ipc-broker 1.1.5

// Windows ACL/SDDL helper utilities (cfg-windows)
//
// This module provides a small, safe utility to obtain a configured
// SDDL string for named-pipe creation. It performs basic validation to
// avoid obviously insecure values (such as granting access to Everyone)
// and exposes an "effective" SDDL that the broker can consult before
// creating pipes. Actual application of the SDDL to the underlying
// pipe handle needs platform API calls; this helper centralizes config
// and validation so it's straightforward to plug-in the platform
// integration later.

#[cfg(windows)]
use std::env;

/// Returns the raw SDDL configured via environment variable
/// `IPC_BROKER_PIPE_SDDL`, if present.
pub fn configured_sddl() -> Option<String> {
    env::var("IPC_BROKER_PIPE_SDDL").ok()
}

/// Inspect a candidate SDDL string for obviously insecure principals.
/// Returns `true` if the SDDL is considered insecure (e.g. contains
/// the `WD` (Everyone) SID or the literal word "Everyone").
pub fn sddl_is_insecure(sddl: &str) -> bool {
    let s = sddl.to_ascii_lowercase();
    s.contains("wd") || s.contains("everyone")
}

/// Produce an "effective" SDDL to use for pipe creation.
///
/// Behavior:
/// - If `IPC_BROKER_PIPE_SDDL` is set and is not insecure, return it.
/// - If it is set but insecure, return `Err` with a message explaining why.
/// - If unset, return a conservative default SDDL that does NOT grant
///   access to Everyone. The default grants access to `Authenticated Users`.
pub fn effective_sddl() -> Result<Option<String>, String> {
    if let Some(cfg) = configured_sddl() {
        if sddl_is_insecure(&cfg) {
            return Err(format!(
                "Refusing to use insecure SDDL provided in IPC_BROKER_PIPE_SDDL: '{}'",
                cfg
            ));
        }
        return Ok(Some(cfg));
    }

    // Conservative default: grant full access to Authenticated Users (AU)
    // and Administrators. This avoids the common-but-insecure Everyone (WD)
    // binding. Example default: D:(A;;GA;;;AU)(A;;GA;;;BA)
    let default = "D:(A;;GA;;;AU)(A;;GA;;;BA)".to_string();
    Ok(Some(default))
}

/// Returns a short human-facing guidance message for README or logs.
pub fn guidance_msg() -> &'static str {
    "Set IPC_BROKER_PIPE_SDDL to a suitable SDDL string (avoid 'WD'/Everyone)."
}

#[cfg(not(windows))]
compile_error!("src/windows_acl.rs must only be compiled on Windows targets");