let mac re-prompt + modularize more code.
This commit is contained in:
KingKDot
@@ -0,0 +1,225 @@
|
||||
import { v4 as uuidv4 } from "uuid";
|
||||
import { authenticateRequest } from "../../auth";
|
||||
import { AuditAction, logAudit } from "../../auditLog";
|
||||
import * as clientManager from "../../clientManager";
|
||||
import { deleteClientRow } from "../../db";
|
||||
import { metrics } from "../../metrics";
|
||||
import { encodeMessage } from "../../protocol";
|
||||
import { requireClientAccess, requireFeatureAccess, requirePermission } from "../../rbac";
|
||||
import { clearThumbnail } from "../../thumbnails";
|
||||
|
||||
type RequestIpProvider = {
|
||||
requestIP: (req: Request) => { address?: string } | null | undefined;
|
||||
};
|
||||
|
||||
type PendingScript = {
|
||||
resolve: (result: any) => void;
|
||||
reject: (error: any) => void;
|
||||
timeout: NodeJS.Timeout;
|
||||
clientId: string;
|
||||
};
|
||||
|
||||
type PendingCommandReply = {
|
||||
resolve: (result: { ok: boolean; message?: string }) => void;
|
||||
reject: (error: Error) => void;
|
||||
timeout: NodeJS.Timeout;
|
||||
clientId: string;
|
||||
};
|
||||
|
||||
type ClientCommandDeps = {
|
||||
CORS_HEADERS: Record<string, string>;
|
||||
pendingScripts: Map<string, PendingScript>;
|
||||
pendingCommandReplies: Map<string, PendingCommandReply>;
|
||||
};
|
||||
|
||||
export async function handleClientCommandRoute(
|
||||
req: Request,
|
||||
url: URL,
|
||||
server: RequestIpProvider,
|
||||
deps: ClientCommandDeps,
|
||||
): Promise<Response | null> {
|
||||
if (req.method !== "POST") return null;
|
||||
const cmdMatch = url.pathname.match(/^\/api\/clients\/(.+)\/command$/);
|
||||
if (!cmdMatch) return null;
|
||||
|
||||
const user = await authenticateRequest(req);
|
||||
if (!user) return new Response("Unauthorized", { status: 401 });
|
||||
|
||||
try {
|
||||
requirePermission(user, "clients:control");
|
||||
} catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
|
||||
const targetId = cmdMatch[1];
|
||||
try {
|
||||
requireClientAccess(user, targetId);
|
||||
} catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
|
||||
const target = clientManager.getClient(targetId);
|
||||
const ip = server.requestIP(req)?.address || "unknown";
|
||||
|
||||
if (!target) return new Response("Not found", { status: 404 });
|
||||
|
||||
try {
|
||||
const body = await req.json();
|
||||
const action = body?.action;
|
||||
let success = true;
|
||||
|
||||
if (action === "ping") {
|
||||
const nonce = Date.now() + Math.floor(Math.random() * 1000);
|
||||
target.lastPingSent = Date.now();
|
||||
target.lastPingNonce = nonce;
|
||||
target.ws.send(encodeMessage({ type: "ping", ts: nonce }));
|
||||
} else if (action === "ping_bulk") {
|
||||
Math.max(1, Math.min(1000, Number(body?.count || 1)));
|
||||
} else if (action === "disconnect") {
|
||||
try {
|
||||
requirePermission(user, "clients:disconnect");
|
||||
requireFeatureAccess(user, "disconnect");
|
||||
} catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
target.ws.send(encodeMessage({ type: "command", commandType: "disconnect", id: uuidv4() }));
|
||||
metrics.recordCommand("disconnect");
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.DISCONNECT, targetClientId: targetId, success: true });
|
||||
} else if (action === "reconnect") {
|
||||
try {
|
||||
requirePermission(user, "clients:reconnect");
|
||||
requireFeatureAccess(user, "reconnect");
|
||||
} catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
target.ws.send(encodeMessage({ type: "command", commandType: "reconnect", id: uuidv4() }));
