@monster-orange/den 0.4.19 → 0.4.21

package/src/shared/secrets/op-token.ts

@@ -0,0 +1,270 @@
+/**
+ * Where the 1Password service-account token comes from, and why `op` failed.
+ *
+ * A Den running as a service (launchd, systemd) does not read a login shell,
+ * so `op` has no OP_SERVICE_ACCOUNT_TOKEN of its own. `secrets.onepassword.token`
+ * in config/local/user.yml (per machine, never the distribution's) says
+ * where to read one:
+ *
+ *   keychain:<service>   macOS: `security find-generic-password -s <service> -w`
+ *   file:<path>          a file whose mode is exactly 600; `~` expands
+ *   env:<VAR>            an env var of this process (the default is
+ *                        env:OP_SERVICE_ACCOUNT_TOKEN)
+ *
+ * The token is read when a ref is resolved, never cached, and goes only into
+ * the `op` child's env. Nothing here returns it in text: every message names
+ * the source, never the token.
+ */
+import { execFile, execFileSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { promisify } from "util";
+
+const execFileAsync = promisify(execFile);
+
+export const OP_TOKEN_ENV = "OP_SERVICE_ACCOUNT_TOKEN";
+const SECURITY_TIMEOUT_MS = 10_000;
+
+export type OpTokenSource =
+  | { kind: "keychain"; service: string }
+  | { kind: "file"; path: string }
+  | { kind: "env"; name: string };
+
+export const DEFAULT_OP_TOKEN_SOURCE: OpTokenSource = {
+  kind: "env",
+  name: OP_TOKEN_ENV,
+};
+
+const SHAPE =
+  "must be keychain:<service>, file:<path> or env:<VAR> (for example env:OP_SERVICE_ACCOUNT_TOKEN)";
+
+/** Why `raw` is not a valid token source, or null. Never echoes `raw`. */
+export function opTokenSourceError(raw: unknown): string | null {
+  if (typeof raw !== "string") return SHAPE;
+  const m = /^(keychain|file|env):(.*)$/s.exec(raw);
+  if (!m) return SHAPE;
+  const [, kind, rest] = m;
+  // eslint-disable-next-line no-control-regex
+  if (rest.trim() === "" || /[\u0000-\u001f]/.test(rest))
+    return `${kind}: needs a value on one line; ${SHAPE}`;
+  if (kind === "env" && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(rest))
+    return `env: needs an env var name; ${SHAPE}`;
+  if (kind === "keychain" && rest.startsWith("-"))
+    return `keychain: service name must not start with "-"; ${SHAPE}`;
+  return null;
+}
+
+/** The source `raw` names (unset: the default). Throws, naming `where`. */
+export function parseOpTokenSource(
+  raw: unknown,
+  where = "secrets.onepassword.token",
+): OpTokenSource {
+  if (raw === undefined || raw === null) return DEFAULT_OP_TOKEN_SOURCE;
+  const err = opTokenSourceError(raw);
+  if (err) throw new Error(`${where} ${err}`);
+  const s = raw as string;
+  const i = s.indexOf(":");
+  const kind = s.slice(0, i);
+  const rest = s.slice(i + 1);
+  if (kind === "keychain") return { kind, service: rest };
+  if (kind === "file") return { kind, path: rest };
+  return { kind: "env", name: rest };
+}
+
+/** "keychain: <service>", "file: <path>" or "env: <VAR>": what people see. */
+export function describeOpTokenSource(src: OpTokenSource): string {
+  if (src.kind === "keychain") return `keychain: ${src.service}`;
+  if (src.kind === "file") return `file: ${src.path}`;
+  return `env: ${src.name}`;
+}
+
+export type OpTokenResult =
+  | { ok: true; token: string }
+  | { ok: false; reason: string };
+
+export interface OpTokenDeps {
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  home?: string;
+}
+
+function expandHome(p: string, home: string): string {
+  if (p === "~") return home;
+  if (p.startsWith("~/")) return path.join(home, p.slice(2));
+  return p;
+}
+
+function fail(src: OpTokenSource, why: string): OpTokenResult {
+  return {
+    ok: false,
+    reason: `token source ${describeOpTokenSource(src)}: ${why}`,
+  };
+}
+
+function readTokenFile(src: { kind: "file"; path: string }, home: string) {
+  const file = expandHome(src.path, home);
+  let st: fs.Stats;
+  try {
+    st = fs.statSync(file);
+  } catch {
+    return fail(src, "file not found or not readable");
+  }
+  if (!st.isFile()) return fail(src, "not a regular file");
+  const mode = st.mode & 0o777;
+  if (mode !== 0o600)
+    return fail(
+      src,
+      `file mode is ${mode.toString(8).padStart(3, "0")}; it must be 600 (chmod 600 the file)`,
+    );
+  let text: string;
+  try {
+    text = fs.readFileSync(file, "utf-8");
+  } catch {
+    return fail(src, "file not readable");
+  }
+  const token = text.replace(/[\r\n]+$/, "");
+  return token ? ({ ok: true, token } as const) : fail(src, "file is empty");
