@ory/argus 0.14.0 → 1.0.1

package/dist/runtime-credential.js

@@ -0,0 +1,572 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCredentialStoreCommand = exports.CredentialStoreCommandError = void 0;
+exports.configureSystemCaTrustForDefaultFetch = configureSystemCaTrustForDefaultFetch;
+exports.canonicalProjectUrl = canonicalProjectUrl;
+exports.canonicalCredentialIdentity = canonicalCredentialIdentity;
+exports.credentialAccount = credentialAccount;
+exports.createOsTalosCredentialStore = createOsTalosCredentialStore;
+exports.talosRuntimeCredential = talosRuntimeCredential;
+exports.resolveRuntimeCredential = resolveRuntimeCredential;
+exports.enrollTalosRuntimeCredential = enrollTalosRuntimeCredential;
+exports.enrollTalosChildRuntimeCredential = enrollTalosChildRuntimeCredential;
+exports.authenticatedRuntimeRequest = authenticatedRuntimeRequest;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const nodeTls = __importStar(require("node:tls"));
+const CREDENTIAL_SERVICE = "com.ory.agent-security.runtime-credential";
+const MACOS_CREDENTIAL_SCRIPT = String.raw `
+ObjC.import('Foundation');
+ObjC.import('Security');
+ObjC.bindFunction('CFDataGetLength', ['long', ['void *']]);
+ObjC.bindFunction('CFDataGetBytePtr', ['void *', ['void *']]);
+
+const inputData = $.NSFileHandle.fileHandleWithStandardInput.readDataToEndOfFile;
+const input = $.NSString.alloc.initWithDataEncoding(inputData, $.NSUTF8StringEncoding);
+const request = JSON.parse(ObjC.unwrap(input));
+// JXA exposes Security's CFString globals as pointer refs, so use their stable values.
+const query = $.NSMutableDictionary.alloc.init;
+query.setObjectForKey($('genp'), $('class'));
+query.setObjectForKey($(request.service), $('svce'));
+query.setObjectForKey($(request.account), $('acct'));
+
+if (request.operation === 'load') {
+  query.setObjectForKey($(true), $('r_Data'));
+  query.setObjectForKey($('m_LimitOne'), $('m_Limit'));
+  const result = Ref();
+  const status = $.SecItemCopyMatching(query, result);
+  if (Number(status) !== -25300) {
+    if (Number(status) !== 0) throw new Error('Keychain read failed with status ' + status);
+    const length = $.CFDataGetLength(result[0]);
+    const bytes = $.CFDataGetBytePtr(result[0]);
+    const data = $.NSData.dataWithBytesLength(bytes, length);
+    $.NSFileHandle.fileHandleWithStandardOutput.writeData(data);
+  }
+} else if (request.operation === 'save') {
+  const value = $(request.payload).dataUsingEncoding($.NSUTF8StringEncoding);
+  const attributes = $.NSMutableDictionary.alloc.init;
+  attributes.setObjectForKey(value, $('v_Data'));
+  let status = $.SecItemUpdate(query, attributes);
+  if (Number(status) === -25300) {
+    query.setObjectForKey(value, $('v_Data'));
+    status = $.SecItemAdd(query, null);
+  }
+  if (Number(status) !== 0) throw new Error('Keychain write failed with status ' + status);
+} else {
+  throw new Error('Unsupported credential operation');
+}
+`;
+const WINDOWS_CREDENTIAL_SCRIPT = String.raw `
+Add-Type @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public static class OryCredentialManager {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  private struct Credential {
+    public uint Flags;
+    public uint Type;
+    public string TargetName;
+    public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public uint CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public uint Persist;
+    public uint AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+
+  [DllImport("Advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+  private static extern bool CredRead(string target, uint type, uint flags, out IntPtr credential);
+
+  [DllImport("Advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  private static extern bool CredWrite(ref Credential credential, uint flags);
+
+  [DllImport("Advapi32.dll", SetLastError = false)]
+  private static extern void CredFree(IntPtr credential);
+
+  public static string Read(string target) {
+    IntPtr pointer;
+    if (!CredRead(target, 1, 0, out pointer)) {
+      int error = Marshal.GetLastWin32Error();
+      if (error == 1168) return null;
+      throw new Win32Exception(error);
+    }
+    try {
+      Credential credential = (Credential)Marshal.PtrToStructure(pointer, typeof(Credential));
+      int size = checked((int)credential.CredentialBlobSize);
