mirror of
https://github.com/profullstack/agentbbs.git
synced 2026-08-13 14:27:27 +00:00
Anthony Ettinger
6dc94bd784
Implements M4 (Files). A fully virtual Go SFTP server (pkg/sftp + crypto/ssh,
no OS users) wired as an "sftp" subsystem on the existing :22 wish listener, so
members reach their files with their login key:
sftp files@bbs.profullstack.com # scp/rsync ride the same endpoint
Identity is the SSH key (the username is conventional/ignored). Two areas per
session: a private, quota-limited /me workspace and a single shared public file
area /public (old-school BBS file area; world-read, members-only write by
default, operator-moderated). This reverses the old NG1 "no sharing" boundary in
favour of one sanctioned, inspectable sharing surface (PRD §9.3 amended).
internal/files:
- backend.go service, layout, quota/usage, live-session registry, operator API
- fs.go per-session virtual FS; resolve() is the single security
chokepoint (area confinement + symlink-escape guard) + pkg/sftp
request handlers
- server.go subsystem handler: key auth -> member session -> request server,
with byte metering and force-disconnect
- tui.go in-BBS member browser (hub plugin "Files")
- admin.go operator management TUI: sessions, workspaces/quotas, public area
Operator console: ssh sftp@<host> (allowlist-gated; sftpadmin@/filesadmin@
aliases) — list/disconnect sessions, set per-user quotas, revoke SFTP access,
toggle public write, moderate the public area.
store: files_access (per-user quota override + revoked) and files_settings
(public-write mode) tables + methods. main.go wiring guarded by AGENTBBS_FILES
(+ AGENTBBS_FILES_QUOTA_MB, default 1 GiB). Route names reserved.
Tests (incl -race): path traversal/confinement, symlink-escape rejection,
public-write ACL, quota enforcement, usage accounting, and an end-to-end run
against a real SFTP client. Docs: docs/files.md; PRD §5.3/§5.3.1/§9.3 + README
updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
126 lines
5.8 KiB
Modula-2
126 lines
5.8 KiB
Modula-2
module github.com/profullstack/agentbbs
|
|
|
|
go 1.26
|
|
|
|
require (
|
|
github.com/charmbracelet/bubbletea v1.3.10
|
|
github.com/charmbracelet/lipgloss v1.1.0
|
|
github.com/charmbracelet/log v1.0.0
|
|
github.com/charmbracelet/ssh v0.0.0-20250826160808-ebfa259c7309
|
|
github.com/charmbracelet/wish v1.4.7
|
|
github.com/creack/pty v1.1.24
|
|
github.com/dustin/go-nntp v0.0.0-20210723005859-f00d51cf8cc1
|
|
github.com/emersion/go-imap/v2 v2.0.0-beta.8
|
|
github.com/emersion/go-message v0.18.2
|
|
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
|
|
github.com/livekit/protocol v1.46.0
|
|
github.com/livekit/server-sdk-go/v2 v2.16.6
|
|
github.com/pion/webrtc/v4 v4.2.15
|
|
github.com/pkg/sftp v1.13.10
|
|
golang.org/x/crypto v0.50.0
|
|
golang.org/x/term v0.42.0
|
|
modernc.org/sqlite v1.52.0
|
|
)
|
|
|
|
require (
|
|
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260209202127-80ab13bee0bf.1 // indirect
|
|
buf.build/go/protovalidate v1.1.2 // indirect
|
|
buf.build/go/protoyaml v0.6.0 // indirect
|
|
cel.dev/expr v0.25.1 // indirect
|
|
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
|
|
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/benbjohnson/clock v1.3.5 // indirect
|
|
github.com/bep/debounce v1.2.1 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/charmbracelet/colorprofile v0.4.1 // indirect
|
|
github.com/charmbracelet/keygen v0.5.3 // indirect
|
|
github.com/charmbracelet/x/ansi v0.11.6 // indirect
|
|
github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
|
|
github.com/charmbracelet/x/conpty v0.1.0 // indirect
