noms-command 0.5.0 → 2.1.1

data/fixture/public/lib/nomsargs.js

@@ -0,0 +1,72 @@
+var nomsargs = { };
+
+(function (self) {
+
+    function NomsArgs(args, opt) {
+        var comparisons = [ ];
+        var assignment = { };
+        var warnings = [ ];
+        var errors = [ ];
+        var extra = [ ];
+
+        args.map(function (item) {
+            var match = /^([^!=~><]+)(==|=|!=|>=|<=|~|!~)(.*)$/.exec(item)
+            if (match == null) {
+                extra.push(item);
+            } else {
+                var m_field = match[1];
+                var m_op = match[2];
+                var m_rvalue = match[3];
+
+                comparisons.push({
+                    field: m_field,
+                    op: m_op,
+                    rvalue: m_rvalue
+                });
+
+                if (m_op == '=') {
+                    assignment[m_field] = m_rvalue
+                }
+            }
+        });
+
+        this.comparisons = comparisons;
+        this.assignment = assignment;
+        this.warnings = warnings;
+        this.errors = errors;
+        this.extra = extra;
+    };
+
+    NomsArgs.prototype = {
+        keys: function () {
+            this.comparisons.map(function (comp) { return comp.field; });
+        },
+        assignmentKeys: function () {
+            var keys = [ ];
+
+            for (var key in this.assignment) {
+                if (this.assignment.hasOwnProperty(key)) {
+                    keys.push(key);
+                }
+            }
+
+            return keys;
+        },
+        query: function () {
+            return encodeURI(this.comparisons.map(function (comp) {
+                return comp.field + comp.op + comp.rvalue;
+            }).join('&'));
+        },
+        assignmentQuery: function () {
+            return encodeURI(this.assignmentKeys().map(function (key) {
+                return key + '=' + this.assignment[key];
+            }).join('&'))
+        },
+        keys: function () {
+            return this.comparisons.map(function (comp) { comp.field });
+        }
+    };
+
+    self.NomsArgs = NomsArgs;
+
+})(nomsargs);

data/lib/noms/command.rb

@@ -1,13 +1,22 @@
 #!ruby
 
 require 'noms/command/version'
+require 'noms/command/home'
 
 require 'trollop'
 require 'logger'
 
+require 'noms/command/base'
+require 'noms/command/useragent'
+
 require 'noms/command/window'
+require 'noms/command/xmlhttprequest'
+require 'noms/command/document'
+
 require 'noms/command/application'
 require 'noms/command/formatter'
+require 'noms/command/auth'
+require 'noms/command/auth/identity'
 
 class NOMS
 
@@ -23,7 +32,7 @@ class NOMS::Command
     def initialize(argv)
         @argv = argv
         @log = Logger.new($stderr)
-        @log.formatter = lambda { |sev, timestamp, prog, msg| msg[-1].chr == "\n" ? msg : msg + "\n" }
+        @log.formatter = lambda { |sev, timestamp, prog, msg| (msg.empty? or msg[-1].chr != "\n") ? msg + "\n" : msg }
     end
 
     def run
@@ -36,16 +45,26 @@ class NOMS::Command
                   noms [noms-options] { bookmark | url } [options] [arguments]
                   noms-options:
             USAGE
-            opt :identity, "Identity file", :type => :string, :multi => true
-            opt :verbose,  "Enable verbose output"
-            opt :list,     "List bookmarks"
+            opt :identity, "Identity file", :short => '-i',
+                                            :type => :string,
+                                            :multi => true
+            opt :logout,   "Log out of authentication sessions", :short => '-L'
+            opt :verbose,  "Enable verbose output", :short => '-v'
+            opt :list,     "List bookmarks", :short => '-l'
             opt :bookmarks, "Bookmark file location (can be specified multiple times)",
+                :short => '-b',
                 :type => :string,
                 :multi => true
+            opt :home,    "Use directory as NOMS_HOME instead of #{NOMS::Command.home}",
+                :short => '-H',
+                :type => :string
+            opt :nocache,  "Don't cache files",
+                :short => '-C'
             opt :nodefault_bookmarks, "Don't consult default bookmarks files",
                 :short => '-X',
                 :long => '--nodefault-bookmarks'
-            opt :debug,    "Enable debug output"
+            opt :debug,    "Enable debug output", :short => '-d'
+            opt :'plaintext-identity', "Save identity credentials in plaintext", :short => '-P'
             stop_on_unknown
         end
 
