value as Record).map(([key, item]) => [key, transform(item, from, to)])); + } + return value; + }; + const descriptorActions = new Set([ + 'runChecks', + 'inspectStackInit', + 'inspectDatastoreAdministrators', + 'scaffoldStack', + 'readEnvVars', + 'applyEnvSelection', + 'clearEnvKeys', + 'detectGithubAuthMode', + 'prepareAgentCredentialDir', + ]); + const rootedObjectActions = new Set(['pullImages', 'checkBackendHealth']); + const rootedTrailingOptionIndex = new Map([ + ['isStackRunning', 2], + ['addRepository', 3], + ['resolveUiUrl', 2], + ['saveWhitelistSetting', 3], + ['listAgents', 2], + ['addAgent', 3], + ['loginAgent', 3], + ['validateAgents', 3], + ]); + const toOperation = (value: unknown) => transform(value, displayRoot, operationRoot); + const toDisplay = (value: unknown) => transform(value, operationRoot, displayRoot); + return new Proxy(actions, { + get(target, property, receiver) { + const value = Reflect.get(target, property, receiver); + if (typeof value !== 'function') return value; + return (...args: unknown[]) => { + guard(); + const descriptorRelative = typeof property === 'string' && descriptorActions.has(property); + const operationArgs = descriptorRelative ? args.map(toOperation) : args; + if (typeof property === 'string' && rootedObjectActions.has(property) && operationArgs[0] && typeof operationArgs[0] === 'object') { + operationArgs[0] = { ...(operationArgs[0] as Record), rootOperationsDir: operationRoot, assertRootAuthority: guard }; + } + const trailingIndex = typeof property === 'string' ? rootedTrailingOptionIndex.get(property) : undefined; + if (trailingIndex !== undefined) { + operationArgs[trailingIndex] = { ...((operationArgs[trailingIndex] as Record | undefined) ?? {}), rootOperationsDir: operationRoot, assertRootAuthority: guard }; + } + if (property === 'startStack' && operationArgs[0] && typeof operationArgs[0] === 'object') { + operationArgs[0] = { ...(operationArgs[0] as Record), rootOperationsDir: operationRoot, assertRootAuthority: guard }; + } + const result = Reflect.apply(value, target, operationArgs); + if (result && typeof (result as PromiseLike).then === 'function') { + return Promise.resolve(result).then( + output => { guard(); return toDisplay(output); }, + error => { guard(); throw error; }, + ); + } + guard(); + return toDisplay(result); + }; + }, + }); +} + +export class SetupSecretCapabilities { + readonly #records = new Map(); + readonly #now: () => number; + + constructor(now: () => number = Date.now) { this.#now = now; } + + issue(sessionId: string, value: string): DesktopSecretSelection { + if (!isValidWebhookSecret(value)) throw new SetupCapabilityError('The webhook secret is invalid.'); + const capability = randomBytes(32).toString('base64url'); + this.#records.set(capability, { sessionId, value, expiresAt: this.#now() + TTL_MS }); + return { capability, label: 'Secret entered' }; + } + + validate(capability: string, sessionId: string): void { + const record = this.#records.get(capability); + if (!record || record.sessionId !== sessionId || record.expiresAt < this.#now() || !isValidWebhookSecret(record.value)) { + throw new SetupCapabilityError(); + } + } + + consume(capability: string, sessionId: string): string { + this.validate(capability, sessionId); + const record = this.#records.get(capability)!; + this.#records.delete(capability); + return record.value; + } + + clear(): void { this.#records.clear(); } +} + +export class SetupFilesystemCapabilities { + readonly #records = new Map(); + readonly #now: () => number; + + constructor(now: () => number = Date.now) { this.#now = now; } + + async issue(kind: SelectionKind, sessionId: string, selectedPath: string, signal?: AbortSignal): Promise { + signal?.throwIfAborted(); + const originalPath = safePath(selectedPath); + const before = await lstat(originalPath, { bigint: true }); + signal?.throwIfAborted(); + if (before.isSymbolicLink()) throw new SetupCapabilityError('Symbolic-link selections are not allowed.'); + if (!before.isFile()) throw new SetupCapabilityError(); + assertOwner(before.uid); + if ((before.mode & 0o077n) !== 0n) throw new SetupCapabilityError('The private-key file must not be accessible by group or other users.'); + if (before.nlink !== 1n || before.size <= 0n || before.size > BigInt(MAX_KEY_BYTES)) throw new SetupCapabilityError('The private-key file size or link count is invalid.'); + const canonicalPath = await realpath(originalPath); + signal?.throwIfAborted(); + if (canonicalPath !== originalPath) throw new SetupCapabilityError('Selections containing symbolic links are not allowed.'); + const canonical = await stat(canonicalPath, { bigint: true }); + signal?.throwIfAborted(); + if (canonical.dev !== before.dev || canonical.ino !== before.ino) throw new SetupCapabilityError(); + const capability = randomBytes(32).toString('base64url'); + signal?.throwIfAborted(); + this.#records.set(capability, { kind, sessionId, originalPath, canonicalPath, device: before.dev, inode: before.ino, expiresAt: this.#now() + TTL_MS }); + return { capability, label: basename(canonicalPath) }; + } + + #take(capability: string, kind: SelectionKind, sessionId: string): SelectionRecord { + const record = this.#records.get(capability); + this.#records.delete(capability); + if (!record || record.kind !== kind || record.sessionId !== sessionId || record.expiresAt < this.#now()) throw new SetupCapabilityError(); + return record; + } + + async validate(capability: string, kind: SelectionKind, sessionId: string): Promise { + const record = this.#records.get(capability); + if (!record || record.kind !== kind || record.sessionId !== sessionId || record.expiresAt < this.#now()) throw new SetupCapabilityError(); + const current = await lstat(record.originalPath, { bigint: true }).catch(() => null); + if (!current || current.isSymbolicLink() || current.dev !== record.device || current.ino !== record.inode + || !current.isFile()) throw new SetupCapabilityError(); + if (await realpath(record.originalPath) !== record.canonicalPath) throw new SetupCapabilityError(); + if ((current.mode & 0o077n) !== 0n || current.nlink !== 1n || current.size <= 0n || current.size > BigInt(MAX_KEY_BYTES)) throw new SetupCapabilityError(); + return record.canonicalPath; + } + + async consumePrivateKey(capability: string, sessionId: string, keyStorageDir: string, signal?: AbortSignal): Promise { + signal?.throwIfAborted(); + const record = this.#take(capability, 'private-key', sessionId); + signal?.throwIfAborted(); + ensurePrivateDirectory(keyStorageDir); + signal?.throwIfAborted(); + const descriptor = openSync(record.originalPath, constants.O_RDONLY | constants.O_NOFOLLOW | O_CLOEXEC); + try { + const current = fstatSync(descriptor, { bigint: true }); + if (!current.isFile() || current.dev !== record.device || current.ino !== record.inode || current.nlink !== 1n + || current.uid !== BigInt(process.getuid?.() ?? Number(current.uid)) || (current.mode & 0o077n) !== 0n + || current.size <= 0n || current.size > BigInt(MAX_KEY_BYTES)) throw new SetupCapabilityError(); + const bytes = readFileSync(descriptor); + const ownedPath = join(resolve(keyStorageDir), `${randomBytes(24).toString('hex')}.pem`); + signal?.throwIfAborted(); + writePrivateFileAtomic(ownedPath, bytes, { signal }); + try { + signal?.throwIfAborted(); + } catch (error) { + unlinkSync(ownedPath); + throw error; + } + return ownedPath; + } finally { + closeSync(descriptor); + } + } + + consume(capabilities: string[]): void { for (const capability of capabilities) this.#records.delete(capability); } + clear(): void { this.#records.clear(); } +} diff --git a/apps/desktop/src/setup-controller.test.ts b/apps/desktop/src/setup-controller.test.ts new file mode 100644 index 000000000..11ea144b2 --- /dev/null +++ b/apps/desktop/src/setup-controller.test.ts @@ -0,0 +1,695 @@ +import assert from 'node:assert/strict'; +import { mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs'; +import { chmod, mkdir, mkdtemp, readFile, readdir, rename, symlink, writeFile } from 'node:fs/promises'; +import { tmpdir as systemTmpdir } from 'node:os'; +import { join } from 'node:path'; +import { describe, it } from 'node:test'; +import { writePrivateFileAtomic, type SetupActions } from '@propr/local-setup'; +import { DesktopSetupController } from './setup-controller'; + +const tmpdir = (): string => realpathSync(systemTmpdir()); + +const fakeActions = (): SetupActions => { + const env: Record = {}; + return { + async runChecks({ root }) { + return { rootDir: root!, anyFail: false, results: [{ name: 'Docker daemon', group: 'Docker', status: 'ok', detail: 'ready' }] }; + }, + inspectStackInit(rootDir) { + return { rootDir, envExists: false, dirs: { data: false, logs: false, repos: false }, initialized: false }; + }, + async inspectDatastoreAdministrators() { return { status: 'absent' }; }, + async scaffoldStack({ root }) { + return { rootDir: root!, envCreated: true, envSkipped: false, envBackedUp: false, dirsCreated: ['data', 'logs', 'repos'], dirsSkipped: [] }; + }, + async persistStackRoot() {}, + readEnvVars() { return { ...env }; }, + applyEnvSelection(_root, values, options) { + const written: string[] = []; + const skipped: string[] = []; + for (const [key, value] of Object.entries(values)) { + if (!options?.overwrite && env[key]) skipped.push(key); + else { env[key] = value; written.push(key); } + } + return { written, skipped }; + }, + clearEnvKeys(_root, keys) { keys.forEach(key => delete env[key]); }, + detectGithubAuthMode() { return { mode: env.PROPR_DEMO_MODE === 'true' ? 'demo' : env.GH_AUTH_MODE === 'relay' ? 'relay' : env.GH_AUTH_MODE === 'app' ? 'app' : 'none', warnings: [] }; }, + prepareAgentCredentialDir() {}, + async pullImages({ onLog }) { + onLog?.('token=must-not-cross-ipc'); + return { pulledCore: ['api'], pulledAgents: [], failedCore: [], failedAgents: [] }; + }, + async isStackRunning() { return false; }, + async startStack() {}, + async checkBackendHealth() { return { healthy: true, detail: 'API healthy' }; }, + async addRepository() {}, + async resolveUiUrl() { return 'http://127.0.0.1:5173'; }, + async openUrl() {}, + async saveWhitelistSetting() {}, + hasGithubToken() { return false; }, + async fetchRelayInstallations() { return { username: 'owner', installations: [] }; }, + async enrollRelay() { return { relayUrl: 'https://connect.propr.dev', token: 'secret' }; }, + async loginWithGithub() { return false; }, + async listAgents() { return []; }, + async addAgent() {}, + async loginableAgents() { return []; }, + async loginAgent() { return { available: false, success: false }; }, + async validateAgents() { return []; }, + }; +}; + +describe('desktop local setup controller', { + skip: process.platform === 'win32' + ? 'Linux local-setup controller fixtures require POSIX modes and directory-descriptor authority.' + : false, +}, () => { + it('runs the injected host adapter, redacts progress, persists resume state, and registers the healthy profile', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-setup-')); + const statePath = join(directory, 'setup.json'); + const snapshots: string[] = []; + const controller = new DesktopSetupController({ + actions: fakeActions(), + platform: 'linux', + statePath, + defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', + registerProfile: async ({ name, apiBaseUrl }) => ({ id: 'local', name, baseUrl: apiBaseUrl, kind: 'local' }), + emit: snapshot => snapshots.push(snapshot.phase), + }); + + const { sessionId } = await controller.status(); + const result = await controller.start({ + sessionId, + root: { mode: 'default' }, + reinitialize: false, + agents: [], + github: { mode: 'demo' }, + intake: { mode: 'keep' }, + whitelist: null, + repository: null, + }); + + assert.equal(result.phase, 'completed'); + assert.equal(result.profile?.baseUrl, 'http://127.0.0.1:4000'); + assert.match(result.logs.join('\n'), /\[REDACTED\]/); + assert.doesNotMatch(result.logs.join('\n'), /must-not-cross-ipc/); + assert.ok(snapshots.includes('running')); + const persisted = await readFile(statePath, 'utf8'); + assert.doesNotMatch(persisted, /must-not-cross-ipc/); + assert.doesNotMatch(persisted, /PROPR_DEMO_MODE/); + }); + + it('reports remote-only capability on non-Linux hosts without invoking setup actions', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-unsupported-')); + const controller = new DesktopSetupController({ + actions: {} as SetupActions, + platform: 'darwin', + statePath: join(directory, 'setup.json'), + defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => { throw new Error('not called'); }, + registerProfile: async () => { throw new Error('not called'); }, + emit() {}, + }); + + const status = await controller.status(); + assert.equal(status.phase, 'unsupported'); + assert.equal(status.capability.kind, 'remote-only'); + await assert.rejects(async () => controller.start({} as never), /Invalid local setup request|not supported/); + }); + + it('awaits aborted host work before publishing cancelled and permits retry only after settlement', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-cancel-')); + let entered!: () => void; + const started = new Promise(resolve => { entered = resolve; }); + let stopped = false; + let registered = false; + const actions = fakeActions(); + actions.runChecks = ({ root, signal }) => new Promise(resolve => { + entered(); + signal?.addEventListener('abort', () => { + stopped = true; + resolve({ rootDir: root!, anyFail: false, results: [] }); + }, { once: true }); + }); + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', + registerProfile: async () => { registered = true; throw new Error('must not run'); }, emit() {}, + }); + const { sessionId } = await controller.status(); + const running = controller.start({ sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }); + await started; + await assert.rejects(controller.retry(), /already running/); + const cancelled = await controller.cancel(); + assert.equal(stopped, true); + assert.equal(cancelled.phase, 'cancelled'); + assert.equal((await running).phase, 'cancelled'); + assert.equal(registered, false); + }); + + it('does not consume or copy a key or secret for an already-aborted setup boundary', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-pre-abort-')); + const keyPath = join(directory, 'selected.pem'); + const keyStorageDir = join(directory, 'owned-keys'); + await writeFile(keyPath, 'private-key-sentinel', { mode: 0o600 }); + let hostActions = 0; + const actions = fakeActions(); + actions.runChecks = async ({ root }) => { hostActions += 1; return { rootDir: root!, anyFail: false, results: [] }; }; + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'stack'), keyStorageDir, + selectPrivateKey: async () => keyPath, promptWebhookSecret: async () => 'webhook-secret-sentinel', + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => { throw new Error('not called'); }, emit() {}, + }); + const status = await controller.status(); + const key = await controller.selectPrivateKey(); + const secret = await controller.acquireWebhookSecret(); + assert.ok(key && secret); + const abort = new AbortController(); + abort.abort(); + await assert.rejects(controller.start({ + sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], + github: { mode: 'app', appId: '123', installationId: '456', privateKeyCapability: key.capability }, + intake: { mode: 'direct_webhook', secretCapability: secret.capability }, whitelist: null, repository: null, + }, abort.signal), error => (error as Error).name === 'AbortError'); + assert.equal(hostActions, 0); + assert.deepEqual(await readdir(keyStorageDir).catch(error => (error as NodeJS.ErrnoException).code === 'ENOENT' ? [] : Promise.reject(error)), []); + assert.equal(await readFile(keyPath, 'utf8'), 'private-key-sentinel'); + }); + + it('does not issue a key or secret capability across an abort boundary', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-selection-abort-')); + const keyPath = join(directory, 'selected.pem'); + await writeFile(keyPath, 'private-key-sentinel', { mode: 0o600 }); + const selectionAbort = new AbortController(); + const secretAbort = new AbortController(); + const controller = new DesktopSetupController({ + actions: fakeActions(), platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => { selectionAbort.abort(); return keyPath; }, + promptWebhookSecret: async () => { secretAbort.abort(); return 'webhook-secret-sentinel'; }, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => { throw new Error('not called'); }, emit() {}, + }); + await assert.rejects(controller.selectPrivateKey(selectionAbort.signal), error => (error as Error).name === 'AbortError'); + await assert.rejects(controller.acquireWebhookSecret(secretAbort.signal), error => (error as Error).name === 'AbortError'); + }); + + it('pins relay enrollment to the official relay and rejects attacker-controlled URL fields', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-relay-')); + const seen: unknown[] = []; + const actions = fakeActions(); + actions.hasGithubToken = () => true; + actions.fetchRelayInstallations = async params => { + seen.push(params); + return { username: 'octocat', installations: [{ installation_id: 42, account_login: 'integry', account_type: 'Organization' }] }; + }; + actions.enrollRelay = async params => { + seen.push(params); + return { relayUrl: params.relayUrl!, token: 'ghr_super-secret-relay-token' }; + }; + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => ({ id: 'local', name: 'Local', baseUrl: 'http://127.0.0.1:4000', kind: 'local' }), emit() {}, + }); + const { sessionId } = await controller.status(); + const request = { sessionId, root: { mode: 'default' as const }, reinitialize: false, agents: [], github: { mode: 'relay' as const }, intake: { mode: 'polling' as const }, whitelist: ['octocat'], repository: null }; + await controller.start(request); + assert.ok(seen.length >= 2); + assert.equal(seen.every(value => JSON.stringify(value).includes('https://webhook.propr.dev/v1')), true); + assert.doesNotMatch(JSON.stringify(seen), /attacker|authorization/i); + await assert.rejects(async () => controller.start({ ...request, github: { mode: 'relay', relayUrl: 'https://attacker.invalid' } } as never), /Invalid/); + }); + + it('aborts and settles blocked host work during shutdown', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-shutdown-')); + let entered!: () => void; + const started = new Promise(resolve => { entered = resolve; }); + let stopped = false; + const actions = fakeActions(); + actions.runChecks = ({ root, signal }) => new Promise(resolve => { + entered(); + signal?.addEventListener('abort', () => { stopped = true; resolve({ rootDir: root!, anyFail: false, results: [] }); }, { once: true }); + }); + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => { throw new Error('not called'); }, emit() {}, + }); + const status = await controller.status(); + const run = controller.start({ sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }); + await started; + await controller.shutdown(); + assert.equal(stopped, true); + assert.equal((await run).phase, 'cancelled'); + }); + + it('threads cancellation into deferred profile registration and suppresses the late write', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-profile-cancel-')); + let entered!: () => void; + const registering = new Promise(resolve => { entered = resolve; }); + let registered = false; + const controller = new DesktopSetupController({ + actions: fakeActions(), platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', + registerProfile: async (_profile, signal) => { + entered(); + await new Promise((resolve, reject) => signal?.addEventListener('abort', () => reject(signal.reason), { once: true })); + registered = true; + return { id: 'late', name: 'Late', baseUrl: 'http://127.0.0.1:4000', kind: 'local' }; + }, emit() {}, + }); + const status = await controller.status(); + const run = controller.start({ sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }); + await registering; + const result = await controller.cancel(); + assert.equal(result.phase, 'cancelled'); + assert.equal((await run).phase, 'cancelled'); + assert.equal(registered, false); + }); + + it('reports residual rollback as a fixed failure even when startup was cancelled', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-residual-cleanup-')); + const external = new AbortController(); + const diagnostics: unknown[] = []; + const actions = fakeActions(); + actions.startStack = async () => { + external.abort(); + throw Object.assign( + new AggregateError([new Error('cancelled'), new Error('residual propr-ui at /host/private')], 'raw cleanup detail'), + { code: 'PROPR_SETUP_CLEANUP_INCOMPLETE' }, + ); + }; + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => { throw new Error('not called'); }, emit() {}, + diagnose: (_event, fields) => diagnostics.push(fields), + }); + const status = await controller.status(); + const result = await controller.start({ + sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], + github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null, + }, external.signal); + assert.equal(result.phase, 'failed'); + assert.match(result.error ?? '', /cleanup is incomplete/); + assert.doesNotMatch(JSON.stringify(result), /propr-ui|host\/private|raw cleanup detail/); + assert.match(JSON.stringify(diagnostics), /REDACTED/); + assert.doesNotMatch(JSON.stringify(diagnostics), /host\/private/); + }); + + it('persists every non-secret choice and requires secret reconfiguration after restart', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-resume-')); + const keyPath = join(directory, 'github-app.pem'); + const keyContents = '-----BEGIN PRIVATE KEY-----\nultra-secret-key-content\n-----END PRIVATE KEY-----'; + await writeFile(keyPath, keyContents, { mode: 0o600 }); + await chmod(keyPath, 0o600); + const statePath = join(directory, 'state.json'); + const options = { + actions: fakeActions(), platform: 'linux' as const, statePath, defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => keyPath, + promptWebhookSecret: async () => 'arbitrary-webhook-value', + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => ({ id: 'local', name: 'Local', baseUrl: 'http://127.0.0.1:4000', kind: 'local' as const }), emit() {}, + }; + const first = new DesktopSetupController(options); + const status = await first.status(); + const key = await first.selectPrivateKey(); + const secret = await first.acquireWebhookSecret(); + assert.ok(key); + assert.ok(secret); + await first.start({ + sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: true, agents: ['claude'], + github: { mode: 'app', appId: '123', installationId: '456', privateKeyCapability: key.capability }, + intake: { mode: 'direct_webhook', secretCapability: secret.capability }, whitelist: [], repository: { fullName: 'integry/propr', alias: 'propr', baseBranch: 'main' }, + }); + const persisted = await readFile(statePath, 'utf8'); + assert.doesNotMatch(persisted, /arbitrary-webhook-value|ultra-secret-key-content|github-app\.pem/); + assert.match(persisted, /"agents": \[\s*"claude"/); + assert.match(persisted, /"fullName": "integry\/propr"/); + + const restarted = new DesktopSetupController({ ...options, sessionId: '11111111-1111-4111-8111-111111111111' }); + const resumed = await restarted.status(); + assert.equal(resumed.reconfigurationRequired, true); + assert.equal(resumed.resume?.reconfigurationStage, 'github'); + assert.deepEqual(resumed.resume?.whitelist, []); + assert.deepEqual(resumed.resume?.repository, { fullName: 'integry/propr', alias: 'propr', baseBranch: 'main' }); + await assert.rejects(restarted.retry(), /Re-enter the github/); + }); + + it('recomputes platform support after shared concurrent hydration instead of trusting Linux state', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-hydration-')); + const statePath = join(directory, 'state.json'); + const linux = new DesktopSetupController({ + actions: fakeActions(), platform: 'linux', statePath, defaultRootDir: join(directory, 'stack'), selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => ({ id: 'local', name: 'Local', baseUrl: 'http://127.0.0.1:4000', kind: 'local' }), emit() {}, + }); + const current = await linux.status(); + await linux.start({ sessionId: current.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }); + + const concurrentSession = '33333333-3333-4333-8333-333333333333'; + const rehydrated = new DesktopSetupController({ + actions: fakeActions(), platform: 'linux', statePath, defaultRootDir: join(directory, 'stack'), sessionId: concurrentSession, selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => ({ id: 'local', name: 'Local', baseUrl: 'http://127.0.0.1:4000', kind: 'local' }), emit() {}, + }); + const [hydratedStatus, hydratedStart] = await Promise.all([ + rehydrated.status(), + rehydrated.start({ sessionId: concurrentSession, root: { mode: 'resume' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }), + ]); + assert.equal(hydratedStatus.capability.supported, true); + assert.equal(hydratedStart.phase, 'completed'); + + const sessionId = '22222222-2222-4222-8222-222222222222'; + const darwin = new DesktopSetupController({ + actions: {} as SetupActions, platform: 'darwin', statePath, defaultRootDir: join(directory, 'stack'), sessionId, selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => { throw new Error('not called'); }, registerProfile: async () => { throw new Error('not called'); }, emit() {}, + }); + const [one, two] = await Promise.all([darwin.status(), darwin.status()]); + assert.equal(one.phase, 'unsupported'); + assert.deepEqual(one.capability, two.capability); + await assert.rejects(darwin.start({ sessionId, root: { mode: 'resume' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }), /not supported/); + }); + + it('surfaces persistence failure as resume unavailable', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-persist-fail-')); + const blocker = join(directory, 'not-a-directory'); + await writeFile(blocker, 'block'); + const controller = new DesktopSetupController({ + actions: fakeActions(), platform: 'linux', statePath: join(blocker, 'state.json'), defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => ({ id: 'local', name: 'Local', baseUrl: 'http://127.0.0.1:4000', kind: 'local' }), emit() {}, + }); + const status = await controller.status(); + const result = await controller.start({ sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }); + assert.equal(result.resumeAvailable, false); + assert.match(result.error ?? '', /Resume after restart is unavailable/); + }); + + it('rejects managed paths that escape the fixed app-owned root', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-contained-root-')); + const root = join(directory, 'default'); + const outside = join(directory, 'outside'); + await mkdir(root); await mkdir(outside); await symlink(outside, join(root, 'data')); + const controller = new DesktopSetupController({ + actions: fakeActions(), platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'default'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => { throw new Error('not called'); }, emit() {}, + }); + const status = await controller.status(); + const result = await controller.start({ sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }); + assert.equal(result.phase, 'failed'); + assert.doesNotMatch(result.error ?? '', new RegExp(outside)); + }); + + it('uses a generic renderer error while retaining only sanitized protected diagnostics', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-generic-error-')); + const actions = fakeActions(); + const diagnostics: unknown[] = []; + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => { throw new Error('profile failure included ghp_1234567890abcdef and Authorization: Bearer relay-auth-value'); }, emit() {}, + diagnose: (_event, fields) => diagnostics.push(fields), + }); + const status = await controller.status(); + const result = await controller.start({ sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }); + assert.match(result.error ?? '', /failed unexpectedly/); + const serialized = JSON.stringify(diagnostics); + assert.doesNotMatch(serialized, /ghp_1234567890abcdef|relay-auth-value/); + assert.match(serialized, /REDACTED/); + }); + + it('quit and reopen resumes against the fixed root without any directory reselection', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-fixed-resume-')); + const root = join(directory, 'default'); + const statePath = join(directory, 'state.json'); + const first = new DesktopSetupController({ + actions: fakeActions(), platform: 'linux', statePath, defaultRootDir: join(directory, 'default'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => ({ id: 'local', name: 'Local', baseUrl: 'http://127.0.0.1:4000', kind: 'local' }), emit() {}, + }); + const status = await first.status(); + await first.start({ sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }); + await first.shutdown(); + + let actions = 0; + const replacementActions = fakeActions(); + replacementActions.runChecks = async ({ root: checked }) => { actions += 1; return { rootDir: checked!, anyFail: false, results: [] }; }; + const restarted = new DesktopSetupController({ + actions: replacementActions, platform: 'linux', statePath, defaultRootDir: join(directory, 'default'), + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => ({ id: 'local', name: 'Local', baseUrl: 'http://127.0.0.1:4000', kind: 'local' }), emit() {}, + }); + const resumed = await restarted.status(); + assert.equal(resumed.rootDir, '[REDACTED_PATH]'); + assert.equal(resumed.resume?.reconfigurationStage, undefined); + assert.equal((await restarted.retry()).phase, 'completed'); + assert.ok(actions > 0); + }); + + it('never reads or mounts a formerly chosen replacement directory', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-no-custom-root-')); + const fixedRoot = join(directory, 'fixed'); + const chosenRoot = join(directory, 'chosen'); + const sentinel = 'CHOSEN_REPLACEMENT_SENTINEL_UNCHANGED'; + await mkdir(chosenRoot, { mode: 0o700 }); + await writeFile(join(chosenRoot, '.env'), sentinel, { mode: 0o600 }); + const observedRoots: string[] = []; + const actions = fakeActions(); + actions.runChecks = async ({ root }) => { observedRoots.push(root!); return { rootDir: root!, anyFail: false, results: [] }; }; + actions.startStack = async ({ rootDir, assertRootAuthority }) => { observedRoots.push(rootDir); assertRootAuthority?.(); }; + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: fixedRoot, + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => ({ id: 'local', name: 'Local', baseUrl: 'http://127.0.0.1:4000', kind: 'local' }), emit() {}, + }); + const status = await controller.status(); + const result = await controller.start({ sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null }); + assert.equal(result.phase, 'completed'); + assert.equal(await readFile(join(chosenRoot, '.env'), 'utf8'), sentinel); + assert.equal(observedRoots.some(value => value.startsWith(chosenRoot)), false); + assert.ok(observedRoots.includes(fixedRoot)); + }); + + it('copies a consumed private key once and never reopens a swapped chooser pathname', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-key-copy-')); + const keyPath = join(directory, 'app.pem'); + const original = 'ORIGINAL_PRIVATE_KEY_BYTES'; + const replacement = 'REPLACEMENT_MUST_NOT_BE_READ'; + await writeFile(keyPath, original, { mode: 0o600 }); + let release!: () => void; + let entered!: () => void; + const atChecks = new Promise(resolve => { entered = resolve; }); + const continueChecks = new Promise(resolve => { release = resolve; }); + let mountedPath: string | undefined; + const actions = fakeActions(); + actions.runChecks = async ({ root }) => { + entered(); await continueChecks; + return { rootDir: root!, anyFail: false, results: [{ name: 'Docker daemon', group: 'Docker', status: 'ok', detail: 'ready' }] }; + }; + const baseApply = actions.applyEnvSelection; + actions.applyEnvSelection = (root, values, options, signal) => { + if (values.HOST_GH_PRIVATE_KEY) mountedPath = values.HOST_GH_PRIVATE_KEY; + return baseApply(root, values, options, signal); + }; + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: join(directory, 'stack'), keyStorageDir: join(directory, 'owned-keys'), + selectPrivateKey: async () => keyPath, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => { throw new Error('not called'); }, emit() {}, + }); + const status = await controller.status(); + const selected = await controller.selectPrivateKey(); + assert.ok(selected); + const running = controller.start({ + sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], + github: { mode: 'app', appId: '1', installationId: '2', privateKeyCapability: selected.capability }, + intake: { mode: 'polling' }, whitelist: null, repository: null, + }); + await atChecks; + await rename(keyPath, `${keyPath}.original`); + await writeFile(keyPath, replacement, { mode: 0o600 }); + release(); + await running; + assert.ok(mountedPath); + assert.notEqual(mountedPath, keyPath); + assert.equal(await readFile(mountedPath, 'utf8'), original); + assert.doesNotMatch(await readFile(mountedPath, 'utf8'), /REPLACEMENT/); + }); + + it('keeps an atomic env commit descriptor-relative when the fixed root is renamed and replaced', { + skip: process.platform !== 'linux' + ? 'This rename/swap proof intentionally exercises Linux /proc//fd descriptor semantics.' + : false, + }, async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-root-commit-')); + const selectedRoot = join(directory, 'fixed'); + const originalRoot = join(directory, 'fixed-original'); + const sentinel = 'REPLACEMENT_SENTINEL_MUST_SURVIVE'; + await mkdir(selectedRoot, { mode: 0o700 }); + const emitted: unknown[] = []; + let swapped = false; + let operationRoot = ''; + const actions = fakeActions(); + actions.applyEnvSelection = (rootDir, values, _options, signal) => { + operationRoot = rootDir; + writePrivateFileAtomic(join(rootDir, '.env'), Object.entries(values).map(([key, value]) => `${key}=${value}`).join('\n'), { + signal, + beforeRename() { + if (swapped) return; + swapped = true; + renameSync(selectedRoot, originalRoot); + mkdirSync(selectedRoot, { mode: 0o700 }); + writeFileSync(join(selectedRoot, '.env'), sentinel, { mode: 0o600 }); + }, + }); + return { written: Object.keys(values), skipped: [] }; + }; + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: selectedRoot, + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => { throw new Error('not called'); }, emit: snapshot => emitted.push(snapshot), + }); + const status = await controller.status(); + const result = await controller.start({ + sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], + github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null, + }); + assert.equal(result.phase, 'failed'); + assert.match(operationRoot, new RegExp(`^/proc/${process.pid}/fd/[0-9]+$`)); + assert.equal(readFileSync(join(selectedRoot, '.env'), 'utf8'), sentinel); + assert.match(readFileSync(join(originalRoot, '.env'), 'utf8'), /PROPR_DEMO_MODE=true/); + assert.doesNotMatch(JSON.stringify({ result, emitted }), new RegExp(`/proc/${process.pid}/fd/`)); + assert.equal((await controller.retry()).phase, 'failed', 'retry starts only after the failed run settled'); + await controller.shutdown(); + }); + + it('hands Docker only the stable fixed root and fails if that identity is replaced', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-root-docker-')); + const selectedRoot = join(directory, 'fixed'); + const originalRoot = join(directory, 'fixed-original'); + const sentinel = 'DO_NOT_READ_OR_BIND_REPLACEMENT'; + await mkdir(selectedRoot, { mode: 0o700 }); + let launched = false; + let daemonRoot = ''; + let operationsRoot = ''; + const actions = fakeActions(); + actions.startStack = async params => { + daemonRoot = params.rootDir; + operationsRoot = params.rootOperationsDir ?? ''; + renameSync(selectedRoot, originalRoot); + mkdirSync(selectedRoot, { mode: 0o700 }); + writeFileSync(join(selectedRoot, '.env'), sentinel, { mode: 0o600 }); + params.assertRootAuthority?.(); + launched = true; + }; + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: selectedRoot, + selectPrivateKey: async () => null, + resolveApiBaseUrl: async () => 'http://127.0.0.1:4000', registerProfile: async () => { throw new Error('not called'); }, emit() {}, + }); + const status = await controller.status(); + const result = await controller.start({ + sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], + github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: null, repository: null, + }); + assert.equal(result.phase, 'failed'); + assert.equal(launched, false); + assert.equal(daemonRoot, selectedRoot); + assert.doesNotMatch(daemonRoot, /(?:^|\/)proc\/|(?:^|\/)dev\/fd/); + assert.match(operationsRoot, new RegExp(`^/proc/${process.pid}/fd/[0-9]+$`)); + assert.equal(readFileSync(join(selectedRoot, '.env'), 'utf8'), sentinel); + assert.equal((await controller.retry()).phase, 'failed', 'retry starts only after the failed run settled'); + await controller.shutdown(); + }); + + it('threads the descriptor read root and authority guard through every config consumer', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-root-consumers-')); + const stableRoot = join(directory, 'stack'); + const seen = new Map(); + const record = (name: string, stable: string, boundary?: { rootOperationsDir?: string; assertRootAuthority?(): void }) => { + boundary?.assertRootAuthority?.(); + seen.set(name, { stable, read: boundary?.rootOperationsDir, guarded: Boolean(boundary?.assertRootAuthority) }); + }; + const actions = fakeActions(); + actions.pullImages = async params => { + record('pull', params.rootDir, params); + return { pulledCore: ['api'], pulledAgents: ['agent'], failedCore: [], failedAgents: [] }; + }; + let statusCalls = 0; + actions.isStackRunning = async (rootDir, _signal, boundary) => { record('status', rootDir, boundary); return statusCalls++ > 0; }; + actions.checkBackendHealth = async params => { record('health', params.rootDir, params); return { healthy: true, detail: 'healthy' }; }; + actions.resolveUiUrl = async (rootDir, _signal, boundary) => { record('ui', rootDir, boundary); return 'http://127.0.0.1:5173'; }; + actions.saveWhitelistSetting = async (rootDir, _users, _signal, boundary) => { record('settings', rootDir, boundary); }; + actions.addRepository = async (_selection, rootDir, _signal, boundary) => { record('repo', rootDir, boundary); }; + actions.listAgents = async (rootDir, _signal, boundary) => { record('agents-list', rootDir, boundary); return []; }; + actions.addAgent = async (rootDir, _options, _signal, boundary) => { record('agents-add', rootDir, boundary); }; + actions.validateAgents = async (rootDir, _types, _signal, boundary) => { record('agents-validate', rootDir, boundary); return []; }; + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath: join(directory, 'state.json'), defaultRootDir: stableRoot, + selectPrivateKey: async () => null, + resolveApiBaseUrl: async rootDir => { assert.equal(rootDir, stableRoot); return 'http://127.0.0.1:4000'; }, + registerProfile: async () => ({ id: 'local', name: 'Local', baseUrl: 'http://127.0.0.1:4000', kind: 'local' }), emit() {}, + }); + const { sessionId } = await controller.status(); + const result = await controller.start({ + sessionId, root: { mode: 'default' }, reinitialize: false, agents: ['claude'], + github: { mode: 'demo' }, intake: { mode: 'keep' }, whitelist: ['octocat'], + repository: { fullName: 'integry/propr' }, + }); + assert.equal(result.phase, 'completed'); + for (const name of ['pull', 'status', 'health', 'ui', 'settings', 'repo', 'agents-list', 'agents-add', 'agents-validate']) { + const value = seen.get(name); + assert.ok(value, `${name} was not called`); + assert.equal(value.stable, stableRoot); + assert.match(value.read ?? '', new RegExp(`^/proc/${process.pid}/fd/[0-9]+$`)); + assert.equal(value.guarded, true); + } + await controller.shutdown(); + }); + + it('keeps native webhook secret bytes out of snapshots, resume state, logs, errors, and diagnostics', async () => { + const sentinel = 'w3bh00k-16chars!'; + assert.equal(sentinel.length, 16); + const directory = await mkdtemp(join(tmpdir(), 'propr-desktop-secret-boundary-')); + const emitted: unknown[] = []; + const diagnostics: unknown[] = []; + const actions = fakeActions(); + actions.hasGithubToken = () => true; + actions.detectGithubAuthMode = () => ({ mode: 'app', warnings: [] }); + actions.inspectDatastoreAdministrators = async () => ({ status: 'has-admin' }); + actions.pullImages = async ({ onLog }) => { + onLog?.(`progress ${sentinel}`); + return { pulledCore: ['api'], pulledAgents: [], failedCore: [], failedAgents: [] }; + }; + const statePath = join(directory, 'state.json'); + const controller = new DesktopSetupController({ + actions, platform: 'linux', statePath, defaultRootDir: join(directory, 'stack'), + selectPrivateKey: async () => null, promptWebhookSecret: async () => sentinel, + resolveApiBaseUrl: async () => { throw new Error(`daemon failure ${sentinel}`); }, registerProfile: async () => { throw new Error('not called'); }, emit: snapshot => emitted.push(snapshot), + diagnose: (_event, fields) => diagnostics.push(fields), + }); + const status = await controller.status(); + const secret = await controller.acquireWebhookSecret(); + assert.ok(secret); + assert.doesNotMatch(JSON.stringify(secret), new RegExp(sentinel)); + const result = await controller.start({ + sessionId: status.sessionId, root: { mode: 'default' }, reinitialize: false, agents: [], + github: { mode: 'keep' }, + intake: { mode: 'direct_webhook', secretCapability: secret.capability }, whitelist: null, repository: null, + }); + assert.equal(result.phase, 'failed'); + const rendererVisible = JSON.stringify({ result, emitted, persisted: await readFile(statePath, 'utf8') }); + assert.doesNotMatch(rendererVisible, new RegExp(sentinel)); + assert.match(rendererVisible, /REDACTED/); + const protectedDiagnostics = JSON.stringify(diagnostics); + assert.doesNotMatch(protectedDiagnostics, new RegExp(sentinel)); + assert.match(protectedDiagnostics, /daemon failure \[REDACTED\]/); + const diagnosticError = (diagnostics[0] as { error: { name: string; message: string; stack: string } }).error; + assert.equal(diagnosticError.name, 'Error'); + assert.equal(diagnosticError.message, 'daemon failure [REDACTED]'); + assert.equal(typeof diagnosticError.stack, 'string'); + await assert.rejects(controller.retry(), /Re-enter the intake/); + }); +}); diff --git a/apps/desktop/src/setup-controller.ts b/apps/desktop/src/setup-controller.ts new file mode 100644 index 000000000..901099a4a --- /dev/null +++ b/apps/desktop/src/setup-controller.ts @@ -0,0 +1,521 @@ +import { randomUUID } from 'node:crypto'; +import { dirname, isAbsolute, resolve } from 'node:path'; +import { + readPrivateFile, + rethrowCancellation, + writePrivateFileAtomic, + getLocalSetupCapability, + retrySetup, + runSetup, + type GithubAuthDecision, + type SetupActions, + type SetupRunResult, +} from '@propr/local-setup'; +import { DEFAULT_PROPR_GH_RELAY_URL } from '@propr/shared'; +import { redactDesktopValue, safeRendererError } from './secret-redaction'; +import { bindRootOperations, RootDirectoryAuthority, SetupFilesystemCapabilities, SetupSecretCapabilities } from './setup-capabilities'; +import { parseDesktopSetupRequest, SetupRequestError } from './setup-schema'; +import type { + DesktopFilesystemSelection, + DesktopProfileView, + DesktopSetupRequest, + DesktopSetupResumeView, + DesktopSetupSnapshot, + DesktopSecretSelection, +} from './shared/contract'; + +type ResumePlan = DesktopSetupResumeView; + +interface PersistedSetupState { + version: 3; + phase: Exclude; + rootDir: string; + lastStepId?: string; + resume: ResumePlan; +} + +interface ResolvedRequest { + publicRequest: DesktopSetupRequest; + rootDir: string; + privateKeyPath?: string; + webhookSecret?: string; + rootAuthority: RootDirectoryAuthority; +} + +export interface DesktopSetupControllerOptions { + actions: SetupActions; + platform?: NodeJS.Platform; + statePath: string; + appDataDir?: string; + defaultRootDir: string; + keyStorageDir?: string; + selectPrivateKey(signal?: AbortSignal): Promise; + promptWebhookSecret?(signal?: AbortSignal): Promise; + resolveApiBaseUrl(rootDir: string, signal?: AbortSignal): Promise; + registerProfile(profile: { name: string; apiBaseUrl: string }, signal?: AbortSignal): Promise; + emit(snapshot: DesktopSetupSnapshot): void; + diagnose?(event: string, fields: Record): void; + sessionId?: string; +} + +const PHASES = new Set(['idle', 'running', 'interrupted', 'cancelled', 'failed', 'completed']); +const STEPS = new Set(['check', 'init-stack', 'pull-images', 'configure-agents', 'github-auth', 'intake', 'start-stack', 'enable-agents', 'whitelist', 'repo', 'launch-ui']); + +const terminalPhase = (result: SetupRunResult): DesktopSetupSnapshot['phase'] => result.completed ? 'completed' : result.cancelled ? 'cancelled' : 'failed'; + +const isCleanupIncomplete = (error: unknown): boolean => Boolean( + error && typeof error === 'object' + && (error as { code?: unknown }).code === 'PROPR_SETUP_CLEANUP_INCOMPLETE', +); + +const cleanupIncompleteRendererError = 'Setup stopped, but local runtime cleanup is incomplete. Review the protected desktop log before retrying.'; + +const assertPath = (value: unknown): value is string => typeof value === 'string' && value.length > 0 && value.length <= 4_096 && isAbsolute(value) && !value.includes('\0'); + +const parseResumePlan = (value: unknown): ResumePlan => { + if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Invalid resume plan'); + const plan = value as Record; + if (Object.keys(plan).some(key => !['reinitialize', 'agents', 'github', 'intake', 'whitelist', 'repository', 'reconfigurationStage'].includes(key))) throw new Error('Invalid resume plan'); + const github = plan.github as Record | undefined; + const intake = plan.intake as Record | undefined; + if (!github || !intake) throw new Error('Invalid resume plan'); + const githubKeys = github.mode === 'app' ? ['mode', 'appId', 'installationId', 'reconfigurationRequired'] : ['mode']; + const intakeKeys = intake.mode === 'direct_webhook' ? ['mode', 'reconfigurationRequired'] : ['mode']; + if (Object.keys(github).length !== githubKeys.length || Object.keys(github).some(key => !githubKeys.includes(key)) + || Object.keys(intake).length !== intakeKeys.length || Object.keys(intake).some(key => !intakeKeys.includes(key))) throw new Error('Invalid resume plan'); + const synthetic = parseDesktopSetupRequest({ + sessionId: randomUUID(), + root: { mode: 'default' }, + reinitialize: plan.reinitialize, + agents: plan.agents, + github: github?.mode === 'app' + ? { mode: 'app', appId: github.appId, installationId: github.installationId, privateKeyCapability: 'A'.repeat(43) } + : github, + intake: intake?.mode === 'direct_webhook' ? { mode: 'direct_webhook', secretCapability: 'A'.repeat(43) } : intake, + whitelist: plan.whitelist, + repository: plan.repository, + }); + if (github?.mode === 'app' && github.reconfigurationRequired !== true) throw new Error('Invalid resume plan'); + if (intake?.mode === 'direct_webhook' && intake.reconfigurationRequired !== true) throw new Error('Invalid resume plan'); + const expectedStage = github?.mode === 'app' ? 'github' : intake?.mode === 'direct_webhook' ? 'intake' : undefined; + if (plan.reconfigurationStage !== expectedStage) throw new Error('Invalid resume plan'); + return { + reinitialize: synthetic.reinitialize, + agents: synthetic.agents, + github: github as unknown as ResumePlan['github'], + intake: intake as unknown as ResumePlan['intake'], + whitelist: synthetic.whitelist, + repository: synthetic.repository, + ...(expectedStage ? { reconfigurationStage: expectedStage } : {}), + }; +}; + +const parsePersisted = (contents: string): PersistedSetupState => { + if (contents.length > 1024 * 1024) throw new Error('Setup state is too large'); + const value = JSON.parse(contents) as Record; + if (!value || value.version !== 3 || !PHASES.has(String(value.phase)) || !assertPath(value.rootDir)) throw new Error('Invalid setup state'); + if (value.lastStepId !== undefined && (typeof value.lastStepId !== 'string' || !STEPS.has(value.lastStepId))) throw new Error('Invalid setup state'); + if (Object.keys(value).some(key => !['version', 'phase', 'rootDir', 'lastStepId', 'resume'].includes(key))) throw new Error('Invalid setup state'); + return { + version: 3, + phase: value.phase as PersistedSetupState['phase'], + rootDir: resolve(value.rootDir as string), + ...(value.lastStepId ? { lastStepId: value.lastStepId as string } : {}), + resume: parseResumePlan(value.resume), + }; +}; + +const resumeView = (plan: ResumePlan): DesktopSetupResumeView => ({ + reinitialize: plan.reinitialize, + agents: [...plan.agents], + github: structuredClone(plan.github), + intake: structuredClone(plan.intake), + whitelist: plan.whitelist ? [...plan.whitelist] : null, + repository: plan.repository ? { ...plan.repository } : null, + ...(plan.reconfigurationStage ? { reconfigurationStage: plan.reconfigurationStage } : {}), +}); + +export class DesktopSetupController { + readonly #options: DesktopSetupControllerOptions; + readonly #sessionId: string; + readonly #filesystem = new SetupFilesystemCapabilities(); + readonly #secrets = new SetupSecretCapabilities(); + #abortController: AbortController | null = null; + #activeSecrets: string[] = []; + #busy = false; + #currentRun: Promise | null = null; + #hydration: Promise | null = null; + #persistQueue = Promise.resolve(); + #persistFailed = false; + #resume: ResumePlan | null = null; + #runtimeRetry: ResolvedRequest | null = null; + #result: SetupRunResult | null = null; + #snapshot: DesktopSetupSnapshot; + + constructor(options: DesktopSetupControllerOptions) { + this.#options = options; + this.#sessionId = options.sessionId ?? randomUUID(); + const capability = this.#capability(); + this.#snapshot = { + phase: capability.supported ? 'idle' : 'unsupported', + capability, + sessionId: this.#sessionId, + logs: [], + rootDir: resolve(options.defaultRootDir), + resumeAvailable: false, + ...(capability.supported ? {} : { error: capability.reason }), + }; + } + + async status(): Promise { + await this.#load(); + this.#enforceCapability(false); + return this.#copy(); + } + + async selectPrivateKey(signal?: AbortSignal): Promise { + signal?.throwIfAborted(); + await this.#load(); + signal?.throwIfAborted(); + this.#enforceCapability(true); + try { + const selected = await this.#options.selectPrivateKey(signal); + signal?.throwIfAborted(); + const issued = selected ? await this.#filesystem.issue('private-key', this.#sessionId, selected, signal) : null; + signal?.throwIfAborted(); + return issued; + } catch (error) { + if (signal?.aborted) signal.throwIfAborted(); + rethrowCancellation(error); + this.#diagnose('desktop.setup.private_key_selection_failed', { error }); + throw new Error(safeRendererError); + } + } + + async acquireWebhookSecret(signal?: AbortSignal): Promise { + signal?.throwIfAborted(); + await this.#load(); + signal?.throwIfAborted(); + this.#enforceCapability(true); + try { + if (!this.#options.promptWebhookSecret) throw new SetupRequestError('A secure native secret prompt is unavailable.'); + const value = await this.#options.promptWebhookSecret(signal); + signal?.throwIfAborted(); + return value === null ? null : this.#secrets.issue(this.#sessionId, value); + } catch (error) { + if (signal?.aborted) signal.throwIfAborted(); + rethrowCancellation(error); + this.#diagnose('desktop.setup.webhook_secret_prompt_failed', { error }); + throw new Error(safeRendererError); + } + } + + start(input: unknown, externalSignal?: AbortSignal): Promise { + return this.#begin(parseDesktopSetupRequest(input), false, externalSignal); + } + + async retry(input?: unknown, externalSignal?: AbortSignal): Promise { + externalSignal?.throwIfAborted(); + await this.#load(); + externalSignal?.throwIfAborted(); + this.#enforceCapability(true); + if (input !== undefined) return this.#begin(parseDesktopSetupRequest(input), true, externalSignal); + if (this.#resume?.reconfigurationStage === 'github' || this.#resume?.reconfigurationStage === 'intake') { + throw new SetupRequestError(`Re-enter the ${this.#resume.reconfigurationStage} configuration before retrying.`); + } + if (this.#runtimeRetry) { + const rootAuthority = RootDirectoryAuthority.open(this.#options.defaultRootDir, true, this.#appDataDir()); + try { + externalSignal?.throwIfAborted(); + return await this.#beginResolved({ ...this.#runtimeRetry, rootDir: resolve(this.#options.defaultRootDir), rootAuthority }, true, externalSignal); + } finally { + if (this.#runtimeRetry?.rootAuthority !== rootAuthority) rootAuthority.close(); + } + } + if (!this.#resume) throw new SetupRequestError('There is no local setup to resume'); + if (this.#resume.reconfigurationStage) throw new SetupRequestError(`Re-enter the ${this.#resume.reconfigurationStage} configuration before retrying.`); + const request = parseDesktopSetupRequest({ + sessionId: this.#sessionId, + root: { mode: 'resume' }, + reinitialize: this.#resume.reinitialize, + agents: this.#resume.agents, + github: this.#resume.github, + intake: this.#resume.intake, + whitelist: this.#resume.whitelist, + repository: this.#resume.repository, + }); + return this.#begin(request, true, externalSignal); + } + + async cancel(): Promise { + this.#abortController?.abort(); + if (this.#currentRun) await this.#currentRun.catch(() => undefined); + return this.#copy(); + } + + async shutdown(): Promise { + this.#abortController?.abort(); + await this.#currentRun?.catch(() => undefined); + await this.#persistQueue; + this.#filesystem.clear(); + this.#secrets.clear(); + this.#runtimeRetry?.rootAuthority.close(); + } + + async #begin(request: DesktopSetupRequest, retry: boolean, externalSignal?: AbortSignal): Promise { + externalSignal?.throwIfAborted(); + await this.#load(); + externalSignal?.throwIfAborted(); + this.#enforceCapability(true); + if (this.#busy || this.#currentRun) throw new SetupRequestError('Local setup is already running'); + this.#busy = true; + let openedAuthority: RootDirectoryAuthority | undefined; + try { + if (request.sessionId !== this.#sessionId) throw new SetupRequestError('The setup session expired. Start again.'); + if (request.github.mode === 'app') { + await this.#filesystem.validate(request.github.privateKeyCapability, 'private-key', this.#sessionId); + externalSignal?.throwIfAborted(); + } + if (request.intake.mode === 'direct_webhook') this.#secrets.validate(request.intake.secretCapability, this.#sessionId); + if (request.root.mode === 'resume' && !this.#resume) throw new SetupRequestError('There is no local setup to resume.'); + const rootDir = resolve(this.#options.defaultRootDir); + const rootAuthority = RootDirectoryAuthority.open(rootDir, true, this.#appDataDir()); + openedAuthority = rootAuthority; + let privateKeyPath: string | undefined; + if (request.github.mode === 'app') { + privateKeyPath = await this.#filesystem.consumePrivateKey( + request.github.privateKeyCapability, + this.#sessionId, + this.#options.keyStorageDir ?? `${this.#options.statePath}.keys`, + externalSignal, + ); + } + externalSignal?.throwIfAborted(); + const webhookSecret = request.intake.mode === 'direct_webhook' + ? this.#secrets.consume(request.intake.secretCapability, this.#sessionId) + : undefined; + externalSignal?.throwIfAborted(); + return await this.#beginResolved({ publicRequest: request, rootDir, rootAuthority, privateKeyPath, webhookSecret }, retry, externalSignal); + } finally { + if (!this.#currentRun) { + if (openedAuthority && this.#runtimeRetry?.rootAuthority !== openedAuthority) openedAuthority.close(); + this.#busy = false; + } + } + } + + async #beginResolved(resolved: ResolvedRequest, retry: boolean, externalSignal?: AbortSignal): Promise { + this.#enforceCapability(true); + if (this.#currentRun) throw new SetupRequestError('Local setup is already running'); + const runController = new AbortController(); + if (externalSignal?.aborted) runController.abort(externalSignal.reason); + else externalSignal?.addEventListener('abort', () => runController.abort(externalSignal.reason), { once: true }); + runController.signal.throwIfAborted(); + this.#busy = true; + if (this.#runtimeRetry && this.#runtimeRetry.rootAuthority !== resolved.rootAuthority) this.#runtimeRetry.rootAuthority.close(); + this.#resume = this.#resumePlan(resolved); + this.#runtimeRetry = resolved; + this.#activeSecrets = [resolved.privateKeyPath, resolved.webhookSecret].filter((value): value is string => Boolean(value)); + this.#abortController = runController; + this.#snapshot = { + phase: 'running', + capability: this.#capability(), + sessionId: this.#sessionId, + rootDir: resolved.rootDir, + state: this.#snapshot.state, + logs: retry ? [...this.#snapshot.logs, 'Retrying setup with a fresh host inspection…'].slice(-200) : [], + resume: resumeView(this.#resume), + resumeAvailable: false, + }; + this.#publish(); + const operation = this.#run(resolved, retry); + this.#currentRun = operation; + try { + return await operation; + } finally { + this.#currentRun = null; + this.#abortController = null; + this.#busy = false; + } + } + + async #run(resolved: ResolvedRequest, retry: boolean): Promise { + const signal = this.#abortController!.signal; + const reporter = { + onState: (state: SetupRunResult['state']) => { + this.#snapshot = { ...this.#snapshot, rootDir: state.rootDir, state }; + this.#publish(); + }, + onLog: (line: string) => { + this.#snapshot = { ...this.#snapshot, logs: [...this.#snapshot.logs, line].slice(-200) }; + this.#publish(); + }, + }; + try { + const result = retry && this.#result + ? await retrySetup(this.#result, { actions: this.#boundActions(resolved), prompts: this.#prompts(resolved), reporter, platform: this.#platform(), signal }) + : await runSetup({ root: resolved.rootDir, actions: this.#boundActions(resolved), prompts: this.#prompts(resolved), reporter, platform: this.#platform(), signal }); + this.#result = result; + signal.throwIfAborted(); + let profile: DesktopProfileView | undefined; + if (result.completed) { + resolved.rootAuthority.validate(); + const apiBaseUrl = await this.#options.resolveApiBaseUrl(resolved.rootDir, signal); + resolved.rootAuthority.validate(); + signal.throwIfAborted(); + profile = await this.#options.registerProfile({ name: 'This computer', apiBaseUrl }, signal); + signal.throwIfAborted(); + } + this.#snapshot = { ...this.#snapshot, phase: terminalPhase(result), rootDir: result.rootDir, state: result.state, errors: result.errors, profile }; + } catch (error) { + const cleanupIncomplete = isCleanupIncomplete(error); + const cancelled = signal.aborted && !cleanupIncomplete; + if (!cancelled) this.#diagnose('desktop.setup.run_failed', { error }); + this.#snapshot = { + ...this.#snapshot, + phase: cancelled ? 'cancelled' : 'failed', + error: cancelled ? 'Setup was cancelled.' : cleanupIncomplete ? cleanupIncompleteRendererError : safeRendererError, + }; + } + this.#publish(); + await this.#persistQueue; + return this.#copy(); + } + + #prompts(resolved: ResolvedRequest) { + const request = resolved.publicRequest; + return { + resolveStackRoot: async () => ({ rootDir: resolved.rootDir, reinitialize: request.reinitialize }), + selectAgents: async () => [...request.agents], + configureGithubAuth: async (): Promise => { + switch (request.github.mode) { + case 'keep': return { keep: true }; + case 'demo': return { mode: 'demo', vars: { PROPR_DEMO_MODE: 'true' } }; + case 'relay': return { mode: 'relay', enrollRelay: { relayUrl: DEFAULT_PROPR_GH_RELAY_URL } }; + case 'app': + if (!resolved.privateKeyPath) throw new SetupRequestError('Select the GitHub App private key again.'); + return { mode: 'app', vars: { PROPR_DEMO_MODE: 'false', GH_AUTH_MODE: 'app', GH_APP_ID: request.github.appId, HOST_GH_PRIVATE_KEY: resolved.privateKeyPath, GH_INSTALLATION_ID: request.github.installationId } }; + } + }, + confirmGithubLogin: async () => true, + confirmGithubAppInstall: async () => true, + confirmGithubAppInstalled: async () => false, + configureIntake: async () => request.intake.mode === 'keep' ? { keep: true } : request.intake.mode === 'direct_webhook' + ? { mode: request.intake.mode, webhookSecret: resolved.webhookSecret } + : { mode: request.intake.mode }, + confirmStartStack: async () => true, + confirmAgentLogin: async ({ candidates }: { candidates: string[] }) => candidates.filter(candidate => request.agents.includes(candidate)), + configureWhitelist: async () => request.whitelist, + addRepository: async () => request.repository, + launchUi: async () => false, + }; + } + + #boundActions(resolved: ResolvedRequest): SetupActions { + return bindRootOperations(this.#options.actions, resolved.rootDir, resolved.rootAuthority); + } + + #resumePlan(resolved: ResolvedRequest): ResumePlan { + const request = resolved.publicRequest; + const github: ResumePlan['github'] = request.github.mode === 'app' + ? { mode: 'app', appId: request.github.appId, installationId: request.github.installationId, reconfigurationRequired: true } + : structuredClone(request.github); + const intake: ResumePlan['intake'] = request.intake.mode === 'direct_webhook' + ? { mode: 'direct_webhook', reconfigurationRequired: true } + : structuredClone(request.intake); + return { + reinitialize: request.reinitialize, + agents: [...request.agents], + github, + intake, + whitelist: request.whitelist ? [...request.whitelist] : null, + repository: request.repository ? { ...request.repository } : null, + ...(request.github.mode === 'app' ? { reconfigurationStage: 'github' as const } : request.intake.mode === 'direct_webhook' ? { reconfigurationStage: 'intake' as const } : {}), + }; + } + + #appDataDir(): string { + return resolve(this.#options.appDataDir ?? dirname(this.#options.defaultRootDir)); + } + + #platform(): NodeJS.Platform { + return this.#options.platform ?? process.platform; + } + + #capability() { + return getLocalSetupCapability(this.#platform()); + } + + #enforceCapability(throwWhenUnsupported: boolean): void { + const capability = this.#capability(); + this.#snapshot = { ...this.#snapshot, capability, sessionId: this.#sessionId, phase: capability.supported ? this.#snapshot.phase === 'unsupported' ? 'idle' : this.#snapshot.phase : 'unsupported', ...(capability.supported ? {} : { error: capability.reason }) }; + if (!capability.supported && throwWhenUnsupported) throw new SetupRequestError(capability.reason); + } + + async #load(): Promise { + this.#hydration ??= this.#hydrate(); + await this.#hydration; + } + + async #hydrate(): Promise { + try { + const contents = readPrivateFile(this.#options.statePath); + if (!contents) throw Object.assign(new Error('missing'), { code: 'ENOENT' }); + const parsed = parsePersisted(contents.toString('utf8')); + if (parsed.rootDir !== resolve(this.#options.defaultRootDir)) throw new Error('Saved setup root is not the fixed desktop runtime root'); + this.#resume = parsed.resume; + const interrupted = parsed.phase === 'running'; + this.#snapshot = { + ...this.#snapshot, + phase: interrupted ? 'interrupted' : parsed.phase, + rootDir: parsed.rootDir, + logs: [], + resume: resumeView(parsed.resume), + resumeAvailable: true, + reconfigurationRequired: Boolean(parsed.resume.reconfigurationStage), + ...(interrupted ? { error: 'Setup was interrupted when ProPR Desktop closed. Review the saved choices to continue.' } : {}), + }; + } catch (error) { + if ((error as NodeJS.ErrnoException).code !== 'ENOENT') { + this.#diagnose('desktop.setup.hydration_failed', { error }); + this.#snapshot = { ...this.#snapshot, resumeAvailable: false, error: 'Previous setup progress could not be loaded. Resume is unavailable.' }; + } + } + this.#enforceCapability(false); + } + + #publish(): void { + this.#options.emit(this.#copy()); + if (!this.#resume || this.#persistFailed) return; + const persisted: PersistedSetupState = { + version: 3, + phase: this.#snapshot.phase === 'unsupported' ? 'idle' : this.#snapshot.phase, + rootDir: resolve(this.#options.defaultRootDir), + lastStepId: this.#snapshot.state?.steps.find(step => step.status === 'active')?.id, + resume: this.#resume, + }; + this.#persistQueue = this.#persistQueue.then(async () => { + const signal = this.#abortController?.signal; + signal?.throwIfAborted(); + // PersistedSetupState is an allowlisted, secret-free main-process schema. + // Keep its fixed root usable for hydration; renderer copies and desktop + // diagnostics apply path redaction independently. + writePrivateFileAtomic(this.#options.statePath, `${JSON.stringify(persisted, null, 2)}\n`, { signal }); + this.#snapshot = { ...this.#snapshot, resumeAvailable: true }; + }).catch(error => { + if ((error as Error).name === 'AbortError' || (error as NodeJS.ErrnoException).code === 'ABORT_ERR') return; + this.#persistFailed = true; + this.#diagnose('desktop.setup.persistence_failed', { error }); + this.#snapshot = { ...this.#snapshot, resumeAvailable: false, error: 'Setup progress could not be saved. Resume after restart is unavailable.' }; + this.#options.emit(this.#copy()); + }); + } + + #copy(): DesktopSetupSnapshot { + return redactDesktopValue(structuredClone(this.#snapshot), 0, this.#activeSecrets) as DesktopSetupSnapshot; + } + + #diagnose(event: string, fields: Record): void { + this.#options.diagnose?.(event, redactDesktopValue(fields, 0, this.#activeSecrets) as Record); + } +} diff --git a/apps/desktop/src/setup-schema.ts b/apps/desktop/src/setup-schema.ts new file mode 100644 index 000000000..bdab7e13e --- /dev/null +++ b/apps/desktop/src/setup-schema.ts @@ -0,0 +1,83 @@ +import type { DesktopSetupRequest } from './shared/contract'; + +const AGENTS = new Set(['claude', 'codex', 'antigravity', 'opencode', 'vibe']); +const CAPABILITY = /^[A-Za-z0-9_-]{32,128}$/; +const SESSION = /^[0-9a-f]{8}-[0-9a-f-]{27,40}$/i; +const INTEGER = /^[1-9][0-9]{0,19}$/; +const USERNAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/; +const REPOSITORY_NAME = /^[A-Za-z0-9_.-]{1,100}$/; +const BRANCH = /^(?!\/|.*(?:\.\.|@\{|\\|\s|[~^:?*\[]|\/\/|\.$|\.lock$))[A-Za-z0-9._/-]{1,255}$/; +const ALIAS = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/; + +export class SetupRequestError extends Error { + constructor(message = 'Invalid local setup request') { + super(message); + this.name = 'SetupRequestError'; + } +} + +const record = (value: unknown): Record => { + if (!value || typeof value !== 'object' || Array.isArray(value)) throw new SetupRequestError(); + return value as Record; +}; + +const exact = (value: Record, required: string[], optional: string[] = []): void => { + const allowed = new Set([...required, ...optional]); + if (required.some(key => !(key in value)) || Object.keys(value).some(key => !allowed.has(key))) throw new SetupRequestError(); +}; + +const bounded = (value: unknown, max: number): value is string => typeof value === 'string' && value.length > 0 && value.length <= max; + +export const parseDesktopSetupRequest = (input: unknown): DesktopSetupRequest => { + const value = record(input); + exact(value, ['sessionId', 'root', 'reinitialize', 'agents', 'github', 'intake', 'whitelist', 'repository']); + if (typeof value.sessionId !== 'string' || !SESSION.test(value.sessionId)) throw new SetupRequestError(); + if (typeof value.reinitialize !== 'boolean') throw new SetupRequestError(); + + const root = record(value.root); + if (root.mode === 'default' || root.mode === 'resume') exact(root, ['mode']); + else throw new SetupRequestError(); + + const agents = value.agents; + if (!Array.isArray(agents) || agents.length > AGENTS.size || !agents.every(item => typeof item === 'string' && AGENTS.has(item)) || new Set(agents).size !== agents.length) { + throw new SetupRequestError('Invalid agent selection'); + } + + const github = record(value.github); + switch (github.mode) { + case 'keep': case 'demo': case 'relay': exact(github, ['mode']); break; + case 'app': + exact(github, ['mode', 'appId', 'privateKeyCapability', 'installationId']); + if (!bounded(github.appId, 20) || !INTEGER.test(github.appId) || !bounded(github.installationId, 20) || !INTEGER.test(github.installationId) + || typeof github.privateKeyCapability !== 'string' || !CAPABILITY.test(github.privateKeyCapability)) throw new SetupRequestError('Invalid GitHub App configuration'); + break; + default: throw new SetupRequestError('Invalid GitHub configuration'); + } + + const intake = record(value.intake); + if (intake.mode === 'keep' || intake.mode === 'routing_websocket' || intake.mode === 'polling') exact(intake, ['mode']); + else if (intake.mode === 'direct_webhook') { + exact(intake, ['mode', 'secretCapability']); + if (typeof intake.secretCapability !== 'string' || !CAPABILITY.test(intake.secretCapability)) throw new SetupRequestError('Invalid webhook secret capability'); + } else throw new SetupRequestError('Invalid GitHub intake configuration'); + if ((github.mode === 'relay' && intake.mode === 'direct_webhook') + || (github.mode === 'app' && intake.mode === 'routing_websocket') + || (github.mode === 'demo' && intake.mode !== 'keep')) throw new SetupRequestError('GitHub intake mode is incompatible with the selected authentication mode'); + + if (value.whitelist !