aen_window/

clipboard.rs

//! Bounded UTF-8 clipboard transactions on the compositor's owner control socket.
//! Scope zero is trusted session-operator access. Native window scopes are
//! checked by KnottCompositor; these scopes are not a same-UID application sandbox.
use std::io::{self, Read, Write};
use std::net::Shutdown;
use std::path::{Path, PathBuf};
use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::{mpsc, Arc};
use std::thread::{self, JoinHandle};
use std::time::{Duration, Instant};

/// Maximum UTF-8 selection retained by the compositor.
pub const MAX_TEXT_BYTES: usize = 64 * 1024;
/// Hex chunks fit the unchanged 1024-byte control request limit.
pub const CHUNK_BYTES: usize = 384;
const DEADLINE: Duration = Duration::from_secs(5);

/// Parsed, bounded native text clipboard control operation.
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum Command {
    /// Metadata only, never selection text.
    Status,
    /// Snapshot the current selection generation and byte length.
    Read(u64),
    /// Read one bounded chunk: window scope, generation, offset.
    Chunk(u64, u64, usize),
    /// Reserve one atomic write: window scope, total byte length.
    Begin(u64, usize),
    /// Append a chunk: window scope, transaction, offset, bytes.
    Append(u64, u64, usize, Vec<u8>),
    /// Publish a complete valid UTF-8 write: window scope, transaction.
    Commit(u64, u64),
    /// Cancel an unfinished write: window scope, transaction.
    Cancel(u64, u64),
    /// Clear the committed selection for a window scope or operator.
    Clear(u64),
}
impl Command {
    /// Compositor-issued window ID, or zero for the trusted operator control plane.
    pub fn scope(&self) -> u64 {
        match self {
            Self::Status => 0,
            Self::Read(s)
            | Self::Clear(s)
            | Self::Chunk(s, ..)
            | Self::Begin(s, ..)
            | Self::Append(s, ..)
            | Self::Commit(s, ..)
            | Self::Cancel(s, ..) => *s,
        }
    }
}
fn number(text: &str) -> Result<u64, &'static str> {
    if text.is_empty()
        || text.len() > 20
        || !text.bytes().all(|b| b.is_ascii_digit())
        || (text.len() > 1 && text.starts_with('0'))
    {
        return Err("invalid clipboard number");
    }
    text.parse().map_err(|_| "invalid clipboard number")
}
fn offset(text: &str) -> Result<usize, &'static str> {
    let n = number(text)?;
    if n > MAX_TEXT_BYTES as u64 {
        return Err("clipboard size exceeds limit");
    }
    Ok(n as usize)
}
/// Parse strict bounded commands without retaining an arbitrary command body.
pub fn parse(text: &str) -> Result<Command, &'static str> {
    if text.len() > 1024 || text.bytes().any(|b| b.is_ascii_control()) {
        return Err("invalid clipboard command");
    }
    let words: Vec<_> = text.split(' ').collect();
    match words.as_slice() {
        ["clipboard", "native", "status", "--json"] => Ok(Command::Status),
        ["clipboard", "read", s] => Ok(Command::Read(number(s)?)),
        ["clipboard", "chunk", s, g, n] => Ok(Command::Chunk(number(s)?, number(g)?, offset(n)?)),
        ["clipboard", "begin", s, n] => Ok(Command::Begin(number(s)?, offset(n)?)),
        ["clipboard", "append", s, t, n, bytes] => Ok(Command::Append(
            number(s)?,
            number(t)?,
            offset(n)?,
            unhex(bytes)?,
        )),
        ["clipboard", "commit", s, t] => Ok(Command::Commit(number(s)?, number(t)?)),
        ["clipboard", "cancel", s, t] => Ok(Command::Cancel(number(s)?, number(t)?)),
        ["clipboard", "clear", s] => Ok(Command::Clear(number(s)?)),
        _ => Err("invalid clipboard command"),
    }
}
fn hex(bytes: &[u8]) -> String {
    const DIGITS: &[u8] = b"0123456789abcdef";
    let mut result = String::with_capacity(bytes.len() * 2);
    for b in bytes {
        result.push(DIGITS[(b >> 4) as usize] as char);
        result.push(DIGITS[(b & 15) as usize] as char);
    }
    result
}
fn unhex(text: &str) -> Result<Vec<u8>, &'static str> {
    if text.is_empty() || text.len() > CHUNK_BYTES * 2 || text.len() & 1 != 0 {
        return Err("invalid clipboard chunk");
    }
    let digit = |b| match b {
        b'0'..=b'9' => Ok(b - b'0'),
        b'a'..=b'f' => Ok(b - b'a' + 10),
        _ => Err("invalid clipboard chunk"),
    };
    text.as_bytes()
        .chunks_exact(2)
        .map(|c| Ok(digit(c[0])? * 16 + digit(c[1])?))