@@ -53,14 +72,16 @@ class NOMS::Command
             parser.parse(@argv)
         end
 
+        NOMS::Command.home = @opt[:home] if @opt[:home]
+
         Trollop::with_standard_exception_handling parser do
-            raise Trollop::HelpNeeded if @argv.empty? and ! @opt[:list]
+            raise Trollop::HelpNeeded if @argv.empty? and ! @opt[:list] and ! @opt[:logout]
         end
 
         @opt[:debug] = true if ENV['NOMS_DEBUG'] and ! ENV['NOMS_DEBUG'].empty?
 
         default_bookmarks =
-            [ File.join(ENV['HOME'], '.noms/bookmarks.json'),
+            [ File.join(NOMS::Command.home, 'bookmarks.json'),
             '/usr/local/etc/noms/bookmarks.json',
             '/etc/noms/bookmarks.json'].select { |f| File.exist? f }
 
@@ -89,10 +110,18 @@ class NOMS::Command
             return 0
         end
 
+        if @opt[:logout]
+            File.unlink NOMS::Command::Auth::Identity.vault_keyfile if
+                File.exist? NOMS::Command::Auth::Identity.vault_keyfile
+            return 0
+        end
+
         begin
             origin = @bookmark[@argv[0].split('/').first] || @argv[0]
             app = NOMS::Command::Application.new(origin, @argv, :logger => @log,
-                                                 :specified_identities => @opt[:identity])
+                                                 :specified_identities => @opt[:identity],
+                                                 :cache => ! @opt[:nocache],
+                                                 :plaintext_identity => @opt[:'plaintext-identity'])
             app.fetch!                    # Retrieve page
             app.render!                   # Run scripts
             out = app.display

data/lib/noms/command/application.rb

@@ -5,14 +5,7 @@ require 'noms/command/version'
 require 'mime-types'
 require 'v8'
 
-require 'noms/command/window'
-require 'noms/command/useragent'
-require 'noms/command/error'
-require 'noms/command/urinion'
-require 'noms/command/formatter'
-require 'noms/command/document'
-require 'noms/command/xmlhttprequest'
-require 'noms/command/base'
+require 'noms/command'
 
 class NOMS
 
@@ -45,7 +38,10 @@ class NOMS::Command::Application < NOMS::Command::Base
 
         @log.debug "Application #{argv[0]} has origin: #{origin}"
         @useragent = NOMS::Command::UserAgent.new(@origin, :logger => @log,
-                                                  :specified_identities => (attrs[:specified_identities] || []))
+                                                  :specified_identities => (attrs[:specified_identities] || []),
+                                                  :cache => (attrs.has_key?(:cache) ? attrs[:cache] : true),
+                                                  :plaintext_identity => (attrs.has_key?(:plaintext_identity) ?
+                                                      attrs[:plaintext_identity] : false))
     end
 
