electron/company-backups.mjs
Rama main · réplica de lectura del repositorio original.
import { createHash, randomBytes } from "node:crypto";
import { createReadStream, createWriteStream } from "node:fs";
import { chmod, lstat, mkdir, mkdtemp, rm, statfs } from "node:fs/promises";
import { isAbsolute, join, parse, resolve } from "node:path";
import { Readable } from "node:stream";
import { pipeline } from "node:stream/promises";
const MAX_BYTES = 10 * 1024 ** 3;
const PART_BYTES = 64 * 1024 ** 2;
const SPACE_MARGIN = 64 * 1024 ** 2;
const MAGIC = Buffer.from("OMB-WORKSPACE-1\n");
const HEADER_BYTES = MAGIC.length + 16 + 12;
const MIN_BYTES = HEADER_BYTES + 16;
const UUID = /^[a-f\d]{8}-[a-f\d]{4}-4[a-f\d]{3}-[89ab][a-f\d]{3}-[a-f\d]{12}$/;
const HASH = /^[a-f\d]{64}$/;
const ETAG = /^(?:"[a-f\d]{32}"|[a-f\d]{32})$/;
const R2_HOST = /^(?:[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?\.)*[a-f\d]{32}(?:\.(?:eu|us|fedramp))?\.r2\.cloudflarestorage\.com$/;
const LOCAL = "/api/workspace-backup";
const CLOUD = "/api/desktop/backups";
export class CompanyBackupError extends Error {
constructor(code, message) { super(message); this.name = "CompanyBackupError"; this.code = code; }
}
const fail = (code, message) => { throw new CompanyBackupError(code, message); };
const record = value => value !== null && typeof value === "object" && !Array.isArray(value);
const archiveSize = value => Number.isSafeInteger(value) && value >= MIN_BYTES && value <= MAX_BYTES;
const identifier = value => typeof value === "string" && UUID.test(value);
const checkPassword = password => {
if (typeof password !== "string" || password.length < 12 || password.length > 1024) fail("invalid_password", "Use a backup password between 12 and 1,024 characters.");
};
const safeError = (error, signal) => {
if (error instanceof CompanyBackupError) return error;
if (signal?.aborted || error?.name === "AbortError") return new CompanyBackupError("cancelled", "The backup transfer was cancelled or timed out.");
if (error?.code === "ENOSPC") return new CompanyBackupError("no_space", "There is not enough free disk space for this backup transfer.");
if (error?.status === 401 || error?.status === 403) return new CompanyBackupError("access_changed", "Company access changed. Reconnect your desktop and try again.");
// Fetch/provider exceptions may contain signed URLs. Never forward them.
return new CompanyBackupError("transfer_failed", "The backup transfer could not be completed. Please try again.");
};
async function discard(response) { try { await response?.body?.cancel(); } catch {} }
// Node opens a read stream lazily; an open that fails after the temp dir is removed must not be uncaught, since the request outcome decides.
const bodyStream = (file, range) => createReadStream(file, { ...range, highWaterMark: 256 * 1024 }).on("error", () => {});
function signedUrl(value, allowLoopbackForTests) {
let url;
try { url = new URL(value); } catch { fail("invalid_response", "The backup service returned an invalid storage address."); }
const loopback = allowLoopbackForTests && ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname) && ["http:", "https:"].includes(url.protocol);
if (url.username || url.password || url.hash || (!loopback && (url.protocol !== "https:" || url.port || !R2_HOST.test(url.hostname)))) {
fail("invalid_response", "The backup service returned an unsupported storage address.");
}
return url.href;
}
function cloudMetadata(value, expectedStatus, expected) {
if (!record(value) || !identifier(value.id) || value.status !== expectedStatus || !archiveSize(value.sizeBytes) || typeof value.sha256 !== "string" || !HASH.test(value.sha256) ||
(expected && (value.id !== expected.id || value.sizeBytes !== expected.sizeBytes || value.sha256 !== expected.sha256))) {
fail("invalid_response", "The backup service returned inconsistent archive metadata.");
}
return { id: value.id, status: value.status, sizeBytes: value.sizeBytes, sha256: value.sha256,
passwordRequired: value.passwordRequired !== false,
...(typeof value.appVersion === "string" ? { appVersion: value.appVersion.slice(0, 64) } : {}),
...(Number.isSafeInteger(value.createdAt) ? { createdAt: value.createdAt } : {}),
...(Number.isSafeInteger(value.completedAt) ? { completedAt: value.completedAt } : {}),
};
}
function liveExpiry(value) {
if (!Number.isSafeInteger(value) || value <= Date.now() || value > Date.now() + 15 * 60_000) fail("invalid_response", "The storage link has expired or has an invalid lifetime. Try again.");
}