        .collect()
}

/// Synchronous native clipboard client; GUI clients should use `Worker`.
pub struct Client {
    socket: PathBuf,
    scope: u64,
    deadline: Instant,
    stop: Arc<AtomicBool>,
}
impl Client {
    /// Start one operation with an absolute deadline on a selected compositor.
    pub fn new(socket: &Path, scope: u64) -> Self {
        Self {
            socket: socket.into(),
            scope,
            deadline: Instant::now() + DEADLINE,
            stop: Arc::new(AtomicBool::new(false)),
        }
    }
    fn check(&self) -> io::Result<Duration> {
        if self.stop.load(Ordering::Relaxed) {
            return Err(io::ErrorKind::Interrupted.into());
        }
        let remaining = self.deadline.saturating_duration_since(Instant::now());
        if remaining.is_zero() {
            return Err(io::ErrorKind::TimedOut.into());
        }
        Ok(remaining.min(Duration::from_millis(250)))
    }
    fn query(&self, text: &str) -> io::Result<String> {
        self.check()?;
        let mut socket = crate::platform::connect_local_until(&self.socket, self.deadline)?;
        socket.set_nonblocking(false)?;
        socket.set_write_timeout(Some(self.check()?))?;
        socket.write_all(text.as_bytes())?;
        socket.set_write_timeout(Some(self.check()?))?;
        socket.write_all(b"\n")?;
        socket.shutdown(Shutdown::Write)?;
        let mut result = Vec::new();
        let mut buffer = [0; 256];
        loop {
            socket.set_read_timeout(Some(self.check()?))?;
            let n = socket.read(&mut buffer)?;
            if n == 0 {
                break;
            }
            result.extend_from_slice(&buffer[..n]);
            if result.len() > 1024 {
                return Err(io::Error::other("native clipboard response exceeds limit"));
            }
        }
        let result = String::from_utf8(result)
            .map_err(|_| io::Error::other("invalid native clipboard response"))?;
        let result = result.strip_suffix('\n').unwrap_or(&result);
        if !result.starts_with("ok") || result.contains(['\r', '\n', '\0']) {
            return Err(io::Error::other(
                "native clipboard request unavailable or denied",
            ));
        }
        self.check()?;
        Ok(result.into())
    }
    /// Retrieve one complete generation; changes during transfer reject the read.
    pub fn read(&self) -> io::Result<String> {
        let response = self.query(&format!("clipboard read {}", self.scope))?;
        let (generation, len) = summary(&response)?;
        let mut bytes = Vec::with_capacity(len);
        while bytes.len() < len {
            let result = self.query(&format!(
                "clipboard chunk {} {} {}",
                self.scope,
                generation,
                bytes.len()
            ))?;
            let chunk = result
                .strip_prefix("ok chunk ")
                .ok_or_else(|| io::Error::other("invalid clipboard chunk response"))?;
            let chunk = unhex(chunk).map_err(io::Error::other)?;
            if chunk.len() != CHUNK_BYTES.min(len - bytes.len()) {
                return Err(io::Error::other("invalid clipboard chunk length"));
            }
            bytes.extend_from_slice(&chunk);
        }
        String::from_utf8(bytes).map_err(|_| io::Error::other("invalid clipboard UTF-8"))
    }
    /// Atomically replace UTF-8 text; incomplete writes preserve the old value.
    pub fn write(&self, text: &str) -> io::Result<()> {
        if text.len() > MAX_TEXT_BYTES {
            return Err(io::Error::other("clipboard text exceeds limit"));
        }
        let response = self.query(&format!("clipboard begin {} {}", self.scope, text.len()))?;
        let txn = response
            .strip_prefix("ok write ")
            .and_then(|s| number(s).ok())
            .filter(|n| *n > 0)
            .ok_or_else(|| io::Error::other("invalid clipboard transaction response"))?;
        let result = (|| {
            for (i, chunk) in text.as_bytes().chunks(CHUNK_BYTES).enumerate() {
                if self.query(&format!(
                    "clipboard append {} {} {} {}",
                    self.scope,
                    txn,
                    i * CHUNK_BYTES,
                    hex(chunk)
                ))? != "ok"
                {
                    return Err(io::Error::other("invalid clipboard append response"));
                }
            }
            let response = self.query(&format!("clipboard commit {} {}", self.scope, txn))?;
            let (_, bytes) = summary(&response)?;
            if bytes != text.len() {
                return Err(io::Error::other("invalid clipboard commit response"));
            }
            Ok(())
        })();
        if result.is_err() {
            let _ = self.query(&format!("clipboard cancel {} {}", self.scope, txn));
        }
        result
    }
    /// Explicitly clear the compositor's retained selection.
