@herodevs/cli 2.0.0-beta.17 → 2.0.0-beta.18

package/README.md

@@ -38,6 +38,18 @@ npx @herodevs/cli@beta
 npm install -g @herodevs/cli@beta
 ```
 
+#### Binary Installation
+
+HeroDevs CLI is available as a binary installation, without requiring `npm`. To do that, you may either download and run the script manually, or use the following cURL or Wget command:
+
+```sh
+curl -o- https://raw.githubusercontent.com/herodevs/cli/v2.0.0-beta.18/scripts/install.sh | bash
+```
+
+```sh
+wget -qO- https://raw.githubusercontent.com/herodevs/cli/v2.0.0-beta.18/scripts/install.sh | bash
+```
+
 ## Scanning Behavior
 
 The CLI is designed to be non-invasive:

package/dist/service/auth-config.svc.d.ts

@@ -1,5 +1,2 @@
 export declare function getRealmUrl(): string;
 export declare function getClientId(): string;
-export declare function getTokenServiceName(): string;
-export declare function getAccessTokenKey(): string;
-export declare function getRefreshTokenKey(): string;

package/dist/service/auth-config.svc.js

@@ -1,20 +1,8 @@
 const DEFAULT_REALM_URL = 'https://idp.prod.apps.herodevs.io/realms/universe/protocol/openid-connect';
 const DEFAULT_CLIENT_ID = 'eol-ds';
-const DEFAULT_SERVICE_NAME = '@herodevs/cli';
-const DEFAULT_ACCESS_KEY = 'access-token';
-const DEFAULT_REFRESH_KEY = 'refresh-token';
 export function getRealmUrl() {
     return process.env.OAUTH_CONNECT_URL || DEFAULT_REALM_URL;
 }
 export function getClientId() {
     return process.env.OAUTH_CLIENT_ID || DEFAULT_CLIENT_ID;
 }
-export function getTokenServiceName() {
-    return process.env.HD_AUTH_SERVICE_NAME || DEFAULT_SERVICE_NAME;
-}
-export function getAccessTokenKey() {
-    return process.env.HD_AUTH_ACCESS_KEY || DEFAULT_ACCESS_KEY;
-}
-export function getRefreshTokenKey() {
-    return process.env.HD_AUTH_REFRESH_KEY || DEFAULT_REFRESH_KEY;
-}

package/dist/service/auth-token.svc.d.ts

@@ -5,7 +5,7 @@ export interface StoredTokens {
 export declare function saveTokens(tokens: {
     accessToken: string;
     refreshToken?: string;
-}): Promise<[void, unknown]>;
+}): Promise<void>;
 export declare function getStoredTokens(): Promise<StoredTokens | undefined>;
-export declare function clearStoredTokens(): Promise<[unknown, unknown]>;
+export declare function clearStoredTokens(): Promise<void>;
 export declare function isAccessTokenExpired(token: string | undefined): boolean;

package/dist/service/auth-token.svc.js

@@ -1,42 +1,56 @@
-import { AsyncEntry } from '@napi-rs/keyring';
-import { getAccessTokenKey, getRefreshTokenKey, getTokenServiceName } from "./auth-config.svc.js";
+import { createConfStore, decryptValue, encryptValue } from "./encrypted-store.svc.js";
 import { decodeJwtPayload } from "./jwt.svc.js";
+import { debugLogger } from "./log.svc.js";
+const AUTH_TOKEN_SALT = 'hdcli-auth-token-v1';
+const ACCESS_TOKEN_KEY = 'accessToken';
+const REFRESH_TOKEN_KEY = 'refreshToken';
 const TOKEN_SKEW_SECONDS = 30;
+function getStore() {
+    return createConfStore('auth-token');
+}
 export async function saveTokens(tokens) {
-    const service = getTokenServiceName();
-    const accessKey = getAccessTokenKey();
-    const refreshKey = getRefreshTokenKey();
-    const accessTokenSet = new AsyncEntry(service, accessKey).setPassword(tokens.accessToken);
-    const refreshTokenSet = tokens.refreshToken
-        ? new AsyncEntry(service, refreshKey).setPassword(tokens.refreshToken)
-        : new AsyncEntry(service, refreshKey).deletePassword();
-    return Promise.all([accessTokenSet, refreshTokenSet]);
+    const store = getStore();
