From 337573378919c3ace3083619b3b977bfee1396e2 Mon Sep 17 00:00:00 2001 From: TomyJan Date: Thu, 21 May 2026 02:18:42 +0800 Subject: [PATCH] fix: resolve backend build errors, preserve sudo file read buffers, and format code (#798) * fix: resolve backend TypeScript build errors and preserve sudo file read buffers * style: format code * fix: ssh2 ESM import failure --------- Co-authored-by: LukeGus Co-authored-by: Claude Sonnet 4.6 --- docker/docker-compose.yml | 1 - electron/main.cjs | 89 ++++++++++++------- index.html | 4 +- src/backend/ssh/docker.ts | 11 ++- src/backend/ssh/file-manager.ts | 47 +++++++--- src/backend/ssh/host-resolver.ts | 15 ++-- src/backend/ssh/server-stats.ts | 11 ++- src/backend/ssh/terminal.ts | 29 +++--- src/backend/ssh/tmux-helper.ts | 5 +- src/backend/starter.ts | 5 +- src/ui/auth/Auth.tsx | 25 +++++- src/ui/dashboard/DashboardTab.tsx | 12 ++- .../features/guacamole/GuacamoleDisplay.tsx | 6 +- src/ui/features/terminal/Terminal.tsx | 10 ++- 14 files changed, 176 insertions(+), 94 deletions(-) diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index dc42e76d..9a2db205 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -1,4 +1,3 @@ -services: services: termix: image: ghcr.io/lukegus/termix:latest diff --git a/electron/main.cjs b/electron/main.cjs index ce8602de..aceef2c9 100644 --- a/electron/main.cjs +++ b/electron/main.cjs @@ -563,12 +563,21 @@ async function clearElectronJwtCookiesAtStartup() { function getBackendPaths() { if (isDev) { const backendDir = path.join(appRoot, "dist", "backend", "backend"); - return { entryPath: path.join(backendDir, "starter.js"), backendCwd: backendDir }; + return { + entryPath: path.join(backendDir, "starter.js"), + backendCwd: backendDir, + }; } // fork() does not go through Electron's asar redirector — use the unpacked path - const unpackedRoot = appRoot.replace(/app\.asar(?!\.unpacked)/, "app.asar.unpacked"); + const unpackedRoot = appRoot.replace( + /app\.asar(?!\.unpacked)/, + "app.asar.unpacked", + ); const backendDir = path.join(unpackedRoot, "dist", "backend", "backend"); - return { entryPath: path.join(backendDir, "starter.js"), backendCwd: backendDir }; + return { + entryPath: path.join(backendDir, "starter.js"), + backendCwd: backendDir, + }; } function getBackendDataDir() { @@ -606,9 +615,10 @@ function startBackendServer() { logToFile(" backendCwd exists:", fs.existsSync(backendCwd)); backendProcess = fork(entryPath, [], { - cwd: fs.existsSync(backendCwd) && fs.statSync(backendCwd).isDirectory() - ? backendCwd - : dataDir, + cwd: + fs.existsSync(backendCwd) && fs.statSync(backendCwd).isDirectory() + ? backendCwd + : dataDir, env: { ...process.env, DATA_DIR: dataDir, @@ -1089,40 +1099,51 @@ ipcMain.handle("get-embedded-server-status", () => { }); // OIDC System Browser Authentication (RFC 8252) -ipcMain.handle("oidc-system-browser-auth", async (_event, authUrl, callbackPort) => { - const http = require("http"); +ipcMain.handle( + "oidc-system-browser-auth", + async (_event, authUrl, callbackPort) => { + const http = require("http"); - return new Promise((resolve, reject) => { - const server = http.createServer((req, res) => { - const url = new URL(req.url, `http://localhost:${callbackPort}`); - if (url.pathname === "/oidc-callback") { - const success = url.searchParams.get("success"); - const error = url.searchParams.get("error"); - const token = url.searchParams.get("token"); + return new Promise((resolve, reject) => { + const server = http.createServer((req, res) => { + const url = new URL(req.url, `http://localhost:${callbackPort}`); + if (url.pathname === "/oidc-callback") { + const success = url.searchParams.get("success"); + const error = url.searchParams.get("error"); + const token = url.searchParams.get("token"); - res.writeHead(200, { "Content-Type": "text/html" }); - res.end(`

${success === "true" ? "Authentication successful!" : "Authentication failed."}

You can close this tab and return to Termix.

`); + res.writeHead(200, { "Content-Type": "text/html" }); + res.end( + `

${success === "true" ? "Authentication successful!" : "Authentication failed."}

You can close this tab and return to Termix.