+      byte[] bytes = new byte[size];
+      Marshal.Copy(credential.CredentialBlob, bytes, 0, bytes.Length);
+      return Encoding.UTF8.GetString(bytes);
+    } finally {
+      CredFree(pointer);
+    }
+  }
+
+  public static void Write(string target, string account, string value) {
+    byte[] bytes = Encoding.UTF8.GetBytes(value);
+    IntPtr blob = Marshal.AllocHGlobal(bytes.Length);
+    try {
+      Marshal.Copy(bytes, 0, blob, bytes.Length);
+      Credential credential = new Credential {
+        Type = 1,
+        TargetName = target,
+        CredentialBlobSize = (uint)bytes.Length,
+        CredentialBlob = blob,
+        Persist = 2,
+        UserName = account
+      };
+      if (!CredWrite(ref credential, 0)) {
+        throw new Win32Exception(Marshal.GetLastWin32Error());
+      }
+    } finally {
+      for (int i = 0; i < bytes.Length; i++) bytes[i] = 0;
+      Marshal.Copy(bytes, 0, blob, bytes.Length);
+      Marshal.FreeHGlobal(blob);
+    }
+  }
+}
+'@
+$request = [Console]::In.ReadToEnd() | ConvertFrom-Json
+$target = $request.service + ':' + $request.account
+if ($request.operation -eq 'load') {
+  $value = [OryCredentialManager]::Read($target)
+  if ($null -eq $value) { exit 44 }
+  [Console]::Out.Write($value)
+} elseif ($request.operation -eq 'save') {
+  [OryCredentialManager]::Write($target, $request.account, $request.payload)
+} else {
+  throw 'Unsupported credential operation'
+}
+`;
+const WINDOWS_POWERSHELL_ARGS = [
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-EncodedCommand",
+    Buffer.from(WINDOWS_CREDENTIAL_SCRIPT, "utf16le").toString("base64"),
+];
+const configuredTlsProviders = new WeakSet();
+/**
+ * Make subsequent default Node TLS connections trust both Node's existing CA
+ * set and the operating system trust store. This is process-local and does not
+ * disable certificate verification.
+ */
+function configureSystemCaTrustForDefaultFetch(provider = nodeTls) {
+    const providerKey = provider;
+    if (configuredTlsProviders.has(providerKey))
+        return false;
+    if (!provider.getCACertificates || !provider.setDefaultCACertificates)
+        return false;
+    const certificates = new Set([
+        ...provider.getCACertificates("default"),
+        ...provider.getCACertificates("system"),
+    ]);
+    provider.setDefaultCACertificates([...certificates]);
+    configuredTlsProviders.add(providerKey);
+    return true;
+}
+function safeFetchFailure(operation, error) {
+    const cause = error instanceof Error
+        ? error.cause
+        : undefined;
+    const rawCode = cause && typeof cause === "object" && "code" in cause
+        ? cause.code
+        : undefined;
+    const code = typeof rawCode === "string" && /^[A-Z0-9_]+$/.test(rawCode)
+        ? rawCode
+        : undefined;
+    return new Error(`${operation} failed${code ? ` (${code})` : ""}`);
+}
+class CredentialStoreCommandError extends Error {
+    exitCode;
+    causeCode;
+    constructor(message, exitCode, causeCode) {
+        super(message);
+        this.exitCode = exitCode;
+        this.causeCode = causeCode;
+    }
+}
+exports.CredentialStoreCommandError = CredentialStoreCommandError;
+const runCredentialStoreCommand = (command, args, options = {}) => new Promise((resolve, reject) => {
+    const child = (0, node_child_process_1.spawn)(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.on("error", (error) => {
+        reject(new CredentialStoreCommandError(`Could not execute ${command}`, undefined, error.code));
+    });
+    child.on("close", (code) => {
+        if (code === 0)
+            resolve({ stdout });
+        else
+            reject(new CredentialStoreCommandError(`${command} exited unsuccessfully`, code ?? undefined));
+    });
+    child.stdin.end(options.input);
+});
+exports.runCredentialStoreCommand = runCredentialStoreCommand;
+/** Normalize equivalent project URLs before deriving their credential-store key. */
+function canonicalProjectUrl(projectUrl) {
+    const value = projectUrl.trim();
+    if (value.includes("\\"))
+        throw new Error("Project URL must not contain backslashes");
+    const authority = value.match(/^[a-z][a-z0-9+.-]*:\/\/([^/?#]+)/i)?.[1];
+    if (authority && /[^\x00-\x7f]/.test(authority)) {
+        throw new Error("Project URL hostname must use ASCII notation");
