@bugmole/cli 0.5.0 → 0.6.0

package/src/vendor/byok.ts

@@ -0,0 +1,371 @@
+// VENDORED from theaiinc/arcana packages/byok/src/byok.ts by `node scripts/sync-byok.mjs` — change it there, then sync.
+// Bring-your-own-vault secret resolution: read a secret by reference from
+// the vault its owner already uses, without the Arcana app, a phone, or any
+// third-party SDK.
+//
+//   gcpsm://projects/P/secrets/S[/versions/V]   Google Secret Manager
+//   awssm://REGION/SECRET_ID[#field]            AWS Secrets Manager (#field reads one field of a JSON secret)
+//   keychain://SERVICE/ACCOUNT                  the machine's keychain (macOS Keychain, Linux Secret Service)
+//   env://VARIABLE                              an environment variable
+//
+// A reference is a pointer, not a credential, so it is safe to store and
+// commit. A value is returned to the caller only, never logged or put in an
+// error message.
+//
+// One file, no dependencies, erasable TypeScript only: Node runs it as is,
+// and other projects (the Bugmole CLI) vendor it verbatim.
+
+import { execFile } from "node:child_process";
+import { createHash, createHmac, createSign } from "node:crypto";
+
+export type SecretReference =
+  | { kind: "gcp"; project: string; secret: string; version: string }
+  | { kind: "aws"; region: string; secretId: string; field?: string }
+  | { kind: "keychain"; service: string; account: string }
+  | { kind: "env"; variable: string };
+
+export type ByokDeps = {
+  env?: Record<string, string | undefined>;
+  fetch?: typeof fetch;
+  /** Runs a program and returns its stdout; replaceable in tests. */
+  exec?: (file: string, args: string[], options?: { input?: string }) => Promise<string>;
+  platform?: string;
+  /**
+   * Environment prefixes AWS keys are read from, in order. A host can put a
+   * tenant's own read-only keys first (Bugmole Cloud uses VAULT_AWS_).
+   */
+  awsPrefixes?: string[];
+  /** Name of an environment variable holding a Google service account's JSON key. */
+  googleKeyVariable?: string;
+  /** Allow the aws, gcloud, security and secret-tool CLIs (default true). */
+  allowCli?: boolean;
+};
+
+export function parseReference(value: unknown): SecretReference | null {
+  if (typeof value !== "string" || /[\r\n]/.test(value)) return null;
+  const text = value.trim();
+  let match = /^gcpsm:\/\/projects\/([^/]+)\/secrets\/([^/]+)(?:\/versions\/([^/]+))?$/.exec(text);
+  if (match) return { kind: "gcp", project: match[1], secret: match[2], version: match[3] ?? "latest" };
+  match = /^awssm:\/\/([a-z]{2}(?:-[a-z]+)+-\d)\/([^#]+?)(?:#([^#]+))?$/.exec(text);
+  if (match) return { kind: "aws", region: match[1], secretId: decodeURIComponent(match[2]), ...(match[3] ? { field: match[3] } : {}) };
+  match = /^keychain:\/\/([^/]+)\/([^/]+)$/.exec(text);
+  if (match) return { kind: "keychain", service: match[1], account: match[2] };
+  match = /^env:\/\/([A-Za-z_][A-Za-z0-9_]*)$/.exec(text);
+  if (match) return { kind: "env", variable: match[1] };
+  return null;
+}
+
+export function formatReference(reference: SecretReference): string {
+  switch (reference.kind) {
+    case "gcp": return `gcpsm://projects/${reference.project}/secrets/${reference.secret}/versions/${reference.version}`;
+    case "aws": return `awssm://${reference.region}/${reference.secretId}${reference.field ? `#${reference.field}` : ""}`;
+    case "keychain": return `keychain://${reference.service}/${reference.account}`;
+    case "env": return `env://${reference.variable}`;
+  }
+}
+
+export const SOURCE_NAME: Record<SecretReference["kind"], string> = {
+  gcp: "Google Secret Manager",
+  aws: "AWS Secrets Manager",
+  keychain: "this machine's keychain",
+  env: "an environment variable",
+};
+
+function defaultExec(file: string, args: string[], options?: { input?: string }): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const child = execFile(file, args, { maxBuffer: 1024 * 1024 }, (error, stdout) => (error ? reject(error) : resolve(String(stdout))));
+    child.stdin?.end(options?.input);
+  });
+}
+
+function execOf(deps: ByokDeps): NonNullable<ByokDeps["exec"]> {
+  if (deps.allowCli === false) return async (file) => { throw new Error(`${file} isn't available here`); };
+  return deps.exec ?? defaultExec;
+}
+
+// ---------- the machine's keychain ----------
+
+type Keychain = Extract<SecretReference, { kind: "keychain" }>;
+
+const quoted = (text: string) => `"${text.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+
+async function readKeychain(reference: Keychain, deps: ByokDeps): Promise<string> {
+  const exec = execOf(deps);
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "darwin" && platform !== "linux") {
+    throw new Error("This machine has no supported keychain (macOS Keychain, or secret-tool on Linux)");
+  }
+  try {
+    if (platform === "darwin") return (await exec("security", ["find-generic-password", "-s", reference.service, "-a", reference.account, "-w"])).replace(/\n$/, "");
+    return await exec("secret-tool", ["lookup", "service", reference.service, "account", reference.account]);
+  } catch {
+    throw new Error(`No keychain entry ${formatReference(reference)} on this machine`);
+  }
+}
+
+/** Stores a value in the machine's keychain, replacing any earlier one. The value goes in on stdin, never in a command's arguments. */
+export async function writeKeychain(reference: Keychain, value: string, label: string, deps: ByokDeps = {}): Promise<void> {
+  const exec = execOf(deps);
+  const platform = deps.platform ?? process.platform;
+  if (platform === "darwin") {
+    // `security add-generic-password -w VALUE` would show the value in the
+    // process list; its interactive mode reads the same command from stdin.
