1import { join } from "@std/path";2import { fail } from "./fmt.ts";34export interface Config {5 server: string;6 token: string;7 defaultVault?: string;8 /**9 * Optional allow-list of vault names this config may target. When present,10 * any push/site/rm/revert/default that names a vault outside the list, or11 * uses a raw address whose vault cannot be validated against authenticated12 * vault metadata, is refused — so a13 * restricted agent can't drop content into a vault that sits adjacent to14 * things you share professionally. Absent = no limit; empty array = no15 * target is permitted.16 */17 allowVaults?: string[];18}1920/** Throw if `config.allowVaults` is set and does not include `vault`. */21export function assertVaultAllowed(vault: string, config: Config): void {22 if (!config.allowVaults) return; // unset → unrestricted23 if (!config.allowVaults.includes(vault)) {24 const allowed = config.allowVaults.length ? config.allowVaults.join(", ") : "none";25 throw new Error(26 `vault "${vault}" is not allowed by this config (allowed: ${allowed})`,27 );28 }29}3031export function configDir(): string {32 const xdg = Deno.env.get("XDG_CONFIG_HOME");33 const home = Deno.env.get("HOME") ?? ".";34 return join(xdg ?? join(home, ".config"), "nzip");35}3637export function configPath(): string {38 return join(configDir(), "config.json");39}4041export async function loadConfig(): Promise<Config | null> {42 try {43 return JSON.parse(await Deno.readTextFile(configPath())) as Config;44 } catch {45 return null;46 }47}4849export async function saveConfig(config: Config): Promise<void> {50 await Deno.mkdir(configDir(), { recursive: true });51 const path = configPath();52 await Deno.writeTextFile(path, JSON.stringify(config, null, 2) + "\n");53 await Deno.chmod(path, 0o600);54}5556export async function requireConfig(): Promise<Config> {57 const config = await loadConfig();58 if (!config) fail("not authenticated");59 return config;60}