== null && (!Array.isArray(value.whitelist) || value.whitelist.length > 100 + || !value.whitelist.every(item => typeof item === 'string' && USERNAME.test(item)) || new Set(value.whitelist.map(item => item.toLowerCase())).size !== value.whitelist.length)) { + throw new SetupRequestError('Invalid GitHub whitelist'); + } + + if (value.repository !== null) { + const repository = record(value.repository); + exact(repository, ['fullName'], ['alias', 'baseBranch']); + const [owner, name, extra] = typeof repository.fullName === 'string' ? repository.fullName.split('/') : []; + if (!bounded(repository.fullName, 140) || extra !== undefined || !owner || !USERNAME.test(owner) || !name || !REPOSITORY_NAME.test(name) || name === '.' || name === '..' + || (repository.alias !== undefined && (typeof repository.alias !== 'string' || !ALIAS.test(repository.alias))) + || (repository.baseBranch !== undefined && (typeof repository.baseBranch !== 'string' || !BRANCH.test(repository.baseBranch)))) { + throw new SetupRequestError('Invalid repository selection'); + } + } + return structuredClone(value) as unknown as DesktopSetupRequest; +}; diff --git a/apps/desktop/src/setup-security.test.ts b/apps/desktop/src/setup-security.test.ts new file mode 100644 index 000000000..1d24a9aaa --- /dev/null +++ b/apps/desktop/src/setup-security.test.ts @@ -0,0 +1,121 @@ +import assert from 'node:assert/strict'; +import { realpathSync } from 'node:fs'; +import { chmod, mkdtemp, rename, symlink, writeFile } from 'node:fs/promises'; +import { tmpdir as systemTmpdir } from 'node:os'; +import { join } from 'node:path'; +import { describe, it } from 'node:test'; +import { SetupFilesystemCapabilities, SetupSecretCapabilities } from './setup-capabilities'; +import { parseDesktopSetupRequest } from './setup-schema'; +import { MAX_WEBHOOK_SECRET_LENGTH, MIN_WEBHOOK_SECRET_LENGTH } from './webhook-secret-policy'; + +const tmpdir = (): string => realpathSync(systemTmpdir()); + +const sessionId = '00000000-0000-4000-8000-000000000000'; +const baseRequest = () => ({ + sessionId, + root: { mode: 'default' }, + reinitialize: false, + agents: ['codex'], + github: { mode: 'relay' }, + intake: { mode: 'routing_websocket' }, + whitelist: ['octocat'], + repository: { fullName: 'integry/propr', alias: 'propr', baseBranch: 'main' }, +}); + +describe('desktop setup request schema', () => { + it('accepts the complete bounded discriminated shape and rejects unknown or mode-forbidden fields', () => { + assert.equal(parseDesktopSetupRequest(baseRequest()).github.mode, 'relay'); + assert.throws(() => parseDesktopSetupRequest({ ...baseRequest(), relayUrl: 'https://attacker.invalid' })); + assert.throws(() => parseDesktopSetupRequest({ ...baseRequest(), github: { mode: 'relay', relayUrl: 'https://attacker.invalid?token=x' } })); + assert.throws(() => parseDesktopSetupRequest({ ...baseRequest(), agents: ['shell-agent'] })); + assert.throws(() => parseDesktopSetupRequest({ ...baseRequest(), reinitialize: 'yes' })); + assert.throws(() => parseDesktopSetupRequest({ ...baseRequest(), whitelist: ['bad user'] })); + assert.throws(() => parseDesktopSetupRequest({ ...baseRequest(), repository: { fullName: '../escape' } })); + assert.throws(() => parseDesktopSetupRequest({ ...baseRequest(), root: { mode: 'selected', capability: '/forged/path' } })); + assert.throws(() => parseDesktopSetupRequest({ ...baseRequest(), intake: { mode: 'polling', webhookSecret: 'forbidden' } })); + assert.throws(() => parseDesktopSetupRequest({ ...baseRequest(), github: { mode: 'app', appId: '1', installationId: '2', privateKeyCapability: 'A'.repeat(43) }, intake: { mode: 'routing_websocket' } })); + }); +}); + +describe('desktop setup filesystem capabilities', { + skip: process.platform === 'win32' + ? 'Private-key filesystem capabilities require POSIX mode bits and symbolic-link semantics.' + : false, +}, () => { + it('binds an exact canonical private key to one session and rejects replay or path switching', async () => { + const parent = await mkdtemp(join(tmpdir(), 'propr-capability-')); + const selected = join(parent, 'selected.pem'); + await writeFile(selected, 'private key', { mode: 0o600 }); + const capabilities = new SetupFilesystemCapabilities(); + const issued = await capabilities.issue('private-key', sessionId, selected); + await assert.rejects(capabilities.validate(issued.capability, 'private-key', '11111111-1111-4111-8111-111111111111')); + assert.equal(await capabilities.validate(issued.capability, 'private-key', sessionId), selected); + capabilities.consume([issued.capability]); + await assert.rejects(capabilities.validate(issued.capability, 'private-key', sessionId)); + + const switched = await capabilities.issue('private-key', sessionId, selected); + await rename(selected, `${selected}-old`); + await writeFile(selected, 'replacement key', { mode: 0o600 }); + await assert.rejects(capabilities.validate(switched.capability, 'private-key', sessionId)); + }); + + it('expires unused capabilities after a short bounded lifetime', async () => { + const parent = await mkdtemp(join(tmpdir(), 'propr-expired-capability-')); + const selected = join(parent, 'selected.pem'); + await writeFile(selected, 'private key', { mode: 0o600 }); + let now = 1_000; + const capabilities = new SetupFilesystemCapabilities(() => now); + const issued = await capabilities.issue('private-key', sessionId, selected); + now += 5 * 60_000 + 1; + await assert.rejects(capabilities.validate(issued.capability, 'private-key', sessionId)); + }); + + it('rejects symlinks, non-regular key files, and unsafe private-key permissions', async () => { + const parent = await mkdtemp(join(tmpdir(), 'propr-key-capability-')); + const key = join(parent, 'github-app.pem'); + await writeFile(key, 'private material', { mode: 0o644 }); + const capabilities = new SetupFilesystemCapabilities(); + await assert.rejects(capabilities.issue('private-key', sessionId, key), /group or other/); + await chmod(key, 0o600); + const issued = await capabilities.issue('private-key', sessionId, key); + assert.equal(issued.label, 'github-app.pem'); + const link = join(parent, 'linked.pem'); + await symlink(key, link); + await assert.rejects(capabilities.issue('private-key', sessionId, link), /Symbolic-link/); + await assert.rejects(capabilities.issue('private-key', sessionId, parent)); + }); +}); + +describe('desktop setup secret capabilities', () => { + it('enforces the shared webhook-secret minimum and preserves the maximum during issuance and validation', () => { + const secrets = new SetupSecretCapabilities(); + assert.throws(() => secrets.issue(sessionId, 'a'.repeat(MIN_WEBHOOK_SECRET_LENGTH - 1)), /webhook secret is invalid/i); + + const shortest = 'b'.repeat(MIN_WEBHOOK_SECRET_LENGTH); + const issued = secrets.issue(sessionId, shortest); + assert.doesNotThrow(() => secrets.validate(issued.capability, sessionId)); + assert.equal(secrets.consume(issued.capability, sessionId), shortest); + + const longest = 'c'.repeat(MAX_WEBHOOK_SECRET_LENGTH); + const maximum = secrets.issue(sessionId, longest); + assert.doesNotThrow(() => secrets.validate(maximum.capability, sessionId)); + assert.equal(secrets.consume(maximum.capability, sessionId), longest); + assert.throws(() => secrets.issue(sessionId, 'd'.repeat(MAX_WEBHOOK_SECRET_LENGTH + 1)), /webhook secret is invalid/i); + }); + + it('is opaque, expiring, session-bound, single-use, and rejects forgery/replay', () => { + const sentinel = 'SENTINEL_SECRET_CAPABILITY_VALUE'; + let now = 1_000; + const secrets = new SetupSecretCapabilities(() => now); + const issued = secrets.issue(sessionId, sentinel); + assert.doesNotMatch(JSON.stringify(issued), new RegExp(sentinel)); + assert.throws(() => secrets.consume('A'.repeat(43), sessionId)); + assert.throws(() => secrets.consume(issued.capability, '11111111-1111-4111-8111-111111111111')); + const fresh = secrets.issue(sessionId, sentinel); + assert.equal(secrets.consume(fresh.capability, sessionId), sentinel); + assert.throws(() => secrets.consume(fresh.capability, sessionId)); + const expired = secrets.issue(sessionId, sentinel); + now += 5 * 60_000 + 1; + assert.throws(() => secrets.consume(expired.capability, sessionId)); + }); +}); diff --git a/apps/desktop/src/shared/contract.ts b/apps/desktop/src/shared/contract.ts index f34d23298..123b4b65b 100644 --- a/apps/desktop/src/shared/contract.ts +++ b/apps/desktop/src/shared/contract.ts @@ -3,19 +3,33 @@ export const DESKTOP_PROTOCOL = 'propr'; export const IPC_CHANNELS = Object.freeze({ appMetadata: 'desktop:app-metadata', authLogout: 'desktop:auth-logout', + authenticationPair: 'desktop:authentication-pair', + authenticationCancel: 'desktop:authentication-cancel', + connectionProbe: 'desktop:connection-probe', + connectionPrepareLocal: 'desktop:connection-prepare-local', + connectionActivateLocal: 'desktop:connection-activate-local', + connectionDiscardLocal: 'desktop:connection-discard-local', + connectionActivate: 'desktop:connection-activate', + connectionDiscard: 'desktop:connection-discard', + connectionInvalidate: 'desktop:connection-invalidate', openExternal: 'desktop:open-external', storageSecurity: 'desktop:storage-security', profilesList: 'desktop:profiles-list', profilesSave: 'desktop:profiles-save', profilesRemove: 'desktop:profiles-remove', profilesSetActive: 'desktop:profiles-set-active', - credentialsRead: 'desktop:credentials-read', - credentialsWrite: 'desktop:credentials-write', - credentialsRemove: 'desktop:credentials-remove', lifecycleStatus: 'desktop:lifecycle-status', lifecycleStart: 'desktop:lifecycle-start', lifecycleStop: 'desktop:lifecycle-stop', lifecycleRestart: 'desktop:lifecycle-restart', + discovery: 'desktop:discovery', + setupStatus: 'desktop:setup-status', + setupStart: 'desktop:setup-start', + setupRetry: 'desktop:setup-retry', + setupCancel: 'desktop:setup-cancel', + setupSelectPrivateKey: 'desktop:setup-select-private-key', + setupAcquireWebhookSecret: 'desktop:setup-acquire-webhook-secret', + setupProgress: 'desktop:setup-progress', deepLink: 'desktop:deep-link', } as const); @@ -58,14 +72,6 @@ export type StorageSecurity = { reason: 'os-encryption-unavailable' | 'insecure-basic-text-backend'; }; -export type CredentialReadResult = - | { available: false; value: null } - | { available: true; value: string | null }; - -export type CredentialWriteResult = - | { stored: true } - | { stored: false; reason: 'encryption-unavailable' }; - export type LocalLifecycleState = 'disconnected' | 'starting' | 'connected' | 'stopping' | 'error'; export interface LocalLifecycleStatus { @@ -97,15 +103,157 @@ export interface DesktopBridge { remove(profileId: string): Promise; setActive(profileId: string | null): Promise; }; - credentials: { - read(profileId: string): Promise; - write(profileId: string, value: string): Promise; - remove(profileId: string): Promise; + authentication: { + pair(profile: DesktopProfileInput): Promise<{ paired: true }>; + cancel(profileId: string): Promise; }; - lifecycle: { + connection: { + probe(profile: DesktopProfileInput): Promise; + activate(activationTicket: string): Promise; + discard(value: DesktopConnectionScope): Promise<{ discarded: boolean }>; + invalidate(value: DesktopAccessInvalidation): Promise<{ invalidated: boolean }>; + }; + lifecycle?: { status(): Promise; start(): Promise; stop(): Promise; restart(): Promise; }; } + +export type DesktopPlatformView = 'macos' | 'windows' | 'linux'; + +/** Renderer profile shape used by the shared desktop presentation layer. */ +export interface DesktopProfileView { + id: string; + name: string; + baseUrl: string; + kind: 'local' | 'remote'; + lastConnectedAt?: string; +} + +export type DesktopConnectionResult = + | { status: 'ready'; version?: string; authentication?: string; activationTicket?: string; localActivationTicket?: string } + | { status: 'authentication-required'; message?: string; version?: string; authentication?: string } + | { status: 'incompatible'; message: string; version?: string } + | { status: 'offline'; message: string }; + +export interface DesktopConnectionScope { + profileId: string; + transportScope: string; +} + +export interface DesktopActivatedConnection extends DesktopConnectionScope { + status: 'ready'; + identityEpoch: string; +} + +export interface DesktopLocalActivatedConnection { + status: 'ready'; + profileId: string; +} + +export interface DesktopAccessInvalidation extends DesktopConnectionScope { + code: string; +} + +export interface DesktopSetupRequest { + sessionId: string; + root: { mode: 'default' | 'resume' }; + reinitialize: boolean; + agents: string[]; + github: + | { mode: 'keep' } + | { mode: 'demo' } + | { mode: 'relay' } + | { mode: 'app'; appId: string; privateKeyCapability: string; installationId: string }; + intake: + | { mode: 'keep' } + | { mode: 'routing_websocket' | 'polling' } + | { mode: 'direct_webhook'; secretCapability: string }; + whitelist: string[] | null; + repository: { fullName: string; alias?: string; baseBranch?: string } | null; +} + +export interface DesktopFilesystemSelection { + capability: string; + label: string; +} + +export interface DesktopSecretSelection { + capability: string; + label: 'Secret entered'; +} + +export interface DesktopSetupResumeView { + agents: string[]; + reinitialize: boolean; + github: { mode: 'keep' | 'demo' | 'relay' } | { mode: 'app'; appId: string; installationId: string; reconfigurationRequired: true }; + intake: { mode: 'keep' | 'routing_websocket' | 'polling' } | { mode: 'direct_webhook'; reconfigurationRequired: true }; + whitelist: string[] | null; + repository: { fullName: string; alias?: string; baseBranch?: string } | null; + reconfigurationStage?: 'github' | 'intake'; +} + +export type DesktopSetupPhase = + | 'idle' + | 'running' + | 'interrupted' + | 'cancelled' + | 'failed' + | 'completed' + | 'unsupported'; + +export interface DesktopSetupSnapshot { + phase: DesktopSetupPhase; + capability: import('@propr/local-setup').LocalSetupCapability; + sessionId: string; + rootDir?: string; + state?: import('@propr/local-setup').SetupState; + logs: string[]; + errors?: import('@propr/local-setup').SetupStructuredError[]; + error?: string; + profile?: DesktopProfileView; + resume?: DesktopSetupResumeView; + resumeAvailable?: boolean; + reconfigurationRequired?: boolean; +} + +/** Narrow bridge consumed by `propr-ui/src/desktop`. */ +export interface DesktopRendererBridge { + isDesktop: true; + platform: DesktopPlatformView; + app: { + onDeepLink(listener: (url: string) => void): () => void; + }; + profiles: { + list(): Promise; + save(profile: DesktopProfileView): Promise; + remove(profileId: string): Promise; + getActiveId(): Promise; + setActiveId(profileId: string | null): Promise; + }; + discovery: { discover(): Promise }; + authentication: { + authenticate(profile: DesktopProfileView): Promise; + cancel(profileId: string): Promise; + }; + externalBrowser: { open(url: string): Promise }; + localSetup: { + status(): Promise; + start(request: DesktopSetupRequest): Promise; + retry(request?: DesktopSetupRequest): Promise; + cancel(): Promise; + selectPrivateKey(): Promise; + acquireWebhookSecret(): Promise; + onProgress(listener: (snapshot: DesktopSetupSnapshot) => void): () => void; + }; + connection: { + probe(profile: DesktopProfileView): Promise; + activateLocal(localActivationTicket: string): Promise; + discardLocal(localActivationTicket: string): Promise<{ discarded: boolean }>; + activate(activationTicket: string): Promise; + discard(value: DesktopConnectionScope): Promise<{ discarded: boolean }>; + invalidate(value: DesktopAccessInvalidation): Promise<{ invalidated: boolean }>; + }; +} diff --git a/apps/desktop/src/shutdown.ts b/apps/desktop/src/shutdown.ts new file mode 100644 index 000000000..9c9f36e9a --- /dev/null +++ b/apps/desktop/src/shutdown.ts @@ -0,0 +1,129 @@ +import type { RegisteredIpcHandlers } from './ipc'; + +interface ShutdownEvent { + preventDefault(): void; +} + +interface DestructibleWindow { + isDestroyed(): boolean; + destroy(): void; +} + +interface ShutdownOptions { + credentials: { dispose(): Promise }; + lifecycle: { shutdown(): Promise }; + setup?: { shutdown(): Promise }; + operations?: { shutdown(cleanup: () => Promise): Promise }; + ipc: RegisteredIpcHandlers; + profiles: { close(): Promise }; + sessionSecurity: { close(): void; dispose(): void }; + disposeRendererProtocol(): void; + getWindow(): DestructibleWindow | null; + quit(): void; + onStarted(): void; + log(level: 'info' | 'error', event: string, fields?: Record): void; +} + +interface ShutdownCoordinatorOptions { + drainTimeoutMs?: number; +} + +export interface DesktopShutdownCoordinator { + beforeQuit(event: ShutdownEvent): void; + readonly started: boolean; + awaitFinished(): Promise; +} + +/** + * The single production shutdown order used by Electron and lifecycle tests. + * Admission closes synchronously. Setup/lifecycle cancellation, pairing, + * credential work, and admitted IPC all drain before profiles are closed. + */ +export const createDesktopShutdownCoordinator = ( + options: ShutdownOptions, + coordinatorOptions: ShutdownCoordinatorOptions = {}, +): DesktopShutdownCoordinator => { + let state: 'idle' | 'draining' | 'allow-final-quit' | 'finished' = 'idle'; + let completion: Promise | null = null; + const drainTimeoutMs = coordinatorOptions.drainTimeoutMs ?? 15_000; + const step = (name: string): void => options.log('info', 'desktop.app.shutdown_step', { step: name }); + const bounded = async (promise: Promise, phase: string): Promise => { + let timer: ReturnType | undefined; + const timedOut = await Promise.race([ + promise.then(() => false, error => { + options.log('error', 'desktop.app.shutdown_failed', { phase, error }); + return false; + }), + new Promise(resolve => { + timer = setTimeout(() => resolve(true), drainTimeoutMs); + }), + ]); + if (timer) clearTimeout(timer); + if (timedOut) options.log('error', 'desktop.app.shutdown_forced', { phase, drainTimeoutMs }); + }; + + return { + beforeQuit(event) { + if (state === 'allow-final-quit') { + state = 'finished'; + return; + } + event.preventDefault(); + if (state !== 'idle') { + if (state === 'draining') options.log('info', 'desktop.app.shutdown_retry'); + return; + } + state = 'draining'; + options.onStarted(); + step('admission-closed'); + options.ipc.close(); + step('ipc-closed'); + options.sessionSecurity.close(); + step('session-closed'); + options.disposeRendererProtocol(); + step('protocol-disposed'); + + step('credentials-dispose-started'); + const credentialDrain = options.credentials.dispose(); + step('authentication-cleared'); + const localDrain = async (): Promise => { + await Promise.allSettled([ + options.lifecycle.shutdown(), + ...(options.setup ? [options.setup.shutdown()] : []), + ]); + }; + const operationDrain = options.operations + ? options.operations.shutdown(localDrain) + : localDrain(); + step('lifecycle-drain-started'); + const ipcDrain = options.ipc.awaitIdle(); + step('ipc-drain-started'); + + completion = bounded(Promise.allSettled([ + credentialDrain, + operationDrain, + ipcDrain, + ]).then(results => { + for (const result of results) if (result.status === 'rejected') throw result.reason; + }), 'service-drain').then(async () => { + step('service-drain-finished'); + step('profiles-close-started'); + await bounded(options.profiles.close(), 'profile-store'); + step('profiles-close-finished'); + options.sessionSecurity.dispose(); + step('session-disposed'); + options.ipc.dispose(); + step('ipc-disposed'); + const window = options.getWindow(); + if (window && !window.isDestroyed()) window.destroy(); + step('window-destroyed'); + options.log('info', 'desktop.app.shutdown'); + state = 'allow-final-quit'; + step('final-quit'); + options.quit(); + }); + }, + get started() { return state !== 'idle'; }, + awaitFinished() { return completion ?? Promise.resolve(); }, + }; +}; diff --git a/apps/desktop/src/smoke-test-authorization.test.ts b/apps/desktop/src/smoke-test-authorization.test.ts index 39058a3c1..d5ea9125e 100644 --- a/apps/desktop/src/smoke-test-authorization.test.ts +++ b/apps/desktop/src/smoke-test-authorization.test.ts @@ -111,6 +111,7 @@ describe('packaged smoke profile authorization', () => { it('registers one-shot lifecycle shutdown before smoke window creation and preserves required evidence order', () => { const main = readFileSync(fileURLToPath(new URL('./main.ts', import.meta.url)), 'utf8'); + const shutdownSource = readFileSync(fileURLToPath(new URL('./shutdown.ts', import.meta.url)), 'utf8'); const installedWindowsAppTest = readFileSync( fileURLToPath(new URL('../scripts/test-installed-windows-app.ps1', import.meta.url)), 'utf8', @@ -120,28 +121,35 @@ describe('packaged smoke profile authorization', () => { const authorized = main.indexOf("packagedSmokeEvidence?.write('desktop.smoke.authorized')"); const appReady = main.indexOf("log('info', 'desktop.app.ready'"); const beforeQuit = main.indexOf("app.on('before-quit'"); - const createWindow = main.indexOf('mainWindow = await createMainWindow()'); + const shutdownCoordinator = main.indexOf('createDesktopShutdownCoordinator({'); + const createWindow = main.indexOf('mainWindow = await createMainWindow(transportSmoke)'); const mvpReady = main.indexOf("log('info', 'desktop.renderer.mvp_flows.ready'"); const layoutReady = main.indexOf("log('info', PACKAGED_LAYOUT_READY_EVENT"); const reducedWindowReady = main.indexOf("log('info', PACKAGED_REDUCED_NATIVE_WINDOW_READY_EVENT"); const rendererReady = main.indexOf("log('info', 'desktop.renderer.ready'"); - const shutdownGuard = main.indexOf('if (shutdownStarted) return;', beforeQuit); - const preventQuit = main.indexOf('event.preventDefault();', beforeQuit); - const startShutdown = main.indexOf('shutdownStarted = true;', beforeQuit); - const lifecycleShutdown = main.indexOf('lifecycle.shutdown()', beforeQuit); - const shutdown = main.indexOf("log('info', 'desktop.app.shutdown'", beforeQuit); - const finalQuit = main.indexOf('app.quit();', shutdown); + const startShutdown = main.indexOf('onStarted: () => { shutdownStarted = true; }', shutdownCoordinator); + const preventQuit = shutdownSource.indexOf('event.preventDefault();'); + const closeIpc = shutdownSource.indexOf('options.ipc.close();', preventQuit); + const closeSession = shutdownSource.indexOf('options.sessionSecurity.close();', closeIpc); + const closeProtocol = shutdownSource.indexOf('options.disposeRendererProtocol();', closeSession); + const drainCredentials = shutdownSource.indexOf('options.credentials.dispose();', closeProtocol); + const drainOperations = shutdownSource.indexOf('options.operations.shutdown(localDrain)', drainCredentials); + const drainIpc = shutdownSource.indexOf('options.ipc.awaitIdle();', drainOperations); + const closeProfiles = shutdownSource.indexOf('options.profiles.close()', drainIpc); + const shutdown = shutdownSource.indexOf("options.log('info', 'desktop.app.shutdown'", closeProfiles); + const finalQuit = shutdownSource.indexOf('options.quit();', shutdown); const willQuit = main.indexOf("app.on('will-quit'"); const sinkClose = main.indexOf('packagedSmokeEvidence?.close()', willQuit); const requiredEvents = installedWindowsAppTest.match(/\$requiredSmokeEvents = @\(([\s\S]*?)\r?\n\)/)?.[1]; assert.ok(isolation < sink && sink < authorized); - assert.ok(authorized < appReady && appReady < beforeQuit && beforeQuit < createWindow); + assert.ok(authorized < appReady && appReady < shutdownCoordinator && shutdownCoordinator < beforeQuit && beforeQuit < createWindow); assert.ok(mvpReady < layoutReady && layoutReady < reducedWindowReady && reducedWindowReady < rendererReady); - assert.ok(beforeQuit < shutdownGuard && shutdownGuard < preventQuit && preventQuit < startShutdown); - assert.ok(startShutdown < lifecycleShutdown && lifecycleShutdown < shutdown && shutdown < finalQuit); - assert.ok(finalQuit < willQuit && willQuit < sinkClose); - assert.equal(main.match(/lifecycle\.shutdown\(\)/g)?.length, 1); + assert.ok(shutdownCoordinator < startShutdown && preventQuit < closeIpc && closeIpc < closeSession); + assert.ok(closeSession < closeProtocol && closeProtocol < drainCredentials && drainCredentials < drainOperations); + assert.ok(drainOperations < drainIpc && drainIpc < closeProfiles && closeProfiles < shutdown && shutdown < finalQuit); + assert.ok(beforeQuit < willQuit && willQuit < sinkClose); + assert.equal(shutdownSource.match(/options\.lifecycle\.shutdown\(\)/g)?.length, 1); assert.deepEqual(Array.from(requiredEvents?.matchAll(/'([^']+)'/g) ?? [], match => match[1]), [ 'desktop.smoke.authorized', 'desktop.app.ready', @@ -152,4 +160,23 @@ describe('packaged smoke profile authorization', () => { 'desktop.app.shutdown', ]); }); + + it('keeps packaged smoke inert while proving the staged Connect candidate', () => { + const main = readFileSync(fileURLToPath(new URL('./main.ts', import.meta.url)), 'utf8'); + const smokeFlowStart = main.indexOf('const profileFlow = await window.webContents.executeJavaScript'); + const smokeFlowEnd = main.indexOf("log('info', 'desktop.renderer.mvp_flows.ready'", smokeFlowStart); + const smokeFlow = main.slice(smokeFlowStart, smokeFlowEnd); + + assert.match(main, /process\.platform === 'linux' && !packagedSmokeTest\s*\? await createDesktopLocalHost/); + assert.doesNotMatch(smokeFlow, /lifecycle\.(?:start|stop|restart)|localSetup\.(?:start|retry|cancel)/); + assert.match(smokeFlow, /stagedConnectCandidate/); + assert.match(smokeFlow, /window\.__PROPR_DESKTOP__/); + assert.match(smokeFlow, /profiles\.length === 0/); + assert.match(smokeFlow, /activeProfileId === null/); + assert.match(smokeFlow, /noLifecycleOrDockerAuthority/); + assert.match(smokeFlow, /legacyRemoteOnlyLifecycleInvariant/); + assert.match(smokeFlow, /!\('lifecycle' in legacyBridge\)/); + assert.match(smokeFlow, /setup\.phase === 'unsupported'/); + assert.match(smokeFlow, /setup\.capability\?\.kind === 'remote-only'/); + }); }); diff --git a/apps/desktop/src/webhook-secret-policy.ts b/apps/desktop/src/webhook-secret-policy.ts new file mode 100644 index 000000000..84d9715c6 --- /dev/null +++ b/apps/desktop/src/webhook-secret-policy.ts @@ -0,0 +1,8 @@ +export const MIN_WEBHOOK_SECRET_LENGTH = 16; +export const MAX_WEBHOOK_SECRET_LENGTH = 512; + +/** Shared main-process policy for webhook secrets acquired and held by setup. */ +export const isValidWebhookSecret = (value: string): boolean => + value.length >= MIN_WEBHOOK_SECRET_LENGTH + && value.length <= MAX_WEBHOOK_SECRET_LENGTH + && !/[\0\r\n]/.test(value); diff --git a/docker/launcher/orchestrator.mjs b/docker/launcher/orchestrator.mjs index 311e458d8..9974ca6bc 100644 --- a/docker/launcher/orchestrator.mjs +++ b/docker/launcher/orchestrator.mjs @@ -18,7 +18,7 @@ // The CLI imports this .mjs dynamically and types it via src/orchestrator/types.ts. import { spawn, spawnSync } from 'node:child_process'; -import { createECDH, timingSafeEqual } from 'node:crypto'; +import { createECDH, randomUUID, timingSafeEqual } from 'node:crypto'; import { readFileSync, existsSync, statSync, accessSync, constants as fsConstants } from 'node:fs'; import { homedir } from 'node:os'; import { resolve, dirname, isAbsolute, join } from 'node:path'; @@ -247,14 +247,15 @@ export function resolveConfig(env = process.env, overrides = {}) { const network = overrides.network ?? env.PROPR_NETWORK ?? `${stack}-net`; const envFileLocal = overrides.envFileLocal ?? env.PROPR_LAUNCHER_ENV_FILE ?? '/app/.env'; const envFileHost = overrides.envFileHost ?? env.PROPR_ENV_FILE; + const envFileRead = overrides.envFileRead ?? envFileLocal; // NODE_ENV is special: Docker receives it from the stack's --env-file, not // from the CLI/launcher process environment. Inspect that exact source so a // developer's shell NODE_ENV cannot accidentally describe (or alter) the // packaged container runtime. - const nodeEnv = readEnvFile(envFileLocal).NODE_ENV || undefined; + const nodeEnv = readEnvFile(envFileRead).NODE_ENV || undefined; // value precedence: explicit override → process env → .env file - const get = (name) => env[name] !== undefined ? env[name] : envFileValueFrom(envFileLocal, name) || undefined; + const get = (name) => env[name] !== undefined ? env[name] : envFileValueFrom(envFileRead, name) || undefined; const hostData = overrides.hostData ?? env.PROPR_DATA_DIR; const hostLogs = overrides.hostLogs ?? env.PROPR_LOGS_DIR; @@ -386,10 +387,11 @@ export function resolveConfig(env = process.env, overrides = {}) { * `cliOverrides` lets the CLI pass in persisted config (e.g. docsEnabled from * ConfigManager) that should take precedence over env/defaults. */ -export function resolveHostConfig({ rootDir = process.cwd(), env = process.env, manifestPath, cliOverrides = {} } = {}) { +export function resolveHostConfig({ rootDir = process.cwd(), readRootDir = rootDir, env = process.env, manifestPath, cliOverrides = {} } = {}) { return resolveConfig(env, { envFileLocal: join(rootDir, '.env'), envFileHost: join(rootDir, '.env'), + envFileRead: join(readRootDir, '.env'), hostData: join(rootDir, 'data'), hostLogs: join(rootDir, 'logs'), hostRepos: join(rootDir, 'repos'), @@ -527,29 +529,86 @@ export function docker(args, { capture = false, timeout } = {}) { * On timeout it kills the child and reports an ETIMEDOUT error, matching the * spawnSync timeout contract that `dockerError` inspects. */ -export function dockerAsync(args, { timeout } = {}) { +export function dockerAsync(args, { timeout, signal, maxOutputBytes } = {}) { return new Promise((resolveResult) => { - const child = spawn('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] }); + if (signal?.aborted) { + resolveResult({ status: null, stdout: '', stderr: '', error: Object.assign(new Error('docker command cancelled'), { code: 'ABORT_ERR' }) }); + return; + } + // A separate process group lets cancellation terminate docker and every + // helper it spawned. Windows uses taskkill /T as the equivalent tree kill. + const child = spawn('docker', args, { stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' }); let stdout = ''; let stderr = ''; + let stdoutBytes = 0; + let stderrBytes = 0; + let stdoutTruncated = false; + let stderrTruncated = false; let settled = false; let timeoutError = null; const finish = (res) => { if (settled) return; settled = true; if (timer) clearTimeout(timer); - resolveResult(res); + if (killTimer) clearTimeout(killTimer); + signal?.removeEventListener('abort', abort); + resolveResult({ + ...res, + ...(stdoutTruncated ? { stdoutTruncated: true } : {}), + ...(stderrTruncated ? { stderrTruncated: true } : {}), + }); + }; + const appendOutput = (chunk, stream) => { + const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk); + if (!Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 0) { + if (stream === 'stdout') stdout += buffer.toString(); + else stderr += buffer.toString(); + return; + } + const used = stream === 'stdout' ? stdoutBytes : stderrBytes; + const remaining = Math.max(0, maxOutputBytes - used); + const captured = buffer.subarray(0, remaining); + if (stream === 'stdout') { + stdout += captured.toString(); + stdoutBytes += captured.length; + if (captured.length < buffer.length) stdoutTruncated = true; + } else { + stderr += captured.toString(); + stderrBytes += captured.length; + if (captured.length < buffer.length) stderrTruncated = true; + } + }; + const killTree = (force = false) => { + if (!child.pid) return; + if (process.platform === 'win32') { + const killer = spawn('taskkill', ['/pid', String(child.pid), '/T', ...(force ? ['/F'] : [])], { stdio: 'ignore' }); + killer.unref(); + } else { + try { process.kill(-child.pid, force ? 'SIGKILL' : 'SIGTERM'); } catch { child.kill(force ? 'SIGKILL' : 'SIGTERM'); } + } + }; + let cancellationError = null; + let killTimer = null; + const abort = () => { + cancellationError = Object.assign(new Error('docker command cancelled'), { code: 'ABORT_ERR' }); + killTree(false); + killTimer = setTimeout(() => { + killTree(true); + killTimer = setTimeout(() => finish({ status: null, stdout, stderr, error: cancellationError }), 2_000); + }, 2_000); }; const timer = timeout ? setTimeout(() => { timeoutError = Object.assign(new Error('docker command timed out'), { code: 'ETIMEDOUT' }); - child.kill('SIGKILL'); + killTree(true); + killTimer = setTimeout(() => finish({ status: null, stdout, stderr, error: timeoutError }), 2_000); }, timeout) : null; - child.stdout.on('data', (chunk) => { stdout += chunk.toString(); }); - child.stderr.on('data', (chunk) => { stderr += chunk.toString(); }); + child.stdout.on('data', (chunk) => appendOutput(chunk, 'stdout')); + child.stderr.on('data', (chunk) => appendOutput(chunk, 'stderr')); + signal?.addEventListener('abort', abort, { once: true }); child.on('error', (error) => finish({ status: null, stdout, stderr, error })); - child.on('close', (code, signal) => finish({ status: code, stdout, stderr, signal, error: timeoutError || undefined })); + child.on('close', (code, exitSignal) => finish({ status: code, stdout, stderr, signal: exitSignal, error: cancellationError || timeoutError || undefined })); }); } @@ -589,6 +648,14 @@ export function tagAgentLatest(key, imageTag) { } } +export async function tagAgentLatestAsync(key, imageTag, signal) { + if (key !== 'agent') return; + const latestTag = latestTagFor(imageTag); + if (!latestTag || latestTag === imageTag) return; + const res = await dockerAsync(['tag', imageTag, latestTag], { signal }); + if (res.status !== 0) throw new Error(`Failed to tag ${imageTag} as ${latestTag}: ${res.stderr}`); +} + export function containerExists(cfg, name) { const res = docker(['ps', '-a', '--filter', `name=^${name}$`, '--format', '{{.Names}}'], { capture: true }); return res.stdout.trim() === name; @@ -614,6 +681,17 @@ function imagePresentLocally(tag) { return res.stdout.trim().length > 0; } +async function imagePresentLocallyAsync(tag, signal) { + const res = await dockerAsync(['images', '-q', tag], { signal }); + throwIfCancelledResult(res, signal); + return res.stdout.trim().length > 0; +} + +function throwIfCancelledResult(result, signal) { + signal?.throwIfAborted(); + if (result?.error?.code === 'ABORT_ERR' || result?.error?.name === 'AbortError') throw result.error; +} + function firstLine(value) { return (value || '').trim().split('\n')[0] || ''; } @@ -636,6 +714,20 @@ function localRepoDigests(tag) { } } +async function localRepoDigestsAsync(tag, signal) { + const res = await dockerAsync(['image', 'inspect', '--format', '{{json .RepoDigests}}', tag], { signal }); + throwIfCancelledResult(res, signal); + if (res.status !== 0) return null; + try { + const parsed = JSON.parse(res.stdout.trim() || '[]'); + return Array.isArray(parsed) ? parsed.map(normalizeDigest).filter(Boolean) : []; + } catch (error) { + signal?.throwIfAborted(); + if (error?.code === 'ABORT_ERR' || error?.name === 'AbortError') throw error; + return []; + } +} + export function remoteDigestFromManifestInspectOutput(output) { return remoteDigestsFromManifestInspectOutput(output)[0] ?? null; } @@ -764,8 +856,9 @@ export function inspectImageFreshness(tag, { skipRemoteCheck = false } = {}) { } /** Async mirror of remoteManifestDigest using non-blocking docker exec. */ -async function remoteManifestDigestAsync(tag) { - const res = await dockerAsync(['manifest', 'inspect', '--verbose', tag], { timeout: REMOTE_IMAGE_CHECK_TIMEOUT_MS }); +async function remoteManifestDigestAsync(tag, signal) { + const res = await dockerAsync(['manifest', 'inspect', '--verbose', tag], { timeout: REMOTE_IMAGE_CHECK_TIMEOUT_MS, signal }); + throwIfCancelledResult(res, signal); if (res.status !== 0) { return { ok: false, error: dockerError(res, 'docker manifest inspect failed') }; } @@ -774,13 +867,15 @@ async function remoteManifestDigestAsync(tag) { if (digests.length > 0) { let allDigests = digests; if (res.stdout.trim().startsWith('[')) { - const buildx = await dockerAsync(['buildx', 'imagetools', 'inspect', tag], { timeout: REMOTE_IMAGE_CHECK_TIMEOUT_MS }); + const buildx = await dockerAsync(['buildx', 'imagetools', 'inspect', tag], { timeout: REMOTE_IMAGE_CHECK_TIMEOUT_MS, signal }); + throwIfCancelledResult(buildx, signal); if (buildx.status === 0) allDigests = appendDigest(allDigests, remoteDigestFromImagetoolsInspectOutput(buildx.stdout)); } return { ok: true, digests: allDigests, digest: allDigests[0] }; } - const buildx = await dockerAsync(['buildx', 'imagetools', 'inspect', tag], { timeout: REMOTE_IMAGE_CHECK_TIMEOUT_MS }); + const buildx = await dockerAsync(['buildx', 'imagetools', 'inspect', tag], { timeout: REMOTE_IMAGE_CHECK_TIMEOUT_MS, signal }); + throwIfCancelledResult(buildx, signal); if (buildx.status !== 0) { return { ok: false, error: dockerError(buildx, 'docker buildx imagetools inspect failed') }; } @@ -788,7 +883,9 @@ async function remoteManifestDigestAsync(tag) { if (buildxDigest) return { ok: true, digests: [buildxDigest], digest: buildxDigest }; return { ok: false, error: 'remote manifest digest was not available from docker manifest inspect or docker buildx imagetools inspect' }; - } catch { + } catch (error) { + signal?.throwIfAborted(); + if (error?.code === 'ABORT_ERR' || error?.name === 'AbortError') throw error; return { ok: false, error: 'could not parse docker manifest inspect output' }; } } @@ -798,12 +895,12 @@ async function remoteManifestDigestAsync(tag) { * synchronous; only the remote registry probe is awaited, so many tags can be * checked concurrently without blocking the event loop. */ -export async function inspectImageFreshnessAsync(tag, { skipRemoteCheck = false } = {}) { - if (!imagePresentLocally(tag)) { +export async function inspectImageFreshnessAsync(tag, { skipRemoteCheck = false, signal } = {}) { + if (!(await imagePresentLocallyAsync(tag, signal))) { return { status: 'missing', tag }; } - const localDigests = localRepoDigests(tag); + const localDigests = await localRepoDigestsAsync(tag, signal); if (!localDigests) { return { status: 'unknown', tag, error: 'local image metadata could not be inspected' }; } @@ -816,7 +913,7 @@ export async function inspectImageFreshnessAsync(tag, { skipRemoteCheck = false return { status: 'unknown', tag, localDigests, localOnly: true, error: 'local image has no registry digest; pull the tag to verify freshness' }; } - return classifyImageFreshness(tag, localDigests, await remoteManifestDigestAsync(tag)); + return classifyImageFreshness(tag, localDigests, await remoteManifestDigestAsync(tag, signal)); } function cachedImageFreshness(cache, tag, opts) { @@ -1166,13 +1263,14 @@ export function startStack(cfg, { ui = true, docs = cfg.docsEnabled, tunnel = cf return getStackStatus(cfg); } -function migrationDockerArgs(cfg) { +function migrationDockerArgs(cfg, setupRunId) { const spec = migrationSpec(cfg); return [ 'run', '--rm', '--init', '--name', `${cfg.stack}-migrate`, '--network', cfg.network, '--label', `propr.stack=${cfg.stack}`, '--label', 'propr.service=migrate', + ...(setupRunId ? ['--label', `propr.setup-run=${setupRunId}`] : []), ...spec.args, spec.image, ...spec.command, @@ -1272,96 +1370,104 @@ export function runMigrationPhase(cfg, { onLog, freshnessCache } = {}) { // one, change the other. // --------------------------------------------------------------------------- -async function containerExistsAsync(cfg, name) { - const res = await dockerAsync(['ps', '-a', '--filter', `name=^${name}$`, '--format', '{{.Names}}']); +async function containerExistsAsync(cfg, name, signal) { + const res = await dockerAsync(['ps', '-a', '--filter', `name=^${name}$`, '--format', '{{.Names}}'], { signal }); return res.stdout.trim() === name; } -async function removeIfExistsAsync(cfg, name, onLog) { - if (await containerExistsAsync(cfg, name)) { +async function removeIfExistsAsync(cfg, name, onLog, signal) { + if (await containerExistsAsync(cfg, name, signal)) { onLog?.(` · removing stale ${name}`); - await dockerAsync(['rm', '-f', name]); + await dockerAsync(['rm', '-f', name], { signal }); } } -async function containerRunningAsync(cfg, name) { - const res = await dockerAsync(['ps', '--filter', `name=^${name}$`, '--format', '{{.Names}}']); +async function containerRunningAsync(cfg, name, signal) { + const res = await dockerAsync(['ps', '--filter', `name=^${name}$`, '--format', '{{.Names}}'], { signal }); if (res.status !== 0) { throw new Error(`Cannot safely inspect ${name} before database migration: ${firstLine(res.stderr || res.error?.message || 'docker ps failed')}`); } return res.stdout.trim().split('\n').includes(name); } -async function assertNoLiveMigrationOwnerAsync(cfg, service) { +async function assertNoLiveMigrationOwnerAsync(cfg, service, signal) { if (!DATABASE_SERVICES.has(service)) return; const migrationName = `${cfg.stack}-migrate`; - if (await containerRunningAsync(cfg, migrationName)) { + if (await containerRunningAsync(cfg, migrationName, signal)) { throw new Error(`Refusing to start ${cfg.stack}-${service} while database migration owner ${migrationName} is running; the existing migration container was left untouched.`); } } -async function runningDatabaseServiceNamesAsync(cfg) { +async function runningDatabaseServiceNamesAsync(cfg, signal) { const running = []; for (const service of DATABASE_SERVICES) { const name = `${cfg.stack}-${service}`; - if (await containerRunningAsync(cfg, name)) running.push(name); + if (await containerRunningAsync(cfg, name, signal)) running.push(name); } return running; } -async function assertDatabaseServiceCanStartAsync(cfg, service, migrationHandoff) { +async function assertDatabaseServiceCanStartAsync(cfg, service, migrationHandoff, signal) { if (!DATABASE_SERVICES.has(service)) return; - await assertNoLiveMigrationOwnerAsync(cfg, service); + await assertNoLiveMigrationOwnerAsync(cfg, service, signal); if (migrationHandoff === MIGRATIONS_PREAPPLIED_HANDOFF) return; - const running = await runningDatabaseServiceNamesAsync(cfg); + const running = await runningDatabaseServiceNamesAsync(cfg, signal); if (running.length > 0) throw directDatabaseStartError(cfg, service, running); } -async function assertMigrationCanStartAsync(cfg) { - const running = await runningDatabaseServiceNamesAsync(cfg); +async function assertMigrationCanStartAsync(cfg, signal) { + const running = await runningDatabaseServiceNamesAsync(cfg, signal); if (running.length > 0) { throw new Error(`Refusing to run database migrations while database services are running (${running.join(', ')}). Stop the stack first (for the CLI, run \`propr stop\`) and retry; existing containers were left untouched.`); } const migrationName = `${cfg.stack}-migrate`; - if (await containerRunningAsync(cfg, migrationName)) { + if (await containerRunningAsync(cfg, migrationName, signal)) { throw new Error(`Database migration owner ${migrationName} is already running; it was left untouched. Wait for it to finish, inspect its logs, or stop it explicitly before retrying.`); } } -async function prepareMigrationOwnerAsync(cfg, onLog) { - await assertMigrationCanStartAsync(cfg); +async function prepareMigrationOwnerAsync(cfg, onLog, signal) { + await assertMigrationCanStartAsync(cfg, signal); const migrationName = `${cfg.stack}-migrate`; - if (!(await containerExistsAsync(cfg, migrationName))) return; + if (!(await containerExistsAsync(cfg, migrationName, signal))) return; onLog?.(` · removing stopped migration container ${migrationName}`); - const removed = await dockerAsync(['rm', migrationName]); + const removed = await dockerAsync(['rm', migrationName], { signal }); if (removed.status !== 0) { throw new Error(`Could not safely remove stopped migration container ${migrationName}; it may have started and was left untouched: ${firstLine(removed.stderr || removed.error?.message || 'docker rm failed')}`); } } -async function dockerRunDetachedAsync(cfg, name, service, args, networkMode = cfg.network) { +async function dockerRunDetachedAsync(cfg, name, service, args, networkMode = cfg.network, signal, setupRunId) { const full = [ 'run', '-d', '--init', '--name', name, '--network', networkMode, '--restart', 'unless-stopped', '--label', `propr.stack=${cfg.stack}`, '--label', `propr.service=${service}`, + ...(setupRunId ? ['--label', `propr.setup-run=${setupRunId}`] : []), ...args, ]; - const res = await dockerAsync(full); + const res = await dockerAsync(full, { signal }); if (res.status !== 0) { throw new Error(`Failed to start ${name}: ${res.stderr}`); } } /** Async mirror of ensureNetwork. */ -export async function ensureNetworkAsync(cfg, onLog) { - const res = await dockerAsync(['network', 'inspect', cfg.network]); +export async function ensureNetworkAsync(cfg, onLog, { signal, beforeMutation } = {}) { + beforeMutation?.(); + const res = await dockerAsync(['network', 'inspect', cfg.network], { signal }); + throwIfCancelledResult(res, signal); + beforeMutation?.(); if (res.status !== 0) { onLog?.(`creating network ${cfg.network}`); - await dockerAsync(['network', 'create', cfg.network]); + beforeMutation?.(); + const created = await dockerAsync(['network', 'create', cfg.network], { signal }); + throwIfCancelledResult(created, signal); + beforeMutation?.(); + if (created.status !== 0) throw new Error(`Could not create Docker network ${cfg.network}.`); } } @@ -1374,11 +1480,12 @@ async function cachedImageFreshnessAsync(cache, tag, opts) { } /** Async mirror of ensureServiceImage — pulls a missing/stale image, awaited. */ -async function ensureServiceImageAsync(cfg, service, onLog, { freshnessCache } = {}) { +async function ensureServiceImageAsync(cfg, service, onLog, { freshnessCache, signal, beforeMutation } = {}) { const tag = imageTagForService(cfg, service); if (!tag) return; const skipFreshness = skipRemoteImageCheck() || !isProprPublishedImage(cfg, tag); - const freshness = await cachedImageFreshnessAsync(freshnessCache, tag, { skipRemoteCheck: skipFreshness }); + const freshness = await cachedImageFreshnessAsync(freshnessCache, tag, { skipRemoteCheck: skipFreshness, signal }); + beforeMutation?.(); if (freshness.status === 'current') return; if (freshness.status === 'unknown') { if (freshness.skipped) return; @@ -1391,23 +1498,37 @@ async function ensureServiceImageAsync(cfg, service, onLog, { freshnessCache } = } else { onLog?.(` · pulling ${tag}`); } - const res = await dockerAsync(['pull', tag]); + beforeMutation?.(); + const res = await dockerAsync(['pull', tag], { signal }); + beforeMutation?.(); if (res.status !== 0) { throw new Error(`Failed to pull ${tag}: ${(res.stderr || '').trim()}`); } } /** Async mirror of startService. */ -export async function startServiceAsync(cfg, service, { onLog, pull = true, freshnessCache, migrationHandoff } = {}) { +export async function startServiceAsync(cfg, service, { onLog, pull = true, freshnessCache, migrationHandoff, signal, setupRunId, beforeLaunch, returnStatus = true } = {}) { const name = `${cfg.stack}-${service}`; - await assertDatabaseServiceCanStartAsync(cfg, service, migrationHandoff); - if (pull) await ensureServiceImageAsync(cfg, service, onLog, { freshnessCache }); + await assertDatabaseServiceCanStartAsync(cfg, service, migrationHandoff, signal); + beforeLaunch?.(); + if (pull) await ensureServiceImageAsync(cfg, service, onLog, { freshnessCache, signal, beforeMutation: beforeLaunch }); + beforeLaunch?.(); const spec = withMigrationPolicy(buildServiceSpec(cfg, service), service, migrationHandoff); - await removeIfExistsAsync(cfg, name, onLog); + if (setupRunId) { + if (await containerExistsAsync(cfg, name, signal)) { + throw new Error(`Refusing to replace preexisting container ${name} during setup; it was left untouched.`); + } + beforeLaunch?.(); + } else { + await removeIfExistsAsync(cfg, name, onLog, signal); + } const runArgs = [...spec.args, spec.image, ...(spec.command || [])]; - await dockerRunDetachedAsync(cfg, name, service, runArgs, spec.networkMode); + signal?.throwIfAborted(); + beforeLaunch?.(); + await dockerRunDetachedAsync(cfg, name, service, runArgs, spec.networkMode, signal, setupRunId); + beforeLaunch?.(); onLog?.(` [ok] started ${name}`); - return getServiceStateAsync(cfg, service); + return returnStatus ? getServiceStateAsync(cfg, service, signal) : undefined; } /** Async mirror of stopService (used by startStackAsync's rollback). */ @@ -1432,63 +1553,374 @@ async function stopServiceAsync(cfg, service, { remove = true, onLog } = {}) { * without blocking the event loop, rolling back already-started services on a * mid-startup failure (best effort) before rethrowing. */ -export async function startStackAsync(cfg, { ui = true, docs = cfg.docsEnabled, tunnel = cfg.uiTunnelEnabled, onLog } = {}) { +export async function startStackAsync(cfg, { ui = true, docs = cfg.docsEnabled, tunnel = cfg.uiTunnelEnabled, onLog, signal, beforeLaunch } = {}) { const toStart = [...CORE_SERVICES, ...(ui ? ['ui'] : []), ...(docs ? ['docs'] : []), ...(tunnel ? ['tunnel'] : [])]; - const started = []; + const setupRunId = randomUUID(); + const journal = []; const freshnessCache = new Map(); + const recordBeforeLaunch = async (name, service) => { + beforeLaunch?.(); + const preexisting = await containerExistsAsync(cfg, name, signal); + beforeLaunch?.(); + journal.push({ name, service, preexisting }); + if (preexisting) throw new Error(`Refusing to replace preexisting container ${name} during setup; it was left untouched.`); + }; try { - await runMigrationPhaseAsync(cfg, { onLog, freshnessCache }); + signal?.throwIfAborted(); + await recordBeforeLaunch(`${cfg.stack}-migrate`, 'migrate'); + await runMigrationPhaseAsync(cfg, { onLog, freshnessCache, signal, setupRunId, beforeLaunch }); for (const service of toStart) { + await recordBeforeLaunch(`${cfg.stack}-${service}`, service); await startServiceAsync(cfg, service, { onLog, freshnessCache, migrationHandoff: MIGRATIONS_PREAPPLIED_HANDOFF, pull: !DATABASE_SERVICES.has(service), + signal, + setupRunId, + beforeLaunch, + returnStatus: false, }); - started.push(service); } + signal?.throwIfAborted(); + beforeLaunch?.(); + const status = await getStackStatusAsync(cfg, signal); + signal?.throwIfAborted(); + beforeLaunch?.(); + return status; } catch (err) { - onLog?.(` ! startup failed (${err.message}) — rolling back already-started services`); - for (const service of started.reverse()) { - try { - await stopServiceAsync(cfg, service, { onLog }); - } catch (stopErr) { - onLog?.(` ! rollback: ${stopErr.message}`); - } + onLog?.(` ! startup failed (${err.message}) — cleaning up run-owned containers`); + try { + await cleanupSetupRunContainers(cfg, setupRunId, journal, onLog); + } catch (cleanupError) { + const failure = new AggregateError( + [err, cleanupError], + `Stack startup failed and run-owned container cleanup is incomplete: ${cleanupError.message}`, + ); + failure.code = 'PROPR_SETUP_CLEANUP_INCOMPLETE'; + throw failure; } throw err; } - return getStackStatusAsync(cfg); } /** Async mirror of runMigrationPhase for the interactive setup UI. */ -export async function runMigrationPhaseAsync(cfg, { onLog, freshnessCache } = {}) { - await assertMigrationCanStartAsync(cfg); - await ensureServiceImageAsync(cfg, 'daemon', onLog, { freshnessCache }); - await prepareMigrationOwnerAsync(cfg, onLog); +export async function runMigrationPhaseAsync(cfg, { onLog, freshnessCache, signal, setupRunId, beforeLaunch } = {}) { + await assertMigrationCanStartAsync(cfg, signal); + beforeLaunch?.(); + await ensureServiceImageAsync(cfg, 'daemon', onLog, { freshnessCache, signal, beforeMutation: beforeLaunch }); + beforeLaunch?.(); + if (setupRunId) { + const migrationName = `${cfg.stack}-migrate`; + if (await containerExistsAsync(cfg, migrationName, signal)) { + throw new Error(`Refusing to replace preexisting container ${migrationName} during setup; it was left untouched.`); + } + } else { + await prepareMigrationOwnerAsync(cfg, onLog, signal); + } onLog?.(' · running database migrations'); - const res = await dockerAsync(migrationDockerArgs(cfg)); + signal?.throwIfAborted(); + beforeLaunch?.(); + const res = await dockerAsync(migrationDockerArgs(cfg, setupRunId), { signal }); + beforeLaunch?.(); if (res.status !== 0) throw migrationFailure(res); onLog?.(' [ok] database migrations completed'); } +const SETUP_CLEANUP_INSPECT_TIMEOUT_MS = 3_000; +const SETUP_CLEANUP_QUERY_TIMEOUT_MS = 3_000; +// `docker stop -t 2` gets its full grace plus three seconds of daemon overhead. +const SETUP_CLEANUP_STOP_TIMEOUT_MS = 5_000; +const SETUP_CLEANUP_REMOVE_TIMEOUT_MS = 4_000; +const SETUP_CLEANUP_WIDE_TIMEOUT_MS = 20_000; +const SETUP_CLEANUP_OUTPUT_LIMIT_BYTES = 8_192; +const STRICT_DOCKER_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/; + +function assertSetupCleanupEntry(cfg, entry) { + const validService = entry?.service === 'migrate' || SERVICES.includes(entry?.service); + if (!validService || typeof entry?.name !== 'string' + || !STRICT_DOCKER_NAME_PATTERN.test(entry.name) + || entry.name !== `${cfg.stack}-${entry.service}`) { + throw new Error('setup cleanup journal contains an invalid container identity'); + } +} + +function exactDockerNameFilter(name) { + // Docker's name filter is a regular expression over a leading-slash name. + // Escape every regexp metacharacter that the validated Docker alphabet can + // contain so a stack name with dots still means one literal exact name. + return `name=^/${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`; +} + +function successfulBoundedDockerResult(result) { + return result.status === 0 + && !result.error + && !result.signal + && !result.stdoutTruncated + && !result.stderrTruncated; +} + +function parseExactNameQuery(stdout, expectedName) { + if (stdout === '') return 'absent'; + // One JSON row may have Docker's single line terminator. Whitespace-only + // output, extra blank lines, and every multi-row shape are not empty proof. + const row = stdout.match(/^([^\r\n]+)(?:\r?\n)?$/)?.[1]; + if (!row) return 'ambiguous'; + try { + const name = JSON.parse(row); + return typeof name === 'string' && name === expectedName ? 'present' : 'ambiguous'; + } catch { + return 'ambiguous'; + } +} + +/** + * Cleanup uses a fresh signal because the setup signal is already aborted. + * Journal entries are independent exact names, so clean them concurrently: the + * wide deadline covers one bounded inspect/stop/reinspect/rm/reinspect chain, + * rather than multiplying the two-second stop grace by up to nine services. + */ +async function cleanupSetupRunContainers(cfg, setupRunId, journal, onLog) { + const cleanup = new AbortController(); + const timer = setTimeout(() => cleanup.abort(new Error('setup cleanup deadline exceeded')), SETUP_CLEANUP_WIDE_TIMEOUT_MS); + const entries = [...journal].reverse().filter((entry) => !entry.preexisting); + const command = (args, timeout, capture = false) => dockerAsync(args, { + signal: cleanup.signal, + timeout, + maxOutputBytes: capture ? SETUP_CLEANUP_OUTPUT_LIMIT_BYTES : 0, + }); + const proveExactNameAfterInspectFailure = async (entry) => { + const queried = await command([ + 'ps', '-a', + '--filter', exactDockerNameFilter(entry.name), + '--format', '{{json .Names}}', + ], SETUP_CLEANUP_QUERY_TIMEOUT_MS, true); + if (!successfulBoundedDockerResult(queried)) return { state: 'unresolved' }; + const proof = parseExactNameQuery(queried.stdout, entry.name); + if (proof === 'absent') return { state: 'absent' }; + return proof === 'present' ? { state: 'unresolved-present' } : { state: 'unresolved' }; + }; + const classify = async (entry) => { + assertSetupCleanupEntry(cfg, entry); + const inspected = await command( + ['inspect', '--format', '{{json .Config.Labels}}', entry.name], + SETUP_CLEANUP_INSPECT_TIMEOUT_MS, + true, + ); + if (!successfulBoundedDockerResult(inspected)) { + return proveExactNameAfterInspectFailure(entry); + } + try { + const labels = JSON.parse(inspected.stdout.trim()); + if (!labels || Array.isArray(labels) || typeof labels !== 'object') { + return proveExactNameAfterInspectFailure(entry); + } + return labels['propr.stack'] === cfg.stack + && labels?.['propr.service'] === entry.service + && labels?.['propr.setup-run'] === setupRunId + ? { state: 'owned' } + : { state: 'foreign' }; + } catch { + return proveExactNameAfterInspectFailure(entry); + } + }; + try { + const settled = await Promise.allSettled(entries.map(async (entry) => { + const beforeStop = await classify(entry); + if (beforeStop.state === 'absent' || beforeStop.state === 'foreign') return; + if (beforeStop.state !== 'owned') throw new Error('container absence could not be proved before stop'); + await command(['stop', '-t', '2', entry.name], SETUP_CLEANUP_STOP_TIMEOUT_MS); + // A nonzero stop can mean the owned container exited between + // inspect and stop while its stopped record still exists. The + // second exact-label inspection, not the stop status, decides + // whether it remains safe to force-remove that same record. + const afterStop = await classify(entry); + if (afterStop.state === 'absent' || afterStop.state === 'foreign') return; + if (afterStop.state !== 'owned') throw new Error('container absence could not be proved after stop'); + await command(['rm', '-f', entry.name], SETUP_CLEANUP_REMOVE_TIMEOUT_MS); + const afterRemove = await classify(entry); + if (afterRemove.state === 'absent' || afterRemove.state === 'foreign') { + onLog?.(` [ok] removed run-owned ${entry.name}`); + return; + } + throw new Error(afterRemove.state === 'owned' + ? 'run-owned container remains after remove' + : 'container absence could not be proved after remove'); + })); + const failures = settled.flatMap((result, index) => result.status === 'rejected' + ? [`${entries[index].name}: rollback step could not be proved complete`] + : []); + + // Await every entry, then independently prove no exact same-run record + // remains. Foreign replacements deliberately fail the label match and + // are therefore preserved and not reported as residual run ownership. + const terminal = await Promise.all(entries.map(async (entry) => { + try { return await classify(entry); } catch { return { state: 'unresolved' }; } + })); + failures.push(...terminal.flatMap((result, index) => { + if (result.state === 'absent' || result.state === 'foreign') return []; + return [`${entries[index].name}: ${result.state === 'owned' || result.state === 'unresolved-present' + ? 'run-owned container may remain' + : 'container absence could not be proved'}`]; + })); + if (failures.length) { + for (const failure of failures) onLog?.(` ! rollback: ${failure}`); + throw new Error('run-owned container cleanup could not be proved complete'); + } + } finally { + clearTimeout(timer); + } +} + /** Async mirror of getStackStatus. */ -export async function getStackStatusAsync(cfg) { - const res = await dockerAsync(STACK_STATUS_PS_ARGS); +export async function getStackStatusAsync(cfg, signal) { + signal?.throwIfAborted(); + const res = await dockerAsync(STACK_STATUS_PS_ARGS, { signal }); + signal?.throwIfAborted(); + if (res.error || res.status !== 0) { + const detail = firstLine(res.stderr || res.error?.message || `docker ps exited with status ${res.status}`); + throw new Error(`Failed to inspect stack status: ${detail}`); + } return parseStackStatus(cfg, res.stdout); } /** Async mirror of getServiceState. */ -async function getServiceStateAsync(cfg, service) { - return (await getStackStatusAsync(cfg)).services.find((s) => s.service === service); +async function getServiceStateAsync(cfg, service, signal) { + return (await getStackStatusAsync(cfg, signal)).services.find((s) => s.service === service); } /** Async mirror of isStackRunning. */ -export async function isStackRunningAsync(cfg) { - const status = await getStackStatusAsync(cfg); +export async function isStackRunningAsync(cfg, signal) { + const status = await getStackStatusAsync(cfg, signal); return status.services.some((s) => CORE_SERVICES.includes(s.service) && s.running); } +function expectedServiceBinds(cfg, service) { + const args = buildServiceSpec(cfg, service).args; + const binds = []; + for (let index = 0; index < args.length; index += 1) { + if (args[index] === '-v') { + const bind = args[index + 1]; + const source = bind.split(':', 1)[0]; + if ((source.startsWith('/') && /(?:^|\/)(?:proc\/(?:[0-9]+|self|thread-self)\/fd|dev\/fd)(?:\/|$)/.test(source)) + || (!source.startsWith('/') && !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(source))) { + throw new Error(`Lifecycle recovery requires stable Docker bind sources for ${service}.`); + } + binds.push(bind); + } + } + return binds.sort(); +} + +function assertStableLifecycleConfig(cfg) { + for (const path of [cfg.envFileHost, cfg.hostData, cfg.hostLogs, cfg.hostRepos]) { + if (!isAbsolute(path) || /(?:^|\/)(?:proc\/(?:[0-9]+|self|thread-self)\/fd|dev\/fd)(?:\/|$)/.test(path)) { + throw new Error('Lifecycle recovery requires stable fixed-root Docker bind paths.'); + } + } +} + +async function inspectLifecycleContainer(cfg, service, signal, assertRootAuthority) { + const name = `${cfg.stack}-${service}`; + assertRootAuthority?.(); + const inspected = await dockerAsync(['inspect', name], { signal }); + throwIfCancelledResult(inspected, signal); + assertRootAuthority?.(); + if (inspected.status !== 0) { + const detail = firstLine(inspected.stderr || inspected.error?.message); + if (/no such (?:object|container)/i.test(detail)) return { name, service, exists: false, running: false }; + throw new Error(`Could not safely inspect ${name}; no lifecycle mutation was attempted.`); + } + let value; + try { + const parsed = JSON.parse(inspected.stdout); + value = Array.isArray(parsed) ? parsed[0] : parsed; + } catch { + throw new Error(`Refusing lifecycle recovery for ${name}: its Docker inspection was malformed; it was left untouched.`); + } + const labels = value?.Config?.Labels; + const containerId = typeof value?.Id === 'string' && value.Id.length > 0 ? value.Id : null; + const inspectedName = typeof value?.Name === 'string' ? value.Name.replace(/^\//, '') : null; + const actualBinds = Array.isArray(value?.HostConfig?.Binds) ? [...value.HostConfig.Binds].sort() : []; + const expectedBinds = expectedServiceBinds(cfg, service); + if (!containerId || inspectedName !== name + || labels?.['propr.stack'] !== cfg.stack || labels?.['propr.service'] !== service + || JSON.stringify(actualBinds) !== JSON.stringify(expectedBinds)) { + throw new Error(`Refusing lifecycle recovery for ${name}: ownership or fixed-root binds do not match; it was left untouched.`); + } + return { id: containerId, name, service, exists: true, running: value?.State?.Running === true }; +} + +/** + * Resume only an already-created, exactly owned lifecycle stack. Setup-run + * creation remains transactional and uses startStackAsync; this path never + * adopts or replaces a same-name container with mismatched labels or binds. + */ +export async function recoverStackAsync(cfg, { ui = true, docs = cfg.docsEnabled, tunnel = cfg.uiTunnelEnabled, signal, onLog, assertRootAuthority } = {}) { + assertStableLifecycleConfig(cfg); + assertRootAuthority?.(); + const services = [...CORE_SERVICES, ...(ui ? ['ui'] : []), ...(docs ? ['docs'] : []), ...(tunnel ? ['tunnel'] : [])]; + const inspected = []; + for (const service of services) inspected.push(await inspectLifecycleContainer(cfg, service, signal, assertRootAuthority)); + const existing = inspected.filter((entry) => entry.exists); + if (existing.length === 0) return { recovered: false }; + if (existing.length !== inspected.length) { + throw new Error('Refusing partial lifecycle recreation: expected service containers are missing; existing containers were left untouched.'); + } + for (const entry of inspected) { + signal?.throwIfAborted(); + if (entry.running) continue; + const current = await inspectLifecycleContainer(cfg, entry.service, signal, assertRootAuthority); + if (!current.exists || current.running) continue; + assertRootAuthority?.(); + const started = await dockerAsync(['start', current.id], { signal }); + throwIfCancelledResult(started, signal); + assertRootAuthority?.(); + if (started.status !== 0) throw new Error(`Could not restart ${entry.name}; remaining containers were left untouched.`); + const verified = await inspectLifecycleContainer(cfg, entry.service, signal, assertRootAuthority); + if (!verified.exists || !verified.running) throw new Error(`Could not verify ${entry.name} after restart.`); + onLog?.(` [ok] restarted ${entry.name}`); + } + return { recovered: true }; +} + +/** Report desktop lifecycle state only after every same-name service is verified. */ +export async function isLifecycleStackRunningAsync(cfg, { signal, assertRootAuthority } = {}) { + assertStableLifecycleConfig(cfg); + assertRootAuthority?.(); + const inspected = []; + for (const service of SERVICES) inspected.push(await inspectLifecycleContainer(cfg, service, signal, assertRootAuthority)); + return inspected.some((entry) => CORE_SERVICES.includes(entry.service) && entry.running); +} + +/** Stop only exact expected service names after labels and binds are verified. */ +export async function stopLifecycleStackAsync(cfg, { signal, onLog, assertRootAuthority } = {}) { + assertStableLifecycleConfig(cfg); + assertRootAuthority?.(); + const inspected = []; + for (const service of SERVICES) inspected.push(await inspectLifecycleContainer(cfg, service, signal, assertRootAuthority)); + const failed = []; + for (const entry of inspected.filter((value) => value.exists && value.running).reverse()) { + try { + const current = await inspectLifecycleContainer(cfg, entry.service, signal, assertRootAuthority); + if (!current.exists || !current.running) continue; + assertRootAuthority?.(); + const stopped = await dockerAsync(['stop', '-t', '10', current.id], { signal }); + assertRootAuthority?.(); + // Always re-inspect after the stop result. A replacement is never + // removed or retried; exact ownership is required on every pass. + await inspectLifecycleContainer(cfg, entry.service, signal, assertRootAuthority); + if (stopped.status !== 0) throw new Error(`Could not stop ${entry.name}.`); + onLog?.(` [ok] stopped ${entry.name}`); + } catch (error) { + signal?.throwIfAborted(); + failed.push(entry.name); + onLog?.(` ! ${error instanceof Error ? error.message : String(error)}`); + } + } + return { failed }; +} + /** * Stop every container belonging to this stack, discovered by the stack label. * Returns `{ failed }` listing containers that could not be stopped/removed so @@ -1691,7 +2123,7 @@ export function validateEnv(cfg) { // Docker name constraint — the stack name is embedded in container, volume // and network names, so reject it early instead of failing mid-startup. - const dockerNamePattern = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/; + const dockerNamePattern = STRICT_DOCKER_NAME_PATTERN; if (!dockerNamePattern.test(cfg.stack)) { errors.push(`PROPR_STACK ("${cfg.stack}") is not a valid Docker name — use letters, digits, '_', '.' or '-', starting with a letter or digit.