+    await exec("security", ["-i"], {
+      input: `add-generic-password -U -s ${quoted(reference.service)} -a ${quoted(reference.account)} -l ${quoted(label)} -w ${quoted(value)}\n`,
+    });
+    return;
+  }
+  if (platform === "linux") {
+    await exec("secret-tool", ["store", "--label", label, "service", reference.service, "account", reference.account], { input: value });
+    return;
+  }
+  throw new Error("This machine has no supported keychain (macOS Keychain, or secret-tool on Linux)");
+}
+
+export async function deleteKeychain(reference: Keychain, deps: ByokDeps = {}): Promise<boolean> {
+  const exec = execOf(deps);
+  const platform = deps.platform ?? process.platform;
+  try {
+    if (platform === "darwin") await exec("security", ["delete-generic-password", "-s", reference.service, "-a", reference.account]);
+    else if (platform === "linux") await exec("secret-tool", ["clear", "service", reference.service, "account", reference.account]);
+    else return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Whether a keychain entry exists, without reading its value. */
+export async function keychainHas(reference: Keychain, deps: ByokDeps = {}): Promise<boolean> {
+  const exec = execOf(deps);
+  const platform = deps.platform ?? process.platform;
+  try {
+    // Without -w macOS prints the entry's attributes, not its value.
+    if (platform === "darwin") await exec("security", ["find-generic-password", "-s", reference.service, "-a", reference.account]);
+    else if (platform === "linux") {
+      const found = await exec("secret-tool", ["search", "service", reference.service, "account", reference.account]);
+      if (!found.trim()) return false;
+    } else return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ---------- AWS Secrets Manager ----------
+
+export type AwsCredentials = { accessKeyId: string; secretAccessKey: string; sessionToken?: string };
+
+const sha256Hex = (value: string) => createHash("sha256").update(value).digest("hex");
+const hmac = (key: string | Buffer, value: string) => createHmac("sha256", key).update(value).digest();
+
+/** AWS Signature Version 4 for a JSON POST. */
+export function signAws(params: { credentials: AwsCredentials; region: string; service: string; url: string; headers: Record<string, string>; body: string; now?: Date }): Record<string, string> {
+  const now = params.now ?? new Date();
+  const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const date = amzDate.slice(0, 8);
+  const url = new URL(params.url);
+  const headers: Record<string, string> = {
+    ...Object.fromEntries(Object.entries(params.headers).map(([key, value]) => [key.toLowerCase(), value.trim()])),
+    host: url.host,
+    "x-amz-date": amzDate,
+    ...(params.credentials.sessionToken ? { "x-amz-security-token": params.credentials.sessionToken } : {}),
+  };
+  const names = Object.keys(headers).sort();
+  const canonical = [
+    "POST",
+    url.pathname || "/",
+    url.searchParams.toString(),
+    names.map((name) => `${name}:${headers[name]}\n`).join(""),
+    names.join(";"),
+    sha256Hex(params.body),
+  ].join("\n");
+  const scope = `${date}/${params.region}/${params.service}/aws4_request`;
+  const toSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha256Hex(canonical)].join("\n");
+  const key = hmac(hmac(hmac(hmac(`AWS4${params.credentials.secretAccessKey}`, date), params.region), params.service), "aws4_request");
+  const signature = createHmac("sha256", key).update(toSign).digest("hex");
+  const { host: _host, ...rest } = headers;
+  return {
+    ...rest,
+    authorization: `AWS4-HMAC-SHA256 Credential=${params.credentials.accessKeyId}/${scope}, SignedHeaders=${names.join(";")}, Signature=${signature}`,
+  };
+}
+
+/** AWS keys from the configured environment prefixes, then the AWS CLI (profiles, SSO). */
+export async function awsCredentials(deps: ByokDeps = {}): Promise<AwsCredentials> {
+  const env = deps.env ?? process.env;
+  for (const prefix of deps.awsPrefixes ?? ["AWS_"]) {
+    const accessKeyId = env[`${prefix}ACCESS_KEY_ID`];
+    const secretAccessKey = env[`${prefix}SECRET_ACCESS_KEY`];
+    if (accessKeyId && secretAccessKey) {
+      const sessionToken = env[`${prefix}SESSION_TOKEN`];
+      return { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) };
+    }
+  }
+  try {
+    const parsed = JSON.parse(await execOf(deps)("aws", ["configure", "export-credentials", "--format", "process"])) as { AccessKeyId?: string; SecretAccessKey?: string; SessionToken?: string };
+    if (parsed.AccessKeyId && parsed.SecretAccessKey) {
+      return { accessKeyId: parsed.AccessKeyId, secretAccessKey: parsed.SecretAccessKey, ...(parsed.SessionToken ? { sessionToken: parsed.SessionToken } : {}) };
+    }
+  } catch {
+    // Reported below.