+}
+
+function fromEnv(src: { kind: "env"; name: string }, env: NodeJS.ProcessEnv) {
+  const v = env[src.name];
+  return v
+    ? ({ ok: true, token: v } as const)
+    : fail(src, "env var is not set");
+}
+
+const NOT_MAC = "the macOS keychain is not available on this system";
+
+/**
+ * Read the token now. Never cached. The failure reason names the source,
+ * never the token.
+ */
+export async function readOpToken(
+  src: OpTokenSource,
+  deps: OpTokenDeps = {},
+): Promise<OpTokenResult> {
+  const env = deps.env ?? process.env;
+  const home = deps.home ?? os.homedir();
+  if (src.kind === "env") return fromEnv(src, env);
+  if (src.kind === "file") return readTokenFile(src, home);
+  if ((deps.platform ?? process.platform) !== "darwin")
+    return fail(src, NOT_MAC);
+  try {
+    const { stdout } = await execFileAsync(
+      "security",
+      ["find-generic-password", "-s", src.service, "-w"],
+      { timeout: SECURITY_TIMEOUT_MS, env },
+    );
+    const token = String(stdout).replace(/[\r\n]+$/, "");
+    return token ? { ok: true, token } : fail(src, "keychain item is empty");
+  } catch {
+    return fail(src, "keychain item not found or not readable");
+  }
+}
+
+/**
+ * Whether the source yields a token, for `doctor`: the same checks, but a
+ * keychain item is only looked up (no `-w`), so nothing is read and no
+ * keychain prompt can appear. Returns the reason, or null when it works.
+ */
+export function opTokenSourceProblem(
+  src: OpTokenSource,
+  deps: OpTokenDeps = {},
+): string | null {
+  const env = deps.env ?? process.env;
+  const home = deps.home ?? os.homedir();
+  if (src.kind === "env") {
+    const r = fromEnv(src, env);
+    return r.ok ? null : r.reason;
+  }
+  if (src.kind === "file") {
+    const r = readTokenFile(src, home);
+    return r.ok ? null : r.reason;
+  }
+  if ((deps.platform ?? process.platform) !== "darwin")
+    return `token source ${describeOpTokenSource(src)}: ${NOT_MAC}`;
+  try {
+    execFileSync("security", ["find-generic-password", "-s", src.service], {
+      timeout: SECURITY_TIMEOUT_MS,
+      env,
+      stdio: "ignore",
+    });
+    return null;
+  } catch {
+    return `token source ${describeOpTokenSource(src)}: keychain item not found`;
+  }
+}
+
+export type OpFailureCode =
+  | "no_token"
+  | "no_access"
+  | "not_found"
+  | "rate_limited"
+  | "token_source"
+  | "unknown";
+
+export interface OpFailureInfo {
+  code: OpFailureCode;
+  /** Plain words, safe to show. */
+  text: string;
+}
+
+/**
+ * Map `op`'s stderr to one plain reason. Pure. `redact` lists strings (the
+ * token) to blank out of the unknown case's summary.
+ */
+export function mapOpFailure(
+  stderr: string,
+  redact: readonly string[] = [],
+): OpFailureInfo {
+  const s = stderr ?? "";
+  if (
+    /not signed in|no active session|service account token|sign ?in|session (has )?expired|authenticat|no accounts? (configured|found)/i.test(
+      s,
+    )
+  )
+    return {
+      code: "no_token",
+      text: "1Password has no service-account token or session for this process",
+    };
+  if (/rate.?limit|too many requests|\b429\b/i.test(s))
+    return { code: "rate_limited", text: "1Password rate limited the request" };
+  if (
+    /isn't a vault|is not a vault|don't have access|do not have access|doesn't have access|not authorized|forbidden|permission|\b403\b|access denied/i.test(
+      s,
+    )
+  )
+    return { code: "no_access", text: "no access to the vault" };
+  if (
+    /isn't an item|isn't a field|is not an item|not found|no such|could not find|couldn't find|doesn't exist|does not exist|no (item|field)|more than one item/i.test(
+      s,
+    )
+  )
+    return { code: "not_found", text: "item or field not found" };
+  let line =
+    s
+      .split(/\r?\n/)
+      .map((l) =>
+        l.replace(/^\[\w+\]\s*\d{4}\/\d\d\/\d\d \d\d:\d\d:\d\d\s*/, "").trim(),
+      )
+      .find((l) => l) ?? "";
+  for (const r of redact) if (r) line = line.split(r).join("[hidden]");
+  line = line.replace(/op:\/\/\S+/g, "[ref]");
+  if (line.length > 100) line = `${line.slice(0, 100)}...`;
+  return {
+    code: "unknown",
+    text: line ? `1Password failed: ${line}` : "1Password failed (no detail)",
+  };
+}
+
+/** A failed 1Password read, with a reason that is safe to show. */
+export class OpFailure extends Error {
+  constructor(
+    readonly code: OpFailureCode,
+    message: string,
+  ) {
+    super(message);
+    this.name = "OpFailure";
+  }
+}