    pub fn clear(&self) -> io::Result<()> {
        summary(&self.query(&format!("clipboard clear {}", self.scope))?).map(|_| ())
    }
}
fn summary(text: &str) -> io::Result<(u64, usize)> {
    let words: Vec<_> = text.split(' ').collect();
    match words.as_slice() {
        ["ok", "clipboard", generation, len] => Ok((
            number(generation).map_err(io::Error::other)?,
            offset(len).map_err(io::Error::other)?,
        )),
        _ => Err(io::Error::other("invalid clipboard summary")),
    }
}
/// Select the control endpoint corresponding to an explicitly selected window endpoint.
pub fn socket_for_window(path: &Path) -> io::Result<PathBuf> {
    use std::os::unix::ffi::OsStrExt;
    let name = path
        .file_name()
        .ok_or_else(|| io::Error::other("missing native endpoint name"))?
        .as_bytes();
    let name = name
        .strip_suffix(b".windows")
        .filter(|n| !n.is_empty())
        .ok_or_else(|| {
            io::Error::other("native clipboard requires a matching compositor control endpoint")
        })?;
    Ok(path.with_file_name(std::ffi::OsStr::from_bytes(name)))
}
struct Job {
    id: u64,
    scope: u64,
    text: Option<String>,
}
/// Completion for one asynchronous copy or paste request.
pub struct Outcome {
    /// Application request serial.
    pub id: u64,
    /// Copy returns None; paste returns complete UTF-8 text.
    pub value: io::Result<Option<String>>,
}
/// One bounded request/result slot, serviced away from the application's UI loop.
pub struct Worker {
    sender: Option<mpsc::SyncSender<Job>>,
    receiver: mpsc::Receiver<Outcome>,
    stop: Arc<AtomicBool>,
    thread: Option<JoinHandle<()>>,
    next: u64,
    busy: bool,
}
impl Worker {
    /// Prepare a worker without connecting or requesting clipboard access.
    pub fn new(socket: PathBuf) -> io::Result<Self> {
        let (sender, jobs) = mpsc::sync_channel::<Job>(1);
        let (results, receiver) = mpsc::sync_channel(1);
        let stop = Arc::new(AtomicBool::new(false));
        let cancel = Arc::clone(&stop);
        let thread = thread::Builder::new()
            .name("aen-clipboard".into())
            .spawn(move || {
                while let Ok(job) = jobs.recv() {
                    if cancel.load(Ordering::Relaxed) {
                        break;
                    }
                    let mut client = Client::new(&socket, job.scope);
                    client.stop = Arc::clone(&cancel);
                    let value = match job.text {
                        Some(text) => client.write(&text).map(|_| None),
                        None => client.read().map(Some),
                    };
                    if results.try_send(Outcome { id: job.id, value }).is_err() {
                        break;
                    }
                }
            })?;
        Ok(Self {
            sender: Some(sender),
            receiver,
            stop,
            thread: Some(thread),
            next: 0,
            busy: false,
        })
    }
    /// Queue copy (Some text) or paste (None) for a compositor-issued native window ID.
    pub fn request(&mut self, scope: u64, text: Option<String>) -> io::Result<u64> {
        if self.busy {
            return Err(io::ErrorKind::WouldBlock.into());
        }
        if text.as_ref().is_some_and(|s| s.len() > MAX_TEXT_BYTES) {
            return Err(io::Error::other("clipboard text exceeds limit"));
        }
        let id = self
            .next
            .checked_add(1)
            .ok_or_else(|| io::Error::other("clipboard serial exhausted"))?;
        self.sender
            .as_ref()
            .ok_or(io::ErrorKind::BrokenPipe)?