|
||||
metrics.recordCommand("reconnect");
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.RECONNECT, targetClientId: targetId, success: true });
|
||||
} else if (action === "screenshot") {
|
||||
target.ws.send(encodeMessage({ type: "command", commandType: "screenshot", id: uuidv4(), payload: { mode: "notification", allDisplays: true } }));
|
||||
metrics.recordCommand("screenshot");
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.SCREENSHOT, targetClientId: targetId, success: true });
|
||||
} else if (action === "desktop_start") {
|
||||
target.ws.send(encodeMessage({ type: "command", commandType: "desktop_start", id: uuidv4() }));
|
||||
metrics.recordCommand("desktop_start");
|
||||
} else if (action === "script_exec") {
|
||||
const scriptContent = body?.script || "";
|
||||
const scriptType = body?.scriptType || "powershell";
|
||||
const cmdId = uuidv4();
|
||||
|
||||
const resultPromise = new Promise((resolve, reject) => {
|
||||
const timeout = setTimeout(() => {
|
||||
deps.pendingScripts.delete(cmdId);
|
||||
reject(new Error("Script execution timed out after 5 minutes"));
|
||||
}, 5 * 60 * 1000);
|
||||
deps.pendingScripts.set(cmdId, { resolve, reject, timeout, clientId: targetId });
|
||||
});
|
||||
|
||||
target.ws.send(encodeMessage({ type: "command", commandType: "script_exec", id: cmdId, payload: { script: scriptContent, type: scriptType } }));
|
||||
metrics.recordCommand("script_exec");
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.SCRIPT_EXECUTE, targetClientId: targetId, success: true, details: `script_exec (${scriptType})` });
|
||||
|
||||
try {
|
||||
const result = await resultPromise;
|
||||
return Response.json(result);
|
||||
} catch (error: any) {
|
||||
return Response.json({ ok: false, error: error.message }, { status: 500 });
|
||||
}
|
||||
} else if (action === "voice_capabilities") {
|
||||
const cmdId = uuidv4();
|
||||
const replyPromise: Promise<{ ok: boolean; message?: string }> = new Promise((resolve, reject) => {
|
||||
const timeout = setTimeout(() => {
|
||||
deps.pendingCommandReplies.delete(cmdId);
|
||||
reject(new Error("Voice capability probe timed out"));
|
||||
}, 30_000);
|
||||
deps.pendingCommandReplies.set(cmdId, { resolve, reject, timeout, clientId: targetId });
|
||||
});
|
||||
|
||||
target.ws.send(encodeMessage({ type: "command", commandType: "voice_capabilities", id: cmdId }));
|
||||
|
||||
try {
|
||||
const result = await replyPromise;
|
||||
let caps: any = null;
|
||||
if (result.message) {
|
||||
try { caps = JSON.parse(result.message); } catch { caps = null; }
|
||||
}
|
||||
return Response.json({ ok: result.ok, capabilities: caps, response: result.message || "" }, { headers: deps.CORS_HEADERS });
|
||||
} catch (error: any) {
|
||||
return Response.json({ ok: false, error: error.message || "Voice capability probe failed" }, { status: 504 });
|
||||
}
|
||||
} else if (action === "silent_exec") {
|
||||
try {
|
||||
requirePermission(user, "clients:silent-exec");
|
||||
} catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
|
||||
const command = typeof body?.command === "string" ? body.command.trim() : "";
|
||||
const args = typeof body?.args === "string" ? body.args : "";
|
||||
const cwd = typeof body?.cwd === "string" ? body.cwd : "";
|
||||
|
||||
if (!command) return new Response("Bad request", { status: 400 });
|
||||
|
||||
const cmdId = uuidv4();
|
||||
target.ws.send(encodeMessage({ type: "command", commandType: "silent_exec", id: cmdId, payload: { command, args, cwd } }));
|
||||
metrics.recordCommand("silent_exec");
