Authenticated command gateway + CLI + MCP wrapper (#57)

.docker/desktop-apps.bake.Dockerfile

@@ -102,7 +102,17 @@ FROM core-base AS desktop-linux
             -DVCPKG_MANIFEST_FEATURES="desktop-editors" \
             -DABOUT_PAGE_APP_NAME="${ABOUT_PAGE_APP_NAME}" \
             /desktop-apps/win-linux/ && \
-        cmake --build . && \
+        cmake --build .
+
+    # Split from the compile step above so ctest's own output isn't sharing (and
+    # getting pushed out of) BuildKit's per-step 2MiB log buffer with the compiler's
+    # warning noise -- that clipping repeatedly hid ctest's actual per-test results
+    # during the gateway test suite's rollout.
+    RUN --mount=type=cache,target=/build-cache-desktop,id=build-cache-desktop-${CACHE_BUST} \
+        --mount=type=cache,target=/ccache,id=ccache \
+        export CCACHE_DIR=/ccache && \
+        cd /build-cache-desktop && \
+        ctest --test-dir . --output-on-failure && \
         cmake --install . && \
         ccache --show-stats && \
         cp -a desktopeditors /desktopeditors

win-linux/CMakeLists.txt

@@ -27,6 +27,13 @@ if(UNIX)
     add_definitions(-DLINUX -D_LINUX -D_WAYLAND)
 endif()
 
+# Gateway (see cdp-gateway-cli-plan.md): GatewayCommandRunner drives CDP in-process via
+# CCefView::SendGatewayDevToolsMessage (CefBrowserHost::SendDevToolsMessage under the
+# hood) -- no external --remote-debugging-port, no WebSocket client needed. An earlier
+# design used Qt6WebSockets against an external CDP port; dropped after investigation
+# showed the in-process CefBrowserHost API solves target resolution for free (see
+# gatewaycommandrunner.h and the desktop-sdk cefview.h/.cpp changes on this branch).
+
 if(NOT TARGET hunspell-wrapper)
     add_subdirectory(${CORE_ROOT_DIR}/Common/3dParty/hunspell/qt hunspell-wrapper)
 endif()
@@ -115,6 +122,14 @@ if(NOT TARGET allthemesgen)
     add_subdirectory( "${CORE_ROOT_DIR}/DesktopEditor/allthemesgen" allthemesgen )
 endif()
 
+if(NOT TARGET eo-ctl)
+    add_subdirectory( "${CMAKE_CURRENT_LIST_DIR}/tools/eo-ctl/build/cmake" eo-ctl )
+endif()
+
+enable_testing()
+add_subdirectory( "${CMAKE_CURRENT_LIST_DIR}/tests/gateway" gateway_tests )
+add_subdirectory( "${CMAKE_CURRENT_LIST_DIR}/tools/eo-ctl/tests" eo_ctl_tests )
+
 # 3. Definitions & Global Config
 add_definitions(-D__DONT_WRITE_IN_APP_TITLE)
 add_definitions(-DAPP_ICON_PATH="./res/icons/desktopeditors-eo.ico")
@@ -131,6 +146,14 @@ endif()
 
 # 4. Source and Header Lists
 set(COMMON_HEADERS
+    src/gateway/gatewaytypes.h
+    src/gateway/allowlist.h
+    src/gateway/gatewaycommandrunner.h
+    src/gateway/gatewayserver.h
+    src/gateway/commands/wordcommands.h
+    src/gateway/commands/cellcommands.h
+    src/gateway/commands/slidecommands.h
+    src/gateway/commands/pdfcommands.h
     src/prop/defines_p.h
     src/prop/cascapplicationmanagerwrapperintf.h
     src/prop/version_p.h
@@ -180,6 +203,13 @@ set(COMMON_HEADERS
 )
 
 set(COMMON_SOURCES
+    src/gateway/allowlist.cpp
+    src/gateway/gatewaycommandrunner.cpp
+    src/gateway/gatewayserver.cpp
+    src/gateway/commands/wordcommands.cpp
+    src/gateway/commands/cellcommands.cpp
+    src/gateway/commands/slidecommands.cpp
+    src/gateway/commands/pdfcommands.cpp
     src/prop/cmainwindowimpl.cpp
     src/prop/utils.cpp
     src/windows/cmainwindow.cpp
@@ -445,6 +475,7 @@ install(TARGETS
     DesktopEditors
     ascdocumentscore
     qtascdocumentscore
+    eo-ctl
     LIBRARY DESTINATION ${CMAKE_INSTALL_BINDIR}
     RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
 )

