| @@ -1,6 +1,7 @@ |
| 1 | import { Effect, Schema } from "effect"; | 1 | import { randomUUID } from "node:crypto"; |
| 2 | import * as fs from "node:fs"; | 2 | import * as fs from "node:fs"; |
| 3 | import * as path from "node:path"; | 3 | import * as path from "node:path"; |
| | 4 | import { Deferred, Effect, Exit, Schema } from "effect"; |
| 4 | | 5 | |
| 5 | import { | 6 | import { |
| 6 | definePlugin, | 7 | definePlugin, |
| @@ -11,10 +12,11 @@ import { · 4 unmodified lines |
| 11 | } from "@executor-js/sdk"; | 12 | } from "@executor-js/sdk"; |
| 12 | | 13 | |
| 13 | // --------------------------------------------------------------------------- | 14 | // --------------------------------------------------------------------------- |
| 14 | // XDG data dir resolution | 15 | // Auth file location |
| 15 | // --------------------------------------------------------------------------- | 16 | // --------------------------------------------------------------------------- |
| 16 | | 17 | |
| 17 | const APP_NAME = "executor"; | 18 | const APP_NAME = "executor"; |
| | 19 | const AUTH_FILE_NAME = "auth.json"; |
| 18 | | 20 | |
| 19 | export const xdgDataHome = (): string => { | 21 | export const xdgDataHome = (): string => { |
| 20 | if (process.env.XDG_DATA_HOME?.trim()) return process.env.XDG_DATA_HOME.trim(); | 22 | if (process.env.XDG_DATA_HOME?.trim()) return process.env.XDG_DATA_HOME.trim(); |
| @@ -28,9 +30,34 @@ export const xdgDataHome = (): string => { · 7 unmodified lines |
| 28 | return path.join(process.env.HOME || "~", ".local", "share"); | 30 | return path.join(process.env.HOME || "~", ".local", "share"); |
| 29 | }; | 31 | }; |
| 30 | | 32 | |
| 31 | const authDir = (overrideDir?: string): string => overrideDir ?? path.join(xdgDataHome(), APP_NAME); | 33 | interface AuthLocation { |
| | 34 | readonly filePath: string; |
| | 35 | readonly legacyFilePath: string | null; |
| | 36 | } |
| | 37 | |
| | 38 | const legacyAuthFilePath = (): string => path.join(xdgDataHome(), APP_NAME, AUTH_FILE_NAME); |
| | 39 | |
| | 40 | const resolveAuthLocation = (config: FileSecretsPluginConfig | undefined): AuthLocation => { |
| | 41 | if (config?.directory !== undefined) { |
| | 42 | return { |
| | 43 | filePath: path.join(config.directory, AUTH_FILE_NAME), |
| | 44 | legacyFilePath: null, |
| | 45 | }; |
| | 46 | } |
| 32 | | 47 | |
| 33 | const authFilePath = (overrideDir?: string): string => path.join(authDir(overrideDir), "auth.json"); | 48 | const dataDir = process.env.EXECUTOR_DATA_DIR?.trim(); |
| | 49 | if (dataDir) { |
| | 50 | return { |
| | 51 | filePath: path.join(dataDir, AUTH_FILE_NAME), |
| | 52 | legacyFilePath: legacyAuthFilePath(), |
| | 53 | }; |
| | 54 | } |
| | 55 | |
| | 56 | return { |
| | 57 | filePath: legacyAuthFilePath(), |
| | 58 | legacyFilePath: null, |
| | 59 | }; |
| | 60 | }; |
| 34 | | 61 | |
| 35 | // --------------------------------------------------------------------------- | 62 | // --------------------------------------------------------------------------- |
| 36 | // Schema for the auth file | 63 | // Schema for the auth file |
| @@ -45,13 +72,29 @@ const authFilePath = (overrideDir?: string): string => path.join(authDir(overrid · 8 unmodified lines |
| 45 | const FlatAuthFile = Schema.Record(Schema.String, Schema.String); | 72 | const FlatAuthFile = Schema.Record(Schema.String, Schema.String); |