`); } diff --git a/package-lock.json b/package-lock.json index 9b8e9b63c..431e758d0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -75,6 +75,12 @@ "name": "@propr/desktop", "version": "0.8.15", "license": "Apache-2.0", + "dependencies": { + "@propr/cli": "*", + "@propr/client": "*", + "@propr/local-setup": "*", + "@propr/shared": "*" + }, "devDependencies": { "@electron-forge/cli": "8.0.0-alpha.10", "@electron-forge/maker-deb": "8.0.0-alpha.10", diff --git a/package.json b/package.json index 2e2b3cf33..087e1281a 100644 --- a/package.json +++ b/package.json @@ -19,13 +19,14 @@ "lint": "eslint src/", "typecheck": "tsc --noEmit", "test": "node --test", - "test:prepare": "npm run build --workspace=packages/shared && npm run build --workspace=packages/core && npm run build --workspace=packages/local-setup && npm run build --workspace=packages/cli", + "test:prepare": "npm run build --workspace=packages/shared && npm run build --workspace=packages/core && npm run build --workspace=packages/client && npm run build --workspace=packages/local-setup && npm run build --workspace=packages/cli", "test:server": "node scripts/run-test-suite.mjs", "test:full:prepared": "npm run test:server", "test:full": "npm run test:prepare && npm run test:full:prepared", "test:notifications:server": "node scripts/run-test-suite.mjs test/notificationSchema.test.ts test/notificationPreferenceMigration.test.ts packages/core/test/notificationService.test.ts packages/core/test/planNotificationActionsMigration.test.ts packages/core/test/pushSubscriptionExpiration.test.ts packages/api/test/notificationRoutes.test.ts packages/api/test/notificationManagementRoutes.test.ts packages/api/test/notificationProjectionService.test.ts packages/api/test/webPushDispatcher.test.ts", "test:notifications:ui": "npm --workspace propr-ui test -- src/api/notificationApi.test.ts src/serviceWorker.test.ts src/serviceWorkerRegistration.test.ts src/hooks/useBrowserPush.test.tsx src/pages/SettingsPage/NotificationSettingsSection.test.tsx src/pages/InboxPage.test.tsx src/pages/inboxUtils.test.ts src/components/Inbox/NotificationActions.test.tsx src/components/MobileBottomNavigation.test.tsx src/contexts/NotificationCenterContext.test.tsx src/utils/notificationIntents.test.ts src/pages/PlanStudioPage.notificationIntent.test.tsx src/components/TaskPlanner/PlanEditor.notificationIntent.test.tsx src/components/TaskPlanner/PlanIssuesManager.notificationIntent.test.tsx src/components/TaskPlanner/PlanEditor.responsive.test.tsx", "test:notifications": "npm run build -w @propr/shared && npm run build -w @propr/core && npm run test:notifications:server && npm run test:notifications:ui", + "pretest:unit": "npm run build -w @propr/shared && npm run build -w @propr/local-setup", "test:unit": "NODE_ENV=test npx tsx --experimental-test-module-mocks --test test/minimal.test.ts test/modelName.test.ts test/agentContainerResources.test.ts test/agentDockerfileSupplyChain.test.ts test/daemonEventIntake.test.ts test/databaseMigrationGate.test.ts test/generateContext.test.ts test/githubEventIntakeMode.test.ts test/intakeModePrerequisites.test.ts test/orchestratorMigrationPhase.test.mjs test/validateRoutingUrl.test.ts test/routingWebSocketProtocol.test.ts test/routingWebSocketIntakeService.test.ts test/routingStatusPublisher.test.ts test/releaseValidation.test.mjs test/sessionSecret.test.ts test/testSuiteRunner.test.mjs packages/api/test/connectAuth.test.ts packages/api/test/attachmentUploadCleanup.test.ts packages/api/test/configReloadSubscription.test.ts packages/api/test/dockerCommandSafety.test.ts packages/api/test/listenAddress.test.ts packages/api/test/oauthState.test.ts packages/api/test/requestRateLimits.test.ts packages/api/test/statusRoutes.test.ts packages/api/test/agentRuntimeRoutes.test.ts packages/api/test/instanceAuthorization.test.ts packages/api/test/routeAuthorization.test.ts", "test:e2e": "npx tsx --test test/e2e.test.ts", "test:docker": "docker-compose run --rm -e REDIS_HOST=redis -e NODE_ENV=test worker npx tsx --test test/*.test.ts", @@ -72,7 +73,7 @@ "deploy:hosted-ui": "npm run build -w propr-ui && npx wrangler deploy --config wrangler.hosted-ui.toml", "desktop": "npm run dev -w @propr/desktop", "desktop:dev": "npm run dev -w @propr/desktop", - "desktop:prepare": "npm run build -w @propr/shared && npm run build -w @propr/client", + "desktop:prepare": "npm run build -w @propr/shared && npm run build -w @propr/client && npm run build -w @propr/local-setup && npm run build -w @propr/cli", "desktop:typecheck": "npm run typecheck -w @propr/desktop && npm run typecheck -w propr-ui", "desktop:test": "npm run test -w @propr/desktop", "desktop:package": "npm run package -w @propr/desktop", diff --git a/packages/api/authRedirect.ts b/packages/api/authRedirect.ts index 2679c2094..f473b6c49 100644 --- a/packages/api/authRedirect.ts +++ b/packages/api/authRedirect.ts @@ -1,4 +1,5 @@ import { isIP } from 'net'; +import { canonicalProprHttpUrlOrigin, isProprLoopbackHostname } from '@propr/shared'; import type { AllowedRedirectHost } from './authTypes.js'; function isValidHostname(hostname: string): boolean { @@ -59,8 +60,8 @@ function isAllowedRedirectHost(hostname: string): boolean { } function isLocalHttpRedirectHost(hostname: string): boolean { - const normalized = normalizeHostname(hostname); - return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1'; + const normalized = hostname.includes(':') ? `[${normalizeHostname(hostname)}]` : normalizeHostname(hostname); + return isProprLoopbackHostname(normalized); } // HTTPS is required for all non-local redirect targets by default. HTTP is only @@ -79,6 +80,7 @@ export function getValidatedRedirectTo(redirectTo: string | undefined): string | try { const url = new URL(redirectTo); const hostname = normalizeHostname(url.hostname); + if (canonicalProprHttpUrlOrigin(redirectTo, { allowInsecureHttp: allowHttp }) !== url.origin) return undefined; if (url.protocol === 'https:' && isAllowedRedirectHost(hostname)) return url.toString(); if (url.protocol === 'http:' && isAllowedRedirectHost(hostname) && (allowHttp || isLocalHttpRedirectHost(hostname))) return url.toString(); } catch { diff --git a/packages/api/authSession.ts b/packages/api/authSession.ts index 10d347fce..28c419458 100644 --- a/packages/api/authSession.ts +++ b/packages/api/authSession.ts @@ -1,5 +1,6 @@ import type session from 'express-session'; import type { Request, Response } from 'express'; +import { isProprLoopbackHostname, normalizeProprApiOrigin } from '@propr/shared'; import { getDefaultRedirectUrl } from './authRedirect.js'; import { isUserWhitelisted } from './userWhitelist.js'; @@ -16,9 +17,13 @@ export function getSessionCookieDomain(): string | undefined { export function shouldUseSecureSessionCookie(cookieDomain: string | undefined): boolean { try { if (process.env.API_PUBLIC_URL) { - const url = new URL(process.env.API_PUBLIC_URL); + const raw = process.env.API_PUBLIC_URL; + const url = new URL(raw); if (url.protocol === 'https:') return true; - if (url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]')) return false; + if (normalizeProprApiOrigin(raw) !== url.origin) { + return process.env.NODE_ENV === 'production' || Boolean(cookieDomain); + } + if (url.protocol === 'http:' && isProprLoopbackHostname(url.hostname)) return false; } return process.env.NODE_ENV === 'production' || Boolean(cookieDomain); } catch { diff --git a/packages/api/connectAuth.ts b/packages/api/connectAuth.ts index f810c61ee..da87a50eb 100644 --- a/packages/api/connectAuth.ts +++ b/packages/api/connectAuth.ts @@ -1,5 +1,10 @@ import type { GitHubUser } from './authTypes.js'; -import { DEFAULT_PROPR_GH_RELAY_URL } from '@propr/shared'; +import { + DEFAULT_PROPR_GH_RELAY_URL, + canonicalProprHttpUrlOrigin, + isProprLoopbackHostname, + normalizeProprApiOrigin, +} from '@propr/shared'; export const DEFAULT_PROPR_CONNECT_ORIGIN = 'https://connect.propr.dev'; const CONNECT_REDEEM_TIMEOUT_MS = 20_000; @@ -35,7 +40,10 @@ export function buildConnectAuthorizationUrl(options: { installationId?: string; }): string { const origin = new URL(options.connectOrigin || DEFAULT_PROPR_CONNECT_ORIGIN); - if (origin.protocol !== 'https:' || origin.username || origin.password || origin.search || origin.hash) { + if (origin.protocol !== 'https:' + || origin.search + || origin.hash + || normalizeProprApiOrigin(options.connectOrigin || DEFAULT_PROPR_CONNECT_ORIGIN) !== origin.origin) { throw new Error('PROPR_CONNECT_URL must be a bare HTTPS origin'); } const url = new URL('/instance-login', origin); @@ -54,9 +62,12 @@ export async function redeemConnectAuthorizationCode(options: { fetchImpl?: typeof fetch; }): Promise { const fetchImpl = options.fetchImpl ?? fetch; - const relayBase = options.relayUrl.trim().replace(/\/+$/, ''); + const relayRaw = options.relayUrl.trim(); + const relayBase = relayRaw.replace(/\/+$/, ''); const endpoint = new URL(`${relayBase}/auth/instance-grants/redeem`); - if (endpoint.protocol !== 'https:' && endpoint.hostname !== 'localhost' && endpoint.hostname !== '127.0.0.1') { + const canonicalRelayOrigin = canonicalProprHttpUrlOrigin(relayRaw); + if (!canonicalRelayOrigin + || (endpoint.protocol === 'http:' && !isProprLoopbackHostname(endpoint.hostname))) { throw new Error('PROPR_GH_RELAY_URL must use HTTPS'); } @@ -137,7 +148,9 @@ function isHostedConnectPath(env: NodeJS.ProcessEnv): boolean { function normalizeServiceUrl(value: string | undefined): string | undefined { try { if (!value?.trim()) return undefined; - const url = new URL(value.trim()); + const raw = value.trim(); + const url = new URL(raw); + if (canonicalProprHttpUrlOrigin(raw) !== url.origin) return undefined; if (url.username || url.password || url.search || url.hash) return undefined; const path = url.pathname.replace(/\/+$/, ''); return `${url.origin}${path}`; @@ -149,11 +162,12 @@ function normalizeServiceUrl(value: string | undefined): string | undefined { function isSupportedLoopbackCallback(value: string | undefined): boolean { try { if (!value?.trim()) return false; - const url = new URL(value.trim()); - const hostname = url.hostname.toLowerCase(); + const raw = value.trim(); + const url = new URL(raw); return ( url.protocol === 'http:' && - (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]') && + canonicalProprHttpUrlOrigin(raw) === url.origin && + isProprLoopbackHostname(url.hostname) && url.username === '' && url.password === '' && url.pathname === '/api/auth/github/callback' && diff --git a/packages/api/corsValidation.ts b/packages/api/corsValidation.ts index 5a35823a1..c34fa5570 100644 --- a/packages/api/corsValidation.ts +++ b/packages/api/corsValidation.ts @@ -7,7 +7,12 @@ // allowed for local development. import type { ErrorRequestHandler } from 'express'; -import { DESKTOP_RENDERER_ORIGIN } from '@propr/shared'; +import { + DESKTOP_RENDERER_ORIGIN, + canonicalProprHttpUrlOrigin, + isProprLoopbackHostname, + normalizeProprApiOrigin, +} from '@propr/shared'; export type CorsOriginCallback = (err: Error | null, allow?: boolean) => void; export type CorsOriginValidator = (origin: string | undefined, callback: CorsOriginCallback) => void; @@ -38,7 +43,8 @@ export const corsRejectionHandler: ErrorRequestHandler = (error, _req, res, next export function createCorsOriginValidator(frontendUrl: string, cookieDomain: string | undefined): CorsOriginValidator { // Remove leading dot if present for hostname matching const baseDomain = cookieDomain?.startsWith('.') ? cookieDomain.slice(1) : cookieDomain; - const frontendOrigin = new URL(frontendUrl).origin; + const frontendOrigin = canonicalProprHttpUrlOrigin(frontendUrl, { allowInsecureHttp: true }); + if (!frontendOrigin) throw new Error('FRONTEND_URL must contain a canonical HTTP(S) URL'); return function validateCorsOrigin(origin: string | undefined, callback: CorsOriginCallback): void { // Allow requests with no origin (e.g., mobile apps, curl, etc.) @@ -54,7 +60,9 @@ export function createCorsOriginValidator(frontendUrl: string, cookieDomain: str return; } try { - const url = new URL(origin); + const canonicalOrigin = normalizeProprApiOrigin(origin, { allowInsecureHttp: true }); + if (!canonicalOrigin) throw new CorsOriginError(); + const url = new URL(canonicalOrigin); // Allow the base domain and any subdomain. The previous inline validator // allowed both http and https here, and some non-tunnel PR-preview // deployments still use http://.. Keep that existing @@ -68,7 +76,7 @@ export function createCorsOriginValidator(frontendUrl: string, cookieDomain: str } else if (url.origin === frontendOrigin) { callback(null, true); } else if ( - (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]') && + isProprLoopbackHostname(url.hostname) && (url.protocol === 'http:' || url.protocol === 'https:') ) { // Allow loopback hosts for development, but only over http/https so an diff --git a/packages/api/desktopAuthService.ts b/packages/api/desktopAuthService.ts index 8ef5bf756..c679c1acb 100644 --- a/packages/api/desktopAuthService.ts +++ b/packages/api/desktopAuthService.ts @@ -1,21 +1,34 @@ /* eslint-disable max-lines -- pairing and token state transitions are kept together for transactional review */ -import { createHash, randomBytes, randomUUID } from 'node:crypto'; +import { createHash, createHmac, randomBytes, randomUUID } from 'node:crypto'; import type { Knex } from 'knex'; import { db } from '@propr/core'; +import { canonicalProprHttpUrlOrigin, normalizeProprApiOrigin } from '@propr/shared'; import type { GitHubUser } from './authTypes.js'; const DEFAULT_PAIRING_TTL_MS = 10 * 60_000; const DEFAULT_POLL_INTERVAL_SECONDS = 5; +const DEFAULT_PROVISIONAL_TTL_MS = 2 * 60_000; const RETAIN_FINISHED_PAIRINGS_MS = 24 * 60 * 60_000; export const INSTANCE_TOKEN_PREFIX = 'propr_it_'; +export const DESKTOP_INSTANCE_SCOPE = 'desktop-instance'; -type PairingStatus = 'pending' | 'approved' | 'consumed'; +type PairingStatus = 'pending' | 'approved' | 'consumed' | 'cancelled'; interface PairingRow { id: string; device_secret_hash: string; client_name: string; status: PairingStatus; + requested_instance_id: string; + requested_origin: string; + requested_scope: string; + credential_generation: string; + provisional_token_id: string | null; + activation_ticket_hash: string | null; + activation_receipt: string | null; + activation_expires_at: string | null; + activated_at: string | null; + cancelled_at: string | null; approved_by_user_id: string | null; approved_by_username: string | null; approved_by_display_name: string | null; @@ -42,6 +55,19 @@ interface TokenRow { expires_at: string | null; revoked_at: string | null; revoked_by_user_id: string | null; + activation_state: 'provisional' | 'active'; + pairing_id: string; + bound_instance_id: string; + bound_origin: string; + bound_scope: string; + credential_generation: string; +} + +export interface DesktopPairingBinding { + instanceId: string; + origin: string; + scope: typeof DESKTOP_INSTANCE_SCOPE; + credentialGeneration: string; } export interface DesktopPairingStart { @@ -62,7 +88,25 @@ export interface DesktopPairingApproval { export type DesktopPairingPoll = | { status: 'pending'; interval: number } - | { status: 'complete'; token: string; tokenType: 'Bearer'; expiresAt: string | null }; + | ({ + status: 'provisional'; + token: string; + tokenType: 'Bearer'; + activationTicket: string; + activationExpiresAt: string; + } & DesktopPairingBinding); + +export interface DesktopPairingActivation extends DesktopPairingBinding { + deviceSecret: string; + activationTicket: string; +} + +export interface DesktopPairingActivationReceipt { + status: 'active'; + receipt: string; + activatedAt: string; + expiresAt: string | null; +} export interface DesktopTokenSummary { id: string; @@ -79,6 +123,10 @@ export interface InstanceTokenIdentity { user: GitHubUser; } +export type PresentedTokenRevocation = + | { revoked: true } + | { revoked: false; code: 'TOKEN_NOT_FOUND' | 'INSTANCE_TOKEN_REVOKED' | 'INSTANCE_TOKEN_EXPIRED' }; + export class DesktopAuthError extends Error { constructor( public readonly code: string, @@ -95,6 +143,7 @@ export interface DesktopAuthServiceOptions { now?: () => Date; pairingTtlMs?: number; tokenTtlMs?: number | null; + provisionalTtlMs?: number; approvalBaseUrl?: string; publicApiUrl?: string; } @@ -107,6 +156,17 @@ function opaqueValue(bytes = 32): string { return randomBytes(bytes).toString('base64url'); } +function derivePairingValue(secret: string, purpose: string, row: PairingRow): string { + return createHmac('sha256', secret).update(JSON.stringify({ + purpose, + pairingId: row.id, + instanceId: row.requested_instance_id, + origin: row.requested_origin, + scope: row.requested_scope, + credentialGeneration: row.credential_generation, + })).digest('base64url'); +} + function validClientName(value: unknown): string { if (typeof value !== 'string') { throw new DesktopAuthError('INVALID_CLIENT_NAME', 400, 'clientName must be a string'); @@ -137,11 +197,48 @@ function requireDeviceSecret(value: unknown): string { return value; } +function validBinding(value: unknown): DesktopPairingBinding { + if (!value || typeof value !== 'object' || Array.isArray(value)) { + throw new DesktopAuthError('INVALID_PAIRING_BINDING', 400, 'Desktop pairing binding is invalid'); + } + const input = value as Record; + const origin = typeof input.origin === 'string' ? normalizeProprApiOrigin(input.origin) : null; + if (typeof input.instanceId !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(input.instanceId) + || origin === null || origin !== input.origin + || input.scope !== DESKTOP_INSTANCE_SCOPE + || typeof input.credentialGeneration !== 'string' + || !/^[A-Za-z0-9_-]{22}$/.test(input.credentialGeneration)) { + throw new DesktopAuthError('INVALID_PAIRING_BINDING', 400, 'Desktop pairing binding is invalid'); + } + return { + instanceId: input.instanceId, + origin, + scope: DESKTOP_INSTANCE_SCOPE, + credentialGeneration: input.credentialGeneration, + }; +} + +function rowBinding(row: PairingRow): DesktopPairingBinding { + return { + instanceId: row.requested_instance_id, + origin: row.requested_origin, + scope: DESKTOP_INSTANCE_SCOPE, + credentialGeneration: row.credential_generation, + }; +} + +function sameBinding(row: PairingRow, binding: DesktopPairingBinding): boolean { + return row.requested_instance_id === binding.instanceId + && row.requested_origin === binding.origin + && row.requested_scope === binding.scope + && row.credential_generation === binding.credentialGeneration; +} + function frontendApprovalBase(configured?: string): URL { const raw = configured ?? process.env.FRONTEND_URL; if (!raw) throw new Error('FRONTEND_URL is required for desktop pairing'); const url = new URL(raw); - if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '::1', '[::1]'].includes(url.hostname))) { + if (canonicalProprHttpUrlOrigin(raw) !== url.origin) { throw new Error('Desktop pairing approval requires HTTPS except on loopback hosts'); } if (url.username || url.password) throw new Error('FRONTEND_URL must not contain credentials'); @@ -152,7 +249,7 @@ function publicApiBase(configured?: string): URL | null { const raw = configured ?? process.env.API_PUBLIC_URL; if (!raw) return null; const url = new URL(raw); - if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '::1', '[::1]'].includes(url.hostname))) { + if (normalizeProprApiOrigin(raw) !== url.origin) { throw new Error('Desktop pairing browser entry requires HTTPS except on loopback hosts'); } if (url.username || url.password || url.pathname !== '/' || url.search || url.hash) { @@ -188,6 +285,7 @@ export class DesktopAuthService { private readonly now: () => Date; private readonly pairingTtlMs: number; private readonly tokenTtlMs: number | null; + private readonly provisionalTtlMs: number; private readonly approvalBaseUrl?: string; private readonly publicApiUrl?: string; @@ -196,12 +294,18 @@ export class DesktopAuthService { this.now = options.now ?? (() => new Date()); this.pairingTtlMs = options.pairingTtlMs ?? DEFAULT_PAIRING_TTL_MS; this.tokenTtlMs = options.tokenTtlMs === undefined ? configuredTokenTtlMs() : options.tokenTtlMs; + this.provisionalTtlMs = options.provisionalTtlMs ?? DEFAULT_PROVISIONAL_TTL_MS; + if (!Number.isSafeInteger(this.provisionalTtlMs) || this.provisionalTtlMs < 1_000 + || this.provisionalTtlMs > DEFAULT_PROVISIONAL_TTL_MS) { + throw new Error('Desktop provisional TTL must be from 1000 to 120000 milliseconds'); + } this.approvalBaseUrl = options.approvalBaseUrl; this.publicApiUrl = options.publicApiUrl; } - async startPairing(clientNameInput: unknown): Promise { + async startPairing(clientNameInput: unknown, bindingInput: unknown): Promise { const clientName = validClientName(clientNameInput); + const binding = validBinding(bindingInput); const pairingId = `dpr_${opaqueValue(16)}`; const deviceSecret = opaqueValue(); const createdAt = this.now(); @@ -219,6 +323,10 @@ export class DesktopAuthService { device_secret_hash: digest(deviceSecret), client_name: clientName, status: 'pending', + requested_instance_id: binding.instanceId, + requested_origin: binding.origin, + requested_scope: binding.scope, + credential_generation: binding.credentialGeneration, created_at: createdAt.toISOString(), expires_at: expiresAt.toISOString(), }); @@ -301,48 +409,190 @@ export class DesktopAuthService { return this.database.transaction(async transaction => { const row = await transaction('desktop_pairing_requests') .where({ id: pairingId, device_secret_hash: digest(deviceSecret) }) + .forUpdate() .first(); if (!row) throw new DesktopAuthError('PAIRING_NOT_FOUND', 404, 'Pairing request was not found'); if (row.expires_at <= nowIso) throw new DesktopAuthError('PAIRING_EXPIRED', 410, 'Pairing request has expired'); if (row.status === 'pending') return { status: 'pending', interval: DEFAULT_POLL_INTERVAL_SECONDS }; if (row.status === 'consumed') { + if (row.cancelled_at) throw new DesktopAuthError('PAIRING_CANCELLED', 410, 'Pairing request was cancelled'); throw new DesktopAuthError('PAIRING_ALREADY_CONSUMED', 409, 'Pairing request was already used'); } + if (row.status === 'cancelled') { + throw new DesktopAuthError('PAIRING_CANCELLED', 410, 'Pairing request was cancelled'); + } if (!row.approved_by_user_id || !row.approved_by_username) { throw new DesktopAuthError('PAIRING_INVALID_STATE', 409, 'Pairing request cannot be completed'); } - const token = `${INSTANCE_TOKEN_PREFIX}${opaqueValue()}`; - const tokenId = randomUUID(); - const tokenExpiresAt = this.tokenTtlMs === null - ? null - : new Date(now.getTime() + this.tokenTtlMs).toISOString(); - await transaction('instance_api_tokens').insert({ - id: tokenId, - token_hash: digest(token), - token_hint: token.slice(-8), - name: row.client_name, - owner_github_user_id: row.approved_by_user_id, - owner_github_username: row.approved_by_username, - owner_display_name: row.approved_by_display_name || row.approved_by_username, - owner_email: row.approved_by_email, - owner_avatar_url: row.approved_by_avatar_url, - created_at: nowIso, - expires_at: tokenExpiresAt, - }); - const consumed = await transaction('desktop_pairing_requests') - .where({ id: pairingId, status: 'approved', device_secret_hash: digest(deviceSecret) }) - .update({ status: 'consumed', consumed_at: nowIso }); - if (consumed !== 1) { - throw new DesktopAuthError('PAIRING_ALREADY_CONSUMED', 409, 'Pairing request was already used'); + const token = `${INSTANCE_TOKEN_PREFIX}${derivePairingValue(deviceSecret, 'credential', row)}`; + const activationTicket = derivePairingValue(deviceSecret, 'activation-ticket', row); + let activationExpiresAt = row.activation_expires_at; + let tokenId = row.provisional_token_id; + if (!tokenId) { + tokenId = randomUUID(); + activationExpiresAt = new Date(Math.min( + Date.parse(row.expires_at), + now.getTime() + this.provisionalTtlMs, + )).toISOString(); + await transaction('instance_api_tokens').insert({ + id: tokenId, + token_hash: digest(token), + token_hint: token.slice(-8), + name: row.client_name, + owner_github_user_id: row.approved_by_user_id, + owner_github_username: row.approved_by_username, + owner_display_name: row.approved_by_display_name || row.approved_by_username, + owner_email: row.approved_by_email, + owner_avatar_url: row.approved_by_avatar_url, + created_at: nowIso, + expires_at: activationExpiresAt, + activation_state: 'provisional', + pairing_id: row.id, + bound_instance_id: row.requested_instance_id, + bound_origin: row.requested_origin, + bound_scope: row.requested_scope, + credential_generation: row.credential_generation, + }); + await transaction('desktop_pairing_requests').where({ id: row.id, status: 'approved' }).update({ + provisional_token_id: tokenId, + activation_ticket_hash: digest(activationTicket), + activation_expires_at: activationExpiresAt, + }); + await this.audit('token_provisioned', { + pairingId, + tokenId, + clientName: row.client_name, + actor: { id: row.approved_by_user_id, username: row.approved_by_username }, + }, transaction); + } else { + const existing = await transaction('instance_api_tokens').where({ id: tokenId }).first(); + if (!existing || existing.token_hash !== digest(token) + || row.activation_ticket_hash !== digest(activationTicket) + || !activationExpiresAt || activationExpiresAt <= nowIso) { + throw new DesktopAuthError('PAIRING_EXPIRED', 410, 'Pairing activation has expired'); + } + } + return { + status: 'provisional', + token, + tokenType: 'Bearer', + activationTicket, + activationExpiresAt: activationExpiresAt!, + ...rowBinding(row), + }; + }); + } + + async cancelPairing(pairingId: string, input: unknown): Promise<{ status: 'cancelled'; cancelledAt: string }> { + validPairingId(pairingId); + if (!input || typeof input !== 'object' || Array.isArray(input)) { + throw new DesktopAuthError('PAIRING_NOT_FOUND', 404, 'Pairing request was not found'); + } + const request = input as Record; + const deviceSecret = requireDeviceSecret(request.deviceSecret); + const binding = validBinding(request); + const activationTicket = typeof request.activationTicket === 'string' + && /^[A-Za-z0-9_-]{43}$/.test(request.activationTicket) + ? request.activationTicket + : null; + if (!activationTicket) throw new DesktopAuthError('PAIRING_NOT_FOUND', 404, 'Pairing request was not found'); + const nowIso = this.now().toISOString(); + return this.database.transaction(async transaction => { + const row = await transaction('desktop_pairing_requests') + .where({ id: pairingId, device_secret_hash: digest(deviceSecret) }) + .forUpdate() + .first(); + if (!row || !sameBinding(row, binding) || row.activation_ticket_hash !== digest(activationTicket)) { + throw new DesktopAuthError('PAIRING_NOT_FOUND', 404, 'Pairing request was not found'); + } + if (row.cancelled_at) return { status: 'cancelled', cancelledAt: row.cancelled_at }; + if (!row.provisional_token_id) { + throw new DesktopAuthError('PAIRING_INVALID_STATE', 409, 'Pairing credential was not provisioned'); } - await this.audit('token_issued', { + await transaction('instance_api_tokens') + .where({ id: row.provisional_token_id }) + .whereNull('revoked_at') + .update({ revoked_at: nowIso, revoked_by_user_id: row.approved_by_user_id }); + await transaction('desktop_pairing_requests').where({ id: row.id }).update({ + status: 'consumed', + consumed_at: nowIso, + cancelled_at: nowIso, + }); + await this.audit('pairing_cancelled', { pairingId, - tokenId, + tokenId: row.provisional_token_id, clientName: row.client_name, - actor: { id: row.approved_by_user_id, username: row.approved_by_username }, + actor: row.approved_by_user_id && row.approved_by_username + ? { id: row.approved_by_user_id, username: row.approved_by_username } + : undefined, + }, transaction); + return { status: 'cancelled', cancelledAt: nowIso }; + }); + } + + async activatePairing(pairingId: string, input: unknown): Promise { + validPairingId(pairingId); + if (!input || typeof input !== 'object' || Array.isArray(input)) { + throw new DesktopAuthError('PAIRING_NOT_FOUND', 404, 'Pairing request was not found'); + } + const request = input as Record; + const deviceSecret = requireDeviceSecret(request.deviceSecret); + const binding = validBinding(request); + const activationTicket = typeof request.activationTicket === 'string' + && /^[A-Za-z0-9_-]{43}$/.test(request.activationTicket) + ? request.activationTicket + : null; + if (!activationTicket) throw new DesktopAuthError('PAIRING_NOT_FOUND', 404, 'Pairing request was not found'); + const now = this.now(); + const nowIso = now.toISOString(); + return this.database.transaction(async transaction => { + const row = await transaction('desktop_pairing_requests') + .where({ id: pairingId, device_secret_hash: digest(deviceSecret) }) + .forUpdate() + .first(); + if (!row || !sameBinding(row, binding) || row.activation_ticket_hash !== digest(activationTicket)) { + throw new DesktopAuthError('PAIRING_NOT_FOUND', 404, 'Pairing request was not found'); + } + const tokenId = row.provisional_token_id; + if (!tokenId) throw new DesktopAuthError('PAIRING_INVALID_STATE', 409, 'Pairing credential was not provisioned'); + if (row.status === 'consumed') { + if (row.cancelled_at) throw new DesktopAuthError('PAIRING_CANCELLED', 410, 'Pairing request was cancelled'); + if (!row.activation_receipt || !row.activated_at) { + throw new DesktopAuthError('PAIRING_ALREADY_CONSUMED', 409, 'Pairing request was already used'); + } + const token = await transaction('instance_api_tokens').where({ id: tokenId }).first(); + if (!token || token.activation_state !== 'active') { + throw new DesktopAuthError('PAIRING_ALREADY_CONSUMED', 409, 'Pairing request was already used'); + } + return { + status: 'active', receipt: row.activation_receipt, activatedAt: row.activated_at, expiresAt: token.expires_at, + }; + } + if (row.status === 'cancelled') throw new DesktopAuthError('PAIRING_CANCELLED', 410, 'Pairing request was cancelled'); + if (row.status !== 'approved' || row.expires_at <= nowIso + || !row.activation_expires_at || row.activation_expires_at <= nowIso) { + throw new DesktopAuthError('PAIRING_EXPIRED', 410, 'Pairing activation has expired'); + } + const finalExpiresAt = this.tokenTtlMs === null + ? null + : new Date(now.getTime() + this.tokenTtlMs).toISOString(); + const activated = await transaction('instance_api_tokens') + .where({ id: tokenId, activation_state: 'provisional' }) + .whereNull('revoked_at') + .andWhere('expires_at', '>', nowIso) + .update({ activation_state: 'active', expires_at: finalExpiresAt }); + if (activated !== 1) throw new DesktopAuthError('PAIRING_EXPIRED', 410, 'Pairing activation has expired'); + const receipt = opaqueValue(16); + const consumed = await transaction('desktop_pairing_requests') + .where({ id: row.id, status: 'approved' }) + .update({ status: 'consumed', consumed_at: nowIso, activated_at: nowIso, activation_receipt: receipt }); + if (consumed !== 1) throw new DesktopAuthError('PAIRING_ALREADY_CONSUMED', 409, 'Pairing request was already used'); + await this.audit('token_activated', { + pairingId, tokenId, clientName: row.client_name, + actor: { id: row.approved_by_user_id!, username: row.approved_by_username! }, }, transaction); - return { status: 'complete', token, tokenType: 'Bearer', expiresAt: tokenExpiresAt }; + return { status: 'active', receipt, activatedAt: nowIso, expiresAt: finalExpiresAt }; }); } @@ -351,6 +601,7 @@ export class DesktopAuthService { const nowIso = this.now().toISOString(); const row = await this.database('instance_api_tokens') .where({ token_hash: digest(token) }) + .andWhere({ activation_state: 'active' }) .whereNull('revoked_at') .andWhere(builder => builder.whereNull('expires_at').orWhere('expires_at', '>', nowIso)) .first(); @@ -376,6 +627,7 @@ export class DesktopAuthService { async listTokens(ownerUserId: string): Promise { const rows = await this.database('instance_api_tokens') .where({ owner_github_user_id: ownerUserId }) + .andWhere({ activation_state: 'active' }) .orderBy('created_at', 'desc'); return rows.map(tokenSummary); } @@ -393,11 +645,52 @@ export class DesktopAuthService { await this.audit('token_revoked', { tokenId, actor }); } + async revokePresentedToken(token: string): Promise { + if (!token.startsWith(INSTANCE_TOKEN_PREFIX) + || token.length !== INSTANCE_TOKEN_PREFIX.length + 43) { + return { revoked: false, code: 'TOKEN_NOT_FOUND' }; + } + return this.database.transaction(async transaction => { + const row = await transaction('instance_api_tokens') + .where({ token_hash: digest(token) }) + .first(); + if (!row) return { revoked: false, code: 'TOKEN_NOT_FOUND' }; + if (row.revoked_at) return { revoked: false, code: 'INSTANCE_TOKEN_REVOKED' }; + const now = this.now(); + if (row.expires_at && Date.parse(row.expires_at) <= now.getTime()) { + return { revoked: false, code: 'INSTANCE_TOKEN_EXPIRED' }; + } + const actor: GitHubUser = { + id: row.owner_github_user_id, + login: row.owner_github_username, + username: row.owner_github_username, + displayName: row.owner_display_name, + email: row.owner_email, + avatarUrl: row.owner_avatar_url, + }; + const updated = await transaction('instance_api_tokens') + .where({ id: row.id }) + .whereNull('revoked_at') + .update({ revoked_at: now.toISOString(), revoked_by_user_id: actor.id }); + if (updated !== 1) return { revoked: false, code: 'INSTANCE_TOKEN_REVOKED' }; + await this.audit('token_revoked', { tokenId: row.id, actor }, transaction); + return { revoked: true }; + }); + } + async cleanupPairings(): Promise { const cutoff = new Date(this.now().getTime() - RETAIN_FINISHED_PAIRINGS_MS).toISOString(); - return this.database('desktop_pairing_requests') - .where('expires_at', '<', cutoff) - .delete(); + const nowIso = this.now().toISOString(); + return this.database.transaction(async transaction => { + await transaction('instance_api_tokens') + .where({ activation_state: 'provisional' }) + .andWhere('expires_at', '<=', nowIso) + .delete(); + const deleted = await transaction('desktop_pairing_requests') + .where('expires_at', '<', cutoff) + .delete(); + return typeof deleted === 'number' ? deleted : 0; + }); } private async activePairing(pairingId: string): Promise { diff --git a/packages/api/routes/desktopAuthRoutes.ts b/packages/api/routes/desktopAuthRoutes.ts index 972435b1f..0e07b7c57 100644 --- a/packages/api/routes/desktopAuthRoutes.ts +++ b/packages/api/routes/desktopAuthRoutes.ts @@ -5,6 +5,14 @@ import { desktopAuthService, } from '../desktopAuthService.js'; import { isUserWhitelisted } from '../userWhitelist.js'; +import { + DESKTOP_REVOCATION_BINDING_HEADER, + DESKTOP_TOKEN_REVOCATION_ENDPOINT, + DESKTOP_TOKEN_REVOCATION_SCHEMA, + DESKTOP_TOKEN_REVOCATION_VERSION, + canonicalProprHttpUrlOrigin, + normalizeProprApiOrigin, +} from '@propr/shared'; interface DesktopAuthRoutesOptions { service?: DesktopAuthService; @@ -26,15 +34,9 @@ function sendDesktopAuthError(error: unknown, res: Response): void { export function isTrustedPairingApprovalOrigin(origin: string | undefined, frontendUrl: string | undefined): boolean { if (!origin || !frontendUrl) return false; - try { - const expected = new URL(frontendUrl); - const supplied = new URL(origin); - return supplied.origin === expected.origin - && (supplied.protocol === 'https:' - || (supplied.protocol === 'http:' && ['localhost', '127.0.0.1', '::1', '[::1]'].includes(supplied.hostname))); - } catch { - return false; - } + const expected = canonicalProprHttpUrlOrigin(frontendUrl); + const supplied = normalizeProprApiOrigin(origin); + return expected !== null && supplied === expected; } /** Pairing approval is intentionally session-only. */ @@ -69,13 +71,30 @@ export function createDesktopAuthRoutes(options: DesktopAuthRoutesOptions = {}) async function startPairing(req: Request, res: Response): Promise { try { - const result = await service.startPairing((req.body as { clientName?: unknown } | undefined)?.clientName); + const body = req.body as Record | undefined; + const result = await service.startPairing(body?.clientName, body); res.status(201).json(result); } catch (error) { sendDesktopAuthError(error, res); } } + async function activatePairing(req: Request, res: Response): Promise { + try { + res.json(await service.activatePairing(pathParameter(req.params.pairingId), req.body)); + } catch (error) { + sendDesktopAuthError(error, res); + } + } + + async function cancelPairing(req: Request, res: Response): Promise { + try { + res.json(await service.cancelPairing(pathParameter(req.params.pairingId), req.body)); + } catch (error) { + sendDesktopAuthError(error, res); + } + } + async function pollPairing(req: Request, res: Response): Promise { try { const result = await service.pollPairing( @@ -148,15 +167,49 @@ export function createDesktopAuthRoutes(options: DesktopAuthRoutesOptions = {}) } } + async function revokeCurrentToken(req: Request, res: Response): Promise { + const authorization = req.header('authorization'); + const credentialGeneration = req.header(DESKTOP_REVOCATION_BINDING_HEADER); + if (!authorization || !/^Bearer propr_it_[A-Za-z0-9_-]{43}$/.test(authorization) + || !credentialGeneration + || !/^[A-Za-z0-9_-]{22}$/.test(credentialGeneration)) { + res.status(403).json({ + code: 'INSTANCE_TOKEN_REQUIRED', + error: 'The current desktop token is required', + }); + return; + } + try { + const result = await service.revokePresentedToken(authorization.slice(7).trim()); + if (result.revoked) { + res.status(204).end(); + return; + } + res.status(result.code === 'TOKEN_NOT_FOUND' ? 404 : 401).json({ + schema: DESKTOP_TOKEN_REVOCATION_SCHEMA, + version: DESKTOP_TOKEN_REVOCATION_VERSION, + endpoint: DESKTOP_TOKEN_REVOCATION_ENDPOINT, + terminal: true, + code: result.code, + credentialGeneration, + }); + } catch (error) { + sendDesktopAuthError(error, res); + } + } + return { browserSessionGuard, approvalOriginGuard, startPairing, pollPairing, + activatePairing, + cancelPairing, getPairingApproval, openPairingApproval, approvePairing, listTokens, + revokeCurrentToken, revokeToken, }; } diff --git a/packages/api/server.ts b/packages/api/server.ts index fcfa415bc..a122e2517 100644 --- a/packages/api/server.ts +++ b/packages/api/server.ts @@ -261,7 +261,12 @@ function setupRoutes(): void { app.get('/api/desktop/discovery', createDiscoveryRequestRateLimiter(), statusRoutes.getDesktopDiscovery); app.post('/api/desktop/pairings', createPairingStartRateLimiter(), desktopAuthRoutes.startPairing); app.post('/api/desktop/pairings/:pairingId/poll', createPairingPollRateLimiter(), desktopAuthRoutes.pollPairing); + app.post('/api/desktop/pairings/:pairingId/activate', createPairingPollRateLimiter(), desktopAuthRoutes.activatePairing); + app.post('/api/desktop/pairings/:pairingId/cancel', createPairingPollRateLimiter(), desktopAuthRoutes.cancelPairing); app.get('/api/desktop/pairings/:pairingId/browser', createPairingStartRateLimiter(), desktopAuthRoutes.openPairingApproval); + // Token possession authorizes only this exact self-revocation route. It must + // precede generic auth so inactive tokens receive a stable terminal contract. + app.delete('/api/desktop/tokens/current', desktopAuthRoutes.revokeCurrentToken); app.use('/api', ensureAuthenticated, resolveAuthorization); app.get('/api/desktop/pairings/:pairingId/approval', desktopAuthRoutes.browserSessionGuard, desktopAuthRoutes.getPairingApproval); app.post('/api/desktop/pairings/:pairingId/approve', desktopAuthRoutes.browserSessionGuard, desktopAuthRoutes.approvalOriginGuard, desktopAuthRoutes.approvePairing); diff --git a/packages/api/services/socketAuthentication.ts b/packages/api/services/socketAuthentication.ts index b0c02141f..be7c0f0f1 100644 --- a/packages/api/services/socketAuthentication.ts +++ b/packages/api/services/socketAuthentication.ts @@ -1,6 +1,6 @@ import { IncomingMessage, ServerResponse } from 'node:http'; import type { NextFunction, Request, RequestHandler, Response } from 'express'; -import type { Server as SocketIOServer, Socket } from 'socket.io'; +import type { Namespace, Server as SocketIOServer, Socket } from 'socket.io'; import { SocketAuthenticationError, type SocketPrincipal, @@ -25,6 +25,23 @@ interface PassportSessionData { const DEFAULT_REVALIDATION_INTERVAL_MS = 60_000; +/** + * Return a stable snapshot of every namespace registered at this instant. + * + * Socket.IO has no public namespace iterator. Keep its typed namespace registry + * access contained here, and use the public accessor for the root namespace, so + * a future Socket.IO registry change has one fail-closed integration point. + */ +function registeredSocketNamespaces(io: SocketIOServer): readonly Namespace[] { + const rootNamespace = io.of('/'); + const registeredNamespaces = io._nsps; + if (!(registeredNamespaces instanceof Map)) { + throw new Error('Socket.IO namespace registry is unavailable'); + } + + return [...new Set([rootNamespace, ...registeredNamespaces.values()])]; +} + interface SocketAuthenticationFailure extends Error { data?: { code: string }; } @@ -116,8 +133,34 @@ export function configureSocketAuthentication( }); } - io.use(async (socket, next) => { - const request = socket.request as unknown as Request; + const authenticateSocket = async (socket: Socket, next: (error?: Error) => void) => { + const transportRequest = socket.request as unknown as Request; + const handshakeToken = (socket.handshake.auth as { token?: unknown } | undefined)?.token; + const synthesizedAuthorization = !transportRequest.headers.authorization + && typeof handshakeToken === 'string' + && handshakeToken.trim() + && !/[\r\n]/.test(handshakeToken) + ? `Bearer ${handshakeToken.trim()}` + : undefined; + const immutableHeaders = Object.freeze(Object.fromEntries( + Object.entries(transportRequest.headers).map(([name, value]) => [ + name, + Array.isArray(value) ? Object.freeze([...value]) : value, + ]), + )); + // Socket.IO namespaces on one transport share socket.request. Keep the + // credential on a socket-specific facade so authentication and later + // revalidation can never rewrite another namespace's request context. + const request = Object.create(transportRequest) as Request; + Object.defineProperty(request, 'headers', { + configurable: false, + enumerable: true, + value: Object.freeze({ + ...immutableHeaders, + ...(synthesizedAuthorization ? { authorization: synthesizedAuthorization } : {}), + }), + writable: false, + }); const usesPassportSession = Boolean(request.isAuthenticated?.() && request.user); try { const initialPrincipal = await options.authenticate(request); @@ -154,6 +197,7 @@ export function configureSocketAuthentication( `[SocketAuthentication] Disconnecting socket ${socket.id} after revalidation failed (${code})`, ); delete data.principal; + socket.emit('authentication:error', { code }); socket.disconnect(true); return false; } @@ -172,5 +216,17 @@ export function configureSocketAuthentication( } catch (error) { next(socketAuthenticationFailure(error)); } - }); + }; + + const configuredNamespaces = new WeakSet(); + const configureNamespace = (namespace: Namespace) => { + if (configuredNamespaces.has(namespace)) return; + configuredNamespaces.add(namespace); + namespace.use(authenticateSocket); + }; + + // Subscribe first so a namespace registered during configuration cannot fall + // between the existing-namespace snapshot and future registration listener. + io.on('new_namespace', configureNamespace); + for (const namespace of registeredSocketNamespaces(io)) configureNamespace(namespace); } diff --git a/packages/api/test/connectAuth.test.ts b/packages/api/test/connectAuth.test.ts index a27be828c..d96e5d9c5 100644 --- a/packages/api/test/connectAuth.test.ts +++ b/packages/api/test/connectAuth.test.ts @@ -32,11 +32,27 @@ test('local relay mode uses Connect without a per-instance OAuth App', () => { }), 'connect'); }); -test('off-tunnel relay inference rejects callbacks outside the exact loopback allowlist', () => { +test('off-tunnel relay inference uses the shared canonical loopback rule', () => { + for (const callbackUrl of [ + 'http://api.dev.localhost:4000/api/auth/github/callback', + 'http://127.0.0.2:4000/api/auth/github/callback', + 'http://127.42.7.9:4000/api/auth/github/callback', + 'http://[::1]:4000/api/auth/github/callback', + ]) { + assert.equal(resolveBrowserAuthMode({ + PROPR_UI_TUNNEL_ENABLED: 'false', + PROPR_GH_RELAY_URL: 'https://webhook.propr.dev/v1', + PROPR_GH_RELAY_TOKEN: 'prt_secret', + GH_OAUTH_CALLBACK_URL: callbackUrl, + }), 'connect', callbackUrl); + } + for (const callbackUrl of [ 'https://api.example.com/api/auth/github/callback', 'https://localhost:4000/api/auth/github/callback', - 'http://127.0.0.2:4000/api/auth/github/callback', + 'http://127.1:4000/api/auth/github/callback', + 'http://0177.0.0.1:4000/api/auth/github/callback', + 'http://localhost.:4000/api/auth/github/callback', 'http://localhost:4000/not-the-auth-callback', ]) { assert.equal(resolveBrowserAuthMode({ @@ -93,6 +109,19 @@ test('Connect authorization URL carries the exact callback and CSRF state', () = assert.equal(url.searchParams.get('installation_id'), '123'); }); +test('Connect authorization URL rejects configured query strings and fragments', () => { + for (const connectOrigin of [ + 'https://connect.propr.dev?tenant=attacker', + 'https://connect.propr.dev#attacker', + ]) { + assert.throws(() => buildConnectAuthorizationUrl({ + connectOrigin, + callbackUrl: 'https://t-abc.propr.dev/api/auth/github/callback', + state: 'random-state', + }), /PROPR_CONNECT_URL must be a bare HTTPS origin/); + } +}); + test('redeems a Connect code server-to-server without exposing the relay token in the body', async () => { let relayRequest: Request | undefined; let githubRequest: Request | undefined; diff --git a/packages/api/test/corsValidation.test.ts b/packages/api/test/corsValidation.test.ts index 2e960b693..552e9a53b 100644 --- a/packages/api/test/corsValidation.test.ts +++ b/packages/api/test/corsValidation.test.ts @@ -55,7 +55,9 @@ test('CORS allows HTTP(S) loopback origins for development', () => { const validate = createCorsOriginValidator('https://app.propr.dev', undefined); assert.equal(isAllowed(validate, 'http://localhost:5173'), true); + assert.equal(isAllowed(validate, 'http://api.dev.localhost:5173'), true); assert.equal(isAllowed(validate, 'http://127.0.0.1:5173'), true); + assert.equal(isAllowed(validate, 'http://127.42.7.9:5173'), true); assert.equal(isAllowed(validate, 'http://[::1]:5173'), true); assert.equal(isAllowed(validate, 'https://localhost:5173'), true); assert.equal(isAllowed(validate, 'https://[::1]:5173'), true); @@ -70,6 +72,9 @@ test('CORS rejects unsafe schemes and non-loopback hosts', () => { assert.equal(isAllowed(validate, 'file://localhost'), false); assert.equal(isAllowed(validate, 'file://[::1]/tmp/propr'), false); assert.equal(isAllowed(validate, 'http://[2001:db8::1]:5173'), false); + assert.equal(isAllowed(validate, 'http://127.1:5173'), false); + assert.equal(isAllowed(validate, 'http://0177.0.0.1:5173'), false); + assert.equal(isAllowed(validate, 'http://localhost.:5173'), false); }); test('CORS allows COOKIE_DOMAIN subdomains for preview environments', () => { @@ -167,12 +172,19 @@ for (const runtimeMode of ['development', 'production'] as const) { const allowedPreflight = await fetch(`${baseUrl}/api/protected`, { method: 'OPTIONS', headers: { - Origin: 'https://app.propr.dev', + Origin: DESKTOP_RENDERER_ORIGIN, 'Access-Control-Request-Method': 'GET', + 'Access-Control-Request-Headers': 'X-ProPR-Desktop-Transport-Scope, Content-Type', }, }); assert.equal(allowedPreflight.status, 204); - assert.equal(allowedPreflight.headers.get('access-control-allow-origin'), 'https://app.propr.dev'); + // This is the browser's real preflight shape: the requested desktop + // marker is named here, but the marker value itself is not sent on OPTIONS. + assert.equal(allowedPreflight.headers.get('access-control-allow-origin'), DESKTOP_RENDERER_ORIGIN); + assert.equal( + allowedPreflight.headers.get('access-control-allow-headers'), + 'X-ProPR-Desktop-Transport-Scope, Content-Type', + ); }); }); } diff --git a/packages/api/test/desktopAuth.test.ts b/packages/api/test/desktopAuth.test.ts index 7753ff5be..72e5b72ba 100644 --- a/packages/api/test/desktopAuth.test.ts +++ b/packages/api/test/desktopAuth.test.ts @@ -3,13 +3,16 @@ import { after, afterEach, beforeEach, describe, test } from 'node:test'; import type { NextFunction, Request, Response } from 'express'; import knex, { type Knex } from 'knex'; import { closeConnection } from '@propr/core'; +import { PROPR_API_ORIGIN_PARITY_CASES } from '@propr/shared'; import { up as createDesktopAuthTables } from '../../core/src/db/migrations/20260829000000_create_desktop_auth.js'; +import { up as addTwoPhaseDesktopPairing } from '../../core/src/db/migrations/20260830000000_add_two_phase_desktop_pairing.js'; import { DesktopAuthError, DesktopAuthService, INSTANCE_TOKEN_PREFIX, } from '../desktopAuthService.js'; import { + createDesktopAuthRoutes, isTrustedPairingApprovalOrigin, requireBrowserPairingSession, } from '../routes/desktopAuthRoutes.js'; @@ -29,6 +32,17 @@ const owner: GitHubUser = { let database: Knex; let now: Date; let service: DesktopAuthService; +const pairingBinding = (origin = 'https://app.example.test') => ({ + instanceId: 'profile-a', + origin, + scope: 'desktop-instance' as const, + credentialGeneration: 'G'.repeat(22), +}); +const startPairing = ( + target: DesktopAuthService, + name: string, + origin = 'https://app.example.test', +) => target.startPairing(name, pairingBinding(origin)); beforeEach(async () => { database = knex({ @@ -37,6 +51,7 @@ beforeEach(async () => { useNullAsDefault: true, }); await createDesktopAuthTables(database); + await addTwoPhaseDesktopPairing(database); now = new Date('2026-08-29T14:00:00.000Z'); service = new DesktopAuthService({ database, @@ -50,7 +65,7 @@ after(async () => closeConnection()); describe('desktop browser pairing', () => { test('stores only a device-secret hash and builds a fixed trusted approval URL', async () => { - const pairing = await service.startPairing(' Work Laptop '); + const pairing = await startPairing(service, ' Work Laptop '); const row = await database('desktop_pairing_requests').where({ id: pairing.pairingId }).first(); const audit = await database('desktop_auth_audit').first(); @@ -59,6 +74,7 @@ describe('desktop browser pairing', () => { assert.equal(pairing.approvalUrl, `https://app.example.test/base/desktop/pairing?pairing_id=${pairing.pairingId}`); assert.equal(pairing.approvalUrl.includes(pairing.deviceSecret), false); assert.equal(row.client_name, 'Work Laptop'); + assert.equal(row.requested_origin, 'https://app.example.test'); assert.notEqual(row.device_secret_hash, pairing.deviceSecret); assert.equal(JSON.stringify(row).includes(pairing.deviceSecret), false); assert.equal(JSON.stringify(audit).includes(pairing.deviceSecret), false); @@ -71,7 +87,7 @@ describe('desktop browser pairing', () => { approvalBaseUrl: 'https://app.propr.dev', publicApiUrl: 'https://t-instance123.propr.dev', }); - const pairing = await hosted.startPairing('Windows desktop'); + const pairing = await startPairing(hosted, 'Windows desktop', 'https://t-instance123.propr.dev'); assert.equal( pairing.approvalUrl, @@ -83,8 +99,9 @@ describe('desktop browser pairing', () => { ); }); - test('issues an opaque token once, resolves its owner, and never stores plaintext credentials', async () => { - const pairing = await service.startPairing('MacBook Pro'); + test('provisions one unusable credential, then activates it exactly once without storing plaintext', async () => { + const binding = pairingBinding(); + const pairing = await startPairing(service, 'MacBook Pro'); assert.deepEqual(await service.pollPairing(pairing.pairingId, pairing.deviceSecret), { status: 'pending', interval: 5, @@ -92,10 +109,19 @@ describe('desktop browser pairing', () => { await service.approvePairing(pairing.pairingId, owner); const completed = await service.pollPairing(pairing.pairingId, pairing.deviceSecret); - assert.equal(completed.status, 'complete'); - if (completed.status !== 'complete') return; + assert.equal(completed.status, 'provisional'); + if (completed.status !== 'provisional') return; assert.match(completed.token, new RegExp(`^${INSTANCE_TOKEN_PREFIX}[A-Za-z0-9_-]{43}$`)); - assert.equal(completed.expiresAt, null); + assert.equal(await service.validateToken(completed.token), null); + assert.deepEqual(await service.pollPairing(pairing.pairingId, pairing.deviceSecret), completed); + + const activation = { + ...binding, + deviceSecret: pairing.deviceSecret, + activationTicket: completed.activationTicket, + }; + const receipt = await service.activatePairing(pairing.pairingId, activation); + assert.deepEqual(await service.activatePairing(pairing.pairingId, activation), receipt); const tokenRow = await database('instance_api_tokens').first(); const pairingRow = await database('desktop_pairing_requests').first(); @@ -118,7 +144,7 @@ describe('desktop browser pairing', () => { }); test('rejects the wrong secret without revealing pairing state', async () => { - const pairing = await service.startPairing('Linux workstation'); + const pairing = await startPairing(service, 'Linux workstation'); await service.approvePairing(pairing.pairingId, owner); await assert.rejects( @@ -130,6 +156,57 @@ describe('desktop browser pairing', () => { assert.equal((await database('desktop_pairing_requests').first()).status, 'approved'); }); + test('binds activation and cancellation exactly and keeps cancellation idempotent', async () => { + const binding = pairingBinding(); + const pairing = await startPairing(service, 'Cancelled desktop'); + await service.approvePairing(pairing.pairingId, owner); + const provisional = await service.pollPairing(pairing.pairingId, pairing.deviceSecret); + assert.equal(provisional.status, 'provisional'); + if (provisional.status !== 'provisional') return; + const exact = { + ...binding, + deviceSecret: pairing.deviceSecret, + activationTicket: provisional.activationTicket, + }; + await assert.rejects( + service.activatePairing(pairing.pairingId, { ...exact, instanceId: 'wrong-profile' }), + (error: unknown) => error instanceof DesktopAuthError && error.code === 'PAIRING_NOT_FOUND', + ); + assert.equal(await service.validateToken(provisional.token), null); + + const cancelled = await service.cancelPairing(pairing.pairingId, exact); + assert.deepEqual(await service.cancelPairing(pairing.pairingId, exact), cancelled); + await assert.rejects( + service.activatePairing(pairing.pairingId, exact), + (error: unknown) => error instanceof DesktopAuthError && error.code === 'PAIRING_CANCELLED', + ); + assert.equal(await service.validateToken(provisional.token), null); + }); + + test('reuses one provisional across a database restart and cleans it after fixed expiry', async () => { + const expiring = new DesktopAuthService({ + database, + now: () => new Date(now), + provisionalTtlMs: 1_000, + approvalBaseUrl: 'https://app.example.test', + }); + const pairing = await startPairing(expiring, 'Restarted desktop'); + await expiring.approvePairing(pairing.pairingId, owner); + const first = await expiring.pollPairing(pairing.pairingId, pairing.deviceSecret); + const restarted = new DesktopAuthService({ + database, + now: () => new Date(now), + provisionalTtlMs: 1_000, + approvalBaseUrl: 'https://app.example.test', + }); + assert.deepEqual(await restarted.pollPairing(pairing.pairingId, pairing.deviceSecret), first); + assert.equal(await database('instance_api_tokens').where({ activation_state: 'provisional' }).count({ count: '*' }).first() + .then(row => Number(row?.count)), 1); + now = new Date(now.getTime() + 1_001); + await restarted.cleanupPairings(); + assert.equal(await database('instance_api_tokens').count({ count: '*' }).first().then(row => Number(row?.count)), 0); + }); + test('expires unapproved pairings and cleans retained expired records', async () => { const expiringService = new DesktopAuthService({ database, @@ -137,7 +214,7 @@ describe('desktop browser pairing', () => { pairingTtlMs: 1_000, approvalBaseUrl: 'https://app.example.test', }); - const pairing = await expiringService.startPairing('Old laptop'); + const pairing = await startPairing(expiringService, 'Old laptop'); now = new Date(now.getTime() + 1_001); await assert.rejects( @@ -150,20 +227,40 @@ describe('desktop browser pairing', () => { }); test('rejects unsafe names and non-HTTPS approval origins', async () => { - await assert.rejects(service.startPairing('bad\nname'), /printable characters/); - await assert.rejects(service.startPairing('x'.repeat(81)), /1 to 80/); + await assert.rejects(startPairing(service, 'bad\nname'), /printable characters/); + await assert.rejects(startPairing(service, 'x'.repeat(81)), /1 to 80/); const insecure = new DesktopAuthService({ database, approvalBaseUrl: 'http://remote.example.test' }); - await assert.rejects(insecure.startPairing('Laptop'), /requires HTTPS/); + await assert.rejects(startPairing(insecure, 'Laptop'), /requires HTTPS/); + }); + + test('matches the shared canonical origin parity table for the public REST and Socket origin', async () => { + let index = 0; + for (const [name, input, expected] of PROPR_API_ORIGIN_PARITY_CASES) { + const candidate = new DesktopAuthService({ + database, + approvalBaseUrl: 'https://app.example.test', + publicApiUrl: input, + }); + const start = startPairing(candidate, `Parity ${index++}`, expected ?? 'https://invalid.example.test'); + if (expected === null) await assert.rejects(start, undefined, name); + else assert.equal(new URL((await start).approvalUrl).origin, expected, name); + } }); }); describe('instance token ownership and revocation', () => { async function issueToken(): Promise<{ token: string; tokenId: string }> { - const pairing = await service.startPairing('Desktop app'); + const binding = pairingBinding(); + const pairing = await startPairing(service, 'Desktop app'); await service.approvePairing(pairing.pairingId, owner); const completed = await service.pollPairing(pairing.pairingId, pairing.deviceSecret); - assert.equal(completed.status, 'complete'); - if (completed.status !== 'complete') throw new Error('token was not issued'); + assert.equal(completed.status, 'provisional'); + if (completed.status !== 'provisional') throw new Error('token was not issued'); + await service.activatePairing(pairing.pairingId, { + ...binding, + deviceSecret: pairing.deviceSecret, + activationTicket: completed.activationTicket, + }); const tokenId = (await service.listTokens(owner.id))[0].id; return { token: completed.token, tokenId }; } @@ -198,6 +295,74 @@ describe('instance token ownership and revocation', () => { assert.equal(await service.validateToken(token), null); }); + test('lets a desktop revoke only the instance token authenticating its request', async () => { + const { token, tokenId } = await issueToken(); + const routes = createDesktopAuthRoutes({ service, frontendUrl: 'https://app.example.test' }); + let statusCode = 200; + let ended = false; + const response = { + status(value: number) { statusCode = value; return response; }, + json() { return response; }, + end() { ended = true; return response; }, + } as unknown as Response; + + await routes.revokeCurrentToken({ + user: owner, + authenticationMethod: 'instance_token', + instanceTokenId: tokenId, + header(name: string) { + if (name.toLowerCase() === 'authorization') return `Bearer ${token}`; + if (name.toLowerCase() === 'x-propr-desktop-revocation-binding') return 'A'.repeat(22); + return undefined; + }, + } as unknown as Request, response); + + assert.equal(statusCode, 204); + assert.equal(ended, true); + assert.equal(await service.validateToken(token), null); + }); + + test('returns the versioned endpoint-bound terminal contract on repeated self-revocation', async () => { + const { token } = await issueToken(); + const routes = createDesktopAuthRoutes({ service, frontendUrl: 'https://app.example.test' }); + const binding = 'G'.repeat(22); + const request = { + header(name: string) { + if (name.toLowerCase() === 'authorization') return `Bearer ${token}`; + if (name.toLowerCase() === 'x-propr-desktop-revocation-binding') return binding; + return undefined; + }, + } as unknown as Request; + const replies: Array<{ status: number; body?: unknown }> = []; + const makeResponse = () => { + const reply: { status: number; body?: unknown } = { status: 200 }; + replies.push(reply); + const response = { + status(value: number) { reply.status = value; return response; }, + json(value: unknown) { reply.body = value; return response; }, + end() { return response; }, + } as unknown as Response; + return response; + }; + + await routes.revokeCurrentToken(request, makeResponse()); + await routes.revokeCurrentToken(request, makeResponse()); + assert.deepEqual(replies, [ + { status: 204 }, + { + status: 401, + body: { + schema: 'propr.desktop-token-revocation', + version: 1, + endpoint: '/api/desktop/tokens/current', + terminal: true, + code: 'INSTANCE_TOKEN_REVOKED', + credentialGeneration: binding, + }, + }, + ]); + }); + test('REST authentication accepts instance tokens while optional GitHub bearer auth is disabled', async () => { const original = process.env.ENABLE_BEARER_AUTH; process.env.ENABLE_BEARER_AUTH = 'false'; @@ -229,6 +394,8 @@ describe('pairing approval request protection', () => { assert.equal(isTrustedPairingApprovalOrigin('https://app.example.test', 'https://app.example.test/path'), true); assert.equal(isTrustedPairingApprovalOrigin('https://preview.app.example.test', 'https://app.example.test'), false); assert.equal(isTrustedPairingApprovalOrigin('http://app.example.test', 'https://app.example.test'), false); + assert.equal(isTrustedPairingApprovalOrigin('http://127.1:3000', 'http://127.0.0.1:3000'), false); + assert.equal(isTrustedPairingApprovalOrigin('http://local%68ost:3000', 'http://localhost:3000'), false); assert.equal(isTrustedPairingApprovalOrigin(undefined, 'https://app.example.test'), false); }); diff --git a/packages/api/test/sessionCookie.test.ts b/packages/api/test/sessionCookie.test.ts index 5f3d3c085..c12c9950d 100644 --- a/packages/api/test/sessionCookie.test.ts +++ b/packages/api/test/sessionCookie.test.ts @@ -43,6 +43,23 @@ test('secure session cookie follows API_PUBLIC_URL protocol for HTTPS and localh process.env.API_PUBLIC_URL = 'http://[::1]:4000'; assert.equal(shouldUseSecureSessionCookie('.example.com'), false); + + process.env.API_PUBLIC_URL = 'http://api.dev.localhost:4000'; + assert.equal(shouldUseSecureSessionCookie('.example.com'), false); + + process.env.API_PUBLIC_URL = 'http://127.42.7.9:4000'; + assert.equal(shouldUseSecureSessionCookie('.example.com'), false); + + process.env.API_PUBLIC_URL = 'http://127.1:4000'; + assert.equal(shouldUseSecureSessionCookie('.example.com'), true); +}); + +test('noncanonical HTTPS public URL keeps the session cookie secure in development', () => { + process.env.NODE_ENV = 'development'; + delete process.env.COOKIE_DOMAIN; + process.env.API_PUBLIC_URL = 'https://api.example.test/path'; + + assert.equal(shouldUseSecureSessionCookie(undefined), true); }); test('secure session cookie does not downgrade for non-localhost HTTP public URL', () => { diff --git a/packages/api/test/socketAuthentication.test.ts b/packages/api/test/socketAuthentication.test.ts index d1bc5a3a3..ad7ced07e 100644 --- a/packages/api/test/socketAuthentication.test.ts +++ b/packages/api/test/socketAuthentication.test.ts @@ -172,7 +172,7 @@ describe('Socket.IO authentication', () => { ); }); - test('runs Engine.IO middleware before the mandatory identity gate', async () => { + test('runs Engine.IO middleware and maps browser Socket.IO auth into the shared bearer gate', async () => { const httpServer = createServer(); const io = new SocketIOServer(httpServer, { transports: ['websocket'] }); const markerMiddleware: RequestHandler = (req, _res, next) => { @@ -196,7 +196,7 @@ describe('Socket.IO authentication', () => { const port = (httpServer.address() as AddressInfo).port; const client = createSocketClient(`http://127.0.0.1:${port}`, { transports: ['websocket'], - extraHeaders: { Authorization: 'Bearer test-token' }, + auth: { token: 'test-token' }, reconnection: false, }); @@ -210,6 +210,115 @@ describe('Socket.IO authentication', () => { } }); + test('refreshes synthesized bearer auth on namespace reconnects over the same Engine.IO connection', async () => { + const httpServer = createServer(); + const io = new SocketIOServer(httpServer, { transports: ['websocket'] }); + const seenAuthorization: Array = []; + configureSocketAuthentication(io, { + engineMiddleware: [], + authenticate: async req => { + const authorization = req.headers.authorization; + seenAuthorization.push(authorization); + if (authorization === 'Bearer initial-token') return principal(user({ id: '1' })); + if (authorization === 'Bearer anchor-token') return principal(user({ id: 'anchor' })); + if (authorization === 'Bearer replacement-token') return principal(user({ id: '2' })); + throw new SocketAuthenticationError('AUTHENTICATION_REQUIRED', 'missing bearer'); + }, + }); + let serverSocket: ServerSocket | undefined; + io.on('connection', socket => { + serverSocket = socket; + }); + io.of('/anchor').on('connection', () => undefined); + await new Promise(resolve => httpServer.listen(0, '127.0.0.1', resolve)); + const port = (httpServer.address() as AddressInfo).port; + const client = createSocketClient(`http://127.0.0.1:${port}`, { + transports: ['websocket'], + auth: { token: 'initial-token' }, + autoConnect: false, + reconnection: false, + }); + const anchor = client.io.socket('/anchor'); + anchor.auth = { token: 'anchor-token' }; + + try { + client.connect(); + anchor.connect(); + await waitFor( + () => client.connected && anchor.connected, + 'Initial namespaces did not connect', + ); + const engineId = client.io.engine?.id; + assert(engineId); + + const initialServerSocket = serverSocket; + assert(initialServerSocket); + const initiallyDisconnected = new Promise(resolve => { + initialServerSocket.once('disconnect', () => resolve()); + }); + client.disconnect(); + await initiallyDisconnected; + client.auth = { token: 'replacement-token' }; + const reconnected = waitForConnect(client); + client.connect(); + await reconnected; + assert.equal(client.io.engine?.id, engineId); + + const replacementServerSocket = serverSocket; + assert(replacementServerSocket); + const replacementDisconnected = new Promise(resolve => { + replacementServerSocket.once('disconnect', () => resolve()); + }); + client.disconnect(); + await replacementDisconnected; + client.auth = {}; + const rejected = waitForConnectError(client); + client.connect(); + const error = await rejected; + assert.equal(error.data?.code, 'AUTHENTICATION_REQUIRED'); + assert.equal(client.io.engine?.id, engineId); + assert.deepEqual(seenAuthorization, [ + 'Bearer initial-token', + 'Bearer anchor-token', + 'Bearer replacement-token', + undefined, + ]); + } finally { + client.disconnect(); + anchor.disconnect(); + await io.close(); + await new Promise(resolve => httpServer.close(() => resolve())); + } + }); + + test('preserves transport-level Authorization instead of Socket.IO auth', async () => { + const httpServer = createServer(); + const io = new SocketIOServer(httpServer, { transports: ['websocket'] }); + configureSocketAuthentication(io, { + engineMiddleware: [], + authenticate: async req => { + assert.equal(req.headers.authorization, 'Bearer transport-token'); + return principal(); + }, + }); + await new Promise(resolve => httpServer.listen(0, '127.0.0.1', resolve)); + const port = (httpServer.address() as AddressInfo).port; + const client = createSocketClient(`http://127.0.0.1:${port}`, { + transports: ['websocket'], + extraHeaders: { Authorization: 'Bearer transport-token' }, + auth: { token: 'socket-token' }, + reconnection: false, + }); + + try { + await waitForConnect(client); + } finally { + client.disconnect(); + await io.close(); + await new Promise(resolve => httpServer.close(() => resolve())); + } + }); + test('surfaces a stable authentication error code to rejected clients', async () => { const httpServer = createServer(); const io = new SocketIOServer(httpServer, { transports: ['websocket'] }); diff --git a/packages/api/test/socketAuthenticationIsolation.test.ts b/packages/api/test/socketAuthenticationIsolation.test.ts new file mode 100644 index 000000000..5dd5fbc0e --- /dev/null +++ b/packages/api/test/socketAuthenticationIsolation.test.ts @@ -0,0 +1,229 @@ +import assert from 'node:assert/strict'; +import { createServer } from 'node:http'; +import type { AddressInfo } from 'node:net'; +import { after, test } from 'node:test'; +import { closeConnection } from '@propr/core'; +import { Server as SocketIOServer, type Socket as ServerSocket } from 'socket.io'; +import { io as createSocketClient, type Socket as ClientSocket } from 'socket.io-client'; +import { + SocketAuthenticationError, + type SocketPrincipal, +} from '../auth.js'; +import type { GitHubUser } from '../authTypes.js'; +import { + configureSocketAuthentication, + revalidateSocketAuthentication, +} from '../services/socketAuthentication.js'; + +after(async () => { await closeConnection(); }); + +function user(id: string): GitHubUser { + return { + id, + login: id, + username: id, + displayName: id, + email: null, + avatarUrl: null, + }; +} + +function principal(id: string): SocketPrincipal { + return { + user: user(id), + authorization: { role: 'member', permissions: [], source: 'implicit' }, + }; +} + +async function waitForConnect(socket: ClientSocket): Promise { + await new Promise((resolve, reject) => { + socket.once('connect', resolve); + socket.once('connect_error', reject); + }); +} + +async function waitForConnectError(socket: ClientSocket): Promise { + return await new Promise((resolve, reject) => { + socket.once('connect', () => reject(new Error('Socket unexpectedly connected'))); + socket.once('connect_error', error => resolve(error as Error & { data?: { code?: string } })); + }); +} + +test('isolates authentication and revalidation across namespaces on one transport', async () => { + const httpServer = createServer(); + const io = new SocketIOServer(httpServer, { transports: ['websocket'] }); + const seenAuthorization: string[] = []; + configureSocketAuthentication(io, { + engineMiddleware: [], + authenticate: async request => { + assert.equal(Object.isFrozen(request.headers), true); + const authorization = request.headers.authorization; + seenAuthorization.push(authorization ?? ''); + if (authorization === 'Bearer anchor-token') return principal('anchor'); + if (authorization === 'Bearer replacement-token') return principal('replacement'); + throw new SocketAuthenticationError('AUTHENTICATION_REQUIRED', 'missing bearer'); + }, + }); + + let anchorServerSocket: ServerSocket | undefined; + io.of('/anchor').on('connection', socket => { + anchorServerSocket = socket; + }); + io.of('/replaceable').on('connection', () => undefined); + await new Promise(resolve => httpServer.listen(0, '127.0.0.1', resolve)); + const port = (httpServer.address() as AddressInfo).port; + const anchor = createSocketClient(`http://127.0.0.1:${port}/anchor`, { + transports: ['websocket'], + auth: { token: 'anchor-token' }, + autoConnect: false, + reconnection: false, + }); + const replaceable = anchor.io.socket('/replaceable'); + replaceable.auth = { token: 'rejected-token' }; + + try { + const anchorConnected = waitForConnect(anchor); + anchor.connect(); + await anchorConnected; + const engineId = anchor.io.engine?.id; + assert(engineId); + assert(anchorServerSocket); + assert.equal(anchorServerSocket.request.headers.authorization, undefined); + + const rejected = waitForConnectError(replaceable); + replaceable.connect(); + const error = await rejected; + assert.equal(error.data?.code, 'AUTHENTICATION_REQUIRED'); + assert.equal(anchor.io.engine?.id, engineId); + assert.equal(anchorServerSocket.request.headers.authorization, undefined); + assert.equal(await