@morit/cli 1.0.0

package/src/secure-store.js

@@ -0,0 +1,130 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { homedir, userInfo } from "node:os";
+import { join } from "node:path";
+import { normalizeApiOrigin } from "./config.js";
+
+const credentialDirectory = join(homedir(), ".morit");
+const credentialPath = join(credentialDirectory, "credentials.json");
+const serviceName = "morit-cli";
+const ACCESS_TOKEN = /^sk_live_[A-Za-z0-9]{32}$/;
+
+function powershell(script, input = "") {
+  const result = spawnSync(
+    "powershell.exe",
+    ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script],
+    { input, encoding: "utf8", windowsHide: true, maxBuffer: 1024 * 1024 },
+  );
+  if (result.status !== 0) throw new Error("Windows credential protection failed");
+  return result.stdout.trim();
+}
+
+function windowsProtect(token) {
+  return powershell(
+    "$v=[Console]::In.ReadToEnd();$b=[Text.Encoding]::UTF8.GetBytes($v);"
+      + "$p=[Security.Cryptography.ProtectedData]::Protect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);"
+      + "[Convert]::ToBase64String($p)",
+    token,
+  );
+}
+
+function windowsUnprotect(payload) {
+  return powershell(
+    "$v=[Console]::In.ReadToEnd();$b=[Convert]::FromBase64String($v);"
+      + "$p=[Security.Cryptography.ProtectedData]::Unprotect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);"
+      + "[Text.Encoding]::UTF8.GetString($p)",
+    payload,
+  );
+}
+
+function linuxSecretToolAvailable() {
+  try {
+    execFileSync("secret-tool", ["--version"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function metadata() {
+  try { return JSON.parse(await readFile(credentialPath, "utf8")); }
+  catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error("Morit credential metadata is unreadable; run morit logout and login again");
+  }
+}
+
+async function writeMetadata(value) {
+  await mkdir(credentialDirectory, { recursive: true, mode: 0o700 });
+  const temporary = `${credentialPath}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+  await rename(temporary, credentialPath);
+  await chmod(credentialPath, 0o600).catch(() => undefined);
+}
+
+export async function saveCredential({ token, apiUrl, organizationId }) {
+  if (!ACCESS_TOKEN.test(token || "")) throw new Error("Developer access token is invalid");
+  const normalizedApiUrl = normalizeApiOrigin(apiUrl);
+  const account = userInfo().username;
+  if (process.platform === "win32") {
+    await writeMetadata({ version: 1, storage: "dpapi", payload: windowsProtect(token), api_url: normalizedApiUrl, organization_id: organizationId });
+    return;
+  }
+  if (process.platform === "darwin") {
+    const result = spawnSync("security", ["add-generic-password", "-a", account, "-s", serviceName, "-w", token, "-U"], {
+      stdio: "ignore",
+    });
+    if (result.status !== 0) throw new Error("Unable to save token in macOS Keychain");
+    await writeMetadata({ version: 1, storage: "keychain", account, api_url: normalizedApiUrl, organization_id: organizationId });
+    return;
+  }
+  if (!linuxSecretToolAvailable()) {
+    throw new Error("A desktop keyring is required; install secret-tool or use MORIT_ACCESS_TOKEN for this session");
+  }
+  const result = spawnSync("secret-tool", ["store", "--label=Morit CLI", "service", serviceName, "account", account], {
+    input: token,
+    encoding: "utf8",
+  });
+  if (result.status !== 0) throw new Error("Unable to save token in the desktop keyring");
+  await writeMetadata({ version: 1, storage: "secret-tool", account, api_url: normalizedApiUrl, organization_id: organizationId });
+}
+
+export async function loadCredential() {
+  const environmentToken = process.env.MORIT_ACCESS_TOKEN?.trim();
+  if (environmentToken) {
+    if (!ACCESS_TOKEN.test(environmentToken)) throw new Error("MORIT_ACCESS_TOKEN is invalid");
+    return {
+      token: environmentToken,
+      apiUrl: normalizeApiOrigin(process.env.MORIT_API_URL?.trim() || "https://developers.moring.co"),
+      organizationId: process.env.MORIT_ORGANIZATION_ID?.trim() || null,
+      ephemeral: true,
+    };
+  }
+  const value = await metadata();
+  if (!value) return null;
+  const apiUrl = normalizeApiOrigin(value.api_url);
+  let token;
+  if (value.storage === "dpapi" && process.platform === "win32") {
+    token = windowsUnprotect(value.payload);
+  } else if (value.storage === "keychain" && process.platform === "darwin") {
+    token = execFileSync("security", ["find-generic-password", "-a", value.account, "-s", serviceName, "-w"], { encoding: "utf8" }).trim();
+  } else if (value.storage === "secret-tool" && linuxSecretToolAvailable()) {
+    token = execFileSync("secret-tool", ["lookup", "service", serviceName, "account", value.account], { encoding: "utf8" }).trim();
+  } else {
+    throw new Error("Saved credentials belong to a different platform; run morit logout and login again");
+  }
+  if (!ACCESS_TOKEN.test(token)) throw new Error("Saved Morit credential is invalid");
+  return { token, apiUrl, organizationId: value.organization_id, ephemeral: false };
+}
+
+export async function clearCredential() {
+  const value = await metadata();
+  if (value?.storage === "keychain" && process.platform === "darwin") {
+    spawnSync("security", ["delete-generic-password", "-a", value.account, "-s", serviceName], { stdio: "ignore" });
+  } else if (value?.storage === "secret-tool" && linuxSecretToolAvailable()) {
+    spawnSync("secret-tool", ["clear", "service", serviceName, "account", value.account], { stdio: "ignore" });
+  }
+  await unlink(credentialPath).catch((error) => {
+    if (error.code !== "ENOENT") throw error;
+  });
+}