[Init] Initial commit - NetMesh terminal manager

domain/vaultImport/csvExport.ts

@@ -0,0 +1,146 @@
+import type { Host } from '../models';
+import { isPluginHostProtocol } from '../pluginConnection';
+import { encodeCsvKeyPath, encodeCsvPassphrase } from './csvCredentialFields';
+
+const UTF8_BOM = "\uFEFF";
+
+export interface VaultCsvTemplateOptions {
+  includeExampleRows?: boolean;
+}
+
+export interface VaultCsvExportOptions {
+  keyPassphrases?: ReadonlyMap<string, string>;
+  keyPassphrasesById?: ReadonlyMap<string, string>;
+  keyPathsById?: ReadonlyMap<string, string>;
+}
+
+export const resolveVaultCsvHostKeyPath = (
+  host: Host,
+  options: VaultCsvExportOptions = {},
+): string => {
+  const referencedPath = host.identityFileId
+    ? options.keyPathsById?.get(host.identityFileId)?.trim()
+    : undefined;
+  return referencedPath
+    || host.identityFilePaths?.find((path) => path.trim())?.trim()
+    || "";
+};
+
+export const getVaultCsvTemplate = (
+  opts: VaultCsvTemplateOptions = {},
+): string => {
+  const includeExampleRows = opts.includeExampleRows !== false;
+  const header = ["Groups", "Label", "Tags", "Notes", "Hostname/IP", "Protocol", "Port", "Username", "Password", "KeyPath", "Passphrase"];
+  const rows: string[][] = [header];
+  if (includeExampleRows) {
+    rows.push(["Project/Dev", "Web Server (dev)", "dev,web", "Dev web tier", "192.168.1.10", "ssh", "22", "root", "", "~/.ssh/id_ed25519", ""]);
+    rows.push(["Project/Prod", "Web Server (prod)", "prod,web", "Production", "server-a.example.com", "ssh", "22", "ubuntu", "", "", ""]);
+    rows.push(["Database", "DB", "db,mysql", "MySQL primary", "db.example.com", "ssh", "4567", "admin", "", "", ""]);
+  }
+
+  const escapeCsv = (value: string) => {
+    if (value.includes('"')) value = value.replace(/"/g, '""');
+    if (/[",\r\n]/.test(value)) return `"${value}"`;
+    return value;
+  };
+
+  return rows.map((r) => r.map((c) => escapeCsv(c)).join(",")).join("\r\n") + "\r\n";
+};
+
+const exportHostsToCsv = (hosts: Host[], options: VaultCsvExportOptions): string => {
+  const header = ["Groups", "Label", "Tags", "Notes", "Hostname/IP", "Protocol", "Port", "Username", "Password", "KeyPath", "Passphrase"];
+  const rows: string[][] = [header];
+
+  const escapeCsv = (value: string, skipFormulaGuard = false) => {
+    // Prevent CSV formula injection by prefixing dangerous characters with a single quote
+    // These characters can be interpreted as formulas by spreadsheet applications
+    // Skip for password fields to preserve credentials verbatim for round-trip
+    if (!skipFormulaGuard && /^[=+\-@\t\r]/.test(value)) {
+      value = "'" + value;
+    }
+    if (value.includes('"')) value = value.replace(/"/g, '""');
+    if (/[",\r\n]/.test(value)) return `"${value}"`;
+    return value;
+  };
+
+  // Filter out transports the legacy CSV format cannot represent without
+  // silently discarding protocol-owned configuration.
+  // Note: mosh-enabled hosts are exported as SSH (losing mosh flag) rather than being skipped,
+  // since exporting partial data is better than losing the entire host entry
+  const isUnsupported = (h: Host) => h.protocol === "serial" || isPluginHostProtocol(h.protocol);
+  const exportableHosts = hosts.filter((h) => !isUnsupported(h));
+
+  // Helper to bracket IPv6 addresses for CSV export
+  // IPv6 addresses contain colons which would be misinterpreted as port separators on import
+  const formatHostname = (hostname: string): string => {
+    // Check if it looks like an IPv6 address (contains colons but not already bracketed)
+    if (hostname.includes(":") && !hostname.startsWith("[")) {
+      return `[${hostname}]`;
+    }
+    return hostname;
+  };
+
+  for (const host of exportableHosts) {
+    // For telnet hosts, use telnet-specific port and username
+    const isTelnet = host.protocol === "telnet";
+    const effectivePort = isTelnet
+      ? (host.telnetPort ?? host.port ?? 23)
+      : (host.port ?? 22);
+    const effectiveUsername = isTelnet
+      ? (host.telnetUsername ?? host.username ?? "")
+      : (host.username ?? "");
+    const keyPath = resolveVaultCsvHostKeyPath(host, options);
+    const passphrase = keyPath
+      ? (
+          host.identityFileId
+            ? (options.keyPassphrasesById?.get(host.identityFileId) ?? "")
+            : (options.keyPassphrases?.get(keyPath) ?? "")
+        )
+      : "";
+
+    rows.push([
+      host.group ?? "",
+      host.label ?? "",
+      (host.tags ?? []).join(","),
+      host.notes ?? "",
+      formatHostname(host.hostname),
+      host.protocol ?? "ssh",
+      String(effectivePort),
+      effectiveUsername,
+      host.password ?? "",
+      encodeCsvKeyPath(keyPath),
+      encodeCsvPassphrase(passphrase),
+    ]);
+  }
+
+  const passwordColIdx = header.indexOf("Password");
+  const keyPathColIdx = header.indexOf("KeyPath");
+  const passphraseColIdx = header.indexOf("Passphrase");
+  return rows.map((r, rowIdx) => r.map((c, i) => escapeCsv(
+    c,
+    rowIdx > 0 && (i === passwordColIdx || i === keyPathColIdx || i === passphraseColIdx),
+  )).join(",")).join("\r\n") + "\r\n";
+};
+
+interface ExportHostsResult {
+  csv: string;
+  exportedCount: number;
+  skippedCount: number;
+}
+
+export const exportHostsToCsvWithStats = (
+  hosts: Host[],
+  options: VaultCsvExportOptions = {},
+): ExportHostsResult => {
+  // Mosh hosts intentionally degrade to SSH, but namespaced plugin protocols
+  // must be skipped because CSV has no field for their opaque configuration.
+  const isUnsupported = (h: Host) => h.protocol === "serial" || isPluginHostProtocol(h.protocol);
+  const skippedHosts = hosts.filter((h) => isUnsupported(h));
+  const exportableHosts = hosts.filter((h) => !isUnsupported(h));
+
+  return {
+    csv: UTF8_BOM + exportHostsToCsv(exportableHosts, options),
+    exportedCount: exportableHosts.length,
+    skippedCount: skippedHosts.length,
+  };
+};