nntrivi2001
e94038481e
- File Explorer (Files in the sidebar, /files; also from a workspace's Files tab, portalled so no panel clips it), laid out like GNOME Files: places (Home, workspaces, Trash), Back/Forward/Up, path bar, search, icon grid with image thumbnails or list, labelled New/Upload, selection action bar, hidden files behind Ctrl+H, right-click menus and the usual keys. Make, rename, move, copy (within a workspace, between workspaces, home ↔ workspace), delete into a per-account trash restorable for 7 days, streamed upload of files and whole folders (≤ 500 MB a batch, Replace / Keep both / Skip on a taken name), download a file or a zip of anything. server/lib/file-explorer.js, /api/lanes/:id/fs/*, /api/homes/:who/fs/*. - The user's home: every dot entry at its top stays hidden and refused (also via a symlink, download, zip or as a copy source); an admin may view other users' homes read-only, audited. - write-as learns move/copy (re-run `sudo agenthub server install-system`). - Hardening: a write to a workspace re-checks its owner by the live role; S3 keeps its server.conf if the file stops reading and a tmux call never falls back to the host's server; the AI Proxy gateway marks what it relays and the dashboard refuses it; a NUL in a pane's argv/env is refused. - OpenAPI for the new routes (server/openapi-extra/files.js); docs (API, SERVER-MODE, CLAUDE.md) updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
85 lines
2.7 KiB
JavaScript
85 lines
2.7 KiB
JavaScript
/**
|
|
* @file S3 fails closed: a server that started with S3 keeps its
|
|
* server.conf when the file later fails to read (it never silently becomes
|
|
* "no S3", which would run a member's pane as the host account), and a tmux
|
|
* call whose account cannot be told under S3 fails instead of going to the
|
|
* host's own tmux server.
|
|
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
|
*/
|
|
|
|
const { describe, it, after } = require("node:test");
|
|
const assert = require("node:assert/strict");
|
|
const fs = require("node:fs");
|
|
const os = require("node:os");
|
|
const path = require("node:path");
|
|
|
|
const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "s3-fail-closed-"));
|
|
const CONF = path.join(TMP, "server.conf");
|
|
process.env.AGENTHUB_SERVER_CONF = CONF;
|
|
process.env.DASHBOARD_DB_PATH = path.join(TMP, "t.db");
|
|
|
|
const linux = require("../lib/linux-accounts");
|
|
const tmux = require("../lib/tmux");
|
|
|
|
const writeConf = () =>
|
|
fs.writeFileSync(CONF, `HOST_USER=h\nHOST_UID=1000\nUSERS_ROOT=${path.join(TMP, "users")}\n`);
|
|
const later = (ms) => {
|
|
const real = Date.now;
|
|
const t = real() + ms;
|
|
Date.now = () => t;
|
|
return () => (Date.now = real);
|
|
};
|
|
|
|
after(() => {
|
|
delete process.env.AGENTHUB_MODE;
|
|
linux.__resetConfCache();
|
|
tmux.__reset();
|
|
});
|
|
|
|
describe("S3 fails closed", () => {
|
|
it("keeps the last good server.conf in server mode when the file stops reading", () => {
|
|
process.env.AGENTHUB_MODE = "server";
|
|
linux.__resetConfCache();
|
|
writeConf();
|
|
assert.equal(linux.s3Enabled(), true);
|
|
fs.rmSync(CONF);
|
|
const restore = later(10_000); // past the 5 s cache
|
|
try {
|
|
assert.equal(linux.s3Enabled(), true, "still S3: never fall back to the host");
|
|
assert.equal(linux.serverConf().usersRoot, path.join(TMP, "users"));
|
|
} finally {
|
|
restore();
|
|
}
|
|
});
|
|
|
|
it("outside server mode a missing file is simply no S3", () => {
|
|
delete process.env.AGENTHUB_MODE;
|
|
linux.__resetConfCache();
|
|
writeConf();
|
|
linux.serverConf();
|
|
fs.rmSync(CONF);
|
|
const restore = later(10_000);
|
|
try {
|
|
assert.equal(linux.serverConf(), null);
|
|
} finally {
|
|
restore();
|
|
}
|
|
});
|
|
|
|
it("a tmux call whose account cannot be told under S3 fails, never reaching the host's tmux", () => {
|
|
process.env.AGENTHUB_MODE = "server";
|
|
linux.__resetConfCache();
|
|
writeConf();
|
|
const calls = [];
|
|
tmux.__setExecImpl((args) => {
|
|
calls.push(args);
|
|
return "";
|
|
});
|
|
tmux.__setAccountImpl(() => {
|
|
throw Object.assign(new Error("database is locked"), { code: "SQLITE_BUSY" });
|
|
});
|
|
assert.throws(() => tmux.sendText("agenthub-lane-7", "ls"), { code: "SQLITE_BUSY" });
|
|
assert.deepEqual(calls, [], "nothing ran on the host's tmux server");
|
|
});
|
|
});
|