package/src/shared/secrets/secret-env.ts

@@ -80,6 +80,8 @@ export function assertSecretEnvSpec(
 export interface SecretEnvMissing {
   key: string;
   ref: string;
+  /** Why, in plain words, when the provider said (never a value). */
+  reason?: string;
 }
 
 export type SecretEnvResolution =
@@ -87,8 +89,10 @@ export type SecretEnvResolution =
   | { ok: false; missing: SecretEnvMissing[]; message: string };
 
 /**
- * The failure text for unresolved keys: key, ref and provider, never a value
- * and never the provider's own error output (which could echo one).
+ * The failure text for unresolved keys: key, ref and provider, and the
+ * provider's reason when it gave one (a mapped phrase such as "no access to
+ * the vault"), never a value and never its raw error output (which could
+ * echo one).
  */
 export function describeSecretEnvMissing(
   target: string,
@@ -96,7 +100,8 @@ export function describeSecretEnvMissing(
   provider: string,
 ): string {
   const lines = missing.map(
-    (m) => `  ${m.key} (ref ${m.ref}, provider ${provider}): not resolved`,
+    (m) =>
+      `  ${m.key} (ref ${m.ref}, provider ${provider}): not resolved${m.reason ? `: ${m.reason}` : ""}`,
   );
   return (
     `${target}: ${missing.length} secret_env key(s) could not be resolved; not starting it:\n` +
@@ -120,17 +125,25 @@ export async function resolveSecretEnv(
     entries.map(async ([key, raw]) => {
       if (secretEnvRefError(raw)) return { key, raw, value: null };
       let value: string | null = null;
+      let reason: string | undefined;
       try {
-        value = await provider.tryGet(parseSecretEnvRef(raw));
+        const ref = parseSecretEnvRef(raw);
+        if (provider.tryGetWithReason) {
+          ({ value, reason } = await provider.tryGetWithReason(ref));
+        } else value = await provider.tryGet(ref);
       } catch {
         value = null;
       }
-      return { key, raw, value };
+      return { key, raw, value, reason };
     }),
   );
   const missing = results
     .filter((r) => !r.value)
-    .map((r) => ({ key: r.key, ref: String(r.raw) }));
+    .map((r) => ({
+      key: r.key,
+      ref: String(r.raw),
+      ...(r.reason ? { reason: r.reason } : {}),
+    }));
   if (missing.length)
     return {
       ok: false,

package/src/shared/secrets/strategies.ts

@@ -27,6 +27,7 @@ import { DopplerProvider } from "./doppler.js";
 import { EnvProvider } from "./env.js";
 import { NoneProvider } from "./none.js";
 import { OnePasswordProvider } from "./onepassword.js";
+import { parseOpTokenSource } from "./op-token.js";
 import type { SecretsConfig } from "./index.js";
 import type { SecretRef, SecretsProvider } from "./types.js";
 
