pico

fix: address CVE-2024-45337 rss
created pr with 39.1 on 2024-12-11T20:00:24Z · by c8ef7d19
cmds
checkout latest patchset: 
ssh pr.pico.sh print 39 | git am -3
checkout any patchset in a patch request: 
ssh pr.pico.sh print 39.[rev] | git am -3
add changes to patch request: 
git format-patch main --stdout | ssh pr.pico.sh pr add 39

Patchset 39.1 on 2024-12-11T20:00:24Z · commit dcfb7ac

→ fix: address CVE-2024-45337
Eric Bower 2024-12-11T18:38:58Z
fix: address CVE-2024-45337
Eric Bower 2024-12-11T18:38:58Z
Reference: https://github.com/golang/go/issues/70779
Semantic diff summary
1 added, 26 modified, 0 signature changed, 9 removed across 10 analyzed files (2 files skipped: unsupported file type)
filehandlers/imgs/handler.go
filehandlers/imgs/img.go
filehandlers/post_handler.go
filehandlers/router_handler.go
pgs/tunnel.go
pgs/uploader.go
pico/file_handler.go
pico/ssh.go
pipe/cli.go
shared/ssh.go
+4 -7 filehandlers/imgs/handler.go #
......@@ -48,7 +48,7 @@ func NewUploadImgHandler(dbpool db.DB, cfg *shared.ConfigSite, storage storage.S
4848 }
4949
5050 func (h *UploadImgHandler) Read(s ssh.Session, entry *sendutils.FileEntry) (os.FileInfo, sendutils.ReaderAtCloser, error) {
51- user, err := shared.GetUser(s.Context())
51+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
5252 if err != nil {
5353 return nil, nil, err
5454 }
......@@ -88,7 +88,7 @@ func (h *UploadImgHandler) Read(s ssh.Session, entry *sendutils.FileEntry) (os.F
8888
8989 func (h *UploadImgHandler) Write(s ssh.Session, entry *sendutils.FileEntry) (string, error) {
9090 logger := h.Cfg.Logger
91- user, err := shared.GetUser(s.Context())
91+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
9292 if err != nil {
9393 logger.Error("could not get user from ctx", "err", err.Error())
9494 return "", err
......@@ -145,10 +145,7 @@ func (h *UploadImgHandler) Write(s ssh.Session, entry *sendutils.FileEntry) (str
145145 logger.Info("unable to find image, continuing", "filename", nextPost.Filename, "err", err.Error())
146146 }
147147
148- featureFlag, err := shared.GetFeatureFlag(s.Context())
149- if err != nil {
150- return "", err
151- }
148+ featureFlag := shared.FindPlusFF(h.DBPool, h.Cfg, user.ID)
152149 metadata := PostMetaData{
153150 OrigText: text,
154151 Post: &nextPost,
......@@ -192,7 +189,7 @@ func (h *UploadImgHandler) Write(s ssh.Session, entry *sendutils.FileEntry) (str
192189 }
193190
194191 func (h *UploadImgHandler) Delete(s ssh.Session, entry *sendutils.FileEntry) error {
195- user, err := shared.GetUser(s.Context())
192+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
196193 if err != nil {
197194 return err
198195 }
+1 -1 filehandlers/imgs/img.go #
......@@ -80,7 +80,7 @@ func (h *UploadImgHandler) writeImg(s ssh.Session, data *PostMetaData) error {
8080 if !valid {
8181 return err
8282 }
83- user, err := shared.GetUser(s.Context())
83+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
8484 if err != nil {
8585 return err
8686 }
+3 -3 filehandlers/post_handler.go #
......@@ -47,7 +47,7 @@ func NewScpPostHandler(dbpool db.DB, cfg *shared.ConfigSite, hooks ScpFileHooks,
4747 }
4848
4949 func (h *ScpUploadHandler) Read(s ssh.Session, entry *sendutils.FileEntry) (os.FileInfo, sendutils.ReaderAtCloser, error) {
50- user, err := shared.GetUser(s.Context())
50+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
5151 if err != nil {
5252 return nil, nil, err
5353 }
......@@ -76,7 +76,7 @@ func (h *ScpUploadHandler) Read(s ssh.Session, entry *sendutils.FileEntry) (os.F
7676
7777 func (h *ScpUploadHandler) Write(s ssh.Session, entry *sendutils.FileEntry) (string, error) {
7878 logger := h.Cfg.Logger
79- user, err := shared.GetUser(s.Context())
79+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
8080 if err != nil {
8181 logger.Error("error getting user from ctx", "err", err.Error())
8282 return "", err
......@@ -263,7 +263,7 @@ func (h *ScpUploadHandler) Write(s ssh.Session, entry *sendutils.FileEntry) (str
263263
264264 func (h *ScpUploadHandler) Delete(s ssh.Session, entry *sendutils.FileEntry) error {