+    }
+    const rawHost = authority?.startsWith("[") ? undefined : authority?.split("@").pop()?.split(":")[0];
+    if (rawHost && /^[0-9.]+$/.test(rawHost)) {
+        const octets = rawHost.split(".");
+        if (octets.length !== 4 ||
+            octets.some((octet) => !octet || String(Number(octet)) !== octet || Number(octet) > 255)) {
+            throw new Error("Project URL must use canonical IPv4 notation");
+        }
+    }
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error("Project URL must use HTTP or HTTPS");
+    }
+    if (url.username || url.password)
+        throw new Error("Project URL must not contain user information");
+    url.hash = "";
+    url.search = "";
+    const path = url.pathname.replace(/\/+$/, "");
+    return `${url.origin}${path}`;
+}
+function canonicalCredentialIdentity(identity) {
+    if (typeof identity === "string") {
+        return {
+            projectUrl: canonicalProjectUrl(identity),
+            harness: "unknown",
+            sessionId: "sessionless",
+            kind: "agent",
+        };
+    }
+    const base = {
+        projectUrl: canonicalProjectUrl(identity.projectUrl),
+        harness: identity.harness.trim() || "unknown",
+        sessionId: identity.sessionId.trim() || "sessionless",
+    };
+    if (identity.kind === "agent")
+        return { ...base, kind: "agent" };
+    const subAgentType = identity.subAgentType.trim();
+    const perSpawnId = identity.perSpawnId.trim();
+    if (!subAgentType || !perSpawnId) {
+        throw new Error("A sub-agent credential requires type and spawn identifiers");
+    }
+    return { ...base, kind: "subagent", subAgentType, perSpawnId };
+}
+function credentialAccount(identity) {
+    return (0, node_crypto_1.createHash)("sha256")
+        .update(JSON.stringify(canonicalCredentialIdentity(identity)))
+        .digest("hex");
+}
+function parseStoredCredential(value, expectedIdentity) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error("Stored Talos credential is not valid JSON");
+    }
+    if (!parsed || typeof parsed !== "object"
+        || typeof parsed.credential !== "string"
+        || !parsed.credential
+        || typeof parsed.actorId !== "string"
+        || !parsed.actorId) {
+        throw new Error("Stored Talos credential has an unsupported format");
+    }
+    if (parsed.version === 1) {
+        return parsed;
+    }
+    if (parsed.version !== 2
+        || typeof parsed.identity !== "object") {
+        throw new Error("Stored Talos credential has an unsupported format");
+    }
+    const stored = parsed;
+    if (JSON.stringify(canonicalCredentialIdentity(stored.identity))
+        !== JSON.stringify(canonicalCredentialIdentity(expectedIdentity))) {
+        throw new Error("Stored Talos credential belongs to another runtime identity");
+    }
+    return stored;
+}
+/** OS-backed Talos store. Secrets are never placed in process arguments. */
+function createOsTalosCredentialStore(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const run = options.runCommand ?? exports.runCredentialStoreCommand;
+    if (platform !== "darwin" && platform !== "linux" && platform !== "win32") {
+        throw new Error(`No supported OS credential store is available on ${platform}`);
+    }
+    return {
+        async load(identity) {
+            const account = credentialAccount(identity);
+            try {
+                const result = platform === "darwin"
+                    ? await run("osascript", ["-l", "JavaScript", "-e", MACOS_CREDENTIAL_SCRIPT], {
+                        input: JSON.stringify({
+                            operation: "load",
+                            service: CREDENTIAL_SERVICE,
+                            account,
+                        }),
+                    })
+                    : platform === "linux"
+                        ? await run("secret-tool", [
+                            "lookup", "service", CREDENTIAL_SERVICE, "project", account,
+                        ])
+                        : await run("powershell.exe", WINDOWS_POWERSHELL_ARGS, {
+                            input: JSON.stringify({
+                                operation: "load",
+                                service: CREDENTIAL_SERVICE,
+                                account,