            .try_send(Job { id, scope, text })
            .map_err(|_| {
                io::Error::new(io::ErrorKind::WouldBlock, "native clipboard worker is busy")
            })?;
        self.next = id;
        self.busy = true;
        Ok(id)
    }
    /// Nonblocking completion; callers must still validate current focus.
    pub fn poll(&mut self) -> Option<Outcome> {
        match self.receiver.try_recv() {
            Ok(result) => {
                self.busy = false;
                Some(result)
            }
            _ => None,
        }
    }
}
impl Drop for Worker {
    fn drop(&mut self) {
        self.stop.store(true, Ordering::Relaxed);
        self.sender.take();
        if let Some(thread) = self.thread.take() {
            let _ = thread.join();
        }
    }
}

#[cfg(feature = "server")]
mod store {
    use super::*;
    struct Pending {
        scope: u64,
        id: u64,
        total: usize,
        bytes: Vec<u8>,
        deadline: Instant,
    }
    /// Compositor-owned, bounded selection and one atomic pending replacement.
    pub struct Store {
        text: String,
        generation: u64,
        next: u64,
        pending: Option<Pending>,
    }
    impl Default for Store {
        fn default() -> Self {
            Self {
                text: String::new(),
                generation: 1,
                next: 0,
                pending: None,
            }
        }
    }
    impl Store {
        /// Cancel a window's unfinished write when its focus/ownership is lost.
        pub fn cancel_scope(&mut self, scope: u64) {
            if self.pending.as_ref().is_some_and(|p| p.scope == scope) {
                self.pending = None;
            }
        }
        /// Execute one validated command without logging selection data.
        pub fn handle(&mut self, command: &Command) -> String {
            self.handle_at(command, Instant::now())
                .unwrap_or_else(|error| format!("error: {error}"))
        }
        fn handle_at(&mut self, command: &Command, now: Instant) -> Result<String, &'static str> {
            if self.pending.as_ref().is_some_and(|p| now >= p.deadline) {
                self.pending = None;
            }
            let summary =
                |generation: u64, bytes: usize| format!("ok clipboard {generation} {bytes}");
            match command {
                Command::Status => Ok(format!(
                    "{{\"transport\":\"aen\",\"mime_type\":\"text/plain;charset=utf-8\",\"generation\":{},\"bytes\":{},\"pending_bytes\":{},\"max_bytes\":{MAX_TEXT_BYTES}}}",
                    self.generation, self.text.len(), self.pending.as_ref().map_or(0, |p| p.bytes.len())
                )),
                Command::Read(_) => Ok(summary(self.generation, self.text.len())),
                Command::Chunk(_, generation, offset) => {
                    if *generation != self.generation || *offset >= self.text.len() {
                        return Err("clipboard generation or offset is stale");
                    }
                    let end = self.text.len().min(*offset + CHUNK_BYTES);
                    Ok(format!("ok chunk {}", hex(&self.text.as_bytes()[*offset..end])))
                }
                Command::Begin(scope, total) => {
                    if *total > MAX_TEXT_BYTES {
                        return Err("clipboard size exceeds limit");
                    }
                    if self.pending.is_some() {
                        return Err("clipboard writer is busy");
                    }
                    self.next = self.next.checked_add(1).ok_or("clipboard serial exhausted")?;
                    self.pending = Some(Pending {
                        scope: *scope, id: self.next, total: *total,
                        bytes: Vec::with_capacity(*total), deadline: now + DEADLINE,
                    });
                    Ok(format!("ok write {}", self.next))
                }
                Command::Append(scope, id, offset, bytes) => {
                    let p = self.pending.as_mut()
                        .filter(|p| p.scope == *scope && p.id == *id)
                        .ok_or("clipboard transaction is stale")?;
                    if *offset != p.bytes.len() || bytes.is_empty()
                        || bytes.len() > CHUNK_BYTES || bytes.len() > p.total.saturating_sub(p.bytes.len()) {
                        return Err("clipboard chunk is invalid");
                    }
                    p.bytes.extend_from_slice(bytes);
                    Ok("ok".into())
                }
                Command::Commit(scope, id) => {
                    let p = self.pending.as_ref()
                        .filter(|p| p.scope == *scope && p.id == *id)
                        .ok_or("clipboard transaction is stale")?;
                    if p.bytes.len() != p.total || std::str::from_utf8(&p.bytes).is_err() {
                        return Err("clipboard write is incomplete or not UTF-8");
                    }
                    let generation = self.generation.checked_add(1).ok_or("clipboard generation exhausted")?;
                    let p = self.pending.take().ok_or("clipboard transaction is stale")?;