     def fetch!
@@ -64,15 +60,14 @@ class NOMS::Command::Application < NOMS::Command::Base
             @origin = new_url
             @useragent.origin = new_url
             @window.origin = new_url
-            @log.debug "Setting origin to: #{@origin}"
-            if response.ok?
+            if response.success?
                 # Unlike typical ReST data sources, this
                 # should very rarely fail unless there is
                 # a legitimate communication issue.
-                @type = response.contenttype || 'text/plain'
-                @body = response.content
+                @type = response.content_type || 'text/plain'
+                @body = response.body
             else
-                raise NOMS::Command::Error.new("Failed to request #{@origin}: #{response.status} #{response.reason}")
+                raise NOMS::Command::Error.new("Failed to request #{@origin}: #{response.statusText}")
             end
         else
             raise NOMS::Command::Error.new("noms command #{@argv[0].inspect} not found: not a URL or bookmark")
@@ -87,12 +82,10 @@ class NOMS::Command::Application < NOMS::Command::Base
             end
             if @body.respond_to? :has_key? and @body.has_key? '$doctype'
                 @type = @body['$doctype']
-                @log.debug "Treating as #{@type} document"
                 @document = NOMS::Command::Document.new @body
                 @document.argv = @argv
                 @document.exitcode = 0
             else
-                @log.debug "Treating as raw object (no '$doctype')"
                 @type = 'noms-raw'
             end
         end
@@ -122,26 +115,38 @@ class NOMS::Command::Application < NOMS::Command::Base
             @document.script.each do |script|
                 if script.respond_to? :has_key? and script.has_key? '$source'
                     # Parse relative URL and load
-                    response, landing_url = @useragent.get(script['$source'])
+                    request_error = nil
+                    begin
+                        response, landing_url = @useragent.get(script['$source'])
+                    rescue StandardError => e
+                        @log.debug "Setting request_error (#{e.class}) to #{e.message})"
+                        request_error = e
+                    end
                     # Don't need landing_url
                     script_name = File.basename(@useragent.absolute_url(script['$source']).path)
                     script_ref = "#{script_index},#{script_name}"
-                    if response.ok?
-                        case response.contenttype
+                    if request_error.nil? and response.success?
+                        case response.content_type
                         when /^(application|text)\/(x-|)javascript/
                             begin
-                                @v8.eval response.content
+                                @v8.eval response.body
                             rescue StandardError => e
                                 @log.warn "Javascript[#{script_ref}] error: #{e.message}"
-                                @log.debug e.backtrace.join("\n")
+                                @log.debug { e.backtrace.join("\n") }
                             end
                         else
-                            @log.warn "Unsupported script type '#{response.contenttype.inspect}' " +
+                            @log.warn "Unsupported script type '#{response.content_type.inspect}' " +
                                 "for script from #{script['$source'].inspect}"
                         end
                     else
-                        @log.warn "Couldn't load script from #{script['$source'].inspect}: #{response.status} #{response.reason}"
-                        @log.debug "Body of unsuccessful request: #{response.body}"
+                        if request_error
+                            @log.warn "Couldn't load script from #{script['$source'].inspect} " +
+                                "(#{request_error.class}): #{request_error.message})"
+                            @log.debug { request_error.backtrace.join("\n") }
+                        else
+                            @log.warn "Couldn't load script from #{script['$source'].inspect}: " +
+                                "#{response.statusText}"
+                        end
                     end
                 else
                     # It's javascript text
@@ -150,7 +155,7 @@ class NOMS::Command::Application < NOMS::Command::Base
                         @v8.eval script
                     rescue StandardError => e
                         @log.warn "Javascript[#{script_ref}] error: #{e.message}"
-                        @log.debug e.backtrace.join("\n")
+                        @log.debug { e.backtrace.join("\n") }
                     end
                 end
                 script_index += 1
@@ -169,7 +174,8 @@ class NOMS::Command::Application < NOMS::Command::Base
     def display
         case @type
         when 'noms-v2'
-            NOMS::Command::Formatter.new(_sanitize(@document.body)).render
+            body = _sanitize(@document.body)
+            NOMS::Command::Formatter.new(body, :logger => @log).render
         when 'noms-raw'
             @body.to_yaml
         when /^text(\/|$)/

data/lib/noms/command/auth.rb

@@ -4,7 +4,7 @@ require 'noms/command/version'
 
 require 'httpclient'
 require 'etc'
-require 'highline/import'
+require 'highline'
 require 'json'
 require 'cgi'
 
@@ -23,48 +23,22 @@ class NOMS::Command::Auth < NOMS::Command::Base
 
     def initialize(opts={})
         @log = opts[:logger] || default_logger
-        @loaded = { }
+        @specified = { }
+        @input  = opts[:prompt_input]  || $stdin
+        @output = opts[:prompt_output] || $stdout
+        @force_prompt = opts.has_key?(:force_prompt) ? opts[:force_prompt] : false
+
         (opts[:specified_identities] || []).each do |file|
-            maybe_id = read_identity_from file
+            maybe_id = NOMS::Command::Auth::Identity.from file
             raise NOMS::Command::Error.now "#{file} contains invalid identity (no 'id')" unless
                 maybe_id['id']
-            @loaded[maybe_id['id']] = maybe_id
+            @specified[maybe_id['id']] = maybe_id
         end
     end
 
