mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-24 08:57:25 +00:00
feat(files): copy & duplicate, bulk actions, disk-backed uploads, and an accessible file tree (#1409)
* perf(files): spool uploads to disk instead of buffering in memory
Switch the stack file-explorer upload from multer memoryStorage to
diskStorage and stream the spooled temp file through the file-root
gateway, so an upload is never held fully in RAM. Authorization and
root resolution now run before multer spools, so an unauthorized or
read-only-root request is rejected without writing a temp file, and the
spool is removed on every exit path. The named-volume helper write
verifies the written byte count, since cat cannot report a short write.
* feat(files): copy and duplicate files in the explorer
Add a copy capability to the stack file explorer: a same-folder
Duplicate (auto-suffixed name) and a "Copy to..." destination picker,
on both filesystem and named-volume roots. Copying is within-root,
symlink-leaf-safe, blocks a directory copy into its own subtree, and
refuses to create a protected name (compose/.env) at the stack root
while still allowing a protected file to be duplicated under a new name.
* feat(files): make the file tree keyboard accessible
Bring the stack file explorer tree to the WCAG tree pattern: rows are
treeitems carrying aria-level, aria-selected, and aria-expanded, with a
single roving tabindex and full keyboard navigation (arrow keys,
Home/End, Enter/Space) over a flattened visible-node list that stays in
lockstep with the rendered rows. A polite live region announces the
selected file. No visual change to the tree.
* feat(files): bulk select, delete, move, and download files
Add multi-select to the stack file explorer (checkboxes plus Shift and
Ctrl/Cmd click over the visible order) driving three bulk actions:
delete, move, and download as a streamed .tar.gz. All run within the
active root on both filesystem and named-volume backends, report
per-item results so partial failures surface (with the failed items
kept selected for retry), normalize ancestor/descendant selections
server-side, and cap the archive entry and byte counts before any
bytes are streamed. Protected compose/.env files are excluded from
bulk delete and move but may still be downloaded.
* docs(files): document copy, bulk actions, and keyboard navigation
Add the copy/duplicate and multi-select bulk delete/move/download
sections to the Files & Volumes page, a keyboard-navigation note for the
tree, an updated context-menu reference, and bulk troubleshooting entries.
* fix(files): inline path-injection barriers at the new file-op sinks
CodeQL js/path-injection does not credit the wrapped isPathWithinBase
containment check, so the new copy/bulk/disk-upload flows tripped the
gate. Inline the canonical path.resolve + startsWith barrier at the
realpath sink in resolveSafePathWithin (covers every user-relPath flow)
and confirm the multer spool path resolves within UPLOAD_TMP_DIR before
unlinking it or streaming it onward. Behavior is unchanged; the paths
were already validated.
* fix(files): guard the ancestor-walk realpath sink too
The first barrier covered realpath(target), but the ENOENT ancestor
walk re-derives the path via path.dirname, which static analysis treats
as a fresh tainted value. Add the same inline containment barrier before
that realpath and resolve the root case via the untainted base, so the
only tainted realpath input is one the startsWith check has cleared.
Behavior is unchanged.
* fix(files): resolve the root case off the taint path in the ancestor walk
The compound guard on existing (the same variable as the startsWith
subject) was not credited as a sanitizer. Handle the root case before
the barrier by resolving the untainted base directly, leaving a plain
canonical startsWith guard on the strictly-within ancestor. Behavior is
unchanged.
* fix(files): harden helper-backend bulk download and uploads
Address three issues found in the named-volume (helper) backend:
- Bulk download could send 200 headers before discovering a file the
helper download path refuses, tearing the archive mid-stream. The
prewalk now rejects symlinks, non-regular ("other") entries, and
files over the per-file download cap before any header (400/413).
FileEntry gains an 'other' type so non-regular entries stay distinct
from regular files as they pass through the gateway.
- The helper directory listing was fully buffered before the archive
entry cap could fire. listDir now accepts a limit; the list script
stops after limit+1 rows and the gateway reports truncation.
