@agentpulselabs/cli-plugin-pulse 0.1.0 → 1.0.0

package/src/lib/identity.js

@@ -0,0 +1,102 @@
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  randomUUID,
+} from 'node:crypto';
+import path from 'node:path';
+import { HubError } from './errors.js';
+import { readOwnerOnlyJson, writeOwnerOnlyJson } from './storage.js';
+
+const IDENTITY_FILE = 'identity.json';
+
+export function fingerprintPublicKey(rawPublicKey) {
+  return createHash('sha256').update(rawPublicKey).digest('hex');
+}
+
+export function createIdentityCandidate({ machineId, now = new Date() } = {}) {
+  const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+  const publicKeyDer = publicKey.export({ format: 'der', type: 'spki' });
+  const rawPublicKey = publicKeyDer.subarray(-32);
+  return {
+    identity: {
+      algorithm: 'Ed25519',
+      machineId: machineId || randomUUID(),
+      publicKeyEd25519: rawPublicKey.toString('base64url'),
+      fingerprint: fingerprintPublicKey(rawPublicKey),
+      secretRef: `device-key-${randomUUID()}`,
+      createdAt: now.toISOString(),
+    },
+    privateKeyPem: privateKey.export({ format: 'pem', type: 'pkcs8' }),
+  };
+}
+
+export async function persistIdentity({ configDir, identity }) {
+  const stored = {
+    algorithm: identity.algorithm,
+    machineId: identity.machineId,
+    publicKeyEd25519: identity.publicKeyEd25519,
+    fingerprint: identity.fingerprint,
+    secretRef: identity.secretRef,
+    createdAt: identity.createdAt,
+  };
+  await writeOwnerOnlyJson(path.join(configDir, IDENTITY_FILE), stored);
+  return stored;
+}
+
+export async function loadIdentity({ secretStore, configDir }) {
+  const identityFile = path.join(configDir, IDENTITY_FILE);
+  const existing = await readOwnerOnlyJson(identityFile);
+  if (!existing) {
+    const error = new Error('Pulse device identity is not installed.');
+    error.code = 'HUB_IDENTITY_NOT_INSTALLED';
+    throw error;
+  }
+  const privateKey = await secretStore.get(existing.secretRef);
+  if (!privateKey) {
+    const error = new Error('Pulse device private key is missing from the operating-system secret store.');
+    error.code = 'HUB_IDENTITY_SECRET_MISSING';
+    throw error;
+  }
+  let signerPublicKey;
+  try {
+    signerPublicKey = createPublicKey(createPrivateKey(privateKey))
+      .export({ format: 'der', type: 'spki' })
+      .subarray(-32);
+  } catch (error) {
+    throw new HubError(
+      'HUB_IDENTITY_MISMATCH',
+      'Stored connector identity does not match its operating-system secret',
+      { cause: error },
+    );
+  }
+  if (
+    existing.publicKeyEd25519 !== signerPublicKey.toString('base64url') ||
+    existing.fingerprint !== fingerprintPublicKey(signerPublicKey)
+  ) {
+    throw new HubError(
+      'HUB_IDENTITY_MISMATCH',
+      'Stored connector identity does not match its operating-system secret',
+    );
+  }
+  return { ...existing };
+}
+
+export async function loadOrCreateIdentity({ secretStore, configDir }) {
+  const identityFile = path.join(configDir, IDENTITY_FILE);
+  const existing = await readOwnerOnlyJson(identityFile);
+  if (existing) {
+    return loadIdentity({ secretStore, configDir });
+  }
+
+  const { identity, privateKeyPem } = createIdentityCandidate();
+  await secretStore.set(identity.secretRef, privateKeyPem);
+  try {
+    await persistIdentity({ configDir, identity });
+  } catch (error) {
+    await secretStore.delete(identity.secretRef);
+    throw error;
+  }
+  return identity;
+}