@amerged/ohmyhost-mcp 0.1.10

package/src/apps/product-cli/credential-store.ts

@@ -0,0 +1,149 @@
+export interface StoredCredential {
+  readonly accessToken: string;
+  readonly refreshToken: string;
+  readonly expiresAt?: string;
+  /** The workspace this credential is scoped to, as the provider names it. */
+  readonly workosOrganizationId?: string;
+  /** The same workspace in platform terms, kept for display. */
+  readonly organizationId?: string;
+}
+
+export interface CurrentCredential extends StoredCredential {
+  readonly expiresAt: string;
+}
+
+export interface CredentialStore {
+  read(): Promise<StoredCredential | undefined>;
+  replace(credential: CurrentCredential): Promise<void>;
+  clear(): Promise<void>;
+}
+
+interface KeyringEntry {
+  setPassword(password: string): Promise<void>;
+  getPassword(): Promise<string | undefined>;
+  deleteCredential(): Promise<boolean>;
+}
+
+export type KeyringEntryFactory = (account: string) => Promise<KeyringEntry>;
+
+export class CredentialStoreUnavailableError extends Error {
+  public constructor() {
+    super("The credential store is unavailable.");
+    this.name = "CredentialStoreUnavailableError";
+  }
+}
+
+export class CredentialStoreIntegrityError extends Error {
+  public constructor() {
+    super("The credential store integrity check failed.");
+    this.name = "CredentialStoreIntegrityError";
+  }
+}
+
+const CREDENTIAL_ACCOUNT = "credential";
+
+export class NativeNapiKeyringCredentialStore implements CredentialStore {
+  private readonly createEntry: KeyringEntryFactory;
+
+  public constructor(
+    createEntry: KeyringEntryFactory | undefined = undefined,
+    serviceName = "ohmyhost",
+  ) {
+    this.createEntry = createEntry ?? createNativeEntryFactory(serviceName);
+  }
+
+  public async read(): Promise<StoredCredential | undefined> {
+    const serialized = await this.entry().then((entry) => entry.getPassword());
+    if (serialized === undefined) return undefined;
+    return parseVerifiedCredential(serialized);
+  }
+
+  public async replace(credential: CurrentCredential): Promise<void> {
+    const entry = await this.entry();
+    const serialized = serializeCredential(credential);
+    await entry.setPassword(serialized);
+    parseVerifiedCredential(await entry.getPassword());
+  }
+
+  public async clear(): Promise<void> {
+    const entry = await this.entry();
+    await entry.deleteCredential();
+    if ((await entry.getPassword()) !== undefined) throw new CredentialStoreIntegrityError();
+  }
+
+  private entry(): Promise<KeyringEntry> {
+    return this.createEntry(CREDENTIAL_ACCOUNT);
+  }
+}
+
+const parseVerifiedCredential = (serialized: string | undefined): StoredCredential => {
+  try {
+    return parseCredential(serialized);
+  } catch {
+    throw new CredentialStoreIntegrityError();
+  }
+};
+
+const createNativeEntryFactory = (serviceName: string): KeyringEntryFactory => {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(serviceName)) {
+    throw new CredentialStoreUnavailableError();
+  }
+  return async (account) => {
+    const { AsyncEntry } = await import("@napi-rs/keyring");
+    let entry: InstanceType<typeof AsyncEntry>;
+    try {
+      entry = new AsyncEntry(serviceName, account);
+    } catch {
+      throw new CredentialStoreUnavailableError();
+    }
+    return {
+      setPassword: (password) => runNativeOperation(() => entry.setPassword(password)),
+      getPassword: async () => (await runNativeOperation(() => entry.getPassword())) ?? undefined,
+      deleteCredential: () => runNativeOperation(() => entry.deleteCredential()),
+    };
+  };
+};
+
+const runNativeOperation = async <Result>(operation: () => Promise<Result>): Promise<Result> => {
+  try {
+    return await operation();
+  } catch {
+    throw new CredentialStoreUnavailableError();
+  }
+};
+
+export const serializeCredential = (credential: CurrentCredential): string =>
+  JSON.stringify(credential);
+
+export const parseCredential = (serialized: string | undefined): StoredCredential => {
+  if (serialized === undefined) throw new Error("Credential entry is missing");
+  const value: unknown = JSON.parse(serialized);
+  if (
+    typeof value !== "object" ||
+    value === null ||
+    !("accessToken" in value) ||
+    !("refreshToken" in value) ||
+    typeof value.accessToken !== "string" ||
+    typeof value.refreshToken !== "string" ||
+    value.accessToken.length === 0 ||
+    value.refreshToken.length === 0 ||
+    ("expiresAt" in value && typeof value.expiresAt !== "string") ||
+    ("workosOrganizationId" in value &&
+      (typeof value.workosOrganizationId !== "string" ||
+        !/^org_[A-Za-z0-9_]{1,120}$/u.test(value.workosOrganizationId))) ||
+    ("organizationId" in value &&
+      (typeof value.organizationId !== "string" ||
+        !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(value.organizationId)))
+  ) {
+    throw new Error("Credential entry is invalid");
+  }
+  return {
+    accessToken: value.accessToken,
+    refreshToken: value.refreshToken,
+    ...("expiresAt" in value ? { expiresAt: value.expiresAt as string } : {}),
+    ...("workosOrganizationId" in value
+      ? { workosOrganizationId: value.workosOrganizationId as string }
+      : {}),
+    ...("organizationId" in value ? { organizationId: value.organizationId as string } : {}),
+  };
+};

