[Init] Initial commit - NetMesh terminal manager

domain/sshDeepLink.ts

@@ -0,0 +1,237 @@
+import type { Host } from "./models";
+
+export interface SshDeepLinkTarget {
+  rawUrl: string;
+  username?: string;
+  password?: string;
+  hostname: string;
+  port?: number;
+}
+
+export interface SshDeepLinkDraftOptions {
+  id: string;
+  now: number;
+}
+
+const DEFAULT_SSH_PORT = 22;
+const URL_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:/i;
+
+const normalizeHostname = (value: string): string =>
+  value.trim().replace(/^\[(.*)\]$/, "$1").toLowerCase();
+
+const decodeUrlComponent = (value: string): string => {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
+
+const getHostPort = (host: Host): number => host.port ?? DEFAULT_SSH_PORT;
+
+const isPrimarySshHost = (host: Host): boolean =>
+  host.protocol === undefined || host.protocol === "ssh";
+
+export const parseSshDeepLink = (rawUrl: string): SshDeepLinkTarget | null => {
+  if (typeof rawUrl !== "string") return null;
+  const trimmed = rawUrl.trim();
+  if (!trimmed) return null;
+
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return null;
+  }
+
+  if (parsed.protocol !== "ssh:") return null;
+
+  const hostname = normalizeHostname(parsed.hostname);
+  if (!hostname) return null;
+
+  const portText = parsed.port;
+  const port = portText ? Number(portText) : undefined;
+  if (port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65535)) {
+    return null;
+  }
+
+  const username = parsed.username
+    ? decodeUrlComponent(parsed.username).trim()
+    : undefined;
+  const password = parsed.password
+    ? decodeUrlComponent(parsed.password)
+    : undefined;
+
+  return {
+    rawUrl: trimmed,
+    ...(username ? { username } : {}),
+    ...(password ? { password } : {}),
+    hostname,
+    ...(port ? { port } : {}),
+  };
+};
+
+export const shouldHandleSshDeepLink = (rawUrl: string, enabled: boolean): boolean =>
+  enabled && parseSshDeepLink(rawUrl) !== null;
+
+export const findSshDeepLinkHost = (
+  hosts: Host[],
+  target: SshDeepLinkTarget,
+): Host | null => {
+  const targetHost = normalizeHostname(target.hostname);
+  const targetPort = target.port ?? DEFAULT_SSH_PORT;
+  const candidates = hosts.filter((host) => {
+    if (!isPrimarySshHost(host)) return false;
+    if (normalizeHostname(host.hostname) !== targetHost) return false;
+    if (target.username && (host.username || "").trim() !== target.username) return false;
+    if (getHostPort(host) !== targetPort) return false;
+    return true;
+  });
+
+  return candidates.length === 1 ? candidates[0] : null;
+};
+
+export const buildSshDeepLinkConnectionHost = (host: Host): Host => ({
+  ...host,
+  protocol: "ssh",
+  moshEnabled: false,
+  etEnabled: false,
+});
+
+export const buildSshDeepLinkOpenHost = (
+  hosts: Host[],
+  target: SshDeepLinkTarget,
+  options: SshDeepLinkDraftOptions,
+): Host => buildSshDeepLinkConnectionHost(
+  findSshDeepLinkHost(hosts, target) ?? buildSshDeepLinkHostDraft(target, options),
+);
+
+export const buildSshDeepLinkEphemeralHost = (
+  target: SshDeepLinkTarget,
+  options: SshDeepLinkDraftOptions,
+): Host => ({
+  ...buildSshDeepLinkHostDraft(target, options),
+  ...(target.password ? { password: target.password, authMethod: "password" as const } : {}),
+  savePassword: false,
+  ephemeral: true,
+  moshEnabled: false,
+  etEnabled: false,
+});
+
+/**
+ * Ephemeral host for a password deep link that uniquely matches a saved
+ * vault host: keep the saved host's non-credential settings (proxy, jump
+ * chain, charset, ...) but authenticate with exactly the URL credentials,
+ * so vault identities and key references never override the one-time
+ * password.
