@cuytamvan/cuypwm 1.0.0

package/src/command-pages/viewCredential.ts

@@ -0,0 +1,345 @@
+import * as p from '@clack/prompts';
+import chalk from 'chalk';
+import { readFileSync, existsSync } from 'node:fs';
+import {
+  readPublicKey,
+  readPrivateKeyPem,
+  getPrivateKeyPassphraseIfNeeded,
+} from '../keys';
+import { encryptData, decryptData } from '../crypto';
+import { deleteEntry, updateEntry, loadUsers } from '../store';
+import { entryLabel, detailBox, dangerBox } from '../ui';
+import {
+  checkCancel,
+  resolvePath,
+  passwordOrGenerate,
+  pickFilteredEntries,
+} from '../utils';
+import type { PasswordEntry } from '../types';
+
+export async function viewCredentialFlow() {
+  const { entries, total } = await pickFilteredEntries();
+
+  if (!total) {
+    p.log.warn(chalk.yellow('No credentials saved yet.'));
+    return;
+  }
+
+  if (!entries.length) {
+    p.log.warn(chalk.yellow('No credentials found for this user.'));
+    return;
+  }
+
+  const selected = checkCancel(
+    await p.select({
+      message: 'Select a credential',
+      options: entries.map((e) => ({ value: e.id, label: entryLabel(e) })),
+    }),
+  );
+
+  const entry = entries.find((e) => e.id === selected)!;
+
+  const subAction = checkCancel(
+    await p.select({
+      message: `Actions for '${chalk.bold(entry.source)}'`,
+      options: [
+        { value: 'view', label: `${chalk.cyan('👁 ')}  View Detail` },
+        { value: 'edit', label: `${chalk.yellow('✏️ ')}  Edit Credential` },
+        { value: 'delete', label: `${chalk.red('🗑 ')}  Delete Credential` },
+      ],
+    }),
+  );
+
+  if (subAction === 'view') {
+    await showEntryDetail(entry);
+  } else if (subAction === 'edit') {
+    await editEntryFlow(entry);
+  } else if (subAction === 'delete') {
+    await confirmAndDeleteEntry(entry);
+  }
+}
+
+export async function showEntryDetail(entry: PasswordEntry) {
+  const privateKeyPem = readPrivateKeyPem();
+  const passphrase = await getPrivateKeyPassphraseIfNeeded();
+
+  const s = p.spinner();
+  s.start('🔐 Decrypting data...');
+
+  try {
+    let body = `${chalk.dim('Description')} : ${entry.description || '-'}\n`;
+
+    if (entry.type === 'ssh_key') {
+      const decryptedPrivate = decryptData(
+        privateKeyPem,
+        passphrase,
+        entry.encrypted_private_key,
+      );
+      body += `\n${chalk.bold.cyan('Public Key')}\n${chalk.gray(entry.public_key.trim())}\n`;
+      body += `\n${chalk.bold.cyan('Private Key')}\n${chalk.magentaBright(decryptedPrivate.trim())}\n`;
+    } else if (entry.type === 'ssh_cred') {
+      const decryptedPassword = decryptData(
+        privateKeyPem,
+        passphrase,
+        entry.encrypted_password,
+      );
+      body += `${chalk.dim('Host')}     : ${chalk.whiteBright(entry.host)}\n`;
+      body += `${chalk.dim('Port')}     : ${chalk.whiteBright(String(entry.port))}\n`;
+      body += `${chalk.dim('Username')} : ${chalk.whiteBright(entry.username)}\n`;
+      body += `${chalk.dim('Password')} : ${chalk.magentaBright.bold(decryptedPassword)}\n`;
+    } else {
+      const decryptedPassword = decryptData(
+        privateKeyPem,
+        passphrase,
+        entry.encrypted_password,
+      );
+      body += `${chalk.dim('Username')} : ${chalk.whiteBright(entry.username)}\n`;
+      body += `${chalk.dim('Password')} : ${chalk.magentaBright.bold(decryptedPassword)}\n`;
+      if (entry.extra) {
+        for (const [k, v] of Object.entries(entry.extra)) {
+          body += `${chalk.dim(k)} : ${chalk.whiteBright(v)}\n`;
+        }
+      }
+    }
+
+    s.stop(chalk.green('✔ Decrypted successfully.'));
+    console.log(detailBox(entry, body.trim()));
+  } catch (err) {
+    s.stop(chalk.red('✖ Decryption failed.'));
+    throw new Error(
+      'Failed to decrypt data. Make sure the private key passphrase is correct. Detail: ' +
+        String(err),
+    );
+  }
+}
+
+export async function confirmAndDeleteEntry(entry: PasswordEntry) {
+  console.log(
+    dangerBox(
+      '⚠️  Confirm Delete',
+      `${entryLabel(entry)}\n${chalk.dim('This action cannot be undone.')}`,
+    ),
+  );
+
+  const confirmed = checkCancel(
+    await p.confirm({
+      message: `Are you sure you want to delete '${entry.source}'?`,
+      initialValue: false,
+    }),
+  );
+
+  if (!confirmed) {
+    p.log.info(chalk.dim('Cancelled.'));
+    return;
+  }
+
+  deleteEntry(entry.id);
+  p.log.success(
+    chalk.green(
+      `✔ Credential '${chalk.bold(entry.source)}' deleted successfully.`,
+    ),
+  );
+}
+
+export async function editEntryFlow(entry: PasswordEntry) {
+  const publicKey = readPublicKey();
+
+  const users = loadUsers();
+  let cred_user_id = entry.cred_user_id;
+  if (users.length) {
+    const userChoice = checkCancel(
+      await p.select({
+        message: 'Linked user',
+        options: [
+          { value: '__none__', label: chalk.dim('— No User —') },
+          ...users.map((u) => ({ value: u.id, label: u.name })),
+        ],
+      }),
+    ) as string;
+    cred_user_id = userChoice === '__none__' ? null : userChoice;