`, + ); - server.close(); - if (success === "true") { - resolve({ success: true, token }); - } else { - resolve({ success: false, error: error || "Authentication failed" }); + server.close(); + if (success === "true") { + resolve({ success: true, token }); + } else { + resolve({ + success: false, + error: error || "Authentication failed", + }); + } } - } - }); + }); - server.listen(callbackPort, "127.0.0.1", () => { - shell.openExternal(authUrl); - }); + server.listen(callbackPort, "127.0.0.1", () => { + shell.openExternal(authUrl); + }); - // Timeout after 5 minutes - setTimeout(() => { - server.close(); - reject(new Error("OIDC authentication timed out")); - }, 5 * 60 * 1000); - }); -}); + // Timeout after 5 minutes + setTimeout( + () => { + server.close(); + reject(new Error("OIDC authentication timed out")); + }, + 5 * 60 * 1000, + ); + }); + }, +); ipcMain.handle("get-server-config", () => { try { diff --git a/index.html b/index.html index f774a2b1..94725365 100644 --- a/index.html +++ b/index.html @@ -47,7 +47,9 @@ - +
diff --git a/src/backend/ssh/docker.ts b/src/backend/ssh/docker.ts index d8b6fc16..201ab6e1 100644 --- a/src/backend/ssh/docker.ts +++ b/src/backend/ssh/docker.ts @@ -139,10 +139,7 @@ async function resolveJumpHost( ): Promise { try { const hostResults = await SimpleDBOps.select( - getDb() - .select() - .from(hosts) - .where(eq(hosts.id, hostId)), + getDb().select().from(hosts).where(eq(hosts.id, hostId)), "ssh_data", userId, ); @@ -160,8 +157,10 @@ async function resolveJumpHost( const { SharedCredentialManager } = await import("../utils/shared-credential-manager.js"); const sharedCredManager = SharedCredentialManager.getInstance(); - const sharedCred = - await sharedCredManager.getSharedCredentialForUser(hostId, userId); + const sharedCred = await sharedCredManager.getSharedCredentialForUser( + hostId, + userId, + ); if (sharedCred) { return { ...host, diff --git a/src/backend/ssh/file-manager.ts b/src/backend/ssh/file-manager.ts index 93e02331..f95c45b0 100644 --- a/src/backend/ssh/file-manager.ts +++ b/src/backend/ssh/file-manager.ts @@ -454,21 +454,33 @@ function execWithSudo( command: string, sudoPassword: string, ): Promise<{ stdout: string; stderr: string; code: number }> { + return execWithSudoBuffer(session, command, sudoPassword).then((result) => ({ + stdout: result.stdout.toString("utf8"), + stderr: result.stderr, + code: result.code, + })); +} + +function execWithSudoBuffer( + session: SSHSession, + command: string, + sudoPassword: string, +): Promise<{ stdout: Buffer; stderr: string; code: number }> { return new Promise((resolve) => { const escapedPassword = sudoPassword.replace(/'/g, "'\"'\"'"); const sudoCommand = `echo '${escapedPassword}' | sudo -S ${command} 2>&1`; execChannel(session, sudoCommand, (err, stream) => { if (err) { - resolve({ stdout: "", stderr: err.message, code: 1 }); + resolve({ stdout: Buffer.alloc(0), stderr: err.message, code: 1 }); return; } - let stdout = ""; + const stdoutChunks: Buffer[] = []; let stderr = ""; stream.on("data", (chunk: Buffer) => { - stdout += chunk.toString(); + stdoutChunks.push(chunk); }); stream.stderr.on("data", (chunk: Buffer) => { @@ -476,12 +488,22 @@ function execWithSudo( }); stream.on("close", (code: number) => { - stdout = stdout.replace(/\[sudo\] password for .+?:\s*/g, ""); + let stdout = Buffer.concat(stdoutChunks); + const sudoPromptMatch = stdout + .toString("utf8", 0, Math.min(stdout.length, 256)) + .match(/^\[sudo\] password for .+?:\s*/); + if (sudoPromptMatch) { + stdout = stdout.subarray(Buffer.byteLength(sudoPromptMatch[0])); + } resolve({ stdout, stderr, code: code || 0 }); }); stream.on("error", (streamErr: Error) => { - resolve({ stdout, stderr: streamErr.message, code: 1 }); + resolve({ + stdout: Buffer.concat(stdoutChunks), + stderr: streamErr.message, + code: 1, + }); }); }); }); @@ -3098,22 +3120,25 @@ app.get("/ssh/file_manager/ssh/readFile", (req, res) => { .includes("permission denied"); if (isPermissionDenied && sshConn.sudoPassword) { - execWithSudo( + execWithSudoBuffer( sshConn, `cat '${escapedPath}'`, sshConn.sudoPassword, ) - .then(({ stdout, stderr, code: sudoCode }) => { - if (sudoCode !