- A stdin pipeline error during a helper upload masked the container's
real nonzero exit code (and its 4xx mapping) as a generic 500. The
nonzero exit now wins; the masked stream error is logged.
* feat(files): add a New file toolbar button with server-enforced create-only
The stack file explorer could create a folder from a toolbar button but a
new file only from a folder's right-click menu, so a file could not be
created at the stack root at all. Add a New file toolbar button beside New
folder, targeting the current directory.
Creating a file now routes through a new createEmptyStackFile helper that
posts a zero-byte file through the existing upload endpoint with overwrite
off, so the server's exclusive-create path rejects an existing name instead
of clobbering it. A file collision surfaces inline in the dialog; a folder
collision and other failures surface as a toast.
* fix(files): widen the tree row hit area and add horizontal scroll for long names
Right-clicking a file tree row only opened the Sencho context menu when the
click landed on the filename; the rest of the row fell through to the native
browser menu, and long names were truncated with no way to read them.
Make each row span the full pane width (and grow with its content) so the
whole row is the context-menu trigger, and let the tree scroll horizontally
so a long name is reachable instead of clipped. A new opt-in horizontal prop
on ScrollArea adds the styled horizontal scrollbar without clamping content
width.
* docs(files): document the New file button, full-row right-click, and long-name scrolling
* test(files): cover createEmptyStackFile targeting the stack root
Add an API-layer case for the empty-directory (stack root) create path, the
primary reason the New file toolbar button exists, so a regression in the
root-level URL would be caught at unit speed rather than only in e2e.
This commit is contained in:
Anso
@@ -1,4 +1,5 @@
|
||||
import { Writable } from 'stream';
|
||||
import { Writable, Readable } from 'stream';
|
||||
import { pipeline } from 'stream/promises';
|
||||
import path from 'path';
|
||||
import { createHash } from 'crypto';
|
||||
import DockerController from './DockerController';
|
||||
@@ -10,7 +11,7 @@ const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
|
||||
// buffered up to this size and a larger file is rejected rather than silently
|
||||
// truncated. The bound matches the upload limit so the in-memory footprint is no
|
||||
// worse than the existing multipart upload path.
|
||||
const DOWNLOAD_MAX_BYTES = 25 * 1024 * 1024;
|
||||
export const DOWNLOAD_MAX_BYTES = 25 * 1024 * 1024;
|
||||
const EXEC_TIMEOUT_MS = 30_000;
|
||||
|
||||
// Containment guard run inside the helper after every `cd`. Even though
|
||||
@@ -27,6 +28,8 @@ const ROOT_GUARD =
|
||||
const LIST_SCRIPT = `set -e
|
||||
cd -- "$1" || exit 1
|
||||
${ROOT_GUARD}
|
||||
lim="$2"
|
||||
n=0
|
||||
for entry in * .[!.]* ..?*; do
|
||||
[ -e "$entry" ] || [ -L "$entry" ] || continue
|
||||
if [ -L "$entry" ]; then t=l; link=$(readlink -- "$entry" 2>/dev/null || echo "")
|
||||
@@ -37,6 +40,8 @@ for entry in * .[!.]* ..?*; do
|
||||
size=$(stat -c '%s' -- "$entry" 2>/dev/null || echo 0)
|
||||
mtime=$(stat -c '%Y' -- "$entry" 2>/dev/null || echo 0)
|
||||
printf '%s\\t%s\\t%s\\t%s\\t%s\\n' "$t" "$size" "$mtime" "$entry" "$link"
|
||||
n=$((n+1))
|
||||
if [ -n "$lim" ] && [ "$n" -ge "$lim" ]; then break; fi
|
||||
done`;
|
||||
|
||||
// Contain the parent before statting the leaf: cd into the leaf's directory and
|
||||
@@ -104,6 +109,26 @@ fd=$(dirname -- "$from"); td=$(dirname -- "$to")
|
||||
{ [ -e "$to" ] || [ -L "$to" ]; } && { echo "destination exists" >&2; exit 11; }
|
||||
mv -- "$from" "$to"`;
|
||||
|
||||
// $1 = from, $2 = to. Both parents are contained and the destination must not
|
||||
// exist. cp -RP recurses without dereferencing symlinks (copying links as links,
|
||||
// matching the fs backend) and does NOT preserve ownership, since the helper runs
|
||||
// unprivileged and cannot chown; new entries are owned by the helper user, like
|
||||
// the helper write. A directory may not be copied into itself or a descendant
|
||||
// (cp would otherwise recurse into the copy it is creating).