| 46 | const decodeFlatAuthFile = Schema.decodeUnknownEffect(Schema.fromJsonString(FlatAuthFile)); | 73 | const decodeFlatAuthFile = Schema.decodeUnknownEffect(Schema.fromJsonString(FlatAuthFile)); |
| 47 | | 74 | |
| | 75 | class AuthFileDecodeError extends Schema.TaggedErrorClass<AuthFileDecodeError>()( |
| | 76 | "AuthFileDecodeError", |
| | 77 | { |
| | 78 | filePath: Schema.String, |
| | 79 | cause: Schema.Defect, |
| | 80 | }, |
| | 81 | { |
| | 82 | description: |
| | 83 | "The auth file was readable but its contents were not a valid flat credential map. The caller must surface the failure or explicitly treat malformed legacy data as non-migratable.", |
| | 84 | }, |
| | 85 | ) { |
| | 86 | override get message(): string { |
| | 87 | return `Failed to parse auth file: ${this.filePath}`; |
| | 88 | } |
| | 89 | } |
| | 90 | |
| 48 | // --------------------------------------------------------------------------- | 91 | // --------------------------------------------------------------------------- |
| 49 | // File I/O with restricted permissions | 92 | // File I/O with restricted permissions |
| 50 | // | 93 | // |
| 51 | // These helpers keep real I/O and decode failures in the Effect error | 94 | // These helpers keep real I/O and decode failures distinct internally, then |
| 52 | // channel as `StorageError`. Missing files are still treated as an empty | 95 | // project both to `StorageError` at the provider boundary. Missing files are |
| 53 | // auth file, but malformed JSON, schema decode failures, and permission | 96 | // still treated as an empty auth file; malformed content and permission errors |
| 54 | // errors no longer collapse into "empty file". | 97 | // do not collapse into "empty file" during ordinary provider reads. |
| 55 | // --------------------------------------------------------------------------- | 98 | // --------------------------------------------------------------------------- |
| 56 | | 99 | |
| 57 | const isFileNotFoundCause = (cause: unknown): cause is NodeJS.ErrnoException => | 100 | const isFileNotFoundCause = (cause: unknown): cause is NodeJS.ErrnoException => |
| @@ -62,7 +105,9 @@ const toStorageError = · 4 unmodified lines |
| 62 | (cause: unknown): StorageError => | 105 | (cause: unknown): StorageError => |
| 63 | new StorageError({ message, cause }); | 106 | new StorageError({ message, cause }); |
| 64 | | 107 | |
| 65 | const readAll = (filePath: string): Effect.Effect<Record<string, string>, StorageError> => { | 108 | const readAuthFile = ( |
| | 109 | filePath: string, |
| | 110 | ): Effect.Effect<Record<string, string>, StorageError | AuthFileDecodeError> => { |
| 66 | if (!fs.existsSync(filePath)) return Effect.succeed({}); | 111 | if (!fs.existsSync(filePath)) return Effect.succeed({}); |
| 67 | return Effect.try({ | 112 | return Effect.try({ |
| 68 | try: () => fs.readFileSync(filePath, "utf-8"), | 113 | try: () => fs.readFileSync(filePath, "utf-8"), |
| @@ -76,18 +121,25 @@ const readAll = (filePath: string): Effect.Effect<Record<string, string>, Storag · 7 unmodified lines |
| 76 | raw === "" | 121 | raw === "" |
| 77 | ? Effect.succeed<Record<string, string>>({}) | 122 | ? Effect.succeed<Record<string, string>>({}) |
| 78 | : decodeFlatAuthFile(raw).pipe( | 123 | : decodeFlatAuthFile(raw).pipe( |
| 79 | Effect.mapError(toStorageError("Failed to parse auth file")), | 124 | Effect.mapError((cause) => new AuthFileDecodeError({ filePath, cause })), |