== 0) { + .then((result) => { + if (result.code !== 0) { return res.status(403).json({ - error: `Permission denied: ${stderr}`, + error: `Permission denied: ${result.stderr || result.stdout.toString("utf8")}`, needsSudo: true, }); } - const sudoData = Buffer.from(stdout, "utf8"); + + const sudoData = result.stdout; const isBinary = detectBinary(sudoData); res.json({ - content: isBinary ? sudoData.toString("base64") : stdout, + content: isBinary + ? sudoData.toString("base64") + : sudoData.toString("utf8"), isBinary, size: sudoData.length, }); diff --git a/src/backend/ssh/host-resolver.ts b/src/backend/ssh/host-resolver.ts index 844da398..110969b2 100644 --- a/src/backend/ssh/host-resolver.ts +++ b/src/backend/ssh/host-resolver.ts @@ -83,13 +83,12 @@ export async function resolveHostById( .select() .from(hostAccess) .where( - and( - eq(hostAccess.hostId, hostId), - eq(hostAccess.userId, userId), - ), + and(eq(hostAccess.hostId, hostId), eq(hostAccess.userId, userId)), ) .limit(1); - const overrideCredId = accessRecords[0]?.overrideCredentialId as number | null; + const overrideCredId = accessRecords[0]?.overrideCredentialId as + | number + | null; if (overrideCredId) { const userCreds = await SimpleDBOps.select( db @@ -113,7 +112,11 @@ export async function resolveHostById( if (!host.overrideCredentialUsername) { host.username = cred.username; } - host.authType = cred.key ? "key" : cred.password ? "password" : "none"; + host.authType = cred.key + ? "key" + : cred.password + ? "password" + : "none"; return host as unknown as SSHHost; } } diff --git a/src/backend/ssh/server-stats.ts b/src/backend/ssh/server-stats.ts index ef7e3538..cf400a5a 100644 --- a/src/backend/ssh/server-stats.ts +++ b/src/backend/ssh/server-stats.ts @@ -75,10 +75,7 @@ async function resolveJumpHost( ): Promise { try { const hostResults = await SimpleDBOps.select( - getDb() - .select() - .from(hosts) - .where(eq(hosts.id, hostId)), + getDb().select().from(hosts).where(eq(hosts.id, hostId)), "ssh_data", userId, ); @@ -96,8 +93,10 @@ async function resolveJumpHost( const { SharedCredentialManager } = await import("../utils/shared-credential-manager.js"); const sharedCredManager = SharedCredentialManager.getInstance(); - const sharedCred = - await sharedCredManager.getSharedCredentialForUser(hostId, userId); + const sharedCred = await sharedCredManager.getSharedCredentialForUser( + hostId, + userId, + ); if (sharedCred) { return { ...host, diff --git a/src/backend/ssh/terminal.ts b/src/backend/ssh/terminal.ts index 305bb12e..50892ad9 100644 --- a/src/backend/ssh/terminal.ts +++ b/src/backend/ssh/terminal.ts @@ -1,15 +1,14 @@ import { WebSocketServer, WebSocket, type RawData } from "ws"; -import ssh2pkg from "ssh2"; -const { Client, BaseAgent, utils: ssh2Utils } = ssh2pkg; -import type { - Client as ClientType, - ClientChannel, - PseudoTtyOptions, - ParsedKey, - SignCallback, - SigningRequestOptions, - IdentityCallback, +import ssh2Pkg, { + type Client as SSHClientType, + type ClientChannel, + type PseudoTtyOptions, + type ParsedKey, + type SignCallback, + type SigningRequestOptions, + type IdentityCallback, } from "ssh2"; +const { Client, BaseAgent, utils: ssh2Utils } = ssh2Pkg; import net from "net"; import dgram from "dgram"; import { SSH_ALGORITHMS } from "../utils/ssh-algorithms.js"; @@ -273,13 +272,13 @@ async function createJumpHostChain( jumpHosts: Array<{ hostId: number }>, userId: string, socks5Config?: SOCKS5Config | null, -): Promise { +): Promise { if (!jumpHosts || jumpHosts.length === 0) { return null; } - let currentClient: ClientType | null = null; - const clients: ClientType[] = []; + let currentClient: SSHClientType | null = null; + const clients: SSHClientType[] = []; try { const jumpHostConfigs = await Promise.all( @@ -560,9 +559,9 @@ wss.on("connection", async (ws: WebSocket, req) => { }); let currentSessionId: string | null = null; - let sshConn: ClientType | null = null; + let sshConn: SSHClientType | null = null; let sshStream: ClientChannel | null = null; - let lastJumpClient: ClientType | null = null; + let lastJumpClient: SSHClientType | null = null; let keyboardInteractiveFinish: ((responses: string[]) => void) | null = null; let totpPromptSent = false; let totpTimeout: NodeJS.Timeout | null = null; diff --git a/src/backend/ssh/tmux-helper.ts b/src/backend/ssh/tmux-helper.ts index 424022c7..31677ff6 100644 --- a/src/backend/ssh/tmux-helper.ts +++ b/src/backend/ssh/tmux-helper.ts @@ -124,7 +124,10 @@ export async function waitForTmuxSession( const deadline = Date.now() + timeoutMs; while (Date.now() < deadline) { try { - await execCommand(conn, `tmux has-session -t ${shellEscape(sessionName)} 2>/dev/null`); + await execCommand( + conn, + `tmux has-session -t ${shellEscape(sessionName)} 2>/dev/null`, + ); return sessionName; } catch { // session not ready yet diff --git a/src/backend/starter.ts b/src/backend/starter.ts index 4569534f..7685a7dc 100644 --- a/src/backend/starter.ts +++ b/src/backend/starter.ts @@ -199,9 +199,8 @@ import { operation: "shutdown", }); try { - const { saveMemoryDatabaseToFile } = await import( - "./database/db/index.js" - ); + const { saveMemoryDatabaseToFile } = + await import("./database/db/index.js"); await saveMemoryDatabaseToFile(); systemLogger.info("Database saved to disk before exit", { operation: "shutdown_db_saved", diff --git a/src/ui/auth/Auth.tsx b/src/ui/auth/Auth.tsx index 7bbb7fa5..f5486f5b 100644 --- a/src/ui/auth/Auth.tsx +++ b/src/ui/auth/Auth.tsx @@ -654,13 +654,32 @@ export function Auth({ onLogin }: AuthProps) { setOidcLoading(true); try { if (isElectron()) { - const electronAPI = (window as unknown as { electronAPI?: { oidcSystemBrowserAuth?: (authUrl: string, port: number) => Promise<{ success: boolean; token?: string; error?: string }> } }).electronAPI; + const electronAPI = ( + window as unknown as { + electronAPI?: { + oidcSystemBrowserAuth?: ( + authUrl: string, + port: number, + ) => Promise<{ + success: boolean; + token?: string; + error?: string; + }>; + }; + } + ).electronAPI; if (electronAPI?.oidcSystemBrowserAuth) { const callbackPort = 17832 + Math.floor(Math.random() * 100); - const authResponse = await getOIDCAuthorizeUrl(rememberMe, callbackPort); + const authResponse = await getOIDCAuthorizeUrl( + rememberMe, + callbackPort, + ); const { auth_url: authUrl } = authResponse; if (!authUrl) throw new Error(t("errors.invalidAuthUrl")); - const result = await electronAPI.oidcSystemBrowserAuth(authUrl, callbackPort); + const result = await electronAPI.oidcSystemBrowserAuth( + authUrl, + callbackPort, + ); if (result.success && result.token) { localStorage.setItem("jwt_token", result.token); window.location.reload(); diff --git a/src/ui/dashboard/DashboardTab.tsx b/src/ui/dashboard/DashboardTab.tsx index cadd4c56..abc5ab1d 100644 --- a/src/ui/dashboard/DashboardTab.tsx +++ b/src/ui/dashboard/DashboardTab.tsx @@ -737,7 +737,11 @@ function CardItem({ /> )} {slot.id === "quick_actions" && ( - + )} {slot.id === "host_status" && ( )} {slot.id === "quick_actions" && ( - + )} {slot.id === "host_status" && ( { + client.onfile = ( + stream: Guacamole.InputStream, + mimetype: string, + filename: string, + ) => { const reader = new Guacamole.BlobReader(stream, mimetype); reader.onend = () => { const blob = reader.getBlob(); diff --git a/src/ui/features/terminal/Terminal.tsx b/src/ui/features/terminal/Terminal.tsx index 9768721c..46d5d736 100644 --- a/src/ui/features/terminal/Terminal.tsx +++ b/src/ui/features/terminal/Terminal.tsx @@ -1981,9 +1981,10 @@ const TerminalInner = forwardRef( const clipboardAddon = new ClipboardAddon(undefined, clipboardProvider); const unicode11Addon = new Unicode11Addon(); const webLinksAddon = new WebLinksAddon((_event, uri) => { - const url = uri.startsWith("http://") || uri.startsWith("https://") - ? uri - : `https://${uri}`; + const url = + uri.startsWith("http://") || uri.startsWith("https://") + ? uri + : `https://${uri}`; window.open(url, "_blank"); }); @@ -2148,7 +2149,8 @@ const TerminalInner = forwardRef( } const persistenceEnabled = - localStorage.getItem("enableTerminalSessionPersistence") !== "false"; + localStorage.getItem("enableTerminalSessionPersistence") !== + "false"; if ( !persistenceEnabled && sessionIdRef.current &&