@novacraft-engineering/pulsar-cli 1.2.0 → 1.2.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novacraft-engineering/pulsar-cli",
-  "version": "1.2.0",
-  "description": "Pulsar OTA release CLI — bundle, hash, and ship React Native updates over-the-air.",
+  "version": "1.2.1",
+  "description": "Pulsar OTA release CLI \u2014 bundle, hash, and ship React Native updates over-the-air.",
   "type": "module",
   "bin": {
     "pulsar": "./pulsar.js"
@@ -26,7 +26,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/hash.test.js"
+    "test": "node test/hash.test.js && node test/security.test.js"
   },
   "keywords": [
     "react-native",

package/pulsar.js

@@ -23,7 +23,7 @@ function cmdKeygen() {
     publicKeyEncoding: {type: 'spki', format: 'pem'},
     privateKeyEncoding: {type: 'pkcs8', format: 'pem'},
   });
-  fs.writeFileSync('pulsar-private.pem', privateKey);
+  fs.writeFileSync('pulsar-private.pem', privateKey, {mode: 0o600});
   fs.writeFileSync('pulsar-public.pem', publicKey);
   console.log('✓ wrote pulsar-private.pem (keep secret, use with --private-key) and pulsar-public.pem');
   console.log('  Put the public key in Info.plist <key>CodePushPublicKey</key> to require signed updates.');
@@ -41,8 +41,11 @@ function loadConfig() {
 }
 
 function saveConfig(config) {
-  fs.mkdirSync(CONFIG_DIR, {recursive: true});
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+  // The config holds a bearer token — keep the dir and file owner-only so other local users on a
+  // shared host can't read the session.
+  fs.mkdirSync(CONFIG_DIR, {recursive: true, mode: 0o700});
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), {mode: 0o600});
+  try { fs.chmodSync(CONFIG_FILE, 0o600); } catch { /* best-effort on pre-existing files */ }
 }
 
 async function api(pathname, {method = 'GET', body, headers = {}, raw, allowAnonymous, onUploadProgress} = {}) {
@@ -153,19 +156,26 @@ function dashboardUrl(apiUrl) {
 // Browser login: spin up a throwaway localhost server, open the dashboard's /cli-login page which
 // (once you're signed in) redirects back here with a token. No password ever touches the terminal.
 function browserLogin(apiUrl) {
+  // A random nonce ties the callback to THIS login: the dashboard echoes it back and we reject any
+  // callback whose state doesn't match, so a stray page spraying the loopback port range can't inject
+  // its own token into our config (login fixation).
+  const state = crypto.randomUUID();
   return new Promise((resolve, reject) => {
     const server = http.createServer((req, res) => {
       const requestUrl = new URL(req.url, 'http://127.0.0.1');
+      if (requestUrl.pathname !== '/callback') { res.writeHead(204); res.end(); return; }
       const token = requestUrl.searchParams.get('token');
-      res.writeHead(token ? 200 : 400, {'content-type': 'text/html'});
-      res.end(`<!doctype html><meta charset="utf-8"><body style="font-family:system-ui;background:#080a0f;color:#eef2f7;display:grid;place-items:center;height:100vh;margin:0"><div style="text-align:center"><h2 style="font-weight:600">${token ? 'Pulsar CLI authorized ✓' : 'No token received'}</h2><p style="color:#8f98a6">You can close this tab and return to your terminal.</p></div></body>`);
+      const ok = token && requestUrl.searchParams.get('state') === state;
+      res.writeHead(ok ? 200 : 400, {'content-type': 'text/html'});
+      res.end(`<!doctype html><meta charset="utf-8"><body style="font-family:system-ui;background:#080a0f;color:#eef2f7;display:grid;place-items:center;height:100vh;margin:0"><div style="text-align:center"><h2 style="font-weight:600">${ok ? 'Pulsar CLI authorized ✓' : 'Authorization failed'}</h2><p style="color:#8f98a6">You can close this tab and return to your terminal.</p></div></body>`);
+      if (!ok) return;
       setTimeout(() => { try { server.close(); } catch {} }, 100);
-      if (token) resolve(token); else reject(new Error('No token received from the browser'));
+      resolve(token);
     });
     server.on('error', reject);
     server.listen(0, '127.0.0.1', () => {
       const {port} = server.address();
-      const authUrl = `${dashboardUrl(apiUrl)}/cli-login?port=${port}`;
+      const authUrl = `${dashboardUrl(apiUrl)}/cli-login?port=${port}&state=${state}`;
       console.log(`\n  Authorize the CLI in your browser:\n  ${authUrl}\n`);
       openBrowser(authUrl);
       console.log('  Waiting for authorization…');
@@ -511,28 +521,33 @@ async function cmdKeys(args) {
   console.log(`✓ wrote ${Object.keys(vars).length} key(s) to ${target} (${written.size} updated, ${missing.length} added)`);
 }
 
-const [command, ...rest] = process.argv.slice(2);
-const commands = {
-  login: cmdLogin,
-  apps: cmdApps,
-  release: cmdRelease,
-  'release-train': cmdReleaseTrain,
-  promote: cmdPromote,
-  rollback: cmdRollback,
-  deployment: cmdDeployment,
-  history: cmdHistory,
-  patch: cmdPatch,
-  keygen: cmdKeygen,
-  keys: cmdKeys,
-};
-
-const ANONYMOUS_COMMANDS = new Set(['login', 'keygen']);
-
-if (commands[command] && !ANONYMOUS_COMMANDS.has(command) && !loadConfig().token) {
-  die('Not authenticated. Run: pulsar login <apiUrl>');
-}
+export {saveConfig, browserLogin};
+
+// Only dispatch when run as the CLI — importing the module (e.g. from tests) must not execute a command.
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const [command, ...rest] = process.argv.slice(2);
+  const commands = {
+    login: cmdLogin,
+    apps: cmdApps,
+    release: cmdRelease,
+    'release-train': cmdReleaseTrain,
+    promote: cmdPromote,
+    rollback: cmdRollback,
+    deployment: cmdDeployment,
+    history: cmdHistory,
+    patch: cmdPatch,
+    keygen: cmdKeygen,
+    keys: cmdKeys,
+  };
+
+  const ANONYMOUS_COMMANDS = new Set(['login', 'keygen']);
 
-(commands[command] || (() => {
-  console.log('pulsar <login|apps|keys|release|release-train|promote|rollback|deployment|history|patch|keygen>');
-  process.exit(command ? 1 : 0);
-}))(rest);
+  if (commands[command] && !ANONYMOUS_COMMANDS.has(command) && !loadConfig().token) {
+    die('Not authenticated. Run: pulsar login <apiUrl>');
+  }
+
+  (commands[command] || (() => {
+    console.log('pulsar <login|apps|keys|release|release-train|promote|rollback|deployment|history|patch|keygen>');
+    process.exit(command ? 1 : 0);
+  }))(rest);
+}