Use HttpApi for Environment APIs & standardize authn/authz

apps/desktop/package.json

@@ -16,6 +16,7 @@
   },
   "dependencies": {
     "@effect/platform-node": "catalog:",
+    "@t3tools/client-runtime": "workspace:*",
     "@t3tools/contracts": "workspace:*",
     "@t3tools/shared": "workspace:*",
     "@t3tools/ssh": "workspace:*",

apps/desktop/src/ipc/DesktopIpcHandlers.ts

@@ -22,7 +22,7 @@ import {
   ensureSshEnvironment,
   fetchSshEnvironmentDescriptor,
   fetchSshSessionState,
-  issueSshWebSocketToken,
+  issueSshWebSocketTicket,
   resolveSshPasswordPrompt,
 } from "./methods/sshEnvironment.ts";
 import {
@@ -62,7 +62,7 @@ export const installDesktopIpcHandlers = Effect.gen(function* () {
   yield* ipc.handle(fetchSshEnvironmentDescriptor);
   yield* ipc.handle(bootstrapSshBearerSession);
   yield* ipc.handle(fetchSshSessionState);
-  yield* ipc.handle(issueSshWebSocketToken);
+  yield* ipc.handle(issueSshWebSocketTicket);
   yield* ipc.handle(resolveSshPasswordPrompt);
 
   yield* ipc.handle(getServerExposureState);

apps/desktop/src/ipc/methods/sshEnvironment.test.ts

@@ -0,0 +1,115 @@
+import { assert, describe, it } from "@effect/vitest";
+import { SshHttpBridgeError } from "@t3tools/ssh/errors";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
+
+import {
+  DesktopSshEnvironmentRequestError,
+  fetchSshEnvironmentDescriptor,
+} from "./sshEnvironment.ts";
+
+function jsonResponse(request: HttpClientRequest.HttpClientRequest, body: unknown, status = 200) {
+  return HttpClientResponse.fromWeb(
+    request,
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+function makeHttpClientLayer(
+  handler: (
+    request: HttpClientRequest.HttpClientRequest,
+  ) => Effect.Effect<HttpClientResponse.HttpClientResponse, never>,
+) {
+  return Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) => handler(request)),
+  );
+}
+
+describe("SSH environment IPC", () => {
+  it.effect("fetches and decodes the remote environment descriptor", () => {
+    const requestUrls: string[] = [];
+    const layer = makeHttpClientLayer((request) =>
+      Effect.sync(() => {
+        requestUrls.push(request.url);
+        return jsonResponse(request, {
+          environmentId: "remote-env",
+          label: "Remote Devbox",
+          platform: { os: "linux", arch: "x64" },
+          serverVersion: "1.2.3",
+          capabilities: { repositoryIdentity: true },
+        });
+      }),
+    );
+
+    return Effect.gen(function* () {
+      const descriptor = yield* fetchSshEnvironmentDescriptor.handler({
+        httpBaseUrl: "http://127.0.0.1:41773/",
+      });
+
+      assert.deepEqual(descriptor, {
+        environmentId: "remote-env",
+        label: "Remote Devbox",
+        platform: { os: "linux", arch: "x64" },
+        serverVersion: "1.2.3",
+        capabilities: { repositoryIdentity: true },
+      });
+      assert.deepEqual(requestUrls, ["http://127.0.0.1:41773/.well-known/t3/environment"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("wraps schema decode failures in a typed request error", () => {
+    const layer = makeHttpClientLayer((request) =>
+      Effect.succeed(jsonResponse(request, { environmentId: "remote-env" })),
+    );
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        fetchSshEnvironmentDescriptor.handler({
+          httpBaseUrl: "http://127.0.0.1:41773/",
+        }),
+      );
+      assert(Exit.isFailure(exit));
+      const failure = Cause.findErrorOption(exit.cause);
+      assert(Option.isSome(failure));
+      const error = failure.value;
+
+      assert.instanceOf(error, DesktopSshEnvironmentRequestError);
+      assert.equal(error.operation, "fetch-environment-descriptor");
+      assert.equal(error.cause instanceof SshHttpBridgeError, false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("rejects non-loopback HTTP endpoints before issuing a request", () => {
+    let requestCount = 0;
+    const layer = makeHttpClientLayer((request) =>
+      Effect.sync(() => {
+        requestCount += 1;
+        return jsonResponse(request, {});
+      }),
+    );
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        fetchSshEnvironmentDescriptor.handler({
+          httpBaseUrl: "http://remote.example.com:41773/",
+        }),
+      );
+      assert(Exit.isFailure(exit));
+      const failure = Cause.findErrorOption(exit.cause);
+      assert(Option.isSome(failure));
+      const error = failure.value;
+
+      assert.instanceOf(error, DesktopSshEnvironmentRequestError);
+      assert.instanceOf(error.cause, SshHttpBridgeError);
+      assert.equal(requestCount, 0);
+    }).pipe(Effect.provide(layer));
+  });
+});

