Update dependencies

vendor/tailscale.com/drive/drive_clone.go

@@ -0,0 +1,44 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by tailscale.com/cmd/cloner; DO NOT EDIT.
+
+package drive
+
+// Clone makes a deep copy of Share.
+// The result aliases no memory with the original.
+func (src *Share) Clone() *Share {
+	if src == nil {
+		return nil
+	}
+	dst := new(Share)
+	*dst = *src
+	dst.BookmarkData = append(src.BookmarkData[:0:0], src.BookmarkData...)
+	return dst
+}
+
+// A compilation failure here means this code must be regenerated, with the command at the top of this file.
+var _ShareCloneNeedsRegeneration = Share(struct {
+	Name         string
+	Path         string
+	As           string
+	BookmarkData []byte
+}{})
+
+// Clone duplicates src into dst and reports whether it succeeded.
+// To succeed, <src, dst> must be of types <*T, *T> or <*T, **T>,
+// where T is one of Share.
+func Clone(dst, src any) bool {
+	switch src := src.(type) {
+	case *Share:
+		switch dst := dst.(type) {
+		case *Share:
+			*dst = *src.Clone()
+			return true
+		case **Share:
+			*dst = src.Clone()
+			return true
+		}
+	}
+	return false
+}

vendor/tailscale.com/drive/drive_view.go

@@ -0,0 +1,75 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Code generated by tailscale/cmd/viewer; DO NOT EDIT.
+
+package drive
+
+import (
+	"encoding/json"
+	"errors"
+
+	"tailscale.com/types/views"
+)
+
+//go:generate go run tailscale.com/cmd/cloner  -clonefunc=true -type=Share
+
+// View returns a readonly view of Share.
+func (p *Share) View() ShareView {
+	return ShareView{ж: p}
+}
+
+// ShareView provides a read-only view over Share.
+//
+// Its methods should only be called if `Valid()` returns true.
+type ShareView struct {
+	// ж is the underlying mutable value, named with a hard-to-type
+	// character that looks pointy like a pointer.
+	// It is named distinctively to make you think of how dangerous it is to escape
+	// to callers. You must not let callers be able to mutate it.
+	ж *Share
+}
+
+// Valid reports whether underlying value is non-nil.
+func (v ShareView) Valid() bool { return v.ж != nil }
+
+// AsStruct returns a clone of the underlying value which aliases no memory with
+// the original.
+func (v ShareView) AsStruct() *Share {
+	if v.ж == nil {
+		return nil
+	}
+	return v.ж.Clone()
+}
+
+func (v ShareView) MarshalJSON() ([]byte, error) { return json.Marshal(v.ж) }
+
+func (v *ShareView) UnmarshalJSON(b []byte) error {
+	if v.ж != nil {
+		return errors.New("already initialized")
+	}
+	if len(b) == 0 {
+		return nil
+	}
+	var x Share
+	if err := json.Unmarshal(b, &x); err != nil {
+		return err
+	}
+	v.ж = &x
+	return nil
+}
+
+func (v ShareView) Name() string { return v.ж.Name }
+func (v ShareView) Path() string { return v.ж.Path }
+func (v ShareView) As() string   { return v.ж.As }
+func (v ShareView) BookmarkData() views.ByteSlice[[]byte] {
+	return views.ByteSliceOf(v.ж.BookmarkData)
+}
+
+// A compilation failure here means this code must be regenerated, with the command at the top of this file.
+var _ShareViewNeedsRegeneration = Share(struct {
+	Name         string
+	Path         string
+	As           string
+	BookmarkData []byte
+}{})

