Open History to see the last commit
1// @effect-diagnostics nodeBuiltinImport:off - Effect's realPath keeps the requested letter case.
2import * as NodeFSP from "node:fs/promises";
3
4import * as Effect from "effect/Effect";
5import * as Path from "effect/Path";
6
7import * as ServerConfig from "../config.ts";
8import { isWithinRoot } from "../workspace/KnownWorkspaces.ts";
9
10/** Builds a check for the server's own state files, which client file reads do not serve. */
11export const makeIsServerInternalPath = Effect.gen(function* () {
12 const config = yield* ServerConfig.ServerConfig;
13 const path = yield* Path.Path;
14 // Native realpath returns the on-disk letter case.
15 const realPath = (value: string) =>
16 Effect.promise(() => NodeFSP.realpath(value).catch(() => path.resolve(value)));
17 return Effect.fn("ServerInternalPaths.isServerInternalPath")(function* (filePath: string) {
18 const [file, stateDir, secretsDir] = yield* Effect.all(
19 [realPath(filePath), realPath(config.stateDir), realPath(config.secretsDir)],
20 { concurrency: "unbounded" },
21 );
22 return (
23 isWithinRoot(path, file, secretsDir) ||
24 (path.dirname(file) === stateDir && path.basename(file).includes(".sqlite")) ||
25 // macOS does not resolve `/dev/fd/N` to the open file's path.
26 isWithinRoot(path, file, "/dev/fd")
27 );
28 });
29});