71 lines
2.6 KiB
TypeScript
71 lines
2.6 KiB
TypeScript
import { desktopBootstrapPath } from "@openwork/paths";
|
|
|
|
import { readJsoncFile } from "./jsonc.js";
|
|
|
|
const MAX_BOOTSTRAP_BYTES = 256 * 1024;
|
|
|
|
function isRecord(value: unknown): value is Record<string, unknown> {
|
|
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
}
|
|
|
|
/**
|
|
* Reduces an administrator-provisioned Den control-plane URL to its exact
|
|
* origin. Anything carrying credentials, a query, or a fragment is rejected
|
|
* rather than trimmed, so a malformed activation record can never widen the
|
|
* diagnostics trust list.
|
|
*/
|
|
export function exactEnterpriseOrigin(rawValue: unknown): string | null {
|
|
if (typeof rawValue !== "string") return null;
|
|
const raw = rawValue.trim();
|
|
if (!raw || raw.length > 2 * 1024) return null;
|
|
try {
|
|
const url = new URL(raw);
|
|
if (url.protocol !== "https:") return null;
|
|
if (url.username || url.password || url.search || url.hash) return null;
|
|
return url.origin;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Resolves the origin of the enterprise/on-prem Den control plane this
|
|
* installation is already activated against.
|
|
*
|
|
* The desktop writes `enterpriseActivation` only after a signed connect-link
|
|
* activation claim verifies, so it is administrator-provisioned configuration
|
|
* rather than a renderer- or request-supplied URL — the one non-built-in
|
|
* source the credentialed diagnostics probe may trust without an explicit
|
|
* environment override. A missing, unreadable, or malformed record yields
|
|
* null and the probe stays fail-closed.
|
|
*/
|
|
export async function readActivatedEnterpriseDenOrigin(options?: {
|
|
signal?: AbortSignal;
|
|
path?: string;
|
|
}): Promise<string | null> {
|
|
const path = options?.path ?? desktopBootstrapPath({ env: process.env });
|
|
if (typeof path !== "string" || !path.trim()) return null;
|
|
try {
|
|
const { data, invalid } = await readJsoncFile<Record<string, unknown>>(
|
|
path,
|
|
{},
|
|
{
|
|
allowInvalid: true,
|
|
maxBytes: MAX_BOOTSTRAP_BYTES,
|
|
regularFileOnly: true,
|
|
signal: options?.signal,
|
|
},
|
|
);
|
|
if (invalid) return null;
|
|
const activation = isRecord(data.enterpriseActivation) ? data.enterpriseActivation : null;
|
|
if (!activation) return null;
|
|
// Both fields are required by the desktop writer; an entry without a
|
|
// completed activation timestamp is not proof of a provisioned tenant.
|
|
if (typeof activation.activatedAt !== "string" || !activation.activatedAt.trim()) return null;
|
|
return exactEnterpriseOrigin(activation.denBaseUrl);
|
|
} catch {
|
|
options?.signal?.throwIfAborted();
|
|
return null;
|
|
}
|
|
}
|