Feature/lxc container runtime (#2514)

* wip: static-server errors * wip: fix wifi * wip: Fix the service_effects * wip: Fix cors in the middleware * wip(chore): Auth clean up the lint. * wip(fix): Vhost * wip: continue manager refactor Co-authored-by: J H <Blu-J@users.noreply.github.com> * wip: service manager refactor * wip: Some fixes * wip(fix): Fix the lib.rs * wip * wip(fix): Logs * wip: bins * wip(innspect): Add in the inspect * wip: config * wip(fix): Diagnostic * wip(fix): Dependencies * wip: context * wip(fix) Sorta auth * wip: warnings * wip(fix): registry/admin * wip(fix) marketplace * wip(fix) Some more converted and fixed with the linter and config * wip: Working on the static server * wip(fix)static server * wip: Remove some asynnc * wip: Something about the request and regular rpc * wip: gut install Co-authored-by: J H <Blu-J@users.noreply.github.com> * wip: Convert the static server into the new system * wip delete file * test * wip(fix) vhost does not need the with safe defaults * wip: Adding in the wifi * wip: Fix the developer and the verify * wip: new install flow Co-authored-by: J H <Blu-J@users.noreply.github.com> * fix middleware * wip * wip: Fix the auth * wip * continue service refactor * feature: Service get_config * feat: Action * wip: Fighting the great fight against the borrow checker * wip: Remove an error in a file that I just need to deel with later * chore: Add in some more lifetime stuff to the services * wip: Install fix on lifetime * cleanup * wip: Deal with the borrow later * more cleanup * resolve borrowchecker errors * wip(feat): add in the handler for the socket, for now * wip(feat): Update the service_effect_handler::action * chore: Add in the changes to make sure the from_service goes to context * chore: Change the * refactor service map * fix references to service map * fill out restore * wip: Before I work on the store stuff * fix backup module * handle some warnings * feat: add in the ui components on the rust side * feature: Update the procedures * chore: Update the js side of the main and a few of the others * chore: Update the rpc listener to match the persistant container * wip: Working on updating some things to have a better name * wip(feat): Try and get the rpc to return the correct shape? * lxc wip * wip(feat): Try and get the rpc to return the correct shape? * build for container runtime wip * remove container-init * fix build * fix error * chore: Update to work I suppose * lxc wip * remove docker module and feature * download alpine squashfs automatically * overlays effect Co-authored-by: Jade <Blu-J@users.noreply.github.com> * chore: Add the overlay effect * feat: Add the mounter in the main * chore: Convert to use the mounts, still need to work with the sandbox * install fixes * fix ssl * fixes from testing * implement tmpfile for upload * wip * misc fixes * cleanup * cleanup * better progress reporting * progress for sideload * return real guid * add devmode script * fix lxc rootfs path * fix percentage bar * fix progress bar styling * fix build for unstable * tweaks * label progress * tweaks * update progress more often * make symlink in rpc_client * make socket dir * fix parent path * add start-cli to container * add echo and gitInfo commands * wip: Add the init + errors * chore: Add in the exit effect for the system * chore: Change the type to null for failure to parse * move sigterm timeout to stopping status * update order * chore: Update the return type * remove dbg * change the map error * chore: Update the thing to capture id * chore add some life changes * chore: Update the loging * chore: Update the package to run module * us From for RpcError * chore: Update to use import instead * chore: update * chore: Use require for the backup * fix a default * update the type that is wrong * chore: Update the type of the manifest * chore: Update to make null * only symlink if not exists * get rid of double result * better debug info for ErrorCollection * chore: Update effects * chore: fix * mount assets and volumes * add exec instead of spawn * fix mounting in image * fix overlay mounts Co-authored-by: Jade <Blu-J@users.noreply.github.com> * misc fixes * feat: Fix two * fix: systemForEmbassy main * chore: Fix small part of main loop * chore: Modify the bundle * merge * fixMain loop" * move tsc to makefile * chore: Update the return types of the health check * fix client * chore: Convert the todo to use tsmatches * add in the fixes for the seen and create the hack to allow demo * chore: Update to include the systemForStartOs * chore UPdate to the latest types from the expected outout * fixes * fix typo * Don't emit if failure on tsc * wip Co-authored-by: Jade <Blu-J@users.noreply.github.com> * add s9pk api * add inspection * add inspect manifest * newline after display serializable * fix squashfs in image name * edit manifest Co-authored-by: Jade <Blu-J@users.noreply.github.com> * wait for response on repl * ignore sig for now * ignore sig for now * re-enable sig verification * fix * wip * env and chroot * add profiling logs * set uid & gid in squashfs to 100000 * set uid of sqfs to 100000 * fix mksquashfs args * add env to compat * fix * re-add docker feature flag * fix docker output format being stupid * here be dragons * chore: Add in the cross compiling for something * fix npm link * extract logs from container on exit * chore: Update for testing * add log capture to drop trait * chore: add in the modifications that I make * chore: Update small things for no updates * chore: Update the types of something * chore: Make main not complain * idmapped mounts * idmapped volumes * re-enable kiosk * chore: Add in some logging for the new system * bring in start-sdk * remove avahi * chore: Update the deps * switch to musl * chore: Update the version of prettier * chore: Organize' * chore: Update some of the headers back to the standard of fetch * fix musl build * fix idmapped mounts * fix cross build * use cross compiler for correct arch * feat: Add in the faked ssl stuff for the effects * @dr_bonez Did a solution here * chore: Something that DrBonez * chore: up * wip: We have a working server!!! * wip * uninstall * wip * tes --------- Co-authored-by: J H <dragondef@gmail.com> Co-authored-by: J H <Blu-J@users.noreply.github.com> Co-authored-by: J H <2364004+Blu-J@users.noreply.github.com>
2026-03-30 20:14:49 +00:00 · 2024-02-17 11:14:14 -07:00
parent 65009e2f69
commit fab13db4b4
326 changed files with 31708 additions and 13987 deletions
--- a/core/startos/src/auth.rs
+++ b/core/startos/src/auth.rs
@@ -1,24 +1,23 @@
 use std::collections::BTreeMap;
-use std::marker::PhantomData;