+    store.set(ACCESS_TOKEN_KEY, encryptValue(tokens.accessToken, AUTH_TOKEN_SALT));
+    if (tokens.refreshToken) {
+        store.set(REFRESH_TOKEN_KEY, encryptValue(tokens.refreshToken, AUTH_TOKEN_SALT));
+    }
+    else {
+        store.delete(REFRESH_TOKEN_KEY);
+    }
 }
 export async function getStoredTokens() {
-    const service = getTokenServiceName();
-    const accessKey = getAccessTokenKey();
-    const refreshKey = getRefreshTokenKey();
-    return Promise.all([
-        new AsyncEntry(service, accessKey).getPassword(),
-        new AsyncEntry(service, refreshKey).getPassword(),
-    ]).then(([accessToken, refreshToken]) => {
-        if (!accessToken && !refreshToken) {
-            return;
+    const store = getStore();
+    const encodedAccess = store.get(ACCESS_TOKEN_KEY);
+    const encodedRefresh = store.get(REFRESH_TOKEN_KEY);
+    let accessToken;
+    let refreshToken;
+    try {
+        if (encodedAccess && typeof encodedAccess === 'string') {
+            accessToken = decryptValue(encodedAccess, AUTH_TOKEN_SALT);
         }
-        return {
-            accessToken,
-            refreshToken,
-        };
-    });
+    }
+    catch (error) {
+        debugLogger('Failed to decrypt access token: %O', error);
+        accessToken = undefined;
+    }
+    try {
+        if (encodedRefresh && typeof encodedRefresh === 'string') {
+            refreshToken = decryptValue(encodedRefresh, AUTH_TOKEN_SALT);
+        }
+    }
+    catch (error) {
+        debugLogger('Failed to decrypt refresh token: %O', error);
+        refreshToken = undefined;
+    }
+    if (!accessToken && !refreshToken) {
+        return;
+    }
+    return { accessToken, refreshToken };
 }
 export async function clearStoredTokens() {
-    const service = getTokenServiceName();
-    const accessKey = getAccessTokenKey();
-    const refreshKey = getRefreshTokenKey();
-    return Promise.all([
-        new AsyncEntry(service, accessKey).deletePassword(),
-        new AsyncEntry(service, refreshKey).deletePassword(),
-    ]);
+    const store = getStore();
+    store.delete(ACCESS_TOKEN_KEY);
+    store.delete(REFRESH_TOKEN_KEY);
 }
 export function isAccessTokenExpired(token) {
     const payload = decodeJwtPayload(token);

package/dist/service/ci-token.svc.js

@@ -1,48 +1,16 @@
-import crypto from 'node:crypto';
-import os from 'node:os';
-import path from 'node:path';
-import Conf from 'conf';
 import { config } from "../config/constants.js";
+import { createConfStore, decryptValue, encryptValue } from "./encrypted-store.svc.js";
+import { debugLogger } from "./log.svc.js";
 const CI_TOKEN_STORAGE_KEY = 'ciRefreshToken';
-const ENCRYPTION_SALT = 'hdcli-ci-token-v1';
-const ALGORITHM = 'aes-256-gcm';
-const IV_LENGTH = 12;
-const AUTH_TAG_LENGTH = 16;
+const CI_TOKEN_SALT = 'hdcli-ci-token-v1';
 function getConfStore() {
-    const cwd = path.join(os.homedir(), '.hdcli');
-    return new Conf({
-        projectName: 'hdcli',
-        cwd,
-        configName: 'ci-token',
-    });
-}
-function getMachineKey() {
-    const hostname = os.hostname();
-    const username = os.userInfo().username;
-    const raw = `${hostname}:${username}:${ENCRYPTION_SALT}`;
-    return crypto.createHash('sha256').update(raw, 'utf8').digest();
+    return createConfStore('ci-token');
 }
 export function encryptToken(plaintext) {
-    const key = getMachineKey();
-    const iv = crypto.randomBytes(IV_LENGTH);
-    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
-    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-    const authTag = cipher.getAuthTag();