| 80 | ), | 125 | ), |
| 81 | ), | 126 | ), |
| 82 | ); | 127 | ); |
| 83 | }; | 128 | }; |
| 84 | | 129 | |
| | 130 | const readAll = (filePath: string): Effect.Effect<Record<string, string>, StorageError> => |
| | 131 | readAuthFile(filePath).pipe( |
| | 132 | Effect.catchTag("AuthFileDecodeError", (cause) => |
| | 133 | Effect.fail(new StorageError({ message: cause.message, cause })), |
| | 134 | ), |
| | 135 | ); |
| | 136 | |
| 85 | const writeAll = ( | 137 | const writeAll = ( |
| 86 | filePath: string, | 138 | filePath: string, |
| 87 | secrets: Record<string, string>, | 139 | secrets: Record<string, string>, |
| 88 | ): Effect.Effect<void, StorageError> => { | 140 | ): Effect.Effect<void, StorageError> => { |
| 89 | const dir = path.dirname(filePath); | 141 | const dir = path.dirname(filePath); |
| 90 | const tmp = `${filePath}.tmp`; | 142 | const tmp = `${filePath}.${process.pid}.${randomUUID()}.tmp`; |
| 91 | return Effect.gen(function* () { | 143 | return Effect.gen(function* () { |
| 92 | if (!fs.existsSync(dir)) { | 144 | if (!fs.existsSync(dir)) { |
| 93 | yield* Effect.try({ | 145 | yield* Effect.try({ |
| @@ -96,7 +148,12 @@ const writeAll = ( · 2 unmodified lines |
| 96 | }); | 148 | }); |
| 97 | } | 149 | } |
| 98 | yield* Effect.try({ | 150 | yield* Effect.try({ |
| 99 | try: () => fs.writeFileSync(tmp, JSON.stringify(secrets, null, 2), { mode: 0o600 }), | 151 | try: () => { |
| | 152 | fs.writeFileSync(tmp, JSON.stringify(secrets, null, 2), { mode: 0o600 }); |
| | 153 | // `mode` only applies when the file is created; chmod afterwards covers |
| | 154 | // the case where a temporary file with broader permissions already exists. |
| | 155 | fs.chmodSync(tmp, 0o600); |
| | 156 | }, |
| 100 | catch: toStorageError("Failed to write temporary auth file"), | 157 | catch: toStorageError("Failed to write temporary auth file"), |
| 101 | }); | 158 | }); |
| 102 | yield* Effect.try({ | 159 | yield* Effect.try({ |
| @@ -106,12 +163,28 @@ const writeAll = ( · 3 unmodified lines |
| 106 | }); | 163 | }); |
| 107 | }; | 164 | }; |
| 108 | | 165 | |
| | 166 | const migrateLegacyAuthFile = ({ |
| | 167 | filePath, |
| | 168 | legacyFilePath, |
| | 169 | }: AuthLocation): Effect.Effect<void, StorageError> => { |
| | 170 | if (legacyFilePath === null || fs.existsSync(filePath) || !fs.existsSync(legacyFilePath)) { |
| | 171 | return Effect.void; |
| | 172 | } |
| | 173 | |
| | 174 | return readAuthFile(legacyFilePath).pipe( |
| | 175 | Effect.flatMap((secrets) => writeAll(filePath, secrets)), |
| | 176 | // Malformed legacy contents are deliberately skipped. Genuine read I/O |
| | 177 | // failures stay visible and leave migration eligible for a later retry. |
| | 178 | Effect.catchTag("AuthFileDecodeError", () => Effect.void), |
| | 179 | ); |
| | 180 | }; |
| | 181 | |
| 109 | // --------------------------------------------------------------------------- | 182 | // --------------------------------------------------------------------------- |
| 110 | // Plugin config | 183 | // Plugin config |
| 111 | // --------------------------------------------------------------------------- | 184 | // --------------------------------------------------------------------------- |
| 112 | | 185 | |
| 113 | export interface FileSecretsPluginConfig { | 186 | export interface FileSecretsPluginConfig { |