@@ -162,6 +163,11 @@ const onepassword: SecretsStrategy = {
         // From the distribution's config or the engineer's shell; never a
         // built-in account.
         account: c.onepassword?.account,
+        // Per machine (user.yml); validated when the config is read.
+        tokenSource:
+          c.onepassword?.token === undefined
+            ? undefined
+            : parseOpTokenSource(c.onepassword.token),
         timeoutMs: OP_CLI_TIMEOUT_MS,
       }),
     cli: { bin: "op", formula: "1password-cli" },

package/src/shared/secrets/types.ts

@@ -50,6 +50,14 @@ export interface SecretsProvider {
   get(ref: SecretRef): Promise<string>;
   /** Read a secret, returning null instead of throwing. */
   tryGet(ref: SecretRef): Promise<string | null>;
+  /**
+   * Like tryGet, plus a plain-words reason when it is null (op's own: no
+   * token, no access to the vault, not found, rate limited). Optional. The
+   * reason never carries a secret value or a token.
+   */
+  tryGetWithReason?(
+    ref: SecretRef,
+  ): Promise<{ value: string | null; reason?: string }>;
   /** Write (create or overwrite) a secret. Throws on failure. */
   set(ref: SecretRef, value: string): Promise<void>;
   /** Check the backend is usable before `den up`/`restart`. */

package/src/shared/web-session.ts

@@ -1,7 +1,8 @@
 /**
  * SEC-1b (SEC-1 spec §2): the browser's sign-in.
  *
- *  - The login code: one-time, valid for 60 s, derived from web.secret.
+ *  - The login code: one-time, valid for `web.login_link_ttl` (D16: 5
+ *    minutes unless set; it was 60 s), derived from web.secret.
  *    `v1.<nonce>.<expiry>.<mac>`, the mac HMAC-SHA256(secret, the rest). The
  *    CLI mints it (it reads the secret as the same OS user); the server
  *    checks the mac in constant time and the expiry, and records the nonce
@@ -24,7 +25,12 @@ import * as yaml from "yaml";
 import { parseMachineName, parseSshUser } from "./cli-command.js";
 import { getStateDir } from "./paths.js";
 
-export const LOGIN_CODE_TTL_MS = 60_000;
+/** D16: how long a sign-in link lasts unless `web.login_link_ttl` says. */
+export const LOGIN_CODE_TTL_MS = 5 * 60_000;
+/** The longest `web.login_link_ttl` may be (and the most a code is believed). */
+export const LOGIN_CODE_MAX_TTL_MS = 60 * 60_000;
+/** The shortest `web.login_link_ttl` may be. */
+export const LOGIN_CODE_MIN_TTL_MS = 30_000;
 /** Clock skew allowed between the CLI that mints a code and the server. */
 const LOGIN_CODE_SKEW_MS = 5_000;
 const LOGIN_CONTEXT = "den-login-v1:";
@@ -57,13 +63,14 @@ function mac(secret: Buffer, body: string): Buffer {
     .digest();
 }
 
-/** A fresh login code, valid for 60 s from `now`. */
+/** A fresh login code, valid for `ttlMs` (web.login_link_ttl) from `now`. */
 export function mintLoginCode(
   secret: Buffer,
   now: number = Date.now(),
+  ttlMs: number = LOGIN_CODE_TTL_MS,
 ): string {
   const nonce = randomBytes(16).toString("base64url");
-  const body = `v1.${nonce}.${(now + LOGIN_CODE_TTL_MS).toString(36)}`;
+  const body = `v1.${nonce}.${(now + ttlMs).toString(36)}`;
   return `${body}.${mac(secret, body).toString("base64url")}`;
 }
 
@@ -72,7 +79,8 @@ export type LoginCodeCheck =
   | { ok: false; reason: "malformed" | "bad_mac" | "expired" };
 
