feat: add file transfer API

Author: bgwastu

README.md

@@ -26,7 +26,11 @@ docker run --rm -p 8765:8765 -e BASE_URL=http://localhost:8765 cya
 2. Target machine runs the install command for its OS.
 3. The Go bridge connects to `/ws` and joins the session.
 4. Agents call `/api/session/:code/run` with `cmd`, `cmd_b64`, and optional `timeout`.
-5. The response includes merged stdout/stderr, `exit_code`, and `truncated`.
+5. Agents can transfer files:
+   - POST `/api/session/:code/files/send` with `path` and `content_b64` to write a file on the target.
+   - POST `/api/session/:code/files/receive` with `path` to read a target file and get a `download_url`.
+   - GET the returned `/api/session/:code/files/download/:id` URL to download the received file.
+6. Command responses include merged stdout/stderr, `exit_code`, and `truncated`.
 
 Sessions are in-memory only. Nothing is persisted by the server.
 

bridge/main.go

@@ -2,13 +2,15 @@ package main
 
 import (
 	"bytes"
+	"encoding/base64"
 	"encoding/json"
 	"io"
 	"net/http"
 	"os"
 	"os/exec"
 	"os/signal"
 	osuser "os/user"
+	"path/filepath"
 	"regexp"
 	"runtime"
 	"strings"
@@ -150,17 +152,31 @@ func safeUser() string {
 func isElevated() bool {
 	if runtime.GOOS == "windows" {
 		u, err := osuser.Current()
-		if err == nil && strings.EqualFold(u.Username, "Administrator") {
-			return true
+		currentUser := ""
+		if err == nil {
+			currentUser = u.Username
 		}
-		return strings.EqualFold(os.Getenv("USERNAME"), "Administrator")
+		return isWindowsAdministrator(currentUser, os.Getenv("USERNAME"))
 	}
 	if os.Getenv("SUDO_UID") != "" {
 		return true
 	}
 	return syscall.Geteuid() == 0
 }
 
+func isWindowsAdministrator(currentUser, envUser string) bool {
+	return windowsUsernameLeaf(currentUser) == "administrator" ||
+		windowsUsernameLeaf(envUser) == "administrator"
+}
+
+func windowsUsernameLeaf(value string) string {
+	value = strings.TrimSpace(value)
+	if idx := strings.LastIndexAny(value, `\\/`); idx >= 0 {
+		value = value[idx+1:]
+	}
+	return strings.ToLower(value)
+}
+
 func hostnameSafe() string {
 	h, err := os.Hostname()
 	if err != nil {
@@ -248,6 +264,37 @@ func readCommands(wsc *wsConn, dot string) {
 				"exit_code": code,
 				"truncated": truncated,
 			})
+		case "file_write":
+			var msg struct {
+				ID         string `json:"id"`
+				Path       string `json:"path"`
+				ContentB64 string `json:"content_b64"`
+			}
+			_ = json.Unmarshal(data, &msg)
+			if msg.ID == "" {
+				continue
+			}
+			ok, bytesWritten, errMsg := writeFileB64(msg.Path, msg.ContentB64)
+			wsc.sendJSON(map[string]any{
+				"type":  "file_write_result",
+				"id":    msg.ID,
+				"ok":    ok,
+				"bytes": bytesWritten,
+				"error": errMsg,
+			})
+		case "file_read":
+			var msg struct {
+				ID   string `json:"id"`
+				Path string `json:"path"`
+			}
+			_ = json.Unmarshal(data, &msg)
+			if msg.ID == "" {
+				continue
+			}
+			result := readFileB64(msg.Path)
+			result["type"] = "file_read_result"
+			result["id"] = msg.ID
+			wsc.sendJSON(result)
 		case "bye":
 			wsc.close()
 			return
@@ -268,6 +315,39 @@ func runOneShot(cmdLine string) (output string, status int, truncated bool) {
 	return output, childExitCode(err), truncated
 }
 
+func writeFileB64(path, contentB64 string) (bool, int, string) {
+	if strings.TrimSpace(path) == "" {
+		return false, 0, "missing path"
+	}
+	content, err := base64.StdEncoding.DecodeString(contentB64)
+	if err != nil {
+		return false, 0, "invalid base64 content"
+	}
+	if err := os.WriteFile(path, content, 0600); err != nil {
+		return false, 0, err.Error()
+	}
+	return true, len(content), ""
+}
+
+func readFileB64(path string) map[string]any {
+	if strings.TrimSpace(path) == "" {
+		return map[string]any{"ok": false, "error": "missing path"}
+	}
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return map[string]any{"ok": false, "path": path, "error": err.Error()}
+	}
+	contentType := http.DetectContentType(content)
+	return map[string]any{
+		"ok":           true,
+		"path":         path,
+		"filename":     filepath.Base(path),
+		"content_type": contentType,
+		"content_b64":  base64.StdEncoding.EncodeToString(content),
+		"bytes":        len(content),
+	}
+}
+
 func trimOutput(output string) (string, bool) {
 	if len(output) <= maxOutputBytes {
 		return output, false

