agent-radar
7be535059e
Dependency audit / audit (push) Canceled after 0s
CI / plan (push) Canceled after 0s
Gitoxide helper admission / macos-latest (push) Canceled after 0s
Gitoxide helper admission / ubuntu-latest (push) Canceled after 0s
Gitoxide helper admission / windows-latest (push) Canceled after 0s
Runtime Host peer admission / quality (push) Canceled after 0s
Windows recovery / windows_recovery (push) Canceled after 0s
CI / heavy (push) Canceled after 0s
CI / test (push) Canceled after 0s
85 lines
3.3 KiB
TypeScript
85 lines
3.3 KiB
TypeScript
/*
|
|
* Licensed to the Apache Software Foundation (ASF) under one
|
|
* or more contributor license agreements. See the NOTICE file
|
|
* distributed with this work for additional information
|
|
* regarding copyright ownership. The ASF licenses this file
|
|
* to you under the Apache License, Version 2.0 (the
|
|
* "License"); you may not use this file except in compliance
|
|
* with the License. You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing,
|
|
* software distributed under the License is distributed on an
|
|
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
* KIND, either express or implied. See the License for the
|
|
* specific language governing permissions and limitations
|
|
* under the License.
|
|
*/
|
|
|
|
import { join } from 'node:path';
|
|
import { runtimeHostAccessCredentialFingerprintFromHash } from '../access-credential-identity.js';
|
|
import {
|
|
discoverMarkedStorageRoot,
|
|
resolveExistingStorageRootControlDirectory,
|
|
resolveExistingStorageRoot,
|
|
} from '@maka/storage/root-authority';
|
|
import type { OperationKey } from '../protocol/index.js';
|
|
import { ACCESS_FILE_NAME, readAccessCredentialFile } from './access-credential-store.js';
|
|
|
|
export interface RuntimeHostAccessCredentialMetadata {
|
|
readonly credentialId: string;
|
|
readonly credentialFingerprint: string;
|
|
readonly principalKind: 'remote_owner' | 'capability_provider';
|
|
readonly principalId: string;
|
|
readonly status: 'active' | 'pending';
|
|
readonly operationGrants: readonly OperationKey[];
|
|
readonly canPublishClientCapabilities: boolean;
|
|
readonly canUseHostPaths: boolean;
|
|
readonly createdAt: string;
|
|
readonly expiresAt?: string;
|
|
}
|
|
|
|
export async function readRuntimeHostAccessCredentialMetadata(
|
|
rootPath: string,
|
|
expectedRootId?: string,
|
|
): Promise<{ readonly credentials: readonly RuntimeHostAccessCredentialMetadata[] }> {
|
|
const capability = expectedRootId
|
|
? await resolveExistingStorageRoot({
|
|
path: rootPath,
|
|
kind: 'interactive',
|
|
expectedRootId,
|
|
})
|
|
: await discoverMarkedStorageRoot({ path: rootPath });
|
|
const { controlDirectory } = await resolveExistingStorageRootControlDirectory(capability);
|
|
const file = await readAccessCredentialFile(join(controlDirectory, ACCESS_FILE_NAME));
|
|
const now = Date.now();
|
|
return {
|
|
credentials: file.credentials.flatMap((credential) => {
|
|
if (
|
|
credential.principalKind === 'session_guest' ||
|
|
(credential.status !== 'active' &&
|
|
!(credential.status === 'pending' && Date.parse(credential.expiresAt!) > now))
|
|
) {
|
|
return [];
|
|
}
|
|
return [
|
|
{
|
|
credentialId: credential.credentialId,
|
|
credentialFingerprint: runtimeHostAccessCredentialFingerprintFromHash(
|
|
credential.credentialHash,
|
|
),
|
|
principalKind: credential.principalKind,
|
|
principalId: credential.principalId,
|
|
status: credential.status,
|
|
operationGrants: credential.operationGrants,
|
|
canPublishClientCapabilities: credential.canPublishClientCapabilities,
|
|
canUseHostPaths: credential.canUseHostPaths,
|
|
createdAt: credential.createdAt,
|
|
...(credential.expiresAt ? { expiresAt: credential.expiresAt } : {}),
|
|
},
|
|
];
|
|
}),
|
|
};
|
|
}
|