| 114 | /** Override the directory for auth.json (default: XDG data dir) */ | 187 | /** Override the directory for auth.json (default: EXECUTOR_DATA_DIR, then XDG data dir) */ |
| 115 | readonly directory?: string; | 188 | readonly directory?: string; |
| 116 | } | 189 | } |
| 117 | | 190 | |
| @@ -119,8 +192,8 @@ export interface FileSecretsPluginConfig { · 1 unmodified line |
| 119 | // Plugin extension — public API on executor.fileSecrets | 192 | // Plugin extension — public API on executor.fileSecrets |
| 120 | // --------------------------------------------------------------------------- | 193 | // --------------------------------------------------------------------------- |
| 121 | | 194 | |
| 122 | const makeFileSecretsExtension = (options: FileSecretsPluginConfig | undefined) => ({ | 195 | const makeFileSecretsExtension = (filePath: string) => ({ |
| 123 | filePath: resolveFilePath(options), | 196 | filePath, |
| 124 | }); | 197 | }); |
| 125 | | 198 | |
| 126 | export type FileSecretsExtension = ReturnType<typeof makeFileSecretsExtension>; | 199 | export type FileSecretsExtension = ReturnType<typeof makeFileSecretsExtension>; |
| @@ -135,54 +208,94 @@ export type FileSecretsExtension = ReturnType<typeof makeFileSecretsExtension>; · 8 unmodified lines |
| 135 | | 208 | |
| 136 | const FILE_PROVIDER_KEY = ProviderKey.make("file"); | 209 | const FILE_PROVIDER_KEY = ProviderKey.make("file"); |
| 137 | | 210 | |
| 138 | const makeFileProvider = (filePath: string): CredentialProvider => ({ | 211 | const makeFileProvider = (location: AuthLocation): CredentialProvider => { |
| 139 | key: FILE_PROVIDER_KEY, | 212 | let migrationComplete = false; |
| 140 | writable: true, | 213 | let migrationInFlight: Deferred.Deferred<void, StorageError> | null = null; |
| 141 | | 214 | const ensureMigration = Effect.suspend(() => { |
| 142 | get: (id: ProviderItemId) => readAll(filePath).pipe(Effect.map((data) => data[id] ?? null)), | 215 | if (migrationComplete) return Effect.void; |
| 143 | | 216 | if (migrationInFlight !== null) return Deferred.await(migrationInFlight); |
| 144 | has: (id: ProviderItemId) => readAll(filePath).pipe(Effect.map((data) => id in data)), | 217 | |
| 145 | | 218 | // Installing the latch inside Effect.suspend is synchronous, so a peer |
| 146 | set: (id: ProviderItemId, value: string) => | 219 | // fiber can only observe either no attempt or this fully initialized one. |
| 147 | Effect.gen(function* () { | 220 | const latch = Deferred.makeUnsafe<void, StorageError>(); |
| 148 | const data = yield* readAll(filePath); | 221 | migrationInFlight = latch; |
| 149 | data[id] = value; | 222 | return migrateLegacyAuthFile(location).pipe( |
| 150 | yield* writeAll(filePath, data); | 223 | Effect.onExit((exit) => |
| 151 | }), | 224 | Effect.gen(function* () { |
| 152 | | 225 | if (Exit.isSuccess(exit)) migrationComplete = true; |
| 153 | delete: (id: ProviderItemId) => | 226 | yield* Deferred.done(latch, exit); |
| 154 | Effect.gen(function* () { | 227 | migrationInFlight = null; |
| 155 | const data = yield* readAll(filePath); | 228 | }), |
| 156 | if (id in data) { | 229 | ), |
| 157 | delete data[id]; | 230 | ); |
| 158 | yield* writeAll(filePath, data); | 231 | }); |
| 159 | } | 232 | |
| 160 | }), | 233 | return { |
| 161 | | 234 | key: FILE_PROVIDER_KEY, |
| 162 | list: () => | 235 | writable: true, |
| 163 | readAll(filePath).pipe( | 236 | |