+ *
+ * Pass the group-resolved effective host (not the raw vault host): group
+ * defaults must already be materialized here, because this builder clears
+ * `group` so that later effective-host resolution cannot re-inherit group
+ * credentials (identity, key, password) over the URL password.
+ */
+export const buildSshDeepLinkEphemeralHostFromSaved = (
+  effectiveSavedHost: Host,
+  target: SshDeepLinkTarget,
+  options: SshDeepLinkDraftOptions,
+): Host => ({
+  ...effectiveSavedHost,
+  id: options.id,
+  createdAt: options.now,
+  ...(target.username ? { username: target.username } : {}),
+  ...(target.password ? { password: target.password, authMethod: "password" as const } : {}),
+  identityId: undefined,
+  identityFileId: undefined,
+  identityFilePaths: undefined,
+  savePassword: false,
+  group: "",
+  ephemeral: true,
+  protocol: "ssh",
+  moshEnabled: false,
+  etEnabled: false,
+});
+
+export const buildSshDeepLinkHostDraft = (
+  target: SshDeepLinkTarget,
+  options: SshDeepLinkDraftOptions,
+): Host => ({
+  id: options.id,
+  label: target.username ? `${target.username}@${target.hostname}` : target.hostname,
+  hostname: target.hostname,
+  username: target.username || "",
+  ...(target.port !== undefined ? { port: target.port } : {}),
+  group: "",
+  tags: [],
+  os: "linux",
+  protocol: "ssh",
+  createdAt: options.now,
+});
+
+const normalizeBareHostReference = (value: string): string | null => {
+  const decoded = decodeUrlComponent(value).trim().replace(/^\.\/+/, "").replace(/\/+$/, "");
+  if (!decoded || decoded.includes(" ") || decoded.startsWith("#") || decoded.startsWith("/")) return null;
+  if (URL_SCHEME_PATTERN.test(decoded)) return null;
+  return decoded;
+};
+
+const isDocumentRelativeLink = (value: string): boolean => {
+  const trimmed = value.trim();
+  return trimmed.startsWith("#")
+    || trimmed.startsWith("/")
+    || trimmed.startsWith("./")
+    || trimmed.startsWith("../")
+    || trimmed.includes("/")
+    || trimmed.includes("?")
+    || trimmed.includes("#");
+};
+
+const parseBareHostReference = (value: string): SshDeepLinkTarget | null => {
+  const reference = normalizeBareHostReference(value);
+  if (!reference) return null;
+  return parseSshDeepLink(`ssh://${reference}`);
+};
+
+const findHostByLabel = (hosts: Host[], label: string): Host | null => {
+  const needle = label.trim().toLowerCase();
+  if (!needle) return null;
+  const candidates = hosts.filter((host) =>
+    isPrimarySshHost(host) && (host.label || "").trim().toLowerCase() === needle,
+  );
+  return candidates.length === 1 ? candidates[0] : null;
+};
+
+export const buildSshNoteLinkOpenHost = (
+  hosts: Host[],
+  href: string,
+  label: string | undefined,
+  options: SshDeepLinkDraftOptions,
+): Host | null => {
+  const normalizedHref = href.trim();
+  const deepLinkTarget = parseSshDeepLink(href);
+  if (deepLinkTarget) {
+    return buildSshDeepLinkOpenHost(hosts, deepLinkTarget, options);
+  }
+
+  if (URL_SCHEME_PATTERN.test(normalizedHref)) {
+    return null;
+  }
+  if (isDocumentRelativeLink(normalizedHref)) {
+    return null;
+  }
+
+  const references = [href, label]
+    .filter((value): value is string => Boolean(value?.trim()));
+  for (const reference of references) {
+    const target = parseBareHostReference(reference);
+    if (!target) continue;
+    const host = findSshDeepLinkHost(hosts, target);
+    if (host) return buildSshDeepLinkConnectionHost(host);
+  }
+
+  for (const reference of references) {
+    const host = findHostByLabel(hosts, reference);
+    if (host) return buildSshDeepLinkConnectionHost(host);
+  }
+
+  return null;
+};