vendor/tailscale.com/drive/local.go

@@ -0,0 +1,37 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package drive provides a filesystem that allows sharing folders between
+// Tailscale nodes using WebDAV. The actual implementation of the core Taildrive
+// functionality lives in package driveimpl. These packages are separated to
+// allow users of Taildrive to refer to the interfaces without having a hard
+// dependency on Taildrive, so that programs which don't actually use Taildrive can
+// avoid its transitive dependencies.
+package drive
+
+import (
+	"net"
+	"net/http"
+)
+
+// Remote represents a remote Taildrive node.
+type Remote struct {
+	Name      string
+	URL       string
+	Available func() bool
+}
+
+// FileSystemForLocal is the Taildrive filesystem exposed to local clients. It
+// provides a unified WebDAV interface to remote Taildrive shares on other nodes.
+type FileSystemForLocal interface {
+	// HandleConn handles connections from local WebDAV clients
+	HandleConn(conn net.Conn, remoteAddr net.Addr) error
+
+	// SetRemotes sets the complete set of remotes on the given tailnet domain
+	// using a map of name -> url. If transport is specified, that transport
+	// will be used to connect to these remotes.
+	SetRemotes(domain string, remotes []*Remote, transport http.RoundTripper)
+
+	// Close() stops serving the WebDAV content
+	Close() error
+}

vendor/tailscale.com/drive/remote.go

@@ -0,0 +1,133 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package drive
+
+//go:generate go run tailscale.com/cmd/viewer --type=Share --clonefunc
+
+import (
+	"bytes"
+	"errors"
+	"net/http"
+	"regexp"
+	"strings"
+)
+
+var (
+	// DisallowShareAs forcibly disables sharing as a specific user, only used
+	// for testing.
+	DisallowShareAs     = false
+	ErrDriveNotEnabled  = errors.New("Taildrive not enabled")
+	ErrInvalidShareName = errors.New("Share names may only contain the letters a-z, underscore _, parentheses (), or spaces")
+)
+
+var (
+	shareNameRegex = regexp.MustCompile(`^[a-z0-9_\(\) ]+$`)
+)
+
+// AllowShareAs reports whether sharing files as a specific user is allowed.
+func AllowShareAs() bool {
+	return !DisallowShareAs && doAllowShareAs()
+}
+
+// Share configures a folder to be shared through drive.
+type Share struct {
+	// Name is how this share appears on remote nodes.
+	Name string `json:"name,omitempty"`
+
+	// Path is the path to the directory on this machine that's being shared.
+	Path string `json:"path,omitempty"`
+
+	// As is the UNIX or Windows username of the local account used for this
+	// share. File read/write permissions are enforced based on this username.
+	// Can be left blank to use the default value of "whoever is running the
+	// Tailscale GUI".
+	As string `json:"who,omitempty"`
+
+	// BookmarkData contains security-scoped bookmark data for the Sandboxed
+	// Mac application. The Sandboxed Mac application gains permission to
+	// access the Share's folder as a result of a user selecting it in a file
+	// picker. In order to retain access to it across restarts, it needs to
+	// hold on to a security-scoped bookmark. That bookmark is stored here. See
+	// https://developer.apple.com/documentation/security/app_sandbox/accessing_files_from_the_macos_app_sandbox#4144043
+	BookmarkData []byte `json:"bookmarkData,omitempty"`
+}
+
+func ShareViewsEqual(a, b ShareView) bool {
+	if !a.Valid() && !b.Valid() {
+		return true
+	}
+	if !a.Valid() || !b.Valid() {
+		return false
+	}
+	return a.Name() == b.Name() && a.Path() == b.Path() && a.As() == b.As() && a.BookmarkData().Equal(b.ж.BookmarkData)
+}
+
+func SharesEqual(a, b *Share) bool {
+	if a == nil && b == nil {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
+	return a.Name == b.Name && a.Path == b.Path && a.As == b.As && bytes.Equal(a.BookmarkData, b.BookmarkData)
+}
+
+func CompareShares(a, b *Share) int {
+	if a == nil && b == nil {
+		return 0
+	}
+	if a == nil {
+		return -1
+	}
+	if b == nil {
+		return 1
+	}
+	return strings.Compare(a.Name, b.Name)
+}
+
+// FileSystemForRemote is the drive filesystem exposed to remote nodes. It
+// provides a unified WebDAV interface to local directories that have been
+// shared.
+type FileSystemForRemote interface {
+	// SetFileServerAddr sets the address of the file server to which we
+	// should proxy. This is used on platforms like Windows and MacOS
+	// sandboxed where we can't spawn user-specific sub-processes and instead
+	// rely on the UI application that's already running as an unprivileged
+	// user to access the filesystem for us.
+	//
+	// Note that this includes both the file server's secret token and its
+	// address, delimited by a pipe |.
+	SetFileServerAddr(addr string)
+
+	// SetShares sets the complete set of shares exposed by this node. If
+	// AllowShareAs() reports true, we will use one subprocess per user to
+	// access the filesystem (see userServer). Otherwise, we will use the file
+	// server configured via SetFileServerAddr.
+	SetShares(shares []*Share)
+
+	// ServeHTTPWithPerms behaves like the similar method from http.Handler but
+	// also accepts a Permissions map that captures the permissions of the
+	// connecting node.
+	ServeHTTPWithPerms(permissions Permissions, w http.ResponseWriter, r *http.Request)
+
+	// Close() stops serving the WebDAV content
+	Close() error
+}
+
+// NormalizeShareName normalizes the given share name and returns an error if
+// it contains any disallowed characters.
+func NormalizeShareName(name string) (string, error) {
+	// Force all share names to lowercase to avoid potential incompatibilities
+	// with clients that don't support case-sensitive filenames.
+	name = strings.ToLower(name)
+
+	// Trim whitespace
+	name = strings.TrimSpace(name)
+
+	if !shareNameRegex.MatchString(name) {
+		return "", ErrInvalidShareName
+	}
+
+	return name, nil
+}

