@livedesk/client 0.1.234 → 0.1.236

package/src/security/secure-direct-client.js

@@ -1,224 +0,0 @@
-import crypto from 'node:crypto';
-import net from 'node:net';
-import {
-  SECURE_SESSION_MAX_CLOCK_SKEW_MS,
-  SECURE_SESSION_MAX_HANDSHAKE_BYTES,
-  SECURE_SESSION_PROTOCOL,
-  SecureRecordSocket,
-  decodeCanonicalBase64Url,
-  deriveSecureSessionKey,
-  enrollmentProof,
-  fixedTimeBase64UrlEqual,
-  normalizeSecureChannel,
-  secureClientTranscript,
-  secureServerTranscript
-} from '@livedesk/runtime-core';
-
-const CONNECT_TIMEOUT_MS = 5_000;
-
-function secureError(code) {
-  const error = new Error(code);
-  error.code = code;
-  return error;
-}
-
-function clean(value, maximum = 256) {
-  return String(value || '').replace(/[\0\r\n]/g, '').trim().slice(0, maximum);
-}
-
-function requireP256PublicKey(value) {
-  const der = decodeCanonicalBase64Url(value, 80, 160);
-  let key;
-  try {
-    key = crypto.createPublicKey({ key: der, format: 'der', type: 'spki' });
-  } catch {
-    throw secureError('secure-public-key-invalid');
-  }
-  if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
-    throw secureError('secure-public-key-invalid');
-  }
-  return key;
-}
-
-async function connectRaw(host, port, timeoutMs) {
-  return await new Promise((resolve, reject) => {
-    const socket = net.createConnection({ host, port });
-    const timer = setTimeout(() => {
-      socket.destroy();
-      reject(secureError('secure-direct-connect-timeout'));
-    }, timeoutMs);
-    timer.unref?.();
-    socket.once('connect', () => {
-      clearTimeout(timer);
-      socket.setNoDelay(true);
-      resolve(socket);
-    });
-    socket.once('error', error => {
-      clearTimeout(timer);
-      reject(error);
-    });
-  });
-}
-
-async function readHandshakeLine(socket, timeoutMs) {
-  return await new Promise((resolve, reject) => {
-    let chunks = [];
-    let bytes = 0;
-    const timer = setTimeout(() => finish(secureError('secure-server-hello-timeout')), timeoutMs);
-    timer.unref?.();
-    const cleanup = () => {
-      clearTimeout(timer);
-      socket.removeListener('data', onData);
-      socket.removeListener('error', onError);
-      socket.removeListener('close', onClose);
-    };
-    const finish = (error, value) => {
-      cleanup();
-      if (error) reject(error);
-      else resolve(value);
-    };
-    const onError = error => finish(error);
-    const onClose = () => finish(secureError('secure-server-hello-closed'));
-    const onData = chunk => {
-      const incoming = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk || []);
-      bytes += incoming.length;
-      if (bytes > SECURE_SESSION_MAX_HANDSHAKE_BYTES) {
-        finish(secureError('secure-server-hello-too-large'));
-        return;
-      }
-      chunks.push(incoming);
-      const combined = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks, bytes);
-      const newline = combined.indexOf(0x0a);
-      if (newline < 0) return;
-      let message;
-      try {
-        message = JSON.parse(combined.subarray(0, newline).toString('utf8'));
-      } catch {
-        finish(secureError('secure-server-hello-invalid'));
-        return;
-      }
-      finish(null, { message, remainder: combined.subarray(newline + 1) });
-    };
-    socket.on('data', onData);
-    socket.once('error', onError);
-    socket.once('close', onClose);
-  });
-}
-
-export async function connectSecureDirect({
-  host,
-  port,
-  channel = 'control',
-  deviceId,
-  enrollmentToken,
-  credentialStore,
-  timeoutMs = CONNECT_TIMEOUT_MS
-} = {}) {
-  const normalizedChannel = normalizeSecureChannel(channel);
-  const normalizedDeviceId = clean(deviceId, 128);
-  if (!normalizedDeviceId || !credentialStore?.privateKey || credentialStore.deviceId !== normalizedDeviceId) {
-    throw secureError('device-credential-store-required');
-  }
-  const existingCredential = credentialStore.readCredential();
-  const mode = existingCredential ? 'resume' : 'enroll';
-  if (mode === 'enroll' && normalizedChannel !== 'control') throw secureError('secure-enrollment-control-channel-required');
-  const generated = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
-  const hello = {
-    type: 'secure.client-hello',
-    protocol: SECURE_SESSION_PROTOCOL,
-    mode,
-    channel: normalizedChannel,
-    timestamp: Date.now(),
-    nonce: crypto.randomBytes(16).toString('base64url'),
