@camstack/system 1.2.427 → 1.2.429

package/dist/device-ca-R7DKKZL6.mjs

@@ -0,0 +1,355 @@
+import { Ar as buildSecretRef, C as DEVICE_SAN_CREDENTIAL_PREFIX, w as DEVICE_SAN_USER_PREFIX } from "./dist-CSSfTM18.mjs";
+import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
+import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
+//#region src/auth/jwt-signing-key.ts
+/**
+* The hub's session signing key — the HMAC key every JWT this hub mints
+* (sessions, SSO bridge, TOTP challenges, service tokens) is signed with.
+*
+* It lives in the keychain, owner `system` ({@link JWT_SIGNING_KEY_REF}), and
+* nowhere else: no environment variable, no `config.yaml` key (D797). The
+* hub's `local-auth` builtin loads it after the keychain booted and registers
+* it here; every `AuthManager` in the process asks this slot on every mint and
+* every verify, so a key that arrives (or changes) after construction is used
+* from the next call on.
+*
+* ## A locked keychain fails closed, visibly
+*
+* While the key cannot be read, sessions can be neither minted nor verified:
+* {@link JwtSigningKeySource.current} throws {@link JwtSigningKeyUnavailableError}
+* (a login answers that error, a bearer check reads it as "not authenticated").
+* There is deliberately NO fallback — not an env var, and not a fresh random
+* key, which would invalidate every session and every app token without
+* anyone having asked for it. A key is generated ONLY when the keychain
+* answers that none is stored (`missing`), i.e. on a fresh hub.
+*
+* Process-global through a registered symbol, like the desktop platform key,
+* so a second copy of this module (an addon bundle) sees the same key.
+*/
+/** The keychain owner of every system-held secret. */
+var SYSTEM_SECRET_OWNER = "system";
+/** `secret://system/global/jwtSigningKey`. */
+var JWT_SIGNING_KEY_REF = buildSecretRef({
+	owner: SYSTEM_SECRET_OWNER,
+	scope: { kind: "global" },
+	fieldPath: "jwtSigningKey"
+});
+/** Sessions cannot be minted or verified: the signing key is not loaded. */
+var JwtSigningKeyUnavailableError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(`sessions are unavailable: the session signing key could not be read from the keychain (${reason}). Unlock the keychain (System → Secrets, or fix keychain.keyFile and restart).`);
+		this.reason = reason;
+		this.name = "JwtSigningKeyUnavailableError";
+	}
+};
+var SLOT = Symbol.for("camstack.auth.jwt-signing-key");
+var NOT_LOADED = {
+	state: "unavailable",
+	reason: "not-loaded"
+};
+function isState(value) {
+	if (value === null || typeof value !== "object") return false;
+	const state = Reflect.get(value, "state");
+	if (state === "ready") return typeof Reflect.get(value, "key") === "string";
+	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
+}
+/** Register the loaded (or unloadable) key. Called by the hub's `local-auth`. */
+function setProcessJwtSigningKey(state) {
+	Reflect.set(globalThis, SLOT, state);
+}
+function getProcessJwtSigningKeyState() {
+	const value = Reflect.get(globalThis, SLOT);
+	return isState(value) ? value : NOT_LOADED;
+}
+/** The process slot — the default source of every `AuthManager`. */
+var processJwtSigningKey = { current() {
+	const state = getProcessJwtSigningKeyState();
+	if (state.state === "ready") return state.key;
+	throw new JwtSigningKeyUnavailableError(state.reason);
+} };
+/** A fixed key — tests, and nothing else. */
+function staticJwtSigningKey(key) {
+	return { current: () => key };
+}
+/** 32 random bytes, hex. */
+function generateJwtSigningKey() {
+	return randomBytes(32).toString("hex");
+}
+/**
+* Read the key from the keychain; generate and store one ONLY when the
+* keychain answers that none exists. Never throws.