apps/desktop/src/ipc/methods/sshEnvironment.ts

@@ -1,3 +1,9 @@
+import {
+  bootstrapRemoteBearerSession,
+  fetchRemoteEnvironmentDescriptor,
+  fetchRemoteSessionState,
+  issueRemoteWebSocketTicket,
+} from "@t3tools/client-runtime";
 import {
   DesktopDiscoveredSshHostSchema,
   DesktopSshBearerBootstrapInputSchema,
@@ -9,18 +15,47 @@ import {
   DesktopSshPasswordPromptCancelledType,
   DesktopSshPasswordPromptResolutionInputSchema,
   ExecutionEnvironmentDescriptor,
-  AuthBearerBootstrapResult,
+  AuthAccessTokenResult,
   AuthSessionState,
-  AuthWebSocketTokenResult,
+  AuthWebSocketTicketResult,
 } from "@t3tools/contracts";
+import { resolveLoopbackSshHttpBaseUrl } from "@t3tools/ssh/tunnel";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 
 import * as IpcChannels from "../channels.ts";
 import { makeIpcMethod } from "../DesktopIpc.ts";
 import * as DesktopSshEnvironment from "../../ssh/DesktopSshEnvironment.ts";
 import * as DesktopSshPasswordPrompts from "../../ssh/DesktopSshPasswordPrompts.ts";
-import * as DesktopSshRemoteApi from "../../ssh/DesktopSshRemoteApi.ts";
+
+type DesktopSshEnvironmentRequestOperation =
+  | "fetch-environment-descriptor"
+  | "bootstrap-bearer-session"
+  | "fetch-session-state"
+  | "issue-websocket-ticket";
+
+export class DesktopSshEnvironmentRequestError extends Data.TaggedError(
+  "DesktopSshEnvironmentRequestError",
+)<{
+  readonly operation: DesktopSshEnvironmentRequestOperation;
+  readonly cause: unknown;
+}> {
+  override get message() {
+    return `SSH remote API request failed during ${this.operation}.`;
+  }
+}
+
+const withLoopbackSshApi =
+  <A, E, R>(
+    operation: DesktopSshEnvironmentRequestOperation,
+    use: (httpBaseUrl: string) => Effect.Effect<A, E, R>,
+  ) =>
+  (httpBaseUrl: string): Effect.Effect<A, DesktopSshEnvironmentRequestError, R> =>
+    resolveLoopbackSshHttpBaseUrl(httpBaseUrl).pipe(
+      Effect.flatMap(use),
+      Effect.mapError((cause) => new DesktopSshEnvironmentRequestError({ operation, cause })),
+    );
 
 export const discoverSshHosts = makeIpcMethod({
   channel: IpcChannels.DISCOVER_SSH_HOSTS_CHANNEL,
@@ -69,21 +104,26 @@ export const fetchSshEnvironmentDescriptor = makeIpcMethod({
   payload: DesktopSshHttpBaseUrlInputSchema,
   result: ExecutionEnvironmentDescriptor,
   handler: Effect.fn("desktop.ipc.sshEnvironment.fetchDescriptor")(function* ({ httpBaseUrl }) {
-    const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-    return yield* remoteApi.fetchEnvironmentDescriptor({ httpBaseUrl });
+    return yield* withLoopbackSshApi("fetch-environment-descriptor", (resolvedHttpBaseUrl) =>
+      fetchRemoteEnvironmentDescriptor({ httpBaseUrl: resolvedHttpBaseUrl }),
+    )(httpBaseUrl);
   }),
 });
 
 export const bootstrapSshBearerSession = makeIpcMethod({
   channel: IpcChannels.BOOTSTRAP_SSH_BEARER_SESSION_CHANNEL,
   payload: DesktopSshBearerBootstrapInputSchema,
-  result: AuthBearerBootstrapResult,
+  result: AuthAccessTokenResult,
   handler: Effect.fn("desktop.ipc.sshEnvironment.bootstrapBearerSession")(function* ({
     httpBaseUrl,
     credential,
   }) {
-    const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-    return yield* remoteApi.bootstrapBearerSession({ httpBaseUrl, credential });
+    return yield* withLoopbackSshApi("bootstrap-bearer-session", (resolvedHttpBaseUrl) =>
+      bootstrapRemoteBearerSession({
+        httpBaseUrl: resolvedHttpBaseUrl,
+        credential,
+      }),
+    )(httpBaseUrl);
   }),
 });
 