+  }
+
+  if (entry.type === 'ssh_key') {
+    const source = checkCancel(
+      await p.text({
+        message: 'Name / label (source)',
+        initialValue: entry.source,
+      }),
+    );
+    const description = checkCancel(
+      await p.text({
+        message: 'Description (optional)',
+        initialValue: entry.description,
+        defaultValue: '',
+      }),
+    );
+
+    const changeKey = checkCancel(
+      await p.confirm({ message: 'Replace key file?', initialValue: false }),
+    );
+
+    let encrypted_private_key = entry.encrypted_private_key;
+    let public_key = entry.public_key;
+
+    if (changeKey) {
+      const privateKeyPath = checkCancel(
+        await p.text({
+          message: 'New private key file path',
+          placeholder: '~/.ssh/id_rsa',
+          validate(v) {
+            if (!v) return 'Required';
+            if (!existsSync(resolvePath(v))) return 'File not found';
+          },
+        }),
+      );
+      const publicKeyPath = checkCancel(
+        await p.text({
+          message: 'New public key file path',
+          placeholder: '~/.ssh/id_rsa.pub',
+          validate(v) {
+            if (!v) return 'Required';
+            if (!existsSync(resolvePath(v))) return 'File not found';
+          },
+        }),
+      );
+      encrypted_private_key = encryptData(
+        publicKey,
+        readFileSync(resolvePath(privateKeyPath), 'utf8'),
+      );
+      public_key = readFileSync(resolvePath(publicKeyPath), 'utf8');
+    }
+
+    updateEntry({
+      ...entry,
+      source,
+      description: description || '',
+      cred_user_id,
+      encrypted_private_key,
+      public_key,
+    });
+    p.log.success(
+      chalk.green(`✔ SSH Key '${chalk.bold(source)}' updated successfully.`),
+    );
+    return;
+  }
+
+  if (entry.type === 'ssh_cred') {
+    const source = checkCancel(
+      await p.text({
+        message: 'Name / label (source)',
+        initialValue: entry.source,
+      }),
+    );
+    const host = checkCancel(
+      await p.text({ message: 'Host', initialValue: entry.host }),
+    );
+    const portInput = checkCancel(
+      await p.text({
+        message: 'Port',
+        initialValue: String(entry.port),
+        validate(v) {
+          if (v && Number.isNaN(Number(v))) return 'Port must be a number';
+        },
+      }),
+    );
+    const username = checkCancel(
+      await p.text({ message: 'Username', initialValue: entry.username }),
+    );
+    const description = checkCancel(
+      await p.text({
+        message: 'Description (optional)',
+        initialValue: entry.description,
+        defaultValue: '',
+      }),
+    );
+
+    const changePassword = checkCancel(
+      await p.confirm({ message: 'Change password?', initialValue: false }),
+    );
+    let encrypted_password = entry.encrypted_password;
+    if (changePassword) {
+      encrypted_password = encryptData(publicKey, await passwordOrGenerate());
+    }
+
+    updateEntry({
+      ...entry,
+      source,
+      host,
+      port: Number(portInput || entry.port),
+      username,
+      description: description || '',
+      cred_user_id,
+      encrypted_password,
+    });
+    p.log.success(
+      chalk.green(
+        `✔ SSH Credential '${chalk.bold(source)}' updated successfully.`,
+      ),
+    );
+    return;
+  }
+
+  // github, gitlab, gmail, bank, website
+  const source = checkCancel(
+    await p.text({ message: 'Source / Name', initialValue: entry.source }),
+  );
+  const username = checkCancel(
+    await p.text({
+      message: 'Username / Email / Account number',
+      initialValue: entry.username,
+    }),
+  );
+  const description = checkCancel(
+    await p.text({
+      message: 'Description (optional)',
+      initialValue: entry.description,
+      defaultValue: '',
+    }),
+  );
+
+  const changePassword = checkCancel(
+    await p.confirm({ message: 'Change password?', initialValue: false }),
+  );
+  let encrypted_password = entry.encrypted_password;
+  if (changePassword) {
+    encrypted_password = encryptData(publicKey, await passwordOrGenerate());
+  }
+
+  let extra = entry.extra;
+
+  if (entry.type === 'bank') {
+    const accountNumber = checkCancel(
+      await p.text({
+        message: 'Account number (optional)',
+        initialValue: entry.extra?.account_number || '',
+        defaultValue: '',
+      }),
+    );
+    if (accountNumber)
+      extra = { ...(extra || {}), account_number: accountNumber };
+  }
+
+  if (entry.type === 'website') {
+    const url = checkCancel(
+      await p.text({
+        message: 'Website URL (optional)',
+        initialValue: entry.extra?.url || '',
+        defaultValue: '',
+      }),
+    );
+    if (url) extra = { ...(extra || {}), url };
+  }
+
+  updateEntry({
+    ...entry,
+    source,
+    username,
+    description: description || '',
+    cred_user_id,
+    encrypted_password,
+    extra,
+  });
+  p.log.success(
+    chalk.green(`✔ Credential '${chalk.bold(source)}' updated successfully.`),
+  );
+}

