mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-13 05:50:45 +08:00
oliver
df97c5e042
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw "sign-in failed / add API key" on DSH Desktop because the remote.mux opens anonymously at boot and every early call was rejected terminally. - gateway: anonymous workspace/follow reaches dsh-acl's empty baseline; anonymous streams are parked until the carrier aborts instead of failing; anonymous workspace/initializeDefault answers "nothing created" - request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket or bridge (sync + async variants used by all callers) - dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup instead of 403, so the Desktop welcome read no longer fails - desktop-bootstrap: key/account projection is best-effort per reference - client: emit connection/reset after login so boot-time caches (settings describe mirror -> Settings > Models) re-read under the real principal - sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min); bridge expiry slides with its session; MemoryStore persisted to sessions.json (bearer hash only, userData AES-256-GCM sealed) - README: session lifetime/persistence and DSH compatibility notes Also includes previously uncommitted uds-auth 0.3.x work in this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
51 lines
1.7 KiB
JavaScript
51 lines
1.7 KiB
JavaScript
/**
|
|
* SEC-21: atomic JSON replace — write temp in same dir, then rename.
|
|
*/
|
|
import { open, rename, mkdir, unlink } from 'node:fs/promises'
|
|
import { dirname, join } from 'node:path'
|
|
import { randomBytes } from 'node:crypto'
|
|
|
|
/**
|
|
* @param {string} filePath
|
|
* @param {string|Buffer} data
|
|
* @param {{ mode?: number }} [opts]
|
|
*/
|
|
export async function atomicWriteFile(filePath, data, opts = {}) {
|
|
const dir = dirname(filePath)
|
|
await mkdir(dir, { recursive: true })
|
|
const tmp = join(dir, `.${randomBytes(8).toString('hex')}.tmp`)
|
|
const mode = opts.mode ?? 0o600
|
|
let handle, committed = false
|
|
try {
|
|
handle = await open(tmp, 'wx', mode)
|
|
await handle.writeFile(data, typeof data === 'string' ? 'utf-8' : undefined)
|
|
await handle.sync()
|
|
await handle.close()
|
|
handle = null
|
|
await rename(tmp, filePath)
|
|
committed = true
|
|
if (process.platform !== 'win32') {
|
|
// Rename is the commit point. A filesystem that cannot fsync directories
|
|
// must not make callers roll back memory after the replacement succeeded.
|
|
let directory
|
|
try { directory = await open(dir, 'r'); await directory.sync() }
|
|
catch { /* directory durability is best effort on unsupported filesystems */ }
|
|
finally { await directory?.close().catch(() => {}) }
|
|
}
|
|
} finally {
|
|
await handle?.close()
|
|
if (!committed) await unlink(tmp).catch(err => { if (err.code !== 'ENOENT') throw err })
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @param {string} filePath
|
|
* @param {any} obj
|
|
* @param {{ mode?: number, pretty?: boolean }} [opts]
|
|
*/
|
|
export async function atomicWriteJson(filePath, obj, opts = {}) {
|
|
const text = opts.pretty === false
|
|
? JSON.stringify(obj)
|
|
: JSON.stringify(obj, null, 2)
|
|
await atomicWriteFile(filePath, text + '\n', { mode: opts.mode })
|
|
}
|