revalidateSocketAuthentication(anchorServerSocket), true); + assert.equal(anchor.connected, true); + + replaceable.auth = { token: 'replacement-token' }; + const replacementConnected = waitForConnect(replaceable); + replaceable.connect(); + await replacementConnected; + assert.equal(anchor.io.engine?.id, engineId); + assert.equal(anchorServerSocket.request.headers.authorization, undefined); + assert.equal(await revalidateSocketAuthentication(anchorServerSocket), true); + assert.equal(anchor.connected, true); + assert.deepEqual(seenAuthorization, [ + 'Bearer anchor-token', + 'Bearer rejected-token', + 'Bearer anchor-token', + 'Bearer replacement-token', + 'Bearer anchor-token', + ]); + } finally { + anchor.disconnect(); + replaceable.disconnect(); + await io.close(); + await new Promise(resolve => httpServer.close(() => resolve())); + } +}); + +test('authenticates a pre-registered namespace and isolates its credential snapshot', async () => { + const httpServer = createServer(); + const io = new SocketIOServer(httpServer, { transports: ['websocket'] }); + let preRegisteredServerSocket: ServerSocket | undefined; + io.of('/pre-registered').on('connection', socket => { + preRegisteredServerSocket = socket; + }); + + const seenAuthorization: string[] = []; + configureSocketAuthentication(io, { + engineMiddleware: [], + authenticate: async request => { + assert.equal(Object.isFrozen(request.headers), true); + const authorization = request.headers.authorization; + seenAuthorization.push(authorization ?? ''); + if (authorization === 'Bearer pre-registered-token') return principal('pre-registered'); + if (authorization === 'Bearer later-token') return principal('later'); + throw new SocketAuthenticationError('AUTHENTICATION_REQUIRED', 'invalid bearer'); + }, + }); + + io.of('/later').on('connection', () => undefined); + await new Promise(resolve => httpServer.listen(0, '127.0.0.1', resolve)); + const port = (httpServer.address() as AddressInfo).port; + const rejectedPreRegistered = createSocketClient( + `http://127.0.0.1:${port}/pre-registered`, + { transports: ['websocket'], autoConnect: false, reconnection: false }, + ); + + try { + const rejected = waitForConnectError(rejectedPreRegistered); + rejectedPreRegistered.connect(); + const unauthenticatedError = await rejected; + assert.equal(unauthenticatedError.data?.code, 'AUTHENTICATION_REQUIRED'); + } finally { + rejectedPreRegistered.disconnect(); + } + + const mismatchedPreRegistered = createSocketClient( + `http://127.0.0.1:${port}/pre-registered`, + { + transports: ['websocket'], + auth: { token: 'mismatched-token' }, + autoConnect: false, + reconnection: false, + }, + ); + + try { + const rejected = waitForConnectError(mismatchedPreRegistered); + mismatchedPreRegistered.connect(); + assert.equal((await rejected).data?.code, 'AUTHENTICATION_REQUIRED'); + } finally { + mismatchedPreRegistered.disconnect(); + } + + const preRegistered = createSocketClient(`http://127.0.0.1:${port}/pre-registered`, { + transports: ['websocket'], + auth: { token: 'pre-registered-token' }, + autoConnect: false, + reconnection: false, + }); + const later = preRegistered.io.socket('/later'); + later.auth = { token: 'mismatched-token' }; + + try { + const preRegisteredConnected = waitForConnect(preRegistered); + preRegistered.connect(); + await preRegisteredConnected; + const engineId = preRegistered.io.engine?.id; + assert(engineId); + assert(preRegisteredServerSocket); + assert.equal(preRegisteredServerSocket.request.headers.authorization, undefined); + + const mismatchedError = waitForConnectError(later); + later.connect(); + assert.equal((await mismatchedError).data?.code, 'AUTHENTICATION_REQUIRED'); + assert.equal(preRegistered.io.engine?.id, engineId); + assert.equal(await revalidateSocketAuthentication(preRegisteredServerSocket), true); + assert.equal(preRegistered.connected, true); + + later.auth = { token: 'later-token' }; + const laterConnected = waitForConnect(later); + later.connect(); + await laterConnected; + assert.equal(preRegistered.io.engine?.id, engineId); + assert.equal(await revalidateSocketAuthentication(preRegisteredServerSocket), true); + assert.equal(preRegistered.connected, true); + assert.equal(preRegisteredServerSocket.request.headers.authorization, undefined); + assert.deepEqual(seenAuthorization, [ + '', + 'Bearer mismatched-token', + 'Bearer pre-registered-token', + 'Bearer mismatched-token', + 'Bearer pre-registered-token', + 'Bearer later-token', + 'Bearer pre-registered-token', + ]); + } finally { + preRegistered.disconnect(); + later.disconnect(); + await io.close(); + await new Promise(resolve => httpServer.close(() => resolve())); + } +}); diff --git a/packages/api/test/statusRoutes.test.ts b/packages/api/test/statusRoutes.test.ts index bcc4b041d..2fc9544c2 100644 --- a/packages/api/test/statusRoutes.test.ts +++ b/packages/api/test/statusRoutes.test.ts @@ -206,7 +206,7 @@ test('/api/compatibility returns public version contract metadata', async () => apiCompatibility: PROPR_API_COMPATIBILITY, uiCompatibility: PROPR_UI_COMPATIBILITY, desktopAuthentication: { - protocolVersion: 1, + protocolVersion: 2, browserPairing: true, instanceBearerTokens: true, socketIoBearerAuthentication: true, @@ -227,7 +227,7 @@ test('/api/desktop/discovery adds only the stable product name to compatibility apiCompatibility: PROPR_API_COMPATIBILITY, uiCompatibility: PROPR_UI_COMPATIBILITY, desktopAuthentication: { - protocolVersion: 1, + protocolVersion: 2, browserPairing: true, instanceBearerTokens: true, socketIoBearerAuthentication: true, diff --git a/packages/cli/src/api/agents.ts b/packages/cli/src/api/agents.ts index 4c010fd27..ba05a4ddd 100644 --- a/packages/cli/src/api/agents.ts +++ b/packages/cli/src/api/agents.ts @@ -158,10 +158,10 @@ export interface SaveAgentsResponse { * console.log(`Found ${result.agents.length} agents`); * ``` */ -export async function listAgents(client?: ApiClient): Promise { +export async function listAgents(client?: ApiClient, signal?: AbortSignal): Promise { const apiClient = client ?? (await createApiClient()); - const response = await apiClient.get("/api/config/agents"); + const response = await apiClient.get("/api/config/agents", { signal }); return response.data; } @@ -188,12 +188,13 @@ export async function listAgents(client?: ApiClient): Promise */ export async function addAgent( options: AddAgentOptions, - client?: ApiClient + client?: ApiClient, + signal?: AbortSignal ): Promise { const apiClient = client ?? (await createApiClient()); // Fetch existing agents - const existingResponse = await apiClient.get("/api/config/agents"); + const existingResponse = await apiClient.get("/api/config/agents", { signal }); const existingAgents = existingResponse.data.agents || []; // Check if alias already exists @@ -224,6 +225,7 @@ export async function addAgent( // Save the updated list const response = await apiClient.post("/api/config/agents", { body: { agents: updatedAgents }, + signal, }); return response.data; diff --git a/packages/cli/src/api/client.ts b/packages/cli/src/api/client.ts index fcbc169ef..57a97d301 100644 --- a/packages/cli/src/api/client.ts +++ b/packages/cli/src/api/client.ts @@ -123,6 +123,7 @@ export class ApiClient { headers: customHeaders = {}, params, timeout = this.defaultTimeout, + signal, } = options; // Build the full URL @@ -156,19 +157,25 @@ export class ApiClient { for (let attempt = 1; attempt <= maxAttempts; attempt++) { // Each retry receives its own timeout window and abort signal. const controller = new AbortController(); - fetchOptions.signal = controller.signal; + signal?.throwIfAborted(); + fetchOptions.signal = signal ? AbortSignal.any([controller.signal, signal]) : controller.signal; const timeoutId = setTimeout(() => controller.abort(), timeout); try { const response = await fetch(url, fetchOptions); clearTimeout(timeoutId); + signal?.throwIfAborted(); // Handle error responses if (!response.ok) { let errorResponse: ApiErrorResponse | undefined; try { errorResponse = await response.json() as ApiErrorResponse; - } catch { + signal?.throwIfAborted(); + } catch (error) { + if (signal?.aborted) throw signal.reason; + if ((error as { name?: unknown; code?: unknown } | null)?.name === "AbortError" + || (error as { code?: unknown } | null)?.code === "ABORT_ERR") throw error; // Response body is not JSON or empty } throw createApiError(response.status, errorResponse); @@ -183,6 +190,7 @@ export class ApiClient { // Handle non-JSON responses data = await response.text() as unknown as T; } + signal?.throwIfAborted(); return { data, @@ -197,6 +205,7 @@ export class ApiClient { throw error; } + if (signal?.aborted) throw signal.reason; const retryableError = error instanceof Error && error.name === "AbortError" ? new TimeoutError("Request timed out.", timeout) : error instanceof TypeError diff --git a/packages/cli/src/api/relay.ts b/packages/cli/src/api/relay.ts index ec0cd65a6..5a6329c06 100644 --- a/packages/cli/src/api/relay.ts +++ b/packages/cli/src/api/relay.ts @@ -10,11 +10,18 @@ const FETCH_TIMEOUT_MS = 15_000; +function rethrowRequestCancellation(error: unknown, signal?: AbortSignal): void { + signal?.throwIfAborted(); + if ((error as { name?: unknown; code?: unknown } | null)?.name === "AbortError" + || (error as { code?: unknown } | null)?.code === "ABORT_ERR") throw error; +} + export interface RelayClientOptions { /** Relay base URL, including the version prefix (e.g. https://relay.example/v1). */ baseUrl: string; /** GitHub user token used to prove identity to the relay. */ githubToken: string; + signal?: AbortSignal; } export interface EnrollRelayTokenResult { @@ -75,9 +82,11 @@ async function relayRequest( method, headers, body: body === undefined ? undefined : JSON.stringify(body), - signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), + signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)]) : AbortSignal.timeout(FETCH_TIMEOUT_MS), }); + options.signal?.throwIfAborted(); } catch (error) { + rethrowRequestCancellation(error, options.signal); throw new Error(`Cannot reach the relay at ${options.baseUrl}: ${(error as Error).message}`); } @@ -85,8 +94,10 @@ async function relayRequest( let code = ""; try { const parsed = (await response.json()) as { error?: { code?: string } }; + options.signal?.throwIfAborted(); code = parsed?.error?.code ?? ""; - } catch { + } catch (error) { + rethrowRequestCancellation(error, options.signal); /* non-JSON error body */ } if (response.status === 401) { @@ -104,8 +115,11 @@ async function relayRequest( } try { - return (await response.json()) as T; - } catch { + const result = (await response.json()) as T; + options.signal?.throwIfAborted(); + return result; + } catch (error) { + rethrowRequestCancellation(error, options.signal); throw new Error("The relay returned a malformed JSON response."); } } diff --git a/packages/cli/src/api/repos.ts b/packages/cli/src/api/repos.ts index d0c98afb8..750456335 100644 --- a/packages/cli/src/api/repos.ts +++ b/packages/cli/src/api/repos.ts @@ -257,10 +257,10 @@ export interface RepoConfigResponse { * } * ``` */ -export async function getRepos(client?: ApiClient): Promise { +export async function getRepos(client?: ApiClient, signal?: AbortSignal): Promise { const apiClient = client ?? (await createApiClient()); - const response = await apiClient.get("/api/config/repos"); + const response = await apiClient.get("/api/config/repos", { signal }); return response.data; } @@ -288,12 +288,13 @@ export async function getRepos(client?: ApiClient): Promise { export async function addRepo( fullName: string, options: AddRepoOptions = {}, - client?: ApiClient + client?: ApiClient, + signal?: AbortSignal ): Promise { const apiClient = client ?? (await createApiClient()); // First, fetch the current list of repos - const currentRepos = await getRepos(apiClient); + const currentRepos = await getRepos(apiClient, signal); // Check if repo already exists const existingRepo = currentRepos.repos_to_monitor.find( @@ -317,6 +318,7 @@ export async function addRepo( const response = await apiClient.post("/api/config/repos", { body: { repos_to_monitor: updatedRepos }, + signal, }); return response.data; diff --git a/packages/cli/src/api/settings.ts b/packages/cli/src/api/settings.ts index 96c6e8918..682e03759 100644 --- a/packages/cli/src/api/settings.ts +++ b/packages/cli/src/api/settings.ts @@ -436,12 +436,14 @@ export async function getSettings(client?: ApiClient): Promise { const apiClient = client ?? (await createApiClient()); const response = await apiClient.post("/api/config/settings", { body: { settings }, + signal, }); return response.data; @@ -467,10 +469,11 @@ export async function updateSettings( export async function updateSetting( key: SettingKey, value: number | string | string[] | boolean, - client?: ApiClient + client?: ApiClient, + signal?: AbortSignal ): Promise { const settings: UpdateSettingsOptions = { [key]: value }; - return updateSettings(settings, client); + return updateSettings(settings, client, signal); } export async function getConfigValue< diff --git a/packages/cli/src/api/system.ts b/packages/cli/src/api/system.ts index bcf3e2dfb..8a9449845 100644 --- a/packages/cli/src/api/system.ts +++ b/packages/cli/src/api/system.ts @@ -138,10 +138,11 @@ export interface QueueStats { * ``` */ export async function getSystemStatus( - client?: ApiClient + client?: ApiClient, + signal?: AbortSignal ): Promise { const apiClient = client ?? (await createApiClient()); - const response = await apiClient.get("/api/status"); + const response = await apiClient.get("/api/status", { signal }); return response.data; } diff --git a/packages/cli/src/api/types.ts b/packages/cli/src/api/types.ts index 5caeaf4d8..579648cdf 100644 --- a/packages/cli/src/api/types.ts +++ b/packages/cli/src/api/types.ts @@ -37,6 +37,7 @@ export interface RequestOptions { * Request timeout in milliseconds. Defaults to 30000 (30 seconds). */ timeout?: number; + signal?: AbortSignal; } /** diff --git a/packages/cli/src/auth/githubLogin.ts b/packages/cli/src/auth/githubLogin.ts index 36d27e3cd..5d9ad44c8 100644 --- a/packages/cli/src/auth/githubLogin.ts +++ b/packages/cli/src/auth/githubLogin.ts @@ -9,6 +9,8 @@ */ import type { ConfigManager } from "../config/index.js"; +import { spawn } from "node:child_process"; +import { rethrowCancellation } from "@propr/local-setup"; /** Scopes requested when launching the interactive `gh auth login`. */ const GH_LOGIN_SCOPES = "repo,read:org"; @@ -23,6 +25,7 @@ export interface GithubLoginOptions { interactive?: boolean; /** Sink for human-facing progress lines. Defaults to no output. */ onLog?: (line: string) => void; + signal?: AbortSignal; } export interface GithubLoginResult { @@ -44,13 +47,16 @@ export async function loginWithGithubCli( configManager: ConfigManager, options: GithubLoginOptions = {} ): Promise { - const { interactive = false, onLog } = options; - const { execSync, spawnSync } = await import("child_process"); + const { interactive = false, onLog, signal } = options; // Require the gh CLI up front — every path below shells out to it. try { - execSync("gh --version", { stdio: "ignore" }); - } catch { + const version = await runGh(["--version"], false, signal); + signal?.throwIfAborted(); + if (version.status !== 0) throw version.error; + } catch (error) { + signal?.throwIfAborted(); + rethrowCancellation(error); return { ok: false, message: @@ -59,9 +65,11 @@ export async function loginWithGithubCli( } // Reuse an existing gh session when one is already authenticated. - const existing = readGhToken(execSync); + const existing = await readGhToken(signal); if (existing) { - await configManager.setGithubToken(existing); + signal?.throwIfAborted(); + await configManager.setGithubToken(existing, signal); + signal?.throwIfAborted(); return { ok: true, token: existing, message: "Authenticated using your existing gh CLI session." }; } @@ -75,25 +83,69 @@ export async function loginWithGithubCli( // Launch the interactive browser/device login. Inherits stdio so the user can // complete the gh prompts directly. onLog?.("No existing gh session found. Starting interactive login…"); - const result = spawnSync("gh", ["auth", "login", "-s", GH_LOGIN_SCOPES], { stdio: "inherit" }); + const result = await runGh(["auth", "login", "-s", GH_LOGIN_SCOPES], false, signal, true); + signal?.throwIfAborted(); if (result.status !== 0) { return { ok: false, message: "GitHub login failed or was cancelled." }; } - const token = readGhToken(execSync); + const token = await readGhToken(signal); if (!token) { return { ok: false, message: "Could not retrieve a token after login." }; } - await configManager.setGithubToken(token); + signal?.throwIfAborted(); + await configManager.setGithubToken(token, signal); + signal?.throwIfAborted(); return { ok: true, token, message: "Authentication successful." }; } /** Read the current `gh` token, or null when no session is authenticated. */ -function readGhToken(execSync: typeof import("child_process").execSync): string | null { +async function readGhToken(signal?: AbortSignal): Promise { try { - const token = execSync("gh auth token", { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }).trim(); + const result = await runGh(["auth", "token"], true, signal); + signal?.throwIfAborted(); + const token = result.status === 0 ? result.stdout.trim() : ""; return token || null; - } catch { + } catch (error) { + signal?.throwIfAborted(); + rethrowCancellation(error); return null; } } + +function runGh(args: string[], capture: boolean, signal?: AbortSignal, interactive = false): Promise<{ status: number | null; stdout: string; error?: Error }> { + return new Promise((resolve, reject) => { + signal?.throwIfAborted(); + const child = spawn("gh", args, { + stdio: interactive ? "inherit" : capture ? ["ignore", "pipe", "ignore"] : "ignore", + detached: process.platform !== "win32", + }); + let stdout = ""; + let forceTimer: NodeJS.Timeout | undefined; + child.stdout?.on("data", chunk => { stdout += chunk.toString(); }); + const terminate = (force = false) => { + if (!child.pid) return; + if (process.platform === "win32") { + const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", ...(force ? ["/F"] : [])], { stdio: "ignore" }); + killer.unref(); + } else { + try { process.kill(-child.pid, force ? "SIGKILL" : "SIGTERM"); } catch { child.kill(force ? "SIGKILL" : "SIGTERM"); } + } + }; + const abort = () => { + terminate(); + forceTimer = setTimeout(() => { + terminate(true); + forceTimer = setTimeout(() => reject(signal?.reason), 2_000); + }, 2_000); + }; + signal?.addEventListener("abort", abort, { once: true }); + child.once("error", error => resolve({ status: null, stdout, error })); + child.once("close", status => { + if (forceTimer) clearTimeout(forceTimer); + signal?.removeEventListener("abort", abort); + if (signal?.aborted) reject(signal.reason); + else resolve({ status, stdout }); + }); + }); +} diff --git a/packages/cli/src/commands/agentValidation.ts b/packages/cli/src/commands/agentValidation.ts index 05fa26cdf..f3cb4adfc 100644 --- a/packages/cli/src/commands/agentValidation.ts +++ b/packages/cli/src/commands/agentValidation.ts @@ -60,10 +60,14 @@ interface ExecResult { function execAsync( cmd: string, args: string[], - opts: { input?: string; cwd?: string; env?: NodeJS.ProcessEnv; timeoutMs: number } + opts: { input?: string; cwd?: string; env?: NodeJS.ProcessEnv; timeoutMs: number; signal?: AbortSignal } ): Promise { return new Promise((resolve) => { - const child = spawn(cmd, args, { cwd: opts.cwd, env: opts.env, stdio: ["pipe", "pipe", "pipe"] }); + if (opts.signal?.aborted) { + resolve({ status: null, stdout: "", stderr: "", error: Object.assign(new Error("cancelled"), { code: "ABORT_ERR" }) }); + return; + } + const child = spawn(cmd, args, { cwd: opts.cwd, env: opts.env, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32" }); let stdout = ""; let stderr = ""; let settled = false; @@ -71,16 +75,39 @@ function execAsync( if (settled) return; settled = true; clearTimeout(timer); + if (forceTimer) clearTimeout(forceTimer); + opts.signal?.removeEventListener("abort", abort); resolve(res); }; + const terminate = (force = false): void => { + if (!child.pid) return; + if (process.platform === "win32") { + const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", ...(force ? ["/F"] : [])], { stdio: "ignore" }); + killer.unref(); + } else { + try { process.kill(-child.pid, force ? "SIGKILL" : "SIGTERM"); } catch { child.kill(force ? "SIGKILL" : "SIGTERM"); } + } + }; + let terminalError: NodeJS.ErrnoException | undefined; + let forceTimer: NodeJS.Timeout | undefined; + const abort = (): void => { + terminalError = Object.assign(new Error("cancelled"), { code: "ABORT_ERR" }); + terminate(); + forceTimer = setTimeout(() => { + terminate(true); + forceTimer = setTimeout(() => finish({ status: null, stdout, stderr, error: terminalError }), 2_000); + }, 2_000); + }; const timer = setTimeout(() => { - child.kill("SIGKILL"); - finish({ status: null, stdout, stderr, error: Object.assign(new Error("timed out"), { code: "ETIMEDOUT" }) }); + terminalError = Object.assign(new Error("timed out"), { code: "ETIMEDOUT" }); + terminate(true); + forceTimer = setTimeout(() => finish({ status: null, stdout, stderr, error: terminalError }), 2_000); }, opts.timeoutMs); child.stdout.on("data", (d) => { stdout += d.toString(); }); child.stderr.on("data", (d) => { stderr += d.toString(); }); child.on("error", (error) => finish({ status: null, stdout, stderr, error })); - child.on("close", (code) => finish({ status: code, stdout, stderr })); + opts.signal?.addEventListener("abort", abort, { once: true }); + child.on("close", (code) => finish({ status: terminalError ? null : code, stdout, stderr, error: terminalError })); child.stdin.on("error", () => { /* ignore EPIPE if the child never reads stdin */ }); if (opts.input != null) child.stdin.write(opts.input); child.stdin.end(); @@ -353,8 +380,8 @@ const DESCRIPTORS: AgentValidationDescriptor[] = [ }, ]; -function imagePresent(orch: OrchestratorModule, tag: string): boolean { - return orch.docker(["images", "-q", tag], { capture: true }).stdout.trim().length > 0; +async function imagePresent(orch: OrchestratorModule, tag: string, signal?: AbortSignal): Promise { + return (await orch.dockerAsync(["images", "-q", tag], { signal })).stdout.trim().length > 0; } function commandExists(bin: string): boolean { @@ -404,6 +431,7 @@ export interface ValidateAgentsOptions { onUpdate?: (agent: string, update: AgentCellUpdate) => void; /** Skip the billable host invocation; setup uses the worker image as truth. */ skipHost?: boolean; + signal?: AbortSignal; } /** The agent types that would be validated for the given filter (for seeding a live view). */ @@ -463,13 +491,14 @@ export interface AgentValidationRow { async function versionInfo( d: AgentValidationDescriptor, image: string | undefined, - orch: OrchestratorModule + orch: OrchestratorModule, + options: Pick ): Promise<{ host?: string; image?: string; drift?: "older" | "newer" }> { - const hostPromise = d.hostBin && commandExists(d.hostBin) - ? execAsync(d.hostBin, ["--version"], { timeoutMs: VERSION_TIMEOUT_MS }).then((r) => parseVersion(`${r.stdout}\n${r.stderr}`)) + const hostPromise = !options.skipHost && d.hostBin && commandExists(d.hostBin) + ? execAsync(d.hostBin, ["--version"], { timeoutMs: VERSION_TIMEOUT_MS, signal: options.signal }).then((r) => parseVersion(`${r.stdout}\n${r.stderr}`)) : Promise.resolve(undefined); - const imagePromise = image && imagePresent(orch, image) - ? execAsync("docker", ["run", "--rm", "--network=none", "-e", `PROPR_AGENT_TYPE=${d.type}`, image, ...d.versionArgs], { timeoutMs: VERSION_TIMEOUT_MS }).then((r) => parseVersion(`${r.stdout}\n${r.stderr}`)) + const imagePromise = image && await imagePresent(orch, image, options.signal) + ? execAsync("docker", ["run", "--rm", "--network=none", "-e", `PROPR_AGENT_TYPE=${d.type}`, image, ...d.versionArgs], { timeoutMs: VERSION_TIMEOUT_MS, signal: options.signal }).then((r) => parseVersion(`${r.stdout}\n${r.stderr}`)) : Promise.resolve(undefined); const [host, img] = await Promise.all([hostPromise, imagePromise]); const drift = host && img && host !== img ? (compareVersions(img, host) < 0 ? "older" : "newer") : undefined; @@ -526,13 +555,13 @@ export async function validateAgents( return { status: "warn", detail: `${d.hostBin} not installed on host — skipped` }; } const { args, stdin } = d.hostInvocation({ prompt: VALIDATION_PROMPT, promptFileHost }); - const run = await execAsync(d.hostBin, args, { input: stdin, cwd: workspaceDir, timeoutMs: VALIDATION_TIMEOUT_MS }); + const run = await execAsync(d.hostBin, args, { input: stdin, cwd: workspaceDir, timeoutMs: VALIDATION_TIMEOUT_MS, signal: options.signal }); const ev = evaluateRun(run); return { status: ev.ok ? "ok" : "fail", detail: ev.detail, ...(ev.ok ? {} : { fix: `Run \`${hostDebugCommand(d)}\` on the host to debug ${d.type} auth.` }) }; }; const runImage = async (d: AgentValidationDescriptor, image: string | undefined, hostDir: string | undefined): Promise => { - if (!image || !imagePresent(orch, image)) { + if (!image || !(await imagePresent(orch, image, options.signal))) { return { status: "warn", detail: `image ${image ?? d.imageKey} not present — skipped` }; } if (!hostDir) { @@ -561,6 +590,7 @@ export async function validateAgents( input: stdin, env: d.type === "vibe" && cfg.mistralApiKey ? { ...process.env, MISTRAL_API_KEY: cfg.mistralApiKey } : undefined, timeoutMs: VALIDATION_TIMEOUT_MS, + signal: options.signal, }); const ev = evaluateRun(run); const loginHint = d.loginArgs ? ` Re-authenticate with: propr agent login ${d.type}.` : ""; @@ -585,7 +615,8 @@ export async function validateAgents( mkdirSync(hostDir, { recursive: true, mode: 0o700 }); } // Emit each cell as it resolves so a live view can fill the table in. - const versionP = versionInfo(d, image, orch).then((v) => { + options.signal?.throwIfAborted(); + const versionP = versionInfo(d, image, orch, options).then((v) => { options.onUpdate?.(d.type, { field: "version", hostVersion: v.host, imageVersion: v.image, drift: v.drift }); return v; }); diff --git a/packages/cli/src/commands/checkCommands.ts b/packages/cli/src/commands/checkCommands.ts index 5815f8eee..bd4993b97 100644 --- a/packages/cli/src/commands/checkCommands.ts +++ b/packages/cli/src/commands/checkCommands.ts @@ -124,6 +124,7 @@ export interface RunChecksOptions { verify?: boolean; agents?: string[]; skipRemoteImageCheck?: boolean; + signal?: AbortSignal; /** Fired when a slow check begins, so a live UI can show a pending row. */ onPending?: (slot: { name: string; group?: CheckGroup }) => void; /** Fired as each result is finalized, so a live UI can update incrementally. */ @@ -215,13 +216,15 @@ export async function runChecks(options: RunChecksOptions = {}): Promise => { // Presence-only for third-party images and when remote checks are skipped. if (skipRemoteImageCheck || !isProprPublished(tag)) { - if (!imagePresent(orch, tag)) return missingImageResult(key, tag); + if (!(await imagePresent(orch, tag, options.signal))) return missingImageResult(key, tag); const detail = skipRemoteImageCheck ? `${tag} (local; remote check skipped)` : `${tag} (present)`; return { name: `Image ${key}`, status: "ok", detail, group: "Images" }; } let freshnessPromise = freshnessByTag.get(tag); if (!freshnessPromise) { - freshnessPromise = orch.inspectImageFreshnessAsync(tag); + freshnessPromise = orch.inspectImageFreshnessAsync(tag, { signal: options.signal }); freshnessByTag.set(tag, freshnessPromise); } const freshness = await freshnessPromise; @@ -405,7 +407,7 @@ export async function runChecks(options: RunChecksOptions = {}): Promise { + const res = await orch.dockerAsync(["images", "-q", tag], { signal }); return res.stdout.trim().length > 0; } diff --git a/packages/cli/src/commands/initStack.ts b/packages/cli/src/commands/initStack.ts index 71fa7ea37..72f0b01ae 100644 --- a/packages/cli/src/commands/initStack.ts +++ b/packages/cli/src/commands/initStack.ts @@ -53,6 +53,14 @@ export interface DetectedCred { path: string; } +let configuredStackTemplatePath: string | undefined; + +/** Configure an application-packaged stack template before scaffolding. */ +export function configureStackTemplatePath(path: string): void { + if (!isAbsolute(path) || !existsSync(path)) throw new Error("The configured stack template path is invalid"); + configuredStackTemplatePath = path; +} + // Mirrors the launcher's HOST_VIBE_PROMPT_CACHE_DIR default in // docker/launcher/orchestrator.mjs. Keep it per-user and private because prompt // files can contain task/repository context. @@ -84,6 +92,7 @@ export function ensureVibePromptCacheDir(cacheDir: string | undefined): string | /** Resolve the bundled .env.example, falling back to a repo checkout. */ function resolveEnvExample(): string | undefined { + if (configuredStackTemplatePath) return configuredStackTemplatePath; const here = dirname(fileURLToPath(import.meta.url)); // Bundled copy is renamed to avoid npm's .env* exclusion from tarballs. const bundled = join(here, "..", "assets", "env.example.txt"); @@ -120,6 +129,7 @@ function detectCredentials(): DetectedCred[] { export interface InitStackOptions { root?: string; force?: boolean; + signal?: AbortSignal; } export interface InitStackResult { @@ -165,10 +175,12 @@ export async function scaffoldStack( pendingCredentials: [], }; - mkdirSync(rootDir, { recursive: true }); + options.signal?.throwIfAborted(); + mkdirSync(rootDir, { recursive: true, mode: 0o700 }); // 1. data/logs/repos directories for (const sub of ["data", "logs", "repos"]) { + options.signal?.throwIfAborted(); const dir = join(rootDir, sub); const created = !existsSync(dir); ensurePrivateDirectory(dir); @@ -204,7 +216,7 @@ export async function scaffoldStack( if (options.force && envExists) { secureExistingPrivateFile(envPath); const bakPath = `${envPath}.bak`; - writePrivateFileAtomic(bakPath, readFileSync(envPath), { secureParent: false }); + writePrivateFileAtomic(bakPath, readFileSync(envPath), { secureParent: false, signal: options.signal }); result.envBackedUp = true; } shouldWriteEnv = true; @@ -234,7 +246,7 @@ export async function scaffoldStack( result.pendingCredentials = toAppend; if (shouldWriteEnv) { - writePrivateFileAtomic(envPath, envContent, { secureParent: false }); + writePrivateFileAtomic(envPath, envContent, { secureParent: false, signal: options.signal }); result.envCreated = true; } @@ -256,6 +268,7 @@ export async function scaffoldStack( } // 4. Persist the stack root so other commands can find it. + options.signal?.throwIfAborted(); await dependencies.persistStackRoot(rootDir); return result; diff --git a/packages/cli/src/commands/setup/agentHostActions.ts b/packages/cli/src/commands/setup/agentHostActions.ts index 1cf470714..784db16ed 100644 --- a/packages/cli/src/commands/setup/agentHostActions.ts +++ b/packages/cli/src/commands/setup/agentHostActions.ts @@ -1,60 +1,113 @@ import { mkdirSync, mkdtempSync, rmSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; -import { spawnSync } from "node:child_process"; +import { spawn } from "node:child_process"; import type { AgentSetupActions } from "@propr/local-setup"; import type { ConfigManager } from "../../config/index.js"; import { localhostServiceUrl } from "../../utils/dockerPort.js"; /** Bind the portable agent setup engine to the CLI API and Docker launcher. */ export function createDefaultAgentSetupActions(configManager?: ConfigManager): AgentSetupActions { - const localApiClient = async (rootDir: string): Promise => { + const localApiClient = async (rootDir: string, root?: import("@propr/local-setup").RootOperationBoundary): Promise => { + root?.assertRootAuthority?.(); const { getHostConfig } = await import("../../orchestrator/index.js"); - const { cfg } = await getHostConfig({ configManager, root: rootDir }); + root?.assertRootAuthority?.(); + const { cfg } = await getHostConfig({ configManager, root: rootDir, readRoot: root?.rootOperationsDir }); + root?.assertRootAuthority?.(); const { createApiClient } = await import("../../api/client.js"); + root?.assertRootAuthority?.(); return createApiClient({ baseUrl: localhostServiceUrl(cfg.apiPort) }); }; return { - async listAgents(rootDir) { + async listAgents(rootDir, signal, root) { const { listAgents } = await import("../../api/agents.js"); - return (await listAgents(await localApiClient(rootDir))).agents; + root?.assertRootAuthority?.(); + const result = await listAgents(await localApiClient(rootDir, root), signal); + root?.assertRootAuthority?.(); + return result.agents; }, - async addAgent(rootDir, options) { + async addAgent(rootDir, options, signal, root) { const { addAgent } = await import("../../api/agents.js"); - await addAgent(options, await localApiClient(rootDir)); + root?.assertRootAuthority?.(); + await addAgent(options, await localApiClient(rootDir, root), signal); + root?.assertRootAuthority?.(); }, async loginableAgents() { const { loginableAgents } = await import("../agentValidation.js"); return loginableAgents(); }, - async loginAgent(rootDir, type) { + async loginAgent(rootDir, type, signal, root) { + root?.assertRootAuthority?.(); const { getHostConfig } = await import("../../orchestrator/index.js"); const { planAgentLogin } = await import("../agentValidation.js"); - const { orch, cfg } = await getHostConfig({ configManager, root: rootDir }); + root?.assertRootAuthority?.(); + const { orch, cfg } = await getHostConfig({ configManager, root: rootDir, readRoot: root?.rootOperationsDir }); + root?.assertRootAuthority?.(); const temporaryRoot = mkdtempSync(join(tmpdir(), "propr-setup-login-")); const workspaceDir = join(temporaryRoot, "workspace"); mkdirSync(workspaceDir, { recursive: true, mode: 0o700 }); try { const { plan, error } = planAgentLogin(type, cfg, workspaceDir, orch.validateDockerBindPath); if (error || !plan) return { available: false, success: false, detail: error }; - if (!orch.docker(["images", "-q", plan.image], { capture: true }).stdout.trim()) { + root?.assertRootAuthority?.(); + const image = await orch.dockerAsync(["images", "-q", plan.image], { signal }); + signal?.throwIfAborted(); + root?.assertRootAuthority?.(); + if (!image.stdout.trim()) { + root?.assertRootAuthority?.(); return { available: true, success: false, detail: `image ${plan.image} not present locally — run \`propr images pull\`` }; } + root?.assertRootAuthority?.(); mkdirSync(plan.hostDir, { recursive: true, mode: 0o700 }); - const result = spawnSync("docker", plan.dockerArgs, { stdio: "inherit" }); - return result.status === 0 + const status = await new Promise((resolve, reject) => { + signal?.throwIfAborted(); + root?.assertRootAuthority?.(); + const child = spawn("docker", plan.dockerArgs, { stdio: "inherit", detached: process.platform !== "win32" }); + let forceTimer: NodeJS.Timeout | undefined; + const terminate = (force = false) => { + if (!child.pid) return; + if (process.platform === "win32") { + const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", ...(force ? ["/F"] : [])], { stdio: "ignore" }); + killer.unref(); + } else { + try { process.kill(-child.pid, force ? "SIGKILL" : "SIGTERM"); } catch { child.kill(force ? "SIGKILL" : "SIGTERM"); } + } + }; + const abort = () => { + terminate(); + forceTimer = setTimeout(() => { + terminate(true); + forceTimer = setTimeout(() => reject(signal?.reason), 2_000); + }, 2_000); + }; + signal?.addEventListener("abort", abort, { once: true }); + child.once("error", reject); + child.once("close", code => { + if (forceTimer) clearTimeout(forceTimer); + signal?.removeEventListener("abort", abort); + if (signal?.aborted) reject(signal.reason); + else resolve(code); + }); + }); + signal?.throwIfAborted(); + root?.assertRootAuthority?.(); + return status === 0 ? { available: true, success: true, detail: `${type} login finished — credentials written to ${plan.hostDir}` } - : { available: true, success: false, detail: `${type} login exited with code ${result.status ?? "?"}` }; + : { available: true, success: false, detail: `${type} login exited with code ${status ?? "?"}` }; } finally { rmSync(temporaryRoot, { recursive: true, force: true }); } }, - async validateAgents(rootDir, types) { + async validateAgents(rootDir, types, signal, root) { + root?.assertRootAuthority?.(); const { getHostConfig } = await import("../../orchestrator/index.js"); const { validateAgents } = await import("../agentValidation.js"); - const { orch, cfg } = await getHostConfig({ configManager, root: rootDir }); - const rows = await validateAgents(orch, cfg, { agents: types, skipHost: true }); + root?.assertRootAuthority?.(); + const { orch, cfg } = await getHostConfig({ configManager, root: rootDir, readRoot: root?.rootOperationsDir }); + root?.assertRootAuthority?.(); + const rows = await validateAgents(orch, cfg, { agents: types, skipHost: true, signal }); + root?.assertRootAuthority?.(); return rows.map((row) => ({ type: row.type, status: row.image.status === "ok" ? "ok" as const : row.image.status === "fail" ? "failed" as const : "skipped" as const, diff --git a/packages/cli/src/commands/setup/engine.test.ts b/packages/cli/src/commands/setup/engine.test.ts index 014cc21ae..be5faf54c 100644 --- a/packages/cli/src/commands/setup/engine.test.ts +++ b/packages/cli/src/commands/setup/engine.test.ts @@ -6,7 +6,7 @@ import assert from "node:assert/strict"; import { test } from "node:test"; -import { classifyBackendAccessError, runSetup, type SetupActions, type SetupPrompts } from "./engine.js"; +import { classifyBackendAccessError, retrySetup, runSetup, type SetupActions, type SetupPrompts } from "./engine.js"; import type { ChecksOutcome } from "../checkCommands.js"; import type { AuthorizedInstallation } from "../../api/relay.js"; import { DEFAULT_PROPR_GH_RELAY_URL, type GithubAuthModeResult } from "@propr/shared"; @@ -1361,6 +1361,58 @@ test("whitelist falls back to .env when the backend is not running", async () => assert.equal(statusOf(result.state, "whitelist"), "done"); }); +test("whitelist abort is cancellation and never falls back to an env commit", async () => { + const controller = new AbortController(); + let envCommitted = false; + const result = await runSetup({ + root: "/stack", + signal: controller.signal, + prompts: { configureWhitelist: async () => ["erin"] }, + actions: mockActions({ + isStackRunning: async () => true, + saveWhitelistSetting: async (_root, _users, signal) => { + controller.abort(); + signal?.throwIfAborted(); + }, + applyEnvSelection: (_root, vars) => { + if ("GITHUB_USER_WHITELIST" in vars) envCommitted = true; + return { written: Object.keys(vars), skipped: [] }; + }, + }), + }); + + assert.equal(result.cancelled, true); + assert.equal(result.errors[0]?.code, "cancelled"); + assert.equal(envCommitted, false); +}); + +test("relay boundary abort never writes the minted token or continues classification", async () => { + const controller = new AbortController(); + let wroteRelayToken = false; + let started = false; + const result = await runSetup({ + root: "/stack", + signal: controller.signal, + prompts: { configureGithubAuth: async () => ({ mode: "relay", enrollRelay: { relayUrl: DEFAULT_PROPR_GH_RELAY_URL } }) }, + actions: mockActions({ + hasGithubToken: () => true, + fetchRelayInstallations: async () => ({ username: "octocat", installations: [{ installation_id: 42, account_login: "octocat", account_type: "User" }] }), + enrollRelay: async () => { + controller.abort(); + return { relayUrl: DEFAULT_PROPR_GH_RELAY_URL, token: "must-not-be-written" }; + }, + applyEnvSelection: (_root, vars) => { + if (vars.PROPR_GH_RELAY_TOKEN) wroteRelayToken = true; + return { written: Object.keys(vars), skipped: [] }; + }, + startStack: async () => { started = true; }, + }), + }); + assert.equal(result.cancelled, true); + assert.equal(wroteRelayToken, false); + assert.equal(started, false); +}); + test("prompts drive a full unattended run to completion", async () => { const seen: string[] = []; const prompts: SetupPrompts = { @@ -1386,3 +1438,13 @@ test("prompts drive a full unattended run to completion", async () => { ["check", "init-stack", "pull-images", "configure-agents", "github-auth", "intake", "start-stack", "enable-agents", "whitelist", "repo", "launch-ui"] ); }); + +for (const platform of ["darwin", "win32"] as const) { + test(`CLI setup and retry reject ${platform} before host actions`, async () => { + let actions = 0; + const overrides = { runChecks: async () => { actions += 1; throw new Error("not called"); } }; + await assert.rejects(runSetup({ root: "/stack", platform, actions: overrides }), /not supported/); + await assert.rejects(retrySetup({ rootDir: "/stack" } as never, { platform, actions: overrides }), /not supported/); + assert.equal(actions, 0); + }); +} diff --git a/packages/cli/src/commands/setup/engine.ts b/packages/cli/src/commands/setup/engine.ts index 7effef45b..90ae64fb0 100644 --- a/packages/cli/src/commands/setup/engine.ts +++ b/packages/cli/src/commands/setup/engine.ts @@ -1,5 +1,6 @@ import { runSetup as runLocalSetup, + getLocalSetupCapability, retrySetup as retryLocalSetup, resolveSetupRoot, type RunSetupOptions as LocalRunSetupOptions, @@ -21,6 +22,8 @@ export interface RunSetupOptions extends Omit { const { configManager, actions: overrides, root, ...portable } = options; + const capability = getLocalSetupCapability(portable.platform); + if (!capability.supported) throw new Error(capability.reason); const actions = { ...createDefaultActions(configManager), ...overrides } as SetupActions; return runLocalSetup({ ...portable, @@ -31,6 +34,8 @@ export async function runSetup(options: RunSetupOptions = {}): Promise = {}): Promise { const { configManager, actions: overrides, ...portable } = options; + const capability = getLocalSetupCapability(portable.platform); + if (!capability.supported) return Promise.reject(new Error(capability.reason)); const actions = { ...createDefaultActions(configManager), ...overrides } as SetupActions; return retryLocalSetup(previous, { ...portable, actions }); } diff --git a/packages/cli/src/commands/setup/hostActions.ts b/packages/cli/src/commands/setup/hostActions.ts index af1aa4746..35280ec44 100644 --- a/packages/cli/src/commands/setup/hostActions.ts +++ b/packages/cli/src/commands/setup/hostActions.ts @@ -12,6 +12,7 @@ import { readEnvVars, type PullImagesResult, type SetupActions, + rethrowCancellation, } from "@propr/local-setup"; import type { ConfigManager } from "../../config/index.js"; import type { RelayClientOptions } from "../../api/relay.js"; @@ -26,12 +27,24 @@ function assertSafeAgentCredentialDir(path: string, name = "Agent credential pat } } +function assertStableDockerHandoff( + rootDir: string, +): void { + if (!isAbsolute(rootDir) || /(?:^|\/)(?:proc\/[0-9]+\/fd|dev\/fd)(?:\/|$)/.test(rootDir)) { + throw new Error("Desktop Docker lifecycle requires the stable app-owned runtime root"); + } +} + export function createDefaultActions(configManager?: ConfigManager): SetupActions { /** A client pointed at the local stack's API port (not the saved remote URL). */ - const localApiClient = async (rootDir: string): Promise => { + const localApiClient = async (rootDir: string, rootOperationsDir?: string, assertRootAuthority?: () => void): Promise => { + assertRootAuthority?.(); const { getHostConfig } = await import("../../orchestrator/index.js"); - const { cfg } = await getHostConfig({ configManager, root: rootDir }); + assertRootAuthority?.(); + const { cfg } = await getHostConfig({ configManager, root: rootDir, readRoot: rootOperationsDir }); + assertRootAuthority?.(); const { createApiClient, createApiClientWithConfig } = await import("../../api/client.js"); + assertRootAuthority?.(); const options = { baseUrl: localhostServiceUrl(cfg.apiPort) }; // Keep the local client on setup's active profile and, importantly, the // token that an in-progress setup login just stored. Creating an unrelated @@ -53,12 +66,15 @@ export function createDefaultActions(configManager?: ConfigManager): SetupAction inspectDatastoreAdministrators, async scaffoldStack(options) { const { scaffoldStack } = await import("../initStack.js"); - return scaffoldStack(options); + // The setup engine persists the display root after scaffolding. Avoid an + // intermediate descriptor-root path escaping into CLI configuration. + return scaffoldStack(options, { persistStackRoot: async () => {} }); }, - async persistStackRoot(rootDir) { + async persistStackRoot(rootDir, signal) { // Mirror scaffoldStack's `configManager.setStackRoot` so the reuse path // records the root too. Best-effort: without a config there is nowhere to // persist it (tests run this way), so it is simply a no-op. + signal?.throwIfAborted(); await configManager?.setStackRoot(rootDir); }, readEnvVars, @@ -69,9 +85,12 @@ export function createDefaultActions(configManager?: ConfigManager): SetupAction assertSafeAgentCredentialDir(path); mkdirSync(path, { recursive: true, mode: 0o700 }); }, - async pullImages({ rootDir, agentTypes, onLog }) { + async pullImages({ rootDir, rootOperationsDir, assertRootAuthority, agentTypes, onLog, signal }) { + assertRootAuthority?.(); const { getHostConfig } = await import("../../orchestrator/index.js"); - const { orch, cfg } = await getHostConfig({ configManager, root: rootDir }); + assertRootAuthority?.(); + const { orch, cfg } = await getHostConfig({ configManager, root: rootDir, readRoot: rootOperationsDir }); + assertRootAuthority?.(); const selected = new Set(agentTypes); const result: PullImagesResult = { pulledCore: [], pulledAgents: [], failedCore: [], failedAgents: [] }; @@ -85,11 +104,18 @@ export function createDefaultActions(configManager?: ConfigManager): SetupAction onLog?.(`pulling ${tag}…`); // Async exec keeps the event loop free so the wizard's Ink spinner keeps // animating while the (often slow) pull runs, instead of freezing. - const pulled = await orch.dockerAsync(["pull", tag]); + signal?.throwIfAborted(); + assertRootAuthority?.(); + const pulled = await orch.dockerAsync(["pull", tag], { signal }); + assertRootAuthority?.(); + signal?.throwIfAborted(); if (pulled.status === 0) { try { - orch.tagAgentLatest(key, tag); - } catch { + await orch.tagAgentLatestAsync(key, tag, signal); + assertRootAuthority?.(); + } catch (error) { + rethrowCancellation(error); + assertRootAuthority?.(); /* best-effort local retag; the pull itself succeeded */ } (isAgent ? result.pulledAgents : result.pulledCore).push(tag); @@ -99,23 +125,43 @@ export function createDefaultActions(configManager?: ConfigManager): SetupAction } return result; }, - async isStackRunning(rootDir) { + async isStackRunning(rootDir, signal, root) { + root?.assertRootAuthority?.(); const { getHostConfig } = await import("../../orchestrator/index.js"); - const { orch, cfg } = await getHostConfig({ configManager, root: rootDir }); - return orch.isStackRunningAsync(cfg); + root?.assertRootAuthority?.(); + const { orch, cfg } = await getHostConfig({ configManager, root: rootDir, readRoot: root?.rootOperationsDir }); + root?.assertRootAuthority?.(); + const running = await orch.isStackRunningAsync(cfg, signal); + root?.assertRootAuthority?.(); + return running; }, - async startStack({ rootDir, ui, docs, onLog }) { + async startStack({ rootDir, rootOperationsDir, ui, docs, onLog, signal, assertRootAuthority }) { + signal?.throwIfAborted(); + assertRootAuthority?.(); const { getHostConfig } = await import("../../orchestrator/index.js"); - const { orch, cfg } = await getHostConfig({ configManager, root: rootDir }); + assertRootAuthority?.(); + const { orch, cfg } = await getHostConfig({ configManager, root: rootDir, readRoot: rootOperationsDir }); + assertRootAuthority?.(); + if (assertRootAuthority) { + assertStableDockerHandoff(rootDir); + assertRootAuthority(); + } // Pre-create the host Vibe prompt-cache dir owned by this user so Docker // does not auto-create it as root on first bind-mount — a root-owned dir // would fail the writability check and block future `propr start` runs. try { + assertRootAuthority?.(); const { ensureVibePromptCacheDir } = await import("../initStack.js"); + assertRootAuthority?.(); ensureVibePromptCacheDir(cfg.hostVibePromptCacheDir); - } catch { + assertRootAuthority?.(); + } catch (error) { + signal?.throwIfAborted(); + assertRootAuthority?.(); + rethrowCancellation(error); /* best-effort: startup validation will surface an actionable error */ } + assertRootAuthority?.(); const validation = orch.validateEnv(cfg); for (const warning of validation.warnings) onLog?.(`warning: ${warning}`); if (!validation.ok) { @@ -124,27 +170,39 @@ export function createDefaultActions(configManager?: ConfigManager): SetupAction // Use the async start path: `propr setup` drives this from behind a live // Ink TUI, so the blocking synchronous startStack would freeze the spinner // and swallow keystrokes for the seconds-to-minutes a cold start takes. - await orch.ensureNetworkAsync(cfg, onLog); + assertRootAuthority?.(); + await orch.ensureNetworkAsync(cfg, onLog, { signal, beforeMutation: assertRootAuthority }); + assertRootAuthority?.(); await orch.startStackAsync(cfg, { ui: ui ?? configManager?.getUiEnabled() ?? true, docs: docs ?? cfg.docsEnabled, onLog, + signal, + beforeLaunch: assertRootAuthority, }); }, - async checkBackendHealth({ rootDir, timeoutMs = 60_000 }) { + async checkBackendHealth({ rootDir, rootOperationsDir, assertRootAuthority, timeoutMs = 60_000, signal }) { + assertRootAuthority?.(); const { getSystemStatus } = await import("../../api/system.js"); - const client = await localApiClient(rootDir); + assertRootAuthority?.(); + const client = await localApiClient(rootDir, rootOperationsDir, assertRootAuthority); + assertRootAuthority?.(); const deadline = Date.now() + timeoutMs; let lastError = "no response"; // Containers take a few seconds to report healthy; poll until the deadline. do { + signal?.throwIfAborted(); try { - const status = await getSystemStatus(client); + assertRootAuthority?.(); + const status = await getSystemStatus(client, signal); + assertRootAuthority?.(); if (String(status.api).toLowerCase() === "healthy") { return { healthy: true, detail: `API healthy (daemon ${status.daemon}, worker ${status.worker})` }; } lastError = `API reports "${status.api}"`; } catch (error) { + rethrowCancellation(error); + assertRootAuthority?.(); // A 401/403 is not an unhealthy backend — the API answered but denied // this protected request. Return immediately so setup does not stall // on a running backend, while preserving whether remediation requires @@ -154,22 +212,34 @@ export function createDefaultActions(configManager?: ConfigManager): SetupAction lastError = (error as Error).message; } if (Date.now() >= deadline) break; - await sleep(2_000); + await new Promise((resolve, reject) => { + const timer = setTimeout(resolve, 2_000); + signal?.addEventListener("abort", () => { clearTimeout(timer); reject(signal.reason); }, { once: true }); + }); } while (Date.now() < deadline); return { healthy: false, detail: `backend not healthy within ${Math.round(timeoutMs / 1000)}s (${lastError})` }; }, - async addRepository({ fullName, alias, baseBranch }, rootDir) { + async addRepository({ fullName, alias, baseBranch }, rootDir, signal, root) { + root?.assertRootAuthority?.(); const { addRepo } = await import("../../api/repos.js"); // Point the client at this stack's API port rather than the saved remote. - const client = await localApiClient(rootDir); - await addRepo(fullName, { alias, baseBranch }, client); + root?.assertRootAuthority?.(); + const client = await localApiClient(rootDir, root?.rootOperationsDir, root?.assertRootAuthority); + root?.assertRootAuthority?.(); + await addRepo(fullName, { alias, baseBranch }, client, signal); + root?.assertRootAuthority?.(); }, - async resolveUiUrl(rootDir) { + async resolveUiUrl(rootDir, signal, root) { + signal?.throwIfAborted(); + root?.assertRootAuthority?.(); const { getHostConfig } = await import("../../orchestrator/index.js"); - const { cfg } = await getHostConfig({ configManager, root: rootDir }); + root?.assertRootAuthority?.(); + const { cfg } = await getHostConfig({ configManager, root: rootDir, readRoot: root?.rootOperationsDir }); + root?.assertRootAuthority?.(); + signal?.throwIfAborted(); return localhostServiceUrl(cfg.uiPort); }, - async openUrl(url) { + async openUrl(url, signal) { // Open in the host's default browser with the platform launcher. Detached // and unref'd so the wizard isn't held open by the child, with stdio // ignored so the launcher can't scribble over the TUI. @@ -178,40 +248,62 @@ export function createDefaultActions(configManager?: ConfigManager): SetupAction const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open"; const args = platform === "win32" ? ["/c", "start", "", url] : [url]; await new Promise((resolve, reject) => { - const child = spawn(command, args, { stdio: "ignore", detached: true }); + signal?.throwIfAborted(); + const child = spawn(command, args, { stdio: "ignore", detached: process.platform !== "win32" }); + let forceTimer: NodeJS.Timeout | undefined; + const terminate = (force = false) => { + if (!child.pid) return; + if (process.platform === "win32") { + const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", ...(force ? ["/F"] : [])], { stdio: "ignore" }); + killer.unref(); + } else { + try { process.kill(-child.pid, force ? "SIGKILL" : "SIGTERM"); } catch { child.kill(force ? "SIGKILL" : "SIGTERM"); } + } + }; + const abort = () => { + terminate(); + forceTimer = setTimeout(() => { terminate(true); reject(signal?.reason); }, 2_000); + }; + signal?.addEventListener("abort", abort, { once: true }); child.once("error", reject); - // The launcher returns immediately; once it has spawned we're done. - child.once("spawn", () => { - child.unref(); - resolve(); + child.once("close", code => { + if (forceTimer) clearTimeout(forceTimer); + signal?.removeEventListener("abort", abort); + if (signal?.aborted) reject(signal.reason); + else if (code === 0) resolve(); + else reject(new Error(`browser launcher exited with code ${code ?? "?"}`)); }); }); }, - async saveWhitelistSetting(rootDir, users) { + async saveWhitelistSetting(rootDir, users, signal, root) { + root?.assertRootAuthority?.(); const { updateSetting } = await import("../../api/settings.js"); // Point the client at this stack's API port rather than the saved remote. - const client = await localApiClient(rootDir); - await updateSetting("github_user_whitelist", users, client); + root?.assertRootAuthority?.(); + const client = await localApiClient(rootDir, root?.rootOperationsDir, root?.assertRootAuthority); + root?.assertRootAuthority?.(); + await updateSetting("github_user_whitelist", users, client, signal); + root?.assertRootAuthority?.(); }, hasGithubToken() { return Boolean(configManager?.getGithubToken()); }, - async fetchRelayInstallations({ relayUrl }) { + async fetchRelayInstallations({ relayUrl, signal }) { const { fetchAuthenticatedUser } = await import("../../api/relay.js"); - const me = await fetchAuthenticatedUser(relayClient(relayUrl)); + const me = await fetchAuthenticatedUser(relayClient(relayUrl, signal)); return { username: me.username, installations: me.installations }; }, - async enrollRelay({ relayUrl, installationId, label }) { + async enrollRelay({ relayUrl, installationId, label, signal }) { const { enrollRelayToken } = await import("../../api/relay.js"); - const client = relayClient(relayUrl); + const client = relayClient(relayUrl, signal); // Default the token label to the hostname, mirroring `propr relay enroll`. const result = await enrollRelayToken(client, { installationId, label: label ?? hostname() }); return { relayUrl: client.baseUrl, token: result.token }; }, - async loginWithGithub({ onLog } = {}) { + async loginWithGithub({ onLog, signal } = {}) { if (!configManager) return false; const { loginWithGithubCli } = await import("../../auth/githubLogin.js"); - const result = await loginWithGithubCli(configManager, { interactive: true, onLog }); + const result = await loginWithGithubCli(configManager, { interactive: true, onLog, signal }); if (!result.ok) onLog?.(result.message); return result.ok; }, @@ -224,12 +316,12 @@ export function createDefaultActions(configManager?: ConfigManager): SetupAction * Build a relay client bound to the stored GitHub token. The hosted relay is * the default base URL; an explicit `relayUrl` (self-hosted) overrides it. */ - function relayClient(relayUrl?: string): RelayClientOptions { + function relayClient(relayUrl?: string, signal?: AbortSignal): RelayClientOptions { const githubToken = configManager?.getGithubToken(); if (!githubToken) { throw new Error("Not logged in to GitHub. Run `propr login` first."); } - return { baseUrl: relayUrl ?? DEFAULT_PROPR_GH_RELAY_URL, githubToken }; + return { baseUrl: relayUrl ?? DEFAULT_PROPR_GH_RELAY_URL, githubToken, signal }; } } diff --git a/packages/cli/src/commands/setupCommand.test.ts b/packages/cli/src/commands/setupCommand.test.ts index aa4581fe9..a5bf83eff 100644 --- a/packages/cli/src/commands/setupCommand.test.ts +++ b/packages/cli/src/commands/setupCommand.test.ts @@ -141,11 +141,12 @@ test("--no-skill conflicts with --install-skill", async () => { }); for (const platform of ["darwin", "win32"] as const) { - test(`setup reaches the agent-skill and engine flow on ${platform}`, { concurrency: false }, async () => { + test(`setup rejects ${platform} before agent-skill, config, or engine actions`, { concurrency: false }, async () => { const originalPlatform = Object.getOwnPropertyDescriptor(process, "platform")!; Object.defineProperty(process, "platform", { ...originalPlatform, value: platform }); const offeredTargets: Array = []; let sequentialRuns = 0; + let configLoads = 0; const exitCodes: number[] = []; try { @@ -154,7 +155,7 @@ for (const platform of ["darwin", "win32"] as const) { offeredTargets.push(options?.explicitTargets); return []; }, - createConfig: async () => ({} as never), + createConfig: async () => { configLoads += 1; return {} as never; }, runSequential: async () => { sequentialRuns += 1; return { completed: true } as never; @@ -164,9 +165,10 @@ for (const platform of ["darwin", "win32"] as const) { await command.parseAsync(["node", "propr", "--no-tui", "--install-skill", "codex"]); - assert.deepEqual(offeredTargets, ["codex"]); - assert.equal(sequentialRuns, 1); - assert.deepEqual(exitCodes, [0]); + assert.deepEqual(offeredTargets, []); + assert.equal(configLoads, 0); + assert.equal(sequentialRuns, 0); + assert.deepEqual(exitCodes, [1]); } finally { Object.defineProperty(process, "platform", originalPlatform); } diff --git a/packages/cli/src/commands/setupCommand.ts b/packages/cli/src/commands/setupCommand.ts index f0e4f2804..207691459 100644 --- a/packages/cli/src/commands/setupCommand.ts +++ b/packages/cli/src/commands/setupCommand.ts @@ -223,6 +223,9 @@ cannot prompt and exits with guidance — scaffold non-interactively instead wit `) .action(async (options: SetupCommandOptions) => { try { + if (process.platform !== "linux") { + throw new Error(`Local setup is not supported on ${process.platform}; use a remote ProPR deployment.`); + } let skillReadline: ReturnType | undefined; const canPromptForSkill = Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY); await (dependencies.offerAgentSkill ?? offerSetupAgentSkill)({ diff --git a/packages/cli/src/config/ConfigManager.test.ts b/packages/cli/src/config/ConfigManager.test.ts index 662712804..fb81ccffc 100644 --- a/packages/cli/src/config/ConfigManager.test.ts +++ b/packages/cli/src/config/ConfigManager.test.ts @@ -162,6 +162,33 @@ test("setGithubToken preserves unrelated active profile values", async () => { } }); +test("an abort at successful profile-save resolution keeps memory and disk committed", async () => { + const tempDir = createTempDir(); + const controller = new AbortController(); + class AbortAtSaveResolutionConfigManager extends ConfigManager { + override async save(signal?: AbortSignal): Promise { + await super.save(signal); + controller.abort(new Error("abort after atomic save")); + } + } + + try { + writeProfileConfig(tempDir); + const manager = new AbortAtSaveResolutionConfigManager(tempDir); + await manager.init(); + + await manager.setGithubToken("committed-token", controller.signal); + + assert.equal(controller.signal.aborted, true); + assert.equal(manager.getGithubToken(), "committed-token"); + const persisted = JSON.parse(readFileSync(join(tempDir, "config.json"), "utf8")); + assert.equal(persisted.profiles.default.githubToken, "committed-token"); + assert.deepEqual(manager.getRemoteProfiles(), persisted.profiles); + } finally { + cleanupTempDir(tempDir); + } +}); + test("setRemoteUrl preserves unrelated active profile values", async () => { const tempDir = createTempDir(); try { diff --git a/packages/cli/src/config/ConfigManager.ts b/packages/cli/src/config/ConfigManager.ts index c6a79439a..983e732c7 100644 --- a/packages/cli/src/config/ConfigManager.ts +++ b/packages/cli/src/config/ConfigManager.ts @@ -257,15 +257,24 @@ export class ConfigManager { return this.getActiveProfile()[key]; } - private async updateActiveProfile(patch: Partial): Promise { + private async updateActiveProfile(patch: Partial, signal?: AbortSignal): Promise { + signal?.throwIfAborted(); const name = this.getActiveProfileName(); - const profiles = { ...(this.config.profiles ?? {}) }; + const previousProfiles = this.config.profiles; + const profiles = { ...(previousProfiles ?? {}) }; profiles[name] = { ...(profiles[name] ?? {}), ...patch, }; this.config.profiles = profiles; - await this.save(); + try { + await this.save(signal); + // A resolved atomic save is the commit point. Do not observe cancellation + // again here: disk and memory must remain on the same committed profile. + } catch (error) { + this.config.profiles = previousProfiles; + throw error; + } } /** @@ -273,8 +282,10 @@ export class ConfigManager { * * @returns A promise that resolves when the configuration is saved. */ - async save(): Promise { + async save(signal?: AbortSignal): Promise { + signal?.throwIfAborted(); ensurePrivateDirectory(this.configDir); + signal?.throwIfAborted(); // Only write non-undefined values const dataToWrite: Record = {}; @@ -285,7 +296,9 @@ export class ConfigManager { } const content = JSON.stringify(dataToWrite, null, 2); - writePrivateFileAtomic(this.configFilePath, content); + // writePrivateFileAtomic observes cancellation immediately before rename. + // Once it returns successfully, the new configuration is committed. + writePrivateFileAtomic(this.configFilePath, content, { signal }); } /** @@ -340,8 +353,9 @@ export class ConfigManager { * @param token - The GitHub token to set. * @returns A promise that resolves when the token is saved. */ - async setGithubToken(token: string): Promise { - await this.updateActiveProfile({ githubToken: token }); + async setGithubToken(token: string, signal?: AbortSignal): Promise { + signal?.throwIfAborted(); + await this.updateActiveProfile({ githubToken: token }, signal); } /** diff --git a/packages/cli/src/orchestrator/index.ts b/packages/cli/src/orchestrator/index.ts index 5d1a9b86a..4d540e9cb 100644 --- a/packages/cli/src/orchestrator/index.ts +++ b/packages/cli/src/orchestrator/index.ts @@ -9,7 +9,7 @@ import { existsSync } from "node:fs"; import { fileURLToPath, pathToFileURL } from "node:url"; -import { dirname, join, resolve } from "node:path"; +import { dirname, isAbsolute, join, resolve } from "node:path"; import type { OrchestratorConfig, OrchestratorModule } from "./types.js"; import type { ConfigManager } from "../config/index.js"; @@ -24,6 +24,14 @@ export type { let cached: OrchestratorModule | undefined; let cachedPath: string | undefined; +let configuredAssetPath: string | undefined; + +/** Configure an application-packaged launcher asset before the first load. */ +export function configureOrchestratorAssetPath(path: string): void { + if (!isAbsolute(path) || !existsSync(path)) throw new Error("The configured orchestrator asset path is invalid"); + if (cached && cachedPath !== path) throw new Error("The orchestrator is already loaded from another path"); + configuredAssetPath = path; +} /** * Candidate locations for orchestrator.mjs, in priority order: @@ -31,6 +39,7 @@ let cachedPath: string | undefined; * 2. Bundled next to this module in dist. */ function resolveOrchestratorPath(): string { + if (configuredAssetPath) return configuredAssetPath; const here = dirname(fileURLToPath(import.meta.url)); const bundled = join(here, "orchestrator.mjs"); @@ -106,6 +115,7 @@ export function resolveStackRoot( export async function getHostConfig(opts: { configManager?: ConfigManager; root?: string; + readRoot?: string; }): Promise<{ orch: OrchestratorModule; cfg: OrchestratorConfig; rootDir: string }> { const orch = await loadOrchestrator(); const rootDir = resolveStackRoot(opts.configManager, opts.root); @@ -127,6 +137,6 @@ export async function getHostConfig(opts: { cliOverrides.uiTunnelEnabled = tunnelExplicit; } } - const cfg = orch.resolveHostConfig({ rootDir, env: process.env, manifestPath, cliOverrides }); + const cfg = orch.resolveHostConfig({ rootDir, readRootDir: opts.readRoot, env: process.env, manifestPath, cliOverrides }); return { orch, cfg, rootDir }; } diff --git a/packages/cli/src/orchestrator/types.ts b/packages/cli/src/orchestrator/types.ts index 2a1160d7c..36757fca5 100644 --- a/packages/cli/src/orchestrator/types.ts +++ b/packages/cli/src/orchestrator/types.ts @@ -122,12 +122,15 @@ export interface DockerCommandResult { status: number | null; stdout: string; stderr: string; + stdoutTruncated?: boolean; + stderrTruncated?: boolean; error?: Error & { code?: string }; signal?: NodeJS.Signals | null; } export interface ResolveHostConfigOptions { rootDir?: string; + readRootDir?: string; env?: NodeJS.ProcessEnv; manifestPath?: string; cliOverrides?: Record; @@ -149,10 +152,11 @@ export interface OrchestratorModule { dockerAvailable(): boolean; inspectImageFreshness(tag: string, opts?: { skipRemoteCheck?: boolean }): ImageFreshnessResult; - inspectImageFreshnessAsync(tag: string, opts?: { skipRemoteCheck?: boolean }): Promise; + inspectImageFreshnessAsync(tag: string, opts?: { skipRemoteCheck?: boolean; signal?: AbortSignal }): Promise; tagAgentLatest(key: string, imageTag: string): void; + tagAgentLatestAsync(key: string, imageTag: string, signal?: AbortSignal): Promise; ensureNetwork(cfg: OrchestratorConfig, onLog?: (line: string) => void): void; - ensureNetworkAsync(cfg: OrchestratorConfig, onLog?: (line: string) => void): Promise; + ensureNetworkAsync(cfg: OrchestratorConfig, onLog?: (line: string) => void, opts?: { signal?: AbortSignal; beforeMutation?: () => void }): Promise; ensureServiceImage( cfg: OrchestratorConfig, service: string, @@ -169,7 +173,10 @@ export interface OrchestratorModule { readonly TOGGLE_SERVICES: readonly string[]; isStackRunning(cfg: OrchestratorConfig): boolean; - isStackRunningAsync(cfg: OrchestratorConfig): Promise; + isStackRunningAsync(cfg: OrchestratorConfig, signal?: AbortSignal): Promise; + isLifecycleStackRunningAsync(cfg: OrchestratorConfig, opts?: { signal?: AbortSignal; assertRootAuthority?: () => void }): Promise; + recoverStackAsync(cfg: OrchestratorConfig, opts?: { ui?: boolean; docs?: boolean; tunnel?: boolean; signal?: AbortSignal; onLog?: (line: string) => void; assertRootAuthority?: () => void }): Promise<{ recovered: boolean }>; + stopLifecycleStackAsync(cfg: OrchestratorConfig, opts?: { signal?: AbortSignal; onLog?: (line: string) => void; assertRootAuthority?: () => void }): Promise<{ failed: string[] }>; startService(cfg: OrchestratorConfig, service: string, opts?: OnLogOption): ServiceState | undefined; startServiceAsync(cfg: OrchestratorConfig, service: string, opts?: OnLogOption): Promise; @@ -188,7 +195,7 @@ export interface OrchestratorModule { ): StackStatus; startStackAsync( cfg: OrchestratorConfig, - opts?: { ui?: boolean; docs?: boolean; tunnel?: boolean; onLog?: (line: string) => void } + opts?: { ui?: boolean; docs?: boolean; tunnel?: boolean; onLog?: (line: string) => void; signal?: AbortSignal; beforeLaunch?: () => void } ): Promise; stopStack( cfg: OrchestratorConfig, @@ -209,5 +216,5 @@ export interface OrchestratorModule { containerExists(cfg: OrchestratorConfig, name: string): boolean; docker(args: string[], opts?: DockerCommandOptions): DockerCommandResult; - dockerAsync(args: string[], opts?: { timeout?: number }): Promise; + dockerAsync(args: string[], opts?: { timeout?: number; signal?: AbortSignal; maxOutputBytes?: number }): Promise; } diff --git a/packages/cli/src/utils/envFile.ts b/packages/cli/src/utils/envFile.ts index 963504b14..af8650ef7 100644 --- a/packages/cli/src/utils/envFile.ts +++ b/packages/cli/src/utils/envFile.ts @@ -9,7 +9,7 @@ * literally and must fit on one line. */ -import { chmodSync, existsSync, readFileSync, statSync, writeFileSync } from "node:fs"; +import { readPrivateFile, writePrivateFileAtomic } from "@propr/local-setup"; function escapeRegExp(value: string): string { return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); @@ -30,7 +30,8 @@ export function upsertEnvVars(envPath: string, vars: Record): vo } } - const raw = existsSync(envPath) ? readFileSync(envPath, "utf-8") : ""; + const previous = readPrivateFile(envPath); + const raw = previous?.toString("utf-8") ?? ""; const lines = raw.split(/\r?