 /**
- * Whether `code` is one this secret minted and still in its 60 s. The mac is
+ * Whether `code` is one this secret minted and still in its time (at most
+ * LOGIN_CODE_MAX_TTL_MS: web.login_link_ttl's ceiling). The mac is
  * compared in constant time. Single use is the caller's (consumeCode).
  */
 export function checkLoginCode(
@@ -93,7 +101,7 @@ export function checkLoginCode(
   if (
     !Number.isFinite(expiresAt) ||
     now >= expiresAt ||
-    expiresAt - now > LOGIN_CODE_TTL_MS + LOGIN_CODE_SKEW_MS
+    expiresAt - now > LOGIN_CODE_MAX_TTL_MS + LOGIN_CODE_SKEW_MS
   )
     return { ok: false, reason: "expired" };
   return { ok: true, nonce: m[2], expiresAt };
@@ -201,6 +209,77 @@ export interface WebAuthConfig {
    * Den runs as. "": no account on the page.
    */
   sshUser?: string;
+  /**
+   * `web.owner_github` (D17, user.yml only): the GitHub login of the person
+   * who runs this instance, recorded from `gh` at `web up` or `service
+   * install`. With no owner linked, that login's GitHub sign-in, from any
+   * machine, becomes the owner.
+   */
+  ownerGithub?: string;
+  /**
+   * `web.allowed_github_org` (D17; the distribution config, or user.yml):
+   * with no owner linked, a member of this GitHub org who proves they are
+   * at this machine ("This is my computer") becomes the owner.
+   */
+  allowedGithubOrg?: string;
+  /** The file `web.allowed_github_org` came from. */
+  allowedGithubOrgFile?: string;
+  /**
+   * `web.login_link_ttl` (D16; user.yml over the distribution config): how
+   * long a sign-in link lasts, in ms. Unset: LOGIN_CODE_TTL_MS (5 minutes).
+   */
+  loginLinkTtlMs: number;
+}
+
+/** A GitHub login (or org name): letters, digits, single dashes, ≤ 39. */
+const GITHUB_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+
+/** `web.owner_github` or `web.allowed_github_org`: a GitHub name, or unset. */
+export function parseGithubName(
+  v: unknown,
+  key: string,
+  file: string,
+): string | undefined {
+  if (v === undefined || v === null) return undefined;
+  const s = typeof v === "string" ? v.trim().replace(/^@/, "") : "";
+  if (s === "" && typeof v === "string") return undefined;
+  if (!GITHUB_NAME.test(s))
+    throw new Error(
+      `${key} (${file}) must be a GitHub name (letters, digits and dashes), got ${JSON.stringify(v)}`,
+    );
+  return s;
+}
+
+/**
+ * `web.login_link_ttl`: `90s`, `5m`, `1h`, or a number of seconds, between
+ * 30 s and 60 min. Unset: undefined. Throws naming the key otherwise.
+ */
+export function parseLoginLinkTtl(
+  v: unknown,
+  file: string,
+): number | undefined {
+  if (v === undefined || v === null) return undefined;
+  const m =
+    typeof v === "number"
+      ? [String(v), String(v), "s"]
+      : typeof v === "string"
+        ? /^\s*(\d+)\s*(s|m|h)?\s*$/i.exec(v)
+        : null;
+  const ms = m
+    ? Number(m[1]) *
+      ({ s: 1000, m: 60_000, h: 3_600_000 } as Record<string, number>)[
+        (m[2] ?? "s").toLowerCase()
+      ]
+    : NaN;
+  if (
+    !Number.isFinite(ms) ||
+    ms < LOGIN_CODE_MIN_TTL_MS ||
+    ms > LOGIN_CODE_MAX_TTL_MS
+  )
+    throw new Error(
+      `web.login_link_ttl (${file}) must be a time between 30s and 60m (such as 5m), got ${JSON.stringify(v)}`,
+    );
+  return ms;
 }
 
 /** `web.edge_unattested`'s values. */
@@ -300,7 +379,34 @@ export function readWebAuthConfig(
     user.ssh_user !== undefined
       ? parseSshUser(user.ssh_user)
       : parseSshUser(team.ssh_user);
+  const ownerGithub = parseGithubName(
+    user.owner_github,
+    "web.owner_github",
+    "config/local/user.yml",
+  );
+  const userOrg = parseGithubName(
+    user.allowed_github_org,
+    "web.allowed_github_org",
+    "config/local/user.yml",
+  );
+  const teamOrg = parseGithubName(
+    team.allowed_github_org,
+    "web.allowed_github_org",
+    configFile,
+  );
+  const allowedGithubOrg = userOrg ?? teamOrg;
+  const ttl =
+    parseLoginLinkTtl(user.login_link_ttl, "config/local/user.yml") ??
+    parseLoginLinkTtl(team.login_link_ttl, configFile);
   return {
+    ...(ownerGithub ? { ownerGithub } : {}),
+    ...(allowedGithubOrg
+      ? {
+          allowedGithubOrg,
+          allowedGithubOrgFile: userOrg ? "config/local/user.yml" : configFile,
+        }
+      : {}),
+    loginLinkTtlMs: ttl ?? LOGIN_CODE_TTL_MS,
     ...(machineName ? { machineName } : {}),
     ...(sshUser !== undefined ? { sshUser } : {}),
     allowPlainHttpRemote: plain === true,