+*/
+async function loadJwtSigningKey(deps) {
+	let entry;
+	try {
+		entry = (await deps.secrets.resolve([JWT_SIGNING_KEY_REF]))[JWT_SIGNING_KEY_REF];
+	} catch (err) {
+		return {
+			state: "unavailable",
+			reason: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (entry === void 0) return {
+		state: "unavailable",
+		reason: "no-answer"
+	};
+	switch (entry.kind) {
+		case "value": return {
+			state: "ready",
+			key: entry.value
+		};
+		case "unavailable": return {
+			state: "unavailable",
+			reason: entry.reason
+		};
+		case "forbidden": return {
+			state: "unavailable",
+			reason: "forbidden"
+		};
+		case "missing": {
+			const key = (deps.generate ?? generateJwtSigningKey)();
+			try {
+				await deps.secrets.put(JWT_SIGNING_KEY_REF, key);
+			} catch (err) {
+				return {
+					state: "unavailable",
+					reason: `could not store a new key: ${err instanceof Error ? err.message : String(err)}`
+				};
+			}
+			return {
+				state: "ready",
+				key
+			};
+		}
+	}
+}
+//#endregion
+//#region src/auth/device-ca.ts
+cryptoProvider.set(webcrypto);
+var MS_PER_DAY = 864e5;
+var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
+/** `secret://system/global/deviceCaKey` — EC P-256 PKCS#8 PEM of the device CA. */
+var DEVICE_CA_KEY_REF = buildSecretRef({
+	owner: "system",
+	scope: { kind: "global" },
+	fieldPath: "deviceCaKey"
+});
+/** Settings section / field holding the public CA certificate PEM (beside `cluster.meshCa`). */
+var DEVICE_CA_SETTINGS_SECTION = "cluster";
+var DEVICE_CA_FIELD = "deviceCa";
+var DEVICE_CA_COMMON_NAME = "CamStack Device CA";
+var DEVICE_CA_VALIDITY_DAYS = 3650;
+var KEY_ALGORITHM = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+var SIGNING_ALGORITHM = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+function freshSerial() {
+	return `00${randomBytes(16).toString("hex")}`;
+}
+function certPemOf(cert) {
+	return `${cert.toString("pem")}\n`;
+}
+async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
+	const keys = await webcrypto.subtle.generateKey(KEY_ALGORITHM, true, ["sign", "verify"]);
+	const extensions = [
+		new BasicConstraintsExtension(true, 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
+		await SubjectKeyIdentifierExtension.create(keys.publicKey)
+	];
+	const cert = await X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial(),
+		name: `CN=${DEVICE_CA_COMMON_NAME}`,
+		notBefore: now,
+		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
+		keys,
+		signingAlgorithm: SIGNING_ALGORITHM,
+		extensions
+	});
+	const pkcs8 = await webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+	return {
+		certPem: certPemOf(cert),
+		keyPem: `${PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`,
+		cert,
+		privateKey: keys.privateKey
+	};
+}
+async function loadDeviceCa(certPem, keyPem) {
+	return {
+		certPem,
+		keyPem,
+		cert: new X509Certificate$1(certPem),
+		privateKey: await webcrypto.subtle.importKey("pkcs8", PemConverter.decodeFirst(keyPem), KEY_ALGORITHM, true, ["sign"])
+	};
+}
+/**
+* A new self-signed certificate for the SAME key pair as `keyPem` (same
+* subject, so leaves already issued still verify): completes a CA creation that
+* died between its key write and its certificate write.
+*/
+async function rebuildDeviceCaCertificate(keyPem) {
+	const privateKey = await webcrypto.subtle.importKey("pkcs8", PemConverter.decodeFirst(keyPem), KEY_ALGORITHM, true, ["sign"]);
+	const jwk = await webcrypto.subtle.exportKey("jwk", privateKey);
+	const publicKey = await webcrypto.subtle.importKey("jwk", {
+		kty: jwk.kty,
+		crv: jwk.crv,
+		x: jwk.x,
+		y: jwk.y
+	}, KEY_ALGORITHM, true, ["verify"]);
+	const now = /* @__PURE__ */ new Date();
+	const cert = await X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial(),
+		name: `CN=${DEVICE_CA_COMMON_NAME}`,
+		notBefore: now,
+		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
+		keys: {
+			privateKey,
+			publicKey
+		},
+		signingAlgorithm: SIGNING_ALGORITHM,
+		extensions: [
+			new BasicConstraintsExtension(true, 0, true),
+			new KeyUsagesExtension(KeyUsageFlags.keyCertSign | KeyUsageFlags.cRLSign, true),
+			await SubjectKeyIdentifierExtension.create(publicKey)
+		]
+	});
+	return {
+		certPem: certPemOf(cert),
+		keyPem,
+		cert,
+		privateKey
+	};
+}
+/** Import (and thereby validate) a device public key: SPKI DER, ECDSA P-256. */
+async function importDevicePublicKey(spki) {
+	return webcrypto.subtle.importKey("spki", spki, KEY_ALGORITHM, true, ["verify"]);
+}
+/**
+* Sign a device leaf: CN = credential id; SAN URIs `camstack:credential:<id>`
+* and `camstack:user:<userId>`; EKU clientAuth; 365 days by default.
