@hivefloor/cli 0.1.3 → 0.1.5

package/dist/{chunk-DQV6FAJU.js → chunk-6MDJB3BV.js}

@@ -8,11 +8,15 @@ import {
   isRecord,
   readText,
   removeFile
-} from "./chunk-VNCQFFQO.js";
+} from "./chunk-TPMFQUAW.js";
 import {
-  cliNpxCommand,
-  runCmd
-} from "./chunk-TH4ANHSG.js";
+  normalizeHost,
+  runCmd,
+  sameOrigin
+} from "./chunk-SOXRITAW.js";
+import {
+  cliNpxCommand
+} from "./chunk-4DRHR7LR.js";
 
 // src/service/units.ts
 import os from "os";
@@ -215,8 +219,13 @@ async function uninstallService(svc, run, uid) {
 }
 
 // src/credentials.ts
+import { createHash } from "crypto";
 import fs from "fs";
-var SERVICE = "hivefloor";
+var KEYCHAIN_SERVICE = "hivefloor";
+var TOKEN_FP_HEX = 16;
+function tokenFingerprint(token) {
+  return createHash("sha256").update(token, "utf8").digest("hex").slice(0, TOKEN_FP_HEX);
+}
 var realKeyring = async () => {
   if (process.env.HIVEFLOOR_KEYRING === "0") return void 0;
   try {
@@ -227,6 +236,19 @@ var realKeyring = async () => {
 };
 var loadKeyring = realKeyring;
 var account = (host, tool) => `${host}#${tool}`;
+function canonicalHost(host) {
+  try {
+    return normalizeHost(host);
+  } catch {
+    return void 0;
+  }
+}
+function hostKey(creds, host) {
+  const want = canonicalHost(host);
+  if (want === void 0) return creds.hosts[host] ? host : void 0;
+  if (creds.hosts[want]) return want;
+  return Object.keys(creds.hosts).find((k) => k === want || sameOrigin(k, want));
+}
 function readCredentials() {
   const text = readText(credentialsFile());
   const empty = { version: 1, hosts: {} };
@@ -256,33 +278,53 @@ function writeCredentials(c) {
   }
   atomicWrite(file, JSON.stringify(c, null, 2) + "\n", 384);
 }
+var windowsAclError = () => new Error("could not restrict the Hivefloor config to your Windows user with icacls; the token was not kept");
 async function secureWindowsCredentials(run, username) {
   if (!username) throw new Error("could not determine the Windows user; the token was not kept");
   const dir = prepareConfigDir();
   const d = await run("icacls", [dir, "/inheritance:r", "/grant:r", `${username}:(OI)(CI)F`]);
-  if (d.code !== 0) throw new Error("could not restrict the Hivefloor config to your Windows user with icacls; the token was not kept");
+  if (d.code !== 0) throw windowsAclError();
+}
+async function secureWindowsCredentialsFile(run, username) {
+  const f = await run("icacls", [credentialsFile(), "/inheritance:r", "/grant:r", `${username}:F`]);
+  if (f.code !== 0) throw windowsAclError();
 }
 async function saveToken(host, tool, token, meta = {}, opts = {}) {
   const creds = readCredentials();
-  const h = creds.hosts[host] ??= { tools: {} };
+  const key = hostKey(creds, host) ?? canonicalHost(host) ?? host;
+  const h = creds.hosts[key] ??= { tools: {} };
   let storage = "file";
   const kr = await loadKeyring();
   if (kr) {
     try {
-      const entry = new kr.Entry(SERVICE, account(host, tool));
+      const entry = new kr.Entry(KEYCHAIN_SERVICE, account(key, tool));
       entry.setPassword(token);
       if (entry.getPassword() === token) storage = "keychain";
     } catch {
       storage = "file";
     }
   }
-  if (storage === "file" && (opts.platform ?? process.platform) === "win32") {
-    await secureWindowsCredentials(opts.run ?? runCmd, opts.username ?? windowsUser(process.env));
+  const winFile = storage === "file" && (opts.platform ?? process.platform) === "win32";
+  const run = opts.run ?? runCmd;
+  const username = opts.username ?? windowsUser(process.env);
+  if (winFile) {
+    await secureWindowsCredentials(run, username);
   }
+  const previous = winFile ? readText(credentialsFile()) : void 0;
   h.tools[tool] = { ...storage === "keychain" ? { keychain: true } : { token }, ...meta, saved_at: (/* @__PURE__ */ new Date()).toISOString() };