-    def read_identity_from(file)
-        @log.debug "Reading identity file #{file}"
-        begin
-            # TODO: Encryption and passphrases
-            raise NOMS::Command::Error.new "Identity file #{file} does not exist" unless File.exist? file
-            s = File.stat file
-            raise NOMS::Command::Error.new "You don't own identity file #{file}" unless s.owned?
-            raise NOMS::Command::Error.new "Permissions on #{file} are too permissive" unless (s.mode & 077 == 0)
-            contents = File.read file
-            case contents[0].chr
-            when '{'
-                NOMS::Command::Auth::Identity.new(self, JSON.parse(contents))
-            else
-                raise NOMS::Command::Error.new "#{file} contains unsupported or corrupted data"
-            end
-        rescue StandardError => e
-            if e.is_a? NOMS::Command::Error
-                raise e
-            else
-                raise NOMS::Command::Error.new "Couldn't load identity from #{file} (#{e.class}): #{e.message}"
-            end
-        end
-    end
-
-    # TODO: Persistent auth creds
-    # Store like a client certificate: encrypted. Then use an
-    # agent to store by using <agent>-add and typing passphrase
-    # just like a client cert. <agent> expires credentials.
-    # also you can explicitly unencrypt identity file
-
     def load(url, response)
         # Prompt
-        auth_header = response.header['www-authenticate']
+        auth_header = response.header('WWW-Authenticate')
         auth_header = (auth_header.respond_to?(:first) ? auth_header.first : auth_header)
         case auth_header
         when /Basic/
@@ -75,30 +49,42 @@ class NOMS::Command::Auth < NOMS::Command::Base
             end
             domain = [url.scheme, '://', url.host, ':', url.port, '/'].join('')
             identity_id = CGI.escape(realm) + '=' + domain
-            if saved(identity_id)
-                retrieve(identity_id)
+            unless @specified.empty?
+                if @specified[identity_id]
+                    @specified[identity_id]
+                else
+                    @log.warn "No identity specified for #{domain} (#{realm})"
+                    nil
+                end
             else
-                if $stdin.tty?
-                    default_user = Etc.getlogin
-                    prompt = "#{domain} (#{realm}) username: "
-                    user = ask(prompt) { |u| u.default = Etc.getlogin }
-                    pass = ask('Password: ') { |p| p.echo = false }
-                    NOMS::Command::Auth::Identity.new(self, {
-                                                          'id' => identity_id,
-                                                          'realm' => realm,
-                                                          'domain' => domain,
-                                                          'username' => user,
-                                                          'password' => pass
-                                                      })
+                if id_info = saved(identity_id)
+                    NOMS::Command::Auth::Identity.new(id_info, :logger => @log)
                 else
-                    @log.warn "Can't prompt for #{domain} (#{realm}) authentication (not a terminal)"
-                    NOMS::Command::Auth::Identity.new({
-                                                         'id' => identity_id,
-                                                         'realm' => realm,
-                                                         'domain' => domain,
-                                                         'username' => '',
-                                                         'password' => ''
-                                                     })
+                    # It might be nice to synchronize around this to
+                    # make pipelines work.
+                    if $stdin.tty? or @force_prompt
+                        highline = HighLine.new(@input, @output)
+                        default_user = Etc.getlogin
+                        prompt = "#{domain} (#{realm}) username: "
+                        user = highline.ask(prompt) { |u| u.default = Etc.getlogin }
+                        pass = highline.ask('Password: ') { |p| p.echo = false }
+                        NOMS::Command::Auth::Identity.new({
+                                                              'id' => identity_id,
+                                                              'realm' => realm,
+                                                              'domain' => domain,
+                                                              'username' => user,
+                                                              'password' => pass
+                                                          }, :logger => @log)
+                    else
+                        @log.warn "Can't prompt for #{domain} (#{realm}) authentication (not a terminal)"
+                        NOMS::Command::Auth::Identity.new({
+                                                              'id' => identity_id,
+                                                              'realm' => realm,
+                                                              'domain' => domain,
+                                                              'username' => '',
+                                                              'password' => ''
+                                                          }, :logger => @log)
+                    end
                 end
             end
         else
@@ -107,11 +93,7 @@ class NOMS::Command::Auth < NOMS::Command::Base
     end
 
