Files
vdm/daemon/src/store/sqlite.cpp
T
samiandClaude Sonnet 5 dab071c41a daemon: rpc/ws_server — loopback WebSocket transport + pairing (build step 1, second half)
The extension's fallback transport (docs/05 §4). veloxd now also listens
on 127.0.0.1, first free port in 52000-52016, and writes it to
<runtime>/ws.port (0600).

- rpc/ws_frame — RFC 6455 frame codec. Incremental; reassembles
  continuation frames; enforces "client frames MUST be masked" (§5.1);
  caps a reassembled message at 8 MiB. This is the attacker-adjacent
  parser, so it has its own test table.
- rpc/ws_handshake — HTTP upgrade parse, Sec-WebSocket-Accept
  (SHA-1 + base64 via libcrypto), and the two non-negotiable checks:
  an Origin header must be present and must be moz-extension:// (a page
  cannot pair). Version must be 13.
- rpc/ws_server — per-connection Handshake -> Open state machine on the
  shared EventLoop. Token gate: session.pair mints a token behind the
  approver + rate limiter; session.hello must present a valid one;
  every other method is -32002 until authed. Privileged methods are
  refused -32003 by the generated dispatch(). Ping -> Pong; Close
  echoed. session.hello major-version mismatch -> -32001.
- rpc/pairing — PairingApprover interface + EnvAutoApprover dev stub
  (approves iff VELOX_PAIR_AUTO=1); PairingRateLimiter (5 failures / 60 s
  per origin, then 60 s lockout -> -32014, survives reconnect); a
  four-digit code generator.
- store/pairings — the pairings table: create() returns the plaintext
  token once and stores only its SHA-256; find_active_by_token,
  touch, revoke, list_active.
- util/crypto — sha1 / sha256_hex / base64 / random_token over libcrypto.
- store/sqlite — pin the DB file (and -wal/-shm) to 0600.
- runtime_dir — resolve_data_dir() for $XDG_DATA_HOME/velox (velox.db).
- main.cpp — opens + migrates velox.db, starts both transports; a WS
  bind failure is logged, not fatal (capture must fail open, the Unix
  socket still serves the GUI/CLI).

Real gap, flagged not hidden: the pairing prompt is EnvAutoApprover for
now — a GUI dialog / desktop notification is build step 7. Pairing
needs VELOX_PAIR_AUTO=1 until then.

Tests (ASan+UBSan and TSan clean): veloxd.ws_frame (codec + handshake
vectors incl. the RFC 6455 §1.3 accept sample), veloxd.pairings (token
create/find/revoke, hash-not-token, rate-limit window + lockout +
per-origin isolation + success reset), veloxd.ws_server (full flow: 101
handshake, -32002 gate, deny-then-approve pairing, hello-with-token,
-32003 privileged refusal, real download.list). 27 daemon/cli tests
green; full tree green.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Upd9WhG9oppieig5nRDLig
2026-09-10 15:44:28 +04:00

