@livedesk/client 0.1.235 → 0.1.237

package/src/security/device-credential-store.js

@@ -1,219 +0,0 @@
-import crypto from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { decodeCanonicalBase64Url } from '@livedesk/runtime-core';
-import { createOsSecretStore, OS_SECRET_REFERENCE } from '@livedesk/runtime-core/os-secret-store';
-
-const STORE_VERSION = 1;
-
-function credentialError(code) {
-  const error = new Error(code);
-  error.code = code;
-  return error;
-}
-
-function clean(value, maximum = 512) {
-  return String(value || '').replace(/[\0\r\n]/g, '').trim().slice(0, maximum);
-}
-
-function credentialRoot() {
-  const configured = clean(process.env.LIVEDESK_CLIENT_CREDENTIAL_ROOT, 4096);
-  return configured ? path.resolve(configured) : path.join(os.homedir(), '.livedesk-client');
-}
-
-function defaultCredentialPath(deviceId) {
-  const deviceHash = crypto.createHash('sha256').update(String(deviceId), 'utf8').digest('hex');
-  return path.join(credentialRoot(), 'security', 'device-credentials', `${deviceHash}.json`);
-}
-
-function legacyCredentialPath() {
-  return path.join(credentialRoot(), 'device-credential-v1.json');
-}
-
-function atomicPrivateJson(filePath, value) {
-  mkdirSync(path.dirname(filePath), { recursive: true });
-  const temporary = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-  renameSync(temporary, filePath);
-}
-
-function loadJson(filePath) {
-  try {
-    const value = JSON.parse(readFileSync(filePath, 'utf8'));
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-
-function requirePrivateKey(value) {
-  const der = decodeCanonicalBase64Url(value, 100, 512);
-  let key;
-  try {
-    key = crypto.createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
-  } catch {
-    throw credentialError('device-private-key-invalid');
-  }
-  if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
-    throw credentialError('device-private-key-invalid');
-  }
-  return key;
-}
-
-function parseCredential(credential) {
-  const text = String(credential || '');
-  const parts = text.split('.');
-  if (parts.length !== 2 || text.length > 8192) throw credentialError('device-credential-invalid');
-  const payloadBytes = decodeCanonicalBase64Url(parts[0], 32, 4096);
-  const signature = decodeCanonicalBase64Url(parts[1], 64, 64);
-  let payload;
-  try {
-    payload = JSON.parse(payloadBytes.toString('utf8'));
-  } catch {
-    throw credentialError('device-credential-invalid');
-  }
-  if (!payload || Number(payload.version) !== 1) throw credentialError('device-credential-invalid');
-  const hubPublicDer = decodeCanonicalBase64Url(payload.hubPublicKey, 80, 160);
-  let hubPublicKey;
-  try {
-    hubPublicKey = crypto.createPublicKey({ key: hubPublicDer, format: 'der', type: 'spki' });
-  } catch {
-    throw credentialError('device-credential-invalid');
-  }
-  if (hubPublicKey.asymmetricKeyType !== 'ec'
-    || hubPublicKey.asymmetricKeyDetails?.namedCurve !== 'prime256v1'
-    || !crypto.verify('sha256', Buffer.from(parts[0], 'utf8'), { key: hubPublicKey, dsaEncoding: 'ieee-p1363' }, signature)) {
-    throw credentialError('device-credential-signature-invalid');
-  }
-  const normalized = {
-    serial: clean(payload.serial, 128),
-    accountId: clean(payload.accountId, 128),
-    hubId: clean(payload.hubId, 128),
-    deviceId: clean(payload.deviceId, 128),
-    devicePublicKey: clean(payload.devicePublicKey, 512),
-    hubPublicKey: hubPublicDer.toString('base64url'),
-    issuedAt: Number(payload.issuedAt),
-    expiresAt: Number(payload.expiresAt)
-  };
-  if (!normalized.serial || !normalized.accountId || !normalized.hubId || !normalized.deviceId
-    || !Number.isSafeInteger(normalized.issuedAt) || !Number.isSafeInteger(normalized.expiresAt)
-    || normalized.expiresAt <= Date.now()) {
-    throw credentialError('device-credential-expired');
-  }
-  return { text, payloadText: parts[0], payload: normalized, hubPublicKey };
-}
-
-export function createClientDeviceCredentialStore({
-  filePath = String(process.env.LIVEDESK_DEVICE_CREDENTIAL_PATH || '').trim(),
-  deviceId
-} = {}) {
-  const normalizedDeviceId = clean(deviceId, 128);
-  if (!normalizedDeviceId) throw credentialError('device-id-required');
-  const configuredPath = clean(filePath, 4096);
-  const resolvedFilePath = configuredPath
-    ? path.resolve(configuredPath)
