65 lines
2.1 KiB
TypeScript
65 lines
2.1 KiB
TypeScript
import type {
|
|
EnabledJavaScriptReplayPolicy,
|
|
JavaScriptReplayPolicy,
|
|
} from "../application/JavaScriptReplayPlanning.js";
|
|
import { ConfigurationError } from "../domain/errors.js";
|
|
import type { PermissionCeiling } from "../domain/permissionPolicy.js";
|
|
import { err, ok, type Result } from "../domain/result.js";
|
|
import type { Environment } from "./environment.js";
|
|
import { parseAbsoluteRoots } from "./parsers.js";
|
|
import { permissionScope } from "./permissions.js";
|
|
|
|
/** Parse controlled replay configuration into disabled or fully enabled state. */
|
|
export const parseJavaScriptReplayPolicy = (
|
|
env: Environment,
|
|
): Result<JavaScriptReplayPolicy, ConfigurationError> => {
|
|
const roots = parseAbsoluteRoots(
|
|
env.REA_JAVASCRIPT_REPLAY_ROOTS_JSON,
|
|
"REA_JAVASCRIPT_REPLAY_ROOTS_JSON",
|
|
);
|
|
if (!roots.ok) return roots;
|
|
if (env.REA_JAVASCRIPT_REPLAY_ENABLED !== "true")
|
|
return ok({ status: "disabled" });
|
|
const [firstRoot, ...remainingRoots] = roots.value;
|
|
if (firstRoot === undefined)
|
|
return err(
|
|
new ConfigurationError(
|
|
"REA_JAVASCRIPT_REPLAY_ROOTS_JSON must encode at least one absolute root when JavaScript replay is enabled",
|
|
),
|
|
);
|
|
return ok({
|
|
status: "enabled",
|
|
roots: [firstRoot, ...remainingRoots],
|
|
nodePath: env.REA_JAVASCRIPT_REPLAY_NODE_PATH,
|
|
bubblewrapPath: env.REA_JAVASCRIPT_REPLAY_BWRAP_PATH,
|
|
systemdRunPath: env.REA_JAVASCRIPT_REPLAY_SYSTEMD_RUN_PATH,
|
|
systemctlPath: env.REA_JAVASCRIPT_REPLAY_SYSTEMCTL_PATH,
|
|
shellPath: env.REA_JAVASCRIPT_REPLAY_SHELL_PATH,
|
|
});
|
|
};
|
|
|
|
/** Add the exact controlled replay ceiling when replay is enabled. */
|
|
export const appendJavaScriptReplayCeiling = (
|
|
ceilings: PermissionCeiling[],
|
|
policy: JavaScriptReplayPolicy,
|
|
): void => {
|
|
if (policy.status === "disabled") return;
|
|
ceilings.push(
|
|
permissionScope("javascript_replay", policy.roots, {
|
|
executables: replayExecutables(policy),
|
|
network: "none",
|
|
mount: true,
|
|
}),
|
|
);
|
|
};
|
|
|
|
const replayExecutables = (
|
|
policy: EnabledJavaScriptReplayPolicy,
|
|
): readonly string[] => [
|
|
policy.nodePath,
|
|
policy.bubblewrapPath,
|
|
policy.systemdRunPath,
|
|
policy.systemctlPath,
|
|
policy.shellPath,
|
|
];
|