265265 logger := h.Cfg.Logger
266- user, err := shared.GetUser(s.Context())
266+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
267267 if err != nil {
268268 logger.Error("could not get user from ctx", "err", err.Error())
269269 return err
+2 -2 filehandlers/router_handler.go #
......@@ -82,7 +82,7 @@ func (r *FileHandlerRouter) Read(s ssh.Session, entry *utils.FileEntry) (os.File
8282
8383 func BaseList(s ssh.Session, fpath string, isDir bool, recursive bool, spaces []string, dbpool db.DB) ([]os.FileInfo, error) {
8484 var fileList []os.FileInfo
85- user, err := shared.GetUser(s.Context())
85+ user, err := dbpool.FindUser(s.Permissions().Extensions["user_id"])
8686 if err != nil {
8787 return fileList, err
8888 }
......@@ -153,7 +153,7 @@ func (r *FileHandlerRouter) GetLogger() *slog.Logger {
153153 }
154154
155155 func (r *FileHandlerRouter) Validate(s ssh.Session) error {
156- user, err := shared.GetUser(s.Context())
156+ user, err := r.DBPool.FindUser(s.Permissions().Extensions["user_id"])
157157 if err != nil {
158158 return err
159159 }
+5 -5 go.mod #
......@@ -53,7 +53,7 @@ require (
5353 go.abhg.dev/goldmark/anchor v0.1.1
5454 go.abhg.dev/goldmark/hashtag v0.3.1
5555 go.abhg.dev/goldmark/toc v0.10.0
56- golang.org/x/crypto v0.29.0
56+ golang.org/x/crypto v0.31.0
5757 gopkg.in/yaml.v2 v2.4.0
5858 )
5959
......@@ -179,10 +179,10 @@ require (
179179 github.com/yusufpapurcu/wmi v1.2.4 // indirect
180180 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
181181 golang.org/x/net v0.31.0 // indirect
182- golang.org/x/sync v0.9.0 // indirect
183- golang.org/x/sys v0.27.0 // indirect
184- golang.org/x/term v0.26.0 // indirect
185- golang.org/x/text v0.20.0 // indirect
182+ golang.org/x/sync v0.10.0 // indirect
183+ golang.org/x/sys v0.28.0 // indirect
184+ golang.org/x/term v0.27.0 // indirect
185+ golang.org/x/text v0.21.0 // indirect
186186 golang.org/x/time v0.8.0 // indirect
187187 google.golang.org/protobuf v1.35.2 // indirect
188188 mvdan.cc/xurls/v2 v2.5.0 // indirect
+10 -10 go.sum #
......@@ -391,8 +391,8 @@ golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPh
391391 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
392392 golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
393393 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
394-golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
395-golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
394+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
395+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
396396 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
397397 golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
398398 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
......@@ -417,8 +417,8 @@ golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJ
417417 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
418418 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
419419 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
420-golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
421-golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
420+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
421+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
422422 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
423423 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
424424 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
......@@ -438,8 +438,8 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
438438 golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
439439 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
440440 golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
441-golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
442-golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
441+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
442+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
443443 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
444444 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
