@lamalibre/portlama-agent 1.0.18 → 1.0.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/portlama-agent",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "description": "Tunnel agent for Portlama — manages Chisel tunnel client as a system service",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/commands/setup.js

@@ -246,6 +246,19 @@ async function runTokenSetup(flags) {
           await mkdir(logsDir, { recursive: true, mode: 0o700 });
         },
       },
+      {
+        title: 'Requesting macOS login password',
+        skip: () => !isDarwin() && 'Not macOS',
+        task: async (_ctx, task) => {
+          task.output = chalk.dim('Required to authorize curl access to the Keychain certificate');
+          ctx._keychainPassword = await prompt('macOS login password (for Keychain access)');
+          if (!ctx._keychainPassword) {
+            throw new Error('Keychain password is required on macOS to grant curl access to the certificate.');
+          }
+          task.output = 'Password received';
+        },
+        rendererOptions: { persistentOutput: true },
+      },
       {
         title: isDarwin() ? 'Importing certificate into Keychain' : 'Storing certificate',
         task: async (_ctx, task) => {
@@ -255,6 +268,7 @@ async function runTokenSetup(flags) {
             ctx._caCertPem,
             ctx.resolvedLabel,
             console,
+            { keychainPassword: ctx._keychainPassword },
           );
           if (result.identity) {
             ctx.keychainIdentity = result.identity;

package/src/lib/cert-store.js

@@ -22,12 +22,13 @@ import { secureDelete } from './keychain.js';
  * @param {string} caCertPem - PEM-encoded CA certificate
  * @param {string} label - Agent label
  * @param {import('pino').Logger | Console} logger
+ * @param {{ keychainPassword?: string }} [options]
  * @returns {Promise<{ identity?: string, p12Path?: string, p12Password?: string }>}
  */
-export async function storeEnrolledCert(keyPath, certPem, caCertPem, label, logger) {
+export async function storeEnrolledCert(keyPath, certPem, caCertPem, label, logger, options = {}) {
   if (isDarwin()) {
     const { importIdentityToKeychain } = await import('./keychain.js');
-    const { identity } = await importIdentityToKeychain(keyPath, certPem, caCertPem, label, logger);
+    const { identity } = await importIdentityToKeychain(keyPath, certPem, caCertPem, label, logger, options);
     return { identity };
   }
   return storeP12Linux(keyPath, certPem, caCertPem, label, logger);

package/src/lib/keychain.js

@@ -82,9 +82,10 @@ export async function generateKeypairAndCSR(label) {
  * @param {string} caCertPem - PEM-encoded CA certificate
  * @param {string} label - Agent label
  * @param {import('pino').Logger | Console} logger
+ * @param {{ keychainPassword?: string }} [options]
  * @returns {Promise<{ identity: string }>}
  */
-export async function importIdentityToKeychain(keyPath, certPem, caCertPem, label, logger) {
+export async function importIdentityToKeychain(keyPath, certPem, caCertPem, label, logger, options = {}) {
   const suffix = crypto.randomBytes(8).toString('hex');
   const certPath = path.join(AGENT_DIR, `.tmp-cert-${suffix}.pem`);
   const caPath = path.join(AGENT_DIR, `.tmp-ca-${suffix}.pem`);
@@ -142,16 +143,32 @@ export async function importIdentityToKeychain(keyPath, certPem, caCertPem, labe
       p12Password,
     ]);
 
+    // Trust the Portlama CA so macOS considers the agent identity valid.
+    // Without this, `security find-identity -v -p ssl-client` marks the
+    // identity as CSSMERR_TP_NOT_TRUSTED and curl exits with code 58.
+    // `add-trusted-cert` is idempotent — safe to call on every import.
+    try {
+      await execa('security', [
+        'add-trusted-cert',
+        '-p',
+        'ssl',                // trust for SSL/TLS
+        caPath,
+      ]);
+    } catch (err) {
+      logger.warn?.({ err, label }, 'Could not set CA trust — curl may fail with exit 58') ??
+        logger.log?.(`Warning: Could not trust CA certificate for ${label}`);
+    }
+
     // Set the key partition list so curl can access the identity without prompts.
-    // This uses the default Keychain password (empty string for login Keychain
-    // on most macOS setups), which may prompt the user if the Keychain is locked.
+    // Requires the login Keychain password — callers should prompt the user for it.
+    const keychainPassword = options.keychainPassword ?? '';
     try {
       await execa('security', [
         'set-key-partition-list',
         '-S',
         'apple-tool:,apple:',  // apple-tool: for /usr/bin/curl, apple: for GUI apps
         '-k',
-        '',                    // Keychain password (empty for login Keychain)
+        keychainPassword,
         '-l',                  // match by Label (friendly name from -name), not -D (Description)
         identityName,
       ]);