-    : defaultCredentialPath(normalizedDeviceId);
-  const privateKeyStore = createOsSecretStore({
-    service: 'LiveDesk',
-    account: `client-device-private-key:${normalizedDeviceId}`,
-    dataDir: path.dirname(resolvedFilePath)
-  });
-  let state = loadJson(resolvedFilePath);
-  let migratedLegacy = false;
-  if (!state && !configuredPath && !existsSync(resolvedFilePath)) {
-    const legacyState = loadJson(legacyCredentialPath());
-    if (Number(legacyState?.version) === STORE_VERSION && legacyState?.deviceId === normalizedDeviceId) {
-      state = legacyState;
-      migratedLegacy = true;
-    }
-  }
-  let privateKey;
-  let publicKey;
-  if (state) {
-    if (Number(state.version) !== STORE_VERSION || state.deviceId !== normalizedDeviceId) throw credentialError('device-key-state-invalid');
-    const plaintextPrivateKey = clean(state.privateKey, 1024);
-    if (plaintextPrivateKey) {
-      if (!privateKeyStore.write(plaintextPrivateKey)) throw credentialError('device-private-key-migration-failed');
-      state = { ...state, privateKeyRef: OS_SECRET_REFERENCE, updatedAt: new Date().toISOString() };
-      delete state.privateKey;
-      atomicPrivateJson(resolvedFilePath, state);
-    }
-    if (state.privateKeyRef !== OS_SECRET_REFERENCE) throw credentialError('device-private-key-reference-invalid');
-    const privateKeyText = privateKeyStore.read();
-    if (!privateKeyText) throw credentialError('device-private-key-secure-store-unavailable');
-    privateKey = requirePrivateKey(privateKeyText);
-    publicKey = crypto.createPublicKey(privateKey);
-    const publicText = publicKey.export({ format: 'der', type: 'spki' }).toString('base64url');
-    if (publicText !== state.publicKey) throw credentialError('device-key-mismatch');
-    if (migratedLegacy) {
-      atomicPrivateJson(resolvedFilePath, state);
-      try { rmSync(legacyCredentialPath(), { force: true }); } catch {}
-    }
-  } else {
-    const generated = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
-    privateKey = generated.privateKey;
-    publicKey = generated.publicKey;
-    const privateKeyText = privateKey.export({ format: 'der', type: 'pkcs8' }).toString('base64url');
-    if (!privateKeyStore.write(privateKeyText)) throw credentialError('device-private-key-secure-store-unavailable');
-    state = {
-      version: STORE_VERSION,
-      deviceId: normalizedDeviceId,
-      publicKey: publicKey.export({ format: 'der', type: 'spki' }).toString('base64url'),
-      privateKeyRef: OS_SECRET_REFERENCE,
-      credential: '',
-      createdAt: new Date().toISOString(),
-      updatedAt: new Date().toISOString()
-    };
-    atomicPrivateJson(resolvedFilePath, state);
-  }
-
-  function saveCredential(credential) {
-    const parsed = parseCredential(credential);
-    if (parsed.payload.deviceId !== normalizedDeviceId || parsed.payload.devicePublicKey !== state.publicKey) {
-      throw credentialError('device-credential-binding-invalid');
-    }
-    state.credential = parsed.text;
-    state.accountId = parsed.payload.accountId;
-    state.hubId = parsed.payload.hubId;
-    state.updatedAt = new Date().toISOString();
-    atomicPrivateJson(resolvedFilePath, state);
-    return parsed;
-  }
-
-  function readCredential() {
-    if (!state.credential) return null;
-    try {
-      const parsed = parseCredential(state.credential);
-      if (parsed.payload.deviceId !== normalizedDeviceId || parsed.payload.devicePublicKey !== state.publicKey) return null;
-      return parsed;
-    } catch {
-      return null;
-    }
-  }
-
-  function clearCredential() {
-    state.credential = '';
-    state.accountId = '';
-    state.hubId = '';
-    state.updatedAt = new Date().toISOString();
-    atomicPrivateJson(resolvedFilePath, state);
-  }
-
-  return Object.freeze({
-    filePath: resolvedFilePath,
-    deviceId: normalizedDeviceId,
-    publicKey: state.publicKey,
-    privateKey,
-    sign(message) {
-      return crypto.sign('sha256', Buffer.from(String(message || ''), 'utf8'), {
-        key: privateKey,
-        dsaEncoding: 'ieee-p1363'
-      }).toString('base64url');
-    },
-    readCredential,
-    saveCredential,
-    clearCredential,
-    parseCredential
-  });
-}

package/src/security/secure-direct-client.js

@@ -1,224 +0,0 @@
-import crypto from 'node:crypto';