445445 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
......@@ -447,16 +447,16 @@ golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
447447 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
448448 golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
449449 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
450-golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU=
451-golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
450+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
451+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
452452 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
453453 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
454454 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
455455 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
456456 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
457457 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
458-golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
459-golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
458+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
459+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
460460 golang.org/x/time v0.4.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
461461 golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
462462 golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+11 -29 pgs/tunnel.go #
......@@ -7,7 +7,6 @@ import (
77 "github.com/charmbracelet/ssh"
88 "github.com/picosh/pico/db"
99 "github.com/picosh/pico/shared"
10- "github.com/picosh/utils"
1110 )
1211
1312 type TunnelWebRouter struct {
......@@ -39,16 +38,14 @@ func createHttpHandler(apiConfig *shared.ApiConfig) CtxHttpBridge {
3938 "impersonating", asUser,
4039 )
4140
42- pubkey, err := shared.GetPublicKey(ctx)
43- if err != nil {
44- log.Error(err.Error(), "subdomain", subdomain)
41+ pubkey := ctx.Permissions().Extensions["pubkey"]
42+ if pubkey == "" {
43+ log.Error("pubkey not found in extensions", "subdomain", subdomain)
4544 return http.HandlerFunc(shared.UnauthorizedHandler)
4645 }
4746
48- pubkeyStr := utils.KeyForKeyText(pubkey)
49-
5047 log = log.With(
51- "pubkey", pubkeyStr,
48+ "pubkey", pubkey,
5249 )
5350
5451 props, err := shared.GetProjectFromSubdomain(subdomain)
......@@ -72,7 +69,7 @@ func createHttpHandler(apiConfig *shared.ApiConfig) CtxHttpBridge {
7269 return http.HandlerFunc(shared.UnauthorizedHandler)
7370 }
7471
75- requester, _ := dbh.FindUserForKey("", pubkeyStr)
72+ requester, _ := dbh.FindUserForKey("", pubkey)
7673 if requester != nil {
7774 log = log.With(
7875 "requester", requester.Name,
......@@ -89,33 +86,18 @@ func createHttpHandler(apiConfig *shared.ApiConfig) CtxHttpBridge {
8986 requester, _ = dbh.FindUserForName(asUser)
9087 }
9188
92- shared.SetUser(ctx, requester)
93-
94- if !HasProjectAccess(project, owner, requester, pubkey) {
89+ ctx.Permissions().Extensions["user_id"] = requester.ID
90+ publicKey, err := ssh.ParsePublicKey([]byte(pubkey))
91+ if err != nil {
92+ return http.HandlerFunc(shared.UnauthorizedHandler)
93+ }
94+ if !HasProjectAccess(project, owner, requester, publicKey) {
9595 log.Error("no access")
9696 return http.HandlerFunc(shared.UnauthorizedHandler)
9797 }
9898
9999 log.Info("user has access to site")
100100
101- /* routes := []shared.Route{
102- // special API endpoint for tunnel users accessing site
103- shared.NewCorsRoute("GET", "/api/current_user", func(w http.ResponseWriter, r *http.Request) {
104- w.Header().Set("Content-Type", "application/json")
105- user, err := shared.GetUser(ctx)
106- if err != nil {
107- logger.Error("could not find user", "err", err.Error())
108- shared.JSONError(w, err.Error(), http.StatusNotFound)
109- return
110- }
111- pico := shared.NewUserApi(user, pubkey)
112- err = json.NewEncoder(w).Encode(pico)
113- if err != nil {
114- log.Error(err.Error())
115- }
116- }),
117- } */
118-
119101 routes := NewWebRouter(
120102 apiConfig.Cfg,
121103 logger,
+6 -10 pgs/uploader.go #
......@@ -121,7 +121,7 @@ func (h *UploadAssetHandler) GetLogger() *slog.Logger {