bridge/main_test.go

@@ -77,6 +77,27 @@ func TestShellMetadataHelpers(t *testing.T) {
 	}
 }
 
+func TestWindowsAdminUsernameDetection(t *testing.T) {
+	cases := []struct {
+		name        string
+		currentUser string
+		envUser     string
+		want        bool
+	}{
+		{name: "plain administrator", currentUser: "Administrator", want: true},
+		{name: "domain administrator", currentUser: `WINBOX\\Administrator`, want: true},
+		{name: "env administrator fallback", envUser: "Administrator", want: true},
+		{name: "normal user", currentUser: `WINBOX\\bagas`, envUser: "bagas", want: false},
+	}
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isWindowsAdministrator(tt.currentUser, tt.envUser); got != tt.want {
+				t.Fatalf("isWindowsAdministrator() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
 func TestOneShotArgs(t *testing.T) {
 	name, args := oneShotArgs("echo ok")
 	if runtime.GOOS == "windows" {
@@ -108,6 +129,22 @@ func TestRunOneShotMergesStdoutStderrAndExitCode(t *testing.T) {
 	}
 }
 
+func TestFileTransferHelpers(t *testing.T) {
+	path := t.TempDir() + "/hello.txt"
+	ok, bytesWritten, errMsg := writeFileB64(path, "aGVsbG8=")
+	if !ok || bytesWritten != 5 || errMsg != "" {
+		t.Fatalf("writeFileB64() = %v, %d, %q", ok, bytesWritten, errMsg)
+	}
+
+	result := readFileB64(path)
+	if result["ok"] != true || result["content_b64"] != "aGVsbG8=" || result["bytes"] != 5 {
+		t.Fatalf("unexpected readFileB64 result: %+v", result)
+	}
+	if result["filename"] != "hello.txt" {
+		t.Fatalf("unexpected filename: %+v", result["filename"])
+	}
+}
+
 func TestReadCommandsExecutesCommandAndSendsResult(t *testing.T) {
 	client, server := websocketPair(t)
 	defer server.Close()
@@ -158,6 +195,67 @@ func TestReadCommandsExecutesCommandAndSendsResult(t *testing.T) {
 	}
 }
 
+func TestReadCommandsHandlesFileTransferMessages(t *testing.T) {
+	client, server := websocketPair(t)
+	defer server.Close()
+
+	done := make(chan struct{})
+	go func() {
+		readCommands(&wsConn{conn: client}, "")
+		close(done)
+	}()
+
+	path := t.TempDir() + "/ws-file.txt"
+	if err := server.WriteJSON(map[string]any{
+		"type":        "file_write",
+		"id":          "write-1",
+		"path":        path,
+		"content_b64": "aGVsbG8=",
+	}); err != nil {
+		t.Fatalf("write file_write: %v", err)
+	}
+	var writeResult struct {
+		Type  string `json:"type"`
+		ID    string `json:"id"`
+		OK    bool   `json:"ok"`
+		Bytes int    `json:"bytes"`
+	}
+	if err := server.ReadJSON(&writeResult); err != nil {
+		t.Fatalf("read file_write result: %v", err)
+	}
+	if writeResult.Type != "file_write_result" || writeResult.ID != "write-1" || !writeResult.OK || writeResult.Bytes != 5 {
+		t.Fatalf("unexpected file_write result: %+v", writeResult)
+	}
+
+	if err := server.WriteJSON(map[string]any{
+		"type": "file_read",
+		"id":   "read-1",
+		"path": path,
+	}); err != nil {
+		t.Fatalf("write file_read: %v", err)
+	}
+	var readResult struct {
+		Type       string `json:"type"`
+		ID         string `json:"id"`
+		OK         bool   `json:"ok"`
+		ContentB64 string `json:"content_b64"`
+		Bytes      int    `json:"bytes"`
+	}
+	if err := server.ReadJSON(&readResult); err != nil {
+		t.Fatalf("read file_read result: %v", err)
+	}
+	if readResult.Type != "file_read_result" || readResult.ID != "read-1" || !readResult.OK || readResult.ContentB64 != "aGVsbG8=" || readResult.Bytes != 5 {
+		t.Fatalf("unexpected file_read result: %+v", readResult)
+	}
+
+	_ = server.WriteJSON(map[string]any{"type": "bye"})
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatalf("readCommands did not exit after bye")
+	}
+}
+
 func TestReadCommandsIgnoresMalformedMessages(t *testing.T) {
 	client, server := websocketPair(t)
 	defer server.Close()