-    const combined = Buffer.concat([iv, authTag, encrypted]);
-    return combined.toString('base64url');
+    return encryptValue(plaintext, CI_TOKEN_SALT);
 }
 export function decryptToken(encoded) {
-    const key = getMachineKey();
-    const combined = Buffer.from(encoded, 'base64url');
-    if (combined.length < IV_LENGTH + AUTH_TAG_LENGTH) {
-        throw new Error('Invalid encrypted token format');
-    }
-    const iv = combined.subarray(0, IV_LENGTH);
-    const authTag = combined.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
-    const ciphertext = combined.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
-    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
-    decipher.setAuthTag(authTag);
-    return decipher.update(ciphertext).toString('utf8') + decipher.final('utf8');
+    return decryptValue(encoded, CI_TOKEN_SALT);
 }
 export function getCITokenFromStorage() {
     const store = getConfStore();
@@ -53,7 +21,8 @@ export function getCITokenFromStorage() {
     try {
         return decryptToken(encoded);
     }
-    catch {
+    catch (error) {
+        debugLogger('Failed to decrypt CI token: %O', error);
         return undefined;
     }
 }

package/dist/service/encrypted-store.svc.d.ts

@@ -0,0 +1,5 @@
+import Conf from 'conf';
+export declare function getMachineKey(salt: string): Buffer;
+export declare function encryptValue(plaintext: string, salt: string): string;
+export declare function decryptValue(encoded: string, salt: string): string;
+export declare function createConfStore(configName: string): Conf<Record<string, unknown>>;

package/dist/service/encrypted-store.svc.js

@@ -0,0 +1,43 @@
+import crypto from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import Conf from 'conf';
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+export function getMachineKey(salt) {
+    const hostname = os.hostname();
+    const username = os.userInfo().username;
+    const raw = `${hostname}:${username}:${salt}`;
+    return crypto.createHash('sha256').update(raw, 'utf8').digest();
+}
+export function encryptValue(plaintext, salt) {
+    const key = getMachineKey(salt);
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    const combined = Buffer.concat([iv, authTag, encrypted]);
+    return combined.toString('base64url');
+}
+export function decryptValue(encoded, salt) {
+    const key = getMachineKey(salt);
+    const combined = Buffer.from(encoded, 'base64url');
+    if (combined.length < IV_LENGTH + AUTH_TAG_LENGTH) {
+        throw new Error('Invalid encrypted token format');
+    }
+    const iv = combined.subarray(0, IV_LENGTH);
+    const authTag = combined.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+    const ciphertext = combined.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    return decipher.update(ciphertext).toString('utf8') + decipher.final('utf8');
+}
+export function createConfStore(configName) {
+    const cwd = path.join(os.homedir(), '.hdcli');
+    return new Conf({
+        projectName: 'hdcli',
+        cwd,
+        configName,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herodevs/cli",
-  "version": "2.0.0-beta.17",
+  "version": "2.0.0-beta.18",
   "author": "HeroDevs, Inc",
   "bin": {
     "hd": "./bin/run.js"
@@ -47,7 +47,6 @@
     "@cyclonedx/cdxgen": "^12.1.1",
     "@herodevs/eol-shared": "github:herodevs/eol-shared#v0.1.18",
     "@inquirer/prompts": "^8.0.2",
-    "@napi-rs/keyring": "^1.2.0",
     "@oclif/core": "^4.8.0",
     "@oclif/plugin-help": "^6.2.32",
     "@oclif/plugin-update": "^4.7.16",