@massu/core 1.10.8 → 1.12.1

package/src/security/license-response-verifier.ts

@@ -1,149 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * P-H019 (plan-stage-c-high-batch / 1.10.5): Ed25519 verifier for signed
- * /validate-key responses from massu.ai.
- *
- * **Bug class closed**: pre-fix, `packages/core/src/license.ts:280-318`
- * accepted ANY `{ valid: true, plan: 'enterprise' }` JSON over HTTPS from
- * whatever endpoint `config.cloud?.endpoint` pointed to. MITM, malicious
- * cloud.endpoint, or local edit of the cached `license_cache` SQLite row
- * could grant arbitrary tier.
- *
- * **Structural fix**: the server (validate-key Supabase Edge Function)
- * signs every response with Ed25519. The client (this module, called
- * from `license.ts`) verifies the signature against the bundled public
- * key in `license-pubkey.generated.ts`. Invalid / missing signature →
- * reject under strict mode, warn-and-accept under transition mode.
- *
- * **Transition mode** (default): when `MASSU_REQUIRE_SIGNED_LICENSE` env
- * var is NOT `'true'`, unsigned/invalid-sig responses are accepted but
- * a one-shot stderr warning is emitted. Lets existing customers keep
- * working while operators provision the signing key.
- *
- * **Strict mode** (post-cutover): when `MASSU_REQUIRE_SIGNED_LICENSE=true`,
- * unsigned/invalid-sig responses are REJECTED (caller drops to grace-period
- * cached or 'free' tier). Operator flips this after Supabase Edge Function
- * env var `LICENSE_RESPONSE_SIGNING_PRIVATE_KEY_B64` is provisioned and
- * cutover smoke test passes.
- */
-
-import { createVerify, createPublicKey } from 'crypto';
-import {
-  LICENSE_PUBKEY_ED25519,
-  LICENSE_PUBKEY_FINGERPRINT_HEX,
-  KNOWN_LICENSE_PUBKEY_FINGERPRINTS,
-} from './license-pubkey.generated.ts';
-
-export interface SignedLicenseResponse {
-  /** Base64-encoded Ed25519 signature over the canonical-serialized payload. */
-  _signature?: string;
-  /** Signature algorithm tag (currently always `'ed25519'`). */
-  _signature_alg?: string;
-  /**
-   * Sorted list of top-level keys (excluding the `_signature*` triplet) that
-   * were included in the signed payload. Lets the client reconstruct the
-   * canonical-serialization input deterministically.
-   */
-  _signature_payload_keys?: readonly string[];
-  /** Hex sha256 of the LICENSE pubkey used for signing (so client can detect rotation). */
-  _signature_pubkey_fingerprint?: string;
-  // Plus the actual fields (plan, tier, validUntil, features, etc.)
-  [key: string]: unknown;
-}
-
-export type VerificationResult =
-  | { kind: 'valid' }
-  | { kind: 'missing_signature' }
-  | { kind: 'bad_signature' }
-  | { kind: 'unknown_pubkey'; got: string }
-  | { kind: 'error'; reason: string };
-
-/**
- * Verify a server-signed /validate-key response. Returns a tagged union
- * describing the verification outcome. Caller decides whether to accept
- * based on strict/transition mode.
- */
-export function verifyLicenseResponse(payload: SignedLicenseResponse): VerificationResult {
-  // Self-check: confirm the bundled key fingerprint matches the allowlist.
-  // CR-9 audit L2 pattern: a future build that swaps the pem to an unknown
-  // key refuses to load even if compiled in.
-  if (!KNOWN_LICENSE_PUBKEY_FINGERPRINTS.has(LICENSE_PUBKEY_FINGERPRINT_HEX)) {
-    return {
-      kind: 'error',
-      reason: `Bundled license pubkey fingerprint ${LICENSE_PUBKEY_FINGERPRINT_HEX} is not in the trusted allowlist. Possible build-time tamper.`,
-    };
-  }
-
-  const sig = payload._signature;
-  const alg = payload._signature_alg;
-  const payloadKeys = payload._signature_payload_keys;
-  const sigPubkey = payload._signature_pubkey_fingerprint;
-
-  if (typeof sig !== 'string' || sig.length === 0) {
-    return { kind: 'missing_signature' };
-  }
-  if (alg !== 'ed25519') {
-    return { kind: 'error', reason: `Unsupported signature algorithm: ${alg}` };
-  }
-  if (!Array.isArray(payloadKeys) || payloadKeys.length === 0) {
-    return { kind: 'error', reason: 'Missing _signature_payload_keys' };
-  }
-  if (typeof sigPubkey === 'string' && sigPubkey !== LICENSE_PUBKEY_FINGERPRINT_HEX) {
-    // Server signed with a different pubkey than we have bundled — rotation
-    // mismatch. Caller should fail-open under transition mode (operator
-    // hasn't published the new bundle yet) but reject under strict mode.