156 lines
4.9 KiB
C++

#include "store/sqlite.hpp"
#include <sqlite3.h>
#include <sys/stat.h>
#include <utility>
namespace velox::daemon::store {
// --- Db ------------------------------------------------------------------------------
Db::~Db() {
if (db_ != nullptr) sqlite3_close(db_);
}
Db::Db(Db&& o) noexcept : db_(std::exchange(o.db_, nullptr)) {}
Db& Db::operator=(Db&& o) noexcept {
if (this != &o) {
if (db_ != nullptr) sqlite3_close(db_);
db_ = std::exchange(o.db_, nullptr);
}
return *this;
}
DbError Db::last_error() const {
return DbError{sqlite3_extended_errcode(db_), sqlite3_errmsg(db_)};
}
DbResult<Db> Db::open(const std::string& path) {
sqlite3* handle = nullptr;
const int rc = sqlite3_open_v2(
path.c_str(), &handle, SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_NOMUTEX,
nullptr);
if (rc != SQLITE_OK) {
DbError e{rc, handle != nullptr ? sqlite3_errmsg(handle) : "sqlite3_open_v2 failed"};
if (handle != nullptr) sqlite3_close(handle);
return std::unexpected(std::move(e));
}
Db db(handle);
// Not a secret store (credentials go to the Secret Service), but task URLs and pairing
// hashes still are not world-readable. SQLite honours the umask; pin 0600 explicitly.
if (path != ":memory:" && !path.empty() && path.front() != ':') {
::chmod(path.c_str(), 0600);
::chmod((path + "-wal").c_str(), 0600);
::chmod((path + "-shm").c_str(), 0600);
}
// WAL for crash-safe concurrent readers (docs/01 §1). busy_timeout so a writer waits
// rather than returning SQLITE_BUSY under the RPC loop. foreign_keys is per-connection.
for (const char* pragma : {"PRAGMA journal_mode=WAL", "PRAGMA synchronous=NORMAL",
"PRAGMA foreign_keys=ON", "PRAGMA busy_timeout=5000"}) {
if (auto r = db.exec(pragma); !r) return std::unexpected(r.error());
}
return db;
}
DbResult<void> Db::exec(std::string_view sql) {
char* err = nullptr;
const int rc = sqlite3_exec(db_, std::string(sql).c_str(), nullptr, nullptr, &err);
if (rc != SQLITE_OK) {
DbError e{rc, err != nullptr ? err : sqlite3_errmsg(db_)};
sqlite3_free(err);
return std::unexpected(std::move(e));
}
return {};
}
DbResult<Stmt> Db::prepare(std::string_view sql) {
sqlite3_stmt* s = nullptr;
const int rc =
sqlite3_prepare_v2(db_, sql.data(), static_cast<int>(sql.size()), &s, nullptr);
if (rc != SQLITE_OK) return std::unexpected(last_error());
return Stmt(db_, s);
}
std::int64_t Db::user_version() {
auto st = prepare("PRAGMA user_version");
if (!st) return -1;
auto row = st->step();
if (!row || !*row) return -1;
return st->column_int(0);
}
DbResult<void> Db::set_user_version(std::int64_t v) {
// PRAGMA does not accept a bound parameter; the value is our own integer.
return exec("PRAGMA user_version=" + std::to_string(v));
}
// --- Stmt ----------------------------------------------------------------------------
Stmt::~Stmt() {
if (stmt_ != nullptr) sqlite3_finalize(stmt_);
}
Stmt::Stmt(Stmt&& o) noexcept
: db_(std::exchange(o.db_, nullptr)), stmt_(std::exchange(o.stmt_, nullptr)) {}
Stmt& Stmt::operator=(Stmt&& o) noexcept {
if (this != &o) {
if (stmt_ != nullptr) sqlite3_finalize(stmt_);
db_ = std::exchange(o.db_, nullptr);
stmt_ = std::exchange(o.stmt_, nullptr);
}
return *this;
}
DbError Stmt::last_error() const {
return DbError{sqlite3_extended_errcode(db_), sqlite3_errmsg(db_)};
}
DbResult<void> Stmt::bind(int i, std::int64_t v) {
if (sqlite3_bind_int64(stmt_, i, v) != SQLITE_OK) return std::unexpected(last_error());
return {};
}
DbResult<void> Stmt::bind(int i, std::string_view v) {
if (sqlite3_bind_text(stmt_, i, v.data(), static_cast<int>(v.size()), SQLITE_TRANSIENT) !=
SQLITE_OK)
return std::unexpected(last_error());
return {};
}
DbResult<void> Stmt::bind_null(int i) {
if (sqlite3_bind_null(stmt_, i) != SQLITE_OK) return std::unexpected(last_error());
return {};
}
DbResult<bool> Stmt::step() {
const int rc = sqlite3_step(stmt_);
if (rc == SQLITE_ROW) return true;
if (rc == SQLITE_DONE) return false;
return std::unexpected(last_error());
}
DbResult<void> Stmt::reset() {
if (sqlite3_reset(stmt_) != SQLITE_OK) return std::unexpected(last_error());
return {};
}
std::int64_t Stmt::column_int(int i) const { return sqlite3_column_int64(stmt_, i); }
std::string Stmt::column_text(int i) const {
const auto* p = sqlite3_column_text(stmt_, i);
if (p == nullptr) return {};
return std::string(reinterpret_cast<const char*>(p),
static_cast<std::size_t>(sqlite3_column_bytes(stmt_, i)));
}
bool Stmt::column_is_null(int i) const {
return sqlite3_column_type(stmt_, i) == SQLITE_NULL;
}
} // namespace velox::daemon::store