-    deviceId: normalizedDeviceId,
-    devicePublicKey: credentialStore.publicKey,
-    clientEphemeralPublicKey: generated.publicKey.export({ format: 'der', type: 'spki' }).toString('base64url'),
-    ...(existingCredential ? { credential: existingCredential.text } : {})
-  };
-  const clientTranscript = secureClientTranscript(hello);
-  hello.deviceSignature = credentialStore.sign(clientTranscript);
-  if (mode === 'enroll') hello.enrollmentProof = enrollmentProof(enrollmentToken, clientTranscript);
-
-  const socket = await connectRaw(host, port, Math.max(250, Math.min(30_000, Number(timeoutMs) || CONNECT_TIMEOUT_MS)));
-  try {
-    socket.write(`${JSON.stringify(hello)}\n`);
-    const { message: response, remainder } = await readHandshakeLine(socket, timeoutMs);
-    if (response?.type === 'secure.error') throw secureError(clean(response.error, 100) || 'secure-handshake-rejected');
-    if (response?.type !== 'secure.server-hello'
-      || response.protocol !== SECURE_SESSION_PROTOCOL
-      || response.channel !== normalizedChannel
-      || response.deviceId !== normalizedDeviceId) {
-      throw secureError('secure-server-hello-invalid');
-    }
-    if (!Number.isSafeInteger(Number(response.timestamp))
-      || Math.abs(Date.now() - Number(response.timestamp)) > SECURE_SESSION_MAX_CLOCK_SKEW_MS) {
-      throw secureError('secure-server-timestamp-invalid');
-    }
-    decodeCanonicalBase64Url(response.sessionId, 16, 32);
-    decodeCanonicalBase64Url(response.serverNonce, 16, 32);
-    const serverEphemeralPublicKey = requireP256PublicKey(response.serverEphemeralPublicKey);
-    const parsedCredential = credentialStore.parseCredential(response.credential);
-    if (parsedCredential.payload.deviceId !== normalizedDeviceId
-      || parsedCredential.payload.devicePublicKey !== credentialStore.publicKey
-      || response.hubId !== parsedCredential.payload.hubId
-      || response.accountId !== parsedCredential.payload.accountId) {
-      throw secureError('device-credential-binding-invalid');
-    }
-    if (existingCredential
-      && (parsedCredential.payload.hubId !== existingCredential.payload.hubId
-        || parsedCredential.payload.accountId !== existingCredential.payload.accountId
-        || parsedCredential.payload.hubPublicKey !== existingCredential.payload.hubPublicKey)) {
-      throw secureError('secure-hub-identity-changed');
-    }
-    const serverTranscript = secureServerTranscript(response, clientTranscript);
-    if (mode === 'enroll') {
-      const expectedServerProof = enrollmentProof(enrollmentToken, serverTranscript);
-      if (!fixedTimeBase64UrlEqual(response.enrollmentServerProof, expectedServerProof, 32)) {
-        throw secureError('secure-enrollment-server-proof-invalid');
-      }
-    }
-    const hubSignature = decodeCanonicalBase64Url(response.hubSignature, 64, 64);
-    if (!crypto.verify('sha256', Buffer.from(serverTranscript, 'utf8'), {
-      key: parsedCredential.hubPublicKey,
-      dsaEncoding: 'ieee-p1363'
-    }, hubSignature)) {
-      throw secureError('secure-hub-signature-invalid');
-    }
-    const sharedSecret = crypto.diffieHellman({ privateKey: generated.privateKey, publicKey: serverEphemeralPublicKey });
-    let sessionKey;
-    try {
-      sessionKey = deriveSecureSessionKey({
-        sharedSecret,
-        clientTranscript,
-        serverTranscript,
-        sessionId: response.sessionId,
-        channel: normalizedChannel
-      });
-    } finally {
-      sharedSecret.fill(0);
-    }
-    if (!existingCredential || existingCredential.text !== parsedCredential.text) credentialStore.saveCredential(parsedCredential.text);
-    const secureSocket = new SecureRecordSocket(socket, {
-      sessionKey,
-      sessionId: response.sessionId,
-      channel: normalizedChannel,
-      role: 'client',
-      securityContext: {
-        protocol: SECURE_SESSION_PROTOCOL,
-        accountId: parsedCredential.payload.accountId,
-        hubId: parsedCredential.payload.hubId,
-        deviceId: normalizedDeviceId,
-        credentialSerial: parsedCredential.payload.serial,
-        authenticated: true,
-        encrypted: true
-      }
-    });
-    sessionKey.fill(0);
-    secureSocket.__liveDeskDirectSecure = true;
-    if (remainder.length > 0) secureSocket.feedEncrypted(remainder);
-    return secureSocket;
-  } catch (error) {
-    socket.destroy();
-    throw error;
-  }
-}