/** Transfer existing encrypted .ombbackup archives. Never commits a restore. */
export function createCompanyBackups({ localRequest, portalRequest, tempRoot, fetchImpl = fetch, allowLoopbackForTests = false, availableBytes }) {
if (typeof localRequest !== "function" || typeof portalRequest !== "function" || typeof fetchImpl !== "function" || typeof tempRoot !== "string" ||
!isAbsolute(tempRoot) || resolve(tempRoot) === parse(resolve(tempRoot)).root) throw new Error("A private backup transfer directory and request adapters are required.");
const freeBytes = availableBytes ?? (async path => { const disk = await statfs(path, { bigint: true }); return Number(disk.bavail * disk.bsize > BigInt(Number.MAX_SAFE_INTEGER) ? BigInt(Number.MAX_SAFE_INTEGER) : disk.bavail * disk.bsize); });
let operating = false;
async function checkSpace(path, required) {
const available = await freeBytes(path);
if (!Number.isFinite(available) || available < required + SPACE_MARGIN) fail("no_space", "There is not enough free disk space for this backup transfer and its temporary files.");
}
async function localJson(path, body, signal, preview = false) {
const response = await localRequest(path, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body), signal, redirect: "error" });
if (!response.ok) {
await discard(response);
if (response.status === 401 || response.status === 403) fail("access_changed", "Access to this installation changed. Reopen Backups and try again.");
if (preview && response.status === 400) fail("invalid_archive", "The backup password is incorrect, or the archive is damaged or unsupported. Nothing was restored.");
if ([409, 503].includes(response.status)) fail("workspace_busy", "Wait for this installation to finish its current work before backing up or restoring.");
fail("local_backup_failed", "The local backup operation could not be completed. Check Backups in the desktop app and try again.");
}
if (!response.body) fail("invalid_response", "The local backup service returned an empty response.");
const chunks = []; let bytes = 0;
for await (const chunk of Readable.fromWeb(response.body)) {
signal.throwIfAborted(); bytes += chunk.length;
if (bytes > 2 * 1024 ** 2) fail("invalid_response", "The local backup response was too large.");
chunks.push(chunk);
}
let result;
try { result = JSON.parse(Buffer.concat(chunks).toString("utf8")); } catch { fail("invalid_response", "The local backup service returned invalid metadata."); }
if (!record(result)) fail("invalid_response", "The local backup service returned invalid metadata.");
return result;
}
async function transferToFile(response, file, expectedBytes, signal, report, phase) {
const declared = response.headers.get("content-length");
if (!response.ok || response.status !== 200 || !response.body || (declared !== null && (!/^\d+$/.test(declared) || Number(declared) !== expectedBytes)) ||
(response.headers.has("content-encoding") && response.headers.get("content-encoding") !== "identity")) {
await discard(response); fail("invalid_archive", "The archive download has an invalid size or encoding.");
}
const hash = createHash("sha256"), prefix = Buffer.alloc(HEADER_BYTES);
let bytes = 0, checkedAt = 0;
await pipeline(Readable.fromWeb(response.body), async function* (source) {
for await (const chunk of source) {
signal.throwIfAborted();
if (bytes + chunk.length > expectedBytes) fail("invalid_archive", "The archive download exceeded its declared size.");
if (bytes < HEADER_BYTES) chunk.copy(prefix, bytes, 0, Math.min(chunk.length, HEADER_BYTES - bytes));
bytes += chunk.length; hash.update(chunk);
if (bytes - checkedAt >= PART_BYTES) { checkedAt = bytes; await checkSpace(file, expectedBytes - bytes); }
report(phase, bytes, expectedBytes); yield chunk;
}
}, createWriteStream(file, { flags: "wx", mode: 0o600 }), { signal });
if (bytes !== expectedBytes) fail("invalid_archive", "The archive download was incomplete.");
if (!prefix.subarray(0, MAGIC.length).equals(MAGIC)) fail("invalid_archive", "This is not a supported encrypted installation backup.");
return hash.digest("hex");
}
async function storageRequest(url, init) {
const response = await fetchImpl(url, { ...init, redirect: "error", credentials: "omit", referrerPolicy: "no-referrer" });
if (response.redirected || (response.url && response.url !== url)) { await discard(response); fail("invalid_response", "The backup storage request was redirected and was stopped."); }
return response;
}
async function run(signal, onProgress, work) {
if (operating) fail("busy", "Another cloud backup transfer is in progress.");