|
||||
const COPY_SCRIPT = `set -e
|
||||
from="$1"; to="$2"
|
||||
fd=$(dirname -- "$from"); td=$(dirname -- "$to")
|
||||
sp=$( cd -- "$fd" 2>/dev/null && pwd -P ) || { echo "source escapes volume root" >&2; exit 7; }
|
||||
case "$sp" in "${VOLUME_MOUNT}"|"${VOLUME_MOUNT}/"*) ;; *) echo "source escapes volume root" >&2; exit 7 ;; esac
|
||||
dp=$( cd -- "$td" 2>/dev/null && pwd -P ) || { echo "destination escapes volume root" >&2; exit 7; }
|
||||
case "$dp" in "${VOLUME_MOUNT}"|"${VOLUME_MOUNT}/"*) ;; *) echo "destination escapes volume root" >&2; exit 7 ;; esac
|
||||
{ [ -e "$to" ] || [ -L "$to" ]; } && { echo "destination exists" >&2; exit 11; }
|
||||
src="$sp/$(basename -- "$from")"
|
||||
if [ -d "$src" ] && [ ! -L "$src" ]; then
|
||||
case "$dp/" in "$src/"*) echo "cannot copy a folder into itself" >&2; exit 12 ;; esac
|
||||
fi
|
||||
cp -RP -- "$from" "$to"`;
|
||||
|
||||
// $1 = relative path. Prints directory|file|none. Used for upload-overwrite checks.
|
||||
const PATHKIND_SCRIPT = `set -e
|
||||
p="$1"
|
||||
@@ -186,7 +211,7 @@ export class VolumeBrowserService {
|
||||
return new VolumeBrowserService(nodeId ?? 1);
|
||||
}
|
||||
|
||||
async listDir(volumeName: string, relPath: string): Promise<VolumeEntry[]> {
|
||||
async listDir(volumeName: string, relPath: string, limit?: number): Promise<VolumeEntry[]> {
|
||||
const safe = sanitizeRelPath(relPath);
|
||||
await this.assertVolumeExists(volumeName);
|
||||
await this.ensureHelperImage();
|
||||
@@ -194,10 +219,12 @@ export class VolumeBrowserService {
|
||||
// Portable across BusyBox (Alpine) and GNU coreutils. Lists each
|
||||
// direct child with a tab-separated row: type<TAB>size<TAB>mtime<TAB>
|
||||
// name<TAB>symlinkTarget. We chdir to /v/<safe> first so user input is
|
||||
// never an argv element passed to find/stat.
|
||||
const script = LIST_SCRIPT;
|
||||
// never an argv element passed to find/stat. When a limit is given the
|
||||
// script breaks after limit+1 rows, so a huge directory is never fully
|
||||
// buffered; the caller detects truncation from the overflow row.
