const { fork } = require('child_process');
const path = require('path');

// 创建沙箱实例
function createSandbox(code, timeout = 5000) {
  return new Promise((resolve, reject) => {
    const worker = fork(path.join(__dirname, 'sandbox-worker.js'), {
      execArgv: ['--no-warnings', `--max-old-space-size=${128}`]
    });

    worker.on('message', (result) => {
      worker.kill();
      resolve(result);
    });

    worker.on('error', (err) => {
      worker.kill();
      reject(err);
    });

    worker.on('exit', (code, signal) => {
      if (code !== 0 && !resultReceived) {
        reject(new Error(`Sandbox exited with code ${code}`));
      }
    });

    // 设置超时机制
    setTimeout(() => {
      worker.kill();
      reject(new Error('Execution timeout'));
    }, timeout);

    worker.send({ code });
  });
}

// sandbox-worker.js
const fs = require('fs').promises;
const path = require('path');

// 限制访问白名单
const allowedPaths = [
  path.resolve(__dirname, 'safe-zone'),
  path.resolve(__dirname, 'shared-cache')
];

// 拦截文件操作
const safeFs = new Proxy(fs, {
  get(target, prop, receiver) {
    if (prop === 'access' || prop === 'readFile') {
      return async function(filePath, ...args) {
        if (!allowedPaths.some(p => filePath.startsWith(p))) {
          throw new Error(`Access denied: ${filePath}`);
        }
        return Reflect.apply(target[prop], target, [filePath, ...args]);
      };
    }
    return Reflect.get(target, prop, receiver);
  }
});

global.__safeFs = safeFs;

const net = require('net');
const { URL } = require('url');

// 创建代理服务器
const proxy = net.createServer((clientSocket) => {
  clientSocket.on('data', async (data) => {
    const req = data.toString();
    const { hostname, port } = new URL(req);

    // 白名单校验
    if (!isAllowedDomain(hostname)) {
      clientSocket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
      return;
    }

    // 建立隧道
    const serverSocket = net.createConnection(port || 80, hostname, () => {
      serverSocket.write(data);
      clientSocket.pipe(serverSocket).pipe(clientSocket);
    });
  });
});

function validateCode(code) {
  // 正则检测危险模式
  const dangerPatterns = [
    /eval\(/,
    /Function\(/,
    /setTimeout\s*\(/,
    /setInterval\s*\(/,
    /require\s*\(/,
    /child_process/,
    /__dirname/,
    /__filename/
  ];

  for (const pattern of dangerPatterns) {
    if (pattern.test(code)) {
      throw new Error(`Detected dangerous pattern: ${pattern}`);
    }
  }

  // AST语法树分析
  const acorn = require('acorn');
  const walk = require('acorn-walk');

  const ast = acorn.parse(code, { ecmaVersion: 2022 });
  walk.fullAncestor(ast, (node) => {
    if (node.type === 'CallExpression' && 
        node.callee.name === 'require') {
      throw new Error('Dynamic require() is not allowed');
    }
  });
}

const { Worker, isMainThread, parentPort } = require('worker_threads');
const os = require('os');

// 创建受限执行环境
function createSafeWorker(code, memoryLimit = 256) {
  return new Promise((resolve, reject) => {
    const worker = new Worker('./worker.js', {
      workerData: { code },
      resourceLimits: {
        maxOldGenerationSizeMb: memoryLimit,
        maxYoungGenerationSizeMb: 64,
        codeRangeSizeMb: 16
      }
    });

    let timedOut = false;
    const timeout = setTimeout(() => {
      timedOut = true;
      worker.terminate().catch(reject);
      reject(new Error('CPU time exceeded'));
    }, 5000);

    worker.on('message', (result) => {
      clearTimeout(timeout);
      resolve(result);
    });

    worker.on('error', (err) => {
      clearTimeout(timeout);
      reject(err);
    });

    worker.on('exit', (code, signal) => {
      if (timedOut) return;
      if (code !== 0) reject(new Error(`Worker exited with code ${code}`));
    });
  });
}

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: node:20-slim
      options: 
        --memory=512m
        --cpus=1
    steps:
      - name: Set up Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '20.x'
          cache: 'npm'