113 lines
2.9 KiB
Go
113 lines
2.9 KiB
Go
// Package fs permission registry.
|
|
// This is the SINGLE SOURCE OF TRUTH for all filesystem permissions.
|
|
// Every file and directory permission in the 9P tree is declared here.
|
|
// No permission literals should appear anywhere else.
|
|
package fs
|
|
|
|
import "os"
|
|
|
|
// Path constants for the filesystem namespace.
|
|
//
|
|
// Paths ending in "/" are directories (used as route prefixes).
|
|
// Paths without trailing "/" are scoped entries within a parent.
|
|
//
|
|
// Template variables:
|
|
//
|
|
// {id} — session ID (dynamic, matches any session)
|
|
// {file} — file name within a session directory
|
|
const (
|
|
PathRoot = "/"
|
|
PathSessions = "/session/"
|
|
PathElevate = "/elevate/"
|
|
PathSessionDir = "session/{id}"
|
|
PathTools = "t/"
|
|
PathSessionFile = "session/{id}/{file}"
|
|
)
|
|
|
|
// Perm declares permissions for a filesystem node.
|
|
// - DirMode: permission reported in 9P stat for the directory itself.
|
|
// - FileMode: default permission for files created/listed in this directory.
|
|
// - Files: per-file permission overrides (file name → mode).
|
|
type Perm struct {
|
|
DirMode os.FileMode
|
|
FileMode os.FileMode
|
|
Files map[string]os.FileMode
|
|
}
|
|
|
|
// Perms is the permission registry. To find the permission for any path,
|
|
// look it up here.
|
|
var Perms = map[string]Perm{
|
|
PathRoot: {
|
|
DirMode: 0755,
|
|
FileMode: 0444,
|
|
Files: map[string]os.FileMode{
|
|
"backends": 0444,
|
|
"help": 0444,
|
|
},
|
|
},
|
|
PathElevate: {
|
|
DirMode: 0755,
|
|
FileMode: 0666,
|
|
Files: map[string]os.FileMode{
|
|
"policy": 0666,
|
|
"pending": 0755,
|
|
},
|
|
},
|
|
PathSessions: {
|
|
DirMode: 0755,
|
|
FileMode: 0444,
|
|
Files: map[string]os.FileMode{
|
|
"new": 0666,
|
|
"idx": 0444,
|
|
"ls": 0555,
|
|
"kill": 0555,
|
|
"sh": 0550,
|
|
"b": 0555,
|
|
"bfg": 0555,
|
|
"bbg": 0555,
|
|
"cleanup": 0555,
|
|
},
|
|
},
|
|
PathSessionDir: {DirMode: 0755},
|
|
PathTools: {DirMode: 0755, FileMode: 0755},
|
|
PathSessionFile: {
|
|
Files: map[string]os.FileMode{
|
|
"elevate": 0666,
|
|
"plan": 0666,
|
|
"ctl": 0666,
|
|
"prompt": 0666,
|
|
"fifo.in": 0222,
|
|
"fifo.out": 0444,
|
|
"chat": 0444,
|
|
"offset": 0444,
|
|
"cfg": 0666,
|
|
"state": 0444,
|
|
"statewait": 0444,
|
|
"usage": 0444,
|
|
"cost": 0444,
|
|
"ctxsz": 0444,
|
|
"models": 0444,
|
|
"systemprompt": 0444,
|
|
"env": 0444,
|
|
"tail": 0555,
|
|
"prompt.prev": 0444,
|
|
"context": 0444,
|
|
"toolsrv.loaded": 0444,
|
|
"toolsrv.rev": 0444,
|
|
"tools": 0666,
|
|
},
|
|
},
|
|
}
|
|
|
|
// Structural permissions — invariants of the Tree type itself.
|
|
const (
|
|
PermIdx os.FileMode = 0444 // synthetic index files are always read-only
|
|
PermChildDir os.FileMode = 0555 // mounted child directories are always rx
|
|
)
|
|
|
|
// OS-level directory creation mode (for os.MkdirAll of backing dirs on disk).
|
|
const PermMkdir os.FileMode = 0755
|
|
|
|
// Private directory creation mode (e.g. sessions state dir).
|
|
const PermMkdirPrivate os.FileMode = 0700
|