@loginguards/loginguards-win 0.1.1 → 0.1.3

package/README.md

@@ -13,12 +13,14 @@ Enterprise-grade password breach prevention for Windows domains.
 ## Install (development)
 
 ```bash
-npm install -g .
+npm i -g @loginguards/loginguards-win
 loginguards-win configure
 loginguards-win install
 loginguards-win test
+loginguards-win --help
 ```
 
+
 ## Configuration
 
 - API base: `https://api.loginguards.com/v1`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loginguards/loginguards-win",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "LoginGuards Active Directory Password Protection for Windows",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",

package/src/cli/commands/check.js

@@ -0,0 +1,84 @@
+"use strict";
+const storage = require('../../storage');
+const apiClient = require('../../apiClient');
+const { logger } = require('../../logger');
+
+module.exports = {
+  command: 'check',
+  describe: 'Check one or more passwords against LoginGuards (no passwords are logged or stored)',
+  builder: {
+    password: { type: 'string', describe: 'Password to check (avoid history; prefer --prompt or --stdin)' },
+    prompt: { type: 'boolean', default: false, describe: 'Securely prompt for a password' },
+    stdin: { type: 'boolean', default: false, describe: 'Read newline-separated passwords from stdin' },
+    debug: { type: 'boolean', default: false, describe: 'Print raw API response (sanitized)' }
+  },
+  handler: async (args) => {
+    const apiKey = await storage.getApiKey();
+    if (!apiKey) {
+      console.log('✖ API key not configured. Run "loginguards-win configure".');
+      process.exit(1);
+    }
+
+    async function evalOne(pwd) {
+      try {
+        const res = await apiClient.checkPlain(pwd, apiKey);
+        if (args.debug) {
+          try { console.log('debug response:', JSON.stringify(res)); } catch {}
+        }
+        const compromised = (typeof res.breached !== 'undefined') ? !!res.breached
+          : (typeof res.compromised !== 'undefined') ? !!res.compromised
+          : (typeof res.is_compromised !== 'undefined') ? !!res.is_compromised
+          : (typeof res.isCompromised !== 'undefined') ? !!res.isCompromised
+          : (typeof res.count === 'number') ? res.count > 0
+          : false;
+        if (compromised) {
+          console.log('✖ COMPROMISED');
+        } else {
+          console.log('✔ NOT COMPROMISED');
+        }
+      } catch (e) {
+        const status = e && e.response && e.response.status;
+        if (status === 401) console.log('✖ Error: Unauthorized (invalid API key)');
+        else if (status === 429) console.log('✖ Error: Rate limited');
+        else console.log('✖ Error:', e.message || String(e));
+        logger.warn(`check command API error: ${status || e.code || e.message}`);
+        process.exitCode = 1;
+      }
+    }
+
+    if (args.stdin) {
+      // batch mode from stdin
+      const chunks = [];
+      process.stdin.setEncoding('utf8');
+      process.stdin.on('data', (d) => chunks.push(d));
+      process.stdin.on('end', async () => {
+        const text = chunks.join('');
+        const lines = text.split(/\r?\n/).map(s => s.trim()).filter(Boolean);
+        if (!lines.length) { console.log('No input passwords.'); return; }
+        for (const line of lines) {
+          await evalOne(line);
+        }
+      });
+      if (process.stdin.readableEnded) {
+        // no stdin piped
+        console.log('No stdin provided. Use --password or --prompt instead.');
+      }
+      return;
+    }
+
+    if (typeof args.password === 'string' && args.password.length > 0) {
+      await evalOne(args.password);
+      return;
+    }
+
+    // prompt safely
+    try {
+      const inquirer = (await import('inquirer')).default;
+      const ans = await inquirer.prompt([{ type: 'password', name: 'pwd', message: 'Enter password to check', mask: '*', validate: v => v ? true : 'Required' }]);
+      await evalOne(ans.pwd);
+    } catch (e) {
+      console.error('✖ Prompt failed:', e.message || String(e));
+      process.exit(1);
+    }
+  }
+};

package/src/cli/index.js

@@ -11,6 +11,7 @@ async function run(argvInput) {
     .usage('$0 <cmd> [args]')
     .command(require('./commands/install'))
     .command(require('./commands/configure'))
+    .command(require('./commands/check'))
     .command(require('./commands/test'))
     .command(require('./commands/pipe-test'))
     .command(require('./commands/uninstall'))

package/src/service/engine.js

@@ -23,7 +23,12 @@ async function evaluatePassword(password) {
   }
   try {
     const res = await apiClient.checkPlain(password, apiKey);
-    const compromised = !!res.compromised;
+    const compromised = (typeof res.breached !== 'undefined') ? !!res.breached
+      : (typeof res.compromised !== 'undefined') ? !!res.compromised
+      : (typeof res.is_compromised !== 'undefined') ? !!res.is_compromised
+      : (typeof res.isCompromised !== 'undefined') ? !!res.isCompromised
+      : (typeof res.count === 'number') ? res.count > 0
+      : false;
     return { allow: !compromised, reason: compromised ? 'compromised' : 'ok' };
   } catch (e) {
     logger.warn(`API error during evaluation: ${e.status || e.code || e.message}`);

package/src/storage.js

@@ -62,16 +62,40 @@ async function dpapiProtect(plain) {
   $plain = @'
 ${plain.replace(/'/g, "''")}
 '@
-  $bytes = [System.Text.Encoding]::UTF8.GetBytes($plain)
-  $enc = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
-  [Convert]::ToBase64String($enc)
+  try { Add-Type -AssemblyName 'System.Security' -ErrorAction SilentlyContinue } catch {}
+  try {
+    $bytes = [System.Text.Encoding]::UTF8.GetBytes($plain)
+    $enc = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
+    [Convert]::ToBase64String($enc)
+  } catch {
+    try {
+      $secure = ConvertTo-SecureString $plain -AsPlainText -Force
+      $hasScope = (Get-Command ConvertFrom-SecureString).Parameters.ContainsKey('Scope')
+      if ($hasScope) { $encStr = ConvertFrom-SecureString $secure -Scope LocalMachine } else { $encStr = ConvertFrom-SecureString $secure }
+      'SS:' + $encStr
+    } catch { throw }
+  }
   `;
   const { stdout } = await runPS(script);
   return stdout.trim();
 }
 
 async function dpapiUnprotect(b64) {
+  if (b64.startsWith('SS:')) {
+    const encStr = b64.slice(3);
+    const scriptSS = `
+    $encStr = @'
+${encStr.replace(/'/g, "''")}
+'@
+    $secure = ConvertTo-SecureString $encStr
+    $bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
+    [Runtime.InteropServices.Marshal]::PtrToStringUni($bstr)
+    `;
+    const { stdout } = await runPS(scriptSS);
+    return stdout.replace(/\r?\n$/, '');
+  }
   const script = `
+  try { Add-Type -AssemblyName 'System.Security' -ErrorAction SilentlyContinue } catch {}
   $b64 = '${b64.replace(/'/g, "''")}'
   $bytes = [Convert]::FromBase64String($b64)
   $dec = [System.Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)