\n/); // Drop trailing blank lines so appends stay tidy; we re-add one newline at the end. @@ -50,24 +51,7 @@ export function upsertEnvVars(envPath: string, vars: Record): vo } } - const isNew = !existsSync(envPath); - let tightenedFrom: number | null = null; - if (!isNew) { - try { - const before = statSync(envPath).mode & 0o777; - if (before !== 0o600) { - chmodSync(envPath, 0o600); - tightenedFrom = before; - } - } catch { - // Best-effort — may fail on Windows or non-owned files. - } - } - - writeFileSync(envPath, `${lines.join("\n")}\n`, { encoding: "utf-8", mode: isNew ? 0o600 : undefined }); - if (tightenedFrom !== null) { - console.warn(`Note: tightened ${envPath} permissions from ${tightenedFrom.toString(8)} to 600 (secrets file).`); - } + writePrivateFileAtomic(envPath, `${lines.join("\n")}\n`); } /** @@ -87,31 +71,18 @@ export function upsertEnvVars(envPath: string, vars: Record): vo * the next read or restart. */ export function clearEnvKeys(envPath: string, keys: string[]): void { - if (keys.length === 0 || !existsSync(envPath)) return; + if (keys.length === 0) return; - const lines = readFileSync(envPath, "utf-8").split(/\r?\n/); + const previous = readPrivateFile(envPath); + if (!previous) return; + const lines = previous.toString("utf-8").split(/\r?\n/); const patterns = keys.map((key) => new RegExp(`^\\s*(export\\s+)?${escapeRegExp(key)}\\s*=`)); const kept = lines.filter((line) => !patterns.some((pattern) => pattern.test(line))); // Nothing matched → leave the file (and its mode) untouched. if (kept.length === lines.length) return; - // Tighten permissions like upsertEnvVars does — this is still the secrets file. - let tightenedFrom: number | null = null; - try { - const before = statSync(envPath).mode & 0o777; - if (before !== 0o600) { - chmodSync(envPath, 0o600); - tightenedFrom = before; - } - } catch { - // Best-effort — may fail on Windows or non-owned files. - } - // Drop trailing blank lines, then re-add exactly one terminating newline. while (kept.length > 0 && kept[kept.length - 1] === "") kept.pop(); - writeFileSync(envPath, `${kept.join("\n")}\n`, "utf-8"); - if (tightenedFrom !== null) { - console.warn(`Note: tightened ${envPath} permissions from ${tightenedFrom.toString(8)} to 600 (secrets file).`); - } + writePrivateFileAtomic(envPath, `${kept.join("\n")}\n`); } diff --git a/packages/cli/src/utils/privateFilesystem.ts b/packages/cli/src/utils/privateFilesystem.ts index e1dd10146..fecbf89c0 100644 --- a/packages/cli/src/utils/privateFilesystem.ts +++ b/packages/cli/src/utils/privateFilesystem.ts @@ -1,92 +1,9 @@ -import { - chmodSync, - closeSync, - fsyncSync, - lstatSync, - mkdirSync, - openSync, - renameSync, - unlinkSync, - writeFileSync, -} from "node:fs"; -import type { Stats } from "node:fs"; -import { randomUUID } from "node:crypto"; -import { dirname } from "node:path"; - -export const PRIVATE_DIRECTORY_MODE = 0o700; -export const PRIVATE_FILE_MODE = 0o600; - -function lstatIfPresent(targetPath: string): Stats | undefined { - try { - return lstatSync(targetPath); - } catch (error) { - if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined; - throw error; - } -} - -function assertOwned(stat: Stats, targetPath: string): void { - if (process.platform === "win32") return; - const currentUid = process.getuid?.(); - if (currentUid !== undefined && stat.uid !== currentUid) { - throw new Error(`Refusing to use ${targetPath}: it is not owned by the current user`); - } -} - -export function secureExistingPrivateDirectory(directoryPath: string): boolean { - const stat = lstatIfPresent(directoryPath); - if (!stat) return false; - if (stat.isSymbolicLink()) throw new Error(`Refusing to use symbolic-link directory ${directoryPath}`); - if (!stat.isDirectory()) throw new Error(`Expected a directory at ${directoryPath}`); - assertOwned(stat, directoryPath); - if (process.platform !== "win32" && (stat.mode & 0o777) !== PRIVATE_DIRECTORY_MODE) { - chmodSync(directoryPath, PRIVATE_DIRECTORY_MODE); - } - return true; -} - -export function ensurePrivateDirectory(directoryPath: string): void { - if (!lstatIfPresent(directoryPath)) { - mkdirSync(directoryPath, { recursive: true, mode: PRIVATE_DIRECTORY_MODE }); - } - secureExistingPrivateDirectory(directoryPath); -} - -export function secureExistingPrivateFile(filePath: string): boolean { - const stat = lstatIfPresent(filePath); - if (!stat) return false; - if (stat.isSymbolicLink()) throw new Error(`Refusing to use symbolic-link file ${filePath}`); - if (!stat.isFile()) throw new Error(`Expected a regular file at ${filePath}`); - assertOwned(stat, filePath); - if (process.platform !== "win32" && (stat.mode & 0o777) !== PRIVATE_FILE_MODE) { - chmodSync(filePath, PRIVATE_FILE_MODE); - } - return true; -} - -export interface PrivateFileWriteOptions { - secureParent?: boolean; -} - -export function writePrivateFileAtomic( - filePath: string, - content: string | Buffer, - options: PrivateFileWriteOptions = {}, -): void { - if (options.secureParent !== false) ensurePrivateDirectory(dirname(filePath)); - secureExistingPrivateFile(filePath); - const tempPath = `${filePath}.tmp-${process.pid}-${randomUUID()}`; - let descriptor: number | undefined; - try { - descriptor = openSync(tempPath, "wx", PRIVATE_FILE_MODE); - writeFileSync(descriptor, content); - fsyncSync(descriptor); - closeSync(descriptor); - descriptor = undefined; - renameSync(tempPath, filePath); - if (process.platform !== "win32") chmodSync(filePath, PRIVATE_FILE_MODE); - } finally { - if (descriptor !== undefined) closeSync(descriptor); - try { unlinkSync(tempPath); } catch { /* Best-effort cleanup after success or failure. */ } - } -} +export { + PRIVATE_DIRECTORY_MODE, + PRIVATE_FILE_MODE, + ensurePrivateDirectory, + secureExistingPrivateDirectory, + secureExistingPrivateFile, + writePrivateFileAtomic, + type PrivateFileWriteOptions, +} from "@propr/local-setup"; diff --git a/packages/client/src/baseUrl.ts b/packages/client/src/baseUrl.ts index e32444fe7..d7e4ec70c 100644 --- a/packages/client/src/baseUrl.ts +++ b/packages/client/src/baseUrl.ts @@ -1,4 +1,5 @@ import { ProprClientError } from './errors.js'; +import { normalizeProprApiOrigin } from '@propr/shared'; declare const normalizedApiBaseUrl: unique symbol; @@ -10,15 +11,6 @@ export interface NormalizeApiBaseUrlOptions { allowInsecureHttp?: boolean; } -const isLoopbackHostname = (hostname: string): boolean => { - const normalized = hostname.toLowerCase().replace(/\.$/, ''); - if (normalized === 'localhost' || normalized.endsWith('.localhost') || normalized === '[::1]') return true; - const parts = normalized.split('.'); - return parts.length === 4 - && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255) - && Number(parts[0]) === 127; -}; - const configurationError = (message: string): never => { throw new ProprClientError(message, { kind: 'configuration' }); }; @@ -31,34 +23,13 @@ export const normalizeApiBaseUrl = ( const candidate = value?.trim() ?? ''; if (!candidate) return '' as ProprApiBaseUrl; - let parsed: URL; - try { - parsed = new URL(candidate); - } catch { - return configurationError('The ProPR API URL must be an absolute HTTP(S) URL.'); - } - - if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') { - return configurationError('The ProPR API URL must use HTTP or HTTPS.'); - } - if (parsed.username || parsed.password) { - return configurationError('The ProPR API URL must not contain embedded credentials.'); + const normalized = normalizeProprApiOrigin(candidate, { + allowInsecureHttp: options.allowInsecureHttp, + }); + if (!normalized) { + return configurationError('The ProPR API URL must be a canonical HTTPS origin, or a supported HTTP loopback origin.'); } - if (parsed.search || parsed.hash) { - return configurationError('The ProPR API URL must not contain a query string or fragment.'); - } - if (parsed.pathname.replace(/\//g, '') !== '') { - return configurationError('The ProPR API URL must be an origin without a path.'); - } - if ( - parsed.protocol === 'http:' - && !isLoopbackHostname(parsed.hostname) - && options.allowInsecureHttp !== true - ) { - return configurationError('Plain HTTP is only allowed for loopback ProPR API URLs.'); - } - - return parsed.origin as ProprApiBaseUrl; + return normalized as ProprApiBaseUrl; }; export const apiUrl = (baseUrl: ProprApiBaseUrl, path: string): string => { diff --git a/packages/client/src/client.ts b/packages/client/src/client.ts index 9458f36fc..b60f013d4 100644 --- a/packages/client/src/client.ts +++ b/packages/client/src/client.ts @@ -17,12 +17,29 @@ import { type ProprSocketOptions, type Socket, } from './socket.js'; +import { + completeDesktopPairing, + parseDesktopDiscovery, + parseDesktopPairingStart, + parseDesktopPairingActivationReceipt, + type ProprDesktopDiscovery, + type ProprDesktopPairingComplete, + type ProprDesktopPairingActivationReceipt, + type ProprDesktopPairingOptions, + type ProprDesktopPairingStart, +} from './desktopPairing.js'; +import { + requestPairingProtocol, + type PairingProtocolRequestOptions, +} from './pairingProtocol.js'; export interface ProprClientOptions extends NormalizeApiBaseUrlOptions { baseUrl?: string | null; authentication?: ProprAuthentication; defaultTimeoutMs?: number; fetch?: typeof globalThis.fetch; + /** @internal Deterministic response-lifecycle proof; production uses fixed protocol defaults. */ + pairingProtocol?: PairingProtocolRequestOptions; } export interface ProprFetchOptions { @@ -75,6 +92,7 @@ export class ProprClient { readonly defaultTimeoutMs: number; private readonly fetchImplementation: typeof globalThis.fetch; + private readonly pairingProtocolOptions: PairingProtocolRequestOptions; constructor(options: ProprClientOptions = {}) { this.baseUrl = normalizeApiBaseUrl(options.baseUrl, options); @@ -82,6 +100,7 @@ export class ProprClient { this.defaultTimeoutMs = options.defaultTimeoutMs ?? 0; assertTimeout(this.defaultTimeoutMs); this.fetchImplementation = options.fetch ?? ((input, init) => globalThis.fetch(input, init)); + this.pairingProtocolOptions = options.pairingProtocol ?? {}; } url(path: string): string { @@ -213,6 +232,124 @@ export class ProprClient { return result; } + async discoverDesktop(timeoutMs = 8000, signal?: AbortSignal): Promise { + const metadata = await this.request('/api/desktop/discovery', { + cache: 'no-store', + signal, + }, { timeoutMs }); + const compatibility = evaluateProprApiCompatibility( + metadata && typeof metadata === 'object' + ? metadata as Partial + : {}, + ); + return parseDesktopDiscovery(metadata, compatibility); + } + + async startDesktopPairing( + clientName: string, + options: Pick, + ): Promise { + const path = '/api/desktop/pairings'; + const expectedOrigin = this.resolveRequestOrigin(this.url(path)); + return parseDesktopPairingStart(await this.requestDesktopPairing(path, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ clientName, ...options.binding }), + redirect: 'manual', + signal: options.signal, + }), expectedOrigin, options.now); + } + + async pairDesktop( + clientName: string, + options: ProprDesktopPairingOptions, + ): Promise { + const start = await this.startDesktopPairing(clientName, options); + return completeDesktopPairing(this, start, options); + } + + async activateDesktopPairing( + pairing: ProprDesktopPairingComplete, + signal?: AbortSignal, + ): Promise { + return parseDesktopPairingActivationReceipt(await this.requestDesktopPairing( + `/api/desktop/pairings/${encodeURIComponent(pairing.pairingId)}/activate`, + { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ + deviceSecret: pairing.deviceSecret, + activationTicket: pairing.activationTicket, + instanceId: pairing.instanceId, + origin: pairing.origin, + scope: pairing.scope, + credentialGeneration: pairing.credentialGeneration, + }), + redirect: 'manual', + signal, + }, + )); + } + + async cancelDesktopPairing( + pairing: ProprDesktopPairingComplete, + signal?: AbortSignal, + ): Promise<{ status: 'cancelled'; cancelledAt: string }> { + const value = await this.requestDesktopPairing( + `/api/desktop/pairings/${encodeURIComponent(pairing.pairingId)}/cancel`, + { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ + deviceSecret: pairing.deviceSecret, + activationTicket: pairing.activationTicket, + instanceId: pairing.instanceId, + origin: pairing.origin, + scope: pairing.scope, + credentialGeneration: pairing.credentialGeneration, + }), + redirect: 'manual', + signal, + }, + ); + if (!value || typeof value !== 'object' || Array.isArray(value)) { + throw new ProprClientError('The ProPR instance returned an invalid pairing cancellation receipt.', { + kind: 'invalid_response', + }); + } + const receipt = value as Record; + if (receipt.status !== 'cancelled' || typeof receipt.cancelledAt !== 'string' + || !Number.isFinite(Date.parse(receipt.cancelledAt)) + || Object.keys(receipt).some(key => !['status', 'cancelledAt'].includes(key))) { + throw new ProprClientError('The ProPR instance returned an invalid pairing cancellation receipt.', { + kind: 'invalid_response', + }); + } + return receipt as unknown as { status: 'cancelled'; cancelledAt: string }; + } + + /** @internal Pairing keeps transport ownership through the complete body. */ + async requestDesktopPairing( + path: string, + init: RequestInit, + overallTimeoutMs?: number, + ): Promise { + const target = this.resolveRequestTarget(this.url(path)); + const authentication = this.authenticate(init); + const authenticatedInit = authentication instanceof Promise + ? await authentication + : authentication; + return requestPairingProtocol( + this.fetchImplementation, + target, + authenticatedInit ?? {}, + { + ...this.pairingProtocolOptions, + overallTimeoutMs: overallTimeoutMs ?? this.pairingProtocolOptions.overallTimeoutMs, + }, + ); + } + connectSocket(options: ProprSocketOptions = {}): Socket { return connectProprSocket(buildSocketConnection(this.baseUrl, this.authentication, options)); } @@ -246,6 +383,22 @@ export class ProprClient { return input; } + private resolveRequestOrigin(input: RequestInfo | URL): string { + const raw = input instanceof Request ? input.url : input.toString(); + const browserOrigin = typeof globalThis.location !== 'undefined' + ? globalThis.location.origin + : undefined; + try { + const origin = new URL(raw, browserOrigin).origin; + if (origin === 'null') throw new Error(); + return origin; + } catch { + throw new ProprClientError('The ProPR instance origin could not be established.', { + kind: 'configuration', + }); + } + } + private authenticate(init?: RequestInit): RequestInit | undefined | Promise { if (this.authentication.type === 'none') return init; if (this.authentication.type === 'session') { @@ -276,6 +429,8 @@ export class ProprClient { } headers.set('Authorization', `Bearer ${token}`); } - return { ...init, headers }; + // Bearer profiles must never accidentally inherit a browser/Electron cookie + // identity from another named profile on the same origin. + return { ...init, credentials: 'omit', headers }; } } diff --git a/packages/client/src/desktopPairing.ts b/packages/client/src/desktopPairing.ts new file mode 100644 index 000000000..b799870ac --- /dev/null +++ b/packages/client/src/desktopPairing.ts @@ -0,0 +1,363 @@ +import type { + ProprApiCompatibilityResult, + ProprDesktopAuthenticationCapabilities, +} from '@propr/shared'; +import { canonicalProprHttpUrlOrigin } from '@propr/shared'; +import type { ProprClient } from './client.js'; +import { ProprClientError } from './errors.js'; + +export interface ProprDesktopDiscovery { + product: string; + version: string; + apiCompatibility: string; + uiCompatibility: string; + desktopAuthentication: ProprDesktopAuthenticationCapabilities; + compatibility: ProprApiCompatibilityResult; +} + +export interface ProprDesktopPairingStart { + pairingId: string; + deviceSecret: string; + approvalUrl: string; + expiresAt: string; + interval: number; +} + +export interface ProprDesktopPairingComplete { + token: string; + tokenType: 'Bearer'; + pairingId: string; + deviceSecret: string; + activationTicket: string; + activationExpiresAt: string; + instanceId: string; + origin: string; + scope: 'desktop-instance'; + credentialGeneration: string; +} + +export interface ProprDesktopPairingBinding { + instanceId: string; + origin: string; + scope: 'desktop-instance'; + credentialGeneration: string; +} + +export interface ProprDesktopPairingActivationReceipt { + status: 'active'; + receipt: string; + activatedAt: string; + expiresAt: string | null; +} + +export interface ProprDesktopPairingOptions { + signal?: AbortSignal; + binding: ProprDesktopPairingBinding; + onApprovalRequired?(approvalUrl: string, expiresAt: string): void | Promise; + /** Injectable only to make protocol tests deterministic. */ + sleep?: (milliseconds: number, signal?: AbortSignal) => Promise; + /** Injectable only to make expiry tests deterministic. */ + now?: () => number; +} + +const MIN_POLL_INTERVAL_SECONDS = 1; +const MAX_POLL_INTERVAL_SECONDS = 60; +const MAX_PAIRING_LIFETIME_MS = 30 * 60 * 1000; +const PAIRING_REQUEST_TIMEOUT_MS = 8_000; +const exactKeys = (body: Record, keys: readonly string[]): boolean => + Object.keys(body).length === keys.length && Object.keys(body).every(key => keys.includes(key)); + +const record = (value: unknown): Record => { + if (!value || typeof value !== 'object' || Array.isArray(value)) { + throw new ProprClientError('The ProPR desktop protocol returned an invalid response.', { + kind: 'invalid_response', + }); + } + return value as Record; +}; + +const string = (value: unknown): value is string => typeof value === 'string' && value.length > 0; +const validPollInterval = (value: unknown): value is number => typeof value === 'number' + && Number.isInteger(value) + && value >= MIN_POLL_INTERVAL_SECONDS + && value <= MAX_POLL_INTERVAL_SECONDS; + +const validPairingDeadline = (value: unknown, now: number): value is string => { + if (!string(value)) return false; + const deadline = Date.parse(value); + return Number.isFinite(deadline) + && Number.isFinite(now) + && deadline > now + && deadline - now <= MAX_PAIRING_LIFETIME_MS; +}; + +const validBinding = (value: unknown): value is ProprDesktopPairingBinding => { + if (!value || typeof value !== 'object' || Array.isArray(value)) return false; + const binding = value as Record; + return typeof binding.instanceId === 'string' + && /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(binding.instanceId) + && typeof binding.origin === 'string' + && canonicalProprHttpUrlOrigin(binding.origin) === binding.origin + && binding.scope === 'desktop-instance' + && typeof binding.credentialGeneration === 'string' + && /^[A-Za-z0-9_-]{22}$/.test(binding.credentialGeneration); +}; + +const validCapabilities = (value: unknown): value is ProprDesktopAuthenticationCapabilities => { + if (!value || typeof value !== 'object') return false; + const capabilities = value as Record; + return capabilities.protocolVersion === 2 + && typeof capabilities.browserPairing === 'boolean' + && typeof capabilities.instanceBearerTokens === 'boolean' + && typeof capabilities.socketIoBearerAuthentication === 'boolean'; +}; + +export const parseDesktopDiscovery = ( + value: unknown, + compatibility: ProprApiCompatibilityResult, +): ProprDesktopDiscovery => { + const body = record(value); + if (body.product !== 'ProPR' || !string(body.version) || !string(body.apiCompatibility) + || !string(body.uiCompatibility) || !validCapabilities(body.desktopAuthentication)) { + throw new ProprClientError('The ProPR instance returned invalid desktop discovery metadata.', { + kind: 'invalid_response', + }); + } + return { + product: body.product, + version: body.version, + apiCompatibility: body.apiCompatibility, + uiCompatibility: body.uiCompatibility, + desktopAuthentication: body.desktopAuthentication, + compatibility, + }; +}; + +export const parseDesktopPairingStart = ( + value: unknown, + expectedOrigin: string, + now: () => number = Date.now, +): ProprDesktopPairingStart => { + const body = record(value); + if (!exactKeys(body, ['pairingId', 'deviceSecret', 'approvalUrl', 'expiresAt', 'interval']) + || !string(body.pairingId) || !/^dpr_[A-Za-z0-9_-]{22}$/.test(body.pairingId) + || !string(body.deviceSecret) || !/^[A-Za-z0-9_-]{43}$/.test(body.deviceSecret) + || !string(body.approvalUrl) + || !validPollInterval(body.interval) + || !validPairingDeadline(body.expiresAt, now())) { + throw new ProprClientError('The ProPR instance returned an invalid pairing request.', { + kind: 'invalid_response', + }); + } + try { + const approvalUrl = new URL(body.approvalUrl); + if (canonicalProprHttpUrlOrigin(body.approvalUrl) !== approvalUrl.origin) throw new Error(); + if (approvalUrl.username || approvalUrl.password) throw new Error(); + // Device approval is intentionally same-origin. A future hosted approval + // service must define and validate a narrow trust contract here first. + if (!expectedOrigin || approvalUrl.origin !== expectedOrigin) throw new Error(); + } catch { + throw new ProprClientError('The ProPR instance returned an unsafe pairing approval URL.', { + kind: 'invalid_response', + }); + } + return { + pairingId: body.pairingId, + deviceSecret: body.deviceSecret, + approvalUrl: body.approvalUrl, + expiresAt: body.expiresAt, + interval: body.interval, + }; +}; + +const cancelled = (cause?: unknown): ProprClientError => + new ProprClientError('Desktop pairing was cancelled.', { kind: 'aborted', cause }); + +const expired = (cause?: unknown): ProprClientError => + new ProprClientError('Desktop pairing expired before it was approved.', { + kind: 'authentication', code: 'PAIRING_EXPIRED', cause, + }); + +const safeDelay = (milliseconds: number): number => Math.max(1, Math.ceil(milliseconds)); + +const defaultSleep = (milliseconds: number, signal?: AbortSignal): Promise => new Promise((resolve, reject) => { + const aborted = () => { + clearTimeout(timer); + reject(cancelled()); + }; + const timer = setTimeout(() => { + signal?.removeEventListener('abort', aborted); + resolve(); + }, milliseconds); + if (signal?.aborted) aborted(); + else signal?.addEventListener('abort', aborted, { once: true }); +}); + +export const completeDesktopPairing = async ( + client: ProprClient, + start: ProprDesktopPairingStart, + options: ProprDesktopPairingOptions, +): Promise => { + const sleep = options.sleep ?? defaultSleep; + const now = options.now ?? Date.now; + if (options.signal?.aborted) throw cancelled(options.signal.reason); + const deadline = Date.parse(start.expiresAt); + const startedAt = now(); + const lifetimeMs = deadline - startedAt; + if (!validPollInterval(start.interval) + || !Number.isFinite(deadline) + || !Number.isFinite(startedAt) + || lifetimeMs > MAX_PAIRING_LIFETIME_MS) { + throw new ProprClientError('The ProPR instance returned an invalid pairing deadline.', { + kind: 'invalid_response', + }); + } + if (lifetimeMs <= 0) throw expired(); + + const lifetimeController = new AbortController(); + const monotonicStartedAt = performance.now(); + let terminal: 'caller' | 'deadline' | undefined; + const abortForCaller = () => { + if (terminal) return; + terminal = 'caller'; + lifetimeController.abort(options.signal?.reason); + }; + const abortForDeadline = () => { + if (terminal) return; + terminal = 'deadline'; + lifetimeController.abort(expired()); + }; + const deadlineTimer = setTimeout(abortForDeadline, safeDelay(lifetimeMs)); + if (options.signal?.aborted) abortForCaller(); + else options.signal?.addEventListener('abort', abortForCaller, { once: true }); + + const terminalError = (cause?: unknown): ProprClientError => terminal === 'caller' + ? cancelled(cause ?? options.signal?.reason) + : expired(cause); + const remainingLifetime = (): number => Math.min( + deadline - now(), + lifetimeMs - (performance.now() - monotonicStartedAt), + ); + const requireRemainingLifetime = (): number => { + if (terminal) throw terminalError(); + const remaining = remainingLifetime(); + if (remaining <= 0) { + abortForDeadline(); + throw terminalError(); + } + return remaining; + }; + const raceLifetime = (operation: PromiseLike): Promise => { + let removeAbortListener: () => void = () => undefined; + const result = new Promise((resolve, reject) => { + const rejectForAbort = () => reject(terminalError()); + removeAbortListener = () => { + lifetimeController.signal.removeEventListener('abort', rejectForAbort); + }; + if (lifetimeController.signal.aborted) rejectForAbort(); + else lifetimeController.signal.addEventListener('abort', rejectForAbort, { once: true }); + // Always attach both handlers, even if the lifetime already ended, so a + // callback or transport that settles late cannot become unhandled. + Promise.resolve(operation).then(resolve, error => { + reject(terminal ? terminalError(error) : error); + }); + }); + return result.finally(() => removeAbortListener()); + }; + + try { + let intervalSeconds = start.interval; + if (options.onApprovalRequired) { + const approval = Promise.resolve().then(() => + options.onApprovalRequired?.(start.approvalUrl, start.expiresAt)); + await raceLifetime(approval); + requireRemainingLifetime(); + } + + while (true) { + const remainingBeforeSleep = requireRemainingLifetime(); + const delay = safeDelay(Math.min(intervalSeconds * 1000, remainingBeforeSleep)); + await raceLifetime(sleep(delay, lifetimeController.signal)); + const remaining = requireRemainingLifetime(); + + let value: unknown; + try { + // The pairing reader owns cancellation through body drain/cancel. Do + // not race it with a faster outer rejection: completion here is the + // operation's guarantee that no response task survives this poll. + value = await client.requestDesktopPairing( + `/api/desktop/pairings/${encodeURIComponent(start.pairingId)}/poll`, + { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ deviceSecret: start.deviceSecret }), + redirect: 'manual', + signal: lifetimeController.signal, + }, + Math.min(PAIRING_REQUEST_TIMEOUT_MS, safeDelay(remaining)), + ); + } catch (error) { + if (terminal || remainingLifetime() <= 0) { + if (!terminal) abortForDeadline(); + throw terminalError(error); + } + throw error; + } + requireRemainingLifetime(); + const body = record(value); + if (body.status === 'pending' + && exactKeys(body, ['status', 'interval']) + && validPollInterval(body.interval)) { + intervalSeconds = body.interval; + continue; + } + if (body.status === 'provisional' + && exactKeys(body, [ + 'status', 'token', 'tokenType', 'activationTicket', 'activationExpiresAt', + 'instanceId', 'origin', 'scope', 'credentialGeneration', + ]) + && string(body.token) + && /^propr_it_[A-Za-z0-9_-]{43}$/.test(body.token) && body.tokenType === 'Bearer' + && string(body.activationTicket) && /^[A-Za-z0-9_-]{43}$/.test(body.activationTicket) + && validPairingDeadline(body.activationExpiresAt, now()) + && validBinding(body) + && body.instanceId === options.binding.instanceId + && body.origin === options.binding.origin + && body.scope === options.binding.scope + && body.credentialGeneration === options.binding.credentialGeneration) { + requireRemainingLifetime(); + return { + token: body.token, + tokenType: 'Bearer', + pairingId: start.pairingId, + deviceSecret: start.deviceSecret, + activationTicket: body.activationTicket, + activationExpiresAt: body.activationExpiresAt, + instanceId: body.instanceId, + origin: body.origin, + scope: body.scope, + credentialGeneration: body.credentialGeneration, + }; + } + throw new ProprClientError('The ProPR instance returned an invalid pairing status.', { + kind: 'invalid_response', + }); + } + } finally { + clearTimeout(deadlineTimer); + options.signal?.removeEventListener('abort', abortForCaller); + } +}; + +export const parseDesktopPairingActivationReceipt = (value: unknown): ProprDesktopPairingActivationReceipt => { + const body = record(value); + if (body.status !== 'active' || !string(body.receipt) || !/^[A-Za-z0-9_-]{22}$/.test(body.receipt) + || !string(body.activatedAt) || !Number.isFinite(Date.parse(body.activatedAt)) + || !(body.expiresAt === null || (string(body.expiresAt) && Number.isFinite(Date.parse(body.expiresAt)))) + || Object.keys(body).some(key => !['status', 'receipt', 'activatedAt', 'expiresAt'].includes(key))) { + throw new ProprClientError('The ProPR instance returned an invalid pairing activation receipt.', { + kind: 'invalid_response', + }); + } + return body as unknown as ProprDesktopPairingActivationReceipt; +}; diff --git a/packages/client/src/index.ts b/packages/client/src/index.ts index 2d3bf4aea..5de7af0d6 100644 --- a/packages/client/src/index.ts +++ b/packages/client/src/index.ts @@ -17,6 +17,19 @@ export { type ProprClientErrorKind, type ProprClientErrorOptions, } from './errors.js'; +export { + completeDesktopPairing, + parseDesktopDiscovery, + parseDesktopPairingStart, + parseDesktopPairingActivationReceipt, + type ProprDesktopPairingActivationReceipt, + type ProprDesktopPairingBinding, + type ProprDesktopDiscovery, + type ProprDesktopPairingComplete, + type ProprDesktopPairingOptions, + type ProprDesktopPairingStart, +} from './desktopPairing.js'; +export type { PairingProtocolRequestOptions } from './pairingProtocol.js'; export { normalizeInstanceProfile, type NormalizedProprInstanceProfile, diff --git a/packages/client/src/pairingProtocol.ts b/packages/client/src/pairingProtocol.ts new file mode 100644 index 000000000..bf45e3ab1 --- /dev/null +++ b/packages/client/src/pairingProtocol.ts @@ -0,0 +1,315 @@ +import { ProprClientError } from './errors.js'; + +const CONNECT_HEADER_TIMEOUT_MS = 8_000; +const BODY_TIMEOUT_MS = 8_000; +const OVERALL_TIMEOUT_MS = CONNECT_HEADER_TIMEOUT_MS + BODY_TIMEOUT_MS; +const CANCELLATION_TIMEOUT_MS = 100; +const MAX_RESPONSE_BYTES = 4_096; +const CANCELLATION_TIMEOUT_DIAGNOSTIC = 'ProPR pairing response cancellation exceeded its fixed deadline.'; + +type TimeoutPhase = 'connect-header' | 'body' | 'overall'; + +export interface PairingProtocolRequestOptions { + overallTimeoutMs?: number; + /** @internal Deterministic protocol-test deadlines may only shorten production limits. */ + deadlines?: Partial<{ + headerMs: number; + bodyMs: number; + cancellationMs: number; + }>; + /** @internal Receives only a fixed, redacted cancellation diagnostic. */ + reportDiagnostic?: (message: string) => void; + /** @internal Deterministic monotonic timer source for protocol tests. */ + clock?: { + now(): number; + setTimeout(callback: () => void, milliseconds: number): ReturnType; + clearTimeout(timer: ReturnType): void; + }; +} + +const timeoutError = (cause?: unknown): ProprClientError => + new ProprClientError('The ProPR desktop pairing request timed out.', { kind: 'timeout', cause }); + +const cancelledError = (cause?: unknown): ProprClientError => + new ProprClientError('Desktop pairing was cancelled.', { kind: 'aborted', cause }); + +const invalidResponse = (status?: number, cause?: unknown): ProprClientError => + new ProprClientError('The ProPR desktop pairing service returned an invalid response.', { + kind: 'invalid_response', + status, + cause, + }); + +const networkError = (cause?: unknown): ProprClientError => + new ProprClientError('The ProPR desktop pairing service could not be reached.', { + kind: 'network', + cause, + }); + +const errorCode = (value: unknown): string | undefined => { + if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined; + const body = value as Record; + if (Object.keys(body).some(key => !['code', 'error'].includes(key)) + || typeof body.code !== 'string' + || !/^[A-Z][A-Z0-9_]{0,63}$/.test(body.code) + || typeof body.error !== 'string' + || body.error.length < 1 + || body.error.length > 256) return undefined; + return body.code; +}; + +const positiveTimeout = (value: number | undefined): number => { + const timeout = value ?? OVERALL_TIMEOUT_MS; + if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > OVERALL_TIMEOUT_MS) { + throw new ProprClientError('Desktop pairing request deadlines are invalid.', { + kind: 'configuration', + }); + } + return timeout; +}; + +const boundedDeadline = (value: number | undefined, maximum: number): number => { + const deadline = value ?? maximum; + if (!Number.isSafeInteger(deadline) || deadline < 1 || deadline > maximum) { + throw new ProprClientError('Desktop pairing request deadlines are invalid.', { + kind: 'configuration', + }); + } + return deadline; +}; + +const contentLength = (response: Response): number | undefined => { + const raw = response.headers.get('content-length'); + if (raw === null) return undefined; + if (!/^(?:0|[1-9][0-9]*)$/.test(raw)) throw invalidResponse(response.status); + const value = Number(raw); + if (!Number.isSafeInteger(value)) throw invalidResponse(response.status); + return value; +}; + +/** + * Reads one pairing response under a single cancellation owner. The caller's + * signal and all timers remain installed until the response stream is complete + * or has been cancelled, so receiving headers never releases the operation. + */ +export const requestPairingProtocol = async ( + fetchImplementation: typeof globalThis.fetch, + target: RequestInfo | URL, + init: RequestInit, + options: PairingProtocolRequestOptions = {}, +): Promise => { + const callerSignal = init.signal; + const overallTimeoutMs = positiveTimeout(options.overallTimeoutMs); + const headerTimeoutMs = boundedDeadline(options.deadlines?.headerMs, CONNECT_HEADER_TIMEOUT_MS); + const bodyTimeoutMs = boundedDeadline(options.deadlines?.bodyMs, BODY_TIMEOUT_MS); + const cancellationTimeoutMs = boundedDeadline( + options.deadlines?.cancellationMs, + CANCELLATION_TIMEOUT_MS, + ); + const reportDiagnostic = options.reportDiagnostic ?? ((message: string) => console.warn(message)); + const clock = options.clock ?? { + now: () => performance.now(), + setTimeout: (callback: () => void, milliseconds: number) => setTimeout(callback, milliseconds), + clearTimeout: (timer: ReturnType) => clearTimeout(timer), + }; + const reportCancellationTimeout = (): void => { + try { + reportDiagnostic(CANCELLATION_TIMEOUT_DIAGNOSTIC); + } catch { + // A diagnostic hook must never change transport or shutdown settlement. + } + }; + const controller = new AbortController(); + const startedAt = clock.now(); + let timeoutPhase: TimeoutPhase | undefined; + let headerTimer: ReturnType | undefined; + let bodyTimer: ReturnType | undefined; + let overallTimer: ReturnType | undefined; + let response: Response | undefined; + let reader: ReadableStreamDefaultReader | undefined; + + const abortForCaller = (): void => controller.abort(callerSignal?.reason); + const abortForTimeout = (phase: TimeoutPhase): void => { + if (controller.signal.aborted) return; + timeoutPhase = phase; + controller.abort(new DOMException('Desktop pairing deadline exceeded', 'TimeoutError')); + }; + const raceCancellation = (operation: PromiseLike): Promise => new Promise((resolve, reject) => { + let settled = false; + const finish = (callback: () => void): void => { + if (settled) return; + settled = true; + controller.signal.removeEventListener('abort', aborted); + callback(); + }; + const aborted = () => finish(() => reject( + controller.signal.reason ?? new DOMException('Aborted', 'AbortError'), + )); + if (controller.signal.aborted) aborted(); + else controller.signal.addEventListener('abort', aborted, { once: true }); + // Both handlers remain attached to the foreign promise after our abort + // wins. A later resolve/reject is deliberately consumed and cannot alter + // endpoint state or become an unhandled rejection. + Promise.resolve(operation).then( + value => finish(() => resolve(value)), + error => finish(() => reject(error)), + ); + }); + const remainingOverall = (): number => Math.max( + 0, + overallTimeoutMs - (clock.now() - startedAt), + ); + const cancelResponse = async (): Promise => { + const cancelTarget = reader ?? response?.body; + if (!cancelTarget) return; + let cancellation: Promise; + try { + cancellation = Promise.resolve(cancelTarget.cancel()); + } catch { + return; + } + // Attach a rejection handler before doing anything else. The underlying + // stream controls this promise and may reject long after local shutdown. + let cancellationSettled = false; + const settled = cancellation.then( + () => { cancellationSettled = true; return true; }, + () => { cancellationSettled = true; return true; }, + ); + const budget = Math.min(cancellationTimeoutMs, remainingOverall()); + if (budget <= 0) { + // Give an already-settled cancellation its queued promise reaction, but + // never install or await a foreign task beyond the overall boundary. + await Promise.resolve(); + if (!cancellationSettled) reportCancellationTimeout(); + return; + } + let cancellationTimer: ReturnType | undefined; + const cancelledInBudget = await Promise.race([ + settled, + new Promise(resolve => { + cancellationTimer = clock.setTimeout(() => resolve(false), budget); + }), + ]); + if (cancellationTimer) clock.clearTimeout(cancellationTimer); + if (!cancelledInBudget) reportCancellationTimeout(); + }; + + if (callerSignal?.aborted) abortForCaller(); + else callerSignal?.addEventListener('abort', abortForCaller, { once: true }); + if (!controller.signal.aborted) { + overallTimer = clock.setTimeout(() => abortForTimeout('overall'), overallTimeoutMs); + headerTimer = clock.setTimeout( + () => abortForTimeout('connect-header'), + Math.min(headerTimeoutMs, overallTimeoutMs), + ); + } + + try { + // Promise argument evaluation would otherwise call an untrusted fetch even + // when disposal/caller cancellation was already complete. + if (controller.signal.aborted) { + throw controller.signal.reason ?? new DOMException('Aborted', 'AbortError'); + } + response = await raceCancellation(fetchImplementation(target, { + ...init, + redirect: 'manual', + signal: controller.signal, + })); + if (headerTimer) clock.clearTimeout(headerTimer); + headerTimer = undefined; + + // Browsers may expose a manual cross-origin redirect as opaqueredirect + // rather than preserving its 3xx status. Both forms are terminal and their + // bodies are never parsed. + if ((response.status >= 300 && response.status < 400) + || response.type === 'opaqueredirect' + || response.status === 0) { + throw invalidResponse(response.status || undefined); + } + + const declaredLength = contentLength(response); + if (declaredLength !== undefined && declaredLength > MAX_RESPONSE_BYTES) { + throw invalidResponse(response.status); + } + if (!response.body) { + if (!response.ok) { + throw new ProprClientError(`Desktop pairing request failed with HTTP ${response.status}.`, { + kind: 'http', + status: response.status, + }); + } + throw invalidResponse(response.status); + } + + reader = response.body.getReader(); + bodyTimer = clock.setTimeout( + () => abortForTimeout('body'), + Math.min(bodyTimeoutMs, overallTimeoutMs), + ); + const chunks: Uint8Array[] = []; + let byteLength = 0; + while (true) { + const part = await raceCancellation(reader.read()); + if (part.done) break; + if (!(part.value instanceof Uint8Array) || part.value.byteLength === 0) { + throw invalidResponse(response.status); + } + byteLength += part.value.byteLength; + if (byteLength > MAX_RESPONSE_BYTES) throw invalidResponse(response.status); + chunks.push(part.value); + } + if (declaredLength !== undefined && declaredLength !== byteLength) { + throw invalidResponse(response.status); + } + + const bytes = new Uint8Array(byteLength); + let offset = 0; + for (const chunk of chunks) { + bytes.set(chunk, offset); + offset += chunk.byteLength; + } + let text: string; + try { + text = new TextDecoder('utf-8', { fatal: true }).decode(bytes); + } catch (cause) { + throw invalidResponse(response.status, cause); + } + + let value: unknown; + try { + value = JSON.parse(text) as unknown; + } catch (cause) { + if (!response.ok) value = undefined; + else throw invalidResponse(response.status, cause); + } + if (!response.ok) { + throw new ProprClientError(`Desktop pairing request failed with HTTP ${response.status}.`, { + kind: 'http', + status: response.status, + code: errorCode(value), + }); + } + const contentType = response.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase(); + if (contentType !== 'application/json') throw invalidResponse(response.status); + return value; + } catch (cause) { + if (cause instanceof ProprClientError) throw cause; + if (callerSignal?.aborted) throw cancelledError(cause); + if (timeoutPhase) throw timeoutError(cause); + if (cause instanceof Error && cause.name === 'AbortError') throw cancelledError(cause); + throw networkError(cause); + } finally { + // Network ownership ends before touching the untrusted stream primitive. + // All local timers/listeners are detached first; cancellation then gets a + // separate short budget which is also clamped to the endpoint deadline. + if (!controller.signal.aborted) controller.abort(); + if (headerTimer) clock.clearTimeout(headerTimer); + if (bodyTimer) clock.clearTimeout(bodyTimer); + if (overallTimer) clock.clearTimeout(overallTimer); + callerSignal?.removeEventListener('abort', abortForCaller); + await cancelResponse(); + try { reader?.releaseLock(); } catch { /* The stream may already be errored. */ } + reader = undefined; + response = undefined; + } +}; diff --git a/packages/client/test/client.test.ts b/packages/client/test/client.test.ts index dae6a6b7a..bcf592826 100644 --- a/packages/client/test/client.test.ts +++ b/packages/client/test/client.test.ts @@ -1,6 +1,6 @@ import assert from 'node:assert/strict'; import { describe, it } from 'node:test'; -import { PROPR_API_COMPATIBILITY } from '@propr/shared'; +import { PROPR_API_COMPATIBILITY, PROPR_API_ORIGIN_PARITY_CASES } from '@propr/shared'; import { ProprClient, ProprClientError, @@ -9,9 +9,17 @@ import { } from '../src/index.js'; describe('Propr API base URLs and instance profiles', () => { + it('matches the shared canonical origin parity table', () => { + for (const [name, input, expected] of PROPR_API_ORIGIN_PARITY_CASES) { + if (expected === null) assert.throws(() => normalizeApiBaseUrl(input), ProprClientError, name); + else assert.equal(normalizeApiBaseUrl(input), expected, name); + } + }); it('supports browser same-origin, loopback, and secure remote instances', () => { assert.equal(normalizeApiBaseUrl(), ''); - assert.equal(normalizeApiBaseUrl(' http://localhost:4000/// '), 'http://localhost:4000'); + assert.equal(normalizeApiBaseUrl(' http://localhost:4000/ '), 'http://localhost:4000'); + assert.equal(normalizeApiBaseUrl('http://api.dev.localhost:3000'), 'http://api.dev.localhost:3000'); + assert.equal(normalizeApiBaseUrl('http://127.42.7.9:3000'), 'http://127.42.7.9:3000'); assert.equal(normalizeApiBaseUrl('http://127.0.0.1:3000'), 'http://127.0.0.1:3000'); assert.equal(normalizeApiBaseUrl('http://[::1]:3000'), 'http://[::1]:3000'); assert.equal(normalizeApiBaseUrl('https://propr.example.com/'), 'https://propr.example.com'); @@ -34,6 +42,12 @@ describe('Propr API base URLs and instance profiles', () => { 'https://propr.example.com/api', 'https://propr.example.com?token=secret', 'http://propr.example.com', + 'http://localhost.:3000', + 'http://127.1:3000', + 'http://0177.0.0.1:3000', + 'http://0x7f000001:3000', + 'http://[::ffff:127.0.0.1]:3000', + 'https://propr.example.com///', ]) { assert.throws(() => normalizeApiBaseUrl(value), ProprClientError); } @@ -52,10 +66,11 @@ describe('ProprClient REST transport', () => { }, }); - await client.request('/api/status'); + await client.request('/api/status', { credentials: 'include' }); assert.equal(calls[0][0], 'https://propr.example.com/api/status'); assert.equal(new Headers(calls[0][1]?.headers).get('Authorization'), 'Bearer secret-token'); + assert.equal(calls[0][1]?.credentials, 'omit'); assert.doesNotMatch(String(calls[0][0]), /secret-token/); }); diff --git a/packages/client/test/desktopPairing.test.ts b/packages/client/test/desktopPairing.test.ts new file mode 100644 index 000000000..f1fa6fc5d --- /dev/null +++ b/packages/client/test/desktopPairing.test.ts @@ -0,0 +1,475 @@ +import assert from 'node:assert/strict'; +import { describe, it } from 'node:test'; +import { PROPR_API_COMPATIBILITY, PROPR_UI_COMPATIBILITY } from '@propr/shared'; +import { ProprClient, ProprClientError } from '../src/index.js'; + +const json = (body: unknown, status = 200): Response => new Response(JSON.stringify(body), { + status, + headers: { 'Content-Type': 'application/json' }, +}); + +const discovery = { + product: 'ProPR', + version: '0.8.15', + apiCompatibility: PROPR_API_COMPATIBILITY, + uiCompatibility: PROPR_UI_COMPATIBILITY, + desktopAuthentication: { + protocolVersion: 2 as const, + browserPairing: true, + instanceBearerTokens: true, + socketIoBearerAuthentication: true, + }, +}; +const protocolNow = Date.parse('2026-01-01T00:00:00.000Z'); +const protocolDeadline = new Date(protocolNow + 10 * 60 * 1000).toISOString(); +const binding = { + instanceId: 'profile-a', + origin: 'https://propr.example.test', + scope: 'desktop-instance' as const, + credentialGeneration: 'G'.repeat(22), +}; +const bounded = (promise: Promise, milliseconds = 1_000): Promise => { + let timer: ReturnType | undefined; + const timeout = new Promise((_resolve, reject) => { + timer = setTimeout(() => reject(new Error('Pairing did not settle within the test timeout')), milliseconds); + }); + return Promise.race([promise, timeout]).finally(() => { + if (timer) clearTimeout(timer); + }); +}; + +describe('desktop instance protocol', () => { + it('discovers capabilities, opens approval, and polls to a single opaque token', async () => { + const requests: Array<{ url: string; init?: RequestInit }> = []; + let polls = 0; + const client = new ProprClient({ + baseUrl: 'https://propr.example.test', + authentication: { type: 'none' }, + fetch: async (input, init) => { + const url = input.toString(); + requests.push({ url, init }); + if (url.endsWith('/api/desktop/discovery')) return json(discovery); + if (url.endsWith('/api/desktop/pairings')) return json({ + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: `https://propr.example.test/api/desktop/pairings/dpr_${'A'.repeat(22)}/browser`, + expiresAt: protocolDeadline, + interval: 2, + }, 201); + polls += 1; + return polls === 1 + ? json({ status: 'pending', interval: 3 }, 202) + : json({ + status: 'provisional', + token: `propr_it_${'C'.repeat(43)}`, + tokenType: 'Bearer', + activationTicket: 'T'.repeat(43), + activationExpiresAt: protocolDeadline, + ...binding, + }); + }, + }); + + const metadata = await client.discoverDesktop(); + assert.equal(metadata.compatibility.compatible, true); + assert.equal(metadata.desktopAuthentication.browserPairing, true); + + const opened: string[] = []; + const sleeps: number[] = []; + const complete = await client.pairDesktop('Test desktop', { + binding, + now: () => protocolNow, + sleep: async milliseconds => { sleeps.push(milliseconds); }, + onApprovalRequired: url => { opened.push(url); }, + }); + + assert.deepEqual(complete, { + token: `propr_it_${'C'.repeat(43)}`, + tokenType: 'Bearer', + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + activationTicket: 'T'.repeat(43), + activationExpiresAt: protocolDeadline, + ...binding, + }); + assert.deepEqual(opened, [`https://propr.example.test/api/desktop/pairings/dpr_${'A'.repeat(22)}/browser`]); + assert.deepEqual(sleeps, [2000, 3000]); + assert.equal(requests.every(request => !request.url.includes('B'.repeat(43))), true); + assert.equal(requests.filter(request => request.url.endsWith('/poll')).every(request => + String(request.init?.body).includes('B'.repeat(43))), true); + }); + + it('cancels and expires without another poll request', async () => { + const client = new ProprClient({ fetch: async () => { throw new Error('must not request'); } }); + const start = { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt: '2026-01-01T00:00:00.000Z', + interval: 1, + }; + await assert.rejects( + // Importing through the client keeps the public helper covered separately + // from the start endpoint. + import('../src/index.js').then(({ completeDesktopPairing }) => completeDesktopPairing(client, start, { + now: () => Date.parse('2026-01-01T00:00:00.000Z'), + })), + (error: unknown) => error instanceof ProprClientError && error.code === 'PAIRING_EXPIRED', + ); + + const controller = new AbortController(); + controller.abort(); + await assert.rejects( + import('../src/index.js').then(({ completeDesktopPairing }) => completeDesktopPairing(client, { + ...start, + expiresAt: protocolDeadline, + }, { signal: controller.signal })), + (error: unknown) => error instanceof ProprClientError && error.kind === 'aborted', + ); + }); + + it('expires while the approval callback is still pending and ignores its late completion', async () => { + const { completeDesktopPairing } = await import('../src/index.js'); + let finishApproval!: () => void; + let polls = 0; + const approvalStarted = new Promise(resolve => { finishApproval = resolve; }); + let completeApproval!: () => void; + const client = new ProprClient({ fetch: async () => { + polls += 1; + throw new Error('must not poll after approval expiry'); + } }); + const pairing = completeDesktopPairing(client, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt: new Date(Date.now() + 50).toISOString(), + interval: 1, + }, { + onApprovalRequired: () => new Promise(resolve => { + completeApproval = resolve; + finishApproval(); + }), + }); + + await approvalStarted; + await assert.rejects(bounded(pairing), (error: unknown) => + error instanceof ProprClientError && error.code === 'PAIRING_EXPIRED'); + completeApproval(); + await new Promise(resolve => setImmediate(resolve)); + assert.equal(polls, 0); + }); + + it('aborts while the approval callback is pending and handles a late callback rejection', async () => { + const { completeDesktopPairing } = await import('../src/index.js'); + const controller = new AbortController(); + let approvalStarted!: () => void; + const started = new Promise(resolve => { approvalStarted = resolve; }); + let rejectApproval!: (error: Error) => void; + const client = new ProprClient({ fetch: async () => { throw new Error('must not poll'); } }); + const pairing = completeDesktopPairing(client, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt: new Date(Date.now() + 60_000).toISOString(), + interval: 1, + }, { + signal: controller.signal, + onApprovalRequired: () => new Promise((_resolve, reject) => { + rejectApproval = reject; + approvalStarted(); + }), + }); + + await started; + controller.abort('test cancellation'); + await assert.rejects(bounded(pairing), (error: unknown) => + error instanceof ProprClientError && error.kind === 'aborted'); + rejectApproval(new Error('late approval failure')); + await new Promise(resolve => setImmediate(resolve)); + }); + + it('rejects an unsafe approval URL', async () => { + const client = new ProprClient({ + baseUrl: 'https://propr.example.test', + fetch: async () => json({ + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'http://remote.example.test/approve', + expiresAt: protocolDeadline, + interval: 2, + }, 201), + }); + await assert.rejects(client.startDesktopPairing('Desktop', { now: () => protocolNow }), (error: unknown) => + error instanceof ProprClientError && error.kind === 'invalid_response'); + }); + + it('enforces the browser request origin for same-origin pairing clients', async () => { + const locationDescriptor = Object.getOwnPropertyDescriptor(globalThis, 'location'); + Object.defineProperty(globalThis, 'location', { + configurable: true, + value: { origin: 'https://propr.example.test' }, + }); + try { + for (const [approvalUrl, accepted] of [ + ['https://propr.example.test/approve', true], + ['https://attacker.example.test/approve', false], + ] as const) { + const client = new ProprClient({ + fetch: async () => json({ + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl, + expiresAt: protocolDeadline, + interval: 2, + }, 201), + }); + if (accepted) { + await assert.doesNotReject(client.startDesktopPairing('Desktop', { now: () => protocolNow })); + } else { + await assert.rejects( + client.startDesktopPairing('Desktop', { now: () => protocolNow }), + (error: unknown) => error instanceof ProprClientError && error.kind === 'invalid_response', + ); + } + } + } finally { + if (locationDescriptor) Object.defineProperty(globalThis, 'location', locationDescriptor); + else Reflect.deleteProperty(globalThis, 'location'); + } + }); + + it('fails closed before pairing when a same-origin request has no browser origin', async () => { + const locationDescriptor = Object.getOwnPropertyDescriptor(globalThis, 'location'); + Reflect.deleteProperty(globalThis, 'location'); + let requests = 0; + try { + const client = new ProprClient({ fetch: async () => { + requests += 1; + throw new Error('must not request without a trusted origin'); + } }); + await assert.rejects( + client.startDesktopPairing('Desktop', { now: () => protocolNow }), + (error: unknown) => error instanceof ProprClientError && error.kind === 'configuration', + ); + assert.equal(requests, 0); + } finally { + if (locationDescriptor) Object.defineProperty(globalThis, 'location', locationDescriptor); + } + }); + + it('rejects cross-origin, credentialed, malformed, and invalid-deadline approval responses', async () => { + for (const override of [ + { approvalUrl: 'https://attacker.example.test/approve' }, + { approvalUrl: 'https://user:secret@propr.example.test/approve' }, + { approvalUrl: 'not a URL' }, + { expiresAt: 'not a deadline' }, + ]) { + const client = new ProprClient({ + baseUrl: 'https://propr.example.test', + fetch: async () => json({ + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt: protocolDeadline, + interval: 2, + ...override, + }, 201), + }); + await assert.rejects(client.startDesktopPairing('Desktop', { now: () => protocolNow }), (error: unknown) => + error instanceof ProprClientError && error.kind === 'invalid_response'); + } + }); + + it('cancels while the pairing start request is in flight', async () => { + const controller = new AbortController(); + let started!: () => void; + const requestStarted = new Promise(resolve => { started = resolve; }); + const client = new ProprClient({ + baseUrl: 'https://propr.example.test', + fetch: async (_input, init) => new Promise((_resolve, reject) => { + started(); + init?.signal?.addEventListener('abort', () => reject(new DOMException('cancelled', 'AbortError')), { once: true }); + }), + }); + + const pairing = client.pairDesktop('Desktop', { signal: controller.signal }); + await requestStarted; + controller.abort(); + await assert.rejects(pairing, (error: unknown) => + error instanceof ProprClientError && error.kind === 'aborted'); + }); + + it('aborts a hung poll at the advertised deadline and reports expiry', async () => { + const expiresAt = new Date(protocolNow + 40).toISOString(); + const sleeps: number[] = []; + const client = new ProprClient({ + baseUrl: 'https://propr.example.test', + fetch: async (input, init) => { + if (input.toString().endsWith('/api/desktop/pairings')) return json({ + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt, + interval: 1, + }, 201); + return new Promise((_resolve, reject) => { + init?.signal?.addEventListener('abort', () => reject(new DOMException('expired', 'AbortError')), { once: true }); + }); + }, + }); + + await assert.rejects(client.pairDesktop('Desktop', { + now: () => protocolNow, + sleep: async milliseconds => { sleeps.push(milliseconds); }, + }), (error: unknown) => + error instanceof ProprClientError && error.code === 'PAIRING_EXPIRED'); + assert.deepEqual(sleeps, [40]); + }); + + for (const lateSettlement of ['microtask', 'next-task'] as const) { + it(`does not accept a token response that settles in the ${lateSettlement} after deadline abort`, async () => { + const { completeDesktopPairing } = await import('../src/index.js'); + const expiresAt = new Date(Date.now() + 40).toISOString(); + let lateResponseResolved = false; + const client = new ProprClient({ + baseUrl: 'https://propr.example.test', + fetch: async (_input, init) => new Promise(resolve => { + init?.signal?.addEventListener('abort', () => { + const settle = () => { + lateResponseResolved = true; + resolve(json({ + status: 'complete', + token: `propr_it_${'C'.repeat(43)}`, + tokenType: 'Bearer', + expiresAt: null, + })); + }; + if (lateSettlement === 'microtask') queueMicrotask(settle); + else setImmediate(settle); + }, { once: true }); + }), + }); + + const pairing = completeDesktopPairing(client, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt, + interval: 1, + }, { sleep: async () => undefined }); + + await assert.rejects(bounded(pairing), (error: unknown) => + error instanceof ProprClientError && error.code === 'PAIRING_EXPIRED'); + await new Promise(resolve => setImmediate(resolve)); + assert.equal(lateResponseResolved, true); + }); + } + + it('aborts an in-flight poll when the caller cancels', async () => { + const controller = new AbortController(); + let pollStarted!: () => void; + const polling = new Promise(resolve => { pollStarted = resolve; }); + const client = new ProprClient({ + baseUrl: 'https://propr.example.test', + fetch: async (input, init) => { + if (input.toString().endsWith('/api/desktop/pairings')) return json({ + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt: protocolDeadline, + interval: 1, + }, 201); + pollStarted(); + return new Promise((_resolve, reject) => { + init?.signal?.addEventListener( + 'abort', + () => reject(new DOMException('cancelled', 'AbortError')), + { once: true }, + ); + }); + }, + }); + + const pairing = client.pairDesktop('Desktop', { + signal: controller.signal, + now: () => protocolNow, + sleep: async () => undefined, + }); + await polling; + controller.abort(); + await assert.rejects(pairing, (error: unknown) => + error instanceof ProprClientError && error.kind === 'aborted'); + }); + + it('rejects invalid start intervals and deadlines instead of scheduling them', async () => { + const invalidOverrides: Array> = [ + { interval: 0 }, + { interval: 0.5 }, + { interval: 61 }, + { interval: Number.MAX_VALUE }, + { interval: Number.NaN }, + { interval: Number.POSITIVE_INFINITY }, + { expiresAt: 'not a deadline' }, + { expiresAt: new Date(protocolNow).toISOString() }, + { expiresAt: new Date(protocolNow + 30 * 60 * 1000 + 1).toISOString() }, + ]; + for (const override of invalidOverrides) { + const client = new ProprClient({ + baseUrl: 'https://propr.example.test', + fetch: async () => json({ + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt: protocolDeadline, + interval: 2, + ...override, + }, 201), + }); + await assert.rejects( + client.startDesktopPairing('Desktop', { now: () => protocolNow }), + (error: unknown) => error instanceof ProprClientError && error.kind === 'invalid_response', + ); + } + }); + + it('rejects invalid intervals returned by every pending response', async () => { + const { completeDesktopPairing } = await import('../src/index.js'); + const start = { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt: protocolDeadline, + interval: 1, + }; + for (const interval of [0, 0.5, 61, Number.MAX_VALUE, Number.NaN, Number.POSITIVE_INFINITY]) { + const client = new ProprClient({ + fetch: async () => json({ status: 'pending', interval }, 202), + }); + await assert.rejects(completeDesktopPairing(client, start, { + now: () => protocolNow, + sleep: async () => undefined, + }), (error: unknown) => error instanceof ProprClientError && error.kind === 'invalid_response'); + } + }); + + it('clamps a valid polling interval to the remaining advertised deadline', async () => { + const { completeDesktopPairing } = await import('../src/index.js'); + let now = protocolNow; + const sleeps: number[] = []; + const client = new ProprClient({ fetch: async () => { throw new Error('must not poll after deadline'); } }); + await assert.rejects(completeDesktopPairing(client, { + pairingId: `dpr_${'A'.repeat(22)}`, + deviceSecret: 'B'.repeat(43), + approvalUrl: 'https://propr.example.test/approve', + expiresAt: new Date(protocolNow + 500).toISOString(), + interval: 60, + }, { + now: () => now, + sleep: async milliseconds => { + sleeps.push(milliseconds); + now += milliseconds; + }, + }), (error: unknown) => error instanceof ProprClientError && error.code === 'PAIRING_EXPIRED'); + assert.deepEqual(sleeps, [500]); + }); +}); diff --git a/packages/client/test/pairingTransport.test.ts b/packages/client/test/pairingTransport.test.ts new file mode 100644 index 000000000..7e7257797 --- /dev/null +++ b/packages/client/test/pairingTransport.test.ts @@ -0,0 +1,552 @@ +import assert from 'node:assert/strict'; +import { createServer, type Server } from 'node:http'; +import type { AddressInfo } from 'node:net'; +import { afterEach, describe, it } from 'node:test'; +import { completeDesktopPairing, ProprClient, ProprClientError } from '../src/index.js'; +import { requestPairingProtocol, type PairingProtocolRequestOptions } from '../src/pairingProtocol.js'; + +const protocolNow = Date.parse('2026-01-01T00:00:00.000Z'); +const deadline = new Date(protocolNow + 60_000).toISOString(); +const pairingId = `dpr_${'P'.repeat(22)}`; +const deviceSecret = 'D'.repeat(43); +const activationTicket = 'A'.repeat(43); +const token = `propr_it_${'T'.repeat(43)}`; +const binding = { + instanceId: 'profile-transport', + origin: 'https://propr.example.test', + scope: 'desktop-instance' as const, + credentialGeneration: 'G'.repeat(22), +}; +const completedPairing = { + token, + tokenType: 'Bearer' as const, + pairingId, + deviceSecret, + activationTicket, + activationExpiresAt: deadline, + ...binding, +}; + +type EndpointName = 'start' | 'poll' | 'activate' | 'cancel'; + +const successBody = (endpoint: EndpointName, origin = binding.origin): Record => { + if (endpoint === 'start') return { + pairingId, + deviceSecret, + approvalUrl: `${origin}/api/desktop/pairings/${pairingId}/browser`, + expiresAt: deadline, + interval: 1, + }; + if (endpoint === 'poll') return { + status: 'provisional', + token, + tokenType: 'Bearer', + activationTicket, + activationExpiresAt: deadline, + ...binding, + origin, + }; + if (endpoint === 'activate') return { + status: 'active', + receipt: 'R'.repeat(22), + activatedAt: '2026-01-01T00:00:01.000Z', + expiresAt: null, + }; + return { status: 'cancelled', cancelledAt: '2026-01-01T00:00:01.000Z' }; +}; + +const jsonResponse = ( + value: unknown, + status = 200, + headers: Record = {}, +): Response => new Response(JSON.stringify(value), { + status, + headers: { 'Content-Type': 'application/json', ...headers }, +}); + +const streamResponse = ( + chunks: Uint8Array[], + options: { status?: number; headers?: Record; error?: Error } = {}, +): Response => new Response(new ReadableStream({ + start(controller) { + chunks.forEach(chunk => controller.enqueue(chunk)); + if (options.error) controller.error(options.error); + else controller.close(); + }, +}), { + status: options.status ?? 200, + headers: { 'Content-Type': 'application/json', ...options.headers }, +}); + +const runEndpoint = async ( + endpoint: EndpointName, + fetchImplementation: typeof globalThis.fetch, + signal?: AbortSignal, + baseUrl = binding.origin, +): Promise => { + const client = new ProprClient({ + baseUrl, + authentication: { type: 'none' }, + fetch: fetchImplementation, + }); + if (endpoint === 'start') { + return client.startDesktopPairing('Transport test', { + signal, + now: () => protocolNow, + binding: { ...binding, origin: baseUrl }, + }); + } + const pairing = { ...completedPairing, origin: baseUrl }; + if (endpoint === 'activate') return client.activateDesktopPairing(pairing, signal); + if (endpoint === 'cancel') return client.cancelDesktopPairing(pairing, signal); + return completeDesktopPairing(client, { + pairingId, + deviceSecret, + approvalUrl: `${baseUrl}/approve`, + expiresAt: deadline, + interval: 1, + }, { + signal, + now: () => protocolNow, + sleep: async () => undefined, + binding: { ...binding, origin: baseUrl }, + }); +}; + +const bounded = async (promise: Promise, milliseconds = 1_000): Promise => { + let timer: ReturnType | undefined; + try { + return await Promise.race([ + promise, + new Promise((_resolve, reject) => { + timer = setTimeout(() => reject(new Error('transport operation did not settle')), milliseconds); + }), + ]); + } finally { + if (timer) clearTimeout(timer); + } +}; + +class ProtocolClock { + #now = 0; + #nextId = 1; + readonly #timers = new Map void }>(); + + readonly source: NonNullable = { + now: () => this.#now, + setTimeout: (callback, milliseconds) => { + const id = this.#nextId++; + this.#timers.set(id, { at: this.#now + milliseconds, callback }); + return id as unknown as ReturnType; + }, + clearTimeout: timer => { this.#timers.delete(timer as unknown as number); }, + }; + + get now(): number { return this.#now; } + get pending(): number { return this.#timers.size; } + + async advance(milliseconds: number): Promise { + const target = this.#now + milliseconds; + while (true) { + const due = [...this.#timers.entries()] + .filter(([, timer]) => timer.at <= target) + .sort(([leftId, left], [rightId, right]) => left.at - right.at || leftId - rightId)[0]; + if (!due) break; + this.#now = due[1].at; + this.#timers.delete(due[0]); + due[1].callback(); + await Promise.resolve(); + await Promise.resolve(); + } + this.#now = target; + await Promise.resolve(); + await Promise.resolve(); + } +} + +const protocolRequest = ( + path: EndpointName, + fetchImplementation: typeof globalThis.fetch, + clock: ProtocolClock, + options: Omit = {}, +): Promise => requestPairingProtocol( + fetchImplementation, + `https://propr.example.test/${path}`, + { method: 'POST' }, + { ...options, clock: clock.source }, +); + +const timeoutKind = (error: unknown): boolean => + error instanceof ProprClientError && error.kind === 'timeout'; + +describe('bounded pairing protocol response transport', () => { + for (const endpoint of ['start', 'poll', 'activate', 'cancel'] as const) { + it(`${endpoint} accepts exact-limit and absent-length bodies but rejects deceptive Content-Length`, async () => { + const json = JSON.stringify(successBody(endpoint)); + const exact = new TextEncoder().encode(json + ' '.repeat(4_096 - Buffer.byteLength(json))); + assert.equal(exact.byteLength, 4_096); + await runEndpoint(endpoint, async () => streamResponse([ + exact.slice(0, 1), + exact.slice(1, 2_049), + exact.slice(2_049), + ])); + await assert.rejects(runEndpoint(endpoint, async () => streamResponse([ + new TextEncoder().encode(json), + ], { headers: { 'Content-Length': '1' } })), (error: unknown) => + error instanceof ProprClientError && error.kind === 'invalid_response'); + }); + + it(`${endpoint} cancels over-limit, stalled, malformed, errored, and late-extra bodies`, async () => { + const valid = JSON.stringify(successBody(endpoint)); + const over = new TextEncoder().encode(valid + ' '.repeat(4_097 - Buffer.byteLength(valid))); + let cancelled = 0; + const failures: Array<() => Promise> = [ + () => runEndpoint(endpoint, async () => streamResponse([over.slice(0, 4_096), over.slice(4_096)])), + () => runEndpoint(endpoint, async () => streamResponse([new Uint8Array([0xff])])), + () => runEndpoint(endpoint, async () => jsonResponse({ broken: true })), + () => runEndpoint(endpoint, async () => streamResponse([ + new TextEncoder().encode(valid), + new TextEncoder().encode('{"late":true}'), + ])), + () => runEndpoint(endpoint, async () => streamResponse([ + new TextEncoder().encode(valid.slice(0, 2)), + ], { error: new Error('private premature stream detail') })), + ]; + for (const failure of failures) { + await assert.rejects(bounded(failure()), (error: unknown) => + error instanceof ProprClientError + && ['invalid_response', 'network'].includes(error.kind) + && !error.message.includes('private')); + } + + const controller = new AbortController(); + let bodyStarted!: () => void; + const started = new Promise(resolve => { bodyStarted = resolve; }); + let streamCancelled = false; + const stalled = runEndpoint(endpoint, async () => new Response(new ReadableStream({ + start(streamController) { + setImmediate(() => { + if (!streamCancelled) streamController.enqueue(new TextEncoder().encode('{')); + bodyStarted(); + }); + }, + cancel() { streamCancelled = true; cancelled += 1; }, + }), { headers: { 'Content-Type': 'application/json' } }), controller.signal); + await started; + controller.abort('caller stopped operation'); + await assert.rejects(bounded(stalled), (error: unknown) => + error instanceof ProprClientError && error.kind === 'aborted'); + assert.equal(cancelled, 1); + }); + + it(`${endpoint} aborts a headers stall and redacts empty or HTML HTTP errors`, async () => { + const controller = new AbortController(); + let headerStarted!: () => void; + const started = new Promise(resolve => { headerStarted = resolve; }); + const stalled = runEndpoint(endpoint, async (_input, init) => new Promise((_resolve, reject) => { + headerStarted(); + init?.signal?.addEventListener('abort', () => reject(new DOMException('secret', 'AbortError')), { once: true }); + }), controller.signal); + await started; + controller.abort(); + await assert.rejects(bounded(stalled), (error: unknown) => + error instanceof ProprClientError && error.kind === 'aborted'); + + for (const response of [ + new Response(null, { status: 502 }), + new Response('