     def saved(identity_id)
-        @loaded.has_key? identity_id
-    end
-
-    def retrieve(identity_id)
-        @loaded[identity_id]
+        NOMS::Command::Auth::Identity.saved identity_id
     end
 
 end

data/lib/noms/command/auth/identity.rb

@@ -1,6 +1,22 @@
 #!ruby
 
+require 'noms/command/version'
+require 'noms/command/home'
+
+require 'fileutils'
 require 'logger'
+require 'openssl'
+require 'fcntl'
+require 'base64'
+require 'bcrypt'
+
+require 'noms/command'
+
+class String
+    def to_hex
+        self.unpack('C*').map { |n| '%02x' % n }.join('')
+    end
+end
 
 class NOMS
 
@@ -17,10 +33,144 @@ end
 class NOMS::Command::Auth::Identity < NOMS::Command::Base
     include Enumerable
 
-    def initialize(auth, h, attrs={})
+    @@identity_dir = File.join(NOMS::Command.home, 'identities')
+    @@cipher       = 'aes-256-cfb'
+    @@hmac_digest  = 'sha256'
+    @@max_key_idle = 3600
+
+    def self.identity_dir
+        @@identity_dir
+    end
+
+    def self.identity_dir=(value)
+        @@identity_dir = value
+    end
+
+    def self.generate_new_key
+        cipher = OpenSSL::Cipher.new(@@cipher)
+        cipher.encrypt
+        cipher.random_key + cipher.random_key
+    end
+
+    def self.vault_keyfile
+        File.join(@@identity_dir, '.noms-vault-key')
+    end
+
+    def self.ensure_dir
+        unless File.directory? @@identity_dir
+            FileUtils.mkdir_p @@identity_dir
+        end
+        File.chmod 0700, @@identity_dir
+    end
+
+    def self.get_vault_key
+        key = ''
+        ensure_dir
+        fh = File.for_fd(IO.sysopen(vault_keyfile, Fcntl::O_RDWR | Fcntl::O_CREAT, 0600))
+        fh.flock(File::LOCK_EX)
+        mtime = fh.mtime
+
+        key = fh.read if (Time.now - mtime < @@max_key_idle)
+
+        if key.empty?
+            key = generate_new_key
+            fh.write key
+        end
+        fh.flock(File::LOCK_EX)
+        fh.close
+
+        key
+    end
+
+    def self.decrypt(blob)
+        mac_key, enc_key = get_vault_key.unpack('a32a32')
+
+        message = Base64.decode64(blob)
+        hmac_digest, iv, data = message.unpack('a32a16a*')
+
+        hmac = OpenSSL::HMAC.new(mac_key, OpenSSL::Digest.new(@@hmac_digest))
+        hmac.update(iv + data)
+        raise NOMS::Command::Error.new("HMAC verification error") unless hmac.digest == hmac_digest
+
+        cipher = OpenSSL::Cipher.new @@cipher
+        cipher.decrypt
+        cipher.key = enc_key
+        cipher.iv = iv
+        cipher.update(data) + cipher.final
+    end
+
+
+    # Returns hash of identity data suitable for passing to .new
+    def self.saved(identity_id, opt={})
+        # This can't really log errors, hm.
+        id_number = OpenSSL::Digest::SHA1.new(identity_id).hexdigest
+        file_base = File.join(@@identity_dir, id_number)
+
+        if File.exist? "#{file_base}.json"
+            begin
+                JSON.parse(File.read "#{file_base}.json").merge({ '_loaded' => { "#{file_base}.json" => Time.now.to_s } })
+            rescue StandardError => e
+                File.unlink "#{file_base}.json" if File.exist? "#{file_base}.json"
+                return nil
+            end
+        elsif File.exist? "#{file_base}.enc"
+            begin
+                hash = JSON.parse(decrypt(File.read("#{file_base}.enc"))).
+                    merge({ '_decrypted' => true, '_loaded' => { "#{file_base}.enc" => Time.now.to_s } })
+            rescue StandardError => e
+                File.unlink "#{file_base}.enc" if File.exist? "#{file_base}.enc"
+                return nil
+            end
+        else
+            return nil
+        end
+
+    end
+
+    def self.from(file)
+        begin
+            raise NOMS::Command::Error.new "Identity file #{file} does not exist" unless File.exist? file
+            s = File.stat file
+            raise NOMS::Command::Error.new "You don't own identity file #{file}" unless s.owned?
+            raise NOMS::Command::Error.new "Permissions on #{file} are too permissive" unless (s.mode & 077 == 0)
+            contents = File.read file
+            raise NOMS::Command::Error.new "#{file} is empty" unless contents and ! contents.empty?
+            case contents[0].chr
+            when '{'
+                NOMS::Command::Auth::Identity.new(JSON.parse(contents).merge({'_specified' => file }), :logger => @log)
+            else
+                raise NOMS::Command::Error.new "#{file} contains unsupported or corrupted data"
+            end
+        rescue StandardError => e
+            if e.is_a? NOMS::Command::Error
+                raise e
+            else
+                raise NOMS::Command::Error.new "Couldn't load identity from #{file} (#{e.class}): #{e.message}"
+            end
+        end
+    end
+
+    def initialize(h, attrs={})
         @log = attrs[:logger] || default_logger
-        @auth = auth
         @data = h
+        refresh_vault_key if h['_decrypted']
+    end
+
+    def specified
+        @data['_specified']
+    end
+
+    def verification_hash
+        BCrypt::Password.create(self['username'] + ':' + self['password'] + '@' + self['id']).to_s
+    end
+
+    def auth_verify?(pwd_hash)
+        pwd = BCrypt::Password.new(pwd_hash)
+        pwd == self['username'] + ':' + self['password'] + '@' + self['id']
+    end
+
+    def id_number
+        OpenSSL::Digest::SHA1.new(self['id']).hexdigest
     end
 
