Add fail-closed AFS data-plane support

afs_contract.php

@@ -0,0 +1,47 @@
+<?php
+/*
+ * Side-effect-free AFS production-provider contract.
+ *
+ * Tiny File Manager loads this before config.php so a deployment can load and
+ * construct its reviewed factory without loading the legacy AFS helper (which
+ * intentionally checks for POSIX/AFS runtime prerequisites at load time).
+ */
+interface AfsDataPlaneProviderFactory
+{
+    public function getFactoryIdentity();
+    public function createProvider( $root, $requestIdentity );
+}
+
+interface AfsDataPlaneProvider
+{
+    const SECURITY_BOUNDARY_DESCRIPTOR_BENEATH_V1 =
+        'descriptor-beneath-v1';
+
+    public function initializeDataPlane( $root );
+    public function isProductionReady();
+    public function getReadinessFailure();
+    public function getSecurityBoundary();
+    public function getProviderIdentity();
+    public function getCredentialIdentity();
+    public function resolveExistingPath( $path, $type='any' );
+    public function resolveWritePath( $path, $allowExisting=true );
+    public function inspectPath( $path, $allowLinkObject=false );
+    public function listDirectory( $path );
+    public function searchFiles( $path, $filter='' );
+    public function openRead( $path );
+    public function readContents( $path );
+    public function detectMimeType( $path );
+    public function createFile( $path );
+    public function writeFile( $path, $contents );
+    public function importFile( $source, $destination, $overwrite=true,
+                                $append=false );
+    public function makeDirectory( $path, $recursive=true );
+    public function copyPath( $source, $destination, $update=true,
+                              $force=true );
+    public function renamePath( $source, $destination );
+    public function removePath( $path );
+    public function archivesSupported();
+    public function readAcl( $path='' );
+    public function changeAclEntries( $entries, $path='', $negative=false );
+    public function getACLAccess( $path );
+}

docs/AFS_APPLICATION_BLOBS.sha256

@@ -0,0 +1,4 @@
+0dfe7400e0233ce8847e4343b4b1371247b420812c85e37b1add3a0f9af97180  afs_contract.php
+d8964c18d6f60e737ac17949be92c5fe784e9a3fffebf10cdb27a5f34c0a0111  afs.php
+9d9387785f73d04d7d13d630be71dfcc5b0a1b0870709e3960a7999ee2457ae3  tinyfilemanager.php
+390dd307e0b0274f105888201d354853229e1d8be2f26124c1115fe4700e60ae  docs/AFS_ASSET_MANIFEST.schema.json

docs/AFS_ASSET_MANIFEST.schema.json

@@ -0,0 +1,86 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://tinyfilemanager.local/schemas/afs-assets-v1.json",
+  "title": "Tiny File Manager AFS production asset manifest",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "assets"],
+  "properties": {
+    "version": {
+      "const": 1
+    },
+    "assets": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "css-bootstrap",
+        "css-dropzone",
+        "css-font-awesome",
+        "css-highlightjs",
+        "js-ace",
+        "js-bootstrap",
+        "js-dropzone",
+        "js-jquery",
+        "js-jquery-datatables",
+        "js-highlightjs"
+      ],
+      "properties": {
+        "css-bootstrap": { "$ref": "#/$defs/style" },
+        "css-dropzone": { "$ref": "#/$defs/style" },
+        "css-font-awesome": { "$ref": "#/$defs/style" },
+        "css-highlightjs": { "$ref": "#/$defs/style" },
+        "js-ace": { "$ref": "#/$defs/script" },
+        "js-bootstrap": { "$ref": "#/$defs/script" },
+        "js-dropzone": { "$ref": "#/$defs/script" },
+        "js-jquery": { "$ref": "#/$defs/script" },
+        "js-jquery-datatables": { "$ref": "#/$defs/script" },
+        "js-highlightjs": { "$ref": "#/$defs/script" }
+      }
+    }
+  },
+  "$defs": {
+    "common": {
+      "type": "object",
+      "required": ["type", "path", "sha256", "license", "defer"],
+      "properties": {
+        "type": { "enum": ["style", "script"] },
+        "path": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^(?!/)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[%?#\\\\])[!-~]+$"
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        "license": {
+          "enum": ["MIT", "BSD-3-Clause", "Apache-2.0", "OFL-1.1"]
+        },
+        "defer": { "type": "boolean" }
+      }
+    },
+    "style": {
+      "unevaluatedProperties": false,
+      "allOf": [
+        { "$ref": "#/$defs/common" },
+        {
+          "properties": {
+            "type": { "const": "style" },
+            "defer": { "const": false }
+          }
+        }
+      ]
+    },
+    "script": {
+      "unevaluatedProperties": false,
+      "allOf": [
+        { "$ref": "#/$defs/common" },
+        {
+          "properties": {
+            "type": { "const": "script" }
+          }
+        }
+      ]
+    }
+  }
+}