private upstream detail

', { + status: 502, + headers: { 'Content-Type': 'text/html' }, + }), + new Response('{', { status: 502, headers: { 'Content-Type': 'application/json' } }), + ]) { + await assert.rejects(runEndpoint(endpoint, async () => response), (error: unknown) => + error instanceof ProprClientError + && error.kind === 'http' + && error.status === 502 + && error.code === undefined + && !error.message.includes('private')); + } + }); + } + + for (const endpoint of ['start', 'poll', 'activate', 'cancel'] as const) { + it(`${endpoint} enforces automatic header, body, slowloris, and overall deadlines`, async () => { + { + const clock = new ProtocolClock(); + let networkSignal: AbortSignal | undefined; + const operation = protocolRequest(endpoint, async (_input, init) => { + networkSignal = init?.signal ?? undefined; + return new Promise(() => undefined); + }, clock, { + overallTimeoutMs: 40, + deadlines: { headerMs: 10, bodyMs: 10, cancellationMs: 5 }, + }); + await clock.advance(9); + assert.equal(networkSignal?.aborted, false); + await clock.advance(1); + await assert.rejects(operation, timeoutKind); + assert.equal(networkSignal?.aborted, true); + assert.equal(clock.pending, 0); + } + + for (const firstChunk of [undefined, new Uint8Array([0x7b])]) { + const clock = new ProtocolClock(); + let networkSignal: AbortSignal | undefined; + let cancelled = 0; + const operation = protocolRequest(endpoint, async (_input, init) => { + networkSignal = init?.signal ?? undefined; + return new Response(new ReadableStream({ + start(controller) { if (firstChunk) controller.enqueue(firstChunk); }, + cancel() { cancelled += 1; }, + }), { headers: { 'Content-Type': 'application/json' } }); + }, clock, { + overallTimeoutMs: 40, + deadlines: { headerMs: 20, bodyMs: 10, cancellationMs: 5 }, + }); + await clock.advance(0); + await clock.advance(10); + await assert.rejects(operation, timeoutKind); + assert.equal(networkSignal?.aborted, true); + assert.equal(cancelled, 1); + assert.equal(clock.pending, 0); + } + + { + const clock = new ProtocolClock(); + let networkSignal: AbortSignal | undefined; + const operation = protocolRequest(endpoint, async (_input, init) => { + networkSignal = init?.signal ?? undefined; + return new Promise(() => undefined); + }, clock, { + overallTimeoutMs: 10, + deadlines: { headerMs: 20, bodyMs: 20, cancellationMs: 5 }, + }); + await clock.advance(10); + await assert.rejects(operation, timeoutKind); + assert.equal(networkSignal?.aborted, true); + assert.equal(clock.pending, 0); + } + }); + + it(`${endpoint} bounds never-settling reader cancellation and ignores every late callback`, async () => { + const clock = new ProtocolClock(); + let networkSignal: AbortSignal | undefined; + let cancelReject!: (error: Error) => void; + const cancellation = new Promise((_resolve, reject) => { cancelReject = reject; }); + let cancelCalls = 0; + const diagnostics: string[] = []; + const unhandled: unknown[] = []; + const onUnhandled = (error: unknown): void => { unhandled.push(error); }; + process.on('unhandledRejection', onUnhandled); + try { + const operation = protocolRequest(endpoint, async (_input, init) => { + networkSignal = init?.signal ?? undefined; + return new Response(new ReadableStream({ + cancel() { + cancelCalls += 1; + return cancellation; + }, + }), { headers: { 'Content-Type': 'application/json' } }); + }, clock, { + overallTimeoutMs: 40, + deadlines: { headerMs: 20, bodyMs: 10, cancellationMs: 5 }, + reportDiagnostic: message => { diagnostics.push(message); }, + }); + await clock.advance(0); + await clock.advance(10); + assert.equal(clock.pending, 1); + await clock.advance(5); + await assert.rejects(operation, timeoutKind); + assert.equal(networkSignal?.aborted, true); + assert.equal(cancelCalls, 1); + assert.deepEqual(diagnostics, [ + 'ProPR pairing response cancellation exceeded its fixed deadline.', + ]); + assert.equal(clock.pending, 0); + + cancelReject(new Error('private late cancellation failure')); + await new Promise(resolve => setImmediate(resolve)); + assert.equal(cancelCalls, 1); + assert.equal(clock.pending, 0); + assert.equal(diagnostics.length, 1); + assert.deepEqual(unhandled, []); + } finally { + process.removeListener('unhandledRejection', onUnhandled); + } + }); + } + + it('bounds a never-settling response.body.cancel before a reader exists', async () => { + const clock = new ProtocolClock(); + let networkSignal: AbortSignal | undefined; + let rejectCancellation!: (error: Error) => void; + const diagnostics: string[] = []; + const response = new Response(new ReadableStream({ + cancel() { + return new Promise((_resolve, reject) => { rejectCancellation = reject; }); + }, + }), { + headers: { + 'Content-Type': 'application/json', + 'Content-Length': '4097', + }, + }); + const operation = protocolRequest('activate', async (_input, init) => { + networkSignal = init?.signal ?? undefined; + return response; + }, clock, { + overallTimeoutMs: 40, + deadlines: { headerMs: 20, bodyMs: 20, cancellationMs: 5 }, + reportDiagnostic: message => { diagnostics.push(message); }, + }); + await clock.advance(0); + assert.equal(clock.pending, 1); + await clock.advance(5); + await assert.rejects(operation, (error: unknown) => + error instanceof ProprClientError && error.kind === 'invalid_response'); + assert.equal(networkSignal?.aborted, true); + assert.equal(clock.pending, 0); + assert.equal(diagnostics.length, 1); + rejectCancellation(new Error('private late body cancellation failure')); + await new Promise(resolve => setImmediate(resolve)); + }); + + it('makes exact header, body, overall, and cancellation boundaries terminal', async () => { + { + const clock = new ProtocolClock(); + let signal: AbortSignal | undefined; + const operation = protocolRequest('start', async (_input, init) => { + signal = init?.signal ?? undefined; + return new Promise(resolve => { + clock.source.setTimeout(() => resolve(jsonResponse(successBody('start'))), 10); + }); + }, clock, { + overallTimeoutMs: 40, + deadlines: { headerMs: 10, bodyMs: 20, cancellationMs: 5 }, + }); + await clock.advance(10); + await assert.rejects(operation, timeoutKind); + assert.equal(signal?.aborted, true); + assert.equal(clock.pending, 0); + } + + for (const overallWins of [false, true]) { + const clock = new ProtocolClock(); + let signal: AbortSignal | undefined; + let bodyController!: ReadableStreamDefaultController; + const operation = protocolRequest('activate', async (_input, init) => { + signal = init?.signal ?? undefined; + return new Response(new ReadableStream({ + start(controller) { bodyController = controller; }, + }), { headers: { 'Content-Type': 'application/json' } }); + }, clock, { + overallTimeoutMs: overallWins ? 10 : 40, + deadlines: { headerMs: 20, bodyMs: overallWins ? 20 : 10, cancellationMs: 5 }, + }); + await clock.advance(0); + clock.source.setTimeout(() => { + if (signal?.aborted) return; + bodyController.enqueue(new TextEncoder().encode(JSON.stringify(successBody('activate')))); + bodyController.close(); + }, 10); + await clock.advance(10); + await assert.rejects(operation, timeoutKind); + assert.equal(signal?.aborted, true); + assert.equal(clock.pending, 0); + } + + { + const clock = new ProtocolClock(); + const diagnostics: string[] = []; + const operation = protocolRequest('cancel', async () => new Response( + new ReadableStream({ cancel: () => new Promise(() => undefined) }), + { headers: { 'Content-Type': 'application/json' } }, + ), clock, { + overallTimeoutMs: 10, + deadlines: { headerMs: 20, bodyMs: 8, cancellationMs: 5 }, + reportDiagnostic: message => { diagnostics.push(message); }, + }); + await clock.advance(0); + await clock.advance(8); + assert.equal(clock.pending, 1); + await clock.advance(2); + await assert.rejects(operation, timeoutKind); + assert.equal(clock.now, 10); + assert.equal(clock.pending, 0); + assert.equal(diagnostics.length, 1); + } + }); +}); + +const servers: Server[] = []; +afterEach(async () => { + await Promise.all(servers.splice(0).map(server => new Promise((resolve, reject) => { + server.close(error => error ? reject(error) : resolve()); + }))); +}); + +const listen = async (handler: Parameters[0]): Promise<{ server: Server; origin: string }> => { + const server = createServer(handler); + servers.push(server); + await new Promise((resolve, reject) => { + server.once('error', reject); + server.listen(0, '127.0.0.1', resolve); + }); + const address = server.address() as AddressInfo; + return { server, origin: `http://127.0.0.1:${address.port}` }; +}; + +describe('pairing redirect fencing', () => { + it('never replays any pairing endpoint across origins on 307 or 308', async () => { + const received: string[] = []; + const receiver = await listen((request, response) => { + let body = ''; + request.setEncoding('utf8'); + request.on('data', chunk => { body += String(chunk); }); + request.on('end', () => { + received.push(`${request.url}\n${JSON.stringify(request.headers)}\n${body}`); + response.end(); + }); + }); + let redirectStatus = 307; + const source = await listen((_request, response) => { + response.writeHead(redirectStatus, { Location: `${receiver.origin}/captured` }); + response.end(); + }); + + for (redirectStatus of [307, 308]) { + for (const endpoint of ['start', 'poll', 'activate', 'cancel'] as const) { + await assert.rejects(runEndpoint(endpoint, globalThis.fetch, undefined, source.origin), (error: unknown) => + error instanceof ProprClientError && error.kind === 'invalid_response'); + } + } + await new Promise(resolve => setImmediate(resolve)); + assert.deepEqual(received, []); + const receiverDump = received.join('\n'); + for (const material of [deviceSecret, pairingId, activationTicket, token, 'Bearer', binding.instanceId]) { + assert.equal(receiverDump.includes(material), false); + } + }); + + it('rejects absolute, relative, missing, and looping same-origin redirects without replay', async () => { + let requests = 0; + let location: string | undefined; + let origin = ''; + const source = await listen((_request, response) => { + requests += 1; + const headers = location === undefined ? {} : { Location: location }; + response.writeHead(307, headers); + response.end(); + }); + origin = source.origin; + + for (const nextLocation of [`${origin}/absolute`, '/relative', undefined, '/loop']) { + location = nextLocation; + const before = requests; + await assert.rejects(runEndpoint('activate', globalThis.fetch, undefined, origin), (error: unknown) => + error instanceof ProprClientError && error.kind === 'invalid_response'); + assert.equal(requests, before + 1); + } + }); +}); diff --git a/packages/core/src/db/migrations/20260830000000_add_two_phase_desktop_pairing.js b/packages/core/src/db/migrations/20260830000000_add_two_phase_desktop_pairing.js new file mode 100644 index 000000000..ec00d8358 --- /dev/null +++ b/packages/core/src/db/migrations/20260830000000_add_two_phase_desktop_pairing.js @@ -0,0 +1,56 @@ +/** + * Make desktop credentials unusable until the desktop confirms that encrypted + * rollback material is durable. Existing active credentials remain active; + * only credentials issued by the new pairing protocol begin provisional. + */ +export async function up(knex) { + await knex.schema.alterTable('desktop_pairing_requests', (table) => { + table.text('requested_instance_id').nullable(); + table.text('requested_origin').nullable(); + table.text('requested_scope').nullable(); + table.text('credential_generation').nullable(); + table.text('provisional_token_id').nullable(); + table.text('activation_ticket_hash').nullable(); + table.text('activation_receipt').nullable(); + table.timestamp('activation_expires_at').nullable(); + table.timestamp('activated_at').nullable(); + table.timestamp('cancelled_at').nullable(); + }); + await knex.schema.alterTable('instance_api_tokens', (table) => { + table.text('activation_state').notNullable().defaultTo('active'); + table.text('pairing_id').nullable(); + table.text('bound_instance_id').nullable(); + table.text('bound_origin').nullable(); + table.text('bound_scope').nullable(); + table.text('credential_generation').nullable(); + table.index(['activation_state', 'expires_at']); + }); +} + +export async function down(knex) { + await knex.schema.alterTable('instance_api_tokens', (table) => { + table.dropIndex(['activation_state', 'expires_at']); + table.dropColumns( + 'activation_state', + 'pairing_id', + 'bound_instance_id', + 'bound_origin', + 'bound_scope', + 'credential_generation', + ); + }); + await knex.schema.alterTable('desktop_pairing_requests', (table) => { + table.dropColumns( + 'requested_instance_id', + 'requested_origin', + 'requested_scope', + 'credential_generation', + 'provisional_token_id', + 'activation_ticket_hash', + 'activation_receipt', + 'activation_expires_at', + 'activated_at', + 'cancelled_at', + ); + }); +} diff --git a/packages/core/test/desktopTwoPhaseAuthMigration.test.ts b/packages/core/test/desktopTwoPhaseAuthMigration.test.ts new file mode 100644 index 000000000..384673168 --- /dev/null +++ b/packages/core/test/desktopTwoPhaseAuthMigration.test.ts @@ -0,0 +1,42 @@ +import assert from 'node:assert/strict'; +import test from 'node:test'; +import knex from 'knex'; +import { up as createDesktopAuth } from '../src/db/migrations/20260829000000_create_desktop_auth.js'; +import { + down as rollbackTwoPhaseDesktopAuth, + up as addTwoPhaseDesktopAuth, +} from '../src/db/migrations/20260830000000_add_two_phase_desktop_pairing.js'; + +test('adds two-phase state without changing existing active credentials and rolls it back', async () => { + const database = knex({ + client: 'better-sqlite3', + connection: { filename: ':memory:' }, + useNullAsDefault: true, + }); + try { + await createDesktopAuth(database); + await database('instance_api_tokens').insert({ + id: 'token-id', + token_hash: 'hash', + token_hint: 'hint', + name: 'Existing desktop', + owner_github_user_id: '1', + owner_github_username: 'owner', + owner_display_name: 'Owner', + created_at: '2026-08-30T00:00:00.000Z', + }); + + await addTwoPhaseDesktopAuth(database); + const migrated = await database('instance_api_tokens').where({ id: 'token-id' }).first(); + assert.equal(migrated.activation_state, 'active'); + assert.equal(migrated.pairing_id, null); + assert.equal(await database.schema.hasColumn('desktop_pairing_requests', 'activation_ticket_hash'), true); + + await rollbackTwoPhaseDesktopAuth(database); + assert.equal(await database.schema.hasColumn('instance_api_tokens', 'activation_state'), false); + assert.equal(await database.schema.hasColumn('desktop_pairing_requests', 'activation_ticket_hash'), false); + assert.notEqual(await database('instance_api_tokens').where({ id: 'token-id' }).first(), undefined); + } finally { + await database.destroy(); + } +}); diff --git a/packages/local-setup/src/agents.ts b/packages/local-setup/src/agents.ts index 2f58936e2..bb3821ea5 100644 --- a/packages/local-setup/src/agents.ts +++ b/packages/local-setup/src/agents.ts @@ -22,6 +22,12 @@ */ import { AGENT_DEFAULTS, type AgentType } from "@propr/shared"; +import { rethrowCancellation } from "./cancellation.js"; + +export interface RootOperationBoundary { + rootOperationsDir?: string; + assertRootAuthority?(): void; +} /** Minimal backend agent shape needed by the setup engine. */ export interface AgentConfig { @@ -59,15 +65,15 @@ export interface AgentConnectivityResult { */ export interface AgentSetupActions { /** List the agents currently configured in the running backend. */ - listAgents(rootDir: string): Promise; + listAgents(rootDir: string, signal?: AbortSignal, root?: RootOperationBoundary): Promise; /** Add a new agent to the backend configuration. */ - addAgent(rootDir: string, options: AddAgentOptions): Promise; + addAgent(rootDir: string, options: AddAgentOptions, signal?: AbortSignal, root?: RootOperationBoundary): Promise; /** Agent types that support an interactive image login (have a login plan). */ - loginableAgents(): Promise; + loginableAgents(signal?: AbortSignal): Promise; /** Authenticate one agent through its image; interactive (inherits stdio). */ - loginAgent(rootDir: string, type: string): Promise; + loginAgent(rootDir: string, type: string, signal?: AbortSignal, root?: RootOperationBoundary): Promise; /** Run a live, image-only request that mirrors the worker credential mount. */ - validateAgents(rootDir: string, types: string[]): Promise; + validateAgents(rootDir: string, types: string[], signal?: AbortSignal, root?: RootOperationBoundary): Promise; } /** Inputs for {@link runAgentSetup}. */ @@ -82,6 +88,7 @@ export interface AgentSetupParams { */ confirmLogin?(ctx: { candidates: string[]; rootDir: string }): Promise; onLog?(line: string): void; + signal?: AbortSignal; } /** What the agent-setup step did, for the caller to render as a step status. */ @@ -111,7 +118,7 @@ export interface AgentSetupOutcome { * the caller can settle the step as a warning rather than aborting setup. */ export async function runAgentSetup(params: AgentSetupParams): Promise { - const { rootDir, selectedAgents, actions, confirmLogin, onLog } = params; + const { rootDir, selectedAgents, actions, confirmLogin, onLog, signal } = params; const outcome: AgentSetupOutcome = { added: [], alreadyConfigured: [], @@ -129,8 +136,10 @@ export async function runAgentSetup(params: AgentSetupParams): Promise agent.type)); for (const type of selectedAgents) { + signal?.throwIfAborted(); if (configuredTypes.has(type as AgentType)) { outcome.alreadyConfigured.push(type); continue; @@ -156,10 +166,12 @@ export async function runAgentSetup(params: AgentSetupParams): Promise; + signal?.throwIfAborted(); try { - loginable = new Set(await actions.loginableAgents()); + loginable = new Set(await actions.loginableAgents(signal)); + signal?.throwIfAborted(); } catch (error) { + rethrowCancellation(error); outcome.errors.push(`could not determine which agents support image login: ${(error as Error).message}`); loginable = new Set(); } @@ -179,6 +194,7 @@ export async function runAgentSetup(params: AgentSetupParams): Promise { + test(`the setup engine rejects ${platform} before reporter or host actions`, async () => { let checksRun = false; + let reports = 0; const actions = { runChecks: async () => { checksRun = true; @@ -37,12 +38,13 @@ for (const platform of ["darwin", "win32"] as const) { }; }, } as unknown as SetupActions; - const result = await runSetup({ root: "/stack", platform, actions }); + const result = await runSetup({ root: "/stack", platform, actions, reporter: { onState: () => { reports += 1; } } }); - assert.equal(checksRun, true); + assert.equal(checksRun, false); + assert.equal(reports, 0); assert.equal(result.completed, false); assert.equal(result.capability.kind, "remote-only"); - assert.notEqual(result.errors[0]?.code, "local-unsupported"); + assert.equal(result.errors[0]?.code, "local-unsupported"); }); } diff --git a/packages/local-setup/src/engine.ts b/packages/local-setup/src/engine.ts index ac19ddf67..f6c37a2cf 100644 --- a/packages/local-setup/src/engine.ts +++ b/packages/local-setup/src/engine.ts @@ -51,7 +51,9 @@ import { import { runAgentSetup, type AgentSetupActions, + type RootOperationBoundary, } from "./agents.js"; +import { isSetupCancellation } from "./cancellation.js"; import { createSetupState, getStep, @@ -340,6 +342,10 @@ export interface InitStackResult { export interface PullImagesParams { rootDir: string; + /** Descriptor-anchored root used only to read configuration. */ + rootOperationsDir?: string; + /** Revalidate fixed-root identity at every external mutation boundary. */ + assertRootAuthority?(): void; /** Agent types whose images should be pulled (in addition to core images). */ agentTypes: string[]; onLog?: (line: string) => void; @@ -357,14 +363,20 @@ export interface PullImagesResult { export interface StartStackParams { rootDir: string; + /** Main-process-only anchored path used to read setup files, never mounted. */ + rootOperationsDir?: string; ui?: boolean; docs?: boolean; onLog?: (line: string) => void; signal?: AbortSignal; + /** Main-process authority check invoked at each Docker container handoff. */ + assertRootAuthority?(): void; } export interface BackendHealthParams { rootDir: string; + rootOperationsDir?: string; + assertRootAuthority?(): void; timeoutMs?: number; signal?: AbortSignal; } @@ -401,9 +413,9 @@ export function classifyBackendAccessError(error: unknown): BackendHealth | unde */ export interface SetupActions extends AgentSetupActions { runChecks(options: RunChecksOptions): Promise; - inspectStackInit(rootDir: string): StackInitState; + inspectStackInit(rootDir: string, signal?: AbortSignal): StackInitState; /** Inspect the configured datastore's durable administrator state without modifying it. */ - inspectDatastoreAdministrators(rootDir: string): Promise; + inspectDatastoreAdministrators(rootDir: string, signal?: AbortSignal): Promise; scaffoldStack(options: InitStackOptions): Promise; /** * Persist the resolved stack root to the CLI config so later `propr start` / @@ -412,36 +424,37 @@ export interface SetupActions extends AgentSetupActions { * already-initialized root that setup leaves untouched), which would otherwise * leave config pointing at a stale root or the cwd. A no-op without a config. */ - persistStackRoot(rootDir: string): Promise; - readEnvVars(rootDir: string): Record; - applyEnvSelection(rootDir: string, vars: Record, opts?: { overwrite?: boolean }): EnvSelectionResult; + persistStackRoot(rootDir: string, signal?: AbortSignal): Promise; + readEnvVars(rootDir: string, signal?: AbortSignal): Record; + applyEnvSelection(rootDir: string, vars: Record, opts?: { overwrite?: boolean }, signal?: AbortSignal): EnvSelectionResult; /** Remove keys from `.env` entirely (used to clear a value, not blank it). */ - clearEnvKeys(rootDir: string, keys: string[]): void; - detectGithubAuthMode(rootDir: string): GithubAuthModeResult; + clearEnvKeys(rootDir: string, keys: string[], signal?: AbortSignal): void; + detectGithubAuthMode(rootDir: string, signal?: AbortSignal): GithubAuthModeResult; /** Ensure a selected agent's host credential path is a directory, creating it securely when absent. */ - prepareAgentCredentialDir(path: string): void; + prepareAgentCredentialDir(path: string, signal?: AbortSignal): void; pullImages(params: PullImagesParams): Promise; - isStackRunning(rootDir: string): Promise; + isStackRunning(rootDir: string, signal?: AbortSignal, root?: RootOperationBoundary): Promise; startStack(params: StartStackParams): Promise; checkBackendHealth(params: BackendHealthParams): Promise; - addRepository(selection: RepoSelection, rootDir: string): Promise; - resolveUiUrl(rootDir: string): Promise; + addRepository(selection: RepoSelection, rootDir: string, signal?: AbortSignal, root?: RootOperationBoundary): Promise; + resolveUiUrl(rootDir: string, signal?: AbortSignal, root?: RootOperationBoundary): Promise; /** Open `url` in the host's default browser (best-effort; may reject). */ - openUrl(url: string): Promise; + openUrl(url: string, signal?: AbortSignal): Promise; /** * Save the user whitelist through the running backend's settings API. A * partial update — only the whitelist key is sent, so unrelated settings are * left intact. */ - saveWhitelistSetting(rootDir: string, users: string[]): Promise; + saveWhitelistSetting(rootDir: string, users: string[], signal?: AbortSignal, root?: RootOperationBoundary): Promise; /** True when a GitHub user token is stored (relay enrollment and protected local API calls need it). */ - hasGithubToken(): boolean; + hasGithubToken(signal?: AbortSignal): boolean; /** * List the relay installations the stored GitHub identity can access (drives * auto-select / the picker during relay enrollment). Throws if not logged in. */ fetchRelayInstallations(params: { relayUrl?: string; + signal?: AbortSignal; }): Promise<{ username: string; installations: AuthorizedInstallation[] }>; /** * Mint a relay token for `installationId`, returning the token and the relay @@ -451,11 +464,12 @@ export interface SetupActions extends AgentSetupActions { relayUrl?: string; installationId: string; label?: string; + signal?: AbortSignal; }): Promise<{ relayUrl: string; token: string }>; /** Authenticate with GitHub via the interactive `gh` CLI and store the token. */ - loginWithGithub(params?: { onLog?: (line: string) => void }): Promise; + loginWithGithub(params?: { onLog?: (line: string) => void; signal?: AbortSignal }): Promise; /** Host preference used to select managed browser authentication. */ - getTunnelEnabled?(rootDir: string): boolean | undefined; + getTunnelEnabled?(rootDir: string, signal?: AbortSignal): boolean | undefined; } /** Options for {@link runSetup}. */ @@ -555,7 +569,7 @@ async function runSetupAttempt(options: RunSetupOptions): Promise getStep(state, id)!; - const begin = (id: SetupStepId): void => { + const checkCancelled = (): void => { if (options.signal?.aborted) { state = { ...state, @@ -565,6 +579,21 @@ async function runSetupAttempt(options: RunSetupOptions): Promise { + // A cancelled startup with residual run-owned containers is not a clean + // cancellation. Preserve the orchestrator's explicit failure so callers + // can require operator attention instead of reporting cancellation done. + if (error && typeof error === "object" + && (error as { code?: unknown }).code === "PROPR_SETUP_CLEANUP_INCOMPLETE") { + throw error; + } + if (!isSetupCancellation(error)) return; + checkCancelled(); + throw error; + }; + const begin = (id: SetupStepId): void => { + checkCancelled(); state = updateStep(state, id, { status: "active", detail: undefined, nextAction: undefined }); emit(); const step = safeStep(stepOf(id)); @@ -622,12 +651,15 @@ async function runSetupAttempt(options: RunSetupOptions): Promise a.type), detected }) : detected; + checkCancelled(); // Guard the engine boundary: a renderer may hand back unknown or duplicate // agent names. Keep only types we know about, de-duped (first occurrence // wins), so unknown names never reach pullImages() and a duplicate can't @@ -896,6 +948,7 @@ async function runSetupAttempt(options: RunSetupOptions): Promise known.has(type)); const pull = await actions.pullImages({ rootDir, agentTypes: selectedAgents, onLog: log, signal: options.signal }); + checkCancelled(); if (pull.failedCore.length > 0) { settle("pull-images", { status: "failed", @@ -915,6 +968,7 @@ async function runSetupAttempt(options: RunSetupOptions): Promise = {}; - const existingEnv = actions.readEnvVars(rootDir); + const existingEnv = actions.readEnvVars(rootDir, options.signal); for (const type of selectedAgents) { const desc = catalog.find((a) => a.type === type); if (!desc) continue; @@ -947,17 +1001,19 @@ async function runSetupAttempt(options: RunSetupOptions): Promise 0 ? `recorded ${applied.written.length} credential dir(s)` : "no new credentials to record"); if (applied.skipped.length > 0) detailParts.push(`${applied.skipped.length} already set`); settle("configure-agents", { status: "done", detail: detailParts.join("; ") }); } } catch (error) { + rethrowIfCancelled(error); settle("configure-agents", { status: "failed", detail: `could not record agent credentials: ${(error as Error).message}`, @@ -978,20 +1034,25 @@ async function runSetupAttempt(options: RunSetupOptions): Promise 0) { - actions.applyEnvSelection(rootDir, authDecision.vars, { overwrite: true }); + checkCancelled(); + actions.applyEnvSelection(rootDir, authDecision.vars, { overwrite: true }, options.signal); } resolvedAuth = relayDoneDetail ? { mode: "relay", warnings: [] } - : actions.detectGithubAuthMode(rootDir); + : actions.detectGithubAuthMode(rootDir, options.signal); } catch (error) { + rethrowIfCancelled(error); settle("github-auth", { status: "failed", detail: `could not configure GitHub auth: ${(error as Error).message}`, @@ -1017,10 +1078,10 @@ async function runSetupAttempt(options: RunSetupOptions): Promise - (actions.readEnvVars(rootDir).PROPR_ADMIN_USERS ?? "") + (actions.readEnvVars(rootDir, options.signal).PROPR_ADMIN_USERS ?? "") .split(",") .map((value) => value.trim()) .filter(Boolean); @@ -1032,15 +1093,17 @@ async function runSetupAttempt(options: RunSetupOptions): Promise String(installation.installation_id) === installationId @@ -1061,12 +1124,14 @@ async function runSetupAttempt(options: RunSetupOptions): Promise s.trim()).filter(Boolean); const demoMode = resolvedAuth.mode === "demo"; let whitelist: string[] | null = null; - if (prompts.configureWhitelist) whitelist = await prompts.configureWhitelist({ current: currentWhitelist, demoMode }); + if (prompts.configureWhitelist) { + whitelist = await prompts.configureWhitelist({ current: currentWhitelist, demoMode }); + checkCancelled(); + } if (whitelist !== null) { // Trim, drop blanks, and de-dupe (first occurrence wins) so the value // matches saveWhitelist's "cleaned, de-duped usernames" contract — a @@ -1342,11 +1424,12 @@ async function runSetupAttempt(options: RunSetupOptions): Promise actions.saveWhitelistSetting(rootDir, users), + saveViaSettings: (users) => actions.saveWhitelistSetting(rootDir, users, options.signal), saveViaEnv: (users) => { // A non-empty list is written; clearing to "none" must *remove* the key // rather than blank it. applyEnvSelection ignores blank values (so it @@ -1354,12 +1437,14 @@ async function runSetupAttempt(options: RunSetupOptions): Promise 0) { - actions.applyEnvSelection(rootDir, { GITHUB_USER_WHITELIST: users.join(",") }, { overwrite: true }); + actions.applyEnvSelection(rootDir, { GITHUB_USER_WHITELIST: users.join(",") }, { overwrite: true }, options.signal); } else { - actions.clearEnvKeys(rootDir, ["GITHUB_USER_WHITELIST"]); + actions.clearEnvKeys(rootDir, ["GITHUB_USER_WHITELIST"], options.signal); } }, + signal: options.signal, }); + checkCancelled(); const where = saved.target === "settings" ? "via settings API" : "in .env"; const summary = cleaned.length > 0 ? `${cleaned.length} user(s) allowed (${where})` : `whitelist cleared (${where})`; if (saved.error) { @@ -1383,6 +1468,7 @@ async function runSetupAttempt(options: RunSetupOptions): Promise { + const capability = getLocalSetupCapability(options.platform); + if (!capability.supported) { + const rootDir = resolve(options.root ?? process.cwd()); + return { + rootDir, + state: createSetupState(rootDir), + capability, + completed: false, + cancelled: false, + errors: [{ code: "local-unsupported", message: capability.reason, retryable: false }], + }; + } try { return await runSetupAttempt(options); } catch (error) { diff --git a/packages/local-setup/src/envFile.ts b/packages/local-setup/src/envFile.ts index 963504b14..557c2b680 100644 --- a/packages/local-setup/src/envFile.ts +++ b/packages/local-setup/src/envFile.ts @@ -9,13 +9,13 @@ * literally and must fit on one line. */ -import { chmodSync, existsSync, readFileSync, statSync, writeFileSync } from "node:fs"; +import { readPrivateFile, writePrivateFileAtomic } from "./privateFilesystem.js"; function escapeRegExp(value: string): string { return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); } -export function upsertEnvVars(envPath: string, vars: Record): void { +export function upsertEnvVars(envPath: string, vars: Record, signal?: AbortSignal): void { for (const [key, value] of Object.entries(vars)) { if (/[\r\n]/.test(value)) { throw new Error(`${key} cannot contain newlines; Docker --env-file only supports one KEY=VALUE assignment per line.`); @@ -30,7 +30,8 @@ export function upsertEnvVars(envPath: string, vars: Record): vo } } - const raw = existsSync(envPath) ? readFileSync(envPath, "utf-8") : ""; + const previous = readPrivateFile(envPath); + const raw = previous?.toString("utf-8") ?? ""; const lines = raw.split(/\r?\n/); // Drop trailing blank lines so appends stay tidy; we re-add one newline at the end. @@ -50,24 +51,7 @@ export function upsertEnvVars(envPath: string, vars: Record): vo } } - const isNew = !existsSync(envPath); - let tightenedFrom: number | null = null; - if (!isNew) { - try { - const before = statSync(envPath).mode & 0o777; - if (before !== 0o600) { - chmodSync(envPath, 0o600); - tightenedFrom = before; - } - } catch { - // Best-effort — may fail on Windows or non-owned files. - } - } - - writeFileSync(envPath, `${lines.join("\n")}\n`, { encoding: "utf-8", mode: isNew ? 0o600 : undefined }); - if (tightenedFrom !== null) { - console.warn(`Note: tightened ${envPath} permissions from ${tightenedFrom.toString(8)} to 600 (secrets file).`); - } + writePrivateFileAtomic(envPath, `${lines.join("\n")}\n`, { signal }); } /** @@ -86,32 +70,19 @@ export function upsertEnvVars(envPath: string, vars: Record): vo * switching auth/intake modes) use this so the value does not silently return on * the next read or restart. */ -export function clearEnvKeys(envPath: string, keys: string[]): void { - if (keys.length === 0 || !existsSync(envPath)) return; +export function clearEnvKeys(envPath: string, keys: string[], signal?: AbortSignal): void { + if (keys.length === 0) return; - const lines = readFileSync(envPath, "utf-8").split(/\r?\n/); + const previous = readPrivateFile(envPath); + if (!previous) return; + const lines = previous.toString("utf-8").split(/\r?\n/); const patterns = keys.map((key) => new RegExp(`^\\s*(export\\s+)?${escapeRegExp(key)}\\s*=`)); const kept = lines.filter((line) => !patterns.some((pattern) => pattern.test(line))); // Nothing matched → leave the file (and its mode) untouched. if (kept.length === lines.length) return; - // Tighten permissions like upsertEnvVars does — this is still the secrets file. - let tightenedFrom: number | null = null; - try { - const before = statSync(envPath).mode & 0o777; - if (before !== 0o600) { - chmodSync(envPath, 0o600); - tightenedFrom = before; - } - } catch { - // Best-effort — may fail on Windows or non-owned files. - } - // Drop trailing blank lines, then re-add exactly one terminating newline. while (kept.length > 0 && kept[kept.length - 1] === "") kept.pop(); - writeFileSync(envPath, `${kept.join("\n")}\n`, "utf-8"); - if (tightenedFrom !== null) { - console.warn(`Note: tightened ${envPath} permissions from ${tightenedFrom.toString(8)} to 600 (secrets file).`); - } + writePrivateFileAtomic(envPath, `${kept.join("\n")}\n`, { signal }); } diff --git a/packages/local-setup/src/github.ts b/packages/local-setup/src/github.ts index ede47e447..0bfdb9749 100644 --- a/packages/local-setup/src/github.ts +++ b/packages/local-setup/src/github.ts @@ -34,6 +34,7 @@ */ import type { GithubAuthMode, GithubEventIntakeMode } from "@propr/shared"; +import { rethrowCancellation } from "./cancellation.js"; /** * How the backend ingests GitHub events. Aliased to the shared @@ -238,6 +239,8 @@ export interface SaveWhitelistParams { saveViaSettings(users: string[]): Promise; /** Persist into `.env` (non-destructive, single key). */ saveViaEnv(users: string[]): void; + /** Abort is observed before each persistence commit and never triggers fallback. */ + signal?: AbortSignal; } /** @@ -250,20 +253,25 @@ export interface SaveWhitelistParams { * unrelated settings are never overwritten. */ export async function saveWhitelist(params: SaveWhitelistParams): Promise { - const { users, backendRunning, saveViaSettings, saveViaEnv } = params; + const { users, backendRunning, saveViaSettings, saveViaEnv, signal } = params; + signal?.throwIfAborted(); if (backendRunning) { try { await saveViaSettings(users); + signal?.throwIfAborted(); // Mirror into `.env` so the whitelist persists across `propr start`. saveViaEnv(users); return { target: "settings", count: users.length }; } catch (error) { + rethrowCancellation(error); + signal?.throwIfAborted(); // The backend rejected the update (or was unreachable after all) — keep // the value in `.env` so it is not lost, and surface why. saveViaEnv(users); return { target: "env", count: users.length, error: (error as Error).message }; } } + signal?.throwIfAborted(); saveViaEnv(users); return { target: "env", count: users.length }; } diff --git a/packages/local-setup/src/index.ts b/packages/local-setup/src/index.ts index b0599dc8d..78f8057dd 100644 --- a/packages/local-setup/src/index.ts +++ b/packages/local-setup/src/index.ts @@ -1,5 +1,7 @@ export * from "./agents.js"; +export * from "./cancellation.js"; export * from "./engine.js"; export * from "./github.js"; +export * from "./privateFilesystem.js"; export * from "./state.js"; export * from "./types.js"; diff --git a/packages/local-setup/src/privateFilesystem.ts b/packages/local-setup/src/privateFilesystem.ts new file mode 100644 index 000000000..d63f6399f --- /dev/null +++ b/packages/local-setup/src/privateFilesystem.ts @@ -0,0 +1,195 @@ +import { randomBytes } from "node:crypto"; +import { + chmodSync, + closeSync, + constants, + fstatSync, + fchmodSync, + fsyncSync, + lstatSync, + mkdirSync, + openSync, + readFileSync, + realpathSync, + renameSync, + unlinkSync, + writeSync, + type Stats, +} from "node:fs"; +import { dirname, isAbsolute, join, parse, resolve } from "node:path"; + +export const PRIVATE_DIRECTORY_MODE = 0o700; +export const PRIVATE_FILE_MODE = 0o600; +const O_CLOEXEC = (constants as unknown as Record).O_CLOEXEC ?? (process.platform === 'linux' ? 0o2000000 : 0); + +interface DescriptorRoot { + descriptor: number; + root: string; + suffix: string[]; +} + +/** Recognize only this process's explicit Linux descriptor paths. */ +function descriptorRootFor(targetPath: string): DescriptorRoot | undefined { + if (process.platform !== "linux") return undefined; + const absolute = resolve(targetPath); + const prefix = `/proc/${process.pid}/fd/`; + if (!absolute.startsWith(prefix)) return undefined; + const [descriptorText, ...suffix] = absolute.slice(prefix.length).split("/").filter(Boolean); + if (!descriptorText || !/^(?:0|[1-9][0-9]*)$/.test(descriptorText)) return undefined; + const descriptor = Number(descriptorText); + const opened = fstatSync(descriptor); + if (!opened.isDirectory()) throw new Error("Descriptor-root path is not anchored to a directory"); + return { descriptor, root: `${prefix}${descriptorText}`, suffix }; +} + +function lstatIfPresent(targetPath: string): Stats | undefined { + try { + return lstatSync(targetPath); + } catch (error) { + if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined; + throw error; + } +} + +function assertOwned(stat: Stats, targetPath: string): void { + if (process.platform === "win32") return; + const currentUid = process.getuid?.(); + if (currentUid !== undefined && stat.uid !== currentUid) { + throw new Error(`Refusing to use ${targetPath}: it is not owned by the current user`); + } +} + +function assertNoSymlinkComponents(targetPath: string): void { + const absolute = resolve(targetPath); + if (!isAbsolute(absolute) || absolute.includes("\0")) throw new Error("Invalid private filesystem path"); + const anchored = descriptorRootFor(absolute); + const root = anchored?.root ?? parse(absolute).root; + let cursor = root; + const components = anchored?.suffix ?? absolute.slice(root.length).split(/[\\/]+/).filter(Boolean); + for (const component of components) { + cursor = join(cursor, component); + const stat = lstatIfPresent(cursor); + if (!stat) break; + // Let the exact-target validator report whether the link was supplied as a + // file or directory. Components above the target can never be followed. + if (stat.isSymbolicLink() && cursor === absolute) return; + if (stat.isSymbolicLink()) throw new Error(`Refusing to follow symbolic-link directory component ${cursor}`); + } +} + +export function secureExistingPrivateDirectory(directoryPath: string): boolean { + assertNoSymlinkComponents(directoryPath); + const anchored = descriptorRootFor(directoryPath); + if (anchored?.suffix.length === 0) { + const stat = fstatSync(anchored.descriptor); + assertOwned(stat, directoryPath); + if (process.platform !== "win32" && (stat.mode & 0o777) !== PRIVATE_DIRECTORY_MODE) { + fchmodSync(anchored.descriptor, PRIVATE_DIRECTORY_MODE); + } + return true; + } + const stat = lstatIfPresent(directoryPath); + if (!stat) return false; + if (stat.isSymbolicLink()) throw new Error(`Refusing to use symbolic-link directory ${directoryPath}`); + if (!stat.isDirectory()) throw new Error(`Expected a directory at ${directoryPath}`); + assertOwned(stat, directoryPath); + if (!anchored && realpathSync(directoryPath) !== resolve(directoryPath)) throw new Error(`Refusing to use linked directory ${directoryPath}`); + if (process.platform !== "win32" && (stat.mode & 0o777) !== PRIVATE_DIRECTORY_MODE) { + chmodSync(directoryPath, PRIVATE_DIRECTORY_MODE); + } + return true; +} + +export function ensurePrivateDirectory(directoryPath: string): void { + assertNoSymlinkComponents(directoryPath); + if (!lstatIfPresent(directoryPath)) mkdirSync(directoryPath, { recursive: true, mode: PRIVATE_DIRECTORY_MODE }); + secureExistingPrivateDirectory(directoryPath); +} + +export function secureExistingPrivateFile(filePath: string): boolean { + assertNoSymlinkComponents(filePath); + const stat = lstatIfPresent(filePath); + if (!stat) return false; + if (stat.isSymbolicLink()) throw new Error(`Refusing to use symbolic-link file ${filePath}`); + if (!stat.isFile()) throw new Error(`Expected a regular file at ${filePath}`); + if (stat.nlink !== 1) throw new Error(`Refusing to use hard-linked file ${filePath}`); + assertOwned(stat, filePath); + if (process.platform !== "win32" && (stat.mode & 0o777) !== PRIVATE_FILE_MODE) chmodSync(filePath, PRIVATE_FILE_MODE); + return true; +} + +export interface PrivateFileWriteOptions { + secureParent?: boolean; + signal?: AbortSignal; + /** Test seam for simulating a commit failure after the durable temp write. */ + beforeRename?(): void; +} + +/** + * Publish a private file without ever modifying the previous inode in place. + * The random same-directory temporary is exclusive, fully written and synced; + * cancellation is observed immediately before the only commit point. + */ +export function writePrivateFileAtomic( + filePath: string, + content: string | Buffer, + options: PrivateFileWriteOptions = {}, +): void { + const target = resolve(filePath); + const parent = dirname(target); + if (options.secureParent !== false) ensurePrivateDirectory(parent); + else secureExistingPrivateDirectory(parent); + secureExistingPrivateFile(target); + const temporary = join(parent, `.${randomBytes(24).toString("hex")}.tmp`); + const bytes = Buffer.isBuffer(content) ? content : Buffer.from(content); + let descriptor: number | undefined; + let directoryDescriptor: number | undefined; + try { + descriptor = openSync( + temporary, + constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW | O_CLOEXEC, + PRIVATE_FILE_MODE, + ); + const opened = fstatSync(descriptor); + if (!opened.isFile() || opened.nlink !== 1) throw new Error("Atomic write temporary is not a private regular file"); + let offset = 0; + while (offset < bytes.length) offset += writeSync(descriptor, bytes, offset, bytes.length - offset); + fsyncSync(descriptor); + closeSync(descriptor); + descriptor = undefined; + options.beforeRename?.(); + options.signal?.throwIfAborted(); + renameSync(temporary, target); + const final = lstatSync(target); + if (!final.isFile() || final.isSymbolicLink() || final.nlink !== 1) throw new Error("Atomic write produced an unsafe target"); + assertOwned(final, target); + if (process.platform !== "win32") chmodSync(target, PRIVATE_FILE_MODE); + directoryDescriptor = openSync(parent, constants.O_RDONLY | constants.O_DIRECTORY | O_CLOEXEC); + fsyncSync(directoryDescriptor); + } finally { + if (descriptor !== undefined) closeSync(descriptor); + if (directoryDescriptor !== undefined) closeSync(directoryDescriptor); + try { unlinkSync(temporary); } catch { /* Removed by rename or best-effort failure cleanup. */ } + } +} + +/** Open a private file without following links and read that exact inode once. */ +export function readPrivateFile(filePath: string, maxBytes = 1024 * 1024): Buffer | undefined { + const target = resolve(filePath); + assertNoSymlinkComponents(target); + let descriptor: number; + try { + descriptor = openSync(target, constants.O_RDONLY | constants.O_NOFOLLOW | O_CLOEXEC); + } catch (error) { + if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined; + throw error; + } + try { + const stat = fstatSync(descriptor); + if (!stat.isFile() || stat.nlink !== 1 || stat.size > maxBytes) throw new Error(`Refusing to read unsafe private file ${target}`); + assertOwned(stat, target); + return readFileSync(descriptor); + } finally { + closeSync(descriptor); + } +} diff --git a/packages/local-setup/src/state.test.ts b/packages/local-setup/src/state.test.ts index 36e528def..499eb2885 100644 --- a/packages/local-setup/src/state.test.ts +++ b/packages/local-setup/src/state.test.ts @@ -1,9 +1,9 @@ import assert from "node:assert/strict"; -import { mkdtempSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; +import { linkSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; import { test } from "node:test"; -import { applyEnvSelection, clearEnvKeys, inspectStackInit, readEnvVars } from "./state.js"; +import { applyEnvSelection, clearEnvKeys, inspectStackInit, readEnvVars, writePrivateFileAtomic } from "./index.js"; function withStack(run: (rootDir: string) => void): void { const rootDir = mkdtempSync(join(tmpdir(), "propr-local-setup-test-")); @@ -42,3 +42,27 @@ test("stack inspection requires the env file and every launcher directory", () = mkdirSync(join(rootDir, "repos")); assert.equal(inspectStackInit(rootDir).initialized, true); })); + +test("environment commits reject symlink and hardlink targets without changing outside bytes", () => withStack((rootDir) => { + const envPath = join(rootDir, ".env"); + const outside = join(rootDir, "outside"); + writeFileSync(outside, "OUTSIDE=unchanged\n", { mode: 0o600 }); + symlinkSync(outside, envPath); + assert.throws(() => applyEnvSelection(rootDir, { SAFE: "no" }), /symbolic|unsafe/i); + assert.equal(readFileSync(outside, "utf8"), "OUTSIDE=unchanged\n"); + rmSync(envPath); + linkSync(outside, envPath); + assert.throws(() => applyEnvSelection(rootDir, { SAFE: "no" }), /hard-linked|unsafe/i); + assert.equal(readFileSync(outside, "utf8"), "OUTSIDE=unchanged\n"); +})); + +test("an atomic commit failure retains prior bytes, cleans its temp, and successful output is mode 0600", () => withStack((rootDir) => { + const envPath = join(rootDir, ".env"); + writeFileSync(envPath, "OLD=bytes\n", { mode: 0o600 }); + assert.throws(() => writePrivateFileAtomic(envPath, "NEW=bytes\n", { beforeRename: () => { throw new Error("rename fault"); } }), /rename fault/); + assert.equal(readFileSync(envPath, "utf8"), "OLD=bytes\n"); + assert.equal(readdirSync(rootDir).some(name => name.endsWith(".tmp")), false); + writePrivateFileAtomic(envPath, "NEW=bytes\n"); + assert.equal(readFileSync(envPath, "utf8"), "NEW=bytes\n"); + assert.equal(statSync(envPath).mode & 0o777, 0o600); +})); diff --git a/packages/local-setup/src/state.ts b/packages/local-setup/src/state.ts index aa190f4a6..ddff8b064 100644 --- a/packages/local-setup/src/state.ts +++ b/packages/local-setup/src/state.ts @@ -12,10 +12,11 @@ * and unit-tested without Docker, Ink, or readline. */ -import { lstatSync, readFileSync, statSync } from "node:fs"; +import { lstatSync, statSync } from "node:fs"; import { isAbsolute, join, relative, resolve, sep } from "node:path"; import { resolveGithubAuthMode, type GithubAuthModeResult } from "@propr/shared"; import { clearEnvKeys as clearEnvFileKeys, upsertEnvVars } from "./envFile.js"; +import { readPrivateFile } from "./privateFilesystem.js"; import { SETUP_STEP_DEFINITIONS, type SetupState, @@ -246,14 +247,17 @@ export function isStackInitialized(rootDir: string): boolean { * full dotenv implementation — it does not handle escaped quotes or multiline * values. */ -export function readEnvVars(rootDir: string): Record { +export function readEnvVars(rootDir: string, signal?: AbortSignal): Record { + signal?.throwIfAborted(); const envPath = envPathFor(rootDir); // Treat anything that is not a regular file (absent, a directory, a broken // symlink) as "no vars", matching inspectStackInit's `isFile` guard, so a // malformed stack surfaces as not-initialized instead of crashing the read. if (!isFile(envPath)) return {}; + const contents = readPrivateFile(envPath); + if (!contents) return {}; const vars: Record = {}; - for (const line of readFileSync(envPath, "utf-8").split(/\r?\n/)) { + for (const line of contents.toString("utf-8").split(/\r?\n/)) { const match = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/); if (!match) continue; const [, key, rawValue] = match; @@ -296,9 +300,11 @@ export interface EnvSelectionResult { export function applyEnvSelection( rootDir: string, vars: Record, - opts: { overwrite?: boolean } = {} + opts: { overwrite?: boolean } = {}, + signal?: AbortSignal, ): EnvSelectionResult { - const existing = readEnvVars(rootDir); + signal?.throwIfAborted(); + const existing = readEnvVars(rootDir, signal); const toWrite: Record = {}; const written: string[] = []; const skipped: string[] = []; @@ -315,7 +321,7 @@ export function applyEnvSelection( } if (written.length > 0) { - upsertEnvVars(envPathFor(rootDir), toWrite); + upsertEnvVars(envPathFor(rootDir), toWrite, signal); } return { written, skipped }; } @@ -330,8 +336,9 @@ export function applyEnvSelection( * user whitelist back to "none", removing a key when switching modes — call this * instead. A missing `.env` or absent keys are no-ops. */ -export function clearEnvKeys(rootDir: string, keys: string[]): void { - clearEnvFileKeys(envPathFor(rootDir), keys); +export function clearEnvKeys(rootDir: string, keys: string[], signal?: AbortSignal): void { + signal?.throwIfAborted(); + clearEnvFileKeys(envPathFor(rootDir), keys, signal); } /** diff --git a/packages/shared/src/apiOrigin.ts b/packages/shared/src/apiOrigin.ts new file mode 100644 index 000000000..34ee8f485 --- /dev/null +++ b/packages/shared/src/apiOrigin.ts @@ -0,0 +1,114 @@ +export interface NormalizeProprApiOriginOptions { + /** Browser-hosted development may deliberately opt into non-loopback HTTP. */ + allowInsecureHttp?: boolean; + /** The browser client uses an empty value to mean same-origin. */ + allowEmpty?: boolean; +} + +/** One documented parity table consumed by client, Electron, store and UI tests. */ +export const PROPR_API_ORIGIN_PARITY_CASES = [ + ['https origin', 'https://propr.example.test', 'https://propr.example.test'], + ['https trailing slash', 'https://propr.example.test/', 'https://propr.example.test'], + ['localhost', 'http://localhost:3000', 'http://localhost:3000'], + ['localhost subdomain', 'http://api.dev.localhost:3000', 'http://api.dev.localhost:3000'], + ['IPv4 127/8', 'http://127.42.7.9:3000', 'http://127.42.7.9:3000'], + ['IPv6 loopback', 'http://[::1]:3000', 'http://[::1]:3000'], + ['credentials', 'https://user:secret@propr.example.test', null], + ['path', 'https://propr.example.test/api', null], + ['query', 'https://propr.example.test?token=x', null], + ['fragment', 'https://propr.example.test#x', null], + ['encoded host', 'http://local%68ost:3000', null], + ['trailing dot', 'http://localhost.:3000', null], + ['short IPv4', 'http://127.1:3000', null], + ['octal IPv4', 'http://0177.0.0.1:3000', null], + ['hex IPv4', 'http://0x7f000001:3000', null], + ['mapped IPv6', 'http://[::ffff:127.0.0.1]:3000', null], + ['mapped IPv6 over HTTPS', 'https://[::ffff:127.0.0.1]:3000', null], + ['alternate IPv6 spelling', 'https://[0:0:0:0:0:0:0:1]:3000', null], + ['localhost lookalike', 'http://localhost.example.test:3000', null], + ['non-loopback HTTP', 'http://192.168.1.20:3000', null], +] as const; + +const DECIMAL_IPV4 = /^(0|[1-9][0-9]{0,2})(?:\.(0|[1-9][0-9]{0,2})){3}$/; + +const rawHostname = (authority: string): string | null => { + if (!authority || authority.includes('@') || authority.includes('%') || authority.includes('\\')) return null; + if (authority.startsWith('[')) { + const close = authority.indexOf(']'); + if (close < 0 || (authority.slice(close + 1) !== '' && !/^:[0-9]+$/.test(authority.slice(close + 1)))) { + return null; + } + return authority.slice(0, close + 1); + } + if ((authority.match(/:/g) ?? []).length > 1) return null; + return authority.split(':', 1)[0] ?? null; +}; + +/** True only for the deliberately supported, canonical HTTP loopback names. */ +export const isProprLoopbackHostname = (hostname: string): boolean => { + const normalized = hostname.toLowerCase(); + if (normalized === 'localhost' || normalized === '[::1]') return true; + if (normalized.endsWith('.localhost')) { + return normalized.slice(0, -'.localhost'.length).split('.').every(label => + /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label) + ); + } + if (!DECIMAL_IPV4.test(normalized)) return false; + const octets = normalized.split('.').map(Number); + return octets[0] === 127 && octets.every(octet => octet <= 255); +}; + +/** + * Return one canonical HTTP(S) origin, or null. The lexical authority checks + * deliberately run before WHATWG URL parsing so numeric and encoded host + * aliases cannot be canonicalized into a broader credential scope. + */ +export const canonicalProprHttpUrlOrigin = ( + value: string | null | undefined, + options: NormalizeProprApiOriginOptions = {}, +): string | null => { + const candidate = value?.trim() ?? ''; + if (!candidate) return options.allowEmpty ? '' : null; + if (candidate.length > 2_048 || candidate.includes('\\')) return null; + + const lexical = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^/?#]*)(?:[/?#]|$)/.exec(candidate); + if (!lexical) return null; + const authorityHostname = rawHostname(lexical[2]); + if (!authorityHostname || authorityHostname.endsWith('.')) return null; + + let parsed: URL; + try { + parsed = new URL(candidate); + } catch { + return null; + } + if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return null; + if (parsed.username || parsed.password) return null; + + const rawLower = authorityHostname.toLowerCase(); + const parsedLower = parsed.hostname.toLowerCase(); + const rawLooksNumeric = /^[0-9]/.test(rawLower) || rawLower.startsWith('0x') || rawLower.startsWith('['); + if (rawLooksNumeric && parsedLower !== rawLower) return null; + if (parsedLower.startsWith('[::ffff:')) return null; + + if (parsed.protocol === 'http:' + && options.allowInsecureHttp !== true + && !isProprLoopbackHostname(parsed.hostname)) return null; + + // For HTTP, require the exact supported lexical spelling too. This rejects + // expanded/mapped IPv6 and every WHATWG alternate IPv4 representation. + if (parsed.protocol === 'http:' && options.allowInsecureHttp !== true) { + if (rawLower !== parsedLower || !isProprLoopbackHostname(rawLower)) return null; + } + return parsed.origin; +}; + +export const normalizeProprApiOrigin = ( + value: string | null | undefined, + options: NormalizeProprApiOriginOptions = {}, +): string | null => { + const candidate = value?.trim() ?? ''; + if (!candidate) return options.allowEmpty ? '' : null; + if (!/^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]*\/?$/.test(candidate)) return null; + return canonicalProprHttpUrlOrigin(candidate, options); +}; diff --git a/packages/shared/src/desktopTokenRevocation.ts b/packages/shared/src/desktopTokenRevocation.ts new file mode 100644 index 000000000..7012d40f6 --- /dev/null +++ b/packages/shared/src/desktopTokenRevocation.ts @@ -0,0 +1,21 @@ +export const DESKTOP_TOKEN_REVOCATION_ENDPOINT = '/api/desktop/tokens/current'; +export const DESKTOP_REVOCATION_BINDING_HEADER = 'X-ProPR-Desktop-Revocation-Binding'; +export const DESKTOP_TOKEN_REVOCATION_SCHEMA = 'propr.desktop-token-revocation'; +export const DESKTOP_TOKEN_REVOCATION_VERSION = 1; + +export const DESKTOP_TOKEN_TERMINAL_CODES = [ + 'TOKEN_NOT_FOUND', + 'INSTANCE_TOKEN_REVOKED', + 'INSTANCE_TOKEN_EXPIRED', +] as const; + +export type DesktopTokenTerminalCode = typeof DESKTOP_TOKEN_TERMINAL_CODES[number]; + +export interface DesktopTokenTerminalRevocation { + schema: typeof DESKTOP_TOKEN_REVOCATION_SCHEMA; + version: typeof DESKTOP_TOKEN_REVOCATION_VERSION; + endpoint: typeof DESKTOP_TOKEN_REVOCATION_ENDPOINT; + terminal: true; + code: DesktopTokenTerminalCode; + credentialGeneration: string; +} diff --git a/packages/shared/src/index.ts b/packages/shared/src/index.ts index 561ea2645..5240e1d80 100644 --- a/packages/shared/src/index.ts +++ b/packages/shared/src/index.ts @@ -58,6 +58,24 @@ export { DEMO_MODE_READ_ONLY_CODE, parseTruthyEnvValue } from './demoMode.js'; export { MIN_SESSION_SECRET_LENGTH, validateSessionSecret } from './sessionSecret.js'; +export { + canonicalProprHttpUrlOrigin, + isProprLoopbackHostname, + normalizeProprApiOrigin, + PROPR_API_ORIGIN_PARITY_CASES, + type NormalizeProprApiOriginOptions, +} from './apiOrigin.js'; + +export { + DESKTOP_REVOCATION_BINDING_HEADER, + DESKTOP_TOKEN_REVOCATION_ENDPOINT, + DESKTOP_TOKEN_REVOCATION_SCHEMA, + DESKTOP_TOKEN_REVOCATION_VERSION, + DESKTOP_TOKEN_TERMINAL_CODES, + type DesktopTokenTerminalCode, + type DesktopTokenTerminalRevocation, +} from './desktopTokenRevocation.js'; + export { INSTANCE_PERMISSIONS, type AuthenticatedInstanceUser, @@ -93,6 +111,8 @@ export { DEFAULT_PROPR_GH_RELAY_URL, DEFAULT_PROPR_UI_ORIGIN, DESKTOP_RENDERER_ORIGIN, + DESKTOP_TRANSPORT_SCOPE_HEADER, + DESKTOP_TRANSPORT_SCOPE_QUERY, PROPR_UI_PROXY_SUFFIX, PROPR_UI_PROXY_LABEL_PREFIX, DEFAULT_CLOUDFLARED_IMAGE, diff --git a/packages/shared/src/proprCompatibility.ts b/packages/shared/src/proprCompatibility.ts index 0110aae11..ba6348137 100644 --- a/packages/shared/src/proprCompatibility.ts +++ b/packages/shared/src/proprCompatibility.ts @@ -22,7 +22,7 @@ export interface ProprCompatibilityMetadata { } export interface ProprDesktopAuthenticationCapabilities { - protocolVersion: 1; + protocolVersion: 2; browserPairing: boolean; instanceBearerTokens: boolean; socketIoBearerAuthentication: boolean; @@ -53,7 +53,7 @@ export function getProprCompatibilityMetadata(desktopAuthenticationEnabled = tru apiCompatibility: PROPR_API_COMPATIBILITY, uiCompatibility: PROPR_UI_COMPATIBILITY, desktopAuthentication: { - protocolVersion: 1, + protocolVersion: 2, browserPairing: desktopAuthenticationEnabled, instanceBearerTokens: desktopAuthenticationEnabled, socketIoBearerAuthentication: desktopAuthenticationEnabled, diff --git a/packages/shared/src/proprServiceUrls.ts b/packages/shared/src/proprServiceUrls.ts index b06cec385..45be5dbf8 100644 --- a/packages/shared/src/proprServiceUrls.ts +++ b/packages/shared/src/proprServiceUrls.ts @@ -41,6 +41,12 @@ export const DEFAULT_PROPR_UI_ORIGIN = 'https://app.propr.dev'; */ export const DESKTOP_RENDERER_ORIGIN = 'propr-app://renderer'; +/** Opaque activation binding carried by packaged renderer REST requests. */ +export const DESKTOP_TRANSPORT_SCOPE_HEADER = 'X-ProPR-Desktop-Transport-Scope'; + +/** Opaque activation binding carried by packaged renderer Socket.IO upgrades. */ +export const DESKTOP_TRANSPORT_SCOPE_QUERY = 'proprDesktopTransportScope'; + /** * DNS suffix and label prefix for per-instance UI/API tunnel hostnames. Each * local stack with an instance id is reachable at diff --git a/propr-ui/src/api/apiClient.ts b/propr-ui/src/api/apiClient.ts index 32cf33f2f..f7ac61711 100644 --- a/propr-ui/src/api/apiClient.ts +++ b/propr-ui/src/api/apiClient.ts @@ -1,13 +1,27 @@ -import { DEMO_MODE_READ_ONLY_CODE } from '@propr/shared'; -import { ProprClient } from '@propr/client'; +import { DEMO_MODE_READ_ONLY_CODE, DESKTOP_TRANSPORT_SCOPE_HEADER } from '@propr/shared'; +import { normalizeApiBaseUrl, ProprClient } from '@propr/client'; +import type { DesktopRendererBridge } from '../../../apps/desktop/src/shared/contract'; import { getApiBaseUrl, pathWithActiveHostedTunnelFlow } from '../config/runtimeConfig'; -import { currentUiPathname, navigateToUiPath } from '../config/runtimeMode'; +import { currentUiPathname, isDesktopRuntime, navigateToUiPath } from '../config/runtimeMode'; +import { DESKTOP_ACCESS_INVALID_EVENT } from '../desktop/types'; + +export interface DesktopConnectionScope { + bridge: DesktopRendererBridge; + profileId: string; + transportScope: string; +} + +let desktopConnectionScope: DesktopConnectionScope | null = null; +const desktopScopeListeners = new Set<() => void>(); +const responseScopes = new WeakMap(); +const DEFINITIVE_INSTANCE_TOKEN_CODES = new Set(['INVALID_INSTANCE_TOKEN', 'INSTANCE_TOKEN_EXPIRED', 'INSTANCE_TOKEN_REVOKED']); +const AUTHORIZATION_CHANGE_CODES = new Set(['AUTHORIZATION_CHANGED', 'USER_NOT_WHITELISTED', 'INSUFFICIENT_INSTANCE_PERMISSION']); const createProprClient = (baseUrl: string): ProprClient => new ProprClient({ baseUrl, // Domain modules already opt into cookies route-by-route. Preserve their // exact RequestInit behavior while sharing the session transport policy. - authentication: { type: 'session', applyByDefault: false }, + authentication: isDesktopRuntime() ? { type: 'none' } : { type: 'session', applyByDefault: false }, }); export let API_BASE_URL = getApiBaseUrl(); @@ -15,10 +29,30 @@ export let proprClient = createProprClient(API_BASE_URL); /** Update the live bindings used by existing API modules when desktop profiles switch. */ export const setApiBaseUrl = (value: string): void => { - const nextApiBaseUrl = value.trim().replace(/\/+$/, ''); + const nextApiBaseUrl = normalizeApiBaseUrl(value); const nextProprClient = createProprClient(nextApiBaseUrl); API_BASE_URL = nextApiBaseUrl; proprClient = nextProprClient; + desktopScopeListeners.forEach(listener => listener()); +}; + +export const setDesktopConnectionScope = (scope: DesktopConnectionScope | null, apiBaseUrl?: string): void => { + const nextApiBaseUrl = apiBaseUrl === undefined ? API_BASE_URL : normalizeApiBaseUrl(apiBaseUrl); + const nextProprClient = createProprClient(nextApiBaseUrl); + API_BASE_URL = nextApiBaseUrl; + desktopConnectionScope = scope; + proprClient = nextProprClient; + desktopScopeListeners.forEach(listener => listener()); +}; + +export const getDesktopConnectionScope = (): DesktopConnectionScope | null => desktopConnectionScope; +export const subscribeDesktopConnectionScope = (listener: () => void): (() => void) => { + desktopScopeListeners.add(listener); + return () => desktopScopeListeners.delete(listener); +}; +export const getDesktopSocketConfigurationKey = (): string => { + const scope = desktopConnectionScope; + return `${isDesktopRuntime() ? 'desktop' : 'browser'}\u0000${API_BASE_URL}\u0000${scope?.profileId ?? ''}\u0000${scope?.transportScope ?? ''}`; }; export const INSTANCE_AUTHORIZATION_CHANGED_EVENT = 'propr:instance-authorization-changed'; const TOKEN_REFRESHED_CODE = 'TOKEN_REFRESHED'; @@ -112,10 +146,50 @@ const parseApiErrorBody = async (response: Response): Promise data?.message || data?.error; -const throwUnauthorizedResponse = (data: ApiErrorBody | null): never => { +const isCurrentDesktopScope = (scope: DesktopConnectionScope | null): boolean => { + if (!scope) return !isDesktopRuntime(); + return desktopConnectionScope?.profileId === scope.profileId + && desktopConnectionScope.transportScope === scope.transportScope; +}; + +const scopeForResponse = (response: Response): DesktopConnectionScope | null => + responseScopes.has(response) ? responseScopes.get(response) ?? null : desktopConnectionScope; + +export const handleDesktopAccessCode = async ( + code: string | undefined, + scope: DesktopConnectionScope | null, +): Promise<'invalidated' | 'authorization-changed' | 'retryable'> => { + if (!code) return 'retryable'; + if (AUTHORIZATION_CHANGE_CODES.has(code)) { + if (!isCurrentDesktopScope(scope)) return 'retryable'; + window.dispatchEvent(new Event(INSTANCE_AUTHORIZATION_CHANGED_EVENT)); + return 'authorization-changed'; + } + if (!scope || !DEFINITIVE_INSTANCE_TOKEN_CODES.has(code)) return 'retryable'; + const result = await scope.bridge.connection.invalidate({ + profileId: scope.profileId, + transportScope: scope.transportScope, + code, + }); + if (result.invalidated && isCurrentDesktopScope(scope)) { + window.dispatchEvent(new CustomEvent(DESKTOP_ACCESS_INVALID_EVENT, { + detail: { profileId: scope.profileId, transportScope: scope.transportScope, code }, + })); + return 'invalidated'; + } + return 'retryable'; +}; + +const throwUnauthorizedResponse = async (data: ApiErrorBody | null, response: Response): Promise => { if (data?.code === TOKEN_REFRESHED_CODE) { throw new TokenRefreshRetryRequiredError(getApiErrorMessage(data)); } + if (isDesktopRuntime()) { + await handleDesktopAccessCode(data?.code, scopeForResponse(response)); + throw new Error(data?.code === 'INVALID_INSTANCE_TOKEN' + ? 'This desktop connection was revoked or expired.' + : 'Desktop authentication is required.'); + } if (currentUiPathname() === '/login') throw new Error('Authentication required'); // Preserve only the validated active flow so login/OAuth cannot be driven by // arbitrary raw URL input or copied sessionStorage. @@ -123,6 +197,18 @@ const throwUnauthorizedResponse = (data: ApiErrorBody | null): never => { throw new Error('Authentication required'); }; +const scopedRequestInit = ( + input: RequestInfo | URL, + init: RequestInit | undefined, + scope: DesktopConnectionScope | null, +): RequestInit | undefined => { + if (!scope) return init; + const headers = new Headers(typeof Request !== 'undefined' && input instanceof Request ? input.headers : undefined); + new Headers(init?.headers).forEach((value, name) => headers.set(name, value)); + headers.set(DESKTOP_TRANSPORT_SCOPE_HEADER, scope.transportScope); + return { ...init, headers }; +}; + const isSafePublicError = (data: ApiErrorBody | null): boolean => typeof data?.code === 'string' && SAFE_PUBLIC_ERROR_CODES.has(data.code); @@ -148,9 +234,17 @@ export const apiFetch = async ( init?: RequestInit, options: ApiFetchOptions = {} ): Promise => { - const response = await proprClient.fetch(input, init); - if (isReplayableApiRequest(input, init, options) && await shouldRetryAfterTokenRefresh(response)) { - return proprClient.fetch(input, init); + const requestScope = desktopConnectionScope; + const requestClient = proprClient; + const requestInit = scopedRequestInit(input, init, requestScope); + const response = await requestClient.fetch(input, requestInit); + responseScopes.set(response, requestScope); + if (isReplayableApiRequest(input, init, options) + && await shouldRetryAfterTokenRefresh(response) + && isCurrentDesktopScope(requestScope)) { + const retried = await requestClient.fetch(input, requestInit); + responseScopes.set(retried, requestScope); + return retried; } return response; }; @@ -159,14 +253,14 @@ export const handleApiResponse = async (response: Response): Promise = if (response.ok) return response; const data = await parseApiErrorBody(response); - if (response.status === 401) throwUnauthorizedResponse(data); + if (response.status === 401) return await throwUnauthorizedResponse(data, response); const errorMessage = getApiErrorMessage(data); if (data?.code === DEMO_MODE_READ_ONLY_CODE) { throw new DemoModeReadOnlyError(errorMessage); } if (data?.code === 'INSUFFICIENT_INSTANCE_PERMISSION') { - window.dispatchEvent(new Event(INSTANCE_AUTHORIZATION_CHANGED_EVENT)); + await handleDesktopAccessCode(data.code, scopeForResponse(response)); } if (data?.committed === true) { throw new CommittedConfigWriteError(response.status, { diff --git a/propr-ui/src/api/demoMode.test.ts b/propr-ui/src/api/demoMode.test.ts index ceca3043b..316a2ec0c 100644 --- a/propr-ui/src/api/demoMode.test.ts +++ b/propr-ui/src/api/demoMode.test.ts @@ -1,19 +1,35 @@ import { afterEach, describe, expect, it, vi } from 'vitest'; -import { DEMO_MODE_READ_ONLY_CODE } from '@propr/shared'; +import { DEMO_MODE_READ_ONLY_CODE, PROPR_API_ORIGIN_PARITY_CASES } from '@propr/shared'; import { apiFetch, CommittedConfigWriteError, getDemoModeStatus, handleApiResponse, + handleDesktopAccessCode, INSTANCE_AUTHORIZATION_CHANGED_EVENT, + API_BASE_URL, + setApiBaseUrl, + setDesktopConnectionScope, TokenRefreshRetryRequiredError, } from './proprApi'; describe('demo mode API helpers', () => { afterEach(() => { + setDesktopConnectionScope(null); + setApiBaseUrl(''); vi.restoreAllMocks(); }); + it('applies the shared canonical origin parity table to REST and Socket.IO client configuration', () => { + for (const [name, input, expected] of PROPR_API_ORIGIN_PARITY_CASES) { + if (expected === null) expect(() => setApiBaseUrl(input), name).toThrow(); + else { + setApiBaseUrl(input); + expect(API_BASE_URL, name).toBe(expected); + } + } + }); + it('discovers demo mode from the backend metadata endpoint', async () => { const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue( new Response(JSON.stringify({ demoMode: true }), { @@ -95,6 +111,42 @@ describe('demo mode API helpers', () => { expect(fetchMock).toHaveBeenCalledTimes(2); }); + it('does not replay profile A work with profile B after a same-origin scope switch', async () => { + let parsingStarted!: () => void; + let releaseParsing!: () => void; + const started = new Promise(resolve => { parsingStarted = resolve; }); + const released = new Promise(resolve => { releaseParsing = resolve; }); + const refreshed = new Response(JSON.stringify({ code: 'TOKEN_REFRESHED' }), { + status: 401, + headers: { 'Content-Type': 'application/json' }, + }); + vi.spyOn(refreshed, 'clone').mockReturnValue({ + json: async () => { + parsingStarted(); + await released; + return { code: 'TOKEN_REFRESHED' }; + }, + } as Response); + const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(refreshed); + setDesktopConnectionScope({ + bridge: {} as never, + profileId: 'profile-a', + transportScope: 'AAAAAAAAAAAAAAAAAAAAAA', + }); + + const pending = apiFetch('/api/tasks'); + await started; + setDesktopConnectionScope({ + bridge: {} as never, + profileId: 'profile-b', + transportScope: 'BBBBBBBBBBBBBBBBBBBBBB', + }); + releaseParsing(); + + await expect(pending).resolves.toBe(refreshed); + expect(fetchMock).toHaveBeenCalledOnce(); + }); + it('surfaces an unreplayed token refresh as retry-required without logging out', async () => { const response = new Response(JSON.stringify({ code: 'TOKEN_REFRESHED', @@ -133,6 +185,39 @@ describe('demo mode API helpers', () => { expect(fetchMock).toHaveBeenNthCalledWith(2, request, undefined); }); + it('preserves Request and init headers plus the captured scope on retry', async () => { + const fetchMock = vi.spyOn(globalThis, 'fetch') + .mockResolvedValueOnce(new Response(JSON.stringify({ code: 'TOKEN_REFRESHED' }), { + status: 401, + headers: { 'Content-Type': 'application/json' }, + })) + .mockResolvedValueOnce(new Response('{}', { status: 200 })); + setDesktopConnectionScope({ + bridge: {} as never, + profileId: 'profile-a', + transportScope: 'SSSSSSSSSSSSSSSSSSSSSS', + }); + const request = new Request(new URL('/api/tasks', window.location.origin), { + headers: { 'X-From-Request': 'request', Authorization: 'Bearer renderer' }, + }); + + await apiFetch(request, { + credentials: 'include', + headers: { 'X-From-Init': 'init', Cookie: 'renderer=session' }, + }); + + expect(fetchMock).toHaveBeenCalledTimes(2); + for (const [input, init] of fetchMock.mock.calls) { + expect(input).toBe(request); + const headers = new Headers(init?.headers); + expect(headers.get('X-From-Request')).toBe('request'); + expect(headers.get('X-From-Init')).toBe('init'); + expect(headers.get('X-ProPR-Desktop-Transport-Scope')).toBe('SSSSSSSSSSSSSSSSSSSSSS'); + expect(headers.get('Authorization')).toBe('Bearer renderer'); + expect(headers.get('Cookie')).toBe('renderer=session'); + } + }); + it('does not retry GitHub re-authentication failures', async () => { const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(JSON.stringify({ code: 'GITHUB_REAUTH_REQUIRED', @@ -181,6 +266,57 @@ describe('demo mode API helpers', () => { window.removeEventListener(INSTANCE_AUTHORIZATION_CHANGED_EVENT, listener); }); + it('does not dispatch a stale authorization change after the desktop profile generation switches', async () => { + const listener = vi.fn(); + const scopeA = { + bridge: { connection: { invalidate: vi.fn() } } as never, + profileId: 'profile-a', + transportScope: 'DDDDDDDDDDDDDDDDDDDDDD', + }; + const scopeB = { + bridge: { connection: { invalidate: vi.fn() } } as never, + profileId: 'profile-b', + transportScope: 'EEEEEEEEEEEEEEEEEEEEEE', + }; + setDesktopConnectionScope(scopeA); + window.addEventListener(INSTANCE_AUTHORIZATION_CHANGED_EVENT, listener); + const response = new Response(JSON.stringify({ + code: 'INSUFFICIENT_INSTANCE_PERMISSION', + message: 'Forbidden', + }), { + status: 403, + headers: { 'Content-Type': 'application/json' }, + }); + const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(response); + + const scopedResponse = await apiFetch('/api/tasks'); + setDesktopConnectionScope(scopeB); + await expect(handleApiResponse(scopedResponse)).rejects.toThrow('Forbidden'); + + expect(fetchMock).toHaveBeenCalledOnce(); + expect(listener).not.toHaveBeenCalled(); + window.removeEventListener(INSTANCE_AUTHORIZATION_CHANGED_EVENT, listener); + }); + + it('preserves desktop credentials for authorization changes and transient authentication failures', async () => { + const invalidate = vi.fn(async () => ({ invalidated: false })); + const scope = { + bridge: { connection: { invalidate } } as never, + profileId: 'profile-a', + transportScope: 'IIIIIIIIIIIIIIIIIIIIII', + }; + const listener = vi.fn(); + window.addEventListener(INSTANCE_AUTHORIZATION_CHANGED_EVENT, listener); + setDesktopConnectionScope(scope); + + await expect(handleDesktopAccessCode('AUTHORIZATION_CHANGED', scope)).resolves.toBe('authorization-changed'); + await expect(handleDesktopAccessCode('AUTHENTICATION_FAILED', scope)).resolves.toBe('retryable'); + + expect(listener).toHaveBeenCalledOnce(); + expect(invalidate).not.toHaveBeenCalled(); + window.removeEventListener(INSTANCE_AUTHORIZATION_CHANGED_EVENT, listener); + }); + it.each([ { status: 409, lockLostAfterCommit: true }, { status: 500, lockLostAfterCommit: false }, diff --git a/propr-ui/src/config/runtimeConfig.test.ts b/propr-ui/src/config/runtimeConfig.test.ts index 953724d02..f732cac15 100644 --- a/propr-ui/src/config/runtimeConfig.test.ts +++ b/propr-ui/src/config/runtimeConfig.test.ts @@ -120,10 +120,10 @@ describe('getApiBaseUrl', () => { expect(getApiBaseUrl()).toBe('https://t-abc123.propr.dev'); }); - it('strips multiple trailing slashes', async () => { + it('rejects a remote runtime origin with a non-canonical multi-slash path', async () => { window.__PROPR_CONFIG__ = { apiBaseUrl: 'https://t-abc123.propr.dev///' }; const getApiBaseUrl = await loadGetApiBaseUrl(); - expect(getApiBaseUrl()).toBe('https://t-abc123.propr.dev'); + expect(() => getApiBaseUrl()).toThrow(/canonical HTTPS origin/); }); it('strips a trailing slash from the build-time env var', async () => { diff --git a/propr-ui/src/contexts/SocketProvider.test.tsx b/propr-ui/src/contexts/SocketProvider.test.tsx index 1a7b5cb9f..9f3886e80 100644 --- a/propr-ui/src/contexts/SocketProvider.test.tsx +++ b/propr-ui/src/contexts/SocketProvider.test.tsx @@ -1,60 +1,275 @@ -import { cleanup, render } from '@testing-library/react'; +import { act, cleanup, render } from '@testing-library/react'; +import { useEffect } from 'react'; import { afterEach, describe, expect, it, vi } from 'vitest'; +import { DRAFT_UPDATE, INDEXING_UPDATE, QUEUE_STATS_UPDATE, TASK_LIVE_UPDATE, TASK_UPDATE } from '@propr/shared'; import { SocketProvider } from './SocketProvider'; +import { useSocket } from './useSocket'; -const socketMock = vi.hoisted(() => ({ - disconnect: vi.fn(), - emit: vi.fn(), - on: vi.fn(), +type Handler = (value?: unknown) => void; +const sockets = vi.hoisted(() => [] as Array<{ + handlers: Map; + connect: ReturnType; + disconnect: ReturnType; + emit: ReturnType; + on: ReturnType; + off: ReturnType; +}>); +const connectSocketMock = vi.hoisted(() => vi.fn(() => { + const handlers = new Map(); + const socket = { + handlers, + connect: vi.fn(), + disconnect: vi.fn(), + emit: vi.fn(), + on: vi.fn((event: string, handler: Handler) => { handlers.set(event, handler); }), + off: vi.fn((event: string, handler?: Handler) => { + if (!handler || handlers.get(event) === handler) handlers.delete(event); + }), + }; + sockets.push(socket); + return socket; +})); +const scopeListeners = vi.hoisted(() => new Set<() => void>()); +const handleDesktopAccessCode = vi.hoisted(() => vi.fn(async () => 'retryable')); +const runtime = vi.hoisted(() => ({ desktop: true })); +const state = vi.hoisted(() => ({ + origin: 'https://a.example.test', + scope: null as null | { bridge: never; profileId: string; transportScope: string }, })); - -const connectSocketMock = vi.hoisted(() => vi.fn(() => socketMock)); vi.mock('../api/apiClient', () => ({ proprClient: { connectSocket: connectSocketMock }, + getDesktopConnectionScope: () => state.scope, + getDesktopSocketConfigurationKey: () => + `${runtime.desktop ? 'desktop' : 'browser'}\u0000${state.origin}\u0000${state.scope?.profileId ?? ''}\u0000${state.scope?.transportScope ?? ''}`, + subscribeDesktopConnectionScope: (listener: () => void) => { + scopeListeners.add(listener); + return () => scopeListeners.delete(listener); + }, + handleDesktopAccessCode, })); +vi.mock('../config/runtimeMode', () => ({ isDesktopRuntime: () => runtime.desktop })); + +const scope = (profileId: string, transportScope: string) => ({ + bridge: {} as never, + profileId, + transportScope, +}); +const publish = (next: typeof state.scope, origin = state.origin) => { + act(() => { + state.scope = next; + state.origin = origin; + scopeListeners.forEach(listener => listener()); + }); +}; describe('SocketProvider', () => { afterEach(() => { cleanup(); + sockets.splice(0); connectSocketMock.mockClear(); - socketMock.disconnect.mockClear(); - socketMock.emit.mockClear(); - socketMock.on.mockClear(); + scopeListeners.clear(); + handleDesktopAccessCode.mockReset(); + handleDesktopAccessCode.mockResolvedValue('retryable'); + runtime.desktop = true; + state.origin = 'https://a.example.test'; + state.scope = null; }); - it('does not connect when disabled for demo mode', () => { - render( - -
demo
- - ); + it('does not connect when disabled or when desktop has no activation scope', () => { + const { rerender } = render(
demo
); + rerender(
desktop
); expect(connectSocketMock).not.toHaveBeenCalled(); }); - it('connects when real-time updates are enabled', () => { - const { unmount } = render( - -
app
- - ); + it('creates one force-new scoped Manager on null-to-A activation', () => { + render(
app
); + publish(scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA')); expect(connectSocketMock).toHaveBeenCalledOnce(); - unmount(); - expect(socketMock.disconnect).toHaveBeenCalledOnce(); + expect(connectSocketMock).toHaveBeenCalledWith(expect.objectContaining({ + forceNew: true, + query: { proprDesktopTransportScope: 'AAAAAAAAAAAAAAAAAAAAAA' }, + })); }); - it('uses the shared client Socket.IO policy', () => { - const { unmount } = render( - -
app
- - ); + it.each([ + ['scope rotation', scope('profile-a', 'BBBBBBBBBBBBBBBBBBBBBB')], + ['same-origin A-to-B', scope('profile-b', 'BBBBBBBBBBBBBBBBBBBBBB')], + ])('fully detaches A before creating a distinct Manager for %s', (_name, nextScope) => { + state.scope = scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA'); + render(
app
); + const socketA = sockets[0]; + + publish(nextScope); + + expect(sockets).toHaveLength(2); + expect(socketA.disconnect).toHaveBeenCalledOnce(); + expect(socketA.off).toHaveBeenCalledWith('connect', expect.any(Function)); + expect(socketA.off).toHaveBeenCalledWith('authentication:error', expect.any(Function)); + expect(socketA.disconnect.mock.invocationCallOrder[0]) + .toBeLessThan(connectSocketMock.mock.invocationCallOrder[1]); + expect(sockets[1]).not.toBe(socketA); + }); + + it('reports a replacement Manager as disconnected until its own connect event', () => { + const connectedStates: boolean[] = []; + const ConnectionState = () => { + connectedStates.push(useSocket().isConnected); + return null; + }; + state.scope = scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA'); + render(); + + act(() => { sockets[0].handlers.get('connect')?.(); }); + expect(connectedStates.at(-1)).toBe(true); + + publish(scope('profile-b', 'BBBBBBBBBBBBBBBBBBBBBB')); + expect(connectedStates.at(-1)).toBe(false); + act(() => { sockets[1].handlers.get('connect_error')?.(new Error('not connected')); }); + expect(connectedStates.at(-1)).toBe(false); + act(() => { sockets[1].handlers.get('connect')?.(); }); + expect(connectedStates.at(-1)).toBe(true); + }); + + it('rotates the Manager when the effective API origin changes', () => { + state.scope = scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA'); + render(
app
); + const socketA = sockets[0]; + + publish(state.scope, 'https://b.example.test'); + + expect(sockets).toHaveLength(2); + expect(socketA.disconnect).toHaveBeenCalledOnce(); + }); + + it('disconnects on deactivate and creates no replacement', () => { + state.scope = scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA'); + render(
app
); + const socketA = sockets[0]; + + publish(null); + + expect(socketA.disconnect).toHaveBeenCalledOnce(); + expect(connectSocketMock).toHaveBeenCalledOnce(); + }); + + it('keeps the hosted browser cookie socket without a desktop marker', () => { + runtime.desktop = false; + render(
app
); + + expect(connectSocketMock).toHaveBeenCalledOnce(); + expect(connectSocketMock).toHaveBeenCalledWith(expect.objectContaining({ forceNew: true })); + expect(connectSocketMock).toHaveBeenCalledWith(expect.not.objectContaining({ query: expect.anything() })); + }); + + it('classifies authentication errors against the immutable activation scope', async () => { + state.scope = scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA'); + handleDesktopAccessCode.mockResolvedValueOnce('invalidated'); + render(
app
); + + sockets[0].handlers.get('authentication:error')?.({ code: 'INVALID_INSTANCE_TOKEN' }); + await vi.waitFor(() => expect(handleDesktopAccessCode).toHaveBeenCalledWith( + 'INVALID_INSTANCE_TOKEN', state.scope, + )); + expect(sockets[0].connect).not.toHaveBeenCalled(); + }); + + it('reconnects the current Manager when authorization changes without invalidating its token', async () => { + state.scope = scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA'); + handleDesktopAccessCode.mockResolvedValueOnce('authorization-changed'); + render(
app
); + const socketA = sockets[0]; + + socketA.handlers.get('authentication:error')?.({ code: 'AUTHORIZATION_CHANGED' }); + + await vi.waitFor(() => expect(socketA.connect).toHaveBeenCalledOnce()); + expect(handleDesktopAccessCode).toHaveBeenCalledWith('AUTHORIZATION_CHANGED', state.scope); + expect(socketA.disconnect).toHaveBeenCalledOnce(); + }); + + it('never reconnects a stale same-origin Manager after deferred authorization work resolves', async () => { + state.scope = scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA'); + let resolveClassification!: (value: 'authorization-changed') => void; + handleDesktopAccessCode.mockReturnValueOnce(new Promise(resolve => { resolveClassification = resolve; })); + render(
app
); + const socketA = sockets[0]; + const staleAuthenticationHandler = socketA.handlers.get('authentication:error'); + + staleAuthenticationHandler?.({ code: 'AUTHORIZATION_CHANGED' }); + await vi.waitFor(() => expect(handleDesktopAccessCode).toHaveBeenCalledWith( + 'AUTHORIZATION_CHANGED', state.scope, + )); + publish(scope('profile-b', 'BBBBBBBBBBBBBBBBBBBBBB')); + const socketB = sockets[1]; + resolveClassification('authorization-changed'); + await Promise.resolve(); + + expect(socketA.connect).not.toHaveBeenCalled(); + expect(socketA.disconnect).toHaveBeenCalledOnce(); + expect(socketA.off).toHaveBeenCalledWith('authentication:error', staleAuthenticationHandler); + expect(socketA.handlers.size).toBe(0); + expect(socketB.disconnect).not.toHaveBeenCalled(); + expect(socketB.connect).not.toHaveBeenCalled(); + }); + + it('drops every application event dispatched by a stale socket scope', () => { + const received = { + task: vi.fn(), + draft: vi.fn(), + indexing: vi.fn(), + queue: vi.fn(), + live: vi.fn(), + }; + const Subscriber = () => { + const value = useSocket(); + useEffect(() => { + const unsubscribe = [ + value.onTaskUpdate(received.task), + value.onDraftUpdate(received.draft), + value.onIndexingUpdate(received.indexing), + value.onQueueStatsUpdate(received.queue), + value.onTaskLiveUpdate(received.live), + ]; + return () => unsubscribe.forEach(remove => remove()); + }, [value]); + return null; + }; + state.scope = scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA'); + render(); + const staleHandlers = new Map(sockets[0].handlers); + + publish(scope('profile-b', 'BBBBBBBBBBBBBBBBBBBBBB')); + act(() => { + staleHandlers.get(TASK_UPDATE)?.({ id: 'stale-task' }); + staleHandlers.get(DRAFT_UPDATE)?.({ id: 'stale-draft' }); + staleHandlers.get(INDEXING_UPDATE)?.({ id: 'stale-indexing' }); + staleHandlers.get(QUEUE_STATS_UPDATE)?.({ id: 'stale-queue' }); + staleHandlers.get(TASK_LIVE_UPDATE)?.({ id: 'stale-live' }); + }); + + Object.values(received).forEach(callback => expect(callback).not.toHaveBeenCalled()); + + act(() => { + sockets[1].handlers.get(TASK_UPDATE)?.({ id: 'current-task' }); + sockets[1].handlers.get(DRAFT_UPDATE)?.({ id: 'current-draft' }); + sockets[1].handlers.get(INDEXING_UPDATE)?.({ id: 'current-indexing' }); + sockets[1].handlers.get(QUEUE_STATS_UPDATE)?.({ id: 'current-queue' }); + sockets[1].handlers.get(TASK_LIVE_UPDATE)?.({ id: 'current-live' }); + }); + Object.values(received).forEach(callback => expect(callback).toHaveBeenCalledOnce()); + }); + + it('fully detaches listeners and disconnects on unmount', () => { + state.scope = scope('profile-a', 'AAAAAAAAAAAAAAAAAAAAAA'); + const { unmount } = render(
app
); + const socketA = sockets[0]; - expect(connectSocketMock).toHaveBeenCalledWith(expect.objectContaining({ - withCredentials: true, - })); unmount(); + + expect(socketA.disconnect).toHaveBeenCalledOnce(); + expect(socketA.handlers.size).toBe(0); + expect(scopeListeners.size).toBe(0); }); }); diff --git a/propr-ui/src/contexts/SocketProvider.tsx b/propr-ui/src/contexts/SocketProvider.tsx index 458fa4280..b81ee0bf6 100644 --- a/propr-ui/src/contexts/SocketProvider.tsx +++ b/propr-ui/src/contexts/SocketProvider.tsx @@ -1,8 +1,15 @@ -import React, { useEffect, useState, useCallback, useRef } from 'react'; +import React, { useEffect, useState, useCallback, useRef, useSyncExternalStore } from 'react'; import type { Socket } from '@propr/client'; -import { TASK_UPDATE, DRAFT_UPDATE, INDEXING_UPDATE, QUEUE_STATS_UPDATE, TASK_LIVE_UPDATE, TaskUpdatePayload, DraftUpdatePayload, IndexingUpdatePayload, QueueStatsUpdatePayload, TaskLiveUpdatePayload } from '@propr/shared'; +import { DESKTOP_TRANSPORT_SCOPE_QUERY, TASK_UPDATE, DRAFT_UPDATE, INDEXING_UPDATE, QUEUE_STATS_UPDATE, TASK_LIVE_UPDATE, TaskUpdatePayload, DraftUpdatePayload, IndexingUpdatePayload, QueueStatsUpdatePayload, TaskLiveUpdatePayload } from '@propr/shared'; import { SocketContext, SocketContextValue } from './SocketContext'; -import { proprClient } from '../api/apiClient'; +import { + getDesktopConnectionScope, + getDesktopSocketConfigurationKey, + handleDesktopAccessCode, + proprClient, + subscribeDesktopConnectionScope, +} from '../api/apiClient'; +import { isDesktopRuntime } from '../config/runtimeMode'; interface SocketProviderProps { children: React.ReactNode; @@ -17,6 +24,11 @@ export const SocketProvider: React.FC = ({ children, disabl const indexingUpdateCallbacksRef = useRef void>>(new Set()); const queueStatsUpdateCallbacksRef = useRef void>>(new Set()); const taskLiveUpdateCallbacksRef = useRef void>>(new Set()); + const socketConfigurationKey = useSyncExternalStore( + subscribeDesktopConnectionScope, + getDesktopSocketConfigurationKey, + getDesktopSocketConfigurationKey, + ); useEffect(() => { if (disabled) { @@ -25,60 +37,122 @@ export const SocketProvider: React.FC = ({ children, disabl return; } + const desktopScope = getDesktopConnectionScope(); + if (isDesktopRuntime() && !desktopScope) { + setSocket(null); + setIsConnected(false); + return; + } + setIsConnected(false); const newSocket = proprClient.connectSocket({ transports: ['websocket'], - withCredentials: true, autoConnect: true, path: '/socket.io/', + forceNew: true, + ...(desktopScope ? { query: { [DESKTOP_TRANSPORT_SCOPE_QUERY]: desktopScope.transportScope } } : {}), }); + let disposed = false; + const isCurrentScope = (): boolean => { + if (disposed) return false; + const current = getDesktopConnectionScope(); + return current?.profileId === desktopScope?.profileId + && current?.transportScope === desktopScope?.transportScope; + }; + const handleAuthenticationCode = (code: string | undefined, reconnect = false): void => { + if (!isCurrentScope()) return; + void handleDesktopAccessCode(code, desktopScope).then(classification => { + if (!isCurrentScope()) return; + if (classification === 'authorization-changed' && reconnect) { + newSocket.disconnect(); + if (!isCurrentScope()) return; + newSocket.connect(); + } + }); + }; - newSocket.on('connect', () => { + const connected = () => { + if (!isCurrentScope()) return; console.log('[SocketContext] Connected to WebSocket server'); setIsConnected(true); - }); + }; - newSocket.on('disconnect', (reason) => { + const disconnected = (reason: string) => { + if (!isCurrentScope()) return; console.log('[SocketContext] Disconnected from WebSocket server:', reason); setIsConnected(false); - }); + }; - newSocket.on('connect_error', (error) => { + const connectionError = (error: Error) => { + if (!isCurrentScope()) return; + setIsConnected(false); console.error('[SocketContext] Connection error:', error.message); - }); + const code = (error as Error & { data?: { code?: string } }).data?.code; + handleAuthenticationCode(code); + }; - // Set up global event listeners - newSocket.on(TASK_UPDATE, (payload: TaskUpdatePayload) => { + const authenticationError = (value: { code?: string } | undefined) => { + handleAuthenticationCode(value?.code, true); + }; + + newSocket.on('connect', connected); + newSocket.on('disconnect', disconnected); + newSocket.on('connect_error', connectionError); + newSocket.on('authentication:error', authenticationError); + + const taskUpdated = (payload: TaskUpdatePayload) => { + if (!isCurrentScope()) return; console.log('[SocketContext] Received task update:', payload); taskUpdateCallbacksRef.current.forEach((callback) => callback(payload)); - }); + }; - newSocket.on(DRAFT_UPDATE, (payload: DraftUpdatePayload) => { + const draftUpdated = (payload: DraftUpdatePayload) => { + if (!isCurrentScope()) return; console.log('[SocketContext] Received draft update:', payload); draftUpdateCallbacksRef.current.forEach((callback) => callback(payload)); - }); + }; - newSocket.on(INDEXING_UPDATE, (payload: IndexingUpdatePayload) => { + const indexingUpdated = (payload: IndexingUpdatePayload) => { + if (!isCurrentScope()) return; console.log('[SocketContext] Received indexing update:', payload); indexingUpdateCallbacksRef.current.forEach((callback) => callback(payload)); - }); + }; - newSocket.on(QUEUE_STATS_UPDATE, (payload: QueueStatsUpdatePayload) => { + const queueStatsUpdated = (payload: QueueStatsUpdatePayload) => { + if (!isCurrentScope()) return; console.log('[SocketContext] Received queue stats update:', payload); queueStatsUpdateCallbacksRef.current.forEach((callback) => callback(payload)); - }); + }; - newSocket.on(TASK_LIVE_UPDATE, (payload: TaskLiveUpdatePayload) => { + const taskLiveUpdated = (payload: TaskLiveUpdatePayload) => { + if (!isCurrentScope()) return; console.log('[SocketContext] Received task live update:', payload); taskLiveUpdateCallbacksRef.current.forEach((callback) => callback(payload)); - }); + }; + + newSocket.on(TASK_UPDATE, taskUpdated); + newSocket.on(DRAFT_UPDATE, draftUpdated); + newSocket.on(INDEXING_UPDATE, indexingUpdated); + newSocket.on(QUEUE_STATS_UPDATE, queueStatsUpdated); + newSocket.on(TASK_LIVE_UPDATE, taskLiveUpdated); setSocket(newSocket); return () => { console.log('[SocketContext] Cleaning up socket connection'); + setIsConnected(false); + disposed = true; + newSocket.off('connect', connected); + newSocket.off('disconnect', disconnected); + newSocket.off('connect_error', connectionError); + newSocket.off('authentication:error', authenticationError); + newSocket.off(TASK_UPDATE, taskUpdated); + newSocket.off(DRAFT_UPDATE, draftUpdated); + newSocket.off(INDEXING_UPDATE, indexingUpdated); + newSocket.off(QUEUE_STATS_UPDATE, queueStatsUpdated); + newSocket.off(TASK_LIVE_UPDATE, taskLiveUpdated); newSocket.disconnect(); }; - }, [disabled]); + }, [disabled, socketConfigurationKey]); const subscribeToTask = useCallback((taskId: string) => { if (socket && isConnected) { diff --git a/propr-ui/src/desktop-deep-link.test.ts b/propr-ui/src/desktop-deep-link.test.ts index b431da2ff..827e17d9a 100644 --- a/propr-ui/src/desktop-deep-link.test.ts +++ b/propr-ui/src/desktop-deep-link.test.ts @@ -6,10 +6,10 @@ describe('desktop open deep-link navigation', () => { const navigate = vi.fn(); const navigation = new DesktopDeepLinkNavigation(navigate); - expect(navigation.receive('propr://open?path=%2Ftasks')).toBe(true); + expect(navigation.receive('propr://open?path=%2Ftasks', 'profile-a')).toBe(true); expect(navigate).not.toHaveBeenCalled(); - navigation.setDashboardReady(); + navigation.setDashboardReady('profile-a'); expect(navigate).toHaveBeenCalledOnce(); expect(navigate).toHaveBeenCalledWith('/tasks'); }); @@ -18,9 +18,9 @@ describe('desktop open deep-link navigation', () => { const navigate = vi.fn(); const navigation = new DesktopDeepLinkNavigation(navigate); - navigation.receive('propr://open?path=%2Fplans'); - navigation.receive('propr://open?path=%2Ftasks'); - navigation.setDashboardReady(); + navigation.receive('propr://open?path=%2Fplans', 'profile-a'); + navigation.receive('propr://open?path=%2Ftasks', 'profile-a'); + navigation.setDashboardReady('profile-a'); expect(navigate.mock.calls).toEqual([['/plans'], ['/tasks']]); }); @@ -28,30 +28,30 @@ describe('desktop open deep-link navigation', () => { it('delivers a valid link received after the dashboard has loaded', () => { const navigate = vi.fn(); const navigation = new DesktopDeepLinkNavigation(navigate); - navigation.setDashboardReady(); + navigation.setDashboardReady('profile-a'); - expect(navigation.receive('propr://open?path=%2Ftasks%3Fstatus%3Dopen%23recent')).toBe(true); + expect(navigation.receive('propr://open?path=%2Ftasks%3Fstatus%3Dopen%23recent', 'profile-a')).toBe(true); expect(navigate).toHaveBeenCalledWith('/tasks?status=open#recent'); }); it('rejects an expanded canonical link and accepts one at the length limit', () => { const navigate = vi.fn(); const navigation = new DesktopDeepLinkNavigation(navigate); - navigation.setDashboardReady(); + navigation.setDashboardReady('profile-a'); const rawPath = `/tasks/${'é '.repeat(300)}end`; const rawLink = `propr://open?path=${rawPath}`; const expandedCanonicalLink = new URL(rawLink).href; expect(rawLink.length).toBeLessThan(2_048); expect(expandedCanonicalLink.length).toBeGreaterThan(2_048); - expect(navigation.receive(expandedCanonicalLink)).toBe(false); + expect(navigation.receive(expandedCanonicalLink, 'profile-a')).toBe(false); const canonicalPrefix = 'propr://open?path=%2Ftasks%2F'; const suffix = 'a'.repeat(2_048 - canonicalPrefix.length); const boundaryCanonicalLink = `${canonicalPrefix}${suffix}`; expect(boundaryCanonicalLink).toHaveLength(2_048); expect(new URL(boundaryCanonicalLink).href).toBe(boundaryCanonicalLink); - expect(navigation.receive(boundaryCanonicalLink)).toBe(true); + expect(navigation.receive(boundaryCanonicalLink, 'profile-a')).toBe(true); expect(navigate).toHaveBeenCalledOnce(); expect(navigate).toHaveBeenCalledWith(`/tasks/${suffix}`); }); @@ -74,9 +74,21 @@ describe('desktop open deep-link navigation', () => { 'propr://open?path=%2Ftasks%3Ftunnel%3Dt-attacker.propr.dev', ]; - rejected.forEach(link => expect(navigation.receive(link), link).toBe(false)); - navigation.setDashboardReady(); - rejected.forEach(link => expect(navigation.receive(link), link).toBe(false)); + rejected.forEach(link => expect(navigation.receive(link, 'profile-a'), link).toBe(false)); + navigation.setDashboardReady('profile-a'); + rejected.forEach(link => expect(navigation.receive(link, 'profile-a'), link).toBe(false)); expect(navigate).not.toHaveBeenCalled(); }); + + it('rejects a stale queued route when a different profile becomes active', () => { + const navigate = vi.fn(); + const reject = vi.fn(); + const navigation = new DesktopDeepLinkNavigation(navigate, reject); + + expect(navigation.receive('propr://open?path=%2Ftasks', 'profile-a')).toBe(true); + navigation.setDashboardReady('profile-b'); + + expect(navigate).not.toHaveBeenCalled(); + expect(reject).toHaveBeenCalledOnce(); + }); }); diff --git a/propr-ui/src/desktop-deep-link.ts b/propr-ui/src/desktop-deep-link.ts index 6972698d1..71833a23d 100644 --- a/propr-ui/src/desktop-deep-link.ts +++ b/propr-ui/src/desktop-deep-link.ts @@ -1,26 +1,75 @@ import { dashboardPathFromDeepLink } from '../../apps/desktop/src/security'; -/** Holds an accepted dashboard route until the shared hash router can observe it. */ +const validProfileId = (value: string): boolean => value.length > 0 && value.length <= 128 && !/[\u0000-\u001F\u007F]/.test(value); + +interface PendingNavigation { + path: string; + profileId: string; +} + +/** Holds accepted routes while binding each one to the profile active when it arrived. */ export class DesktopDeepLinkNavigation { - private dashboardReady = false; - private readonly pendingPaths: string[] = []; + private activeProfileId: string | null = null; + private readonly pending: PendingNavigation[] = []; - constructor(private readonly navigate: (path: string) => void) {} + constructor( + private readonly navigate: (path: string) => void, + private readonly reject: () => void = () => undefined, + ) {} - receive(value: string): boolean { + receive(value: string, profileId: string): boolean { const path = dashboardPathFromDeepLink(value); - if (!path) return false; - if (this.dashboardReady) this.navigate(path); - else this.pendingPaths.push(path); + if (!path || !validProfileId(profileId)) { + this.reject(); + return false; + } + if (this.activeProfileId === profileId) this.navigate(path); + else if (this.activeProfileId === null) this.pending.push({ path, profileId }); + else { + this.reject(); + return false; + } return true; } - setDashboardReady(): void { - this.dashboardReady = true; - this.pendingPaths.splice(0).forEach(path => this.navigate(path)); + setDashboardReady(profileId: string): void { + if (!validProfileId(profileId)) { + this.rejectPending(); + return; + } + this.activeProfileId = profileId; + this.pending.splice(0).forEach(item => { + if (item.profileId === profileId) this.navigate(item.path); + else this.reject(); + }); } setDashboardUnavailable(): void { - this.dashboardReady = false; + this.activeProfileId = null; + } + + rejectPending(): void { + const rejected = this.pending.splice(0).length; + if (rejected > 0) this.reject(); + } +} + +/** One-consumer handoff used between the presentation boundary and desktop experience. */ +export class DesktopDeepLinkInbox { + private listener: ((value: string) => void) | null = null; + private readonly pending: string[] = []; + + receive(value: string): void { + if (this.listener) this.listener(value); + else this.pending.push(value); + } + + subscribe(listener: (value: string) => void): () => void { + if (this.listener) throw new Error('Desktop deep-link inbox already has a consumer'); + this.listener = listener; + this.pending.splice(0).forEach(value => listener(value)); + return () => { + if (this.listener === listener) this.listener = null; + }; } } diff --git a/propr-ui/src/desktop.tsx b/propr-ui/src/desktop.tsx index 7bfee062f..2bf17953f 100644 --- a/propr-ui/src/desktop.tsx +++ b/propr-ui/src/desktop.tsx @@ -1,249 +1,15 @@ -import { StrictMode, type ComponentType, useCallback, useEffect, useState } from 'react'; +import { StrictMode } from 'react'; import { createRoot } from 'react-dom/client'; -import type { - DesktopAppMetadata, - DesktopProfile, - StorageSecurity, -} from '../../apps/desktop/src/shared/contract'; -import { activateDesktopProfile } from './desktop-profile'; -import { DesktopDeepLinkNavigation } from './desktop-deep-link'; +import App from './App'; import './index.css'; -import './desktop.css'; - -const logoUrl = new URL('./media/logo-and-name.png', window.location.href).href; - -export const DesktopTitleBar = ({ - metadata, - profile, - onDisconnect, -}: { - metadata: DesktopAppMetadata | null; - profile: DesktopProfile | null; - onDisconnect?: () => void; -}) => ( -
-
- ProPR - - {profile ? profile.label : 'Desktop'} - -
-
- {metadata && v{metadata.version} · {metadata.platform}} - {onDisconnect && ( - - )} -
-
-); - -export const ConnectionPlaceholder = ({ - metadata, - security, - initialApiUrl, - onConnect, -}: { - metadata: DesktopAppMetadata | null; - security: StorageSecurity | null; - initialApiUrl: string; - onConnect: (label: string, apiBaseUrl: string) => Promise; -}) => { - const [label, setLabel] = useState('Local ProPR'); - const [apiBaseUrl, setApiBaseUrl] = useState(initialApiUrl); - const [error, setError] = useState(null); - const [saving, setSaving] = useState(false); - - useEffect(() => setApiBaseUrl(initialApiUrl), [initialApiUrl]); - - const submit = async (event: React.FormEvent) => { - event.preventDefault(); - setError(null); - setSaving(true); - try { - await onConnect(label, apiBaseUrl); - } catch (caught) { - setError(caught instanceof Error ? caught.message : 'Could not save this connection.'); - } finally { - setSaving(false); - } - }; - - return ( -
-
-
-
-

