@intentic/keyring 1.344.0 → 1.346.0

package/dist/core.js

@@ -1,26 +1,43 @@
 import { serialLock } from "@intentic/base/async";
 import { KeyringSandboxKeysSchema, } from "@intentic/sandbox-contract/schemas/keyring";
 import { keyFingerprint, newSealKeyPair, seal, unseal } from "@intentic/sandbox-contract/keyring-seal";
-import { askpassMatch, parseAskpassPrompt } from "./askpass/askpass.js";
+import { NOT_SET_UP, refuse } from "./passwords/access.js";
+import { AppOps } from "./passwords/app-ops.js";
+import { Askpass } from "./askpass/answer.js";
+import { Captures, seenIn } from "./passwords/capture.js";
+import { DEFAULT_SETTINGS, entryInfoOf, healthOf, liveEntries, usedEntry, withEntry } from "./passwords/entries.js";
+import { Fills } from "./passwords/fills.js";
 import { pinOf, samePin } from "./keys.js";
-import { acceptGrant, applyPatch, hostOf, isUnlocked, MINUTE_MS, modeNeedsPerson, NonceBook, rememberedFresh, releaseTargetOf, sandboxKey, shareWith, typeTargetOf, typingDecision, wideningOf, } from "./policy.js";
+import { Needs } from "./passwords/needs.js";
+import { Phones } from "./passwords/phone.js";
+import { acceptGrant, applyPatch, hostOf, isUnlocked, MINUTE_MS, modeNeedsPerson, NonceBook, releaseTargetOf, sandboxKey, shareWith, typeTargetOf, typingDecision, wideningOf, } from "./policy.js";
 import { emptyOpenPart, helloChallenge, helloWrapOf, newVaultKey, openDocument, PENDING_INBOX_MAX, PENDING_SYNC_MAX, SCRYPT_COST, sealDocument, StoredEntrySchema, unwrapHello, unwrapPassphrase, VALUE_MAX_BYTES, wrapWithHello, wrapWithPassphrase, } from "./vault.js";
-const RELAYED_OPS = ["shares", "release", "type", "inbox", "copies", "sync-state", "sync-pair", "sync-outbox", "sync-deliver"];
+const RELAYED_OPS = ["shares", "release", "type", "inbox", "copies", "sync-state", "sync-pair", "sync-outbox", "sync-deliver", "capture", "need", "phone-pair", "phone-fill"];
+const APP_OPS = [
+    "capture-batch",
+    "undo-capture",
+    "seen",
+    "reveal",
+    "copy",
+    "history",
+    "restore",
+    "settings",
+    "set-settings",
+    "activity",
+    "fill-window",
+    "fill-value",
+    "candidates",
+    "needs",
+    "answer-need",
+];
 const RELAYED = new Set(RELAYED_OPS);
+const APP = new Set(APP_OPS);
 const isRelayed = (request) => RELAYED.has(request.op);
-const refuse = (code, refusal) => ({ ok: false, code, refusal });
+const isApp = (request) => APP.has(request.op);
 const fromConsent = (answer) => refuse(answer.code, answer.reason);
-const NOT_SET_UP = "The keyring on this computer is not set up yet: `intentic-machine keyring setup` sets it up.";
 const SETUP_UNLOCK_MINUTES = 15;
 const FOCUS_SETTLE_MS = 400;
 const SyncEntrySchema = StoredEntrySchema.omit({ shares: true, revision: true });
-const entryInfoOf = (entry) => {
-    const info = { name: entry.name, ...entry.rules, source: entry.source, shares: entry.shares, createdAt: entry.createdAt, updatedAt: entry.updatedAt };
-    if (entry.backend !== undefined) {
-        info.backend = entry.backend;
-    }
-    return info;
-};
 const syncEntryOf = (entry) => {
     const sent = { name: entry.name, rules: entry.rules, source: entry.source, createdAt: entry.createdAt, updatedAt: entry.updatedAt };
     if (entry.backend !== undefined) {
@@ -51,18 +68,42 @@ const rulesWords = (rules) => {
     const field = rules.kind === "password" && !rules.anyField ? "password fields only" : "any field";
     return `${programs}; ${field}`;
 };
-const withEntry = (doc, entry) => ({ ...doc, entries: { ...doc.entries, [entry.name]: entry } });
 export class Keyring {
     deps;
     #file;
     #keys;
     #unlocked;
     #nonces = new NonceBook();
-    #remembered = new Map();
     #lock = serialLock();
     #loaded = false;
+    #access;
+    #captures;
+    #appOps;
+    #fills;
+    #needs;
+    #phones;
+    #askpass;
     constructor(deps) {
         this.deps = deps;
+        this.#access = {
+            deps,
+            file: () => this.#file,
+            keys: async () => await this.#load(),
+            held: () => this.#held(),
+            open: async (file, request) => await this.#open(file, request),
+            commit: async (opened, pending) => await this.#commit(opened, pending),