121121 }
122122
123123 func (h *UploadAssetHandler) Read(s ssh.Session, entry *sendutils.FileEntry) (os.FileInfo, sendutils.ReaderAtCloser, error) {
124- user, err := shared.GetUser(s.Context())
124+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
125125 if err != nil {
126126 return nil, nil, err
127127 }
......@@ -155,7 +155,7 @@ func (h *UploadAssetHandler) Read(s ssh.Session, entry *sendutils.FileEntry) (os
155155 func (h *UploadAssetHandler) List(s ssh.Session, fpath string, isDir bool, recursive bool) ([]os.FileInfo, error) {
156156 var fileList []os.FileInfo
157157
158- user, err := shared.GetUser(s.Context())
158+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
159159 if err != nil {
160160 return fileList, err
161161 }
......@@ -197,7 +197,7 @@ func (h *UploadAssetHandler) List(s ssh.Session, fpath string, isDir bool, recur
197197 }
198198
199199 func (h *UploadAssetHandler) Validate(s ssh.Session) error {
200- user, err := shared.GetUser(s.Context())
200+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
201201 if err != nil {
202202 return err
203203 }
......@@ -248,7 +248,7 @@ func (h *UploadAssetHandler) findDenylist(bucket sst.Bucket, project *db.Project
248248 }
249249
250250 func (h *UploadAssetHandler) Write(s ssh.Session, entry *sendutils.FileEntry) (string, error) {
251- user, err := shared.GetUser(s.Context())
251+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
252252 if user == nil || err != nil {
253253 h.Cfg.Logger.Error("user not found in ctx", "err", err.Error())
254254 return "", err
......@@ -314,11 +314,7 @@ func (h *UploadAssetHandler) Write(s ssh.Session, entry *sendutils.FileEntry) (s
314314 return "", err
315315 }
316316
317- featureFlag, err := shared.GetFeatureFlag(s.Context())
318- if err != nil {
319- return "", err
320- }
321-
317+ featureFlag := shared.FindPlusFF(h.DBPool, h.Cfg, user.ID)
322318 // calculate the filsize difference between the same file already
323319 // stored and the updated file being uploaded
324320 assetFilename := shared.GetAssetFileName(entry)
......@@ -424,7 +420,7 @@ func isSpecialFile(entry *sendutils.FileEntry) bool {
424420 }
425421
426422 func (h *UploadAssetHandler) Delete(s ssh.Session, entry *sendutils.FileEntry) error {
427- user, err := shared.GetUser(s.Context())
423+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
428424 if err != nil {
429425 h.Cfg.Logger.Error("user not found in ctx", "err", err.Error())
430426 return err
+4 -4 pico/file_handler.go #
......@@ -56,7 +56,7 @@ func (h *UploadHandler) Delete(s ssh.Session, entry *sendutils.FileEntry) error
5656 }
5757
5858 func (h *UploadHandler) Read(s ssh.Session, entry *sendutils.FileEntry) (os.FileInfo, sendutils.ReaderAtCloser, error) {
59- user, err := shared.GetUser(s.Context())
59+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
6060 if err != nil {
6161 return nil, nil, err
6262 }
......@@ -80,7 +80,7 @@ func (h *UploadHandler) Read(s ssh.Session, entry *sendutils.FileEntry) (os.File
8080
8181 func (h *UploadHandler) List(s ssh.Session, fpath string, isDir bool, recursive bool) ([]os.FileInfo, error) {
8282 var fileList []os.FileInfo
83- user, err := shared.GetUser(s.Context())
83+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
8484 if err != nil {
8585 return fileList, err
8686 }
......@@ -135,7 +135,7 @@ func (h *UploadHandler) Validate(s ssh.Session) error {
135135 return fmt.Errorf("must have username set")
136136 }
137137
138- shared.SetUser(s.Context(), user)
138+ s.Permissions().Extensions["user_id"] = user.ID
139139 return nil
140140 }
141141
......@@ -276,7 +276,7 @@ func (h *UploadHandler) ProcessAuthorizedKeys(text []byte, logger *slog.Logger,
276276
277277 func (h *UploadHandler) Write(s ssh.Session, entry *sendutils.FileEntry) (string, error) {
278278 logger := h.Cfg.Logger
279- user, err := shared.GetUser(s.Context())
279+ user, err := h.DBPool.FindUser(s.Permissions().Extensions["user_id"])
280280 if err != nil {
281281 logger.Error(err.Error())
282282 return "", err
+0 -1 pico/ssh.go #
......@@ -28,7 +28,6 @@ import (