+  }
+  throw new Error("No AWS credentials: set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or sign in with the AWS CLI");
+}
+
+async function readAws(reference: Extract<SecretReference, { kind: "aws" }>, deps: ByokDeps): Promise<string> {
+  const credentials = await awsCredentials(deps);
+  const url = `https://secretsmanager.${reference.region}.amazonaws.com/`;
+  const body = JSON.stringify({ SecretId: reference.secretId });
+  const headers = signAws({
+    credentials,
+    region: reference.region,
+    service: "secretsmanager",
+    url,
+    headers: { "content-type": "application/x-amz-json-1.1", "x-amz-target": "secretsmanager.GetSecretValue" },
+    body,
+  });
+  const reply = await (deps.fetch ?? fetch)(url, { method: "POST", headers, body });
+  if (!reply.ok) throw new Error(`AWS Secrets Manager refused ${formatReference(reference)} (${reply.status}): ${await errorText(reply)}`);
+  const payload = await reply.json() as { SecretString?: string; SecretBinary?: string };
+  const text = payload.SecretString ?? (payload.SecretBinary ? Buffer.from(payload.SecretBinary, "base64").toString("utf8") : undefined);
+  if (text === undefined) throw new Error(`${formatReference(reference)} has no value`);
+  return reference.field ? jsonField(text, reference.field, formatReference(reference)) : text;
+}
+
+// ---------- Google Secret Manager ----------
+
+type ServiceAccountKey = { client_email?: string; private_key?: string; token_uri?: string };
+
+async function serviceAccountToken(key: ServiceAccountKey, doFetch: typeof fetch): Promise<string> {
+  if (!key.client_email || !key.private_key) throw new Error("The service account key needs client_email and private_key");
+  const now = Math.floor(Date.now() / 1000);
+  const tokenUri = key.token_uri ?? "https://oauth2.googleapis.com/token";
+  const encode = (value: object) => Buffer.from(JSON.stringify(value)).toString("base64url");
+  const unsigned = `${encode({ alg: "RS256", typ: "JWT" })}.${encode({
+    iss: key.client_email,
+    scope: "https://www.googleapis.com/auth/cloud-platform",
+    aud: tokenUri,
+    iat: now,
+    exp: now + 600,
+  })}`;
+  const signature = createSign("RSA-SHA256").update(unsigned).sign(key.private_key).toString("base64url");
+  const reply = await doFetch(tokenUri, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: `${unsigned}.${signature}` }).toString(),
+  });
+  if (!reply.ok) throw new Error(`Google refused the service account (${reply.status}): ${await errorText(reply)}`);
+  const body = await reply.json() as { access_token?: string };
+  if (!body.access_token) throw new Error("Google returned no access token for the service account");
+  return body.access_token;
+}
+
+/** A Google access token: a service account key, GOOGLE_OAUTH_ACCESS_TOKEN, or the signed-in gcloud CLI. */
+export async function googleAccessToken(deps: ByokDeps = {}): Promise<string> {
+  const env = deps.env ?? process.env;
+  const keyJson = deps.googleKeyVariable ? env[deps.googleKeyVariable] : undefined;
+  if (keyJson) {
+    let key: ServiceAccountKey;
+    try {
+      key = JSON.parse(keyJson) as ServiceAccountKey;
+    } catch {
+      throw new Error(`${deps.googleKeyVariable} isn't a service account key (JSON)`);
+    }
+    return serviceAccountToken(key, deps.fetch ?? fetch);
+  }
+  if (env.GOOGLE_OAUTH_ACCESS_TOKEN) return env.GOOGLE_OAUTH_ACCESS_TOKEN;
+  try {
+    const token = (await execOf(deps)("gcloud", ["auth", "print-access-token"])).trim();
+    if (token) return token;
+  } catch {
+    // Reported below.