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.SILENT_EXECUTE, targetClientId: targetId, success: true, details: JSON.stringify({ command, args, cwd }) });
|
||||
} else if (action === "uninstall") {
|
||||
try {
|
||||
requirePermission(user, "clients:uninstall");
|
||||
requireFeatureAccess(user, "uninstall");
|
||||
} catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
target.ws.send(encodeMessage({ type: "command", commandType: "uninstall", id: uuidv4() }));
|
||||
metrics.recordCommand("uninstall");
|
||||
clientManager.deleteClient(targetId);
|
||||
deleteClientRow(targetId);
|
||||
clearThumbnail(targetId);
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.UNINSTALL, targetClientId: targetId, details: "Agent uninstall requested - persistence will be removed", success: true });
|
||||
} else if (action === "elevate") {
|
||||
try {
|
||||
requirePermission(user, "clients:elevate");
|
||||
} catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
|
||||
const password = typeof body?.password === "string" ? body.password : "";
|
||||
const cmdId = uuidv4();
|
||||
const replyPromise: Promise<{ ok: boolean; message?: string }> = new Promise((resolve, reject) => {
|
||||
const timeout = setTimeout(() => {
|
||||
deps.pendingCommandReplies.delete(cmdId);
|
||||
reject(new Error("Elevation timed out"));
|
||||
}, 30_000);
|
||||
deps.pendingCommandReplies.set(cmdId, { resolve, reject, timeout, clientId: targetId });
|
||||
});
|
||||
|
||||
target.ws.send(encodeMessage({ type: "command", commandType: "elevate", id: cmdId, payload: { password } }));
|
||||
metrics.recordCommand("elevate");
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, targetClientId: targetId, success: true, details: "elevate" });
|
||||
|
||||
try {
|
||||
const result = await replyPromise;
|
||||
return Response.json({ ok: result.ok, message: result.message || "" }, { headers: deps.CORS_HEADERS });
|
||||
} catch (error: any) {
|
||||
return Response.json({ ok: false, error: error.message || "Elevation failed" }, { status: 504 });
|
||||
}
|
||||
} else {
|
||||
success = false;
|
||||
return new Response("Bad request", { status: 400 });
|
||||
}
|
||||
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, targetClientId: targetId, details: action, success });
|
||||
return Response.json({ ok: true });
|
||||
} catch (error) {
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, targetClientId: targetId, success: false, errorMessage: String(error) });
|
||||
return new Response("Bad request", { status: 400 });
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,181 @@
|
||||
import { authenticateRequest } from "../../auth";
|
||||
import { AuditAction, logAudit } from "../../auditLog";
|
||||
import {
|
||||
clientExists,
|
||||
listGroups,
|
||||
getGroup,
|
||||
createGroup,
|
||||
updateGroup,
|
||||
deleteGroup,
|
||||
setClientGroup,
|
||||
} from "../../db";
|
||||
import { requireClientAccess, requireFeatureAccess, requirePermission } from "../../rbac";
|
||||
import { canUserAccessClient } from "../../users";
|
||||
import { notifyDashboardViewers } from "../../sessions/sessionManager";
|
||||
|
||||
type RequestIpProvider = {
|
||||
requestIP: (req: Request) => { address?: string } | null | undefined;
|
||||
};
|
||||
|
||||
type ClientGroupDeps = {
|
||||
CORS_HEADERS: Record<string, string>;
|
||||
};
|
||||
|
||||
export async function handleClientGroupRoutes(
|
||||
req: Request,
|
||||
url: URL,
|
||||
server: RequestIpProvider,
|
||||
deps: ClientGroupDeps,
|
||||
): Promise<Response | null> {
|
||||
if (!url.pathname.startsWith("/api/groups") &&
|
||||
url.pathname !== "/api/clients/bulk-group" &&
