feat: establish NekoNest Cloud control and relay

relay/internal/tenantfs/paths.go

@@ -0,0 +1,94 @@
+package tenantfs
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+type Paths struct {
+	Root        string
+	Database    string
+	Attachments string
+}
+
+func validTenantID(id string) bool {
+	if !strings.HasPrefix(id, "tenant_") || len(id) != len("tenant_")+32 {
+		return false
+	}
+	for _, char := range strings.TrimPrefix(id, "tenant_") {
+		if !strings.ContainsRune("0123456789abcdef", char) {
+			return false
+		}
+	}
+	return true
+}
+
+func ensureRealDirectory(path string) error {
+	if err := os.MkdirAll(path, 0o700); err != nil {
+		return err
+	}
+	if err := os.Chmod(path, 0o700); err != nil {
+		return err
+	}
+	info, err := os.Lstat(path)
+	if err != nil {
+		return err
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+		return fmt.Errorf("%s is not a real directory", path)
+	}
+	return nil
+}
+
+// Derive maps an internal tenant UUID to non-client-visible paths without
+// creating them. Restore tooling uses this to stage an atomic directory swap.
+func Derive(dataRoot, tenantID string) (Paths, error) {
+	if !validTenantID(tenantID) {
+		return Paths{}, fmt.Errorf("invalid tenant id")
+	}
+	root, err := filepath.Abs(strings.TrimSpace(dataRoot))
+	if err != nil || strings.TrimSpace(dataRoot) == "" {
+		return Paths{}, fmt.Errorf("invalid data root")
+	}
+	tenantsRoot := filepath.Join(root, "tenants")
+	digest := sha256.Sum256([]byte("nekonest-cloud/tenant-directory/v1\x00" + tenantID))
+	directoryName := hex.EncodeToString(digest[:16])
+	tenantRoot := filepath.Join(tenantsRoot, directoryName)
+	if filepath.Dir(tenantRoot) != tenantsRoot {
+		return Paths{}, fmt.Errorf("tenant path escaped root")
+	}
+	attachments := filepath.Join(tenantRoot, "attachments")
+	return Paths{
+		Root:        tenantRoot,
+		Database:    filepath.Join(tenantRoot, "relay.db"),
+		Attachments: attachments,
+	}, nil
+}
+
+// Resolve derives and creates the secure directory tree for a live Engine.
+// The caller still carries tenant ID separately for authorization and fencing;
+// filesystem paths never accept client-controlled path fragments.
+func Resolve(dataRoot, tenantID string) (Paths, error) {
+	paths, err := Derive(dataRoot, tenantID)
+	if err != nil {
+		return Paths{}, err
+	}
+	root := filepath.Dir(filepath.Dir(paths.Root))
+	if err := ensureRealDirectory(root); err != nil {
+		return Paths{}, fmt.Errorf("prepare data root: %w", err)
+	}
+	if err := ensureRealDirectory(filepath.Dir(paths.Root)); err != nil {
+		return Paths{}, fmt.Errorf("prepare tenants root: %w", err)
+	}
+	if err := ensureRealDirectory(paths.Root); err != nil {
+		return Paths{}, fmt.Errorf("prepare tenant root: %w", err)
+	}
+	if err := ensureRealDirectory(paths.Attachments); err != nil {
+		return Paths{}, fmt.Errorf("prepare attachment root: %w", err)
+	}
+	return paths, nil
+}

relay/internal/tenantfs/paths_test.go

@@ -0,0 +1,58 @@
+package tenantfs
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestResolveUsesOpaqueTenantDirectoryAndRejectsTraversal(t *testing.T) {
+	tenantID := "tenant_0123456789abcdef0123456789abcdef"
+	paths, err := Resolve(t.TempDir(), tenantID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(paths.Root, tenantID) || filepath.Base(paths.Root) == tenantID {
+		t.Fatalf("tenant id leaked into path: %s", paths.Root)
+	}
+	if filepath.Dir(paths.Attachments) != paths.Root || filepath.Dir(paths.Database) != paths.Root {
+		t.Fatalf("paths escaped tenant root: %#v", paths)
+	}
+	if _, err := Resolve(t.TempDir(), "tenant_../../escape"); err == nil {
+		t.Fatal("traversal tenant id was accepted")
+	}
+}
+
+func TestDeriveDoesNotCreateTenantDirectory(t *testing.T) {
+	root := t.TempDir()
+	paths, err := Derive(root, "tenant_0123456789abcdef0123456789abcdef")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(paths.Root); !os.IsNotExist(err) {
+		t.Fatalf("Derive created tenant root: %v", err)
+	}
+}
+
+func TestResolveRejectsSymlinkedTenantRoot(t *testing.T) {
+	root := t.TempDir()
+	tenantID := "tenant_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	paths, err := Resolve(root, tenantID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Remove(paths.Attachments); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Remove(paths.Root); err != nil {
+		t.Fatal(err)
+	}
+	target := t.TempDir()
+	if err := os.Symlink(target, paths.Root); err != nil {
+		t.Skipf("symlink unavailable: %v", err)
+	}
+	if _, err := Resolve(root, tenantID); err == nil {
+		t.Fatal("symlinked tenant root was accepted")
+	}
+}