package/src/apps/product-cli/device-token-expiry.ts

@@ -0,0 +1,89 @@
+export class DeviceTokenExpiryError extends Error {
+  public constructor() {
+    super("The Device Flow token expiry is invalid.");
+    this.name = "DeviceTokenExpiryError";
+  }
+}
+
+const invalidExpiry = (): DeviceTokenExpiryError => new DeviceTokenExpiryError();
+
+const decodeBase64Url = (value: string): Uint8Array => {
+  if (value.length === 0 || !/^[A-Za-z0-9_-]+$/u.test(value) || value.length % 4 === 1) {
+    throw invalidExpiry();
+  }
+  const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), "=");
+  let binary: string;
+  try {
+    binary = atob(padded);
+  } catch {
+    throw invalidExpiry();
+  }
+  const canonical = btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+  if (canonical !== value) throw invalidExpiry();
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+};
+
+const parseJsonSegment = (value: string): Readonly<Record<string, unknown>> => {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(value)));
+  } catch {
+    throw invalidExpiry();
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw invalidExpiry();
+  }
+  return parsed as Readonly<Record<string, unknown>>;
+};
+
+const readJwtExpirySeconds = (accessToken: string): number => {
+  const segments = accessToken.split(".");
+  if (segments.length !== 3) throw invalidExpiry();
+  const [header, payload, signature] = segments;
+  if (header === undefined || payload === undefined || signature === undefined) {
+    throw invalidExpiry();
+  }
+  parseJsonSegment(header);
+  decodeBase64Url(signature);
+  const claims = parseJsonSegment(payload);
+  const expiry = claims["exp"];
+  if (
+    !Object.hasOwn(claims, "exp") ||
+    typeof expiry !== "number" ||
+    !Number.isSafeInteger(expiry) ||
+    expiry <= 0 ||
+    expiry > 8_640_000_000_000
+  ) {
+    throw invalidExpiry();
+  }
+  return expiry;
+};
+
+export const resolveDeviceTokenExpiresAt = (
+  accessToken: string,
+  expiresInSeconds: number | undefined,
+  now: Date,
+): string => {
+  const nowMilliseconds = now.getTime();
+  if (!Number.isFinite(nowMilliseconds)) throw invalidExpiry();
+
+  const jwtExpirySeconds = readJwtExpirySeconds(accessToken);
+  const jwtExpiryMilliseconds = jwtExpirySeconds * 1_000;
+  if (!Number.isSafeInteger(jwtExpiryMilliseconds) || jwtExpiryMilliseconds <= nowMilliseconds) {
+    throw invalidExpiry();
+  }
+
+  if (expiresInSeconds !== undefined) {
+    if (!Number.isSafeInteger(expiresInSeconds) || expiresInSeconds <= 0) throw invalidExpiry();
+    const relativeExpirySeconds = Math.floor(nowMilliseconds / 1_000) + expiresInSeconds;
+    if (
+      !Number.isSafeInteger(relativeExpirySeconds) ||
+      relativeExpirySeconds !== jwtExpirySeconds
+    ) {
+      throw invalidExpiry();
+    }
+  }
+
+  return new Date(jwtExpiryMilliseconds).toISOString();
+};