 use chrono::{DateTime, Utc};
-use clap::ArgMatches;
+use clap::{ArgMatches, Parser};
 use color_eyre::eyre::eyre;
+use imbl_value::{json, InternedString};
 use josekit::jwk::Jwk;
-use rpc_toolkit::command;
-use rpc_toolkit::command_helpers::prelude::{RequestParts, ResponseParts};
 use rpc_toolkit::yajrc::RpcError;
+use rpc_toolkit::{command, from_fn_async, AnyContext, CallRemote, HandlerExt, ParentHandler};
 use serde::{Deserialize, Serialize};
-use serde_json::Value;
 use sqlx::{Executor, Postgres};
 use tracing::instrument;

 use crate::context::{CliContext, RpcContext};
-use crate::middleware::auth::{AsLogoutSessionId, HasLoggedOutSessions, HashSessionToken};
-use crate::middleware::encrypt::EncryptedWire;
+use crate::middleware::auth::{
+    AsLogoutSessionId, HasLoggedOutSessions, HashSessionToken, LoginRes,
+};
 use crate::prelude::*;
-use crate::util::display_none;
-use crate::util::serde::{display_serializable, IoFormat};
+use crate::util::crypto::EncryptedWire;
+use crate::util::serde::{display_serializable, HandlerExtSerde, WithIoFormat};
 use crate::{ensure_code, Error, ResultExt};
 #[derive(Clone, Serialize, Deserialize)]
 #[serde(untagged)]
@@ -61,14 +60,43 @@ impl std::str::FromStr for PasswordType {
        })
    }
 }
-
-#[command(subcommands(login, logout, session, reset_password, get_pubkey))]
-pub fn auth() -> Result<(), Error> {
-    Ok(())
+pub fn auth() -> ParentHandler {
+    ParentHandler::new()
+        .subcommand(
+            "login",
+            from_fn_async(login_impl)
+                .with_metadata("login", Value::Bool(true))
+                .no_cli(),
+        )
+        .subcommand("login", from_fn_async(cli_login).no_display())
+        .subcommand(
+            "logout",
+            from_fn_async(logout)
+                .with_metadata("get-session", Value::Bool(true))
+                .with_remote_cli::<CliContext>()
+                // TODO @dr-bonez
+                .no_display(),
+        )
+        .subcommand("session", session())
+        .subcommand(
+            "reset-password",
+            from_fn_async(reset_password_impl).no_cli(),
+        )
+        .subcommand(
+            "reset-password",
+            from_fn_async(cli_reset_password).no_display(),
+        )
+        .subcommand(
+            "get-pubkey",
+            from_fn_async(get_pubkey)
+                .with_metadata("authenticated", Value::Bool(false))
+                .no_display()
+                .with_remote_cli::<CliContext>(),
+        )
 }