-    return { kind: 'unknown_pubkey', got: sigPubkey };
-  }
-
-  // Reconstruct the canonical serialization the server signed:
-  //   JSON.stringify({ k1: payload[k1], k2: payload[k2], ... }, payloadKeysSorted)
-  // where payloadKeysSorted is the sorted list of NON-underscore-prefixed keys.
-  const canonicalObj: Record<string, unknown> = {};
-  for (const k of payloadKeys) {
-    if (typeof k !== 'string') continue;
-    canonicalObj[k] = payload[k];
-  }
-  const canonical = JSON.stringify(canonicalObj, [...payloadKeys].sort());
-
-  // Verify signature.
-  try {
-    // Construct a node KeyObject from the bundled raw Ed25519 pubkey bytes.
-    // We use createPublicKey with SubjectPublicKeyInfo DER encoding (44 bytes:
-    // 12-byte algorithm OID prefix + 32-byte raw key).
-    const spkiPrefix = Buffer.from([
-      0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65,
-      0x70, 0x03, 0x21, 0x00,
-    ]);
-    const der = Buffer.concat([spkiPrefix, Buffer.from(LICENSE_PUBKEY_ED25519)]);
-    const pubkey = createPublicKey({ key: der, format: 'der', type: 'spki' });
-
-    // Ed25519 in node uses `verify` directly (no createVerify needed for ed25519).
-    // crypto.verify(algorithm, data, key, signature) — algorithm MUST be null for Ed25519.
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { verify } = require('crypto');
-    const ok = verify(
-      null,
-      Buffer.from(canonical, 'utf-8'),
-      pubkey,
-      Buffer.from(sig, 'base64'),
-    );
-
-    return ok ? { kind: 'valid' } : { kind: 'bad_signature' };
-  } catch (err) {
-    return {
-      kind: 'error',
-      reason: `Signature verification threw: ${err instanceof Error ? err.message : String(err)}`,
-    };
-  }
-}
-
-/**
- * P-H019 strict-mode gate. Operator sets `MASSU_REQUIRE_SIGNED_LICENSE=true`
- * AFTER the validate-key Edge Function is provisioned with
- * `LICENSE_RESPONSE_SIGNING_PRIVATE_KEY_B64` and cutover smoke test passes.
- */
-export function isLicenseSignatureRequired(): boolean {
-  return process.env.MASSU_REQUIRE_SIGNED_LICENSE === 'true';
-}

package/src/security/local-fingerprint.ts

@@ -1,225 +0,0 @@
-/**
- * adapters.local postinstall-poisoning fingerprint (Plan 3c gap-32).
- *
- * Threat model: a malicious npm package's `postinstall` script could mutate
- * `massu.config.yaml > adapters.local` to add a path pointing at attacker-
- * controlled code. Local adapters bypass the registry-signed allowlist
- * entirely (operator opt-in per-path), so the only defense is verifying
- * that the operator INTENDED the mutation. The mechanism:
- *
- * 1. Every time the operator runs `massu adapters add-local <path>`,
- *    `massu adapters remove-local <path>`, or `massu adapters resync-local-
- *    fingerprint`, this module writes a sentinel file at
- *    `~/.massu/adapters-local-fingerprint.json` recording:
- *      { fingerprint: <sha256-hex of canonical-stringified sorted array>,
- *        source:      "cli" | "cli-resync",
- *        ts:          ISO8601-string }
- *
- * 2. At loader startup, discoverAdapters compares the CURRENT
- *    massu.config.yaml.adapters.local content's fingerprint against the
- *    sentinel. If they differ, the loader REFUSES to load any local
- *    adapter and emits a stderr warning naming the additions/removals
- *    that diverged from the last operator-acknowledged state.
- *
- * 3. Operators can re-acknowledge the current state by running
- *    `massu adapters resync-local-fingerprint` — which recomputes the
- *    fingerprint over whatever adapters.local currently holds (regardless
- *    of how it got there) and writes the sentinel anew. This is
- *    explicitly a "trust me, I know what I edited" CLI escape hatch.