|
||||
!url.pathname.match(/^\/api\/clients\/[^/]+\/group$/)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (url.pathname === "/api/groups") {
|
||||
const user = await authenticateRequest(req);
|
||||
if (!user) return new Response("Unauthorized", { status: 401 });
|
||||
|
||||
if (req.method === "GET") {
|
||||
return Response.json({ groups: listGroups() }, { headers: deps.CORS_HEADERS });
|
||||
}
|
||||
|
||||
if (req.method === "POST") {
|
||||
try { requirePermission(user, "clients:control"); } catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
let body: any = {};
|
||||
try { body = await req.json(); } catch {
|
||||
return Response.json({ error: "Invalid JSON body" }, { status: 400 });
|
||||
}
|
||||
const name = typeof body?.name === "string" ? body.name.trim() : "";
|
||||
const color = typeof body?.color === "string" ? body.color.trim() : "#3b82f6";
|
||||
if (!name || name.length > 64) {
|
||||
return Response.json({ error: "Name is required and must be 64 characters or fewer" }, { status: 400 });
|
||||
}
|
||||
if (!/^#[0-9a-fA-F]{6}$/.test(color)) {
|
||||
return Response.json({ error: "Color must be a valid hex code (#RRGGBB)" }, { status: 400 });
|
||||
}
|
||||
const group = createGroup(name, color);
|
||||
const ip = server.requestIP(req)?.address || "unknown";
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, details: `create_group:${name}`, success: true });
|
||||
return Response.json(group, { status: 201, headers: deps.CORS_HEADERS });
|
||||
}
|
||||
}
|
||||
|
||||
const groupIdMatch = url.pathname.match(/^\/api\/groups\/(\d+)$/);
|
||||
if (groupIdMatch) {
|
||||
const user = await authenticateRequest(req);
|
||||
if (!user) return new Response("Unauthorized", { status: 401 });
|
||||
try { requirePermission(user, "clients:control"); } catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
const groupId = Number(groupIdMatch[1]);
|
||||
|
||||
if (req.method === "PATCH") {
|
||||
let body: any = {};
|
||||
try { body = await req.json(); } catch {
|
||||
return Response.json({ error: "Invalid JSON body" }, { status: 400 });
|
||||
}
|
||||
const existing = getGroup(groupId);
|
||||
if (!existing) return Response.json({ error: "Group not found" }, { status: 404 });
|
||||
const name = typeof body?.name === "string" ? body.name.trim() : existing.name;
|
||||
const color = typeof body?.color === "string" ? body.color.trim() : existing.color;
|
||||
if (name.length === 0 || name.length > 64) {
|
||||
return Response.json({ error: "Name must be 1-64 characters" }, { status: 400 });
|
||||
}
|
||||
if (!/^#[0-9a-fA-F]{6}$/.test(color)) {
|
||||
return Response.json({ error: "Color must be a valid hex code (#RRGGBB)" }, { status: 400 });
|
||||
}
|
||||
const updated = updateGroup(groupId, name, color);
|
||||
if (!updated) return Response.json({ error: "Group not found" }, { status: 404 });
|
||||
notifyDashboardViewers();
|
||||
const ip = server.requestIP(req)?.address || "unknown";
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, details: `update_group:${groupId}`, success: true });
|
||||
return Response.json({ ok: true, id: groupId, name, color }, { headers: deps.CORS_HEADERS });
|
||||
}
|
||||
|
||||
if (req.method === "DELETE") {
|
||||
const deleted = deleteGroup(groupId);
|
||||
if (!deleted) return Response.json({ error: "Group not found" }, { status: 404 });
|
||||
notifyDashboardViewers();
|
||||
const ip = server.requestIP(req)?.address || "unknown";
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, details: `delete_group:${groupId}`, success: true });
|
||||