ProPR Desktop

-

- Connect to your ProPR instance -

-
-
- Not connected -
-
-

- Add an existing instance to open the same dashboard you use on the web. The desktop app will not - install, download, or start runtime components. -

-
- - - {security && !security.available && ( -
- OS-backed encryption is unavailable ({security.backend}). Profiles can still be saved, but this - app will refuse to persist credentials until secure storage is available. -
- )} - {error &&
{error}
} - -
-
- Local lifecycle controls and secure pairing will appear here in a later setup flow. - {metadata && Runtime: Electron on {metadata.platform} ({metadata.arch})} -
-
-
- ); -}; - -export const DesktopRoot = () => { - const bridge = window.proprDesktop; - const [metadata, setMetadata] = useState(null); - const [security, setSecurity] = useState(null); - const [profile, setProfile] = useState(null); - const [DashboardApp, setDashboardApp] = useState(null); - const [initialApiUrl, setInitialApiUrl] = useState('http://localhost:4000'); - const [loading, setLoading] = useState(true); - const [fatalError, setFatalError] = useState(null); - const [deepLinkNavigation] = useState(() => new DesktopDeepLinkNavigation(path => { - window.location.hash = path; - })); - - const loadDashboard = useCallback(async (activeProfile: DesktopProfile) => { - window.__PROPR_CONFIG__ = { apiBaseUrl: activeProfile.apiBaseUrl }; - const application = await import('./App'); - setProfile(activeProfile); - setDashboardApp(() => application.default); - deepLinkNavigation.setDashboardReady(); - }, [deepLinkNavigation]); - - useEffect(() => { - if (!bridge) { - setFatalError('The secure desktop bridge did not load. Restart ProPR Desktop.'); - setLoading(false); - return; - } - let cancelled = false; - const unsubscribe = bridge.app.onDeepLink(value => { - try { - const deepLink = new URL(value); - if (deepLink.hostname === 'connect') { - const apiUrl = deepLink.searchParams.get('api'); - if (apiUrl) setInitialApiUrl(apiUrl); - } else if (deepLink.hostname === 'open') { - deepLinkNavigation.receive(value); - } - } catch { - // Main validates protocol input; ignore malformed values defensively. - } - }); - void Promise.all([bridge.app.getMetadata(), bridge.storage.security(), bridge.profiles.list()]) - .then(async ([appMetadata, storageSecurity, profiles]) => { - if (cancelled) return; - setMetadata(appMetadata); - setSecurity(storageSecurity); - const active = profiles.profiles.find(item => item.id === profiles.activeProfileId); - if (active) await loadDashboard(active); - }) - .catch(error => { - if (!cancelled) setFatalError(error instanceof Error ? error.message : 'Desktop startup failed.'); - }) - .finally(() => { - if (!cancelled) setLoading(false); - }); - return () => { - cancelled = true; - unsubscribe(); - }; - }, [bridge, deepLinkNavigation, loadDashboard]); - - const connect = async (label: string, apiBaseUrl: string) => { - if (!bridge) return; - const saved = await bridge.profiles.save({ label, apiBaseUrl }); - await activateDesktopProfile(bridge.profiles, saved); - }; - - const disconnect = async () => { - if (!bridge) return; - await bridge.profiles.setActive(null); - setProfile(null); - setDashboardApp(null); - deepLinkNavigation.setDashboardUnavailable(); - window.__PROPR_CONFIG__ = undefined; - window.location.hash = ''; - }; - - if (loading) { - return ( -
- -
Starting ProPR Desktop…
-
- ); - } - - if (fatalError) { - return ( -
- -
-
- {fatalError} -
-
-
- ); - } - - return ( -
- -
- {profile && DashboardApp - ? - : } -
-
- ); -}; const container = document.getElementById('root'); if (!container) throw new Error('Root container missing in renderer.html'); -createRoot(container).render(); + +if (location.hash === '#packaged-transport-smoke') { + void import('./desktop/packagedTransportSmoke').then(({ installPackagedTransportSmokeHarness }) => { + installPackagedTransportSmokeHarness(); + }); +} + +createRoot(container).render(); diff --git a/propr-ui/src/desktop/DesktopExperience.management.test.tsx b/propr-ui/src/desktop/DesktopExperience.management.test.tsx new file mode 100644 index 000000000..105064d07 --- /dev/null +++ b/propr-ui/src/desktop/DesktopExperience.management.test.tsx @@ -0,0 +1,170 @@ +import { act, fireEvent, screen, waitFor } from '@testing-library/react'; +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'; +import { adaptersFor, deferred, localProfile, remoteProfile, renderConnectedExperience } from './DesktopExperience.testUtils'; +import type { DesktopConnectionResult } from './types'; + +const apiMock = vi.hoisted(() => ({ setApiBaseUrl: vi.fn() })); +const runtimeMock = vi.hoisted(() => ({ setDesktopApiBaseUrl: vi.fn() })); + +vi.mock('../api/apiClient', () => ({ setApiBaseUrl: apiMock.setApiBaseUrl })); +vi.mock('../config/runtimeConfig', () => ({ setDesktopApiBaseUrl: runtimeMock.setDesktopApiBaseUrl })); + +describe('DesktopExperience profile management', () => { + beforeEach(() => { + vi.clearAllMocks(); + vi.spyOn(window, 'confirm').mockReturnValue(true); + }); + + afterEach(() => vi.restoreAllMocks()); + + it('opens instance management with the desktop shortcut and exposes connection status', async () => { + const adapters = adaptersFor([localProfile], localProfile.id); + renderConnectedExperience(adapters); + expect(await screen.findByRole('button', { name: 'Connected: This computer' })).toBeInTheDocument(); + fireEvent.keyDown(document, { key: ',', ctrlKey: true }); + expect(await screen.findByRole('dialog', { name: 'Manage instances' })).toBeInTheDocument(); + fireEvent.keyDown(document, { key: 'Escape' }); + await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument()); + }); + + it('traps modal focus, makes the app inert, and restores focus to the opener', async () => { + const adapters = adaptersFor([localProfile], localProfile.id); + renderConnectedExperience(adapters); + const opener = await screen.findByRole('button', { name: 'Connected: This computer' }); + opener.focus(); + fireEvent.click(opener); + const dialog = await screen.findByRole('dialog', { name: 'Manage instances' }); + const app = opener.closest('.desktop-app'); + const close = screen.getByRole('button', { name: 'Close instance manager' }); + const last = screen.getByRole('button', { name: /Add instance/i }); + expect(app).toHaveAttribute('inert'); + expect(app).toHaveAttribute('aria-hidden', 'true'); + expect(dialog).toContainElement(close); + expect(close).toHaveFocus(); + close.focus(); + fireEvent.keyDown(document, { key: 'Tab', shiftKey: true }); + expect(last).toHaveFocus(); + fireEvent.keyDown(document, { key: 'Tab' }); + expect(close).toHaveFocus(); + fireEvent.keyDown(document, { key: 'Escape' }); + await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument()); + expect(app).not.toHaveAttribute('inert'); + expect(opener).toHaveFocus(); + }); + + it('connects a new instance added from the manager', async () => { + const adapters = adaptersFor([localProfile], localProfile.id); + renderConnectedExperience(adapters, 'Connected app'); + expect(await screen.findByText('Connected app')).toBeInTheDocument(); + vi.clearAllMocks(); + await waitFor(() => { + fireEvent.keyDown(document, { key: ',', ctrlKey: true }); + expect(screen.getByRole('dialog', { name: 'Manage instances' })).toBeInTheDocument(); + }); + fireEvent.click(await screen.findByRole('button', { name: /Add instance/i })); + fireEvent.change(screen.getByLabelText('Display name'), { target: { value: 'New server' } }); + fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://new.example.com/' } }); + fireEvent.click(screen.getByRole('button', { name: 'Connect' })); + expect(await screen.findByText('Connected app')).toBeInTheDocument(); + expect(adapters.connection.probe).toHaveBeenCalledWith(expect.objectContaining({ name: 'New server', baseUrl: 'https://new.example.com' })); + expect(adapters.profiles.setActiveId).toHaveBeenCalledWith(expect.any(String)); + expect(runtimeMock.setDesktopApiBaseUrl).toHaveBeenLastCalledWith('https://new.example.com'); + expect(apiMock.setApiBaseUrl).toHaveBeenLastCalledWith('https://new.example.com'); + }); + + it.each(['new', 'active'] as const)('closes the instance manager after a %s profile starts connecting', async profileKind => { + const pendingProbe = deferred(); + const probe = vi.fn().mockResolvedValueOnce({ status: 'ready', version: '0.8.15' }).mockImplementationOnce(() => pendingProbe.promise); + const adapters = adaptersFor([localProfile], localProfile.id, probe); + renderConnectedExperience(adapters, 'Connected app'); + expect(await screen.findByText('Connected app')).toBeInTheDocument(); + await waitFor(() => { + fireEvent.keyDown(document, { key: ',', ctrlKey: true }); + expect(screen.getByRole('dialog', { name: 'Manage instances' })).toBeInTheDocument(); + }); + if (profileKind === 'new') { + fireEvent.click(await screen.findByRole('button', { name: /Add instance/i })); + fireEvent.change(screen.getByLabelText('Display name'), { target: { value: 'New server' } }); + fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://new.example.com/' } }); + fireEvent.click(screen.getByRole('button', { name: 'Connect' })); + } else { + fireEvent.click(await screen.findByRole('button', { name: 'Edit This computer' })); + fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://active.example.com/' } }); + fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); + } + expect(await screen.findByRole('heading', { name: new RegExp(`Connecting to ${profileKind === 'new' ? 'New server' : 'This computer'}`) })).toBeInTheDocument(); + await act(async () => { pendingProbe.resolve({ status: 'ready', version: '0.8.15' }); }); + const app = await screen.findByText('Connected app'); + expect(screen.queryByRole('dialog', { name: 'Manage instances' })).not.toBeInTheDocument(); + expect(app.closest('.desktop-app')).not.toHaveAttribute('inert'); + expect(app.closest('.desktop-app')).not.toHaveAttribute('aria-hidden'); + }); + + it('reconnects an edited active instance but saves an inactive edit without connecting', async () => { + const adapters = adaptersFor([localProfile, remoteProfile], localProfile.id); + renderConnectedExperience(adapters, 'Connected app'); + expect(await screen.findByText('Connected app')).toBeInTheDocument(); + vi.clearAllMocks(); + fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); + fireEvent.click(await screen.findByRole('button', { name: 'Edit This computer' })); + fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://active.example.com/' } }); + fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); + expect(await screen.findByText('Connected app')).toBeInTheDocument(); + expect(adapters.connection.probe).toHaveBeenCalledWith(expect.objectContaining({ baseUrl: 'https://active.example.com' })); + expect(adapters.profiles.save).toHaveBeenCalledWith(expect.objectContaining({ baseUrl: 'https://active.example.com' })); + expect(adapters.profiles.setActiveId).not.toHaveBeenCalled(); + expect(apiMock.setApiBaseUrl).toHaveBeenLastCalledWith('https://active.example.com'); + vi.clearAllMocks(); + fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); + fireEvent.click(await screen.findByRole('button', { name: 'Edit Team server' })); + fireEvent.change(screen.getByLabelText('Display name'), { target: { value: 'Renamed team server' } }); + fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); + expect(await screen.findByText('Renamed team server')).toBeInTheDocument(); + expect(adapters.profiles.save).toHaveBeenCalledWith(expect.objectContaining({ id: 'remote', name: 'Renamed team server' })); + expect(adapters.connection.probe).not.toHaveBeenCalled(); + expect(apiMock.setApiBaseUrl).not.toHaveBeenCalled(); + }); + + it('does not persist an active profile edit until the updated connection is ready', async () => { + const probe = vi.fn().mockResolvedValueOnce({ status: 'ready', version: '0.8.15' }).mockResolvedValueOnce({ status: 'offline', message: 'The updated server is unavailable.' }); + const adapters = adaptersFor([localProfile], localProfile.id, probe); + renderConnectedExperience(adapters, 'Connected app'); + expect(await screen.findByText('Connected app')).toBeInTheDocument(); + vi.clearAllMocks(); + fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); + fireEvent.click(await screen.findByRole('button', { name: 'Edit This computer' })); + fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://unavailable.example.com/' } }); + fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); + expect(await screen.findByText('The updated server is unavailable.')).toBeInTheDocument(); + expect(adapters.profiles.save).not.toHaveBeenCalled(); + expect(adapters.profiles.setActiveId).not.toHaveBeenCalled(); + expect(runtimeMock.setDesktopApiBaseUrl).not.toHaveBeenCalled(); + expect(apiMock.setApiBaseUrl).not.toHaveBeenCalled(); + }); + + it('keeps a failed save in the manager editor so it can be retried', async () => { + const adapters = adaptersFor([localProfile, remoteProfile], localProfile.id); + vi.mocked(adapters.profiles.save).mockResolvedValueOnce(undefined).mockRejectedValueOnce(new Error('Profile storage is locked.')).mockResolvedValueOnce(undefined); + renderConnectedExperience(adapters, 'Connected app'); + expect(await screen.findByText('Connected app')).toBeInTheDocument(); + fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); + fireEvent.click(await screen.findByRole('button', { name: 'Edit Team server' })); + fireEvent.change(screen.getByLabelText('Display name'), { target: { value: 'Retryable edit' } }); + fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); + expect(await screen.findByRole('alert')).toHaveTextContent(/could not save this instance.*storage is locked.*try again/i); + expect(screen.getByLabelText('Display name')).toHaveValue('Retryable edit'); + fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); + expect(await screen.findByText('Retryable edit')).toBeInTheDocument(); + }); + + it('keeps a profile visible and reports a rejected removal', async () => { + const adapters = adaptersFor([remoteProfile]); + vi.mocked(adapters.profiles.remove).mockRejectedValueOnce(new Error('Profile storage is locked.')); + renderConnectedExperience(adapters); + expect(await screen.findByText('Team server')).toBeInTheDocument(); + fireEvent.click(screen.getByRole('button', { name: 'Remove Team server' })); + expect(await screen.findByRole('alert')).toHaveTextContent(/could not remove this instance.*storage is locked.*try again/i); + expect(screen.getByText('Team server')).toBeInTheDocument(); + expect(adapters.profiles.remove).toHaveBeenCalledWith(remoteProfile.id); + }); +}); diff --git a/propr-ui/src/desktop/DesktopExperience.test.tsx b/propr-ui/src/desktop/DesktopExperience.test.tsx index 24ff3e8a8..f78b25634 100644 --- a/propr-ui/src/desktop/DesktopExperience.test.tsx +++ b/propr-ui/src/desktop/DesktopExperience.test.tsx @@ -1,8 +1,9 @@ import { act, fireEvent, render, screen, waitFor } from '@testing-library/react'; import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'; import { DesktopExperience } from './DesktopExperience'; -import { DesktopTitleBar } from './DesktopTitleBar'; -import type { DesktopAdapters, DesktopConnectionResult, DesktopProfile } from './types'; +import { DesktopDeepLinkInbox } from '../desktop-deep-link'; +import { adaptersFor, deferred, localProfile, remoteProfile } from './DesktopExperience.testUtils'; +import type { DesktopConnectionResult, DesktopProfile } from './types'; const apiMock = vi.hoisted(() => ({ setApiBaseUrl: vi.fn() })); const runtimeMock = vi.hoisted(() => ({ setDesktopApiBaseUrl: vi.fn() })); @@ -10,53 +11,6 @@ const runtimeMock = vi.hoisted(() => ({ setDesktopApiBaseUrl: vi.fn() })); vi.mock('../api/apiClient', () => ({ setApiBaseUrl: apiMock.setApiBaseUrl })); vi.mock('../config/runtimeConfig', () => ({ setDesktopApiBaseUrl: runtimeMock.setDesktopApiBaseUrl })); -const localProfile: DesktopProfile = { - id: 'local', - name: 'This computer', - baseUrl: 'http://127.0.0.1:3000', - kind: 'local', -}; - -const remoteProfile: DesktopProfile = { - id: 'remote', - name: 'Team server', - baseUrl: 'https://propr.example.com', - kind: 'remote', -}; - -const adaptersFor = ( - profiles: DesktopProfile[] = [], - activeId: string | null = null, - probe: (profile: DesktopProfile) => Promise = async () => ({ status: 'ready', version: '0.8.15' }) -): DesktopAdapters => ({ - platform: 'linux', - profiles: { - list: vi.fn(async () => profiles), - save: vi.fn(async () => undefined), - remove: vi.fn(async () => undefined), - getActiveId: vi.fn(async () => activeId), - setActiveId: vi.fn(async () => undefined), - }, - discovery: { discover: vi.fn(async () => []) }, - authentication: { authenticate: vi.fn(async () => undefined) }, - externalBrowser: { open: vi.fn(async () => undefined) }, - localSetup: { setup: vi.fn(async () => localProfile) }, - connection: { probe: vi.fn(probe) }, -}); - -function deferred() { - let resolve!: (value: T) => void; - const promise = new Promise(complete => { resolve = complete; }); - return { promise, resolve }; -} - -const renderConnectedExperience = (adapters: DesktopAdapters, content?: string) => render( - - - {content &&
{content}
} - -); - describe('DesktopExperience', () => { beforeEach(() => { vi.clearAllMocks(); @@ -76,8 +30,15 @@ describe('DesktopExperience', () => { fireEvent.click(screen.getByRole('button', { name: /Set up this computer/i })); + expect(await screen.findByRole('heading', { name: 'Check the essentials' })).toBeInTheDocument(); + for (let step = 0; step < 5; step += 1) { + fireEvent.click(screen.getByRole('button', { name: /Continue/i })); + } + fireEvent.click(screen.getByRole('button', { name: /Install ProPR/i })); + fireEvent.click(await screen.findByRole('button', { name: /Open dashboard/i })); + expect(await screen.findByText('Shared route tree')).toBeInTheDocument(); - expect(adapters.localSetup.setup).toHaveBeenCalledOnce(); + expect(adapters.localSetup.start).toHaveBeenCalledOnce(); expect(adapters.connection.probe).toHaveBeenCalledWith(localProfile); expect(adapters.profiles.save).toHaveBeenCalledWith(expect.objectContaining({ id: 'local' })); expect(adapters.profiles.setActiveId).toHaveBeenCalledWith('local'); @@ -85,6 +46,109 @@ describe('DesktopExperience', () => { expect(apiMock.setApiBaseUrl).toHaveBeenCalledWith(localProfile.baseUrl); }); + it('stages a Connect deep link for explicit confirmation without probing or mutating profiles', async () => { + const adapters = adaptersFor(); + const deepLinks = new DesktopDeepLinkInbox(); + render(
Shared route tree
); + + expect(await screen.findByRole('heading', { name: 'Let’s set up this computer' })).toBeInTheDocument(); + vi.clearAllMocks(); + act(() => deepLinks.receive('propr://connect?api=https%3A%2F%2Fcandidate.example')); + + expect(await screen.findByRole('status')).toHaveTextContent(/untrusted instance address/i); + expect(screen.getByLabelText('Instance URL')).toHaveValue('https://candidate.example'); + expect(adapters.discovery.discover).not.toHaveBeenCalled(); + expect(adapters.connection.probe).not.toHaveBeenCalled(); + expect(adapters.authentication.authenticate).not.toHaveBeenCalled(); + expect(adapters.profiles.save).not.toHaveBeenCalled(); + expect(adapters.profiles.setActiveId).not.toHaveBeenCalled(); + expect(window.location.hash).toBe(''); + + fireEvent.click(screen.getByRole('button', { name: 'Connect' })); + expect(await screen.findByText('Shared route tree')).toBeInTheDocument(); + expect(adapters.connection.probe).toHaveBeenCalledOnce(); + expect(adapters.profiles.save).toHaveBeenCalledOnce(); + expect(adapters.profiles.setActiveId).toHaveBeenCalledOnce(); + }); + + it('routes a bounded Open deep link only for the validated active profile', async () => { + const adapters = adaptersFor([localProfile], localProfile.id); + const deepLinks = new DesktopDeepLinkInbox(); + window.location.hash = ''; + render(
Connected app
); + + expect(await screen.findByText('Connected app')).toBeInTheDocument(); + act(() => deepLinks.receive('propr://open?path=%2Ftasks%3Fstatus%3Dopen')); + expect(window.location.hash).toBe('#/tasks?status=open'); + }); + + it('uses one fixed redacted UI state for malformed desktop links', async () => { + const adapters = adaptersFor(); + const deepLinks = new DesktopDeepLinkInbox(); + render(
Connected app
); + + expect(await screen.findByRole('heading', { name: 'Let’s set up this computer' })).toBeInTheDocument(); + act(() => deepLinks.receive('propr://open?path=SENTINEL_ATTACKER_VALUE')); + const alert = await screen.findByRole('alert'); + expect(alert).toHaveTextContent('ProPR Desktop could not use that link. Choose an instance and try again.'); + expect(alert).not.toHaveTextContent('SENTINEL_ATTACKER_VALUE'); + expect(adapters.profiles.save).not.toHaveBeenCalled(); + expect(adapters.profiles.setActiveId).not.toHaveBeenCalled(); + }); + + it.each(['macos', 'windows'] as const)('activates an existing remote profile on %s', async platform => { + const adapters = adaptersFor([remoteProfile], remoteProfile.id); + adapters.platform = platform; + render(
Remote dashboard
); + + expect(await screen.findByText('Remote dashboard')).toBeInTheDocument(); + expect(adapters.connection.probe).toHaveBeenCalledWith(remoteProfile); + expect(runtimeMock.setDesktopApiBaseUrl).toHaveBeenCalledWith(remoteProfile.baseUrl); + }); + + it('keeps local activation selected without publishing a remote bearer scope', async () => { + const adapters = adaptersFor([localProfile]); + adapters.connection.activate = vi.fn(async (profile, result) => { + await adapters.profiles.setActiveId(profile.id); + return result; + }); + adapters.connection.publishActivation = vi.fn(); + adapters.connection.deactivate = vi.fn(); + render(
Local dashboard
); + + fireEvent.click((await screen.findByText('This computer')).closest('button')!); + + expect(await screen.findByText('Local dashboard')).toBeInTheDocument(); + expect(adapters.profiles.save).toHaveBeenCalledWith(expect.objectContaining({ id: localProfile.id })); + expect(adapters.profiles.setActiveId).toHaveBeenCalledWith(localProfile.id); + expect(adapters.connection.publishActivation).not.toHaveBeenCalled(); + expect(adapters.connection.deactivate).toHaveBeenCalledOnce(); + expect(apiMock.setApiBaseUrl).toHaveBeenCalledWith(localProfile.baseUrl); + }); + + it('publishes only the ticketed remote activation result', async () => { + const adapters = adaptersFor([remoteProfile], remoteProfile.id); + const activated: Extract = { + status: 'ready', + version: '0.8.15', + profileId: remoteProfile.id, + transportScope: 'remote-scope', + identityEpoch: 'R'.repeat(22), + }; + adapters.connection.activate = vi.fn(async () => activated); + adapters.connection.publishActivation = vi.fn(); + adapters.connection.deactivate = vi.fn(); + render(
Scoped dashboard
); + + expect(await screen.findByText('Scoped dashboard')).toBeInTheDocument(); + expect(adapters.connection.publishActivation).toHaveBeenCalledWith( + expect.objectContaining({ id: remoteProfile.id }), + activated, + ); + expect(adapters.connection.deactivate).not.toHaveBeenCalled(); + expect(apiMock.setApiBaseUrl).not.toHaveBeenCalled(); + }); + it('shows a retryable offline state and recovers without reloading', async () => { const probe = vi.fn() .mockResolvedValueOnce({ status: 'offline', message: 'The instance is offline.' }) @@ -227,181 +291,6 @@ describe('DesktopExperience', () => { })); }); - it('opens instance management with the desktop shortcut and exposes connection status', async () => { - const adapters = adaptersFor([localProfile], localProfile.id); - renderConnectedExperience(adapters); - - expect(await screen.findByRole('button', { name: 'Connected: This computer' })).toBeInTheDocument(); - fireEvent.keyDown(document, { key: ',', ctrlKey: true }); - expect(await screen.findByRole('dialog', { name: 'Manage instances' })).toBeInTheDocument(); - fireEvent.keyDown(document, { key: 'Escape' }); - await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument()); - }); - - it('traps modal focus, makes the app inert, and restores focus to the opener', async () => { - const adapters = adaptersFor([localProfile], localProfile.id); - renderConnectedExperience(adapters); - - const opener = await screen.findByRole('button', { name: 'Connected: This computer' }); - opener.focus(); - fireEvent.click(opener); - - const dialog = await screen.findByRole('dialog', { name: 'Manage instances' }); - const app = opener.closest('.desktop-app'); - const close = screen.getByRole('button', { name: 'Close instance manager' }); - const last = screen.getByRole('button', { name: /Add instance/i }); - expect(app).toHaveAttribute('inert'); - expect(app).toHaveAttribute('aria-hidden', 'true'); - expect(dialog).toContainElement(close); - expect(close).toHaveFocus(); - - close.focus(); - fireEvent.keyDown(document, { key: 'Tab', shiftKey: true }); - expect(last).toHaveFocus(); - fireEvent.keyDown(document, { key: 'Tab' }); - expect(close).toHaveFocus(); - - fireEvent.keyDown(document, { key: 'Escape' }); - await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument()); - expect(app).not.toHaveAttribute('inert'); - expect(opener).toHaveFocus(); - }); - - it('connects a new instance added from the manager', async () => { - const adapters = adaptersFor([localProfile], localProfile.id); - renderConnectedExperience(adapters, 'Connected app'); - - expect(await screen.findByText('Connected app')).toBeInTheDocument(); - vi.clearAllMocks(); - fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); - fireEvent.click(await screen.findByRole('button', { name: /Add instance/i })); - fireEvent.change(screen.getByLabelText('Display name'), { target: { value: 'New server' } }); - fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://new.example.com/' } }); - fireEvent.click(screen.getByRole('button', { name: 'Connect' })); - - expect(await screen.findByText('Connected app')).toBeInTheDocument(); - expect(adapters.connection.probe).toHaveBeenCalledWith(expect.objectContaining({ - name: 'New server', - baseUrl: 'https://new.example.com', - })); - expect(adapters.profiles.setActiveId).toHaveBeenCalledWith(expect.any(String)); - expect(runtimeMock.setDesktopApiBaseUrl).toHaveBeenLastCalledWith('https://new.example.com'); - expect(apiMock.setApiBaseUrl).toHaveBeenLastCalledWith('https://new.example.com'); - }); - - it.each(['new', 'active'] as const)('closes the instance manager after a %s profile starts connecting', async profileKind => { - const pendingProbe = deferred(); - const probe = vi.fn() - .mockResolvedValueOnce({ status: 'ready', version: '0.8.15' }) - .mockImplementationOnce(() => pendingProbe.promise); - const adapters = adaptersFor([localProfile], localProfile.id, probe); - renderConnectedExperience(adapters, 'Connected app'); - - expect(await screen.findByText('Connected app')).toBeInTheDocument(); - fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); - if (profileKind === 'new') { - fireEvent.click(await screen.findByRole('button', { name: /Add instance/i })); - fireEvent.change(screen.getByLabelText('Display name'), { target: { value: 'New server' } }); - fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://new.example.com/' } }); - fireEvent.click(screen.getByRole('button', { name: 'Connect' })); - } else { - fireEvent.click(await screen.findByRole('button', { name: 'Edit This computer' })); - fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://active.example.com/' } }); - fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); - } - - expect(await screen.findByRole('heading', { name: new RegExp(`Connecting to ${profileKind === 'new' ? 'New server' : 'This computer'}`) })).toBeInTheDocument(); - await act(async () => { pendingProbe.resolve({ status: 'ready', version: '0.8.15' }); }); - - const app = await screen.findByText('Connected app'); - expect(screen.queryByRole('dialog', { name: 'Manage instances' })).not.toBeInTheDocument(); - expect(app.closest('.desktop-app')).not.toHaveAttribute('inert'); - expect(app.closest('.desktop-app')).not.toHaveAttribute('aria-hidden'); - }); - - it('reconnects an edited active instance but saves an inactive edit without connecting', async () => { - const adapters = adaptersFor([localProfile, remoteProfile], localProfile.id); - renderConnectedExperience(adapters, 'Connected app'); - - expect(await screen.findByText('Connected app')).toBeInTheDocument(); - vi.clearAllMocks(); - fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); - fireEvent.click(await screen.findByRole('button', { name: 'Edit This computer' })); - fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://active.example.com/' } }); - fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); - - expect(await screen.findByText('Connected app')).toBeInTheDocument(); - expect(adapters.connection.probe).toHaveBeenCalledWith(expect.objectContaining({ baseUrl: 'https://active.example.com' })); - expect(adapters.profiles.save).toHaveBeenCalledWith(expect.objectContaining({ baseUrl: 'https://active.example.com' })); - expect(adapters.profiles.setActiveId).not.toHaveBeenCalled(); - expect(apiMock.setApiBaseUrl).toHaveBeenLastCalledWith('https://active.example.com'); - - vi.clearAllMocks(); - fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); - fireEvent.click(await screen.findByRole('button', { name: 'Edit Team server' })); - fireEvent.change(screen.getByLabelText('Display name'), { target: { value: 'Renamed team server' } }); - fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); - - expect(await screen.findByText('Renamed team server')).toBeInTheDocument(); - expect(adapters.profiles.save).toHaveBeenCalledWith(expect.objectContaining({ id: 'remote', name: 'Renamed team server' })); - expect(adapters.connection.probe).not.toHaveBeenCalled(); - expect(apiMock.setApiBaseUrl).not.toHaveBeenCalled(); - }); - - it('does not persist an active profile edit until the updated connection is ready', async () => { - const probe = vi.fn() - .mockResolvedValueOnce({ status: 'ready', version: '0.8.15' }) - .mockResolvedValueOnce({ status: 'offline', message: 'The updated server is unavailable.' }); - const adapters = adaptersFor([localProfile], localProfile.id, probe); - renderConnectedExperience(adapters, 'Connected app'); - - expect(await screen.findByText('Connected app')).toBeInTheDocument(); - vi.clearAllMocks(); - fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); - fireEvent.click(await screen.findByRole('button', { name: 'Edit This computer' })); - fireEvent.change(screen.getByLabelText('Instance URL'), { target: { value: 'https://unavailable.example.com/' } }); - fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); - - expect(await screen.findByText('The updated server is unavailable.')).toBeInTheDocument(); - expect(adapters.profiles.save).not.toHaveBeenCalled(); - expect(adapters.profiles.setActiveId).not.toHaveBeenCalled(); - expect(runtimeMock.setDesktopApiBaseUrl).not.toHaveBeenCalled(); - expect(apiMock.setApiBaseUrl).not.toHaveBeenCalled(); - }); - - it('keeps a failed save in the manager editor so it can be retried', async () => { - const adapters = adaptersFor([localProfile, remoteProfile], localProfile.id); - vi.mocked(adapters.profiles.save) - .mockResolvedValueOnce(undefined) - .mockRejectedValueOnce(new Error('Profile storage is locked.')) - .mockResolvedValueOnce(undefined); - renderConnectedExperience(adapters, 'Connected app'); - - expect(await screen.findByText('Connected app')).toBeInTheDocument(); - fireEvent.click(await screen.findByRole('button', { name: 'Connected: This computer' })); - fireEvent.click(await screen.findByRole('button', { name: 'Edit Team server' })); - fireEvent.change(screen.getByLabelText('Display name'), { target: { value: 'Retryable edit' } }); - fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); - - expect(await screen.findByRole('alert')).toHaveTextContent(/could not save this instance.*storage is locked.*try again/i); - expect(screen.getByLabelText('Display name')).toHaveValue('Retryable edit'); - fireEvent.click(screen.getByRole('button', { name: 'Save changes' })); - expect(await screen.findByText('Retryable edit')).toBeInTheDocument(); - }); - - it('keeps a profile visible and reports a rejected removal', async () => { - const adapters = adaptersFor([remoteProfile]); - vi.mocked(adapters.profiles.remove).mockRejectedValueOnce(new Error('Profile storage is locked.')); - render(
Connected app
); - - expect(await screen.findByText('Team server')).toBeInTheDocument(); - fireEvent.click(screen.getByRole('button', { name: 'Remove Team server' })); - - expect(await screen.findByRole('alert')).toHaveTextContent(/could not remove this instance.*storage is locked.*try again/i); - expect(screen.getByText('Team server')).toBeInTheDocument(); - expect(adapters.profiles.remove).toHaveBeenCalledWith(remoteProfile.id); - }); - it('reconnects after authentication completes and advances to the connected app', async () => { const probe = vi.fn() .mockResolvedValueOnce({ status: 'authentication-required', message: 'Please sign in.' }) diff --git a/propr-ui/src/desktop/DesktopExperience.testUtils.tsx b/propr-ui/src/desktop/DesktopExperience.testUtils.tsx new file mode 100644 index 000000000..c8e881c14 --- /dev/null +++ b/propr-ui/src/desktop/DesktopExperience.testUtils.tsx @@ -0,0 +1,64 @@ +import { render } from '@testing-library/react'; +import { vi } from 'vitest'; +import { DesktopExperience } from './DesktopExperience'; +import { DesktopTitleBar } from './DesktopTitleBar'; +import type { DesktopAdapters, DesktopConnectionResult, DesktopProfile } from './types'; + +export const localProfile: DesktopProfile = { + id: 'local', name: 'This computer', baseUrl: 'http://127.0.0.1:3000', kind: 'local', +}; + +export const remoteProfile: DesktopProfile = { + id: 'remote', name: 'Team server', baseUrl: 'https://propr.example.com', kind: 'remote', +}; + +export const adaptersFor = ( + profiles: DesktopProfile[] = [], + activeId: string | null = null, + probe: (profile: DesktopProfile) => Promise = async () => ({ status: 'ready', version: '0.8.15' }), +): DesktopAdapters => ({ + platform: 'linux', + app: { onDeepLink: vi.fn(() => () => undefined) }, + profiles: { + list: vi.fn(async () => profiles), save: vi.fn(async () => undefined), remove: vi.fn(async () => undefined), + getActiveId: vi.fn(async () => activeId), setActiveId: vi.fn(async () => undefined), + }, + discovery: { discover: vi.fn(async () => []) }, + authentication: { authenticate: vi.fn(async () => undefined) }, + externalBrowser: { open: vi.fn(async () => undefined) }, + localSetup: { + status: vi.fn(async () => ({ + phase: 'idle' as const, + capability: { supported: true as const, kind: 'local' as const, platform: 'linux' as const }, + sessionId: '00000000-0000-4000-8000-000000000000', rootDir: '/tmp/propr', logs: [], + })), + start: vi.fn(async () => ({ + phase: 'completed' as const, + capability: { supported: true as const, kind: 'local' as const, platform: 'linux' as const }, + sessionId: '00000000-0000-4000-8000-000000000000', rootDir: '/tmp/propr', logs: [], profile: localProfile, + })), + retry: vi.fn(async () => { throw new Error('not used'); }), + cancel: vi.fn(async () => ({ + phase: 'cancelled' as const, + capability: { supported: true as const, kind: 'local' as const, platform: 'linux' as const }, + sessionId: '00000000-0000-4000-8000-000000000000', logs: [], + })), + selectPrivateKey: vi.fn(async () => null), + acquireWebhookSecret: vi.fn(async () => null), + onProgress: vi.fn(() => () => undefined), + }, + connection: { probe: vi.fn(probe) }, +}); + +export function deferred() { + let resolve!: (value: T) => void; + const promise = new Promise(complete => { resolve = complete; }); + return { promise, resolve }; +} + +export const renderConnectedExperience = (adapters: DesktopAdapters, content?: string) => render( + + + {content &&
{content}
} + , +); diff --git a/propr-ui/src/desktop/DesktopExperience.tsx b/propr-ui/src/desktop/DesktopExperience.tsx index d2c8239d6..b130a0531 100644 --- a/propr-ui/src/desktop/DesktopExperience.tsx +++ b/propr-ui/src/desktop/DesktopExperience.tsx @@ -1,25 +1,34 @@ import React, { useCallback, useEffect, useRef, useState } from 'react'; -import { AlertTriangle, ArrowLeft, ChevronRight, Cloud, Computer, LoaderCircle, Pencil, Plus, RefreshCw, Search, Server, Trash2, X } from 'lucide-react'; +import { LoaderCircle, Plus, X } from 'lucide-react'; +import { connectApiBaseUrlFromDeepLink } from '../../../apps/desktop/src/security'; import { setApiBaseUrl } from '../api/apiClient'; import * as runtimeConfig from '../config/runtimeConfig'; +import { DesktopDeepLinkNavigation, type DesktopDeepLinkInbox } from '../desktop-deep-link'; import { DesktopContext } from './DesktopContext'; -import { normalizeBaseUrl } from './browserAdapters'; import { useDesktopModal, useSerializedMutationQueue } from './desktopExperienceHooks'; +import { ConnectionPanel, DesktopBrand, InstanceChooser, ProfileEditor, ProfileList } from './DesktopExperiencePanels'; +import { matchesDesktopAccessInvalidation, revokedDesktopConnection, useDesktopAccessInvalidation } from './desktopAccessInvalidation'; import type { DesktopAdapters, DesktopConnectionResult, DesktopProfile } from './types'; +import { LocalSetupWizard } from './LocalSetupWizard'; import './desktop.css'; type ExperienceState = | { phase: 'loading' } | { phase: 'choose' } + | { phase: 'local-setup' } | { phase: 'connecting'; profile: DesktopProfile } | { phase: 'blocked'; profile: DesktopProfile; result: Exclude } | { phase: 'connected'; profile: DesktopProfile; result: Extract }; interface DesktopExperienceProps { adapters: DesktopAdapters; + deepLinks?: DesktopDeepLinkInbox; children: React.ReactNode; } +const REJECTED_DEEP_LINK_MESSAGE = 'ProPR Desktop could not use that link. Choose an instance and try again.'; +const CONNECT_CANDIDATE_NOTICE = 'Review this untrusted instance address, then choose Connect to continue.'; + const profileId = (): string => { try { return crypto.randomUUID(); } catch { return `profile-${Date.now()}`; } }; @@ -30,192 +39,92 @@ const mergeProfiles = (current: DesktopProfile[], incoming: DesktopProfile[]): D return [...profiles.values()].sort((a, b) => (b.lastConnectedAt || '').localeCompare(a.lastConnectedAt || '')); }; -const connectionLabel = (result: DesktopConnectionResult): string => { - if (result.status === 'incompatible') return 'Update required'; - if (result.status === 'authentication-required') return 'Sign in required'; - if (result.status === 'offline') return 'Instance unavailable'; - return 'Connected'; -}; - const recoverableError = (message: string, error: unknown): string => `${message}${error instanceof Error && error.message ? ` ${error.message}` : ''} Try again.`; -const DesktopBrand: React.FC = () => ( -
- - ProPR -
-); - -interface ProfileEditorProps { - initial?: DesktopProfile; - operationError?: string | null; - onCancel(): void; - onSave(profile: DesktopProfile): void; -} - -const ProfileEditor: React.FC = ({ initial, operationError, onCancel, onSave }) => { - const [name, setName] = useState(initial?.name || 'My ProPR'); - const [baseUrl, setBaseUrl] = useState(initial?.baseUrl || 'http://127.0.0.1:3000'); - const [validationError, setValidationError] = useState(null); - - const submit = (event: React.FormEvent) => { - event.preventDefault(); - try { - onSave({ - id: initial?.id || profileId(), - name: name.trim() || 'My ProPR', - baseUrl: normalizeBaseUrl(baseUrl), - kind: initial?.kind || (new URL(baseUrl).hostname === '127.0.0.1' || new URL(baseUrl).hostname === 'localhost' ? 'local' : 'remote'), - lastConnectedAt: initial?.lastConnectedAt, - }); - } catch (caught) { - setValidationError(caught instanceof Error ? caught.message : 'Enter a valid instance URL.'); - } - }; - - const error = validationError || operationError; - - return ( -
- -

{initial ? 'Edit instance' : 'Connect to an instance'}

-

Enter the address shown by your ProPR server.

- - - {error && } - -
- ); -}; - -interface ProfileListProps { - profiles: DesktopProfile[]; - onConnect(profile: DesktopProfile): void; - onEdit(profile: DesktopProfile): void; - onRemove(profile: DesktopProfile): void; -} - -const ProfileList: React.FC = ({ profiles, onConnect, onEdit, onRemove }) => ( -
-

Recent instances

-
- {profiles.map(profile => ( -
- - - -
- ))} -
-
-); - -interface ChooserProps extends ProfileListProps { - busy: boolean; - error: string | null; - localSetupSupported: boolean; - onLocalSetup(): void; - onConnectNew(): void; - onDiscover(): void; -} - -const InstanceChooser: React.FC = ({ profiles, busy, error, localSetupSupported, onLocalSetup, onConnectNew, onDiscover, ...listProps }) => ( -
- -
- ProPR Desktop -

{profiles.length ? 'Choose an instance' : localSetupSupported ? 'Let’s set up this computer' : 'Connect to ProPR'}

-

{localSetupSupported - ? 'Keep your repositories and coding agents close, or connect securely to a ProPR instance you already use.' - : 'Local setup is currently available on Linux. Connect securely to a ProPR instance hosted elsewhere.'}

-
-
- {localSetupSupported && ( - - )} - -
- {error &&
{error}
} - {profiles.length > 0 && } - -
-); - -const ConnectionPanel: React.FC<{ - profile: DesktopProfile; - result?: Exclude; - onBack(): void; - onRetry(): void; - onAuthenticate(): void; - onHelp(): void; -}> = ({ profile, result, onBack, onRetry, onAuthenticate, onHelp }) => ( -
- - {!result ? ( - <> -
-

Connecting to {profile.name}

-

Checking the instance and desktop compatibility…

-
- - ) : ( - <> -
- {connectionLabel(result)} -

{profile.name}

-

{result.message || 'This instance needs authentication before ProPR Desktop can connect.'}

- {result.status === 'incompatible' && result.version &&
Instance version {result.version} · Desktop {__APP_VERSION__}
} -
- {result.status === 'authentication-required' && } - - - -
- - )} -
-); - -export const DesktopExperience: React.FC = ({ adapters, children }) => { +export const DesktopExperience: React.FC = ({ adapters, deepLinks, children }) => { const [profiles, setProfiles] = useState([]); const [state, setState] = useState({ phase: 'loading' }); const [editing, setEditing] = useState(null); const [managerOpen, setManagerOpen] = useState(false); const [operationError, setOperationError] = useState(null); + const [deepLinkError, setDeepLinkError] = useState(null); + const [editorNotice, setEditorNotice] = useState(null); const [busy, setBusy] = useState(false); const [networkOffline, setNetworkOffline] = useState(!navigator.onLine); const connectionAttempt = useRef(0); const activeProfileId = useRef(null); + const pendingConnectCandidate = useRef(false); + const startupOpenLinks = useRef([]); + const stateRef = useRef(state); + stateRef.current = state; + const deepLinkHandler = useRef<(value: string) => void>(() => undefined); + const [deepLinkNavigation] = useState(() => new DesktopDeepLinkNavigation( + path => { + window.location.hash = path; + setDeepLinkError(null); + }, + () => setDeepLinkError(REJECTED_DEEP_LINK_MESSAGE), + )); const enqueueProfileMutation = useSerializedMutationQueue(); const closeManager = useCallback(() => { setManagerOpen(false); setEditing(null); }, []); const { dialogRef: managerRef, openModal: openManager } = useDesktopModal(managerOpen, setManagerOpen, closeManager); + deepLinkHandler.current = value => { + let action: string | null = null; + try { + const url = new URL(value); + if (url.protocol === 'propr:') action = url.hostname; + } catch { + // The fixed rejection below deliberately omits attacker-controlled input. + } + + if (action === 'connect') { + const baseUrl = connectApiBaseUrlFromDeepLink(value); + if (!baseUrl) { + setDeepLinkError(REJECTED_DEEP_LINK_MESSAGE); + return; + } + const hostname = new URL(baseUrl).hostname.toLowerCase(); + const candidate: DesktopProfile = { + id: profileId(), + name: 'Discovered ProPR instance', + baseUrl, + kind: hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' ? 'local' : 'remote', + }; + pendingConnectCandidate.current = true; + setDeepLinkError(null); + setOperationError(null); + setEditorNotice(CONNECT_CANDIDATE_NOTICE); + setEditing(candidate); + if (stateRef.current.phase === 'connected') setManagerOpen(true); + else if (stateRef.current.phase !== 'loading') { + connectionAttempt.current += 1; + setState({ phase: 'choose' }); + } + return; + } + + if (action === 'open') { + const current = stateRef.current; + if (current.phase === 'loading') { + startupOpenLinks.current.push(value); + return; + } + if (current.phase === 'connecting' || current.phase === 'connected') { + if (activeProfileId.current !== current.profile.id + || !deepLinkNavigation.receive(value, current.profile.id)) { + setDeepLinkError(REJECTED_DEEP_LINK_MESSAGE); + } + return; + } + } + + setDeepLinkError(REJECTED_DEEP_LINK_MESSAGE); + }; + + useEffect(() => deepLinks?.subscribe(value => deepLinkHandler.current(value)), [deepLinks]); + const connect = useCallback(async (profile: DesktopProfile) => { const attempt = ++connectionAttempt.current; const isCurrentAttempt = () => connectionAttempt.current === attempt; @@ -223,23 +132,40 @@ export const DesktopExperience: React.FC = ({ adapters, setState({ phase: 'connecting', profile }); let operation: 'probe' | 'persist' = 'probe'; try { - const result = await adapters.connection.probe(profile); + const probeResult = await adapters.connection.probe(profile); if (!isCurrentAttempt()) return; - if (result.status !== 'ready') { setState({ phase: 'blocked', profile, result }); return; } + if (probeResult.status !== 'ready') { setState({ phase: 'blocked', profile, result: probeResult }); return; } operation = 'persist'; const connectedProfile = { ...profile, lastConnectedAt: new Date().toISOString() }; + let result: DesktopConnectionResult = probeResult; await enqueueProfileMutation(async () => { if (!isCurrentAttempt()) return; await adapters.profiles.save(connectedProfile); if (!isCurrentAttempt()) return; - if (activeProfileId.current !== profile.id) await adapters.profiles.setActiveId(profile.id); - activeProfileId.current = profile.id; + if (adapters.connection.activate) { + result = await adapters.connection.activate(connectedProfile, probeResult, isCurrentAttempt); + } else if (activeProfileId.current !== profile.id) { + await adapters.profiles.setActiveId(profile.id); + } + if (result.status === 'ready') activeProfileId.current = profile.id; }); if (!isCurrentAttempt()) return; setProfiles(current => mergeProfiles(current, [connectedProfile])); + if (result.status !== 'ready') { + setState({ phase: 'blocked', profile: connectedProfile, result }); + return; + } runtimeConfig.setDesktopApiBaseUrl(connectedProfile.baseUrl); - setApiBaseUrl(connectedProfile.baseUrl); + const remoteActivation = result.profileId === connectedProfile.id + && typeof result.transportScope === 'string' + && typeof result.identityEpoch === 'string'; + if (remoteActivation && adapters.connection.publishActivation) { + adapters.connection.publishActivation(connectedProfile, result); + } else { + adapters.connection.deactivate?.(); + setApiBaseUrl(connectedProfile.baseUrl); + } setState({ phase: 'connected', profile: connectedProfile, result }); } catch (error) { if (!isCurrentAttempt()) return; @@ -251,6 +177,13 @@ export const DesktopExperience: React.FC = ({ adapters, } }, [adapters, enqueueProfileMutation]); + useDesktopAccessInvalidation(detail => setState(current => { + if (current.phase !== 'connected' + || !matchesDesktopAccessInvalidation(current.profile.id, current.result, detail)) return current; + adapters.connection.deactivate?.(); + return { phase: 'blocked', profile: current.profile, result: revokedDesktopConnection(current.result) }; + })); + useEffect(() => { let cancelled = false; activeProfileId.current = null; @@ -258,6 +191,10 @@ export const DesktopExperience: React.FC = ({ adapters, if (cancelled) return; activeProfileId.current = activeId; setProfiles(stored); + if (pendingConnectCandidate.current) { + setState({ phase: 'choose' }); + return; + } const active = stored.find(profile => profile.id === activeId); if (active) void connect(active); else setState({ phase: 'choose' }); @@ -273,6 +210,28 @@ export const DesktopExperience: React.FC = ({ adapters, }; }, [adapters, connect]); + useEffect(() => { + if (state.phase === 'connecting') { + deepLinkNavigation.setDashboardUnavailable(); + if (activeProfileId.current === state.profile.id) { + startupOpenLinks.current.splice(0).forEach(value => deepLinkNavigation.receive(value, state.profile.id)); + } else if (startupOpenLinks.current.splice(0).length > 0) { + setDeepLinkError(REJECTED_DEEP_LINK_MESSAGE); + } + return; + } + if (state.phase === 'connected') { + if (activeProfileId.current === state.profile.id) deepLinkNavigation.setDashboardReady(state.profile.id); + else setDeepLinkError(REJECTED_DEEP_LINK_MESSAGE); + return; + } + deepLinkNavigation.setDashboardUnavailable(); + if (state.phase !== 'loading') { + if (startupOpenLinks.current.splice(0).length > 0) setDeepLinkError(REJECTED_DEEP_LINK_MESSAGE); + deepLinkNavigation.rejectPending(); + } + }, [deepLinkNavigation, state]); + useEffect(() => { const online = () => setNetworkOffline(false); const offline = () => setNetworkOffline(true); @@ -306,7 +265,10 @@ export const DesktopExperience: React.FC = ({ adapters, await enqueueProfileMutation(() => adapters.profiles.remove(profile.id)); setProfiles(current => current.filter(item => item.id !== profile.id)); if (activeProfileId.current === profile.id) activeProfileId.current = null; - if (state.phase === 'connected' && state.profile.id === profile.id) setState({ phase: 'choose' }); + if (state.phase === 'connected' && state.profile.id === profile.id) { + adapters.connection.deactivate?.(); + setState({ phase: 'choose' }); + } } catch (error) { setOperationError(recoverableError('ProPR Desktop could not remove this instance.', error)); } @@ -314,6 +276,8 @@ export const DesktopExperience: React.FC = ({ adapters, const saveProfile = async (profile: DesktopProfile, shouldConnect = true) => { setOperationError(null); + setEditorNotice(null); + pendingConnectCandidate.current = false; if (shouldConnect) { closeManager(); await connect(profile); @@ -330,16 +294,8 @@ export const DesktopExperience: React.FC = ({ adapters, }; const setupLocal = async () => { - setBusy(true); setOperationError(null); - try { - const profile = await adapters.localSetup.setup(); - await saveProfile(profile); - } catch (error) { - setOperationError(error instanceof Error ? error.message : 'Local setup could not be started.'); - } finally { - setBusy(false); - } + setState({ phase: 'local-setup' }); }; const discover = async () => { @@ -357,6 +313,8 @@ export const DesktopExperience: React.FC = ({ adapters, }; const choose = () => { + if ('profile' in state) void adapters.authentication.cancel?.(state.profile.id).catch(() => undefined); + adapters.connection.deactivate?.(); const attempt = ++connectionAttempt.current; void enqueueProfileMutation(async () => { if (connectionAttempt.current !== attempt) return; @@ -385,17 +343,18 @@ export const DesktopExperience: React.FC = ({ adapters, } }; - const openEditor = (profile: DesktopProfile | 'new') => { setOperationError(null); setEditing(profile); }; + const openEditor = (profile: DesktopProfile | 'new') => { setOperationError(null); setEditorNotice(null); setEditing(profile); }; const content = () => { if (state.phase === 'loading') return
Opening ProPR…
; if (state.phase === 'connecting') return undefined} onHelp={() => undefined} />; if (state.phase === 'blocked') return void runBlockedAction(state.profile, () => adapters.authentication.authenticate(state.profile), 'ProPR Desktop could not open sign in.', () => connect(state.profile))} onHelp={() => void runBlockedAction(state.profile, () => adapters.externalBrowser.open('https://propr.dev'), 'ProPR Desktop could not open connection help.')} />; - if (editing) return
setEditing(null)} onSave={profile => void saveProfile(profile)} />
; + if (state.phase === 'local-setup') return setState({ phase: 'choose' })} onComplete={profile => void saveProfile(profile)} />; + if (editing) return
{ pendingConnectCandidate.current = false; setEditorNotice(null); setEditing(null); }} onSave={profile => void saveProfile(profile)} />
; return void setupLocal()} onConnectNew={() => openEditor('new')} onDiscover={() => void discover()} onConnect={profile => void connect(profile)} onEdit={openEditor} onRemove={profile => void removeProfile(profile)} />; }; - if (state.phase !== 'connected') return
{content()}
; + if (state.phase !== 'connected') return
{deepLinkError &&
{deepLinkError}
}{content()}
; const displayedConnection: DesktopConnectionResult = networkOffline ? { status: 'offline', message: 'This computer is offline.' } : state.result; const contextValue = { @@ -411,13 +370,14 @@ export const DesktopExperience: React.FC = ({ adapters, return ( + {deepLinkError &&
{deepLinkError}
}
{children}
{managerOpen && (
{ if (event.target === event.currentTarget) closeManager(); }}>
Desktop

Manage instances

{editing ? ( - setEditing(null)} onSave={profile => void saveProfile(profile, editing === 'new' || state.profile.id === profile.id)} /> + { pendingConnectCandidate.current = false; setEditorNotice(null); setEditing(null); }} onSave={profile => void saveProfile(profile, pendingConnectCandidate.current || editing === 'new' || state.profile.id === profile.id)} /> ) : ( <> {operationError &&
{operationError}
} diff --git a/propr-ui/src/desktop/DesktopExperiencePanels.tsx b/propr-ui/src/desktop/DesktopExperiencePanels.tsx new file mode 100644 index 000000000..d009ea441 --- /dev/null +++ b/propr-ui/src/desktop/DesktopExperiencePanels.tsx @@ -0,0 +1,153 @@ +import React, { useState } from 'react'; +import { AlertTriangle, ArrowLeft, ChevronRight, Cloud, Computer, LoaderCircle, Pencil, RefreshCw, Search, Server, Trash2 } from 'lucide-react'; +import { normalizeBaseUrl } from './browserAdapters'; +import type { DesktopConnectionResult, DesktopProfile } from './types'; + +const profileId = (): string => { + try { return crypto.randomUUID(); } catch { return `profile-${Date.now()}`; } +}; + +const connectionLabel = (result: DesktopConnectionResult): string => { + if (result.status === 'incompatible') return 'Update required'; + if (result.status === 'authentication-required') return 'Sign in required'; + if (result.status === 'offline') return 'Instance unavailable'; + return 'Connected'; +}; + +export const DesktopBrand: React.FC = () => ( +
+ + ProPR +
+); + +interface ProfileEditorProps { + initial?: DesktopProfile; + candidate?: boolean; + notice?: string | null; + operationError?: string | null; + onCancel(): void; + onSave(profile: DesktopProfile): void; +} + +export const ProfileEditor: React.FC = ({ initial, candidate = false, notice, operationError, onCancel, onSave }) => { + const [name, setName] = useState(initial?.name || 'My ProPR'); + const [baseUrl, setBaseUrl] = useState(initial?.baseUrl || 'http://127.0.0.1:3000'); + const [validationError, setValidationError] = useState(null); + + const submit = (event: React.FormEvent) => { + event.preventDefault(); + try { + onSave({ + id: initial?.id || profileId(), + name: name.trim() || 'My ProPR', + baseUrl: normalizeBaseUrl(baseUrl), + kind: initial?.kind || (new URL(baseUrl).hostname === '127.0.0.1' || new URL(baseUrl).hostname === 'localhost' ? 'local' : 'remote'), + lastConnectedAt: initial?.lastConnectedAt, + }); + } catch (caught) { + setValidationError(caught instanceof Error ? caught.message : 'Enter a valid instance URL.'); + } + }; + + const error = validationError || operationError; + return ( +
+ +

{candidate || !initial ? 'Connect to an instance' : 'Edit instance'}

+

Enter the address shown by your ProPR server.

+ {notice &&
{notice}
} + + + {error && } + +
+ ); +}; + +interface ProfileListProps { + profiles: DesktopProfile[]; + onConnect(profile: DesktopProfile): void; + onEdit(profile: DesktopProfile): void; + onRemove(profile: DesktopProfile): void; +} + +export const ProfileList: React.FC = ({ profiles, onConnect, onEdit, onRemove }) => ( +
+

Recent instances

+
+ {profiles.map(profile => ( +
+ + + +
+ ))} +
+
+); + +interface ChooserProps extends ProfileListProps { + busy: boolean; + error: string | null; + localSetupSupported: boolean; + onLocalSetup(): void; + onConnectNew(): void; + onDiscover(): void; +} + +export const InstanceChooser: React.FC = ({ profiles, busy, error, localSetupSupported, onLocalSetup, onConnectNew, onDiscover, ...listProps }) => ( +
+ +
+ ProPR Desktop +

{profiles.length ? 'Choose an instance' : localSetupSupported ? 'Let’s set up this computer' : 'Connect to ProPR'}

+

{localSetupSupported + ? 'Keep your repositories and coding agents close, or connect securely to a ProPR instance you already use.' + : 'Local setup is currently available on Linux. Connect securely to a ProPR instance hosted elsewhere.'}

+
+
+ {localSetupSupported && ( + + )} + +
+ {error &&
{error}
} + {profiles.length > 0 && } + +
+); + +export const ConnectionPanel: React.FC<{ + profile: DesktopProfile; + result?: Exclude; + onBack(): void; + onRetry(): void; + onAuthenticate(): void; + onHelp(): void; +}> = ({ profile, result, onBack, onRetry, onAuthenticate, onHelp }) => ( +
+ + {!result ? ( + <>

Connecting to {profile.name}

Checking the instance and desktop compatibility…

+ ) : ( + <>
{connectionLabel(result)}

{profile.name}

{result.message || 'This instance needs authentication before ProPR Desktop can connect.'}

+ {result.status === 'incompatible' && result.version &&
Instance version {result.version} · Desktop {__APP_VERSION__}
} +
+ {result.status === 'authentication-required' && } + + + +
+ )} +
+); diff --git a/propr-ui/src/desktop/DesktopPresentationBoundary.test.tsx b/propr-ui/src/desktop/DesktopPresentationBoundary.test.tsx new file mode 100644 index 000000000..664a720a1 --- /dev/null +++ b/propr-ui/src/desktop/DesktopPresentationBoundary.test.tsx @@ -0,0 +1,80 @@ +import { act, render, screen } from '@testing-library/react'; +import { afterEach, describe, expect, it, vi } from 'vitest'; +import { DesktopPresentationBoundary } from './DesktopPresentationBoundary'; +import type { ProprDesktopBridge } from './types'; + +const bridgeWithDeepLinks = () => { + const listeners = new Set<(value: string) => void>(); + const onDeepLink = vi.fn((listener: (value: string) => void) => { + listeners.add(listener); + return vi.fn(() => listeners.delete(listener)); + }); + const bridge: ProprDesktopBridge = { + isDesktop: true, + platform: 'linux', + app: { onDeepLink }, + profiles: { + list: async () => [], + save: async () => undefined, + remove: async () => undefined, + getActiveId: async () => null, + setActiveId: async () => undefined, + }, + discovery: { discover: async () => [] }, + authentication: { authenticate: async () => undefined, cancel: async () => undefined }, + externalBrowser: { open: async () => undefined }, + localSetup: { + status: async () => ({ + phase: 'idle', + capability: { supported: true, kind: 'local', platform: 'linux' }, + sessionId: '00000000-0000-4000-8000-000000000000', + logs: [], + }), + start: async () => { throw new Error('not used'); }, + retry: async () => { throw new Error('not used'); }, + cancel: async () => { throw new Error('not used'); }, + selectPrivateKey: async () => null, + acquireWebhookSecret: async () => null, + onProgress: () => () => undefined, + }, + connection: { + probe: async () => ({ status: 'ready', activationTicket: 'test-ticket' }), + activateLocal: async () => ({ status: 'ready', profileId: 'test' }), + discardLocal: async () => ({ discarded: true }), + activate: async () => ({ status: 'ready', profileId: 'test', transportScope: 'A'.repeat(22), identityEpoch: 'B'.repeat(22) }), + discard: async () => ({ discarded: true }), + invalidate: async () => ({ invalidated: true }), + }, + }; + return { bridge, listeners, onDeepLink }; +}; + +describe('DesktopPresentationBoundary deep-link subscription', () => { + afterEach(() => { + delete window.__PROPR_DESKTOP__; + vi.restoreAllMocks(); + }); + + it('subscribes once, unsubscribes on teardown, and does not replay after remount', async () => { + const { bridge, listeners, onDeepLink } = bridgeWithDeepLinks(); + window.__PROPR_DESKTOP__ = bridge; + const first = render(Desktop app
} fallback={
Web app
} />); + + expect(await screen.findByRole('heading', { name: 'Let’s set up this computer' })).toBeInTheDocument(); + expect(onDeepLink).toHaveBeenCalledOnce(); + first.rerender(Desktop app} fallback={
Web app
} />); + expect(onDeepLink).toHaveBeenCalledOnce(); + act(() => listeners.forEach(listener => listener('propr://connect?api=https%3A%2F%2Ffirst.example'))); + expect(await screen.findByDisplayValue('https://first.example')).toBeInTheDocument(); + + const unsubscribe = onDeepLink.mock.results[0]?.value; + first.unmount(); + expect(unsubscribe).toHaveBeenCalledOnce(); + expect(listeners.size).toBe(0); + + render(Desktop app} fallback={
Web app
} />); + expect(await screen.findByRole('heading', { name: 'Let’s set up this computer' })).toBeInTheDocument(); + expect(screen.queryByDisplayValue('https://first.example')).not.toBeInTheDocument(); + expect(onDeepLink).toHaveBeenCalledTimes(2); + }); +}); diff --git a/propr-ui/src/desktop/DesktopPresentationBoundary.tsx b/propr-ui/src/desktop/DesktopPresentationBoundary.tsx index 9e85ddab2..1c0cc0383 100644 --- a/propr-ui/src/desktop/DesktopPresentationBoundary.tsx +++ b/propr-ui/src/desktop/DesktopPresentationBoundary.tsx @@ -1,4 +1,5 @@ -import React, { useState } from 'react'; +import React, { useEffect, useState } from 'react'; +import { DesktopDeepLinkInbox } from '../desktop-deep-link'; import { resolveDesktopAdapters } from './browserAdapters'; import { DesktopExperience } from './DesktopExperience'; @@ -10,5 +11,12 @@ interface DesktopPresentationBoundaryProps { /** Keeps desktop detection at the application edge and leaves the route tree shared. */ export const DesktopPresentationBoundary: React.FC = ({ desktop, fallback }) => { const adapters = useState(resolveDesktopAdapters)[0]; - return adapters ? {desktop} : fallback; + const inbox = useState(() => new DesktopDeepLinkInbox())[0]; + + useEffect(() => { + if (!adapters) return; + return adapters.app.onDeepLink(value => inbox.receive(value)); + }, [adapters, inbox]); + + return adapters ? {desktop} : fallback; }; diff --git a/propr-ui/src/desktop/LocalSetupWizard.tsx b/propr-ui/src/desktop/LocalSetupWizard.tsx new file mode 100644 index 000000000..0c5805720 --- /dev/null +++ b/propr-ui/src/desktop/LocalSetupWizard.tsx @@ -0,0 +1,203 @@ +import React, { useEffect, useMemo, useState } from 'react'; +import { ArrowLeft, Check, ChevronRight, CircleAlert, KeyRound, LoaderCircle, RotateCcw, X } from 'lucide-react'; +import type { DesktopFilesystemSelection, DesktopProfileView, DesktopSecretSelection, DesktopSetupRequest, DesktopSetupSnapshot } from '../../../apps/desktop/src/shared/contract'; +import type { DesktopLocalSetupAdapter } from './types'; + +type FormStage = 'prerequisites' | 'directory' | 'github' | 'intake' | 'agents' | 'summary'; +type GithubMode = DesktopSetupRequest['github']['mode']; +type IntakeMode = DesktopSetupRequest['intake']['mode']; +type RootChoice = { mode: 'default' | 'resume'; label: string }; +const agents = ['codex', 'claude', 'antigravity', 'opencode', 'vibe']; +const stages: FormStage[] = ['prerequisites', 'directory', 'github', 'intake', 'agents', 'summary']; + +interface SetupDraft { + root: RootChoice; + githubMode: GithubMode; + appId: string; + privateKey: DesktopFilesystemSelection | null; + installationId: string; + intakeMode: IntakeMode; + intakeSecretApproval: DesktopSecretSelection | null; + selectedAgents: string[]; + reinitialize: boolean; + whitelist: string[] | null; + repository: DesktopSetupRequest['repository']; +} + +const buildSetupRequest = (sessionId: string, draft: SetupDraft): DesktopSetupRequest => ({ + sessionId, + root: { mode: draft.root.mode }, + reinitialize: draft.reinitialize, + agents: draft.selectedAgents, + github: draft.githubMode === 'app' + ? { mode: 'app', appId: draft.appId, privateKeyCapability: draft.privateKey?.capability ?? '', installationId: draft.installationId } + : { mode: draft.githubMode }, + intake: draft.intakeMode === 'direct_webhook' + ? { mode: 'direct_webhook', secretCapability: draft.intakeSecretApproval?.capability ?? '' } + : { mode: draft.intakeMode }, + whitelist: draft.whitelist, + repository: draft.repository, +}); + +const UnsupportedSetup: React.FC<{ error?: string; onBack(): void }> = ({ error, onBack }) => ( +

Local setup is unavailable

{error}

Local Docker setup is intentionally Linux-only.

+); + +const RunningSetup: React.FC<{ snapshot: DesktopSetupSnapshot; onCancel(): void }> = ({ snapshot, onCancel }) => { + const completed = snapshot.state?.steps.filter(step => ['done', 'skipped', 'warning'].includes(step.status)).length ?? 0; + const total = snapshot.state?.steps.length ?? 1; + return
Installing locally

Setting up ProPR

{snapshot.state?.steps.map(step =>
{step.status === 'active' ? : step.status === 'done' ? : step.status === 'failed' ? : null}
{step.title}{step.detail || step.description}
)}
{snapshot.logs.length > 0 && 
{snapshot.logs.slice(-8).join('\n')}
}
; +}; + +const RecoverySetup: React.FC<{ snapshot: DesktopSetupSnapshot; busy: boolean; onBack(): void; onRetry(): void }> = ({ snapshot, busy, onBack, onRetry }) => { + const failed = snapshot.state?.steps.find(step => step.status === 'failed'); + const nextAction = failed?.nextAction || snapshot.errors?.[0]?.nextAction; + const label = snapshot.reconfigurationRequired ? 'Review saved choices' : 'Retry setup'; + return
Recovery

{snapshot.phase === 'interrupted' ? 'Continue your setup' : 'Setup needs attention'}

{failed?.detail || snapshot.error || snapshot.errors?.[0]?.message || 'Setup stopped safely.'}

{snapshot.resumeAvailable === false &&
Resume after restart is unavailable.
}{nextAction &&
{nextAction}
}
; +}; + +const CompletedSetup: React.FC<{ profile: DesktopProfileView; onConfigureAgain(): void; onComplete(profile: DesktopProfileView): void }> = ({ profile, onConfigureAgain, onComplete }) => ( +
Setup complete

ProPR is ready

Your local stack is healthy and registered as “This computer”.

+); + +const githubModeCopy: Record = { + relay: { title: 'ProPR Connect', description: 'Uses the official ProPR GitHub relay.' }, + app: { title: 'Custom GitHub App', description: 'Use your App ID, installation, and a natively selected private key.' }, + demo: { title: 'Demo mode', description: 'Explore locally without GitHub access.' }, + keep: { title: 'Keep existing configuration', description: 'Best for an already configured stack.' }, +}; + +interface FormProps extends Omit { + stage: FormStage; + busy: boolean; + error: string | null; + setStage(value: FormStage): void; + setGithubMode(value: GithubMode): void; + setAppId(value: string): void; + setInstallationId(value: string): void; + setIntakeMode(value: IntakeMode): void; + setSelectedAgents(value: React.SetStateAction): void; + setWhitelist(value: string): void; + whitelist: string; + onChoosePrivateKey(): void; + onAcquireWebhookSecret(): void; + onBack(): void; + onContinue(): void; +} + +const GithubStage: React.FC = props => <>

Connect GitHub

Credentials remain in the trusted desktop process and are never returned to this page.

{(['relay', 'app', 'demo', 'keep'] as GithubMode[]).map(mode => )}
{props.githubMode === 'relay' &&
The official ProPR relay will be used. Custom renderer URLs are not accepted.
}{props.githubMode === 'app' &&
{props.privateKey?.label ?? 'No key selected'}
}; + +const FormContent: React.FC = props => { + switch (props.stage) { + case 'prerequisites': return <>

Check the essentials

ProPR requires a running Docker Engine on Linux. The installer verifies it before changing the stack.

; + case 'directory': return <>

Private local storage

ProPR keeps its environment, data, logs, repositories, and Docker mounts in one fixed owner-only directory managed by the desktop app.