+*/
+async function issueDeviceLeaf(ca, input) {
+	const publicKey = await importDevicePublicKey(input.publicKeySpki);
+	const notBefore = input.now ?? /* @__PURE__ */ new Date();
+	const notAfter = new Date(notBefore.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
+	const serialNumber = freshSerial();
+	const extensions = [
+		new BasicConstraintsExtension(false, void 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.digitalSignature, true),
+		new ExtendedKeyUsageExtension([CLIENT_AUTH_OID]),
+		new SubjectAlternativeNameExtension([{
+			type: "url",
+			value: `${DEVICE_SAN_CREDENTIAL_PREFIX}${input.credentialId}`
+		}, {
+			type: "url",
+			value: `${DEVICE_SAN_USER_PREFIX}${input.userId}`
+		}]),
+		await SubjectKeyIdentifierExtension.create(publicKey),
+		await AuthorityKeyIdentifierExtension.create(ca.cert)
+	];
+	const pem = certPemOf(await X509CertificateGenerator.create({
+		serialNumber,
+		subject: `CN=${input.credentialId}`,
+		issuer: ca.cert.subject,
+		notBefore,
+		notAfter,
+		publicKey,
+		signingKey: ca.privateKey,
+		signingAlgorithm: SIGNING_ALGORITHM,
+		extensions
+	}));
+	return {
+		certPem: pem,
+		serialNumber,
+		notBefore,
+		notAfter,
+		fingerprint: new X509Certificate(pem).fingerprint256
+	};
+}
+function sanValues(cert) {
+	const san = cert.getExtension(SubjectAlternativeNameExtension);
+	if (san === null) return [];
+	return san.names.items.filter((n) => n.type === "url").map((n) => n.value);
+}
+/** Chain (signature by the device CA), validity window, EKU and identity of a presented leaf. */
+async function verifyDeviceLeaf(caCertPem, leafPem, now = /* @__PURE__ */ new Date()) {
+	let leaf;
+	let ca;
+	try {
+		leaf = new X509Certificate$1(leafPem);
+		ca = new X509Certificate$1(caCertPem);
+	} catch {
+		return {
+			ok: false,
+			reason: "malformed-certificate"
+		};
+	}
+	if (!await leaf.verify({
+		publicKey: ca,
+		signatureOnly: true
+	}, webcrypto) || leaf.issuer !== ca.subject) return {
+		ok: false,
+		reason: "not-issued-by-device-ca"
+	};
+	if (now < leaf.notBefore) return {
+		ok: false,
+		reason: "not-yet-valid"
+	};
+	if (now > leaf.notAfter) return {
+		ok: false,
+		reason: "expired"
+	};
+	const eku = leaf.getExtension(ExtendedKeyUsageExtension);
+	if (eku === null || !eku.usages.includes(CLIENT_AUTH_OID)) return {
+		ok: false,
+		reason: "missing-client-auth"
+	};
+	const sans = sanValues(leaf);
+	const credentialId = sans.find((v) => v.startsWith(DEVICE_SAN_CREDENTIAL_PREFIX))?.slice(DEVICE_SAN_CREDENTIAL_PREFIX.length);
+	if (credentialId === void 0 || credentialId === "") return {
+		ok: false,
+		reason: "missing-credential-san"
+	};
+	return {
+		ok: true,
+		credentialId,
+		userId: sans.find((v) => v.startsWith("camstack:user:"))?.slice(14) ?? null,
+		publicKeySpki: Buffer.from(leaf.publicKey.rawData),
+		serialNumber: leaf.serialNumber,
+		fingerprint: new X509Certificate(leafPem).fingerprint256,
+		notAfter: leaf.notAfter
+	};
+}
+/**
+* ECDSA P-256 / SHA-256 over `message`. Accepts the raw `r||s` form WebCrypto
+* and Android emit (64 bytes) and the DER form the Secure Enclave emits.
+*/
+function verifyDeviceSignature(publicKeySpki, message, signatureBase64Url) {
+	let signature;
+	try {
+		signature = Buffer.from(signatureBase64Url, "base64url");
+	} catch {
+		return false;
+	}
+	if (signature.length === 0) return false;
+	try {
+		const key = createPublicKey({
+			key: Buffer.from(publicKeySpki),
+			format: "der",
+			type: "spki"
+		});
+		const dsaEncoding = signature.length === 64 ? "ieee-p1363" : "der";
+		return verify("sha256", Buffer.from(message, "utf8"), {
+			key,
+			dsaEncoding
+		}, signature);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { setProcessJwtSigningKey as _, importDevicePublicKey as a, rebuildDeviceCaCertificate as c, JWT_SIGNING_KEY_REF as d, JwtSigningKeyUnavailableError as f, processJwtSigningKey as g, loadJwtSigningKey as h, generateDeviceCa as i, verifyDeviceLeaf as l, getProcessJwtSigningKeyState as m, DEVICE_CA_KEY_REF as n, issueDeviceLeaf as o, SYSTEM_SECRET_OWNER as p, DEVICE_CA_SETTINGS_SECTION as r, loadDeviceCa as s, DEVICE_CA_FIELD as t, verifyDeviceSignature as u, staticJwtSigningKey as v };