Make server file manager list-first

platform/validator/resources.go

@@ -7,6 +7,7 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+	"unicode"
 	"unicode/utf8"
 
 	"browser.local/platform/domain"
@@ -24,7 +25,7 @@ const (
 	maxProgressMessageLength   = 256
 	maxServerConfigContentSize = 64 * 1024
 	maxJobExecutionContentSize = 64 * 1024
-	maxLogicalFileKeyLength    = 160
+	maxLogicalFileKeyLength    = 1024
 	maxProductionMessageLength = 320
 )
 
@@ -1444,6 +1445,16 @@ func ValidateServerFileReadRequest(request domain.ServerFileReadRequest) error {
 	return ValidateFileOperationDispatchRequest(domain.FileOperationDispatchRequest{ServerInstanceID: request.ServerInstanceID, PluginID: request.PluginID, Operation: domain.FileOperationRead, Key: request.Key, IdempotencyKey: request.IdempotencyKey})
 }
 
+func ValidateServerFileReadSnapshotRequest(serverInstanceID string, key string) error {
+	var violations []string
+	violations = appendRequired(violations, "serverInstanceId", serverInstanceID)
+	violations = appendRequired(violations, "key", key)
+	if !validLogicalFileKey(key) {
+		violations = append(violations, "key is not allowed")
+	}
+	return finish(violations)
+}
+
 func ValidateServerFileWriteRequest(request domain.ServerFileWriteRequest) error {
 	return ValidateFileOperationDispatchRequest(domain.FileOperationDispatchRequest{ServerInstanceID: request.ServerInstanceID, PluginID: request.PluginID, Operation: domain.FileOperationWrite, Key: request.Key, InputRef: request.InputRef, Content: request.Content, ExpectedConfigVersion: request.ExpectedVersion, ExpectedChecksum: request.ExpectedChecksum, IdempotencyKey: request.IdempotencyKey})
 }
@@ -2412,14 +2423,13 @@ func validFileOperationKind(operation domain.FileOperationKind) bool {
 
 func validUploadFilename(name string) bool {
 	trimmed := strings.TrimSpace(name)
-	if trimmed == "" || trimmed != name || len([]rune(name)) > 120 || strings.Contains(name, "/") || strings.Contains(name, `\`) || strings.Contains(name, "..") || strings.Contains(name, "://") || looksLikeRawHostPath(name) || containsUnsafeRuntimeSecret(name) {
+	if trimmed == "" || trimmed != name || name == "." || name == ".." || len([]rune(name)) > 255 || !utf8.ValidString(name) || strings.Contains(name, "/") || strings.Contains(name, `\`) || strings.Contains(name, ":") || strings.Contains(name, "://") || looksLikeRawHostPath(name) {
 		return false
 	}
 	for _, char := range name {
-		if (char >= 'a' && char <= 'z') || (char >= 'A' && char <= 'Z') || (char >= '0' && char <= '9') || char == '_' || char == '-' || char == '.' || char == ' ' || char == '(' || char == ')' {
-			continue
+		if unicode.IsControl(char) || char == 0 {
+			return false
 		}
-		return false
 	}
 	return true
 }
@@ -2438,14 +2448,18 @@ func validLogicalFileKey(key string) bool {
 	if trimmed == "" || trimmed != key || len([]rune(key)) > maxLogicalFileKeyLength {
 		return false
 	}
-	if strings.HasPrefix(key, "/") || strings.Contains(key, "..") || strings.Contains(key, `\`) || strings.Contains(key, "://") || looksLikeRawHostPath(key) || containsUnsafeRuntimeSecret(key) {
+	if !utf8.ValidString(key) || strings.HasPrefix(key, "/") || strings.Contains(key, `\`) || strings.Contains(key, ":") || strings.Contains(key, "://") || looksLikeRawHostPath(key) {
 		return false
 	}
+	for _, segment := range strings.Split(key, "/") {
+		if segment == "" || segment == "." || segment == ".." {
+			return false
+		}
+	}
 	for _, char := range key {
-		if (char >= 'a' && char <= 'z') || (char >= 'A' && char <= 'Z') || (char >= '0' && char <= '9') || char == '_' || char == '-' || char == '.' || char == '/' {
-			continue
+		if unicode.IsControl(char) || char == 0 {
+			return false
 		}
-		return false
 	}
 	return true
 }