#!/bin/bash
###############################################################################
# cPGuard X Composer Wrapper Script
#
# Purpose: Execute Composer using user-specific configurations from cPGuard X
# - For managed users: Use configured PHP from ~/.cpguard/php.ini
# - For unmanaged users: Use greatest available PHP from /opt/cpguard/packages/
# - Uses cPGuard PHP wrapper to execute composer
# - Enforces open_basedir restrictions for managed users
# - Sets up composer-specific directories and environment
###############################################################################
set -euo pipefail
# Color codes for output
RED='\033[0;31m'
BLUE='\033[0;34m'
BOLD='\033[1m'
NC='\033[0m'
# Configuration paths
CPGUARD_ROOT="/opt/cpguard/app"
CPGUARD_RESOURCES="${CPGUARD_ROOT}/resources/tools"
PHP_SCRIPT="${CPGUARD_ROOT}/scripts/php"
COMPOSER_PHAR="${CPGUARD_RESOURCES}/composer"
# Get current user and home directory
CURRENT_USER="$(id -un)"
USER_HOME="$(eval echo "~$CURRENT_USER")"
CURRENT_DIR="$(pwd -P)"
# User's cPGuard config
CPGUARD_USER_CONFIG="$USER_HOME/.cpguard/php.ini"
# Export HOME for subprocesses
export HOME="$USER_HOME"
###############################################################################
# Function: Print error message and exit
###############################################################################
error_exit() {
local message="$1"
local exit_code="${2:-1}"
echo -e "${RED}cPGuard X Error: ${message}${NC}" >&2
exit "$exit_code"
}
###############################################################################
# Function: Validate required files
###############################################################################
validate_environment() {
# Check composer.phar exists
if [ ! -f "$COMPOSER_PHAR" ]; then
error_exit "Composer not found at $COMPOSER_PHAR"
fi
# Check PHP wrapper script exists
if [ ! -f "$PHP_SCRIPT" ]; then
error_exit "PHP wrapper not found at $PHP_SCRIPT"
fi
}
###############################################################################
# Function: Check if user is managed by cPGuard X
###############################################################################
is_cpguard_managed_user() {
if [ -f "$CPGUARD_USER_CONFIG" ]; then
return 0
fi
return 1
}
###############################################################################
# Function: Extract open_basedir from user config
###############################################################################
get_open_basedir() {
local open_basedir
open_basedir=$(grep -E "^[[:space:]]*open_basedir[[:space:]]*=" "$CPGUARD_USER_CONFIG" 2>/dev/null | tail -n 1 | cut -d'=' -f2- | xargs || true)
if [ -z "$open_basedir" ]; then
error_exit "open_basedir not configured in $CPGUARD_USER_CONFIG"
fi
echo "$open_basedir"
}
###############################################################################
# Function: Validate current directory against open_basedir
###############################################################################
validate_current_directory() {
local open_basedir="$1"
local allowed=0
# Split by colon and check each allowed directory
IFS=':' read -ra BASEDIRS <<< "$open_basedir"
for dir in "${BASEDIRS[@]}"; do
# Remove trailing slash for consistent comparison
dir="${dir%/}"
[ -z "$dir" ] && continue
# Check if current directory matches or is under allowed directory
if [ "$CURRENT_DIR" = "$dir" ] || [[ "$CURRENT_DIR" == "$dir"/* ]]; then
allowed=1
break
fi
done
if [ "$allowed" -ne 1 ]; then
error_exit "Access denied from $CURRENT_DIR. Allowed: $open_basedir"
fi
}
###############################################################################
# Function: Setup composer-specific directories
###############################################################################
setup_composer_directories() {
local cpguard_dir="$USER_HOME/.cpguard"
# Create composer subdirectories
mkdir -p "$USER_HOME/.composer" \
"$USER_HOME/.composer/cache"
# Set appropriate permissions
chmod 700 "$USER_HOME/.composer" 2>/dev/null || true
}
###############################################################################
# Main Execution
###############################################################################
# Validate environment
validate_environment
# Define composer data directory
CPGUARD_USER_DATA="$USER_HOME/.cpguard"
# Check if user is managed by cPGuard X
if is_cpguard_managed_user; then
# Managed user: validate restrictions and config
# Get open_basedir restrictions
OPEN_BASEDIR=$(get_open_basedir)
# Validate current working directory
validate_current_directory "$OPEN_BASEDIR"
# Setup composer directories
setup_composer_directories
# Construct open_basedir with additional paths for composer
COMPOSER_OPEN_BASEDIR="${OPEN_BASEDIR}:${CPGUARD_RESOURCES}:${CPGUARD_USER_DATA}:/opt:/tmp:/dev:/proc"
# Setup environment variables for composer
export COMPOSER_HOME="$USER_HOME/.composer"
export COMPOSER_CACHE_DIR="$USER_HOME/.composer/cache"
# Execute composer via PHP wrapper with open_basedir
exec "$PHP_SCRIPT" \
-c "$CPGUARD_USER_CONFIG" \
-d "open_basedir=${COMPOSER_OPEN_BASEDIR}" \
"$COMPOSER_PHAR" "$@"
else
# Unmanaged user: run without restrictions (like root)
# Setup composer directories (best effort)
setup_composer_directories 2>/dev/null || true
# Setup environment variables for composer
export COMPOSER_HOME="$USER_HOME/.composer"
export COMPOSER_CACHE_DIR="$USER_HOME/.composer/cache"
# Execute composer via PHP wrapper without restrictions
exec "$PHP_SCRIPT" "$COMPOSER_PHAR" "$@"
fi
|