+            writeOpen: async (open) => await this.#writeOpen(open),
+            record: async (record) => await this.#record(record),
+            valueOf: async (doc, entry) => await this.#valueOf(doc, entry),
+            fetchKeys: async (sandbox) => await this.#fetchKeys(sandbox),
+            typeInto: async (place, seen, value, asked) => await this.#typeInto(place, seen, value, asked),
+        };
+        this.#captures = new Captures(this.#access);
+        this.#appOps = new AppOps(this.#access);
+        this.#fills = new Fills(this.#access, this.#captures);
+        this.#needs = new Needs(this.#access);
+        this.#phones = new Phones(this.#access);
+        this.#askpass = new Askpass(this.#access, this.#captures);
     }
     async #load() {
         if (!this.#loaded || this.#keys === undefined) {
@@ -81,7 +122,7 @@ export class Keyring {
     #forget() {
         this.#unlocked?.key.fill(0);
         this.#unlocked = undefined;
-        this.#remembered.clear();
+        this.#askpass.forget();
         this.deps.backends.forget();
     }
     #opener(file) {
@@ -96,23 +137,42 @@ export class Keyring {
         if (held !== undefined && !request.person) {
             return { doc: held.doc, key: held.key, asked: false, how: undefined };
         }
-        const answer = await this.deps.consent.ask({ title: request.title, message: request.message, unlock: held === undefined, opener: this.#opener(file) });
+        const picked = await this.#choose(request);
+        if (!picked.ok) {
+            return picked;
+        }
+        const chosen = picked.choice;
+        const label = request.choices?.find((choice) => choice.id === chosen)?.label;
+        const message = label === undefined ? request.message : `${request.message} You chose: ${label}.`;
+        const answer = await this.deps.consent.ask({ title: request.title, message, unlock: held === undefined, opener: this.#opener(file) });
         if (!answer.ok) {
             return fromConsent(answer);
         }
         if (held !== undefined) {
-            return { doc: held.doc, key: held.key, asked: true, how: answer.how };
+            return { doc: held.doc, key: held.key, asked: true, how: answer.how, choice: chosen };
         }
         if (answer.vaultKey === undefined) {
-            return refuse("locked", "The keyring could not be opened with that answer: unlock it with its passphrase.");
+            return refuse("locked", "Passwords could not be opened with that answer: unlock it with its recovery key.");
         }
         try {
-            return { doc: openDocument(answer.vaultKey, file.sealed), key: answer.vaultKey, asked: true, how: answer.how };
+            return { doc: openDocument(answer.vaultKey, file.sealed), key: answer.vaultKey, asked: true, how: answer.how, choice: chosen };
         }
         catch (error) {
             return refuse("unavailable", error instanceof Error ? error.message : "The vault could not be opened.");
         }
     }
+    async #choose(request) {
+        const choices = request.choices;
+        const choose = this.deps.consent.choose;
+        if (choices === undefined || choices.length === 0 || choose === undefined) {
+            return { ok: true, choice: choices?.[0]?.id };
+        }
+        const picked = await choose({ title: request.title, message: request.message, choices });
+        if (picked.kind === "cancelled") {
+            return refuse("declined", "The person at the computer said no.");
+        }
+        return { ok: true, choice: picked.kind === "chosen" ? picked.id : choices[0]?.id };
+    }
     #copiesOf(doc, entries) {
         const copies = new Map();
         for (const entry of entries) {
@@ -142,6 +202,7 @@ export class Keyring {
             pendingInbox: pending?.pendingInbox ?? file.open.pendingInbox,
             pendingSync: pending?.pendingSync ?? file.open.pendingSync,
         };
+        this.#openExtras(open, doc, file.open, pending);
         const next = { ...file, sealed: sealDocument(opened.key, doc), open };
         await this.deps.vault.write(next);
         this.#file = next;
@@ -152,6 +213,27 @@ export class Keyring {