{props.root.label}
; + case 'github': return ; + case 'intake': { + const allowed: IntakeMode[] = props.githubMode === 'relay' ? ['keep', 'routing_websocket', 'polling'] : props.githubMode === 'app' ? ['keep', 'polling', 'direct_webhook'] : props.githubMode === 'demo' ? ['keep'] : ['keep', 'routing_websocket', 'polling', 'direct_webhook']; + return <>

Choose GitHub event intake

{allowed.map(mode => )}
{props.intakeMode === 'direct_webhook' &&
{props.intakeSecretApproval?.label ?? 'No secret entered'}
}; + } + case 'agents': return <>

Select coding agents

{agents.map(agent => )}
{props.githubMode !== 'demo' && }; + case 'summary': return <>

Ready to install

Directory
{props.root.label}
GitHub
{props.githubMode}
Intake
{props.intakeMode}
Agents
{props.selectedAgents.join(', ') || 'None'}
; + } +}; + +const SetupForm: React.FC = props => { + const index = stages.indexOf(props.stage); + return
Local setup · {index + 1} of {stages.length}{props.error &&
{props.error}
}
; +}; + +export const LocalSetupWizard: React.FC<{ adapter: DesktopLocalSetupAdapter; onBack(): void; onComplete(profile: DesktopProfileView): void }> = ({ adapter, onBack, onComplete }) => { + const [stage, setStage] = useState('prerequisites'); + const [snapshot, setSnapshot] = useState(null); + const [root, setRoot] = useState({ mode: 'default', label: 'Desktop default directory' }); + const [githubMode, setGithubMode] = useState('relay'); + const [appId, setAppId] = useState(''); + const [privateKey, setPrivateKey] = useState(null); + const [installationId, setInstallationId] = useState(''); + const [intakeMode, setIntakeMode] = useState('routing_websocket'); + const [intakeSecretApproval, setIntakeSecretApproval] = useState(null); + const [selectedAgents, setSelectedAgents] = useState(['codex']); + const [reinitialize, setReinitialize] = useState(false); + const [whitelistText, setWhitelistText] = useState(''); + const [whitelist, setWhitelistChoice] = useState(null); + const [repository, setRepository] = useState(null); + const [busy, setBusy] = useState(false); + const [error, setError] = useState(null); + const [configureAgain, setConfigureAgain] = useState(false); + const [reconfiguring, setReconfiguring] = useState(false); + + useEffect(() => { + let mounted = true; + const unsubscribe = adapter.onProgress(value => { if (mounted) setSnapshot(value); }); + void adapter.status().then(value => { + if (!mounted) return; + setSnapshot(value); + setRoot({ mode: value.resume ? 'resume' : 'default', label: value.rootDir ?? 'Desktop default directory' }); + if (value.resume) { + setSelectedAgents(value.resume.agents); + setReinitialize(value.resume.reinitialize); + setGithubMode(value.resume.github.mode); + if (value.resume.github.mode === 'app') { setAppId(value.resume.github.appId); setInstallationId(value.resume.github.installationId); } + setIntakeMode(value.resume.intake.mode); + setWhitelistChoice(value.resume.whitelist); + setWhitelistText(value.resume.whitelist?.join(', ') ?? ''); + setRepository(value.resume.repository); + } + }).catch(() => { if (mounted) setError('Setup status is unavailable.'); }); + return () => { mounted = false; unsubscribe(); }; + }, [adapter]); + + const draft = useMemo(() => ({ root, githubMode, appId, privateKey, installationId, intakeMode, intakeSecretApproval, selectedAgents, reinitialize, whitelist, repository }), [appId, githubMode, installationId, intakeMode, intakeSecretApproval, privateKey, reinitialize, repository, root, selectedAgents, whitelist]); + const request = snapshot ? buildSetupRequest(snapshot.sessionId, draft) : null; + + const run = async (retry = false) => { + if (retry && snapshot?.reconfigurationRequired && !reconfiguring) { + setStage(snapshot.resume?.reconfigurationStage ?? 'github'); + setReconfiguring(true); + return; + } + if (!request) return; + setError(null); setBusy(true); + try { + const result = retry ? reconfiguring ? await adapter.retry(request) : await adapter.retry() : await adapter.start(request); + setSnapshot(result); + } catch { setError('Local setup could not be started. Check the selected values and try again.'); } + finally { setBusy(false); } + }; + + const choosePrivateKey = async () => { + setError(null); setBusy(true); + try { const selection = await adapter.selectPrivateKey(); if (selection) setPrivateKey(selection); } + catch { setError('Choose a regular, owner-only private-key file.'); } finally { setBusy(false); } + }; + const acquireWebhookSecret = async () => { + setError(null); setBusy(true); + try { const selection = await adapter.acquireWebhookSecret(); if (selection) setIntakeSecretApproval(selection); } + catch { setError('The secure secret prompt could not be opened.'); } finally { setBusy(false); } + }; + + if (!snapshot) return
Loading setup…
; + if (snapshot.phase === 'unsupported') return ; + if (snapshot.phase === 'running') return void adapter.cancel()} />; + if (['failed', 'cancelled', 'interrupted'].includes(snapshot.phase) && !reconfiguring) return void run(true)} />; + if (snapshot.phase === 'completed' && snapshot.profile && !configureAgain) return { setConfigureAgain(true); setGithubMode('keep'); setIntakeMode('keep'); }} onComplete={onComplete} />; + + const continueForm = () => { + setError(null); + if (stage === 'github' && githubMode === 'app' && (!/^\d{1,20}$/.test(appId) || !/^\d{1,20}$/.test(installationId) || !privateKey)) { setError('Enter numeric App and installation IDs, then choose the private key.'); return; } + if (stage === 'intake' && intakeMode === 'direct_webhook' && !intakeSecretApproval) { setError('Enter the webhook secret.'); return; } + const index = stages.indexOf(stage); + if (index === stages.length - 1) void run(reconfiguring); else setStage(stages[index + 1]); + }; + const chooseGithubMode = (mode: GithubMode) => { + setGithubMode(mode); + if (mode === 'relay' && intakeMode === 'direct_webhook') setIntakeMode('routing_websocket'); + if (mode === 'app' && intakeMode === 'routing_websocket') setIntakeMode('polling'); + if (mode === 'demo') setIntakeMode('keep'); + }; + const setWhitelist = (value: string) => { + setWhitelistText(value); + setWhitelistChoice(value.split(',').map(item => item.trim()).filter(Boolean)); + }; + return void choosePrivateKey()} onAcquireWebhookSecret={() => void acquireWebhookSecret()} onBack={onBack} onContinue={continueForm} />; +}; diff --git a/propr-ui/src/desktop/browserAdapters.test.ts b/propr-ui/src/desktop/browserAdapters.test.ts index fa25aec3c..731421686 100644 --- a/propr-ui/src/desktop/browserAdapters.test.ts +++ b/propr-ui/src/desktop/browserAdapters.test.ts @@ -36,7 +36,6 @@ describe('desktop browser fixtures', () => { it('resolves fixture authentication only after the matching desktop completion signal', async () => { window.history.replaceState(null, '', '/?desktop-fixture=connected'); - const open = vi.spyOn(window, 'open').mockReturnValue({} as Window); const adapters = resolveDesktopAdapters(); const profile = (await adapters?.profiles.list())?.[0]; expect(adapters).not.toBeNull(); @@ -59,8 +58,5 @@ describe('desktop browser fixtures', () => { })); await expect(authentication).resolves.toBeUndefined(); expect(completed).toBe(true); - expect(decodeURIComponent(open.mock.calls[0]?.[0] as string)).toContain( - `propr://authentication-complete?profile_id=${profile!.id}` - ); }); }); diff --git a/propr-ui/src/desktop/browserAdapters.ts b/propr-ui/src/desktop/browserAdapters.ts index ba47a324c..bf77c0dd7 100644 --- a/propr-ui/src/desktop/browserAdapters.ts +++ b/propr-ui/src/desktop/browserAdapters.ts @@ -8,6 +8,7 @@ import type { ProprDesktopBridge, } from './types'; import { DESKTOP_AUTHENTICATION_COMPLETE_EVENT } from './types'; +import { createElectronDesktopAdapters } from './electronAdapters'; const PROFILES_KEY = 'propr.desktop.profiles'; const ACTIVE_PROFILE_KEY = 'propr.desktop.activeProfile'; @@ -100,7 +101,7 @@ const probeProfile = async (profile: DesktopProfile): Promise => new Promise((resolve, reject) => { +const authenticateFixture = (profile: DesktopProfile): Promise => new Promise((resolve, reject) => { const complete = (event: Event) => { const detail = (event as CustomEvent).detail; if (detail?.profileId !== profile.id) return; @@ -117,22 +118,11 @@ const authenticateBrowserFixture = (profile: DesktopProfile): Promise => n }; window.addEventListener(DESKTOP_AUTHENTICATION_COMPLETE_EVENT, complete); - const redirect = new URL('propr://authentication-complete'); - redirect.searchParams.set('profile_id', profile.id); - try { - window.open( - `${normalizeBaseUrl(profile.baseUrl)}/api/auth/github?redirect_to=${encodeURIComponent(redirect.toString())}`, - '_blank', - 'noopener,noreferrer' - ); - } catch (error) { - cleanup(); - reject(error); - } }); const createBrowserAdapters = (fixture: DesktopFixture | null): DesktopAdapters => ({ platform: detectPlatform(), + app: { onDeepLink: () => () => undefined }, profiles: { async list() { if (fixture === 'first-run') return []; @@ -161,13 +151,18 @@ const createBrowserAdapters = (fixture: DesktopFixture | null): DesktopAdapters discovery: { async discover() { return fixture ? [fixtureProfile] : []; } }, externalBrowser: { async open(url) { window.open(url, '_blank', 'noopener,noreferrer'); } }, authentication: { - authenticate: authenticateBrowserFixture, + authenticate: authenticateFixture, }, localSetup: { - async setup() { - if (fixture) return fixtureProfile; - throw new Error('Local setup will be available when the desktop host adapter is connected.'); + async status() { + return { phase: 'idle', capability: { supported: true, kind: 'local', platform: 'linux' }, sessionId: '00000000-0000-4000-8000-000000000000', logs: [] }; }, + async start() { throw new Error('Local setup requires the Electron desktop host.'); }, + async retry() { throw new Error('Local setup requires the Electron desktop host.'); }, + async cancel() { return { phase: 'cancelled', capability: { supported: true, kind: 'local', platform: 'linux' }, sessionId: '00000000-0000-4000-8000-000000000000', logs: [] }; }, + async selectPrivateKey() { throw new Error('Private-key selection requires the Electron desktop host.'); }, + async acquireWebhookSecret() { throw new Error('Webhook-secret entry requires the Electron desktop host.'); }, + onProgress() { return () => undefined; }, }, connection: { async probe(profile) { @@ -181,7 +176,7 @@ const createBrowserAdapters = (fixture: DesktopFixture | null): DesktopAdapters export const resolveDesktopAdapters = (): DesktopAdapters | null => { const bridge: ProprDesktopBridge | undefined = window.__PROPR_DESKTOP__; - if (bridge?.isDesktop) return bridge; + if (bridge?.isDesktop) return createElectronDesktopAdapters(bridge); const fixture = import.meta.env.DEV ? fixtureFromLocation() : null; return fixture ? createBrowserAdapters(fixture) : null; }; diff --git a/propr-ui/src/desktop/desktop.css b/propr-ui/src/desktop/desktop.css index 8151f8a73..3ea8aa5b6 100644 --- a/propr-ui/src/desktop/desktop.css +++ b/propr-ui/src/desktop/desktop.css @@ -243,6 +243,64 @@ outline-offset: 2px; } +.desktop-setup-wizard { + width: min(100%, 46rem); + border: 1px solid #d7e3e2; + border-radius: 1.2rem; + padding: 2rem; + color: #263938; + background: rgba(255, 255, 255, .97); + box-shadow: 0 24px 70px rgba(25, 48, 48, .12); +} +.desktop-setup-wizard > .desktop-back-button { margin-bottom: 1.4rem; } +.desktop-setup-wizard h1 { margin: .4rem 0 .6rem; color: #132525; font-size: 1.75rem; font-weight: 720; letter-spacing: -.035em; } +.desktop-setup-wizard > p { max-width: 42rem; color: #5e6d6d; font-size: .9rem; line-height: 1.6; } +.desktop-setup-note, +.desktop-setup-recovery { margin-top: 1.25rem; border: 1px solid #cce1df; border-radius: .7rem; padding: .8rem .9rem; color: #365b59; background: #f2f9f8; font-size: .8rem; line-height: 1.5; } +.desktop-setup-recovery { border-color: #f0d5b8; color: #704b28; background: #fff9f1; } +.desktop-setup-field { display: grid; gap: .4rem; margin-top: 1.35rem; color: #435555; font-size: .76rem; font-weight: 650; } +.desktop-setup-field > div { display: flex; align-items: center; gap: .45rem; border: 1px solid #cdd9d9; border-radius: .6rem; padding: 0 .65rem; } +.desktop-setup-field svg { width: 1rem; color: #6a8583; } +.desktop-setup-field input, +.desktop-setup-grid input { width: 100%; border: 0; padding: .72rem .15rem; color: #192c2c; background: transparent; outline: none; font-size: .84rem; } +.desktop-setup-field > div:focus-within { border-color: #16827c; box-shadow: 0 0 0 3px rgba(22, 130, 124, .13); } +.desktop-setup-options { display: grid; gap: .55rem; margin-top: 1.2rem; } +.desktop-setup-options > label { display: flex; align-items: flex-start; gap: .7rem; border: 1px solid #dbe5e4; border-radius: .7rem; padding: .7rem .8rem; cursor: pointer; } +.desktop-setup-options > label:has(input:checked) { border-color: #83bdb9; background: #f3faf9; } +.desktop-setup-options strong, +.desktop-setup-options small { display: block; } +.desktop-setup-options strong { font-size: .82rem; } +.desktop-setup-options small { margin-top: .15rem; color: #6c7d7c; font-size: .72rem; line-height: 1.4; } +.desktop-setup-grid { display: grid; grid-template-columns: 1fr 1fr; gap: .65rem; margin-top: 1rem; } +.desktop-setup-grid label { display: grid; gap: .3rem; color: #536665; font-size: .72rem; font-weight: 650; } +.desktop-setup-grid input { border: 1px solid #cdd9d9; border-radius: .55rem; padding: .65rem .7rem; } +.desktop-setup-wide { grid-column: 1 / -1; } +.desktop-agent-options { display: grid; grid-template-columns: repeat(2, 1fr); gap: .55rem; margin-top: 1.2rem; } +.desktop-agent-options > label { display: flex; align-items: center; gap: .5rem; border: 1px solid #dce5e4; border-radius: .65rem; padding: .65rem; font-size: .8rem; text-transform: capitalize; } +.desktop-agent-login { margin-left: auto; color: #71807f; font-size: .65rem; text-transform: none; } +.desktop-setup-summary { margin-top: 1.25rem; border: 1px solid #dce5e4; border-radius: .7rem; overflow: hidden; } +.desktop-setup-summary > div { display: grid; grid-template-columns: 7rem 1fr; gap: .8rem; padding: .7rem .85rem; border-bottom: 1px solid #e6edec; font-size: .78rem; } +.desktop-setup-summary > div:last-child { border-bottom: 0; } +.desktop-setup-summary dt { color: #758382; } +.desktop-setup-summary dd { overflow-wrap: anywhere; color: #273a39; font-weight: 600; } +.desktop-setup-footer { display: flex; justify-content: flex-end; gap: .6rem; margin-top: 1.4rem; } +.desktop-setup-progress { height: .45rem; margin: 1.2rem 0; border-radius: 999px; overflow: hidden; background: #e4eceb; } +.desktop-setup-progress > span { display: block; height: 100%; border-radius: inherit; background: #16827c; transition: width .25s ease; } +.desktop-setup-step-list { display: grid; gap: .35rem; max-height: 22rem; overflow-y: auto; } +.desktop-setup-step-list > div { display: grid; grid-template-columns: 1.25rem 1fr; gap: .55rem; padding: .45rem .55rem; border-radius: .5rem; } +.desktop-setup-step-list > div[data-status="active"] { background: #edf8f7; } +.desktop-setup-step-list > div[data-status="failed"] { color: #9f2d20; background: #fff6f4; } +.desktop-setup-step-list svg { width: .95rem; height: .95rem; } +.desktop-setup-step-list strong, +.desktop-setup-step-list small { display: block; } +.desktop-setup-step-list strong { font-size: .78rem; } +.desktop-setup-step-list small { margin-top: .1rem; color: #6d7c7b; font-size: .68rem; line-height: 1.35; } +.desktop-setup-log { max-height: 7rem; margin: .8rem 0; overflow: auto; border-radius: .55rem; padding: .65rem; color: #c7e8e4; background: #18302f; font-size: .65rem; line-height: 1.45; white-space: pre-wrap; } +.desktop-setup-hero-icon { width: 2.5rem; height: 2.5rem; margin-bottom: .8rem; color: #b46a2a; } +.desktop-setup-error-icon { color: #b64334; } +.desktop-setup-success { display: grid; place-items: center; width: 3.5rem; height: 3.5rem; margin-bottom: 1rem; border-radius: 1rem; color: white; background: #21956c; } +.desktop-setup-success svg { width: 1.7rem; height: 1.7rem; } + @media (prefers-reduced-motion: reduce) { .desktop-choice-button { transition: none; } .desktop-choice-button:hover:not(:disabled) { transform: none; } @@ -255,4 +313,8 @@ .desktop-welcome-card, .desktop-connection-card { border-radius: .9rem; padding: 1.25rem; } .desktop-welcome-copy { padding: 1.8rem 0 1.25rem; } + .desktop-setup-wizard { padding: 1.25rem; } + .desktop-agent-options, + .desktop-setup-grid { grid-template-columns: 1fr; } + .desktop-setup-wide { grid-column: auto; } } diff --git a/propr-ui/src/desktop/desktopAccessInvalidation.ts b/propr-ui/src/desktop/desktopAccessInvalidation.ts new file mode 100644 index 000000000..81a4d0701 --- /dev/null +++ b/propr-ui/src/desktop/desktopAccessInvalidation.ts @@ -0,0 +1,34 @@ +import { useEffect, useRef } from 'react'; +import type { DesktopAccessInvalidEventDetail, DesktopConnectionResult } from './types'; +import { DESKTOP_ACCESS_INVALID_EVENT } from './types'; + +export const matchesDesktopAccessInvalidation = ( + profileId: string, + result: Extract, + detail: DesktopAccessInvalidEventDetail | undefined, +): detail is DesktopAccessInvalidEventDetail => Boolean( + detail && detail.profileId === profileId && detail.transportScope === result.transportScope, +); + +export const revokedDesktopConnection = ( + result: Extract, +): Exclude => ({ + status: 'authentication-required', + message: 'Access to this instance was revoked or expired. Pair again to continue.', + version: result.version, + authentication: result.authentication, +}); + +export const useDesktopAccessInvalidation = ( + listener: (detail: DesktopAccessInvalidEventDetail | undefined) => void, +): void => { + const current = useRef(listener); + current.current = listener; + useEffect(() => { + const receive = (event: Event) => current.current( + (event as CustomEvent).detail, + ); + window.addEventListener(DESKTOP_ACCESS_INVALID_EVENT, receive); + return () => window.removeEventListener(DESKTOP_ACCESS_INVALID_EVENT, receive); + }, []); +}; diff --git a/propr-ui/src/desktop/electronAdapters.test.ts b/propr-ui/src/desktop/electronAdapters.test.ts new file mode 100644 index 000000000..6a1d40310 --- /dev/null +++ b/propr-ui/src/desktop/electronAdapters.test.ts @@ -0,0 +1,140 @@ +import { afterEach, describe, expect, it, vi } from 'vitest'; +import type { DesktopRendererBridge } from '../../../apps/desktop/src/shared/contract'; +import { getDesktopConnectionScope, setDesktopConnectionScope } from '../api/apiClient'; +import { createElectronDesktopAdapters } from './electronAdapters'; + +const profile = { id: 'remote-1', name: 'Team', baseUrl: 'https://team.example.com', kind: 'remote' as const }; + +const bridgeFixture = (): DesktopRendererBridge => ({ + isDesktop: true, + platform: 'macos', + app: { onDeepLink: () => () => undefined }, + profiles: { + list: async () => [profile], + save: async () => undefined, + remove: async () => undefined, + getActiveId: async () => null, + setActiveId: async () => undefined, + }, + discovery: { discover: async () => [] }, + authentication: { authenticate: async () => undefined, cancel: async () => undefined }, + externalBrowser: { open: async () => undefined }, + localSetup: { + status: async () => ({ + phase: 'unsupported', + capability: { supported: false, kind: 'remote-only', platform: 'darwin', reason: 'remote only' }, + sessionId: '00000000-0000-4000-8000-000000000000', + logs: [], + }), + start: async () => { throw new Error('unavailable'); }, + retry: async () => { throw new Error('unavailable'); }, + cancel: async () => { throw new Error('unavailable'); }, + selectPrivateKey: async () => null, + acquireWebhookSecret: async () => null, + onProgress: () => () => undefined, + }, + connection: { + probe: async () => ({ status: 'ready', activationTicket: 'ticket' }), + activateLocal: async () => ({ status: 'ready', profileId: 'local-1' }), + discardLocal: async () => ({ discarded: true }), + activate: async () => ({ + status: 'ready', profileId: profile.id, transportScope: 'S'.repeat(22), identityEpoch: 'E'.repeat(22), + }), + discard: async () => ({ discarded: true }), + invalidate: async () => ({ invalidated: true }), + }, +}); + +describe('Electron desktop renderer adapter', () => { + afterEach(() => { + setDesktopConnectionScope(null); + window.localStorage.clear(); + window.sessionStorage.clear(); + }); + + it('activates an expiring main-owned ticket and publishes only its non-secret transport scope', async () => { + const bridge = bridgeFixture(); + bridge.connection.activate = vi.fn(bridge.connection.activate); + const adapters = createElectronDesktopAdapters(bridge); + const probe = await adapters.connection.probe(profile); + expect(probe.status).toBe('ready'); + if (probe.status !== 'ready') return; + + const activated = await adapters.connection.activate!(profile, probe); + expect(bridge.connection.activate).toHaveBeenCalledWith('ticket'); + expect(activated.status).toBe('ready'); + if (activated.status !== 'ready') return; + expect(activated).not.toHaveProperty('activationTicket'); + adapters.connection.publishActivation!(profile, activated); + + expect(getDesktopConnectionScope()).toMatchObject({ + bridge, + profileId: profile.id, + transportScope: 'S'.repeat(22), + }); + expect(JSON.stringify(activated)).not.toMatch(/bearer|deviceSecret|credentialPath|nativeEvidence|propr_it_/i); + }); + + it('selects a local profile without publishing a bearer transport scope', async () => { + const local = { id: 'local-1', name: 'This computer', baseUrl: 'http://127.0.0.1:4000', kind: 'local' as const }; + const bridge = bridgeFixture(); + bridge.connection.activateLocal = vi.fn(bridge.connection.activateLocal); + bridge.connection.probe = vi.fn(async () => ({ + status: 'ready' as const, + version: '0.8.15', + localActivationTicket: 'L'.repeat(43), + })); + bridge.connection.activate = vi.fn(bridge.connection.activate); + const adapters = createElectronDesktopAdapters(bridge); + const probe = await adapters.connection.probe(local); + expect(probe.status).toBe('ready'); + if (probe.status !== 'ready') return; + + const activated = await adapters.connection.activate!(local, probe); + + expect(activated).toEqual({ + status: 'ready', + version: '0.8.15', + localActivationTicket: 'L'.repeat(43), + }); + expect(bridge.connection.activateLocal).toHaveBeenCalledWith('L'.repeat(43)); + expect(bridge.connection.activate).not.toHaveBeenCalled(); + expect(getDesktopConnectionScope()).toBeNull(); + }); + + it('discards activation when the connection attempt is no longer current', async () => { + const bridge = bridgeFixture(); + bridge.connection.discard = vi.fn(bridge.connection.discard); + const adapters = createElectronDesktopAdapters(bridge); + const result = await adapters.connection.activate!( + profile, + { status: 'ready', activationTicket: 'ticket' }, + () => false, + ); + expect(result.status).toBe('authentication-required'); + expect(bridge.connection.discard).toHaveBeenCalledOnce(); + expect(getDesktopConnectionScope()).toBeNull(); + }); + + it('rolls back a local selection that becomes stale while trusted activation is in flight', async () => { + const local = { id: 'local-1', name: 'This computer', baseUrl: 'http://127.0.0.1:4000', kind: 'local' as const }; + const bridge = bridgeFixture(); + let current = true; + bridge.connection.activateLocal = vi.fn(async ticket => { + expect(ticket).toBe('L'.repeat(43)); + current = false; + return { status: 'ready' as const, profileId: local.id }; + }); + bridge.connection.discardLocal = vi.fn(bridge.connection.discardLocal); + const adapters = createElectronDesktopAdapters(bridge); + const result = await adapters.connection.activate!( + local, + { status: 'ready', localActivationTicket: 'L'.repeat(43) }, + () => current, + ); + + expect(result.status).toBe('offline'); + expect(bridge.connection.discardLocal).toHaveBeenCalledWith('L'.repeat(43)); + expect(getDesktopConnectionScope()).toBeNull(); + }); +}); diff --git a/propr-ui/src/desktop/electronAdapters.ts b/propr-ui/src/desktop/electronAdapters.ts new file mode 100644 index 000000000..a8c593b39 --- /dev/null +++ b/propr-ui/src/desktop/electronAdapters.ts @@ -0,0 +1,141 @@ +import { normalizeApiBaseUrl } from '@propr/client'; +import type { DesktopRendererBridge } from '../../../apps/desktop/src/shared/contract'; +import { getDesktopConnectionScope, setDesktopConnectionScope } from '../api/apiClient'; +import type { DesktopAdapters } from './types'; + +const snapshotStorage = (storage: Storage): [string, string][] => { + const snapshot: [string, string][] = []; + for (let index = 0; index < storage.length; index += 1) { + const key = storage.key(index); + if (key !== null) snapshot.push([key, storage.getItem(key) ?? '']); + } + return snapshot; +}; + +const restoreStorage = (storage: Storage, snapshot: [string, string][]): void => { + const expected = new Set(snapshot.map(([key]) => key)); + for (let index = storage.length - 1; index >= 0; index -= 1) { + const key = storage.key(index); + if (key !== null && !expected.has(key)) storage.removeItem(key); + } + snapshot.forEach(([key, value]) => storage.setItem(key, value)); +}; + +const clearRendererProfileState = (): boolean => { + let localSnapshot: [string, string][] = []; + let sessionSnapshot: [string, string][] = []; + try { + localSnapshot = snapshotStorage(window.localStorage); + sessionSnapshot = snapshotStorage(window.sessionStorage); + window.localStorage.clear(); + window.sessionStorage.clear(); + if (window.localStorage.length !== 0 || window.sessionStorage.length !== 0) { + throw new Error('Desktop renderer storage was not cleared'); + } + return true; + } catch { + try { restoreStorage(window.localStorage, localSnapshot); } catch { /* fail closed below */ } + try { restoreStorage(window.sessionStorage, sessionSnapshot); } catch { /* fail closed below */ } + return false; + } +}; + +/** Renderer-owned composition around the least-privileged staged preload bridge. */ +export const createElectronDesktopAdapters = (bridge: DesktopRendererBridge): DesktopAdapters => { + let publishedProfile: { id: string; origin: string; identityEpoch: string } | null = null; + return { + platform: bridge.platform, + app: bridge.app, + profiles: { + list: () => bridge.profiles.list(), + save: profile => bridge.profiles.save(profile), + async remove(profileId) { + await bridge.authentication.cancel(profileId); + await bridge.profiles.remove(profileId); + }, + getActiveId: () => bridge.profiles.getActiveId(), + async setActiveId(profileId) { + await bridge.profiles.setActiveId(profileId); + if (profileId === null) setDesktopConnectionScope(null); + }, + }, + discovery: bridge.discovery, + authentication: { + authenticate: profile => bridge.authentication.authenticate(profile), + cancel: profileId => bridge.authentication.cancel(profileId), + }, + externalBrowser: bridge.externalBrowser, + localSetup: bridge.localSetup, + connection: { + probe: profile => bridge.connection.probe(profile), + async activate(profile, result, isCurrent = () => true) { + if (profile.kind === 'local') { + if (!result.localActivationTicket) throw new Error('Local desktop activation ticket is missing.'); + if (!isCurrent()) return { status: 'offline', message: 'This connection changed before activation completed.' }; + const activated = await bridge.connection.activateLocal(result.localActivationTicket); + if (activated.profileId !== profile.id || !isCurrent()) { + await bridge.connection.discardLocal(result.localActivationTicket).catch(() => undefined); + return { status: 'offline', message: 'This connection changed before activation completed.' }; + } + return result; + } + if (result.activationTicket === undefined) throw new Error('Desktop activation ticket is missing.'); + const previousProfileId = await bridge.profiles.getActiveId(); + const activated = await bridge.connection.activate(result.activationTicket); + const discard = async () => { + await bridge.connection.discard(activated).catch(() => undefined); + const currentScope = getDesktopConnectionScope(); + if (currentScope?.profileId === activated.profileId + && currentScope.transportScope === activated.transportScope) setDesktopConnectionScope(null); + }; + if (activated.profileId !== profile.id || !isCurrent() + || !/^[A-Za-z0-9_-]{22}$/.test(activated.identityEpoch)) { + await discard(); + return { + status: 'authentication-required', + message: 'This connection changed while it was being activated. Check it again to continue.', + version: result.version, + authentication: result.authentication, + }; + } + const intendedOrigin = normalizeApiBaseUrl(profile.baseUrl); + const isReplacement = publishedProfile === null + || previousProfileId !== profile.id + || publishedProfile.id !== profile.id + || publishedProfile.origin !== intendedOrigin + || publishedProfile.identityEpoch !== activated.identityEpoch; + if (isReplacement && !clearRendererProfileState()) { + await discard(); + return { status: 'offline', message: 'Desktop storage isolation failed. Restart ProPR Desktop before connecting again.' }; + } + return { + status: 'ready', + version: result.version, + authentication: result.authentication, + profileId: activated.profileId, + transportScope: activated.transportScope, + identityEpoch: activated.identityEpoch, + }; + }, + publishActivation(profile, result) { + if (!result.transportScope || !result.identityEpoch || result.profileId !== profile.id) { + setDesktopConnectionScope(null); + throw new Error('Desktop connection activation changed before publication.'); + } + setDesktopConnectionScope({ + bridge, + profileId: result.profileId, + transportScope: result.transportScope, + }, profile.baseUrl); + publishedProfile = { + id: profile.id, + origin: normalizeApiBaseUrl(profile.baseUrl), + identityEpoch: result.identityEpoch, + }; + }, + deactivate() { + setDesktopConnectionScope(null); + }, + }, + }; +}; diff --git a/propr-ui/src/desktop/packagedTransportSmoke.ts b/propr-ui/src/desktop/packagedTransportSmoke.ts new file mode 100644 index 000000000..043811aa7 --- /dev/null +++ b/propr-ui/src/desktop/packagedTransportSmoke.ts @@ -0,0 +1,170 @@ +import type { Socket } from '@propr/client'; +import { DESKTOP_TRANSPORT_SCOPE_QUERY } from '@propr/shared'; +import { + apiFetch, + getDesktopConnectionScope, + handleDesktopAccessCode, + proprClient, +} from '../api/apiClient'; +import { createElectronDesktopAdapters } from './electronAdapters'; +import type { DesktopProfile } from './types'; + +interface SocketRecord { + socket: Socket; + profileId: string; + transportScope: string; +} + +interface SocketConnectionError extends Error { + data?: { code?: unknown }; +} + +interface PackagedTransportSmokeHarness { + activate(profile: DesktopProfile): Promise<{ + profileId: string; + transportScope: string; + identityEpoch: string; + contractsContainSecret: boolean; + }>; + rest(): Promise; + connectSocket(): Promise; + reconnectSocket(id: number): Promise; + expectSocketRejected(id: number): Promise; + disconnectSocket(id: number): void; + handleStaleInvalidation(profileId: string, transportScope: string): Promise; + rendererEvidence(): unknown; +} + +declare global { + interface Window { + __proprPackagedTransportSmoke?: PackagedTransportSmokeHarness; + } +} + +const INVALID_INSTANCE_TOKEN = 'INVALID_INSTANCE_TOKEN'; + +const waitForSocket = (socket: Socket, expected: 'connect' | 'connect_error'): Promise => + new Promise((resolve, reject) => { + const timer = window.setTimeout(() => { + cleanup(); + reject(new Error(`Packaged Socket.IO ${expected} timed out`)); + }, 5_000); + const connected = () => { + cleanup(); + if (expected === 'connect') resolve(); + else reject(new Error('Stale Socket.IO scope unexpectedly connected')); + }; + const failed = (error: SocketConnectionError) => { + cleanup(); + if (expected !== 'connect_error') { + reject(new Error(`Packaged Socket.IO connection failed: ${error.message}`)); + } else if (error.message !== INVALID_INSTANCE_TOKEN || error.data?.code !== INVALID_INSTANCE_TOKEN) { + reject(new Error('Packaged stale Socket.IO rejection was not INVALID_INSTANCE_TOKEN')); + } else { + resolve(); + } + }; + const cleanup = () => { + window.clearTimeout(timer); + socket.off('connect', connected); + socket.off('connect_error', failed); + }; + socket.once('connect', connected); + socket.once('connect_error', failed); + }); + +/** Packaged-only E2E driver composed from the production renderer adapters. */ +export const installPackagedTransportSmokeHarness = (): void => { + const bridge = window.__PROPR_DESKTOP__; + if (!bridge) throw new Error('Packaged renderer bridge is unavailable'); + const adapters = createElectronDesktopAdapters(bridge); + const sockets = new Map(); + let nextSocketId = 1; + + const harness: PackagedTransportSmokeHarness = { + async activate(profile) { + const probed = await adapters.connection.probe(profile); + if (probed.status !== 'ready' || !adapters.connection.activate || !adapters.connection.publishActivation) { + throw new Error('Packaged desktop profile was not ready'); + } + const activated = await adapters.connection.activate(profile, probed); + if (activated.status !== 'ready' || !activated.profileId + || !activated.transportScope || !activated.identityEpoch) { + throw new Error('Packaged desktop activation failed'); + } + adapters.connection.publishActivation(profile, activated); + return { + profileId: activated.profileId, + transportScope: activated.transportScope, + identityEpoch: activated.identityEpoch, + contractsContainSecret: JSON.stringify([probed, activated]).includes('propr_it_'), + }; + }, + async rest() { + const response = await apiFetch('/api/smoke/rest', { credentials: 'include' }); + if (!response.ok || (await response.json() as { ok?: boolean }).ok !== true) { + throw new Error('Packaged REST fixture failed'); + } + }, + async connectSocket() { + const scope = getDesktopConnectionScope(); + if (!scope) throw new Error('Packaged Socket.IO scope is unavailable'); + const socket = proprClient.connectSocket({ + transports: ['websocket'], + forceNew: true, + reconnection: true, + auth: { [DESKTOP_TRANSPORT_SCOPE_QUERY]: scope.transportScope }, + query: { [DESKTOP_TRANSPORT_SCOPE_QUERY]: scope.transportScope }, + }); + const id = nextSocketId++; + sockets.set(id, { socket, profileId: scope.profileId, transportScope: scope.transportScope }); + await waitForSocket(socket, 'connect'); + return id; + }, + async reconnectSocket(id) { + const record = sockets.get(id); + if (!record) throw new Error('Packaged Socket.IO connection is unavailable'); + record.socket.disconnect(); + const connected = waitForSocket(record.socket, 'connect'); + record.socket.connect(); + await connected; + }, + async expectSocketRejected(id) { + const record = sockets.get(id); + const currentScope = getDesktopConnectionScope(); + if (!record || !currentScope || currentScope.profileId !== record.profileId + || currentScope.transportScope === record.transportScope) { + throw new Error('Packaged stale Socket.IO activation was not rotated'); + } + record.socket.disconnect(); + record.socket.io.opts.query = { [DESKTOP_TRANSPORT_SCOPE_QUERY]: currentScope.transportScope }; + const rejected = waitForSocket(record.socket, 'connect_error'); + try { + record.socket.connect(); + await rejected; + } finally { + record.socket.disconnect(); + } + }, + disconnectSocket(id) { sockets.get(id)?.socket.disconnect(); }, + handleStaleInvalidation(profileId, transportScope) { + return handleDesktopAccessCode('INVALID_INSTANCE_TOKEN', { bridge, profileId, transportScope }); + }, + rendererEvidence() { + const scope = getDesktopConnectionScope(); + return { + origin: location.origin, + href: location.href, + localStorage: Object.entries(localStorage), + sessionStorage: Object.entries(sessionStorage), + scope: scope && { profileId: scope.profileId, transportScope: scope.transportScope }, + }; + }, + }; + Object.defineProperty(window, '__proprPackagedTransportSmoke', { + configurable: false, + enumerable: false, + value: Object.freeze(harness), + writable: false, + }); +}; diff --git a/propr-ui/src/desktop/types.ts b/propr-ui/src/desktop/types.ts index 1bcab4343..3107051d8 100644 --- a/propr-ui/src/desktop/types.ts +++ b/propr-ui/src/desktop/types.ts @@ -9,8 +9,8 @@ export interface DesktopProfile { } export type DesktopConnectionResult = - | { status: 'ready'; version?: string } - | { status: 'authentication-required'; message?: string } + | { status: 'ready'; version?: string; authentication?: string; activationTicket?: string; localActivationTicket?: string; transportScope?: string; profileId?: string; identityEpoch?: string } + | { status: 'authentication-required'; message?: string; version?: string; authentication?: string } | { status: 'incompatible'; message: string; version?: string } | { status: 'offline'; message: string }; @@ -33,28 +33,52 @@ export interface DesktopAuthenticationAdapter { * Opening the system browser alone is not successful authentication. */ authenticate(profile: DesktopProfile): Promise; + cancel?(profileId: string): Promise; } export const DESKTOP_AUTHENTICATION_COMPLETE_EVENT = 'propr:desktop-authentication-complete'; +export const DESKTOP_ACCESS_INVALID_EVENT = 'propr:desktop-access-invalid'; export interface DesktopAuthenticationCompleteEventDetail { profileId: string; } +export interface DesktopAccessInvalidEventDetail { + profileId: string; + transportScope: string; + code: string; +} + export interface DesktopExternalBrowserAdapter { open(url: string): Promise; } export interface DesktopLocalSetupAdapter { - setup(): Promise; + status(): Promise; + start(request: import('../../../apps/desktop/src/shared/contract').DesktopSetupRequest): Promise; + retry(request?: import('../../../apps/desktop/src/shared/contract').DesktopSetupRequest): Promise; + cancel(): Promise; + selectPrivateKey(): Promise; + acquireWebhookSecret(): Promise; + onProgress(listener: (snapshot: import('../../../apps/desktop/src/shared/contract').DesktopSetupSnapshot) => void): () => void; } export interface DesktopConnectionAdapter { probe(profile: DesktopProfile): Promise; + activate?( + profile: DesktopProfile, + result: Extract, + isCurrent?: () => boolean, + ): Promise; + publishActivation?(profile: DesktopProfile, result: Extract): void; + deactivate?(): void; } export interface DesktopAdapters { platform: DesktopPlatform; + app: { + onDeepLink(listener: (url: string) => void): () => void; + }; profiles: DesktopProfileAdapter; discovery: DesktopDiscoveryAdapter; authentication: DesktopAuthenticationAdapter; @@ -67,12 +91,4 @@ export interface DesktopAdapters { * Small preload-facing contract. Electron can expose this object through * contextBridge without exposing Node or command execution to React. */ -export interface ProprDesktopBridge extends DesktopAdapters { - isDesktop: true; -} - -declare global { - interface Window { - __PROPR_DESKTOP__?: ProprDesktopBridge; - } -} +export type ProprDesktopBridge = import('../../../apps/desktop/src/shared/contract').DesktopRendererBridge; diff --git a/propr-ui/src/vite-env.d.ts b/propr-ui/src/vite-env.d.ts index 6abae6cad..65725a30d 100644 --- a/propr-ui/src/vite-env.d.ts +++ b/propr-ui/src/vite-env.d.ts @@ -7,4 +7,5 @@ declare const __PROPR_DESKTOP__: boolean; interface Window { proprDesktop?: import('../../apps/desktop/src/shared/contract').DesktopBridge; + __PROPR_DESKTOP__?: import('../../apps/desktop/src/shared/contract').DesktopRendererBridge; } diff --git a/test/cliAgentValidation.test.ts b/test/cliAgentValidation.test.ts index 6c6bab3d1..ccf542229 100644 --- a/test/cliAgentValidation.test.ts +++ b/test/cliAgentValidation.test.ts @@ -62,6 +62,7 @@ function fakeConfig(overrides: Partial = {}): OrchestratorCo function fakeOrchestrator(): OrchestratorModule { return { docker: () => ({ status: 0, stdout: "image-id\n", stderr: "" }), + dockerAsync: async () => ({ status: 0, stdout: "image-id\n", stderr: "" }), validateDockerBindPath: (name, value) => (!value || value.startsWith("/") ? null : `${name} must be absolute`), } as unknown as OrchestratorModule; } diff --git a/test/orchestratorCancellation.test.mjs b/test/orchestratorCancellation.test.mjs new file mode 100644 index 000000000..76f2e5d44 --- /dev/null +++ b/test/orchestratorCancellation.test.mjs @@ -0,0 +1,260 @@ +import assert from 'node:assert/strict'; +import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'; +import { readFileSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join } from 'node:path'; +import test from 'node:test'; +import { fileURLToPath } from 'node:url'; +import { dockerAsync, resolveConfig, startStackAsync } from '../docker/launcher/orchestrator.mjs'; + +const eventually = async (operation, timeoutMs = 15_000) => { + const deadline = Date.now() + timeoutMs; + while (Date.now() < deadline) { + try { return await operation(); } catch { await new Promise(resolve => setTimeout(resolve, 20)); } + } + return operation(); +}; + +test('dockerAsync cancellation terminates the spawned process group before settling', async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-docker-cancel-')); + const executable = join(directory, 'docker'); + const descendantPath = join(directory, 'descendant.pid'); + const previousPath = process.env.PATH; + process.env.PATH = `${directory}:${previousPath ?? ''}`; + process.env.PROPR_TEST_DESCENDANT_PATH = descendantPath; + try { + await writeFile(executable, '#!/bin/sh\nsleep 30 &\necho "$!" > "$PROPR_TEST_DESCENDANT_PATH"\nwait\n', { mode: 0o700 }); + await chmod(executable, 0o700); + const controller = new AbortController(); + const operation = dockerAsync(['pull', 'example'], { signal: controller.signal }); + const descendantPid = Number(await eventually(async () => readFile(descendantPath, 'utf8'))); + controller.abort(); + const result = await operation; + assert.equal(result.error?.code, 'ABORT_ERR'); + await eventually(async () => { + try { + const state = (await readFile(`/proc/${descendantPid}/stat`, 'utf8')).split(' ')[2]; + assert.equal(state, 'Z', 'descendant must be terminated (a container PID 1 may leave it as a zombie)'); + } catch (error) { + if (error?.code !== 'ENOENT') throw error; + } + }); + } finally { + process.env.PATH = previousPath; + delete process.env.PROPR_TEST_DESCENDANT_PATH; + await rm(directory, { recursive: true, force: true }); + } +}); + +test('setup abort during launch and final status cleans run-owned containers and leaves preexisting and foreign containers untouched', { concurrency: false, timeout: 180_000 }, async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-docker-daemon-cancel-')); + const executable = join(directory, 'docker'); + const statePath = join(directory, 'containers.json'); + const markerPath = join(directory, 'created.marker'); + const previous = { path: process.env.PATH, state: process.env.PROPR_FAKE_STATE, marker: process.env.PROPR_FAKE_MARKER, target: process.env.PROPR_FAKE_ABORT_TARGET, stopMode: process.env.PROPR_FAKE_STOP_MODE, skip: process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK }; + const initial = { + 'propr-api': { 'propr.stack': 'propr', 'propr.service': 'api', foreign: 'preexisting', __running: false }, + foreign: { foreign: 'true', __running: true }, + }; + await writeFile(statePath, JSON.stringify(initial)); + await writeFile(executable, `#!/bin/sh +exec /usr/local/bin/node - -- "$@" <<'PROPR_FAKE_NODE' +const fs = require('node:fs'); +const args = process.argv.slice(2); if (args[0] === '--') args.shift(); +const statePath = process.env.PROPR_FAKE_STATE; +const load = () => JSON.parse(fs.readFileSync(statePath, 'utf8')); +const save = value => { const temporary = statePath + '.' + process.pid; fs.writeFileSync(temporary, JSON.stringify(value)); fs.renameSync(temporary, statePath); }; +const lockPath = statePath + '.lock'; +const mutate = operation => { + for (;;) { + try { fs.mkdirSync(lockPath); break; } + catch (error) { if (error.code !== 'EEXIST') throw error; Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2); } + } + try { const state = load(); const result = operation(state); save(state); return result; } + finally { fs.rmdirSync(lockPath); } +}; +const option = name => { const index = args.indexOf(name); return index >= 0 ? args[index + 1] : undefined; }; +if (args[0] === 'images') { console.log('image-id'); process.exit(0); } +if (args[0] === 'image' && args[1] === 'inspect') { console.log('[]'); process.exit(0); } +if (args[0] === 'network') process.exit(0); +if (args[0] === 'ps') { + const match = args.join(' ').match(/name=\\^([^$]+)\\$/); + const name = match && match[1].replace(/^\\//, ''); + const state = load(); + const entry = name && state[name]; + const allCoreLaunched = ['redis', 'daemon', 'worker', 'analysis-worker', 'indexing-worker', 'api'] + .every(service => state['propr-' + service]?.['propr.setup-run'] && state['propr-' + service].__running); + if (!name && state.foreign?.statusError && allCoreLaunched) { + fs.writeSync(2, 'synthetic docker ps failure\\n'); + process.exit(23); + } else if (!name && state.foreign?.abortFinal && allCoreLaunched) { + fs.writeFileSync(process.env.PROPR_FAKE_MARKER, 'final-status'); + Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 30_000); + process.exit(0); + } else { + if (entry && (args.includes('-a') || entry.__running)) { + fs.writeSync(1, args.includes('{{json .Names}}') ? JSON.stringify(name) + '\\n' : name + '\\n'); + } + process.exit(0); + } +} +if (args[0] === 'inspect') { + const name = args[args.length - 1]; + const labels = load()[name]; + if (!labels) process.exit(1); + const value = args.join(' ').includes('.HostConfig.Binds') ? labels.__hostConfig?.Binds : labels; + fs.writeSync(1, JSON.stringify(value) + '\\n'); + process.exit(0); +} +if (args[0] === 'run') { + const name = option('--name'); + const labels = {}; + for (let i = 0; i < args.length; i += 1) if (args[i] === '--label') { const [key, ...rest] = args[++i].split('='); labels[key] = rest.join('='); } + labels.__hostConfig = { Binds: args.flatMap((value, index) => value === '-v' ? [args[index + 1]] : []) }; + labels.__running = true; + mutate(state => { state[name] = labels; if (args.includes('--rm')) delete state[name]; }); + fs.writeFileSync(process.env.PROPR_FAKE_MARKER, name); + if (name === process.env.PROPR_FAKE_ABORT_TARGET) setTimeout(() => {}, 30_000); + else { console.log(name); process.exit(0); } +} else if (args[0] === 'stop') { + const name = args[args.length - 1]; + if (name === 'propr-redis' && process.env.PROPR_FAKE_STOP_MODE === 'owned-remains') { + mutate(state => { if (state[name]) state[name].__running = false; }); + process.exit(42); + } + if (name === 'propr-redis' && process.env.PROPR_FAKE_STOP_MODE === 'foreign-replacement') { + mutate(state => { state[name] = { foreign: 'replacement', __running: false }; }); + process.exit(42); + } + process.exit(0); +} +else if (args[0] === 'rm') { const name = args[args.length - 1]; mutate(state => { delete state[name]; }); process.exit(0); } +else process.exit(0); +PROPR_FAKE_NODE +`, { mode: 0o700 }); + await chmod(executable, 0o700); + process.env.PATH = `${directory}:${previous.path ?? ''}`; + process.env.PROPR_FAKE_STATE = statePath; + process.env.PROPR_FAKE_MARKER = markerPath; + process.env.PROPR_FAKE_ABORT_TARGET = 'propr-redis'; + process.env.PROPR_FAKE_STOP_MODE = 'owned-remains'; + process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK = '1'; + const manifestPath = fileURLToPath(new URL('../docker/launcher/manifest.json', import.meta.url)); + const stableRoot = join(directory, 'app-data', 'desktop', 'local-stack'); + await mkdir(join(stableRoot, 'data'), { recursive: true, mode: 0o700 }); + await mkdir(join(stableRoot, 'logs'), { mode: 0o700 }); + await mkdir(join(stableRoot, 'repos'), { mode: 0o700 }); + await writeFile(join(stableRoot, '.env'), '', { mode: 0o600 }); + const cfg = resolveConfig({}, { + manifestPath, + envFileLocal: join(stableRoot, '.env'), + envFileHost: join(stableRoot, '.env'), + hostData: join(stableRoot, 'data'), + hostLogs: join(stableRoot, 'logs'), + hostRepos: join(stableRoot, 'repos'), + }); + try { + for (let iteration = 0; iteration < 5; iteration += 1) { + await writeFile(statePath, JSON.stringify(initial)); + await writeFile(markerPath, ''); + process.env.PROPR_FAKE_ABORT_TARGET = 'propr-redis'; + const controller = new AbortController(); + const operation = startStackAsync(cfg, { ui: false, docs: false, tunnel: false, signal: controller.signal }); + const rejected = assert.rejects(operation); + await Promise.race([ + eventually(async () => { assert.equal(await readFile(markerPath, 'utf8'), 'propr-redis'); }), + operation.then(() => { throw new Error('stack unexpectedly completed'); }, error => { throw error; }), + ]); + controller.abort(); + await rejected; + const settled = JSON.parse(readFileSync(statePath, 'utf8')); + assert.deepEqual(Object.keys(settled).sort(), ['foreign', 'propr-api'], `iteration ${iteration + 1}`); + assert.equal(settled['propr-api'].foreign, 'preexisting'); + assert.equal(settled.foreign.foreign, 'true'); + assert.equal(Object.values(settled).some(labels => labels['propr.setup-run']), false); + } + + await writeFile(statePath, JSON.stringify(initial)); + await writeFile(markerPath, ''); + process.env.PROPR_FAKE_STOP_MODE = 'foreign-replacement'; + const replacementController = new AbortController(); + const replacementOperation = startStackAsync(cfg, { ui: false, docs: false, tunnel: false, signal: replacementController.signal }); + await eventually(async () => { assert.equal(await readFile(markerPath, 'utf8'), 'propr-redis'); }); + replacementController.abort(); + await assert.rejects(replacementOperation); + const replacementSettled = JSON.parse(readFileSync(statePath, 'utf8')); + assert.equal(replacementSettled['propr-redis']?.foreign, 'replacement'); + assert.equal(replacementSettled['propr-api'].foreign, 'preexisting'); + assert.equal(replacementSettled.foreign.foreign, 'true'); + process.env.PROPR_FAKE_STOP_MODE = 'owned-remains'; + + const finalInitial = { + 'propr-ui': { 'propr.stack': 'propr', 'propr.service': 'ui', foreign: 'preexisting', __running: false }, + foreign: { foreign: 'true', abortFinal: true, __running: true }, + }; + await writeFile(statePath, JSON.stringify(finalInitial)); + await writeFile(markerPath, ''); + process.env.PROPR_FAKE_ABORT_TARGET = 'final-status'; + const finalController = new AbortController(); + const finalOperation = startStackAsync(cfg, { ui: false, docs: false, tunnel: false, signal: finalController.signal }); + await Promise.race([ + eventually(async () => { assert.equal(await readFile(markerPath, 'utf8'), 'final-status'); }, 5_000), + finalOperation.then(() => { throw new Error('stack unexpectedly completed'); }, error => { throw error; }), + ]); + finalController.abort(); + await assert.rejects(finalOperation); + const finalSettled = JSON.parse(readFileSync(statePath, 'utf8')); + assert.deepEqual(Object.keys(finalSettled).sort(), ['foreign', 'propr-ui']); + assert.equal(finalSettled['propr-ui'].foreign, 'preexisting'); + assert.equal(finalSettled.foreign.foreign, 'true'); + assert.equal(Object.values(finalSettled).some(labels => labels['propr.setup-run']), false); + + const errorInitial = { + 'propr-docs': { 'propr.stack': 'propr', 'propr.service': 'docs', foreign: 'preexisting', __running: false }, + foreign: { foreign: 'true', statusError: true, __running: true }, + }; + await writeFile(statePath, JSON.stringify(errorInitial)); + process.env.PROPR_FAKE_ABORT_TARGET = 'status-error'; + await assert.rejects( + startStackAsync(cfg, { ui: false, docs: false, tunnel: false }), + /Failed to inspect stack status: synthetic docker ps failure/, + ); + const errorSettled = JSON.parse(readFileSync(statePath, 'utf8')); + assert.deepEqual(Object.keys(errorSettled).sort(), ['foreign', 'propr-docs']); + assert.equal(errorSettled['propr-docs'].foreign, 'preexisting'); + assert.equal(errorSettled.foreign.foreign, 'true'); + assert.equal(Object.values(errorSettled).some(labels => labels['propr.setup-run']), false); + + // A successful create persists only the stable app-owned bind sources. + // Toggle the fake daemon's running state to model an automatic Docker + // restart after the creating Electron authority has gone away; HostConfig + // remains byte-for-byte unchanged and contains no PID/fd path. + await writeFile(statePath, JSON.stringify({ foreign: { foreign: 'true', __running: true } })); + process.env.PROPR_FAKE_ABORT_TARGET = 'none'; + await startStackAsync(cfg, { ui: false, docs: false, tunnel: false }); + const created = JSON.parse(readFileSync(statePath, 'utf8')); + const createdNames = Object.keys(created).filter(name => name.startsWith('propr-')); + assert.ok(createdNames.length > 0); + for (const name of createdNames) { + const inspected = await dockerAsync(['inspect', '--format', '{{json .HostConfig.Binds}}', name]); + assert.equal(inspected.status, 0); + const binds = JSON.parse(inspected.stdout); + for (const bind of binds.filter(value => value.startsWith(stableRoot))) { + const source = bind.split(':')[0]; + assert.ok(source === join(stableRoot, '.env') || source.startsWith(`${stableRoot}/`)); + assert.doesNotMatch(source, /(?:^|\/)proc\/[0-9]+\/fd\/|(?:^|\/)dev\/fd\//); + } + created[name].__running = false; + created[name].__running = true; + } + await writeFile(statePath, JSON.stringify(created)); + const restarted = JSON.parse(readFileSync(statePath, 'utf8')); + for (const name of createdNames) assert.deepEqual(restarted[name].__hostConfig, created[name].__hostConfig); + } finally { + process.env.PATH = previous.path; + for (const [name, value] of [['PROPR_FAKE_STATE', previous.state], ['PROPR_FAKE_MARKER', previous.marker], ['PROPR_FAKE_ABORT_TARGET', previous.target], ['PROPR_FAKE_STOP_MODE', previous.stopMode], ['PROPR_SKIP_REMOTE_IMAGE_CHECK', previous.skip]]) { + if (value === undefined) delete process.env[name]; else process.env[name] = value; + } + await rm(directory, { recursive: true, force: true }); + } +}); diff --git a/test/orchestratorConcurrentCleanup.test.mjs b/test/orchestratorConcurrentCleanup.test.mjs new file mode 100644 index 000000000..b70fcf175 --- /dev/null +++ b/test/orchestratorConcurrentCleanup.test.mjs @@ -0,0 +1,125 @@ +import assert from 'node:assert/strict'; +import { chmod, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'; +import { tmpdir } from 'node:os'; +import { join } from 'node:path'; +import test from 'node:test'; +import { fileURLToPath } from 'node:url'; +import { resolveConfig, startStackAsync } from '../docker/launcher/orchestrator.mjs'; + +const eventually = async (operation, timeoutMs = 10_000) => { + const deadline = Date.now() + timeoutMs; + while (Date.now() < deadline) { + try { return await operation(); } catch { await new Promise(resolve => setTimeout(resolve, 20)); } + } + return operation(); +}; + +test('full nine-container cancellation cleans delayed journal entries concurrently and surfaces residuals', { timeout: 120_000 }, async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-concurrent-cleanup-')); + const executable = join(directory, 'docker'); + const stateDir = join(directory, 'containers'); + const marker = join(directory, 'final-status.marker'); + await mkdir(stateDir); + const previous = { + path: process.env.PATH, + state: process.env.PROPR_FAKE_STATE_DIR, + marker: process.env.PROPR_FAKE_MARKER, + residual: process.env.PROPR_FAKE_RESIDUAL, + skip: process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK, + }; + await writeFile(executable, `#!/bin/sh +exec /usr/local/bin/node - -- "$@" <<'PROPR_FAKE_NODE' +const fs = require('node:fs'); const path = require('node:path'); +const args = process.argv.slice(2); if (args[0] === '--') args.shift(); +const dir = process.env.PROPR_FAKE_STATE_DIR; +const file = name => path.join(dir, encodeURIComponent(name) + '.json'); +const names = () => fs.readdirSync(dir).filter(name => name.endsWith('.json')).map(name => decodeURIComponent(name.slice(0, -5))); +const read = name => { try { return JSON.parse(fs.readFileSync(file(name), 'utf8')); } catch { return null; } }; +const option = key => { const i = args.indexOf(key); return i < 0 ? undefined : args[i + 1]; }; +if (args[0] === 'images') { fs.writeSync(1, 'image-id\\n'); process.exit(0); } +if (args[0] === 'image' && args[1] === 'inspect') { fs.writeSync(1, '[]\\n'); process.exit(0); } +if (args[0] === 'network') process.exit(0); +if (args[0] === 'ps') { + const match = args.join(' ').match(/name=\\^([^$]+)\\$/); + if (match) { + const name = match[1].replace(/^\\//, ''); + if (read(name)) fs.writeSync(1, args.includes('{{json .Names}}') ? JSON.stringify(name) + '\\n' : name + '\\n'); + process.exit(0); + } + const current = names(); + const services = ['redis','daemon','worker','analysis-worker','indexing-worker','api','ui','docs','tunnel']; + if (services.every(service => current.includes('propr-' + service))) { + fs.writeFileSync(process.env.PROPR_FAKE_MARKER, 'ready'); + Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 30000); + } + for (const name of current) fs.writeSync(1, name + '\\trunning\\tUp\\t\\n'); + process.exit(0); +} +if (args[0] === 'run') { + const name = option('--name'); const labels = {}; + for (let i = 0; i < args.length; i++) if (args[i] === '--label') { const [key, ...value] = args[++i].split('='); labels[key] = value.join('='); } + fs.writeFileSync(file(name), JSON.stringify(labels)); + if (args.includes('--rm')) fs.unlinkSync(file(name)); + fs.writeSync(1, name + '\\n'); process.exit(0); +} +if (args[0] === 'inspect') { + const value = read(args[args.length - 1]); if (!value) process.exit(1); + fs.writeSync(1, JSON.stringify(value) + '\\n'); process.exit(0); +} +if (args[0] === 'stop') { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 1800); process.exit(0); } +if (args[0] === 'rm') { + const name = args[args.length - 1]; + if (name !== process.env.PROPR_FAKE_RESIDUAL) { try { fs.unlinkSync(file(name)); } catch {} } + process.exit(0); +} +process.exit(0); +PROPR_FAKE_NODE +`, { mode: 0o700 }); + await chmod(executable, 0o700); + process.env.PATH = `${directory}:${previous.path ?? ''}`; + process.env.PROPR_FAKE_STATE_DIR = stateDir; + process.env.PROPR_FAKE_MARKER = marker; + process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK = '1'; + const root = join(directory, 'app-data', 'desktop', 'local-stack'); + await mkdir(join(root, 'data'), { recursive: true, mode: 0o700 }); + await mkdir(join(root, 'logs'), { mode: 0o700 }); + await mkdir(join(root, 'repos'), { mode: 0o700 }); + await writeFile(join(root, '.env'), '', { mode: 0o600 }); + const manifestPath = fileURLToPath(new URL('../docker/launcher/manifest.json', import.meta.url)); + const cfg = resolveConfig({ PROPR_UI_TUNNEL_TOKEN: 'fake-tunnel-token' }, { + manifestPath, + envFileLocal: join(root, '.env'), envFileHost: join(root, '.env'), + hostData: join(root, 'data'), hostLogs: join(root, 'logs'), hostRepos: join(root, 'repos'), + uiTunnelEnabled: true, + }); + const run = async (residual) => { + await rm(stateDir, { recursive: true, force: true }); await mkdir(stateDir); + await writeFile(marker, ''); + if (residual) process.env.PROPR_FAKE_RESIDUAL = residual; else delete process.env.PROPR_FAKE_RESIDUAL; + const controller = new AbortController(); + const operation = startStackAsync(cfg, { ui: true, docs: true, tunnel: true, signal: controller.signal }); + const observed = operation.then(() => null, failure => failure); + await eventually(async () => assert.equal(await readFile(marker, 'utf8'), 'ready')); + const cancelledAt = Date.now(); + controller.abort(); + const error = await observed; + return { error, elapsed: Date.now() - cancelledAt, names: (await readdir(stateDir)).filter(name => name.endsWith('.json')) }; + }; + try { + const clean = await run(undefined); + assert.ok(clean.error, 'cancellation must reject'); + assert.deepEqual(clean.names, []); + assert.ok(clean.elapsed < 9_000, `concurrent cleanup took ${clean.elapsed}ms`); + + const residual = await run('propr-ui'); + assert.equal(residual.error?.code, 'PROPR_SETUP_CLEANUP_INCOMPLETE'); + assert.match(String(residual.error?.message), /cleanup is incomplete|run-owned containers remain/); + assert.deepEqual(residual.names, ['propr-ui.json']); + } finally { + process.env.PATH = previous.path; + for (const [name, value] of [['PROPR_FAKE_STATE_DIR', previous.state], ['PROPR_FAKE_MARKER', previous.marker], ['PROPR_FAKE_RESIDUAL', previous.residual], ['PROPR_SKIP_REMOTE_IMAGE_CHECK', previous.skip]]) { + if (value === undefined) delete process.env[name]; else process.env[name] = value; + } + await rm(directory, { recursive: true, force: true }); + } +}); diff --git a/test/orchestratorConfig.test.mjs b/test/orchestratorConfig.test.mjs index ae2a42526..dd42ab302 100644 --- a/test/orchestratorConfig.test.mjs +++ b/test/orchestratorConfig.test.mjs @@ -108,6 +108,30 @@ test('resolveHostConfig honors stack .env values for ports and docs', () => { ); }); +test('anchored config reads keep every Docker path on the stable runtime root', () => { + const parent = mkdtempSync(join(tmpdir(), 'propr-orch-fixed-root-')); + const stableRoot = join(parent, 'app-data', 'desktop', 'local-stack'); + const readRoot = join(parent, 'descriptor-root'); + mkdirSync(stableRoot, { recursive: true, mode: 0o700 }); + mkdirSync(readRoot, { mode: 0o700 }); + writeFileSync(join(stableRoot, '.env'), 'API_PORT=attacker-value\n', { mode: 0o600 }); + writeFileSync(join(readRoot, '.env'), 'API_PORT=4401\nDOCS_ENABLED=true\n', { mode: 0o600 }); + + const cfg = resolveHostConfig({ rootDir: stableRoot, readRootDir: readRoot, env: {}, manifestPath }); + assert.equal(cfg.apiPort, '4401'); + assert.equal(cfg.docsEnabled, true); + assert.equal(cfg.envFileLocal, join(stableRoot, '.env')); + assert.equal(cfg.envFileHost, join(stableRoot, '.env')); + assert.equal(cfg.hostData, join(stableRoot, 'data')); + assert.equal(cfg.hostLogs, join(stableRoot, 'logs')); + assert.equal(cfg.hostRepos, join(stableRoot, 'repos')); + for (const service of ['daemon', 'worker', 'api']) { + const serialized = JSON.stringify(buildServiceSpec(cfg, service)); + assert.doesNotMatch(serialized, new RegExp(readRoot.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))); + assert.doesNotMatch(serialized, /\/proc\/[0-9]+\/fd\/|\/dev\/fd\//); + } +}); + test('api service receives the configured stack env file', () => { const rootDir = mkdtempSync(join(tmpdir(), 'propr-orch-')); const envFile = join(rootDir, '.env'); diff --git a/test/orchestratorLifecycleRecovery.test.mjs b/test/orchestratorLifecycleRecovery.test.mjs new file mode 100644 index 000000000..aea71ef42 --- /dev/null +++ b/test/orchestratorLifecycleRecovery.test.mjs @@ -0,0 +1,140 @@ +import assert from 'node:assert/strict'; +import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'; +import { tmpdir } from 'node:os'; +import { join } from 'node:path'; +import test from 'node:test'; +import { fileURLToPath } from 'node:url'; +import { + getStackStatusAsync, + isLifecycleStackRunningAsync, + recoverStackAsync, + resolveHostConfig, + startStackAsync, + stopLifecycleStackAsync, +} from '../docker/launcher/orchestrator.mjs'; + +test('fixed-root lifecycle safely survives stop/start/restart and rejects replacements', { timeout: 120_000 }, async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-lifecycle-recovery-')); + const executable = join(directory, 'docker'); + const statePath = join(directory, 'containers.json'); + const oldPath = process.env.PATH; + const oldState = process.env.PROPR_FAKE_STATE; + const oldReplaceOnStop = process.env.PROPR_FAKE_REPLACE_ON_STOP; + const oldSkip = process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK; + await writeFile(statePath, '{}'); + await writeFile(executable, `#!/bin/sh +exec /usr/local/bin/node - -- "$@" <<'PROPR_FAKE_NODE' +const fs = require('node:fs'); +const args = process.argv.slice(2); if (args[0] === '--') args.shift(); +const statePath = process.env.PROPR_FAKE_STATE; +const load = () => JSON.parse(fs.readFileSync(statePath, 'utf8')); +const save = state => fs.writeFileSync(statePath, JSON.stringify(state)); +const byId = (state, id) => Object.entries(state).find(([, entry]) => entry.id === id); +const idFor = name => Buffer.from(name).toString('hex').padEnd(64, '0').slice(0, 64); +const option = key => { const i = args.indexOf(key); return i < 0 ? undefined : args[i + 1]; }; +if (args[0] === 'images') { fs.writeSync(1, 'image-id\\n'); process.exit(0); } +if (args[0] === 'image' && args[1] === 'inspect') { fs.writeSync(1, '[]\\n'); process.exit(0); } +if (args[0] === 'network') process.exit(0); +if (args[0] === 'ps') { + const state = load(); + const match = args.join(' ').match(/name=\\^([^$]+)\\$/); + if (match) { + const entry = state[match[1]]; + if (entry && (args.includes('-a') || entry.running)) fs.writeSync(1, match[1] + '\\n'); + process.exit(0); + } + for (const [name, entry] of Object.entries(state)) { + fs.writeSync(1, name + '\\t' + (entry.running ? 'running' : 'exited') + '\\t' + (entry.running ? 'Up' : 'Exited') + '\\t\\n'); + } + process.exit(0); +} +if (args[0] === 'run') { + const name = option('--name'); const labels = {}; + for (let i = 0; i < args.length; i++) if (args[i] === '--label') { const [key, ...value] = args[++i].split('='); labels[key] = value.join('='); } + const binds = args.flatMap((value, index) => value === '-v' ? [args[index + 1]] : []); + const state = load(); state[name] = { id: idFor(name), labels, binds, running: true }; save(state); + if (args.includes('--rm')) { delete state[name]; save(state); } + fs.writeSync(1, name + '\\n'); process.exit(0); +} +if (args[0] === 'inspect') { + const name = args[args.length - 1]; const entry = load()[name]; + if (!entry) { fs.writeSync(2, 'Error: No such object: ' + name + '\\n'); process.exit(1); } + fs.writeSync(1, JSON.stringify([{ Id: entry.id, Name: '/' + name, Config: { Labels: entry.labels }, HostConfig: { Binds: entry.binds }, State: { Running: entry.running } }]) + '\\n'); + process.exit(0); +} +if (args[0] === 'stop') { + const state = load(); const found = byId(state, args[args.length - 1]); + if (found && process.env.PROPR_FAKE_REPLACE_ON_STOP === found[0]) { + state[found[0]] = { id: 'e'.repeat(64), labels: { 'propr.stack': 'foreign', 'propr.service': found[1].labels['propr.service'] }, binds: [], running: false, sentinel: 'replacement-untouched' }; + } else if (found) found[1].running = false; + save(state); process.exit(found ? 0 : 1); +} +if (args[0] === 'start') { const state = load(); const found = byId(state, args[args.length - 1]); if (!found) process.exit(1); found[1].running = true; save(state); process.exit(0); } +if (args[0] === 'rm') { const state = load(); delete state[args[args.length - 1]]; save(state); process.exit(0); } +process.exit(0); +PROPR_FAKE_NODE +`, { mode: 0o700 }); + await chmod(executable, 0o700); + process.env.PATH = `${directory}:${oldPath ?? ''}`; + process.env.PROPR_FAKE_STATE = statePath; + process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK = '1'; + const rootDir = join(directory, 'app-data', 'desktop', 'local-stack'); + await mkdir(join(rootDir, 'data'), { recursive: true, mode: 0o700 }); + await mkdir(join(rootDir, 'logs'), { mode: 0o700 }); + await mkdir(join(rootDir, 'repos'), { mode: 0o700 }); + await writeFile(join(rootDir, '.env'), 'DOCS_ENABLED=true\n', { mode: 0o600 }); + const manifestPath = fileURLToPath(new URL('../docker/launcher/manifest.json', import.meta.url)); + const cfg = resolveHostConfig({ rootDir, env: {}, manifestPath }); + try { + await startStackAsync(cfg, { ui: true, docs: true, tunnel: false }); + assert.equal((await getStackStatusAsync(cfg)).running, true, 'setup then reopen status'); + assert.equal(await isLifecycleStackRunningAsync(cfg), true); + + assert.deepEqual(await stopLifecycleStackAsync(cfg), { failed: [] }); + assert.equal((await getStackStatusAsync(cfg)).running, false); + assert.equal(await isLifecycleStackRunningAsync(cfg), false); + assert.deepEqual(await recoverStackAsync(cfg, { ui: true, docs: true, tunnel: false }), { recovered: true }); + assert.equal((await getStackStatusAsync(cfg)).running, true); + + const partial = JSON.parse(await readFile(statePath, 'utf8')); + partial['propr-worker'].running = false; + partial['propr-ui'].running = false; + partial['propr-docs'].running = false; + await writeFile(statePath, JSON.stringify(partial)); + await recoverStackAsync(cfg, { ui: true, docs: true, tunnel: false }); + const recovered = JSON.parse(await readFile(statePath, 'utf8')); + assert.equal(recovered['propr-worker'].running, true); + assert.equal(recovered['propr-ui'].running, true); + assert.equal(recovered['propr-docs'].running, true); + + await stopLifecycleStackAsync(cfg); + await recoverStackAsync(cfg, { ui: true, docs: true, tunnel: false }); + assert.equal((await getStackStatusAsync(cfg)).running, true, 'restart sequence'); + + await stopLifecycleStackAsync(cfg); + const foreign = JSON.parse(await readFile(statePath, 'utf8')); + foreign['propr-api'] = { id: 'f'.repeat(64), labels: { 'propr.stack': 'foreign', 'propr.service': 'api' }, binds: [], running: false, sentinel: 'untouched' }; + await writeFile(statePath, JSON.stringify(foreign)); + await assert.rejects(isLifecycleStackRunningAsync(cfg), /left untouched/); + await assert.rejects(recoverStackAsync(cfg, { ui: true, docs: true, tunnel: false }), /left untouched/); + assert.equal(JSON.parse(await readFile(statePath, 'utf8'))['propr-api'].sentinel, 'untouched'); + + const mismatched = JSON.parse(await readFile(statePath, 'utf8')); + mismatched['propr-api'] = { ...recovered['propr-api'], running: false, binds: ['/foreign:/usr/src/app/.env:ro'], sentinel: 'mismatch' }; + await writeFile(statePath, JSON.stringify(mismatched)); + await assert.rejects(recoverStackAsync(cfg, { ui: true, docs: true, tunnel: false }), /fixed-root binds/); + assert.equal(JSON.parse(await readFile(statePath, 'utf8'))['propr-api'].sentinel, 'mismatch'); + + await writeFile(statePath, JSON.stringify(recovered)); + process.env.PROPR_FAKE_REPLACE_ON_STOP = 'propr-worker'; + const replacedStop = await stopLifecycleStackAsync(cfg); + assert.ok(replacedStop.failed.includes('propr-worker')); + assert.equal(JSON.parse(await readFile(statePath, 'utf8'))['propr-worker'].sentinel, 'replacement-untouched'); + } finally { + process.env.PATH = oldPath; + if (oldState === undefined) delete process.env.PROPR_FAKE_STATE; else process.env.PROPR_FAKE_STATE = oldState; + if (oldReplaceOnStop === undefined) delete process.env.PROPR_FAKE_REPLACE_ON_STOP; else process.env.PROPR_FAKE_REPLACE_ON_STOP = oldReplaceOnStop; + if (oldSkip === undefined) delete process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK; else process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK = oldSkip; + await rm(directory, { recursive: true, force: true }); + } +}); diff --git a/test/orchestratorRollbackAbsenceProof.test.mjs b/test/orchestratorRollbackAbsenceProof.test.mjs new file mode 100644 index 000000000..61fd3082f --- /dev/null +++ b/test/orchestratorRollbackAbsenceProof.test.mjs @@ -0,0 +1,148 @@ +import assert from 'node:assert/strict'; +import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'; +import { existsSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join } from 'node:path'; +import test from 'node:test'; +import { fileURLToPath } from 'node:url'; +import { resolveConfig, startStackAsync } from '../docker/launcher/orchestrator.mjs'; + +const eventually = async (operation, timeoutMs = 10_000) => { + const deadline = Date.now() + timeoutMs; + while (Date.now() < deadline) { + try { return await operation(); } catch { await new Promise(resolve => setTimeout(resolve, 20)); } + } + return operation(); +}; + +test('rollback proves exact-name absence and fails closed for unusable Docker proofs', { concurrency: false, timeout: 120_000 }, async () => { + const directory = await mkdtemp(join(tmpdir(), 'propr-rollback-proof-')); + const executable = join(directory, 'docker'); + const stateDir = join(directory, 'state'); + const marker = join(directory, 'created.marker'); + const previous = { + path: process.env.PATH, + state: process.env.PROPR_FAKE_STATE_DIR, + marker: process.env.PROPR_FAKE_MARKER, + mode: process.env.PROPR_FAKE_PROOF_MODE, + skip: process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK, + }; + await mkdir(stateDir); + await writeFile(executable, `#!/bin/sh +exec /usr/local/bin/node - -- "$@" <<'PROPR_FAKE_NODE' +const fs = require('node:fs'); const path = require('node:path'); +const args = process.argv.slice(2); if (args[0] === '--') args.shift(); +const dir = process.env.PROPR_FAKE_STATE_DIR; const mode = process.env.PROPR_FAKE_PROOF_MODE; +const marker = process.env.PROPR_FAKE_MARKER; const target = 'propr-redis'; +const file = name => path.join(dir, encodeURIComponent(name) + '.json'); +const exists = name => fs.existsSync(file(name)); +const read = name => JSON.parse(fs.readFileSync(file(name), 'utf8')); +const remove = name => { try { fs.unlinkSync(file(name)); } catch {} }; +const option = key => { const index = args.indexOf(key); return index < 0 ? undefined : args[index + 1]; }; +if (args[0] === 'images') { fs.writeSync(1, 'image-id\\n'); process.exit(0); } +if (args[0] === 'image' && args[1] === 'inspect') { fs.writeSync(1, '[]\\n'); process.exit(0); } +if (args[0] === 'network') process.exit(0); +if (args[0] === 'ps') { + const match = args.join(' ').match(/name=\\^\\/?([^$]+)\\$/); + if (!match) process.exit(0); + const name = match[1].replace(/\\\\\./g, '.'); + const proof = args.includes('{{json .Names}}'); + if (!proof) { if (exists(name)) fs.writeSync(1, name + '\\n'); process.exit(0); } + if (name !== target || !exists(name)) process.exit(0); + if (mode === 'daemon-failure') { fs.writeSync(2, 'RAW_DOCKER_DAEMON_SECRET\\n'); process.exit(42); } + if (mode === 'permission-failure') { fs.writeSync(2, 'RAW_DOCKER_PERMISSION_SECRET\\n'); process.exit(13); } + if (mode === 'query-timeout') { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 30_000); process.exit(0); } + if (mode === 'query-signal') { process.kill(process.pid, 'SIGTERM'); } + if (mode === 'query-malformed') { fs.writeSync(1, 'RAW_DOCKER_MALFORMED_SECRET\\n'); process.exit(0); } + if (mode === 'query-truncated') { fs.writeSync(1, 'x'.repeat(20_000)); process.exit(0); } + if (mode === 'query-ambiguous') { fs.writeSync(1, JSON.stringify('not-' + name) + '\\n'); process.exit(0); } + if (mode === 'query-duplicate') { const row = JSON.stringify(name) + '\\n'; fs.writeSync(1, row + row); process.exit(0); } + fs.writeSync(1, JSON.stringify(name) + '\\n'); process.exit(0); +} +if (args[0] === 'run') { + const name = option('--name'); const labels = {}; + for (let i = 0; i < args.length; i += 1) if (args[i] === '--label') { const [key, ...rest] = args[++i].split('='); labels[key] = rest.join('='); } + if (args.includes('--rm')) process.exit(0); + fs.writeFileSync(file(name), JSON.stringify(labels)); fs.writeFileSync(marker, name); + Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 30_000); process.exit(0); +} +if (args[0] === 'inspect') { + const name = args[args.length - 1]; + if (!exists(name)) process.exit(1); + if (name === target && mode === 'exact-not-found') { remove(name); process.exit(1); } + if (name === target && mode === 'generic-inspect-present') { fs.writeSync(2, 'RAW_DOCKER_INSPECT_SECRET\\n'); process.exit(23); } + if (name === target && ['daemon-failure','permission-failure','query-timeout','query-signal','query-malformed','query-truncated','query-ambiguous','query-duplicate'].includes(mode)) process.exit(23); + fs.writeSync(1, JSON.stringify(read(name)) + '\\n'); process.exit(0); +} +if (args[0] === 'stop') { + const name = args[args.length - 1]; + if (mode === 'disappears-between-checks') { remove(name); process.exit(44); } + process.exit(0); +} +if (args[0] === 'rm') { remove(args[args.length - 1]); process.exit(0); } +process.exit(0); +PROPR_FAKE_NODE +`, { mode: 0o700 }); + await chmod(executable, 0o700); + process.env.PATH = `${directory}:${previous.path ?? ''}`; + process.env.PROPR_FAKE_STATE_DIR = stateDir; + process.env.PROPR_FAKE_MARKER = marker; + process.env.PROPR_SKIP_REMOTE_IMAGE_CHECK = '1'; + + const root = join(directory, 'app-data', 'desktop', 'local-stack'); + await mkdir(join(root, 'data'), { recursive: true, mode: 0o700 }); + await mkdir(join(root, 'logs'), { mode: 0o700 }); + await mkdir(join(root, 'repos'), { mode: 0o700 }); + await writeFile(join(root, '.env'), '', { mode: 0o600 }); + const cfg = resolveConfig({}, { + manifestPath: fileURLToPath(new URL('../docker/launcher/manifest.json', import.meta.url)), + envFileLocal: join(root, '.env'), envFileHost: join(root, '.env'), + hostData: join(root, 'data'), hostLogs: join(root, 'logs'), hostRepos: join(root, 'repos'), + }); + + const run = async mode => { + await rm(stateDir, { recursive: true, force: true }); await mkdir(stateDir); + await writeFile(marker, ''); process.env.PROPR_FAKE_PROOF_MODE = mode; + const logs = []; const controller = new AbortController(); + const operation = startStackAsync(cfg, { + ui: false, docs: false, tunnel: false, signal: controller.signal, + onLog: value => logs.push(value), + }); + const observed = operation.then(() => null, error => error); + await eventually(async () => assert.equal(await readFile(marker, 'utf8'), 'propr-redis')); + controller.abort(); + return { error: await observed, logs, remains: existsSync(join(stateDir, 'propr-redis.json')) }; + }; + + try { + for (const mode of ['exact-not-found', 'disappears-between-checks']) { + const result = await run(mode); + assert.ok(result.error, `${mode} must preserve the original cancellation`); + assert.notEqual(result.error?.code, 'PROPR_SETUP_CLEANUP_INCOMPLETE', `${mode} conclusively proves absence`); + assert.equal(result.remains, false, `${mode} leaves no run-owned container`); + assert.doesNotMatch(JSON.stringify([result.error, result.logs]), /RAW_DOCKER_/); + } + + for (const mode of [ + 'generic-inspect-present', 'daemon-failure', 'permission-failure', + 'query-timeout', 'query-signal', 'query-malformed', 'query-truncated', + 'query-ambiguous', 'query-duplicate', + ]) { + const result = await run(mode); + assert.equal(result.error?.code, 'PROPR_SETUP_CLEANUP_INCOMPLETE', `${mode} must fail closed`); + assert.equal(result.remains, true, `${mode} must not mutate without proved ownership`); + assert.match(String(result.error?.message), /cleanup is incomplete/); + assert.doesNotMatch(JSON.stringify([result.error, result.logs]), /RAW_DOCKER_/); + } + + const laterRetry = await run('exact-not-found'); + assert.notEqual(laterRetry.error?.code, 'PROPR_SETUP_CLEANUP_INCOMPLETE'); + assert.equal(laterRetry.remains, false, 'a later successful proof retry settles as cancelled'); + } finally { + process.env.PATH = previous.path; + for (const [name, value] of [['PROPR_FAKE_STATE_DIR', previous.state], ['PROPR_FAKE_MARKER', previous.marker], ['PROPR_FAKE_PROOF_MODE', previous.mode], ['PROPR_SKIP_REMOTE_IMAGE_CHECK', previous.skip]]) { + if (value === undefined) delete process.env[name]; else process.env[name] = value; + } + await rm(directory, { recursive: true, force: true }); + } +});