+                            }),
+                        });
+                if (!result.stdout.trim())
+                    return undefined;
+                return parseStoredCredential(result.stdout.trim(), identity);
+            }
+            catch (error) {
+                if (error instanceof CredentialStoreCommandError) {
+                    const missing = platform === "linux" ? error.exitCode === 1 : error.exitCode === 44;
+                    if (missing)
+                        return undefined;
+                }
+                throw error;
+            }
+        },
+        async save(identity, secret) {
+            const account = credentialAccount(identity);
+            const input = `${JSON.stringify(secret)}\n`;
+            if (platform === "darwin") {
+                await run("osascript", ["-l", "JavaScript", "-e", MACOS_CREDENTIAL_SCRIPT], {
+                    input: JSON.stringify({
+                        operation: "save",
+                        service: CREDENTIAL_SERVICE,
+                        account,
+                        payload: input.trim(),
+                    }),
+                });
+            }
+            else if (platform === "linux") {
+                await run("secret-tool", [
+                    "store", `--label=Ory Agent Security runtime credential`,
+                    "service", CREDENTIAL_SERVICE, "project", account,
+                ], { input });
+            }
+            else {
+                await run("powershell.exe", WINDOWS_POWERSHELL_ARGS, {
+                    input: JSON.stringify({
+                        operation: "save",
+                        service: CREDENTIAL_SERVICE,
+                        account,
+                        payload: input.trim(),
+                    }),
+                });
+            }
+        },
+    };
+}
+function talosRuntimeCredential(apiKey, options = {}) {
+    const key = apiKey.trim();
+    return {
+        kind: "talos",
+        ...(options.subject ? { subject: options.subject } : {}),
+        authenticate: async ({ url, init, authorizationHeader, fetch: requestFetch, usesDefaultFetch, }) => {
+            const headerName = authorizationHeader === "authorization"
+                ? "authorization"
+                : "X-Ory-Agent-Authorization";
+            const headers = {
+                ...Object.fromEntries(new Headers(init.headers)),
+                [headerName]: `Bearer ${key}`,
+            };
+            const fetchImpl = options.fetch ?? requestFetch;
+            try {
+                if (!options.fetch && usesDefaultFetch) {
+                    (options.configureSystemCaTrust ?? configureSystemCaTrustForDefaultFetch)();
+                }
+                return await fetchImpl(url, { ...init, headers });
+            }
+            catch (error) {
+                if (options.fetch || !usesDefaultFetch)
+                    throw error;
+                throw safeFetchFailure("Talos runtime request", error);
+            }
+        },
+    };
+}
+/** Resolve only noninteractive runtime credentials. No persisted state is read. */
+function resolveRuntimeCredential(options = {}) {
+    if (options.requestAuthenticator) {
+        return {
+            kind: "injected",
+            ...(options.subject ? { subject: options.subject } : {}),
+            authenticate: options.requestAuthenticator,
+        };
+    }
+    const apiKey = (options.env ?? process.env).ORY_AGENT_API_KEY?.trim();
+    if (!apiKey)
+        return undefined;
+    return talosRuntimeCredential(apiKey, { subject: options.subject, fetch: options.fetch });
+}
+/** Explicitly enroll a Talos credential and optionally persist it in an OS store. */
+async function enrollTalosRuntimeCredential(options) {
+    let response;
+    try {
+        if (!options.fetch) {
+            (options.configureSystemCaTrust ?? configureSystemCaTrustForDefaultFetch)();
+        }
+        response = await (options.fetch ?? globalThis.fetch)(`${options.agentSecurityUrl.replace(/\/+$/, "")}/agent-security/v1/agents:enroll`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${options.userToken}`,
+                "Idempotency-Key": options.idempotencyKey,
+            },
+            body: JSON.stringify({