             this.#unlocked = { ...this.#unlocked, doc };
         }
     }
+    #openExtras(open, doc, before, pending) {
+        if (doc.settings !== undefined) {
+            open.settings = doc.settings;
+        }
+        const phones = Object.entries(doc.phones ?? {}).map(([device, pin]) => ({ device, label: pin.keys.label, pairedAt: pin.pairedAt }));
+        if (phones.length > 0) {
+            open.phones = phones;
+        }
+        const captures = pending?.pendingCaptures ?? before.pendingCaptures;
+        if (captures !== undefined && captures.length > 0) {
+            open.pendingCaptures = captures;
+        }
+        const needs = pending?.pendingNeeds ?? before.pendingNeeds;
+        if (needs !== undefined && needs.length > 0) {
+            open.pendingNeeds = needs;
+        }
+        const seen = pending?.pendingSeen ?? before.pendingSeen;
+        if (seen !== undefined && seen.length > 0) {
+            open.pendingSeen = seen;
+        }
+    }
     async #writeOpen(open) {
         const file = this.#file;
         if (file !== undefined) {
@@ -188,7 +270,10 @@ export class Keyring {
     }
     async handle(request) {
         await this.#load();
-        return isRelayed(request) ? await this.#relayed(request) : await this.#local(request);
+        if (isRelayed(request)) {
+            return await this.#relayed(request);
+        }
+        return isApp(request) ? await this.#app(request) : await this.#local(request);
     }
     async #local(request) {
         switch (request.op) {
@@ -217,11 +302,49 @@ export class Keyring {
             case "backend":
                 return await this.#lock(async () => await this.backend(request.config));
             case "askpass":
-                return await this.askpass(request.prompt, request.parent);
+                return await this.#askpass.askpass(request.prompt, request.parent);
+            case "git-credential":
+                return await this.#lock(async () => await this.#askpass.gitCredential(request.action, request.url, request.username));
             case "consent-upgrade":
                 return await this.consentUpgrade(request.version);
         }
     }
+    async #app(request) {
+        switch (request.op) {
+            case "capture-batch":
+                return await this.#lock(async () => await this.#captures.batch(request.items, request.from));
+            case "undo-capture":
+                return await this.#lock(async () => await this.#captures.undo(request.name, request.at));
+            case "seen":
+                return await this.#lock(async () => await this.#captures.seen(request.names));
+            case "reveal":
+                return await this.#appOps.reveal(request.name, request.version);
+            case "copy":
+                return await this.#appOps.copy(request.name, request.field, request.clearAfterSeconds);
+            case "history":
+                return await this.#appOps.history(request.name);
+            case "restore":
+                return await this.#lock(async () => await this.#appOps.restore(request.name, request.version));
+            case "settings": {
+                const phones = this.#file?.open.phones;
+                return phones === undefined ? { ok: true, settings: this.#appOps.settings() } : { ok: true, settings: this.#appOps.settings(), phones };
+            }
+            case "set-settings":
+                return await this.#lock(async () => await this.#appOps.setSettings(request.patch));
+            case "activity":
+                return await this.#appOps.activity(request.name, request.limit);
+            case "fill-window":
+                return await this.#lock(async () => await this.#fills.fillWindow(request.name));
+            case "fill-value":
+                return await this.#lock(async () => await this.#appOps.fillValue(request.origin, request.name));
+            case "candidates":
+                return this.#appOps.candidates(request.origin);
+            case "needs":
+                return this.#needs.needs();
+            case "answer-need":
+                return await this.#lock(async () => await this.#needs.answerNeed(request.id, request.answer, request.name, request.sealed, request.at));