win-linux/src/gateway/allowlist.cpp

@@ -0,0 +1,30 @@
+#include "allowlist.h"
+
+namespace Gateway
+{
+    AllowlistTable& AllowlistTable::Instance()
+    {
+        static AllowlistTable instance;
+        return instance;
+    }
+
+    void AllowlistTable::Register(const QString& command, CommandSpec spec)
+    {
+        m_commands.emplace(command, std::move(spec));
+    }
+
+    const CommandSpec* AllowlistTable::Find(const QString& command) const
+    {
+        auto it = m_commands.find(command);
+        return it == m_commands.end() ? nullptr : &it->second;
+    }
+
+    std::vector<QString> AllowlistTable::ListCommandNames() const
+    {
+        std::vector<QString> names;
+        names.reserve(m_commands.size());
+        for (const auto& entry : m_commands)
+            names.push_back(entry.first);
+        return names;
+    }
+}

win-linux/src/gateway/allowlist.h

@@ -0,0 +1,76 @@
+#ifndef GATEWAY_ALLOWLIST_H
+#define GATEWAY_ALLOWLIST_H
+
+#include <QString>
+#include <QJsonObject>
+#include <functional>
+#include <map>
+
+#include "gatewaytypes.h"
+
+// One entry per allowlisted command. `validate` is a hand-rolled schema check (no
+// generic JSON-schema engine — see cdp-gateway-cli-plan.md §9/YAGNI: this app has no
+// existing JSON-schema dependency, and the schemas in gateway-test-case-designs.md are
+// simple enough not to need one). `script` is the apiBuilder.js-backed script template;
+// its only substitution point is the literal token %%SCOPE%%, filled by
+// GatewayCommandRunner with QJsonDocument(scope).toJson(Compact) — never by
+// interpolating individual scope fields into the template string. See §2 of the plan.
+namespace Gateway
+{
+    struct CommandSpec
+    {
+        // Returns an empty QString if `scope` is valid, otherwise a human-readable reason.
+        std::function<QString(const QJsonObject& scope)> validate;
+        QString script;
+    };
+
+    class AllowlistTable
+    {
+    public:
+        static AllowlistTable& Instance();
+
+        // Registers a command. Called from each *Commands.cpp's static registration
+        // block (WordCommands.cpp, CellCommands.cpp, SlideCommands.cpp, PdfCommands.cpp).
+        void Register(const QString& command, CommandSpec spec);
+
+        // Returns nullptr if `command` is not allowlisted.
+        const CommandSpec* Find(const QString& command) const;
+
+        // eo-ctl's `allowlist` subcommand and the gateway's introspection endpoint both
+        // read this — command names only, no schema/script internals leaked.
+        std::vector<QString> ListCommandNames() const;
+
+    private:
+        std::map<QString, CommandSpec> m_commands;
+    };
+
+    // --- small reusable scope-field validators, shared across command families ---
+
+    inline QString RequireInt(const QJsonObject& scope, const QString& field, int minimum = 0)
+    {
+        if (!scope.contains(field) || !scope.value(field).isDouble())
+            return QStringLiteral("scope.%1 must be an integer").arg(field);
+        double v = scope.value(field).toDouble();
+        if (v != static_cast<int>(v) || static_cast<int>(v) < minimum)
+            return QStringLiteral("scope.%1 must be an integer >= %2").arg(field).arg(minimum);
+        return QString();
+    }
+
+    inline QString RequireString(const QJsonObject& scope, const QString& field, bool allowEmpty = true)
+    {
+        if (!scope.contains(field) || !scope.value(field).isString())
+            return QStringLiteral("scope.%1 must be a string").arg(field);
+        if (!allowEmpty && scope.value(field).toString().isEmpty())
+            return QStringLiteral("scope.%1 must not be empty").arg(field);
+        return QString();
+    }
+
+    inline QString RequireBool(const QJsonObject& scope, const QString& field)
+    {
+        if (!scope.contains(field) || !scope.value(field).isBool())
+            return QStringLiteral("scope.%1 must be a boolean").arg(field);
+        return QString();
+    }
+}
+
+#endif // GATEWAY_ALLOWLIST_H