|
|
github.com/charmbracelet/x/errors v0.0.0-20240508181413-e8d8b6e2de86 // indirect
|
|
github.com/charmbracelet/x/input v0.3.4 // indirect
|
|
github.com/charmbracelet/x/term v0.2.2 // indirect
|
|
github.com/charmbracelet/x/termios v0.1.0 // indirect
|
|
github.com/charmbracelet/x/windows v0.2.0 // indirect
|
|
github.com/clipperhouse/displaywidth v0.9.0 // indirect
|
|
github.com/clipperhouse/stringish v0.1.1 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.5.0 // indirect
|
|
github.com/dennwc/iters v1.2.2 // indirect
|
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
|
github.com/frostbyte73/core v0.1.1 // indirect
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
|
github.com/gammazero/deque v1.2.1 // indirect
|
|
github.com/go-jose/go-jose/v3 v3.0.5 // indirect
|
|
github.com/go-logfmt/logfmt v0.6.1 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/google/cel-go v0.27.0 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/jxskiss/base62 v1.1.0 // indirect
|
|
github.com/klauspost/compress v1.18.4 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/kr/fs v0.1.0 // indirect
|
|
github.com/lithammer/shortuuid/v4 v4.2.0 // indirect
|
|
github.com/livekit/mageutil v0.0.0-20250511045019-0f1ff63f7731 // indirect
|
|
github.com/livekit/mediatransportutil v0.0.0-20260521165806-8004f10ad0c5 // indirect
|
|
github.com/livekit/psrpc v0.7.1 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
|
|
github.com/magefile/mage v1.17.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-localereader v0.0.1 // indirect
|
|
github.com/mattn/go-runewidth v0.0.19 // indirect
|
|
github.com/moby/sys/user v0.4.0 // indirect
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/muesli/termenv v0.16.0 // indirect
|
|
github.com/nats-io/nats.go v1.48.0 // indirect
|
|
github.com/nats-io/nkeys v0.4.15 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/pion/datachannel v1.6.0 // indirect
|
|
github.com/pion/dtls/v3 v3.1.4 // indirect
|
|
github.com/pion/ice/v4 v4.2.7 // indirect
|
|
github.com/pion/interceptor v0.1.45 // indirect
|
|
github.com/pion/logging v0.2.4 // indirect
|
|
github.com/pion/mdns/v2 v2.1.0 // indirect
|
|
github.com/pion/randutil v0.1.0 // indirect
|
|
github.com/pion/rtcp v1.2.16 // indirect
|
|
github.com/pion/rtp v1.10.2 // indirect
|
|
github.com/pion/sctp v1.10.0 // indirect
|
|
github.com/pion/sdp/v3 v3.0.18 // indirect
|
|
github.com/pion/srtp/v3 v3.0.11 // indirect
|
|
github.com/pion/stun/v3 v3.1.5 // indirect
|
|
github.com/pion/transport/v4 v4.0.2 // indirect
|
|
github.com/pion/turn/v5 v5.0.9 // indirect
|
|
github.com/puzpuzpuz/xsync/v3 v3.5.1 // indirect
|
|
github.com/redis/go-redis/v9 v9.17.2 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/twitchtv/twirp v8.1.3+incompatible // indirect
|
|
github.com/wlynxg/anet v0.0.5 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
github.com/zeebo/xxh3 v1.1.0 // indirect
|
|
go.opentelemetry.io/otel v1.43.0 // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.1 // indirect
|
|
go.uber.org/zap/exp v0.3.0 // indirect
|
|
golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
|
|
golang.org/x/net v0.53.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.43.0 // indirect
|
|
golang.org/x/text v0.36.0 // indirect
|
|
golang.org/x/time v0.14.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260427160629-7cedc36a6bc4 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4 // indirect
|
|
google.golang.org/grpc v1.80.0 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
modernc.org/libc v1.72.3 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|