     def [](key)
@@ -28,6 +178,7 @@ class NOMS::Command::Auth::Identity < NOMS::Command::Base
     end
 
     def []=(key, value)
+        $stderr.puts "auth identity set #{key} = #{value}"
         @data[key] = value
     end
 
@@ -39,8 +190,57 @@ class NOMS::Command::Auth::Identity < NOMS::Command::Base
         @data.keys
     end
 
-    def save
-        @log.debug "Saving #{@data['id']}"
+    def refresh_vault_key
+        vault_keyfile = NOMS::Command::Auth::Identity.vault_keyfile
+        if File.exist? vault_keyfile
+            File.utime(Time.now, Time.now, vault_keyfile)
+        end
+    end
+
+    def save(opt={})
+        return self.specified if self.specified
+        begin
+            opt[:encrypt] = true unless opt.has_key? :encrypt
+            file = opt[:file] || File.join(@@identity_dir, self.id_number + '.' + (opt[:encrypt] ? 'enc' : 'json'))
+            data = opt[:encrypt] ? self.encrypt : (self.to_json + "\n")
+
+            File.open(file, 'w') { |fh| fh.write data }
+            file
+        rescue StandardError => e
+            @log.warn "Couldn't save identity for #{@data['id']} (#{e.class}): #{e.message}"
+            @log.debug { e.backtrace.join("\n") }
+            return nil
+        end
+    end
+
+    def clear(opt={})
+        @log.debug "Clearing #{@data['id']}"
+        begin
+            basefile = File.join(@@identity_dir, self.id_number)
+            File.unlink "#{basefile}.json" if File.exist? "#{basefile}.json"
+            File.unlink "#{basefile}.enc" if File.exist? "#{basefile}.enc"
+        end
+    end
+
+    def to_json
+        @data.to_json
+    end
+
+    def encrypt
+        mac_key, enc_key = NOMS::Command::Auth::Identity.get_vault_key.unpack('a32a32')
+        cipher = OpenSSL::Cipher.new @@cipher
+        cipher.encrypt
+        iv = cipher.random_iv
+        cipher.key = enc_key
+        plaintext = self.to_json
+        data = cipher.update(plaintext) + cipher.final
+
+        hmac = OpenSSL::HMAC.new(mac_key, OpenSSL::Digest.new(@@hmac_digest))
+        hmac.update(iv + data)
+
+        message = hmac.digest + iv + data
+
+        Base64.encode64(message)
     end
 
     def id
@@ -56,7 +256,7 @@ class NOMS::Command::Auth::Identity < NOMS::Command::Base
     end
 
     def to_s
-        "#{@data['id']}"
+        @data['id']
     end
 
 end