orca/src/shared/secure-path-windows-acl.ts

import { writeFileSync } from 'node:fs'
import { reportSecurePathHardening as report } from './secure-path-hardening-report'
import { loadWindowsSecurity, type WindowsSecurity } from './windows-security-addon'
import { findSecureDaclViolation, hardenedDaclSddl } from './windows-secure-dacl'

/**
 * Restricts a directory on the thread pool: a rewrite walks every descendant, seconds on a large
 * userData. Never rejects; failures are reported and resolve false so the caller can retry.
 */
export function restrictWindowsDirectory(dirPath: string): Promise<boolean> {
  const security = securityFor(dirPath)
  return security ? restrictAsync(security, dirPath, true) : Promise.resolve(false)
}

async function restrictAsync(
  security: WindowsSecurity,
  targetPath: string,
  isDirectory: boolean
): Promise<boolean> {
  // Verify first: a directory rewrite walks every descendant (seconds on a large userData), so
  // a path that already reads back correct must never pay it again.
  if (violationOf(security, targetPath, isDirectory) === null) {
    return true
  }
  try {
    await security.addon.setDaclSddlAsync(
      targetPath,
      hardenedDaclSddl(security.userSid, isDirectory)
    )
  } catch (error) {
    report(targetPath, 'apply', String(error))
    return false
  }
  return verifyAfterApply(security, targetPath, isDirectory)
}

/** Restricts one file on the thread pool; never rejects, resolves whether the DACL holds. */
export function restrictWindowsFile(filePath: string): Promise<boolean> {
  const security = securityFor(filePath)
  return security ? restrictAsync(security, filePath, false) : Promise.resolve(false)
}

/** Verifies and, only when that fails, rewrites the DACL on the calling thread. */
export function restrictWindowsPathSync(targetPath: string, isDirectory: boolean): boolean {
  const security = securityFor(targetPath)
  if (!security) {
    return false
  }
  if (violationOf(security, targetPath, isDirectory) === null) {
    return true
  }
  try {
    security.addon.setDaclSddl(targetPath, hardenedDaclSddl(security.userSid, isDirectory))
  } catch (error) {
    // Why not fatal: a failed apply must not crash the caller; false leaves the path retryable.
    report(targetPath, 'apply', String(error))
    return false
  }
  return verifyAfterApply(security, targetPath, isDirectory)
}

/**
 * Writes a NEW file that is restricted from the moment it exists, so its contents are never
 * readable under the directory's (possibly broader) inherited DACL. Returns whether the
 * restriction holds. Without the addon the file is written plainly and this is false; with it, a
 * failed create throws like any other write failure.
 */
export function writeRestrictedWindowsFile(targetPath: string, contents: string | Buffer): boolean {
  const security = securityFor(targetPath)
  if (!security) {
    writeFileSync(targetPath, contents, { encoding: 'utf-8', mode: 0o600 })
    return false
  }
  security.addon.createFileWithDacl(
    targetPath,
    hardenedDaclSddl(security.userSid, false),
    typeof contents === 'string' ? Buffer.from(contents, 'utf-8') : contents
  )
  // Why read it back: FAT32 and some shares accept the descriptor and silently drop it.
  return verifyAfterApply(security, targetPath, false)
}

function verifyAfterApply(
  security: WindowsSecurity,
  targetPath: string,
  isDirectory: boolean
): boolean {
  const invalid = violationOf(security, targetPath, isDirectory)
  if (invalid) {
    report(targetPath, 'verify', invalid)
    return false
  }
  return true
}

/** Why the DACL on disk is not acceptable, or null when it is. */
function violationOf(
  security: WindowsSecurity,
  targetPath: string,
  isDirectory: boolean
): string | null {
  try {
    return findSecureDaclViolation(
      security.addon.getDaclAces(targetPath),
      security.userSid,
      isDirectory
    )
  } catch (error) {
    return String(error)
  }
}

let reportedLoadFailure = false

function securityFor(targetPath: string): WindowsSecurity | null {
  const loaded = loadWindowsSecurity()
  if ('error' in loaded) {
    // Once per process: a missing addon is a packaging fault, and every secure write would repeat it.
    if (!reportedLoadFailure) {
      reportedLoadFailure = true
      report(targetPath, 'addon', loaded.error)
    }
    return null
  }
  return loaded
}