 pub fn cli_metadata() -> Value {
-    serde_json::json!({
+    imbl_value::json!({
        "platforms": ["cli"],
    })
 }
@@ -89,12 +117,17 @@ fn gen_pwd() {
        .unwrap()
    )
 }
+#[derive(Deserialize, Serialize, Parser)]
+#[serde(rename_all = "kebab-case")]
+#[command(rename_all = "kebab-case")]
+pub struct CliLoginParams {
+    password: Option<PasswordType>,
+}

 #[instrument(skip_all)]
 async fn cli_login(
    ctx: CliContext,
-    password: Option<PasswordType>,
-    metadata: Value,
+    CliLoginParams { password }: CliLoginParams,
 ) -> Result<(), RpcError> {
    let password = if let Some(password) = password {
        password.decrypt(&ctx)?
@@ -102,14 +135,16 @@ async fn cli_login(
        rpassword::prompt_password("Password: ")?
    };

-    rpc_toolkit::command_helpers::call_remote(
-        ctx,
+    ctx.call_remote(
        "auth.login",
-        serde_json::json!({ "password": password, "metadata": metadata }),
-        PhantomData::<()>,
+        json!({
+            "password": password,
+            "metadata": {
+                "platforms": ["cli"],
+            },
+        }),
    )
-    .await?
-    .result?;
+    .await?;

    Ok(())
 }
@@ -140,30 +175,27 @@ where
    Ok(())
 }

-#[command(
-    custom_cli(cli_login(async, context(CliContext))),
-    display(display_none),
-    metadata(authenticated = false)
-)]
-#[instrument(skip_all)]
-pub async fn login(
-    #[context] ctx: RpcContext,
-    #[request] req: &RequestParts,
-    #[response] res: &mut ResponseParts,
-    #[arg] password: Option<PasswordType>,
-    #[arg(
-        parse(parse_metadata),
-        default = "cli_metadata",
-        help = "RPC Only: This value cannot be overidden from the cli"
-    )]
+#[derive(Deserialize, Serialize, Parser)]
+#[serde(rename_all = "kebab-case")]
+#[command(rename_all = "kebab-case")]
+pub struct LoginParams {
+    password: Option<PasswordType>,
+    #[arg(skip = cli_metadata())]
+    #[serde(default)]
    metadata: Value,
-) -> Result<(), Error> {
+}
+
+#[instrument(skip_all)]
+pub async fn login_impl(
+    ctx: RpcContext,
+    LoginParams { password, metadata }: LoginParams,
+) -> Result<LoginRes, Error> {
    let password = password.unwrap_or_default().decrypt(&ctx)?;
    let mut handle = ctx.secret_store.acquire().await?;
    check_password_against_db(handle.as_mut(), &password).await?;

    let hash_token = HashSessionToken::new();
-    let user_agent = req.headers.get("user-agent").and_then(|h| h.to_str().ok());
+    let user_agent = "".to_string(); // todo!() as String;
    let metadata = serde_json::to_string(&metadata).with_kind(crate::ErrorKind::Database)?;
    let hash_token_hashed = hash_token.hashed();
    sqlx::query!(
@@ -174,25 +206,24 @@ pub async fn login(
    )
    .execute(handle.as_mut())
    .await?;
-    res.headers.insert(
-        "set-cookie",
-        hash_token.header_value()?, // Should be impossible, but don't want to panic
-    );