- *
- * Why a SEPARATE file (not stored inside the cache, not stored in the
- * yaml itself):
- * - In yaml: a postinstall script could update both the entry AND the
- *   fingerprint, defeating detection.
- * - In ~/.massu/adapter-manifest.json (signed cache): the cache wraps
- *   registry data, mixing operator-trust state into it would conflate
- *   two different security domains.
- * - Standalone: the file's path is well-known + stable; CLI-only
- *   writes are the explicit acknowledgment signal.
- *
- * File mode: 0o600 (gap-37 — security-relevant cache files are owner-only).
- *
- * Drift-prevention (CR-46 / Rule 0 self-attest #2): the SAME canonical-
- * fingerprint computation is used at write time AND at check time —
- * `computeLocalFingerprint` is the single source of truth. A future
- * caller that hashes locally-different bytes would silently drift; this
- * module's API makes that impossible by exposing only the high-level
- * write/check primitives, not the raw sha256 step.
- */
-import { existsSync, readFileSync, lstatSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { resolve, isAbsolute } from 'node:path';
-import { createHash } from 'node:crypto';
-import { z } from 'zod';
-import { atomicWrite } from './atomic-write.js';
-import { PrintableAsciiStringSchema } from './manifest-schema.js';
-
-export const FINGERPRINT_PATH = resolve(homedir(), '.massu', 'adapters-local-fingerprint.json');
-
-/**
- * Canonical fingerprint: sha256 hex of `[path, sha256(content)]` tuples for
- * each adapters.local entry, sorted by path. CR-9 audit C3 fix: hashing path
- * STRINGS only (the prior shape) let a postinstall script swap the FILE at
- * an already-acknowledged path with full bypass — fingerprint matched even
- * though the file content changed. This implementation hashes BOTH the path
- * AND the current file content, so swapping the file (even with a same-
- * length payload) triggers drift on the very next discovery + the loader
- * refuses until the operator runs `massu adapters resync-local-fingerprint`.
- *
- * Path inputs MUST be the AdapterLocalPathSchema-validated + POSIX-normalized
- * content from getConfig().adapters?.local. `projectRoot` is the absolute
- * path to the project so we can resolve relative entries to disk reads.
- *
- * Missing files: the fingerprint includes a sentinel string `<missing>` for
- * any adapters.local entry that does not resolve to a regular file at
- * fingerprint time. This means an absent file is part of the fingerprint
- * — adding the file later is a drift event the operator must explicitly
- * acknowledge. Symbolic links are detected via lstatSync + treated as
- * `<symlink>` (also a sentinel; the link target is NEVER followed for
- * hashing — a malicious symlink to /etc/shadow does not exfiltrate that
- * file's content into the fingerprint).
- */
-export function computeLocalFingerprint(
-  localPaths: ReadonlyArray<string>,
-  projectRoot: string,
-): string {
-  const tuples: Array<{ path: string; contentTag: string }> = [];
-  for (const p of localPaths) {
-    const abs = isAbsolute(p) ? p : resolve(projectRoot, p);
-    let contentTag: string;
-    try {
-      const lst = lstatSync(abs);
-      if (lst.isSymbolicLink()) {
-        contentTag = '<symlink>';
-      } else if (!lst.isFile()) {
-        contentTag = '<not-a-file>';
-      } else {
-        contentTag = createHash('sha256').update(readFileSync(abs)).digest('hex');
-      }
-    } catch {
-      contentTag = '<missing>';
-    }
-    tuples.push({ path: p, contentTag });
-  }
-  tuples.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
-  const canonical = JSON.stringify(tuples);
-  return createHash('sha256').update(canonical).digest('hex');
-}
-
-const FingerprintSentinelSchema = z.object({
-  fingerprint: z.string().regex(/^[0-9a-f]{64}$/),
-  source: z.enum(['cli', 'cli-resync']),
-  // CR-9 iter-5 audit LOW-NEW5-1 fix: ts is rendered to stderr in the
-  // drift warning at line 214 (`${sentinel.source} at ${sentinel.ts}`);
-  // a same-user attacker writing the sentinel file with control chars
-  // in ts would log-inject. Same vector iter-3 closed for
-  // InstallEntrySchema.ts; closing the parallel sentinel schema for
-  // single-source-of-truth consistency.
