@capgo/cli 4.3.6 → 5.0.0-alpha.7

package/src/key.ts

@@ -21,14 +21,15 @@ export async function saveKey(options: saveOptions, log = true) {
   const config = await getConfig()
   const { extConfig } = config.app
 
-  const keyPath = options.key || baseKey
+  // const keyPath = options.key || baseKey
+  const keyPath = options.key || baseKeyPub
   // check if publicKey exist
 
-  let privateKey = options.keyData || ''
+  let publicKey = options.keyData || ''
 
-  if (!existsSync(keyPath) && !privateKey) {
+  if (!existsSync(keyPath) && !publicKey) {
     if (log) {
-      p.log.error(`Cannot find public key ${keyPath} or as keyData option or in ${config.app.extConfigFilePath}`)
+      p.log.error(`Cannot find a public key at ${keyPath} or as keyData option or in ${config.app.extConfigFilePath}`)
       program.error('')
     }
     else {
@@ -38,7 +39,20 @@ export async function saveKey(options: saveOptions, log = true) {
   else if (existsSync(keyPath)) {
     // open with fs publicKey path
     const keyFile = readFileSync(keyPath)
-    privateKey = keyFile.toString()
+    publicKey = keyFile.toString()
+  }
+
+  // let's doublecheck and make sure the key we are saving is the right type based on the decryption strategy
+  if (publicKey) {
+    if (!publicKey.startsWith('-----BEGIN RSA PUBLIC KEY-----')) {
+      if (log) {
+        p.log.error(`the public key provided is not a valid RSA Public key`)
+        program.error('')
+      }
+      else {
+        return false
+      }
+    }
   }
 
   if (extConfig) {
@@ -51,12 +65,16 @@ export async function saveKey(options: saveOptions, log = true) {
     if (!extConfig.plugins.CapacitorUpdater)
       extConfig.plugins.CapacitorUpdater = {}
 
-    extConfig.plugins.CapacitorUpdater.privateKey = privateKey
+    // TODO: this might be a breaking change if user has other code looking at the specific value in the config file
+    if (extConfig.plugins.CapacitorUpdater.privateKey)
+      delete extConfig.plugins.CapacitorUpdater.privateKey
+    extConfig.plugins.CapacitorUpdater.publicKey = publicKey
+
     // console.log('extConfig', extConfig)
     writeConfig(extConfig, config.app.extConfigFilePath)
   }
   if (log) {
-    p.log.success(`private key saved into ${config.app.extConfigFilePath} file in local directory`)
+    p.log.success(`public key saved into ${config.app.extConfigFilePath} file in local directory`)
     p.log.success(`your app will decode the zip archive with this key`)
   }
   return true
@@ -98,6 +116,7 @@ export async function createKey(options: Options, log = true) {
 
   const config = await getConfig()
   const { extConfig } = config.app
+
   if (extConfig) {
     if (!extConfig.plugins) {
       extConfig.plugins = {
@@ -105,21 +124,29 @@ export async function createKey(options: Options, log = true) {
         CapacitorUpdater: {},
       }
     }
-    extConfig.plugins.CapacitorUpdater.privateKey = privateKey
+
+    if (!extConfig.plugins.CapacitorUpdater)
+      extConfig.plugins.CapacitorUpdater = {}
+
+    // TODO: this might be a breaking change if user has other code looking at the specific value in the config file
+    if (extConfig.plugins.CapacitorUpdater.privateKey)
+      delete extConfig.plugins.CapacitorUpdater.privateKey
+    extConfig.plugins.CapacitorUpdater.publicKey = publicKey
+
     // console.log('extConfig', extConfig)
     writeConfig(extConfig, config.app.extConfigFilePath)
   }
 
   if (log) {
     p.log.success('Your RSA key has been generated')
-    p.log.success(`Public key saved in ${baseKeyPub}`)
+    p.log.success(`Private key saved in ${baseKey}`)
     p.log.success('This key will be use to encrypt your bundle before sending it to Capgo')
     p.log.success('Keep it safe')
     p.log.success('Than make it unreadable by Capgo and unmodifiable by anyone')
-    p.log.success(`Private key saved in ${config.app.extConfigFilePath}`)
+    p.log.success(`Public key saved in ${config.app.extConfigFilePath}`)
     p.log.success('Your app will be the only one having it')
     p.log.success('Only your users can decrypt your update')
-    p.log.success('Only you can send them an update')
+    p.log.success('Only your key can send them an update')
     p.outro(`Done ✅`)
   }
   return true