-    Ok(())
+    Ok(hash_token.to_login_res())
+}
+
+#[derive(Deserialize, Serialize, Parser)]
+#[serde(rename_all = "kebab-case")]
+#[command(rename_all = "kebab-case")]
+pub struct LogoutParams {
+    session: InternedString,
 }

-#[command(display(display_none), metadata(authenticated = false))]
-#[instrument(skip_all)]
 pub async fn logout(
-    #[context] ctx: RpcContext,
-    #[request] req: &RequestParts,
+    ctx: RpcContext,
+    LogoutParams { session }: LogoutParams,
 ) -> Result<Option<HasLoggedOutSessions>, Error> {
-    let auth = match HashSessionToken::from_request_parts(req) {
-        Err(_) => return Ok(None),
-        Ok(a) => a,
-    };
-    Ok(Some(HasLoggedOutSessions::new(vec![auth], &ctx).await?))
+    Ok(Some(
+        HasLoggedOutSessions::new(vec![HashSessionToken::from_token(session)], &ctx).await?,
+    ))
 }

 #[derive(Deserialize, Serialize)]
@@ -211,16 +242,31 @@ pub struct SessionList {
    sessions: BTreeMap<String, Session>,
 }

-#[command(subcommands(list, kill))]
-pub async fn session() -> Result<(), Error> {
-    Ok(())
+pub fn session() -> ParentHandler {
+    ParentHandler::new()
+        .subcommand(
+            "list",
+            from_fn_async(list)
+                .with_metadata("get-session", Value::Bool(true))
+                .with_display_serializable()
+                .with_custom_display_fn::<AnyContext, _>(|handle, result| {
+                    Ok(display_sessions(handle.params, result))
+                })
+                .with_remote_cli::<CliContext>(),
+        )
+        .subcommand(
+            "kill",
+            from_fn_async(kill)
+                .no_display()
+                .with_remote_cli::<CliContext>(),
+        )
 }

-fn display_sessions(arg: SessionList, matches: &ArgMatches) {
+fn display_sessions(params: WithIoFormat<ListParams>, arg: SessionList) {
    use prettytable::*;

-    if matches.is_present("format") {
-        return display_serializable(arg, matches);
+    if let Some(format) = params.format {
+        return display_serializable(format, arg);
    }

    let mut table = Table::new();
@@ -249,17 +295,22 @@ fn display_sessions(arg: SessionList, matches: &ArgMatches) {
    table.print_tty(false).unwrap();
 }

-#[command(display(display_sessions))]
+#[derive(Deserialize, Serialize, Parser)]
+#[serde(rename_all = "kebab-case")]
+#[command(rename_all = "kebab-case")]
+pub struct ListParams {
+    #[arg(skip)]
+    session: InternedString,
+}
+
+// #[command(display(display_sessions))]
 #[instrument(skip_all)]
 pub async fn list(
-    #[context] ctx: RpcContext,
-    #[request] req: &RequestParts,
-    #[allow(unused_variables)]
-    #[arg(long = "format")]
-    format: Option<IoFormat>,
+    ctx: RpcContext,
+    ListParams { session, .. }: ListParams,
 ) -> Result<SessionList, Error> {
    Ok(SessionList {
-        current: HashSessionToken::from_request_parts(req)?.as_hash(),
+        current: HashSessionToken::from_token(session).hashed().to_owned(),
        sessions: sqlx::query!(
            "SELECT * FROM session WHERE logged_out IS NULL OR logged_out > CURRENT_TIMESTAMP"
        )
@@ -287,29 +338,50 @@ fn parse_comma_separated(arg: &str, _: &ArgMatches) -> Result<Vec<String>, RpcEr
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
-struct KillSessionId(String);
+struct KillSessionId(InternedString);
+
+impl KillSessionId {
+    fn new(id: String) -> Self {
+        Self(InternedString::from(id))
+    }
+}

 impl AsLogoutSessionId for KillSessionId {
-    fn as_logout_session_id(self) -> String {
+    fn as_logout_session_id(self) -> InternedString {
        self.0
    }
 }

