mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-15 19:32:20 +03:00
246b87f739
* fix(mitm): gate Agent Bridge DNS and Trust Cert on sudo password (#7938) Extend the #7865 sudo gate to setup wizard DNS, Start DNS, and Trust Cert. Start server still runs without a password but skips privileged cert/DNS steps instead of spawning sudo -S with an empty string. Add a shared sudo password modal on the Agent Bridge page for DNS and trust-cert actions. Fixes #7938 * fix(mitm): use .tsx extension for MitmSudoPasswordModal hook JSX in a .ts file broke dashboard typecheck and ESLint on CI. * fix(mitm): skip DNS teardown on stop when sudo password missing (#7938) stopMitm() no longer invokes removeDNSEntry with an empty password when the server was started in skip mode. The MITM process is still killed. * refactor(mitm): extract privileged step helpers to satisfy file-size cap manager.ts exceeded the 800-line cap after #7938 gates. Move DNS teardown and the shared sudo skip runner into dedicated modules; behavior unchanged.
36 lines
1.3 KiB
TypeScript
36 lines
1.3 KiB
TypeScript
import { isSudoPasswordRequired } from "./dns/dnsConfig.ts";
|
|
import { isRoot } from "./systemCommands.ts";
|
|
|
|
/** Trim and treat whitespace-only sudo passwords as missing (#7865 review). */
|
|
export function normalizeMitmSudoPasswordInput(value?: string | null): string {
|
|
return value?.trim() ?? "";
|
|
}
|
|
|
|
/** Resolve the sudo password from the request body and in-process cache. */
|
|
export function resolveMitmSudoPassword(
|
|
bodyPassword?: string,
|
|
cachedPassword?: string | null
|
|
): string {
|
|
const body = normalizeMitmSudoPasswordInput(bodyPassword);
|
|
if (body) return body;
|
|
return normalizeMitmSudoPasswordInput(cachedPassword);
|
|
}
|
|
|
|
/**
|
|
* Whether a privileged MITM operation must reject because no sudo password is
|
|
* available. Mirrors the gate in `/api/cli-tools/antigravity-mitm` (#822) and
|
|
* `/api/settings/mitm` — skip on Windows, root, NOPASSWD sudoers, and hosts
|
|
* without sudo on PATH.
|
|
*/
|
|
export function isMitmSudoPasswordRequired(sudoPassword: string): boolean {
|
|
if (process.platform === "win32") return false;
|
|
if (isRoot()) return false;
|
|
if (normalizeMitmSudoPasswordInput(sudoPassword)) return false;
|
|
return isSudoPasswordRequired();
|
|
}
|
|
|
|
/** Whether cert trust / DNS provisioning may run (inverse of the hard gate). */
|
|
export function canRunPrivilegedMitmSteps(sudoPassword: string): boolean {
|
|
return !isMitmSudoPasswordRequired(sudoPassword);
|
|
}
|