2828 )
2929
3030 func authHandler(ctx ssh.Context, key ssh.PublicKey) bool {
31- shared.SetPublicKey(ctx, key)
3231 return true
3332 }
3433
+1 -1 pipe/cli.go #
......@@ -141,7 +141,7 @@ func WishMiddleware(handler *CliHandler) wish.Middleware {
141141 logger := handler.Logger
142142 ctx := sesh.Context()
143143
144- user, err := shared.GetUser(ctx)
144+ user, err := handler.DBPool.FindUser(sesh.Permissions().Extensions["user_id"])
145145 if err != nil {
146146 logger.Info("user not found", "err", err)
147147 }
+24 -63 shared/ssh.go #
......@@ -1,7 +1,6 @@
11 package shared
22
33 import (
4- "fmt"
54 "log/slog"
65
76 "github.com/charmbracelet/ssh"
......@@ -9,47 +8,6 @@ import (
98 "github.com/picosh/utils"
109 )
1110
12-type ctxUserKey struct{}
13-type ctxFeatureFlagKey struct{}
14-
15-func GetUser(ctx ssh.Context) (*db.User, error) {
16- user, ok := ctx.Value(ctxUserKey{}).(*db.User)
17- if !ok {
18- return user, fmt.Errorf("user not set on `ssh.Context()` for connection")
19- }
20- return user, nil
21-}
22-
23-func SetUser(ctx ssh.Context, user *db.User) {
24- ctx.SetValue(ctxUserKey{}, user)
25-}
26-
27-func GetFeatureFlag(ctx ssh.Context) (*db.FeatureFlag, error) {
28- ff, ok := ctx.Value(ctxFeatureFlagKey{}).(*db.FeatureFlag)
29- if !ok || ff.Name == "" {
30- return ff, fmt.Errorf("feature flag not set on `ssh.Context()` for connection")
31- }
32- return ff, nil
33-}
34-
35-func SetFeatureFlag(ctx ssh.Context, ff *db.FeatureFlag) {
36- ctx.SetValue(ctxFeatureFlagKey{}, ff)
37-}
38-
39-type ctxPublicKey struct{}
40-
41-func GetPublicKey(ctx ssh.Context) (ssh.PublicKey, error) {
42- pk, ok := ctx.Value(ctxPublicKey{}).(ssh.PublicKey)
43- if !ok {
44- return nil, fmt.Errorf("public key not set on `ssh.Context()` for connection")
45- }
46- return pk, nil
47-}
48-
49-func SetPublicKey(ctx ssh.Context, pk ssh.PublicKey) {
50- ctx.SetValue(ctxPublicKey{}, pk)
51-}
52-
5311 type SshAuthHandler struct {
5412 DBPool db.DB
5513 Logger *slog.Logger
......@@ -64,11 +22,28 @@ func NewSshAuthHandler(dbpool db.DB, logger *slog.Logger, cfg *ConfigSite) *SshA
6422 }
6523 }
6624
67-func (r *SshAuthHandler) PubkeyAuthHandler(ctx ssh.Context, key ssh.PublicKey) bool {
68- SetPublicKey(ctx, key)
25+func FindPlusFF(dbpool db.DB, cfg *ConfigSite, userID string) *db.FeatureFlag {
26+ ff, _ := dbpool.FindFeatureForUser(userID, "plus")
27+ // we have free tiers so users might not have a feature flag
28+ // in which case we set sane defaults
29+ if ff == nil {
30+ ff = db.NewFeatureFlag(
31+ userID,
32+ "plus",
33+ cfg.MaxSize,
34+ cfg.MaxAssetSize,
35+ cfg.MaxSpecialFileSize,
36+ )
37+ }
38+ // this is jank
39+ ff.Data.StorageMax = ff.FindStorageMax(cfg.MaxSize)
40+ ff.Data.FileMax = ff.FindFileMax(cfg.MaxAssetSize)
41+ ff.Data.SpecialFileMax = ff.FindSpecialFileMax(cfg.MaxSpecialFileSize)
42+ return ff
43+}
6944
45+func (r *SshAuthHandler) PubkeyAuthHandler(ctx ssh.Context, key ssh.PublicKey) bool {
7046 pubkey := utils.KeyForKeyText(key)
71-
7247 user, err := r.DBPool.FindUserForKey(ctx.User(), pubkey)
7348 if err != nil {
7449 r.Logger.Error(
......@@ -84,24 +59,10 @@ func (r *SshAuthHandler) PubkeyAuthHandler(ctx ssh.Context, key ssh.PublicKey) b
8459 return false
8560 }
8661
87- ff, _ := r.DBPool.FindFeatureForUser(user.ID, "plus")
88- // we have free tiers so users might not have a feature flag
89- // in which case we set sane defaults
90- if ff == nil {
91- ff = db.NewFeatureFlag(
92- user.ID,
93- "plus",
94- r.Cfg.MaxSize,
95- r.Cfg.MaxAssetSize,
96- r.Cfg.MaxSpecialFileSize,
97- )
62+ if ctx.Permissions().Extensions == nil {
63+ ctx.Permissions().Extensions = map[string]string{}
9864 }
99- // this is jank
100- ff.Data.StorageMax = ff.FindStorageMax(r.Cfg.MaxSize)
101- ff.Data.FileMax = ff.FindFileMax(r.Cfg.MaxAssetSize)
102- ff.Data.SpecialFileMax = ff.FindSpecialFileMax(r.Cfg.MaxSpecialFileSize)
103-
104- SetUser(ctx, user)
105- SetFeatureFlag(ctx, ff)
65+ ctx.Permissions().Extensions["user_id"] = user.ID
66+ ctx.Permissions().Extensions["pubkey"] = pubkey
10667 return true
10768 }
Back to top