@dp-pcs/ogp 0.2.12 → 0.2.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../src/daemon/keypair.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../src/daemon/keypair.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmB,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAiDrE,wBAAgB,qBAAqB,IAAI,OAAO,CAoD/C;AAED,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAGtC"}
|
package/dist/daemon/keypair.js
CHANGED
|
@@ -1,17 +1,87 @@
|
|
|
1
1
|
import fs from 'node:fs';
|
|
2
2
|
import path from 'node:path';
|
|
3
|
+
import { execSync } from 'node:child_process';
|
|
3
4
|
import { generateKeyPair } from '../shared/signing.js';
|
|
4
5
|
import { getConfigDir, ensureConfigDir } from '../shared/config.js';
|
|
5
6
|
const KEYPAIR_FILE = path.join(getConfigDir(), 'keypair.json');
|
|
7
|
+
const KEYCHAIN_SERVICE = 'ogp-federation';
|
|
8
|
+
const KEYCHAIN_ACCOUNT = 'private-key';
|
|
9
|
+
// --- macOS Keychain helpers ---
|
|
10
|
+
function isMacOS() {
|
|
11
|
+
return process.platform === 'darwin';
|
|
12
|
+
}
|
|
13
|
+
function keychainStore(privateKey) {
|
|
14
|
+
try {
|
|
15
|
+
execSync(`security add-generic-password -U -s ${KEYCHAIN_SERVICE} -a ${KEYCHAIN_ACCOUNT} -w ${JSON.stringify(privateKey)}`, { stdio: 'pipe' });
|
|
16
|
+
}
|
|
17
|
+
catch {
|
|
18
|
+
// ignore — falls back to file
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
function keychainLoad() {
|
|
22
|
+
try {
|
|
23
|
+
const result = execSync(`security find-generic-password -s ${KEYCHAIN_SERVICE} -a ${KEYCHAIN_ACCOUNT} -w`, { stdio: 'pipe' }).toString().trim();
|
|
24
|
+
return result || null;
|
|
25
|
+
}
|
|
26
|
+
catch {
|
|
27
|
+
return null;
|
|
28
|
+
}
|
|
29
|
+
}
|
|
30
|
+
function keychainDelete() {
|
|
31
|
+
try {
|
|
32
|
+
execSync(`security delete-generic-password -s ${KEYCHAIN_SERVICE} -a ${KEYCHAIN_ACCOUNT}`, { stdio: 'pipe' });
|
|
33
|
+
}
|
|
34
|
+
catch {
|
|
35
|
+
// ignore — may not exist
|
|
36
|
+
}
|
|
37
|
+
}
|
|
38
|
+
// --- Keypair management ---
|
|
6
39
|
export function loadOrGenerateKeyPair() {
|
|
7
40
|
ensureConfigDir();
|
|
8
41
|
if (fs.existsSync(KEYPAIR_FILE)) {
|
|
9
|
-
const data = fs.readFileSync(KEYPAIR_FILE, 'utf-8');
|
|
10
|
-
|
|
42
|
+
const data = JSON.parse(fs.readFileSync(KEYPAIR_FILE, 'utf-8'));
|
|
43
|
+
// Migration: if private key is in file and we're on macOS, move it to Keychain
|
|
44
|
+
if (data.privateKey && isMacOS()) {
|
|
45
|
+
const existing = keychainLoad();
|
|
46
|
+
if (!existing) {
|
|
47
|
+
keychainStore(data.privateKey);
|
|
48
|
+
console.log('[OGP] Migrated private key to macOS Keychain');
|
|
49
|
+
}
|
|
50
|
+
// Scrub private key from file
|
|
51
|
+
const safe = { publicKey: data.publicKey };
|
|
52
|
+
fs.writeFileSync(KEYPAIR_FILE, JSON.stringify(safe, null, 2), 'utf-8');
|
|
53
|
+
}
|
|
54
|
+
// Load private key from Keychain (macOS) or file (other)
|
|
55
|
+
let privateKey;
|
|
56
|
+
if (isMacOS()) {
|
|
57
|
+
const fromKeychain = keychainLoad();
|
|
58
|
+
if (!fromKeychain) {
|
|
59
|
+
throw new Error('[OGP] Private key not found in Keychain. Run `ogp setup --reset-keypair` to regenerate.');
|
|
60
|
+
}
|
|
61
|
+
privateKey = fromKeychain;
|
|
62
|
+
}
|
|
63
|
+
else {
|
|
64
|
+
if (!data.privateKey) {
|
|
65
|
+
throw new Error('[OGP] Private key missing from keypair.json on non-macOS platform.');
|
|
66
|
+
}
|
|
67
|
+
privateKey = data.privateKey;
|
|
68
|
+
}
|
|
69
|
+
return { publicKey: data.publicKey, privateKey };
|
|
11
70
|
}
|
|
71
|
+
// Generate fresh keypair
|
|
12
72
|
const keypair = generateKeyPair();
|
|
13
|
-
|
|
14
|
-
|
|
73
|
+
if (isMacOS()) {
|
|
74
|
+
// Store private key in Keychain, public key in file only
|
|
75
|
+
keychainStore(keypair.privateKey);
|
|
76
|
+
fs.writeFileSync(KEYPAIR_FILE, JSON.stringify({ publicKey: keypair.publicKey }, null, 2), 'utf-8');
|
|
77
|
+
console.log('[OGP] Generated new Ed25519 keypair (private key stored in macOS Keychain)');
|
|
78
|
+
}
|
|
79
|
+
else {
|
|
80
|
+
// Non-macOS: store full keypair in file (restrict permissions)
|
|
81
|
+
fs.writeFileSync(KEYPAIR_FILE, JSON.stringify(keypair, null, 2), 'utf-8');
|
|
82
|
+
fs.chmodSync(KEYPAIR_FILE, 0o600);
|
|
83
|
+
console.log('[OGP] Generated new Ed25519 keypair (private key stored in keypair.json, mode 600)');
|
|
84
|
+
}
|
|
15
85
|
return keypair;
|
|
16
86
|
}
|
|
17
87
|
export function getPublicKey() {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../../src/daemon/keypair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAgB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../../src/daemon/keypair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAgB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,iCAAiC;AAEjC,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB;IACvC,IAAI,CAAC;QACH,QAAQ,CACN,uCAAuC,gBAAgB,OAAO,gBAAgB,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EACjH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CACrB,qCAAqC,gBAAgB,OAAO,gBAAgB,KAAK,EACjF,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,QAAQ,CACN,uCAAuC,gBAAgB,OAAO,gBAAgB,EAAE,EAChF,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B,MAAM,UAAU,qBAAqB;IACnC,eAAe,EAAE,CAAC;IAElB,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAEhE,+EAA+E;QAC/E,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,EAAE,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;YAC9D,CAAC;YACD,8BAA8B;YAC9B,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;QAED,yDAAyD;QACzD,IAAI,UAAkB,CAAC;QACvB,IAAI,OAAO,EAAE,EAAE,CAAC;YACd,MAAM,YAAY,GAAG,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;YAC7G,CAAC;YACD,UAAU,GAAG,YAAY,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/B,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IAED,yBAAyB;IACzB,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAElC,IAAI,OAAO,EAAE,EAAE,CAAC;QACd,yDAAyD;QACzD,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAClC,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,OAAO,OAAO,CAAC,SAAS,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,OAAO,OAAO,CAAC,UAAU,CAAC;AAC5B,CAAC"}
|
package/package.json
CHANGED