| 164 | Effect.map((data) => Object.keys(data).map((k) => ({ id: ProviderItemId.make(k), name: k }))), | 237 | get: (id: ProviderItemId) => |
| 165 | ), | 238 | ensureMigration.pipe( |
| 166 | }); | 239 | Effect.andThen(Effect.suspend(() => readAll(location.filePath))), |
| | 240 | Effect.map((data) => data[id] ?? null), |
| | 241 | ), |
| | 242 | |
| | 243 | has: (id: ProviderItemId) => |
| | 244 | ensureMigration.pipe( |
| | 245 | Effect.andThen(Effect.suspend(() => readAll(location.filePath))), |
| | 246 | Effect.map((data) => id in data), |
| | 247 | ), |
| | 248 | |
| | 249 | set: (id: ProviderItemId, value: string) => |
| | 250 | ensureMigration.pipe( |
| | 251 | Effect.andThen( |
| | 252 | Effect.gen(function* () { |
| | 253 | const data = yield* readAll(location.filePath); |
| | 254 | data[id] = value; |
| | 255 | yield* writeAll(location.filePath, data); |
| | 256 | }), |
| | 257 | ), |
| | 258 | ), |
| | 259 | |
| | 260 | delete: (id: ProviderItemId) => |
| | 261 | ensureMigration.pipe( |
| | 262 | Effect.andThen( |
| | 263 | Effect.gen(function* () { |
| | 264 | const data = yield* readAll(location.filePath); |
| | 265 | if (id in data) { |
| | 266 | delete data[id]; |
| | 267 | yield* writeAll(location.filePath, data); |
| | 268 | } |
| | 269 | }), |
| | 270 | ), |
| | 271 | ), |
| | 272 | |
| | 273 | list: () => |
| | 274 | ensureMigration.pipe( |
| | 275 | Effect.andThen(Effect.suspend(() => readAll(location.filePath))), |
| | 276 | Effect.map((data) => |
| | 277 | Object.keys(data).map((k) => ({ id: ProviderItemId.make(k), name: k })), |
| | 278 | ), |
| | 279 | ), |
| | 280 | }; |
| | 281 | }; |
| 167 | | 282 | |
| 168 | // --------------------------------------------------------------------------- | 283 | // --------------------------------------------------------------------------- |
| 169 | // Plugin definition | 284 | // Plugin definition |
| 170 | // | 285 | // |
| 171 | // Compute the file path identically in `extension` (for `filePath`) and | 286 | // Resolve the path once when the configured plugin is constructed. The provider |
| 172 | // `credentialProviders` (for the provider's read/write). Both are called once | 287 | // performs the one-time migration before its first read or write. |
| 173 | // per createExecutor. | | |
| 174 | // --------------------------------------------------------------------------- | 288 | // --------------------------------------------------------------------------- |
| 175 | | 289 | |
| 176 | const resolveFilePath = (config: FileSecretsPluginConfig | undefined): string => | 290 | export const fileSecretsPlugin = definePlugin((options?: FileSecretsPluginConfig) => { |
| 177 | authFilePath(config?.directory); | 291 | const location = resolveAuthLocation(options); |
| 178 | | 292 | |
| 179 | export const fileSecretsPlugin = definePlugin((options?: FileSecretsPluginConfig) => ({ | 293 | return { |
| 180 | id: "fileSecrets" as const, | 294 | id: "fileSecrets" as const, |
| 181 | storage: () => ({}), | 295 | storage: () => ({}), |
| 182 | | 296 | |
| 183 | extension: () => makeFileSecretsExtension(options), | 297 | extension: () => makeFileSecretsExtension(location.filePath), |
| 184 | | 298 | |
| 185 | credentialProviders: (): readonly CredentialProvider[] => [ | 299 | credentialProviders: (): readonly CredentialProvider[] => [makeFileProvider(location)], |
| 186 | makeFileProvider(resolveFilePath(options)), | 300 | }; |
| 187 | ], | 301 | }); |
| 188 | })); | | |