                    self.text = String::from_utf8(p.bytes).map_err(|_| "invalid clipboard UTF-8")?;
                    self.generation = generation;
                    Ok(summary(generation, self.text.len()))
                }
                Command::Cancel(scope, id) => {
                    if !self.pending.as_ref().is_some_and(|p| p.scope == *scope && p.id == *id) {
                        return Err("clipboard transaction is stale");
                    }
                    self.pending = None;
                    Ok("ok".into())
                }
                Command::Clear(_) => {
                    self.generation = self.generation.checked_add(1).ok_or("clipboard generation exhausted")?;
                    self.text.clear();
                    self.pending = None;
                    Ok(summary(self.generation, 0))
                }
            }
        }
    }
    #[cfg(test)]
    mod tests {
        use super::*;
        #[test]
        fn incomplete_invalid_stale_and_expired_writes_preserve_selection() {
            let mut s = Store::default();
            let now = Instant::now();
            assert_eq!(
                s.handle_at(&Command::Begin(7, 2), now).unwrap(),
                "ok write 1"
            );
            assert!(s
                .handle_at(&Command::Append(7, 1, 1, vec![1]), now)
                .is_err());
            assert!(s.handle_at(&Command::Commit(7, 1), now).is_err());
            assert_eq!(
                s.handle_at(&Command::Read(0), now).unwrap(),
                "ok clipboard 1 0"
            );
            assert!(s.handle_at(&Command::Commit(7, 1), now + DEADLINE).is_err());
            s.handle_at(&Command::Begin(7, 1), now).unwrap();
            s.handle_at(&Command::Append(7, 2, 0, vec![0xff]), now)
                .unwrap();
            assert!(s.handle_at(&Command::Commit(7, 2), now).is_err());
            s.cancel_scope(7);
            assert!(s.pending.is_none());
        }
        #[test]
        fn replacement_is_atomic_and_generations_prevent_mixed_reads() {
            let mut s = Store::default();
            let now = Instant::now();
            s.handle_at(&Command::Begin(9, 3), now).unwrap();
            s.handle_at(&Command::Append(9, 1, 0, b"old".to_vec()), now)
                .unwrap();
            assert_eq!(
                s.handle_at(&Command::Commit(9, 1), now).unwrap(),
                "ok clipboard 2 3"
            );
            s.handle_at(&Command::Begin(9, 3), now).unwrap();
            s.handle_at(&Command::Append(9, 2, 0, b"new".to_vec()), now)
                .unwrap();
            assert_eq!(
                s.handle_at(&Command::Chunk(0, 2, 0), now).unwrap(),
                "ok chunk 6f6c64"
            );
            assert!(s.handle_at(&Command::Commit(8, 2), now).is_err());
            s.handle_at(&Command::Commit(9, 2), now).unwrap();
            assert!(s.handle_at(&Command::Chunk(0, 2, 0), now).is_err());
            assert!(!s.handle(&Command::Status).contains("new"));
            assert!(s
                .handle_at(&Command::Begin(0, MAX_TEXT_BYTES + 1), now)
                .is_err());
        }
    }
}
#[cfg(feature = "server")]
pub use store::Store;
#[cfg(test)]
mod tests {
    use super::*;
    #[test]
    fn strict_parser_and_chunks_cannot_expand_the_control_limit() {
        for bad in [
            "clipboard read -1",
            "clipboard read 01",
            "clipboard read 1 extra",
            "clipboard  read 1",
            "clipboard begin 0 65537",
            "clipboard append 0 1 0 0",
            "clipboard append 0 1 0 GG",
            "clipboard read 1\nshutdown",
        ] {
            assert!(parse(bad).is_err(), "{bad}");
        }
        let text = format!(
            "clipboard append {} {} {} {}",
            u64::MAX,
            u64::MAX,
            MAX_TEXT_BYTES,
            hex(&vec![255; CHUNK_BYTES])
        );
        assert!(text.len() < 1024);
        assert!(parse(&text).is_ok());
        assert_eq!(unhex(&hex("é🙂".as_bytes())).unwrap(), "é🙂".as_bytes());
    }
    #[test]
    fn expired_operations_never_connect_and_cancellation_is_observed() {
        let path = Path::new("/tmp/aen-clipboard-never-connected");
        let mut client = Client::new(path, 0);
        client.deadline = Instant::now();
        assert_eq!(client.read().unwrap_err().kind(), io::ErrorKind::TimedOut);
        assert_eq!(
            crate::platform::connect_local_until(path, client.deadline)
                .unwrap_err()
                .kind(),
            io::ErrorKind::TimedOut
        );
        client.deadline = Instant::now() + DEADLINE;
        client.stop.store(true, Ordering::Relaxed);
        assert_eq!(
            client.read().unwrap_err().kind(),
            io::ErrorKind::Interrupted
        );
    }
    #[test]
    fn selected_window_socket_determines_control_endpoint() {
        assert_eq!(
            socket_for_window(Path::new("/tmp/private.shell.windows")).unwrap(),
            Path::new("/tmp/private.shell")
        );
        assert!(socket_for_window(Path::new("/tmp/other")).is_err());
    }
}