-  ts: PrintableAsciiStringSchema,
-}).strict();
-export type FingerprintSentinel = z.infer<typeof FingerprintSentinelSchema>;
-
-/**
- * Read the on-disk sentinel. Returns null when:
- * - file is absent (no operator action has ever been recorded)
- * - file is present but unparseable (treat as absent — caller should
- *   surface a stderr warning about the corrupt sentinel)
- * - file's shape doesn't match the strict schema
- *
- * Caller decides what to do with `null` (typically: refuse all
- * LOCAL-EXPLICIT loading until `massu adapters resync-local-fingerprint`
- * is run).
- */
-export function readFingerprintSentinel(path: string = FINGERPRINT_PATH): FingerprintSentinel | null {
-  if (!existsSync(path)) return null;
-  let raw: unknown;
-  try {
-    raw = JSON.parse(readFileSync(path, 'utf-8'));
-  } catch {
-    return null;
-  }
-  const parsed = FingerprintSentinelSchema.safeParse(raw);
-  if (!parsed.success) return null;
-  return parsed.data;
-}
-
-export type FingerprintWriteResult = { written: true } | { written: false; error: string };
-
-/**
- * Atomically write the sentinel with the given paths' fingerprint + source
- * tag. Mode 0o600; parent dir 0o700. Uses the shared atomicWrite primitive
- * so torn writes are impossible.
- */
-export function writeFingerprintSentinel(
-  localPaths: ReadonlyArray<string>,
-  source: FingerprintSentinel['source'],
-  projectRoot: string,
-  path: string = FINGERPRINT_PATH,
-): FingerprintWriteResult {
-  const sentinel: FingerprintSentinel = {
-    fingerprint: computeLocalFingerprint(localPaths, projectRoot),
-    source,
-    ts: new Date().toISOString(),
-  };
-  const result = atomicWrite(path, JSON.stringify(sentinel, null, 2), {
-    mode: 0o600,
-    ensureParentDirMode: 0o700,
-  });
-  if (!result.written) {
-    return { written: false, error: result.error ?? 'unknown atomicWrite error' };
-  }
-  return { written: true };
-}
-
-export type FingerprintCheckResult =
-  | { kind: 'match'; sentinel: FingerprintSentinel }
-  | { kind: 'no-sentinel'; reason: string }
-  | { kind: 'drift'; sentinel: FingerprintSentinel; currentFingerprint: string; reason: string };
-
-/**
- * Compare the current adapters.local fingerprint to the on-disk sentinel.
- * Caller (typically discoverAdapters) interprets the result:
- *   - 'match'        — proceed to load LOCAL-EXPLICIT adapters
- *   - 'no-sentinel'  — refuse all LOCAL-EXPLICIT; tell operator to run
- *                       `massu adapters resync-local-fingerprint` once
- *   - 'drift'        — refuse all LOCAL-EXPLICIT; surface the additions/
- *                       removals so the operator can audit + ack via
- *                       `massu adapters resync-local-fingerprint`
- *
- * Note: `localPaths` MUST be the AdapterLocalPathSchema-validated +
- * POSIX-normalized content from getConfig() — passing a non-normalized
- * array will produce a fingerprint that doesn't match what the CLI
- * wrote. Drift-prevention from the schema side: AdapterLocalPathSchema
- * runs at config-parse time, so any code path reading
- * cfg.adapters.local always sees the canonical form.
- */
-export function checkFingerprintDrift(
-  localPaths: ReadonlyArray<string>,
-  projectRoot: string,
-  path: string = FINGERPRINT_PATH,
-): FingerprintCheckResult {
-  const sentinel = readFingerprintSentinel(path);
-  if (!sentinel) {
-    return {
-      kind: 'no-sentinel',
-      reason:
-        `no adapters-local-fingerprint sentinel at ${path}. ` +
-        `If you have entries in adapters.local, run \`massu adapters resync-local-fingerprint\` ` +
-        `to acknowledge them once.`,
-    };
-  }
-  const currentFingerprint = computeLocalFingerprint(localPaths, projectRoot);
-  if (currentFingerprint === sentinel.fingerprint) {
-    return { kind: 'match', sentinel };
-  }
-  return {
-    kind: 'drift',
-    sentinel,
-    currentFingerprint,
-    reason:
-      `adapters.local fingerprint drift: sentinel was ${sentinel.fingerprint.slice(0, 16)}... ` +
-      `(written by ${sentinel.source} at ${sentinel.ts}); current is ${currentFingerprint.slice(0, 16)}.... ` +
-      `If you edited massu.config.yaml directly OR a postinstall script may have mutated adapters.local, ` +
-      `audit the diff and run \`massu adapters resync-local-fingerprint\` to acknowledge.`,
-  };
-}