-import net from 'node:net';
-import {
-  SECURE_SESSION_MAX_CLOCK_SKEW_MS,
-  SECURE_SESSION_MAX_HANDSHAKE_BYTES,
-  SECURE_SESSION_PROTOCOL,
-  SecureRecordSocket,
-  decodeCanonicalBase64Url,
-  deriveSecureSessionKey,
-  enrollmentProof,
-  fixedTimeBase64UrlEqual,
-  normalizeSecureChannel,
-  secureClientTranscript,
-  secureServerTranscript
-} from '@livedesk/runtime-core';
-
-const CONNECT_TIMEOUT_MS = 5_000;
-
-function secureError(code) {
-  const error = new Error(code);
-  error.code = code;
-  return error;
-}
-
-function clean(value, maximum = 256) {
-  return String(value || '').replace(/[\0\r\n]/g, '').trim().slice(0, maximum);
-}
-
-function requireP256PublicKey(value) {
-  const der = decodeCanonicalBase64Url(value, 80, 160);
-  let key;
-  try {
-    key = crypto.createPublicKey({ key: der, format: 'der', type: 'spki' });
-  } catch {
-    throw secureError('secure-public-key-invalid');
-  }
-  if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
-    throw secureError('secure-public-key-invalid');
-  }
-  return key;
-}
-
-async function connectRaw(host, port, timeoutMs) {
-  return await new Promise((resolve, reject) => {
-    const socket = net.createConnection({ host, port });
-    const timer = setTimeout(() => {
-      socket.destroy();
-      reject(secureError('secure-direct-connect-timeout'));
-    }, timeoutMs);
-    timer.unref?.();
-    socket.once('connect', () => {
-      clearTimeout(timer);
-      socket.setNoDelay(true);
-      resolve(socket);
-    });
-    socket.once('error', error => {
-      clearTimeout(timer);
-      reject(error);
-    });
-  });
-}
-
-async function readHandshakeLine(socket, timeoutMs) {
-  return await new Promise((resolve, reject) => {
-    let chunks = [];
-    let bytes = 0;
-    const timer = setTimeout(() => finish(secureError('secure-server-hello-timeout')), timeoutMs);
-    timer.unref?.();
-    const cleanup = () => {
-      clearTimeout(timer);
-      socket.removeListener('data', onData);
-      socket.removeListener('error', onError);
-      socket.removeListener('close', onClose);
-    };
-    const finish = (error, value) => {
-      cleanup();
-      if (error) reject(error);
-      else resolve(value);
-    };
-    const onError = error => finish(error);
-    const onClose = () => finish(secureError('secure-server-hello-closed'));
-    const onData = chunk => {
-      const incoming = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk || []);
-      bytes += incoming.length;
-      if (bytes > SECURE_SESSION_MAX_HANDSHAKE_BYTES) {
-        finish(secureError('secure-server-hello-too-large'));
-        return;
-      }
-      chunks.push(incoming);
-      const combined = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks, bytes);
-      const newline = combined.indexOf(0x0a);
-      if (newline < 0) return;
-      let message;
-      try {
-        message = JSON.parse(combined.subarray(0, newline).toString('utf8'));
-      } catch {
-        finish(secureError('secure-server-hello-invalid'));
-        return;
-      }
-      finish(null, { message, remainder: combined.subarray(newline + 1) });
-    };
-    socket.on('data', onData);
-    socket.once('error', onError);
-    socket.once('close', onClose);
-  });
-}
-
-export async function connectSecureDirect({
-  host,
-  port,
-  channel = 'control',
-  deviceId,
-  enrollmentToken,
-  credentialStore,
-  timeoutMs = CONNECT_TIMEOUT_MS
-} = {}) {
-  const normalizedChannel = normalizeSecureChannel(channel);
-  const normalizedDeviceId = clean(deviceId, 128);
-  if (!normalizedDeviceId || !credentialStore?.privateKey || credentialStore.deviceId !== normalizedDeviceId) {
-    throw secureError('device-credential-store-required');
-  }
-  const existingCredential = credentialStore.readCredential();
-  const mode = existingCredential ? 'resume' : 'enroll';
-  if (mode === 'enroll' && normalizedChannel !== 'control') throw secureError('secure-enrollment-control-channel-required');
-  const generated = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
-  const hello = {
-    type: 'secure.client-hello',
-    protocol: SECURE_SESSION_PROTOCOL,
-    mode,
-    channel: normalizedChannel,
-    timestamp: Date.now(),
-    nonce: crypto.randomBytes(16).toString('base64url'),
-    deviceId: normalizedDeviceId,
-    devicePublicKey: credentialStore.publicKey,