   h.last_tool = tool;
-  creds.default_host = host;
+  h.token_fp = tokenFingerprint(token);
+  creds.default_host = key;
   writeCredentials(creds);
+  if (winFile) {
+    try {
+      await secureWindowsCredentialsFile(run, username);
+    } catch (e) {
+      if (previous === void 0) fs.rmSync(credentialsFile(), { force: true });
+      else atomicWrite(credentialsFile(), previous, 384);
+      throw e;
+    }
+  }
   return storage;
 }
 function pickTool(h, tool) {
@@ -291,8 +333,10 @@ function pickTool(h, tool) {
   return Object.keys(h.tools)[0];
 }
 async function loadToken(host, tool) {
-  const h = readCredentials().hosts[host];
-  if (!h) return void 0;
+  const creds = readCredentials();
+  const key = hostKey(creds, host);
+  const h = key ? creds.hosts[key] : void 0;
+  if (!key || !h) return void 0;
   const t = pickTool(h, tool);
   const c = t ? h.tools[t] : void 0;
   if (!t || !c) return void 0;
@@ -301,7 +345,7 @@ async function loadToken(host, tool) {
     const kr = await loadKeyring();
     if (!kr) return void 0;
     try {
-      const v = new kr.Entry(SERVICE, account(host, t)).getPassword();
+      const v = new kr.Entry(KEYCHAIN_SERVICE, account(key, t)).getPassword();
       if (v) return { token: v, tool: t };
     } catch {
     }
@@ -312,34 +356,57 @@ function defaultHost() {
   const c = readCredentials();
   return c.default_host && c.hosts[c.default_host] ? c.default_host : Object.keys(c.hosts)[0];
 }
+function deletedKeychainEntry(kr, host, tool) {
+  try {
+    const e = new kr.Entry(KEYCHAIN_SERVICE, account(host, tool));
+    let dropped;
+    if (e.deletePassword) dropped = e.deletePassword();
+    else if (e.deleteCredential) dropped = e.deleteCredential();
+    else return false;
+    if (dropped !== false) return true;
+    try {
+      const still = e.getPassword();
+      return still === null || still === void 0;
+    } catch {
+      return false;
+    }
+  } catch {
+    return false;
+  }
+}
 async function deleteCredentials(host, tool) {
   const creds = readCredentials();
   const kr = await loadKeyring();
-  let n = 0;
+  let removed = 0;
+  const leftover = [];
   for (const [h, hc] of Object.entries(creds.hosts)) {
-    if (host && h !== host) continue;
+    if (host && h !== host && !sameOrigin(h, host)) continue;
+    let removedHere = 0;
     for (const [t, c] of Object.entries(hc.tools)) {
       if (tool && t !== tool) continue;
-      if (c.keychain && kr) {
-        try {
-          const e = new kr.Entry(SERVICE, account(h, t));
-          if (e.deletePassword) e.deletePassword();
-          else e.deleteCredential?.();
-        } catch {
-        }
+      if (c.keychain && !(kr && deletedKeychainEntry(kr, h, t))) {
+        leftover.push(account(h, t));
+        continue;
       }
       delete hc.tools[t];
-      n += 1;
+      removed += 1;
+      removedHere += 1;
     }
+    if (removedHere === 0) continue;
     if (hc.last_tool && !hc.tools[hc.last_tool]) hc.last_tool = Object.keys(hc.tools)[0];
     if (Object.keys(hc.tools).length === 0) delete creds.hosts[h];
+    else {
+      const last = hc.last_tool ? hc.tools[hc.last_tool] : void 0;
+      if (last?.token) hc.token_fp = tokenFingerprint(last.token);
+      else delete hc.token_fp;
+    }
   }
   if (creds.default_host && !creds.hosts[creds.default_host]) creds.default_host = Object.keys(creds.hosts)[0];
-  if (n > 0) {
+  if (removed > 0) {
     if (Object.keys(creds.hosts).length === 0) fs.rmSync(credentialsFile(), { force: true });
     else writeCredentials(creds);
   }
-  return n;
+  return { removed, leftover };
 }
 
 export {
@@ -348,6 +415,10 @@ export {
   installService,
   windowsServiceStatus,
   uninstallService,
+  KEYCHAIN_SERVICE,
+  TOKEN_FP_HEX,
+  tokenFingerprint,
+  hostKey,
   readCredentials,
   saveToken,
   loadToken,