+  }
+  throw new Error("No Google credentials: sign in with `gcloud auth login`, or set GOOGLE_OAUTH_ACCESS_TOKEN");
+}
+
+async function readGoogle(reference: Extract<SecretReference, { kind: "gcp" }>, deps: ByokDeps): Promise<string> {
+  const token = await googleAccessToken(deps);
+  const url = `https://secretmanager.googleapis.com/v1/projects/${encodeURIComponent(reference.project)}/secrets/${encodeURIComponent(reference.secret)}/versions/${encodeURIComponent(reference.version)}:access`;
+  const reply = await (deps.fetch ?? fetch)(url, { headers: { authorization: `Bearer ${token}` } });
+  if (!reply.ok) throw new Error(`Google Secret Manager refused ${formatReference(reference)} (${reply.status}): ${await errorText(reply)}`);
+  const body = await reply.json() as { payload?: { data?: string } };
+  if (!body.payload?.data) throw new Error(`${formatReference(reference)} has no value`);
+  return Buffer.from(body.payload.data, "base64").toString("utf8");
+}
+
+// ---------- shared ----------
+
+async function errorText(reply: Response): Promise<string> {
+  const text = (await reply.text().catch(() => "")).slice(0, 300);
+  try {
+    const parsed = JSON.parse(text) as { message?: string; Message?: string; error?: { message?: string } };
+    return parsed.error?.message ?? parsed.message ?? parsed.Message ?? text;
+  } catch {
+    return text;
+  }
+}
+
+function jsonField(text: string, field: string, label: string): string {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`${label} isn't JSON, so it has no field "${field}"`);
+  }
+  const value = (parsed as Record<string, unknown> | null)?.[field];
+  if (typeof value !== "string" && typeof value !== "number") throw new Error(`${label} has no text field "${field}"`);
+  return String(value);
+}
+
+/** Reads the value a reference points at. Errors name the reference, never a value. */
+export async function resolveReference(reference: SecretReference, deps: ByokDeps = {}): Promise<string> {
+  switch (reference.kind) {
+    case "env": {
+      const value = (deps.env ?? process.env)[reference.variable];
+      if (value === undefined || value === "") throw new Error(`${reference.variable} is not set`);
+      return value;
+    }
+    case "keychain": return readKeychain(reference, deps);
+    case "aws": return readAws(reference, deps);
+    case "gcp": return readGoogle(reference, deps);
+  }
+}
+
+export type Readiness = { ready: boolean; detail: string };
+
+/**
+ * Whether a reference can probably be read here, without reading it: an env
+ * variable or keychain entry exists, or credentials for the cloud vault do.
+ */
+export async function readiness(reference: SecretReference, deps: ByokDeps = {}): Promise<Readiness> {
+  const env = deps.env ?? process.env;
+  switch (reference.kind) {
+    case "env":
+      return env[reference.variable] ? { ready: true, detail: `Read from ${reference.variable}` } : { ready: false, detail: `${reference.variable} is not set` };
+    case "keychain":
+      return (await keychainHas(reference, deps))
+        ? { ready: true, detail: "In this machine's keychain" }
+        : { ready: false, detail: `No keychain entry ${formatReference(reference)}` };
+    case "aws":
+      try {
+        await awsCredentials({ ...deps, allowCli: false });
+        return { ready: true, detail: "AWS keys found; read when it's used" };
+      } catch {
+        // Checking the AWS CLI's profile could start a sign-in, so it isn't.
+        return deps.allowCli === false
+          ? { ready: false, detail: "No AWS keys" }
+          : { ready: true, detail: "No AWS keys in the environment; the AWS CLI's profile is tried when it's used" };
+      }
+    case "gcp": {
+      if ((deps.googleKeyVariable && env[deps.googleKeyVariable]) || env.GOOGLE_OAUTH_ACCESS_TOKEN) return { ready: true, detail: "Google credentials found; read when it's used" };
+      try {
+        const account = (await execOf(deps)("gcloud", ["auth", "list", "--filter=status:ACTIVE", "--format=value(account)"])).trim();
+        if (account) return { ready: true, detail: `Signed in to gcloud as ${account}; read when it's used` };
+      } catch {
+        // Reported below.
+      }
+      return { ready: false, detail: "No Google credentials: run gcloud auth login, or set GOOGLE_OAUTH_ACCESS_TOKEN" };
+    }
+  }
+}