operating = true;
const operationSignal = signal ? AbortSignal.any([signal, AbortSignal.timeout(24 * 3600_000)]) : AbortSignal.timeout(24 * 3600_000);
let directory, result, failure, lastPhase = "", lastAt = 0;
const report = (phase, bytesTransferred = 0, totalBytes = 0) => {
if (phase === lastPhase && bytesTransferred !== totalBytes && Date.now() - lastAt < 250) return;
lastPhase = phase; lastAt = Date.now();
try { onProgress?.({ phase, bytesTransferred, totalBytes }); } catch {}
};
try {
operationSignal.throwIfAborted();
await mkdir(tempRoot, { recursive: true, mode: 0o700 });
const root = await lstat(tempRoot);
if (!root.isDirectory() || root.isSymbolicLink() || (process.platform !== "win32" && (root.mode & 0o077) !== 0)) fail("unsafe_directory", "Backup transfers require a private temporary directory.");
directory = await mkdtemp(join(tempRoot, "company-backup-"));
await chmod(directory, 0o700); await checkSpace(directory, 0);
result = await work(directory, operationSignal, report);
} catch (error) { failure = safeError(error, operationSignal); }
finally {
try { if (directory) await rm(directory, { recursive: true, force: true }); }
catch { failure = new CompanyBackupError("cleanup_failed", "The encrypted temporary transfer file could not be removed. Close the app and check its backup cache."); }
finally { operating = false; }
}
if (failure) throw failure;
return result;
}
return {
backup(input, signal, onProgress) {
return run(signal, onProgress, async (directory, operationSignal, report) => {
const password = randomBytes(32).toString("base64url");
const clientState = input?.clientState ?? {};
if (!record(clientState) || Object.values(clientState).some(value => typeof value !== "string") || Buffer.byteLength(JSON.stringify(clientState)) > 2 * 1024 ** 2) fail("invalid_preferences", "Saved desktop preferences exceed the supported backup limit.");
report("exporting");
const exported = await localJson(`${LOCAL}/export`, { password, clientState }, operationSignal);
if (!identifier(exported.id) || !archiveSize(exported.bytes)) fail("invalid_archive", "The exported encrypted archive must contain no more than 10 GiB.");
const appVersion = input.appVersion ?? exported.summary?.appVersion ?? "unknown";
if (typeof appVersion !== "string" || !/^[a-zA-Z\d][a-zA-Z\d ._+()-]{0,63}$/.test(appVersion)) fail("invalid_response", "The desktop app version is invalid.");
await checkSpace(directory, exported.bytes);
const response = await localRequest(`${LOCAL}/download/${exported.id}`, { method: "GET", signal: operationSignal, redirect: "error" });
const file = join(directory, "workspace.ombbackup");
report("reading", 0, exported.bytes);
const sha256 = await transferToFile(response, file, exported.bytes, operationSignal, report, "reading");
let pendingId = null;
try {
operationSignal.throwIfAborted();
const started = await portalRequest(CLOUD, { method: "POST", body: { sizeBytes: exported.bytes, sha256, appVersion, unlockKey: password }, signal: operationSignal });
if (identifier(started?.id)) pendingId = started.id;
const backup = cloudMetadata(started, "uploading");
if (backup.passwordRequired) fail("update_required", "Update your organization's Admin service to enable passwordless backups.");
if (backup.sizeBytes !== exported.bytes || backup.sha256 !== sha256 || started.partSizeBytes !== PART_BYTES || started.partCount !== Math.ceil(exported.bytes / PART_BYTES)) fail("invalid_response", "The backup service returned an invalid multipart plan.");
const parts = [];
report("uploading", 0, exported.bytes);
for (let partNumber = 1; partNumber <= started.partCount; partNumber++) {
operationSignal.throwIfAborted();
const start = (partNumber - 1) * PART_BYTES, sizeBytes = Math.min(PART_BYTES, exported.bytes - start);
const signed = await portalRequest(`${CLOUD}/${backup.id}/parts/${partNumber}`, { method: "POST", body: {}, signal: operationSignal });
if (!record(signed) || signed.partNumber !== partNumber || signed.sizeBytes !== sizeBytes || !record(signed.headers) ||
Object.keys(signed.headers).some(name => name.toLowerCase() !== "content-length") ||
new Headers(signed.headers).get("content-length") !== String(sizeBytes)) fail("invalid_response", "The backup service returned invalid upload instructions.");
liveExpiry(signed.expiresAt);
const url = signedUrl(signed.url, allowLoopbackForTests), stream = bodyStream(file, { start, end: start + sizeBytes - 1 });
let uploaded;
try { uploaded = await storageRequest(url, { method: "PUT", headers: { "content-length": String(sizeBytes) }, body: stream, duplex: "half", signal: operationSignal }); }
