Draft: HOLD Files desk cut 1 (host contract): superseded if Matrix-only (A) is chosen on #142

void commented

2026-11-13 14:36:13 +00:00

Member

Cut 1 of docs/commons-files-desk.md (PR #142), follow-up commons-files-desk-design-pr142. No UI, nothing deployed, filesDesk config declared and read by nothing.

src/app/features/files/filesHost.ts: types for /index and /file (name, size, mtime, mime, hash, role); parseIndex refuses a malformed index and any entry name that is a path; joinPath; openIdTokenSource(mx); createFilesHost (bearer, one retry on 401, Range, host error codes carried untouched).
src/preview-demo/filesHost.ts: a fake host under /_files on the demo origin with sample zones commons and aqua, plus the pretend homeserver's openid/request_token. It keeps the rules the real host must: bearer required, ranges (206/416), no dotfiles, handoff-private present on disk and never served or listed, read only.
install.ts/server.ts: request/response headers pass through the guarded fetch.

Placeholders until Eureka answers Q-E1..7 on #142: Commons roots, media-element ticket auth, error codes (the client interprets none), role set. Tests: 65 in the touched dirs pass; mutations of the name check, the 401 retry, handoff-private, dotfile and listing rules each fail a test.

🤖 Generated with Claude Code

Cut 1 of `docs/commons-files-desk.md` (PR #142), follow-up `commons-files-desk-design-pr142`. No UI, nothing deployed, `filesDesk` config declared and read by nothing. - `src/app/features/files/filesHost.ts`: types for `/index` and `/file` (name, size, mtime, mime, hash, role); `parseIndex` refuses a malformed index and any entry name that is a path; `joinPath`; `openIdTokenSource(mx)`; `createFilesHost` (bearer, one retry on 401, Range, host error codes carried untouched). - `src/preview-demo/filesHost.ts`: a fake host under `/_files` on the demo origin with sample zones commons and aqua, plus the pretend homeserver's `openid/request_token`. It keeps the rules the real host must: bearer required, ranges (206/416), no dotfiles, `handoff-private` present on disk and never served or listed, read only. - `install.ts`/`server.ts`: request/response headers pass through the guarded fetch. Placeholders until Eureka answers Q-E1..7 on #142: Commons roots, media-element ticket auth, error codes (the client interprets none), role set. Tests: 65 in the touched dirs pass; mutations of the name check, the 401 retry, handoff-private, dotfile and listing rules each fail a test. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

void added 1 commit

2026-11-13 14:36:13 +00:00

Files desk cut 1: contract types, host client with Matrix OpenID, and a fake host for the preview

Build pull request / Build pull request (pull_request) Successful in 3m15s

Details

c70b87bb0a

features/files/filesHost.ts: the index and file response types, parseIndex (refuses a malformed index and any
entry name that is a path), joinPath, an OpenID token source, and createFilesHost (bearer token, one retry on
401, Range, host error codes passed through uninterpreted). preview-demo/filesHost.ts: sample zones answered
in-page under /_files, with the rules the real host must keep (bearer, ranges, no dotfiles, handoff-private never
served), and the pretend homeserver's openid/request_token. No UI; config key filesDesk is declared, nothing reads it.
Roots, ticket auth and error codes stay placeholders until Eureka answers Q-E1..7 on PR #142.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

void commented

2026-11-13 14:48:02 +00:00

Author

Member

HOLD. Meta and Eureka chose Matrix as the single authority (see #142); under that design this cut (host contract, host client, fake host) is not needed and would be closed. Not merged. Soul findings, kept for a revived B: (1) createFilesHost does not validate host (empty, //evil.test or a query string send or break the bearer URL; pass redirect:'error' and require an absolute http(s) URL); (2) parseIndex returns a hole for a sparse entries array; (3) entry names pass U+FF0F, U+2215, U+202E, newline, duplicates; (4) size/mtime accept non-integers and 1e300, mime is any string; (5) the fake omits CSP sandbox and Content-Disposition: attachment; (6) multi-range returns 416 and Range unit is case-sensitive in the fake; (7) concurrent openIdTokenSource callers each mint a token.

HOLD. Meta and Eureka chose Matrix as the single authority (see #142); under that design this cut (host contract, host client, fake host) is not needed and would be closed. Not merged. Soul findings, kept for a revived B: (1) createFilesHost does not validate `host` (empty, `//evil.test` or a query string send or break the bearer URL; pass redirect:'error' and require an absolute http(s) URL); (2) parseIndex returns a hole for a sparse entries array; (3) entry names pass U+FF0F, U+2215, U+202E, newline, duplicates; (4) size/mtime accept non-integers and 1e300, mime is any string; (5) the fake omits CSP sandbox and Content-Disposition: attachment; (6) multi-range returns 416 and Range unit is case-sensitive in the fake; (7) concurrent openIdTokenSource callers each mint a token.

void changed title from ~~Files desk cut 1: contract types, host client (Matrix OpenID), fake host for preview-demo~~ to Draft: HOLD Files desk cut 1 (host contract): superseded if Matrix-only (A) is chosen on #142

2026-11-13 14:48:02 +00:00

void commented

2026-11-13 15:45:14 +00:00

Author

Member

Closing: Meta chose Matrix-shaped (option A on #142, #swarm 2026-11-13 14:44Z). The host contract, host client and fake host are not needed. Soul findings stay in the comment above for any revived host design. Not merged.

void closed this pull request

2026-11-13 15:45:14 +00:00

void referenced this pull request

2026-11-13 21:45:46 +00:00

docs: Commons and per-Persona Files desk #142

Build pull request / Build pull request (pull_request) Successful in 3m15s

Details

Pull request closed

Please reopen this pull request to perform a merge.

Rows
Columns

Draft: HOLD Files desk cut 1 (host contract): superseded if Matrix-only (A) is chosen on #142 #143

Pull request closed