-    clientEphemeralPublicKey: generated.publicKey.export({ format: 'der', type: 'spki' }).toString('base64url'),
-    ...(existingCredential ? { credential: existingCredential.text } : {})
-  };
-  const clientTranscript = secureClientTranscript(hello);
-  hello.deviceSignature = credentialStore.sign(clientTranscript);
-  if (mode === 'enroll') hello.enrollmentProof = enrollmentProof(enrollmentToken, clientTranscript);
-
-  const socket = await connectRaw(host, port, Math.max(250, Math.min(30_000, Number(timeoutMs) || CONNECT_TIMEOUT_MS)));
-  try {
-    socket.write(`${JSON.stringify(hello)}\n`);
-    const { message: response, remainder } = await readHandshakeLine(socket, timeoutMs);
-    if (response?.type === 'secure.error') throw secureError(clean(response.error, 100) || 'secure-handshake-rejected');
-    if (response?.type !== 'secure.server-hello'
-      || response.protocol !== SECURE_SESSION_PROTOCOL
-      || response.channel !== normalizedChannel
-      || response.deviceId !== normalizedDeviceId) {
-      throw secureError('secure-server-hello-invalid');
-    }
-    if (!Number.isSafeInteger(Number(response.timestamp))
-      || Math.abs(Date.now() - Number(response.timestamp)) > SECURE_SESSION_MAX_CLOCK_SKEW_MS) {
-      throw secureError('secure-server-timestamp-invalid');
-    }
-    decodeCanonicalBase64Url(response.sessionId, 16, 32);
-    decodeCanonicalBase64Url(response.serverNonce, 16, 32);
-    const serverEphemeralPublicKey = requireP256PublicKey(response.serverEphemeralPublicKey);
-    const parsedCredential = credentialStore.parseCredential(response.credential);
-    if (parsedCredential.payload.deviceId !== normalizedDeviceId
-      || parsedCredential.payload.devicePublicKey !== credentialStore.publicKey
-      || response.hubId !== parsedCredential.payload.hubId
-      || response.accountId !== parsedCredential.payload.accountId) {
-      throw secureError('device-credential-binding-invalid');
-    }
-    if (existingCredential
-      && (parsedCredential.payload.hubId !== existingCredential.payload.hubId
-        || parsedCredential.payload.accountId !== existingCredential.payload.accountId
-        || parsedCredential.payload.hubPublicKey !== existingCredential.payload.hubPublicKey)) {
-      throw secureError('secure-hub-identity-changed');
-    }
-    const serverTranscript = secureServerTranscript(response, clientTranscript);
-    if (mode === 'enroll') {
-      const expectedServerProof = enrollmentProof(enrollmentToken, serverTranscript);
-      if (!fixedTimeBase64UrlEqual(response.enrollmentServerProof, expectedServerProof, 32)) {
-        throw secureError('secure-enrollment-server-proof-invalid');
-      }
-    }
-    const hubSignature = decodeCanonicalBase64Url(response.hubSignature, 64, 64);
-    if (!crypto.verify('sha256', Buffer.from(serverTranscript, 'utf8'), {
-      key: parsedCredential.hubPublicKey,
-      dsaEncoding: 'ieee-p1363'
-    }, hubSignature)) {
-      throw secureError('secure-hub-signature-invalid');
-    }
-    const sharedSecret = crypto.diffieHellman({ privateKey: generated.privateKey, publicKey: serverEphemeralPublicKey });
-    let sessionKey;
-    try {
-      sessionKey = deriveSecureSessionKey({
-        sharedSecret,
-        clientTranscript,
-        serverTranscript,
-        sessionId: response.sessionId,
-        channel: normalizedChannel
-      });
-    } finally {
-      sharedSecret.fill(0);
-    }
-    if (!existingCredential || existingCredential.text !== parsedCredential.text) credentialStore.saveCredential(parsedCredential.text);
-    const secureSocket = new SecureRecordSocket(socket, {
-      sessionKey,
-      sessionId: response.sessionId,
-      channel: normalizedChannel,
-      role: 'client',
-      securityContext: {
-        protocol: SECURE_SESSION_PROTOCOL,
-        accountId: parsedCredential.payload.accountId,
-        hubId: parsedCredential.payload.hubId,
-        deviceId: normalizedDeviceId,
-        credentialSerial: parsedCredential.payload.serial,
-        authenticated: true,
-        encrypted: true
-      }
-    });
-    sessionKey.fill(0);
-    secureSocket.__liveDeskDirectSecure = true;
-    if (remainder.length > 0) secureSocket.feedEncrypted(remainder);
-    return secureSocket;
-  } catch (error) {
-    socket.destroy();
-    throw error;
-  }
-}