-#[command(display(display_none))]
+#[derive(Deserialize, Serialize, Parser)]
+#[serde(rename_all = "kebab-case")]
+#[command(rename_all = "kebab-case")]
+pub struct KillParams {
+    ids: Vec<String>,
+}
+
 #[instrument(skip_all)]
-pub async fn kill(
-    #[context] ctx: RpcContext,
-    #[arg(parse(parse_comma_separated))] ids: Vec<String>,
-) -> Result<(), Error> {
-    HasLoggedOutSessions::new(ids.into_iter().map(KillSessionId), &ctx).await?;
+pub async fn kill(ctx: RpcContext, KillParams { ids }: KillParams) -> Result<(), Error> {
+    HasLoggedOutSessions::new(ids.into_iter().map(KillSessionId::new), &ctx).await?;
    Ok(())
 }

+#[derive(Deserialize, Serialize, Parser)]
+#[serde(rename_all = "kebab-case")]
+#[command(rename_all = "kebab-case")]
+pub struct ResetPasswordParams {
+    #[arg(name = "old-password")]
+    old_password: Option<PasswordType>,
+    #[arg(name = "new-password")]
+    new_password: Option<PasswordType>,
+}
+
 #[instrument(skip_all)]
 async fn cli_reset_password(
    ctx: CliContext,
-    old_password: Option<PasswordType>,
-    new_password: Option<PasswordType>,
+    ResetPasswordParams {
+        old_password,
+        new_password,
+    }: ResetPasswordParams,
 ) -> Result<(), RpcError> {
    let old_password = if let Some(old_password) = old_password {
        old_password.decrypt(&ctx)?
@@ -331,28 +403,22 @@ async fn cli_reset_password(
        new_password
    };

-    rpc_toolkit::command_helpers::call_remote(
-        ctx,
+    ctx.call_remote(
        "auth.reset-password",
-        serde_json::json!({ "old-password": old_password, "new-password": new_password }),
-        PhantomData::<()>,
+        imbl_value::json!({ "old-password": old_password, "new-password": new_password }),
    )
-    .await?
-    .result?;
+    .await?;

    Ok(())
 }

-#[command(
-    rename = "reset-password",
-    custom_cli(cli_reset_password(async, context(CliContext))),
-    display(display_none)
-)]
 #[instrument(skip_all)]
-pub async fn reset_password(
-    #[context] ctx: RpcContext,
-    #[arg(rename = "old-password")] old_password: Option<PasswordType>,
-    #[arg(rename = "new-password")] new_password: Option<PasswordType>,
+pub async fn reset_password_impl(
+    ctx: RpcContext,
+    ResetPasswordParams {
+        old_password,
+        new_password,
+    }: ResetPasswordParams,
 ) -> Result<(), Error> {
    let old_password = old_password.unwrap_or_default().decrypt(&ctx)?;
    let new_password = new_password.unwrap_or_default().decrypt(&ctx)?;
@@ -378,13 +444,8 @@ pub async fn reset_password(
        .await
 }

-#[command(
-    rename = "get-pubkey",
-    display(display_none),
-    metadata(authenticated = false)
-)]
 #[instrument(skip_all)]
-pub async fn get_pubkey(#[context] ctx: RpcContext) -> Result<Jwk, RpcError> {
+pub async fn get_pubkey(ctx: RpcContext) -> Result<Jwk, RpcError> {
    let secret = ctx.as_ref().clone();
    let pub_key = secret.to_public_key()?;
    Ok(pub_key)