feat: add deployable alpha silo

hub/src/security/workspaceFiles.ts

@@ -7,7 +7,7 @@ export class WorkspaceFileBoundaryError extends Error {
   constructor(
     message: string,
     readonly requestedPath: string,
-    readonly reason: "not_found" | "boundary" | "io" = "boundary",
+    readonly reason: "not_found" | "boundary" | "io" | "limit" = "boundary",
     options?: ErrorOptions,
   ) {
     super(message, options);
@@ -77,12 +77,14 @@ export async function writeNewWorkspaceFileNoFollow(
   workspaceDir: string,
   requestedPath: string,
   source: Readable,
+  maxBytes?: number,
 ): Promise<string> {
   return (await writeNewWorkspaceFileNoFollowTracked(
     workspaceRoot,
     workspaceDir,
     requestedPath,
     source,
+    maxBytes,
   )).path;
 }
 
@@ -92,6 +94,7 @@ export async function writeNewWorkspaceFileNoFollowTracked(
   workspaceDir: string,
   requestedPath: string,
   source: Readable,
+  maxBytes?: number,
 ): Promise<WorkspaceFileWriteResult> {
   const workspace = await canonicalWorkspace(workspaceRoot, workspaceDir);
   const components = fileComponents(workspace, requestedPath);
@@ -114,8 +117,17 @@ export async function writeNewWorkspaceFileNoFollowTracked(
     const metadata = await file.stat();
     device = metadata.dev;
     inode = metadata.ino;
+    let bytesWritten = 0;
     for await (const chunk of source) {
       const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk as Uint8Array);
+      bytesWritten += buffer.length;
+      if (maxBytes !== undefined && bytesWritten > maxBytes) {
+        throw new WorkspaceFileBoundaryError(
+          `inbound file exceeds ${maxBytes} bytes: ${requestedPath}`,
+          requestedPath,
+          "limit",
+        );
+      }
       let offset = 0;
       while (offset < buffer.length) {
         const { bytesWritten } = await file.write(buffer, offset, buffer.length - offset, null);