package/src/config.ts

@@ -0,0 +1,15 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { existsSync, mkdirSync } from 'node:fs';
+
+export const APP_DIR = join(homedir(), '.cuy-pwm');
+export const KEYS_DIR = join(APP_DIR, 'keys');
+export const PRIVATE_KEY_PATH = join(KEYS_DIR, 'private.pem');
+export const PUBLIC_KEY_PATH = join(KEYS_DIR, 'public.pem');
+export const SOURCE_FILE = join(homedir(), 'cuypwm.db.json');
+export const CONFIG_FILE = join(APP_DIR, 'config.json');
+
+export function ensureAppDir() {
+  if (!existsSync(APP_DIR)) mkdirSync(APP_DIR, { recursive: true });
+  if (!existsSync(KEYS_DIR)) mkdirSync(KEYS_DIR, { recursive: true });
+}

package/src/crypto.ts

@@ -0,0 +1,79 @@
+import {
+  publicEncrypt,
+  privateDecrypt,
+  randomBytes,
+  createCipheriv,
+  createDecipheriv,
+  constants,
+} from 'node:crypto';
+
+interface EncryptedPayload {
+  k: string;
+  iv: string;
+  tag: string;
+  data: string;
+}
+
+export function encryptData(publicKeyPem: string, plaintext: string): string {
+  const aesKey = randomBytes(32);
+  const iv = randomBytes(12);
+
+  const cipher = createCipheriv('aes-256-gcm', aesKey, iv);
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, 'utf8'),
+    cipher.final(),
+  ]);
+  const tag = cipher.getAuthTag();
+
+  const encryptedKey = publicEncrypt(
+    {
+      key: publicKeyPem,
+      padding: constants.RSA_PKCS1_OAEP_PADDING,
+      oaepHash: 'sha256',
+    },
+    aesKey,
+  );
+
+  const payload: EncryptedPayload = {
+    k: encryptedKey.toString('base64'),
+    iv: iv.toString('base64'),
+    tag: tag.toString('base64'),
+    data: encrypted.toString('base64'),
+  };
+
+  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');
+}
+
+export function decryptData(
+  privateKeyPem: string,
+  passphrase: string | undefined,
+  encryptedString: string,
+): string {
+  const payload: EncryptedPayload = JSON.parse(
+    Buffer.from(encryptedString, 'base64').toString('utf8'),
+  );
+
+  const aesKey = privateDecrypt(
+    {
+      key: privateKeyPem,
+      passphrase,
+      padding: constants.RSA_PKCS1_OAEP_PADDING,
+      oaepHash: 'sha256',
+    },
+    Buffer.from(payload.k, 'base64'),
+  );
+
+  const decipher = createDecipheriv(
+    'aes-256-gcm',
+    aesKey,
+    Buffer.from(payload.iv, 'base64'),
+  );
+  decipher.setAuthTag(Buffer.from(payload.tag, 'base64'));
+
+  const decrypted = Buffer.concat([
+    decipher.update(Buffer.from(payload.data, 'base64')),
+    decipher.final(),
+  ]);
+
+  return decrypted.toString('utf8');
+}