|
||||
const limArg = limit !== undefined ? String(limit + 1) : '';
|
||||
const { stdout, stderr, exitCode } = await this.runHelper(volumeName, [
|
||||
'sh', '-c', script, 'sh', `./${safe || ''}`,
|
||||
'sh', '-c', LIST_SCRIPT, 'sh', `./${safe || ''}`, limArg,
|
||||
]);
|
||||
|
||||
if (exitCode !== 0) {
|
||||
@@ -392,6 +419,39 @@ export class VolumeBrowserService {
|
||||
return { mtimeMs: meta.mtime * 1000, size: meta.size };
|
||||
}
|
||||
|
||||
/**
|
||||
* Like writeFile but streams the content from a Readable (an upload spooled to
|
||||
* a temp file) straight into the helper's stdin, so a large upload is never
|
||||
* held in memory. Non-atomic in-place write (`cat > file`), matching writeFile
|
||||
* (see writeFile for the ownership-preservation rationale); the caller owns the
|
||||
* source stream's underlying temp file. `expectedSize` is the source byte count:
|
||||
* `cat` cannot report a short write, so the post-write size is checked against
|
||||
* it to catch a truncated transfer that exited cleanly.
|
||||
*/
|
||||
async writeFileStream(volumeName: string, relPath: string, source: Readable, expectedSize: number): Promise<{ mtimeMs: number; size: number }> {
|
||||
const safe = sanitizeRelPath(relPath);
|
||||
if (!safe) throw new ExecError('Cannot write the volume root', 400);
|
||||
await this.assertVolumeExists(volumeName);
|
||||
await this.ensureHelperImage();
|
||||
|
||||
const { stderr, exitCode } = await this.runHelper(
|
||||
volumeName,
|
||||
['sh', '-c', WRITE_SCRIPT, 'sh', `./${safe}`],
|
||||
{ writable: true, stdin: source },
|
||||
);
|
||||
if (exitCode !== 0) {
|
||||
const msg = stderr.toString('utf-8').trim();
|
||||
if (/Permission denied/i.test(msg) || exitCode === 8) throw new ExecError('Permission denied', 403);
|
||||
if (exitCode === 9) throw new ExecError('Target is a directory', 400);
|
||||
throw new ExecError(`Write failed: ${msg.substring(0, 200) || 'unknown error'}`);
|
||||
}
|
||||
const meta = await this.stat(volumeName, safe);
|
||||
if (meta.size !== expectedSize) {
|
||||
throw new ExecError('Upload did not fully write to the volume', 500);
|
||||
}
|
||||
return { mtimeMs: meta.mtime * 1000, size: meta.size };
|
||||
}
|
||||
|
||||
/** Create a single directory; its parent must already exist. */
|
||||
async mkdir(volumeName: string, relPath: string): Promise<void> {
|
||||
const safe = sanitizeRelPath(relPath);
|
||||
@@ -450,6 +510,27 @@ export class VolumeBrowserService {
|
||||
}
|
||||
}
|
||||
|
||||
/** Copy a file or directory within the same volume (symlink-as-link, no chown). */
|
||||
async copy(volumeName: string, fromRel: string, toRel: string): Promise<void> {
|
||||
const from = sanitizeRelPath(fromRel);
|
||||
const to = sanitizeRelPath(toRel);
|
||||
if (!from || !to) throw new ExecError('Invalid copy path', 400);
|
||||
await this.assertVolumeExists(volumeName);
|
||||
await this.ensureHelperImage();
|
||||
const { stderr, exitCode } = await this.runHelper(
|
||||
volumeName,
|
||||
['sh', '-c', COPY_SCRIPT, 'sh', `./${from}`, `./${to}`],
|
||||
{ writable: true },
|
||||
);
|
||||
if (exitCode !== 0) {
|
||||
const msg = stderr.toString('utf-8').trim();
|
||||
if (/Permission denied/i.test(msg)) throw new ExecError('Permission denied', 403);
|
||||
if (exitCode === 11 || /exists/i.test(msg)) throw new ExecError('A file or folder with that name already exists', 409);
|
||||
if (exitCode === 12) throw new ExecError('Cannot copy a folder into itself', 400);
|
||||