+                project_url: options.projectUrl,
+                name: options.name,
+                method: "talos_api_key",
+            }),
+            signal: options.signal ?? AbortSignal.timeout(30_000),
+        });
+    }
+    catch (error) {
+        if (options.fetch)
+            throw error;
+        throw safeFetchFailure("Talos enrollment request", error);
+    }
+    if (!response.ok) {
+        throw Object.assign(new Error(`HTTP ${response.status}`), { status: response.status });
+    }
+    const body = await response.json();
+    if (typeof body.credential !== "string" || body.credential.length === 0) {
+        throw new Error("Enrollment response missing credential");
+    }
+    if (typeof body.actor_id !== "string" || body.actor_id.length === 0) {
+        throw new Error("Enrollment response missing actor_id");
+    }
+    const stored = {
+        version: 2,
+        credential: body.credential,
+        actorId: body.actor_id,
+        ...(typeof body.credential_id === "string" ? { credentialId: body.credential_id } : {}),
+        ...(typeof body.expires_at === "string" ? { expiresAt: body.expires_at } : {}),
+        identity: canonicalCredentialIdentity(options.identity ?? options.projectUrl),
+    };
+    const warnings = [];
+    if (options.credentialStore) {
+        try {
+            await options.credentialStore.save(options.identity ?? options.projectUrl, stored);
+        }
+        catch {
+            warnings.push("The Talos runtime credential was issued but could not be saved to the OS credential store; it will remain available only in this process");
+        }
+    }
+    return {
+        actorId: body.actor_id,
+        warnings,
+        credential: talosRuntimeCredential(body.credential, {
+            subject: body.actor_id,
+            fetch: options.fetch,
+        }),
+    };
+}
+/** Enroll a separately keyed child using the authenticated parent runtime. */
+async function enrollTalosChildRuntimeCredential(options) {
+    const response = await authenticatedRuntimeRequest(options.parentCredential, {
+        url: `${options.agentSecurityUrl.replace(/\/+$/, "")}/agent-security/v1/agents:enroll-child`,
+        init: {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "Idempotency-Key": options.idempotencyKey,
+            },
+            body: JSON.stringify({
+                project_url: options.projectUrl,
+                name: options.name,
+                type_name: options.subAgentType,
+            }),
+            signal: options.signal ?? AbortSignal.timeout(30_000),
+        },
+        authorizationHeader: "authorization",
+        fetch: options.fetch,
+    });
+    if (!response.ok) {
+        throw Object.assign(new Error(`HTTP ${response.status}`), { status: response.status });
+    }
+    const body = await response.json();
+    if (typeof body.credential !== "string" || !body.credential) {
+        throw new Error("Child enrollment response missing credential");
+    }
+    if (typeof body.actor_id !== "string" || !body.actor_id) {
+        throw new Error("Child enrollment response missing actor_id");
+    }
+    const stored = {
+        version: 2,
+        credential: body.credential,
+        actorId: body.actor_id,
+        ...(typeof body.credential_id === "string" ? { credentialId: body.credential_id } : {}),
+        ...(typeof body.expires_at === "string" ? { expiresAt: body.expires_at } : {}),
+        identity: canonicalCredentialIdentity(options.identity),
+    };
+    const warnings = [];
+    if (options.credentialStore) {
+        try {
+            await options.credentialStore.save(options.identity, stored);
+        }
+        catch {
+            warnings.push("The child Talos credential was issued but could not be saved to the OS credential store; it will remain available only in this process");
+        }
+    }
+    return {
+        actorId: body.actor_id,
+        warnings,
+        credential: talosRuntimeCredential(body.credential, {
+            subject: body.actor_id,
+            fetch: options.fetch,
+        }),
+    };
+}
+async function authenticatedRuntimeRequest(credential, request) {
+    return credential.authenticate({
+        ...request,
+        fetch: request.fetch ?? globalThis.fetch,
+        usesDefaultFetch: request.fetch === undefined,
+    });
+}