package/src/generator.ts

@@ -0,0 +1,84 @@
+import * as p from '@clack/prompts';
+
+const CHARSETS = {
+  upper: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',
+  lower: 'abcdefghijklmnopqrstuvwxyz',
+  numeric: '0123456789',
+  symbol: '!@#$%^&*()_+-=[]{}|;:,.<>?',
+} as const;
+
+type CharsetKey = keyof typeof CHARSETS;
+
+export async function promptGeneratePassword(): Promise<string | undefined> {
+  const options = await p.multiselect({
+    message:
+      'Select character types for password (space to select, enter to continue)',
+    options: [
+      { value: 'upper', label: 'UPPERCASE (A-Z)' },
+      { value: 'lower', label: 'lowercase (a-z)' },
+      { value: 'numeric', label: 'Numeric (0-9)' },
+      { value: 'symbol', label: 'Symbol (!@#$%^&*...)' },
+    ],
+    required: true,
+  });
+
+  if (p.isCancel(options)) return undefined;
+
+  const selected = options as CharsetKey[];
+
+  if (!selected.length) {
+    p.log.error('Select at least 1 character type.');
+    return undefined;
+  }
+
+  const lengthInput = await p.text({
+    message: 'Password length',
+    placeholder: '8',
+    initialValue: '8',
+    validate(value) {
+      if (!value) return;
+      const n = Number(value);
+      if (Number.isNaN(n) || !Number.isInteger(n))
+        return 'Must be a whole number';
+      if (n < 4) return 'Minimum length is 4 characters';
+      if (n > 128) return 'Maximum length is 128 characters';
+    },
+  });
+
+  if (p.isCancel(lengthInput)) return undefined;
+
+  const length = Number(lengthInput || '8');
+
+  return generatePassword(selected, length);
+}
+
+export function generatePassword(
+  selected: CharsetKey[],
+  length: number,
+): string {
+  const pools = selected.map((s) => CHARSETS[s]);
+  const allChars = pools.join('');
+
+  const result: string[] = [];
+
+  for (const pool of pools) {
+    result.push(pool[randomInt(pool.length)]!);
+  }
+
+  while (result.length < length) {
+    result.push(allChars[randomInt(allChars.length)]!);
+  }
+
+  for (let i = result.length - 1; i > 0; i--) {
+    const j = randomInt(i + 1);
+    const current = result[i]!;
+    result[i] = result[j]!;
+    result[j] = current;
+  }
+
+  return result.slice(0, length).join('');
+}
+
+function randomInt(max: number): number {
+  return Math.floor(Math.random() * max);
+}

package/src/index.ts

@@ -0,0 +1,64 @@
+#!/usr/bin/env bun
+import * as p from '@clack/prompts';
+import chalk from 'chalk';
+import { ensureKeys } from './keys';
+import { printBanner, pressEnterHint } from './ui';
+import { checkCancel } from './utils';
+import { runCli } from './cli';
+import { addCredentialFlow } from './command-pages/addCredential';
+import { listCredentialsFlow } from './command-pages/listCredentials';
+import { viewCredentialFlow } from './command-pages/viewCredential';
+import { generatePasswordFlow } from './command-pages/generatePassword';
+import { manageUsersFlow } from './command-pages/manageUsers';
+
+async function main() {
+  const cliArgs = process.argv.slice(2);
+
+  if (cliArgs.length > 0) {
+    const handled = await runCli(cliArgs);
+    if (handled) return;
+  }
+
+  printBanner();
+  await ensureKeys();
+
+  while (true) {
+    printBanner();
+
+    const action = checkCancel(
+      await p.select({
+        message: 'What would you like to do?',
+        options: [
+          { value: 'add', label: 'Add Credential' },
+          { value: 'list', label: 'List All Credentials' },
+          { value: 'view', label: 'View Credential' },
+          { value: 'generate', label: 'Generate Password' },
+          { value: 'users', label: 'Manage Users' },
+          { value: 'exit', label: 'Exit' },
+        ],
+      }),
+    );
+
+    if (action === 'exit') {
+      p.outro(chalk.greenBright.bold('See you later 👋'));
+      break;
+    }
+
+    try {
+      if (action === 'add') await addCredentialFlow();
+      else if (action === 'list') await listCredentialsFlow();
+      else if (action === 'view') await viewCredentialFlow();
+      else if (action === 'generate') await generatePasswordFlow();
+      else if (action === 'users') await manageUsersFlow();
+    } catch (err) {
+      p.log.error(chalk.red(String(err instanceof Error ? err.message : err)));
+    }
+
+    await p.text({ message: pressEnterHint(), defaultValue: '' });
+  }
+}
+
+main().catch((err) => {
+  console.error(chalk.red(err));
+  process.exit(1);
+});