@@ -95,21 +135,29 @@ export const fetchSshSessionState = makeIpcMethod({
     httpBaseUrl,
     bearerToken,
   }) {
-    const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-    return yield* remoteApi.fetchSessionState({ httpBaseUrl, bearerToken });
+    return yield* withLoopbackSshApi("fetch-session-state", (resolvedHttpBaseUrl) =>
+      fetchRemoteSessionState({
+        httpBaseUrl: resolvedHttpBaseUrl,
+        bearerToken,
+      }),
+    )(httpBaseUrl);
   }),
 });
 
-export const issueSshWebSocketToken = makeIpcMethod({
+export const issueSshWebSocketTicket = makeIpcMethod({
   channel: IpcChannels.ISSUE_SSH_WEBSOCKET_TOKEN_CHANNEL,
   payload: DesktopSshBearerRequestInputSchema,
-  result: AuthWebSocketTokenResult,
-  handler: Effect.fn("desktop.ipc.sshEnvironment.issueWebSocketToken")(function* ({
+  result: AuthWebSocketTicketResult,
+  handler: Effect.fn("desktop.ipc.sshEnvironment.issueWebSocketTicket")(function* ({
     httpBaseUrl,
     bearerToken,
   }) {
-    const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-    return yield* remoteApi.issueWebSocketToken({ httpBaseUrl, bearerToken });
+    return yield* withLoopbackSshApi("issue-websocket-ticket", (resolvedHttpBaseUrl) =>
+      issueRemoteWebSocketTicket({
+        httpBaseUrl: resolvedHttpBaseUrl,
+        bearerToken,
+      }),
+    )(httpBaseUrl);
   }),
 });
 

apps/desktop/src/main.ts

@@ -40,7 +40,6 @@ import * as DesktopAppSettings from "./settings/DesktopAppSettings.ts";
 import * as DesktopShellEnvironment from "./shell/DesktopShellEnvironment.ts";
 import * as DesktopSshEnvironment from "./ssh/DesktopSshEnvironment.ts";
 import * as DesktopSshPasswordPrompts from "./ssh/DesktopSshPasswordPrompts.ts";
-import * as DesktopSshRemoteApi from "./ssh/DesktopSshRemoteApi.ts";
 import * as DesktopState from "./app/DesktopState.ts";
 import * as DesktopUpdates from "./updates/DesktopUpdates.ts";
 import * as DesktopWindow from "./window/DesktopWindow.ts";
@@ -116,7 +115,7 @@ const desktopFoundationLayer = Layer.mergeAll(
   DesktopObservability.layer,
 ).pipe(Layer.provideMerge(desktopEnvironmentLayer));
 
-const desktopSshLayer = Layer.mergeAll(desktopSshEnvironmentLayer, DesktopSshRemoteApi.layer).pipe(
+const desktopSshLayer = desktopSshEnvironmentLayer.pipe(
   Layer.provideMerge(DesktopSshPasswordPrompts.layer()),
 );
 

apps/desktop/src/preload.ts

@@ -66,7 +66,7 @@ contextBridge.exposeInMainWorld("desktopBridge", {
     }),
   fetchSshSessionState: (httpBaseUrl, bearerToken) =>
     ipcRenderer.invoke(IpcChannels.FETCH_SSH_SESSION_STATE_CHANNEL, { httpBaseUrl, bearerToken }),
-  issueSshWebSocketToken: (httpBaseUrl, bearerToken) =>
+  issueSshWebSocketTicket: (httpBaseUrl, bearerToken) =>
     ipcRenderer.invoke(IpcChannels.ISSUE_SSH_WEBSOCKET_TOKEN_CHANNEL, { httpBaseUrl, bearerToken }),
   onSshPasswordPrompt: (listener) => {
     const wrappedListener = (_event: Electron.IpcRendererEvent, request: unknown) => {