Raven Scott
15209b4837
- Add bare-os-hrpc-allowlist.js; wire stock bareOsHrpcRequest + bareOsHrpcAllowlistProbe; passthrough BARE_OS_HRPC_ALLOWLIST_JSON and operator env for snapshot/blind-relay/mirror/pear-doctor - Merge BARE_OS_CORESTORE_SNAPSHOT_WORKFLOW_JSON into bareOsReadSnapshotHintsJson (match proc) - Shell: pipefail runs all pipeline stages; aggregate first non-zero exit after assign prefixes - mv: stage renames via vfs.resolveLogical so temp files stay in writable destination dir - coreutils: POSIX-style split suffixes past zz; xargs doc for -P vs host subprocess - identity-session: stable Error.code for no-account / passphrase failures - Docs: KERNEL_CONTRACT, POSIX profile, handbook 5/7/9, kernel-extensions strict-boot table, env appendix, developer-guide + scripts README, protocol/booter CHANGELOGs; hrpc allowlist schema - Tests: hrpc allowlist, pear_doctor schema 2, split suffix, pipefail pipeline; fix PLACEHOLDER_BASELINE link Pretest: refreshed kernel bins, man.json, posix dashboard, bundle health, seeder parity
40 lines
1.2 KiB
JavaScript
40 lines
1.2 KiB
JavaScript
/**
|
|
* Parse optional **`BARE_OS_HRPC_ALLOWLIST_JSON`** for stock **`ctx.bareOsHrpcRequest`**.
|
|
* @param {string} raw
|
|
* @returns {{ allow: Set<string> | null, parseError: boolean }}
|
|
*/
|
|
export function parseBareOsHrpcAllowlistJson(raw) {
|
|
const s = String(raw || '').trim()
|
|
if (!s) return { allow: null, parseError: false }
|
|
try {
|
|
const parsed = JSON.parse(s)
|
|
/** @type {Set<string>} */
|
|
const allow = new Set()
|
|
if (Array.isArray(parsed)) {
|
|
for (const v of parsed) {
|
|
const x = String(v || '').trim()
|
|
if (x) allow.add(x)
|
|
}
|
|
} else if (parsed && typeof parsed === 'object') {
|
|
for (const [k, v] of Object.entries(parsed)) {
|
|
if (v) allow.add(String(k).trim())
|
|
}
|
|
}
|
|
return { allow: allow.size > 0 ? allow : null, parseError: false }
|
|
} catch {
|
|
return { allow: null, parseError: true }
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @param {Set<string> | null} allow
|
|
* @param {string} svc
|
|
* @param {string} method
|
|
* @returns {boolean} true when the route is denied by a non-empty allowlist
|
|
*/
|
|
export function bareOsHrpcAllowlistDeniesRoute(allow, svc, method) {
|
|
if (!allow || allow.size === 0) return false
|
|
const key = `${svc}.${method}`
|
|
return !allow.has('*') && !allow.has(`${svc}.*`) && !allow.has(key)
|
|
}
|