fix(hayabusa): close windows direct-upload path

aw-server/hayabusa/README.md

@@ -93,11 +93,13 @@ powershell.exe -ExecutionPolicy Bypass -File C:\ProgramData\AWatch-rus\export-up
 2. The script will:
 
 - run `C:\ProgramData\AWatch-rus\export-evtx-for-hayabusa.ps1`
+- upload matching `.caseid` first when `-CaseId` is specified
 - upload the newest zip to `/opt/activitywatch/aw-rus-ops/drop`
-- upload matching `.caseid` when `-CaseId` is specified
 - let `aw-hayabusa-drop.path` process the package automatically on `10.10.10.13`
 
-One-time SSH prerequisite on the server for user `awops`:
+This path was validated live against case `30` after the `awops` SSH authorization was installed on `10.10.10.13`.
+
+Server-side prerequisite for user `awops`:
 
 ```bash
 printf '%s\n' 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILoFWQmgoUJj1P7mp1/fB5aBkI3fVgjPme9jmK8Gh9jr igor@snb-live' | sudo tee /var/lib/awops/.ssh/authorized_keys >/dev/null

windows/export-upload-hayabusa-to-aw-server.ps1

@@ -15,6 +15,24 @@ param(
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+function New-TemporarySshKeyCopy {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$SourceKeyPath
+    )
+
+    $tempDir = Join-Path $env:TEMP 'aw-rus-hayabusa-ssh'
+    New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
+    $tempKeyPath = Join-Path $tempDir 'awops_ed25519'
+    Copy-Item -LiteralPath $SourceKeyPath -Destination $tempKeyPath -Force
+
+    & icacls.exe $tempKeyPath /inheritance:r | Out-Null
+    & icacls.exe $tempKeyPath /grant:r "$($env:USERNAME):(F)" | Out-Null
+    & icacls.exe $tempKeyPath /remove:g 'Users' 'Authenticated Users' 'Everyone' 'BUILTIN\Users' 'BUILTIN\Administrators' 'NT AUTHORITY\SYSTEM' 2>$null | Out-Null
+
+    return $tempKeyPath
+}
+
 $exportScript = 'C:\ProgramData\AWatch-rus\export-evtx-for-hayabusa.ps1'
 if (-not (Test-Path -LiteralPath $exportScript)) {
     throw "export script not found: $exportScript"
@@ -23,7 +41,7 @@ if (-not (Test-Path -LiteralPath $RemoteKeyPath)) {
     throw "SSH private key not found: $RemoteKeyPath"
 }
 
-$export = powershell.exe -ExecutionPolicy Bypass -File $exportScript -ConfigPath $ConfigPath -DaysBack $DaysBack | ConvertFrom-Json
+$export = & $exportScript -ConfigPath $ConfigPath -DaysBack $DaysBack
 $zipPath = [string]$export.zipPath
 $hostName = [string]$export.hostname
 if ([string]::IsNullOrWhiteSpace($zipPath) -or -not (Test-Path -LiteralPath $zipPath)) {
@@ -34,23 +52,29 @@ $zipName = Split-Path -Leaf $zipPath
 $remoteTarget = "$ServerUser@$ServerHost`:$RemoteDropDir/"
 $baseName = [System.IO.Path]::GetFileNameWithoutExtension($zipPath)
 $caseIdPath = Join-Path ([System.IO.Path]::GetDirectoryName($zipPath)) ($baseName + '.caseid')
+$effectiveKeyPath = New-TemporarySshKeyCopy -SourceKeyPath $RemoteKeyPath
 
-& scp.exe -i $RemoteKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL $zipPath $remoteTarget
-if ($LASTEXITCODE -ne 0) {
-    throw "scp upload failed with rc=$LASTEXITCODE"
-}
-if ($CaseId.HasValue) {
-    Set-Content -LiteralPath $caseIdPath -Value ([string]$CaseId.Value) -Encoding ASCII
-    & scp.exe -i $RemoteKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL $caseIdPath $remoteTarget
-    if ($LASTEXITCODE -ne 0) {
-        throw "scp caseid upload failed with rc=$LASTEXITCODE"
+try {
+    if ($null -ne $CaseId) {
+        Set-Content -LiteralPath $caseIdPath -Value ([string]$CaseId) -Encoding ASCII
+        & scp.exe -i $effectiveKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL $caseIdPath $remoteTarget
+        if ($LASTEXITCODE -ne 0) {
+            throw "scp caseid upload failed with rc=$LASTEXITCODE"
+        }
     }
+    & scp.exe -i $effectiveKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL $zipPath $remoteTarget
+    if ($LASTEXITCODE -ne 0) {
+        throw "scp upload failed with rc=$LASTEXITCODE"
+    }
+}
+finally {
+    Remove-Item -LiteralPath $effectiveKeyPath -Force -ErrorAction SilentlyContinue
 }
 
 $result = [ordered]@{
     exportedZip = $zipPath
     uploadedTo = "$RemoteDropDir/$zipName"
-    caseIdSidecar = if ($CaseId.HasValue) { "$RemoteDropDir/$baseName.caseid" } else { $null }
+    caseIdSidecar = if ($null -ne $CaseId) { "$RemoteDropDir/$baseName.caseid" } else { $null }
     hostname = $hostName
     mode = $Mode
     runRemote = [bool]$RunRemote
@@ -59,15 +83,21 @@ $result = [ordered]@{
 if ($RunRemote) {
     $accept = "sudo /usr/local/bin/aw-hayabusa accept --package $RemoteDropDir/$zipName --host $hostName"
     $process = "sudo /usr/local/bin/aw-hayabusa process-inbox --mode $Mode --limit 1"
-    $link = if ($CaseId.HasValue -and -not $NoLink) {
-        " && sudo /usr/local/bin/aw-hayabusa-link-case --case-id $($CaseId.Value) --mode $Mode --link-source windows-direct-upload"
+    $link = if (($null -ne $CaseId) -and -not $NoLink) {
+        " && sudo /usr/local/bin/aw-hayabusa-link-case --case-id $CaseId --mode $Mode --link-source windows-direct-upload"
     } else {
         ''
     }
     $remoteCmd = "$accept && $process$link && sudo cat /opt/hayabusa/state/latest-intake.json"
-    $remoteOut = & ssh.exe -i $RemoteKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL "$ServerUser@$ServerHost" $remoteCmd
-    if ($LASTEXITCODE -ne 0) {
-        throw "remote Hayabusa run failed with rc=$LASTEXITCODE"
+    $effectiveKeyPath = New-TemporarySshKeyCopy -SourceKeyPath $RemoteKeyPath
+    try {
+        $remoteOut = & ssh.exe -i $effectiveKeyPath -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL "$ServerUser@$ServerHost" $remoteCmd
+        if ($LASTEXITCODE -ne 0) {
+            throw "remote Hayabusa run failed with rc=$LASTEXITCODE"
+        }
+    }
+    finally {
+        Remove-Item -LiteralPath $effectiveKeyPath -Force -ErrorAction SilentlyContinue
     }
     $result.remoteOutput = $remoteOut
 }