throw new ExecError(`Copy failed: ${msg.substring(0, 200) || 'unknown error'}`);
|
||||
}
|
||||
}
|
||||
|
||||
// --- internals -----------------------------------------------------------
|
||||
|
||||
private async assertVolumeExists(volumeName: string): Promise<void> {
|
||||
@@ -493,7 +574,7 @@ export class VolumeBrowserService {
|
||||
private async runHelper(
|
||||
volumeName: string,
|
||||
cmd: string[],
|
||||
opts: { writable?: boolean; stdin?: Buffer } = {},
|
||||
opts: { writable?: boolean; stdin?: Buffer | Readable } = {},
|
||||
): Promise<{ stdout: Buffer; stderr: Buffer; exitCode: number }> {
|
||||
const docker = DockerController.getInstance(this.nodeId).getDocker();
|
||||
const stdoutChunks: Buffer[] = [];
|
||||
@@ -540,6 +621,7 @@ export class VolumeBrowserService {
|
||||
timer = setTimeout(() => reject(new ExecError('Helper exec timed out', 504)), EXEC_TIMEOUT_MS);
|
||||
});
|
||||
|
||||
let stdinError: unknown = null;
|
||||
const runPromise = (async () => {
|
||||
const stream = await container.attach({ stream: true, stdin: wantStdin, stdout: true, stderr: true, hijack: wantStdin });
|
||||
const streamEnded = new Promise<void>((resolve) => {
|
||||
@@ -551,16 +633,45 @@ export class VolumeBrowserService {
|
||||
if (wantStdin && opts.stdin) {
|
||||
// Feed the file content to the container's stdin, then close it so the
|
||||
// helper's `cat > file` sees EOF and exits.
|
||||
stream.write(opts.stdin);
|
||||
stream.end();
|
||||
if (Buffer.isBuffer(opts.stdin)) {
|
||||
stream.write(opts.stdin);
|
||||
stream.end();
|
||||
} else {
|
||||
// A Readable (an upload spooled to a temp file) is piped so a large
|
||||
// upload is never held in memory. pipeline tears the stdin side down
|
||||
// (destroys it) on a source error rather than ending it cleanly, so
|
||||
// cat sees an abnormal close instead of a normal EOF and does not
|
||||
// commit a truncated file as a success. Remember the error so the run
|
||||
// is reported as failed after the container exits.
|
||||
try {
|
||||
await pipeline(opts.stdin, stream);
|
||||
} catch (err) {
|
||||
stdinError = err;
|
||||
}
|
||||
}
|
||||
}
|
||||
const exitInfo = await container.wait();
|
||||
// Wait for the attach stream to finish flushing demuxed output.
|
||||
await streamEnded;
|
||||
const exitCode = typeof exitInfo?.StatusCode === 'number' ? exitInfo.StatusCode : 0;
|
||||
// A nonzero helper exit is the authoritative failure: its exit code carries
|
||||
// the intended 4xx mapping (target-is-a-directory, permission denied, etc.),
|
||||
// which a stdin EPIPE from the helper closing stdin early would otherwise
|
||||
// mask as a generic 500. Only surface the stream error when the helper
|
||||
// itself exited cleanly (or its status was unreadable).
|
||||
if (stdinError) {
|
||||
if (exitCode === 0) {
|
||||
throw new ExecError('Upload stream failed before the volume write completed', 500);
|
||||
}
|
||||
// The nonzero exit's mapping is the user-facing error, but the stream
|
||||
// failure is the root cause; log it so an intermittent upload failure is
|
||||
// debuggable rather than being silently attributed to the exit code.
|
||||
console.error('[VolumeBrowser] helper stdin stream error masked by nonzero exit', exitCode, stdinError);
|
||||
}
|
||||
return {
|
||||
stdout: Buffer.concat(stdoutChunks),
|
||||
stderr: Buffer.concat(stderrChunks),
|
||||
exitCode: typeof exitInfo?.StatusCode === 'number' ? exitInfo.StatusCode : 0,
|
||||
exitCode,
|
||||
};
|
||||
})();
|
||||
|
||||
|
||||
Reference in New Issue
Block a user