vendor/tailscale.com/drive/remote_nonunix.go

@@ -0,0 +1,13 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build !unix
+
+package drive
+
+func doAllowShareAs() bool {
+	// On non-UNIX platforms, we use the GUI application (e.g. Windows taskbar
+	// icon) to access the filesystem as whatever unprivileged user is running
+	// the GUI app, so we cannot allow sharing as a different user.
+	return false
+}

vendor/tailscale.com/drive/remote_permissions.go

@@ -0,0 +1,65 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+package drive
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+type Permission uint8
+
+const (
+	PermissionNone Permission = iota
+	PermissionReadOnly
+	PermissionReadWrite
+)
+
+const (
+	accessReadOnly  = "ro"
+	accessReadWrite = "rw"
+
+	wildcardShare = "*"
+)
+
+// Permissions represents the set of permissions for a given principal to a
+// set of shares.
+type Permissions map[string]Permission
+
+type grant struct {
+	Shares []string
+	Access string
+}
+
+// ParsePermissions builds a Permissions map from a lis of raw grants.
+func ParsePermissions(rawGrants [][]byte) (Permissions, error) {
+	permissions := make(Permissions)
+	for _, rawGrant := range rawGrants {
+		var g grant
+		err := json.Unmarshal(rawGrant, &g)
+		if err != nil {
+			return nil, fmt.Errorf("unmarshal raw grants %s: %v", rawGrant, err)
+		}
+		for _, share := range g.Shares {
+			existingPermission := permissions[share]
+			permission := PermissionReadOnly
+			if g.Access == accessReadWrite {
+				permission = PermissionReadWrite
+			}
+			if permission > existingPermission {
+				permissions[share] = permission
+			}
+		}
+	}
+	return permissions, nil
+}
+
+func (p Permissions) For(share string) Permission {
+	specific := p[share]
+	wildcard := p[wildcardShare]
+	if specific > wildcard {
+		return specific
+	}
+	return wildcard
+}

vendor/tailscale.com/drive/remote_unix.go

@@ -0,0 +1,16 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build unix
+
+package drive
+
+import "tailscale.com/version"
+
+func doAllowShareAs() bool {
+	// All UNIX platforms use user servers (sub-processes) to access the OS
+	// filesystem as a specific unprivileged users, except for sandboxed macOS
+	// which doesn't support impersonating users and instead accesses files
+	// through the macOS GUI app as whatever unprivileged user is running it.
+	return !version.IsSandboxedMacOS()
+}