+        }
+    }
     async #relayed(request) {
         switch (request.op) {
             case "shares":
@@ -242,6 +365,14 @@ export class Keyring {
                 return await this.#lock(async () => await this.syncOutbox());
             case "sync-deliver":
                 return await this.#lock(async () => await this.syncDeliver(request.deliver.items));
+            case "capture":
+                return await this.#lock(async () => await this.#captures.capture(request.item, request.sandbox));
+            case "need":
+                return await this.#needs.need(request.sandbox, request.need);
+            case "phone-pair":
+                return await this.#lock(async () => await this.#phones.pair(request.sandbox, request.phone));
+            case "phone-fill":
+                return await this.#lock(async () => await this.#phones.fill(request.sandbox, request.fill));
         }
     }
     async state() {
@@ -255,7 +386,11 @@ export class Keyring {
             locked: held === undefined,
             unlock: helloReady ? ["hello", "passphrase"] : ["passphrase"],
             pendingInbox: file?.open.pendingInbox.length ?? 0,
+            pendingCaptures: file?.open.pendingCaptures?.length ?? 0,
         };
+        if (file !== undefined) {
+            state.remember = (held === undefined ? file.open.settings : held.doc.settings)?.remember ?? DEFAULT_SETTINGS.remember;
+        }
         if (this.#unlocked !== undefined && held !== undefined) {
             state.unlockedUntil = this.#unlocked.until;
         }
@@ -296,10 +431,12 @@ export class Keyring {
             return refuse("locked", NOT_SET_UP);
         }
         const pending = file.open.pendingInbox;
+        const captured = file.open.pendingCaptures?.length ?? 0;
         const waiting = pending.length === 0 ? "" : ` Waiting to be taken in: ${pending.map((item) => `${item.item.name} from ${hostOf(item.item.sandbox)}`).join(", ")}.`;
+        const saving = captured === 0 ? "" : ` And save ${String(captured)} new ${captured === 1 ? "password" : "passwords"}.`;
         const opened = await this.#open(file, {
             title: "Unlock the Intentic keyring",
-            message: `For ${String(minutes)} minutes, entries shared "while you're here" go to their sandboxes without asking.${waiting}`,
+            message: `For ${String(minutes)} minutes, entries shared "while you're here" go to their sandboxes without asking.${waiting}${saving}`,
             person: true,
         });
         if ("ok" in opened) {
@@ -314,7 +451,9 @@ export class Keyring {
     }
     async #takeInPending(opened) {
         const file = this.#file;
-        if (file === undefined || (file.open.pendingInbox.length === 0 && file.open.pendingSync.length === 0)) {
+        const captures = file?.open.pendingCaptures ?? [];
+        const seen = file?.open.pendingSeen ?? [];
+        if (file === undefined || (file.open.pendingInbox.length === 0 && file.open.pendingSync.length === 0 && captures.length === 0 && seen.length === 0)) {
             return;
         }
         let doc = opened.doc;
@@ -328,12 +467,25 @@ export class Keyring {
             }
         }
         doc = this.#mergeSync(doc, file.open.pendingSync).doc;
-        await this.#commit({ doc, key: opened.key }, { pendingInbox: [], pendingSync: [] });
+        doc = seenIn(this.#captures.takeIn(doc, captures), new Set(seen));
+        await this.#commit({ doc, key: opened.key }, { pendingInbox: [], pendingSync: [], pendingCaptures: [], pendingSeen: [] });
     }
     list() {
         const held = this.#held();
         const open = this.#file?.open;
-        const entries = held === undefined ? (open?.entries ?? []) : Object.values(held.doc.entries).filter((entry) => entry.deleted !== true).map(entryInfoOf);
+        if (held === undefined) {
+            return { ok: true, entries: open?.entries ?? [], backends: open?.backends ?? [] };
+        }
+        const live = liveEntries(held.doc);
+        const health = healthOf(live);
+        const entries = live.map((entry) => {
+            const info = entryInfoOf(entry);
+            const verdict = health.get(entry.name);