finally { stream.destroy(); }
const etag = uploaded.headers.get("etag");
const accepted = uploaded.ok; await discard(uploaded);
if (!accepted || !etag || !ETAG.test(etag)) fail("upload_failed", "A backup part could not be uploaded and verified. Try the backup again.");
parts.push({ partNumber, etag }); report("uploading", start + sizeBytes, exported.bytes);
}
report("completing", exported.bytes, exported.bytes);
const completed = await portalRequest(`${CLOUD}/${backup.id}/complete`, { method: "POST", body: { parts }, signal: operationSignal });
const result = cloudMetadata(completed, "ready", backup);
if (result.passwordRequired) fail("invalid_response", "The backup service did not retain the encryption key.");
pendingId = null; report("ready", exported.bytes, exported.bytes); return result;
} finally {
if (pendingId) {
try { await portalRequest(`${CLOUD}/${pendingId}/abort`, { method: "POST", body: {}, signal: AbortSignal.timeout(10_000) }); } catch {}
}
}
});
},
prepareRestore(input, signal, onProgress) {
return run(signal, onProgress, async (directory, operationSignal, report) => {
if (!identifier(input?.id)) fail("invalid_archive", "Select a valid cloud backup.");
const signed = await portalRequest(`${CLOUD}/${input.id}/download`, { method: "POST", body: {}, signal: operationSignal });
const backup = cloudMetadata(signed, "ready");
// Keys stay in the native process, never in the renderer or object URL.
const password = backup.passwordRequired ? input.password : signed.unlockKey;
checkPassword(password);
if (backup.id !== input.id) fail("invalid_response", "The backup service returned a different archive.");
liveExpiry(signed.expiresAt);
const url = signedUrl(signed.url, allowLoopbackForTests);
// Version 1 is uncompressed tar: transfer, upload, decrypted tar and staging can coexist during preview.
await checkSpace(directory, backup.sizeBytes * 4);
report("downloading", 0, backup.sizeBytes);
const downloaded = await storageRequest(url, { method: "GET", signal: operationSignal });
const file = join(directory, "workspace.ombbackup");
const sha256 = await transferToFile(downloaded, file, backup.sizeBytes, operationSignal, report, "downloading");
report("validating", backup.sizeBytes, backup.sizeBytes);
if (sha256 !== backup.sha256) fail("checksum_mismatch", "The downloaded backup checksum did not match. Nothing was uploaded locally or restored.");
await checkSpace(directory, backup.sizeBytes * 3); operationSignal.throwIfAborted();
report("preparing", 0, backup.sizeBytes);
const stream = bodyStream(file);
let response;
try { response = await localRequest(`${LOCAL}/upload`, { method: "POST", headers: { "content-type": "application/octet-stream", "content-length": String(backup.sizeBytes) }, body: stream, duplex: "half", signal: operationSignal, redirect: "error" }); }
finally { stream.destroy(); }
if (!response.ok) { await discard(response); fail("local_backup_failed", "The verified archive could not be staged in this installation."); }
const receipt = await readUploadReceipt(response, operationSignal);
if (!identifier(receipt.id)) fail("invalid_response", "This installation returned an invalid upload receipt.");
await checkSpace(directory, backup.sizeBytes * 2); operationSignal.throwIfAborted();
const preview = await localJson(`${LOCAL}/preview`, { id: receipt.id, password }, operationSignal, true);
if (!identifier(preview.id) || !record(preview.summary) || preview.summary.format !== "openmaus.workspace-backup" || preview.summary.version !== 1 ||
!identifier(preview.summary.id) || !Number.isSafeInteger(preview.summary.bytes) || preview.summary.bytes < 0 || preview.summary.bytes > MAX_BYTES) fail("invalid_response", "This installation returned an invalid restore preview.");
report("ready", backup.sizeBytes, backup.sizeBytes);
return { id: preview.id, summary: preview.summary };
});
},
};
}
async function readUploadReceipt(response, signal) {
if (!response.body) fail("invalid_response", "This installation returned an empty upload receipt.");
const chunks = []; let bytes = 0;
for await (const chunk of Readable.fromWeb(response.body)) {
signal.throwIfAborted(); bytes += chunk.length;
if (bytes > 4096) fail("invalid_response", "The local upload receipt was too large.");
chunks.push(chunk);
}
try { const value = JSON.parse(Buffer.concat(chunks).toString("utf8")); if (record(value)) return value; } catch {}
fail("invalid_response", "This installation returned an invalid upload receipt.");
}