return Response.json({ ok: true }, { headers: deps.CORS_HEADERS });
|
||||
}
|
||||
}
|
||||
|
||||
if (req.method === "PATCH" && url.pathname === "/api/clients/bulk-group") {
|
||||
const user = await authenticateRequest(req);
|
||||
if (!user) return new Response("Unauthorized", { status: 401 });
|
||||
try { requirePermission(user, "clients:metadata"); requireFeatureAccess(user, "client_metadata"); } catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
let body: any = {};
|
||||
try { body = await req.json(); } catch {
|
||||
return Response.json({ error: "Invalid JSON body" }, { status: 400 });
|
||||
}
|
||||
const clientIds = body?.clientIds;
|
||||
if (!Array.isArray(clientIds) || clientIds.length === 0 || clientIds.some((id: any) => typeof id !== "string")) {
|
||||
return Response.json({ error: "clientIds must be a non-empty array of strings" }, { status: 400 });
|
||||
}
|
||||
if (clientIds.length > 500) {
|
||||
return Response.json({ error: "Too many clients (max 500)" }, { status: 400 });
|
||||
}
|
||||
const groupId = body?.groupId === null ? null : Number(body?.groupId);
|
||||
if (groupId !== null && (isNaN(groupId) || groupId < 1)) {
|
||||
return Response.json({ error: "Invalid groupId" }, { status: 400 });
|
||||
}
|
||||
let updated = 0;
|
||||
for (const cid of clientIds) {
|
||||
if (!canUserAccessClient(user.userId, user.role, cid)) continue;
|
||||
if (setClientGroup(cid, groupId)) updated++;
|
||||
}
|
||||
notifyDashboardViewers();
|
||||
const ip = server.requestIP(req)?.address || "unknown";
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, details: `bulk_set_group:${groupId ?? "none"}:${updated}/${clientIds.length}`, success: true });
|
||||
return Response.json({ ok: true, updated, total: clientIds.length, groupId }, { headers: deps.CORS_HEADERS });
|
||||
}
|
||||
|
||||
const clientGroupMatch = url.pathname.match(/^\/api\/clients\/([^/]+)\/group$/);
|
||||
if (req.method === "PATCH" && clientGroupMatch) {
|
||||
const user = await authenticateRequest(req);
|
||||
if (!user) return new Response("Unauthorized", { status: 401 });
|
||||
try { requirePermission(user, "clients:metadata"); requireFeatureAccess(user, "client_metadata"); } catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
const targetId = clientGroupMatch[1];
|
||||
try {
|
||||
requireClientAccess(user, targetId);
|
||||
} catch (error) {
|
||||
if (error instanceof Response) return error;
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
}
|
||||
if (!clientExists(targetId)) {
|
||||
return Response.json({ error: "Client not found" }, { status: 404 });
|
||||
}
|
||||
let body: any = {};
|
||||
try { body = await req.json(); } catch {
|
||||
return Response.json({ error: "Invalid JSON body" }, { status: 400 });
|
||||
}
|
||||
const groupId = body?.groupId === null ? null : Number(body?.groupId);
|
||||
if (groupId !== null && (isNaN(groupId) || groupId < 1)) {
|
||||
return Response.json({ error: "Invalid groupId" }, { status: 400 });
|
||||
}
|
||||
const updated = setClientGroup(targetId, groupId);
|
||||
if (!updated) {
|
||||
return Response.json({ error: "Client not found or group does not exist" }, { status: 404 });
|
||||
}
|
||||
notifyDashboardViewers();
|
||||
const ip = server.requestIP(req)?.address || "unknown";
|
||||
logAudit({ timestamp: Date.now(), username: user.username, ip, action: AuditAction.COMMAND, targetClientId: targetId, details: groupId ? `set_group:${groupId}` : "clear_group", success: true });
|
||||
return Response.json({ ok: true, groupId }, { headers: deps.CORS_HEADERS });
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user