+            if (verdict !== undefined) {
+                info.health = verdict;
+            }
+            return info;
+        });
         return { ok: true, entries, backends: open?.backends ?? [] };
     }
     #sentValue(doc, name, sealed) {
@@ -575,6 +727,7 @@ export class Keyring {
         const sealed = target.target.kind === "relay"
             ? seal(target.target.sealTo, value.value, { kind: "type", sandbox: grant.sandbox, secret: grant.secret, nonce: grant.nonce })
             : seal(pin.seal, value.value, { kind: "release", sandbox: grant.sandbox, secret: grant.secret, nonce: grant.nonce });
+        await this.#markUsed(granted.opened, granted.entry);
         await this.#record({
             op: "release",
             outcome: "granted",
@@ -657,7 +810,17 @@ export class Keyring {
             return refuse("guard", onFile.verdict === "refuse" ? onFile.reason : "The entry on file differs from what this use was judged against: the sandbox asks again.");
         }
         const value = await this.#valueOf(granted.opened.doc, granted.entry);
-        return value.ok ? await this.#typeInto(place, seen, value.value, granted.opened.asked) : value;
+        if (!value.ok) {
+            return value;
+        }
+        const typed = await this.#typeInto(place, seen, value.value, granted.opened.asked);
+        if (typed.ok) {
+            await this.#markUsed(granted.opened, granted.entry);
+        }
+        return typed;
+    }
+    async #markUsed(opened, entry) {
+        await this.#commit({ doc: withEntry(opened.doc, usedEntry(entry, this.deps.now())), key: opened.key });
     }
     async #typeInto(place, seen, value, asked) {
         let now = seen;
@@ -831,42 +994,6 @@ export class Keyring {
         }
         return { doc: { ...doc, entries }, accepted };
     }
-    async askpass(prompt, parent) {
-        const file = this.#file;
-        if (file === undefined) {
-            return refuse("locked", NOT_SET_UP);
-        }
-        const question = parseAskpassPrompt(prompt);
-        const shown = file.open.entries.find((entry) => askpassMatch(question, entry.askpass) !== undefined);
-        const matcher = shown === undefined ? undefined : askpassMatch(question, shown.askpass);
-        if (shown === undefined || matcher === undefined) {
-            return refuse("unknown", `No keyring entry answers "${question.prompt}": \`intentic-machine keyring edit NAME --askpass ${question.matchers[0] ?? "prompt:…"}\` adds one.`);
-        }
-        if (question.wants === "username") {
-            return shown.username === undefined ? refuse("unknown", `${shown.name} has no user name to answer with.`) : { ok: true, value: shown.username };
-        }
-        const now = this.deps.now();
-        const remembered = this.#held() !== undefined && rememberedFresh(this.#remembered.get(matcher), shown.askpassRememberMinutes, now);
-        const asker = parent ?? "A program";
-        const opened = await this.#open(file, { title: `Answer ${asker}'s prompt?`, message: `${asker} asks: "${question.prompt}". The keyring answers with ${shown.name}.`, person: !remembered });
-        if ("ok" in opened) {
-            await this.#record({ op: "askpass", outcome: "refused", code: opened.code, secret: shown.name, target: matcher });
-            return opened;
-        }
-        const entry = opened.doc.entries[shown.name];
-        if (entry === undefined || entry.deleted === true || askpassMatch(question, entry.rules.askpass) === undefined) {
-            return refuse("unknown", `No keyring entry answers "${question.prompt}".`);
-        }
-        const value = await this.#valueOf(opened.doc, entry);
-        if (!value.ok) {
-            return value;
-        }
-        if (entry.rules.askpassRememberMinutes > 0) {
-            this.#remembered.set(matcher, now);
-        }
-        await this.#record({ op: "askpass", outcome: "granted", secret: entry.name, target: matcher, asked: opened.asked, program: parent });
-        return { ok: true, value: value.value };
-    }
     async consentUpgrade(version) {
         const file = this.#file;
         const answer = await this.deps.consent.ask({