package/src/apps/product-cli/file-credential-store.ts

@@ -0,0 +1,166 @@
+import { constants, lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { dirname, join } from "node:path";
+
+import {
+  CredentialStoreUnavailableError,
+  parseCredential,
+  serializeCredential,
+  type CredentialStore,
+  type CurrentCredential,
+  type StoredCredential,
+} from "./credential-store.js";
+
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+
+export class OwnerOnlyFileCredentialStore implements CredentialStore {
+  readonly #credentialPath: string;
+  readonly #temporaryPath: string;
+
+  public constructor(
+    private readonly directory: string,
+    private readonly ownerId: number,
+  ) {
+    this.#credentialPath = join(directory, "credentials.json");
+    this.#temporaryPath = join(directory, ".credentials.next");
+  }
+
+  public async read(): Promise<StoredCredential | undefined> {
+    try {
+      await this.ensureDirectory();
+      await this.recoverTemporary();
+      if (!(await this.validateFile())) return undefined;
+      const handle = await open(this.#credentialPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+      try {
+        const status = await handle.stat();
+        this.assertOwnedStatus(status, FILE_MODE, false);
+        return parseCredential(await handle.readFile("utf8"));
+      } finally {
+        await handle.close();
+      }
+    } catch {
+      throw new CredentialStoreUnavailableError();
+    }
+  }
+
+  public async replace(credential: CurrentCredential): Promise<void> {
+    try {
+      await this.ensureDirectory();
+      await this.recoverTemporary();
+      await this.validateFile();
+      const handle = await open(
+        this.#temporaryPath,
+        constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
+        FILE_MODE,
+      );
+      try {
+        await handle.writeFile(serializeCredential(credential), "utf8");
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await this.validateOwnedPath(this.#temporaryPath, FILE_MODE, false);
+      await rename(this.#temporaryPath, this.#credentialPath);
+      await this.syncDirectory();
+      await this.validateOwnedPath(this.#credentialPath, FILE_MODE, false);
+    } catch {
+      await unlink(this.#temporaryPath).catch(() => undefined);
+      throw new CredentialStoreUnavailableError();
+    }
+  }
+
+  public async clear(): Promise<void> {
+    try {
+      await this.ensureDirectory();
+      let failed = false;
+      for (const path of [this.#credentialPath, this.#temporaryPath]) {
+        try {
+          await unlink(path);
+        } catch (error) {
+          if (!isMissing(error)) failed = true;
+        }
+      }
+      try {
+        await this.syncDirectory();
+      } catch {
+        failed = true;
+      }
+      for (const path of [this.#credentialPath, this.#temporaryPath]) {
+        try {
+          await lstat(path);
+          failed = true;
+        } catch (error) {
+          if (!isMissing(error)) failed = true;
+        }
+      }
+      if (failed) throw new Error("Credential artifact cleanup failed");
+    } catch {
+      throw new CredentialStoreUnavailableError();
+    }
+  }
+
+  private async ensureDirectory(): Promise<void> {
+    await mkdir(this.directory, { mode: DIRECTORY_MODE, recursive: true });
+    await this.validateOwnedPath(this.directory, DIRECTORY_MODE, true);
+  }
+
+  private async recoverTemporary(): Promise<void> {
+    try {
+      const status = await lstat(this.#temporaryPath);
+      const invalid =
+        status.isSymbolicLink() ||
+        !status.isFile() ||
+        status.uid !== this.ownerId ||
+        (status.mode & 0o777) !== FILE_MODE;
+      await unlink(this.#temporaryPath);
+      await this.syncDirectory();
+      if (invalid) throw new Error("Temporary credential artifact was invalid");
+    } catch (error) {
+      if (!isMissing(error)) throw error;
+    }
+  }
+
+  private async validateFile(): Promise<boolean> {
+    try {
+      await this.validateOwnedPath(this.#credentialPath, FILE_MODE, false);
+      return true;
+    } catch (error) {
+      if (isMissing(error)) return false;
+      throw error;
+    }
+  }
+
+  private async validateOwnedPath(path: string, mode: number, directory: boolean): Promise<void> {
+    const status = await lstat(path);
+    if (status.isSymbolicLink()) {
+      throw new Error("Credential path ownership or mode is invalid");
+    }
+    this.assertOwnedStatus(status, mode, directory);
+  }
+
+  private assertOwnedStatus(
+    status: Awaited<ReturnType<typeof lstat>>,
+    mode: number,
+    directory: boolean,
+  ): void {
+    if (
+      (directory ? !status.isDirectory() : !status.isFile()) ||
+      status.uid !== this.ownerId ||
+      (Number(status.mode) & 0o777) !== mode
+    ) {
+      throw new Error("Credential path ownership or mode is invalid");
+    }
+  }
+
+  private async syncDirectory(): Promise<void> {
+    const handle = await open(dirname(this.#credentialPath), constants.O_RDONLY);
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+  }
+}
+
+const isMissing = (error: unknown): boolean =>
+  typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";

package/src/apps/product-cli/index.ts

@@ -0,0 +1,23 @@
+export * from "./cli.js";
+export * from "./command.js";
+export * from "./composition.js";
+export * from "./credential-store.js";
+export * from "./file-credential-store.js";
+export * from "./product-api.js";
+export * from "./project-link-store.js";
+export * from "./repository-init.js";
+export * from "./workspace.js";
+export {
+  parseAccountProfile,
+  parseCurrentIdentity,
+  parseDevAccessTicket,
+  parseCloudflareDnsAuthorization,
+  parseCloudflareDnsAuthorizationStatus,
+  parsePaidDomain,
+  parsePaidDomainPlan,
+  parseOperation,
+  parseOperationEvent,
+  parseSafeProblem,
+} from "./runtime-contract.js";
+
+export * from "./user-token-file.js";