@positronic/cli 0.0.58 → 0.0.60

package/dist/src/lib/jwt-auth.js

@@ -0,0 +1,579 @@
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    if (staticProps) _defineProperties(Constructor, staticProps);
+    return Constructor;
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import { SignJWT, importPKCS8, base64url } from 'jose';
+import { existsSync } from 'fs';
+import { createPrivateKey } from 'crypto';
+import { loadPrivateKey, getPrivateKeyFingerprint, getPublicKeyFingerprint, resolvePrivateKeyPath } from './ssh-key-utils.js';
+import { ProjectConfigManager } from '../commands/project-config-manager.js';
+import { AgentSigner } from './ssh-agent-signer.js';
+/**
+ * Check if an error indicates an encrypted key
+ */ function isEncryptedKeyError(error) {
+    if (_instanceof(error, Error) && error.name === 'KeyEncryptedError') {
+        return true;
+    }
+    return false;
+}
+/**
+ * JWT Auth Provider for authenticating API requests
+ * Uses SSH private keys to sign short-lived JWTs
+ * Falls back to ssh-agent for encrypted keys
+ */ export var JwtAuthProvider = /*#__PURE__*/ function() {
+    "use strict";
+    function JwtAuthProvider() {
+        _class_call_check(this, JwtAuthProvider);
+        _define_property(this, "privateKey", null);
+        _define_property(this, "fingerprint", null);
+        _define_property(this, "initialized", false);
+        _define_property(this, "initError", null);
+        // Agent fallback support
+        _define_property(this, "encryptedKeyPath", null);
+        _define_property(this, "agentSigner", null);
+        _define_property(this, "agentKey", null);
+        _define_property(this, "useAgent", false);
+        this.initialize();
+    }
+    _create_class(JwtAuthProvider, [
+        {
+            key: "initialize",
+            value: function initialize() {
+                try {
+                    // Get configured path from project config manager
+                    var configManager = new ProjectConfigManager();
+                    var configuredPath = configManager.getPrivateKeyPath();
+                    var keyPath = resolvePrivateKeyPath(configuredPath);
+                    if (!existsSync(keyPath)) {
+                        this.initError = new Error("Private key not found at ".concat(keyPath, ". Run 'px auth login' to configure your SSH key, or set POSITRONIC_PRIVATE_KEY environment variable."));
+                        return;
+                    }
+                    this.privateKey = loadPrivateKey(keyPath);
+                    this.fingerprint = getPrivateKeyFingerprint(this.privateKey);
+                    this.initialized = true;
+                } catch (error) {
+                    if (isEncryptedKeyError(error)) {
+                        // Store the path for agent fallback - we'll try the agent in createToken()
+                        var configManager1 = new ProjectConfigManager();
+                        var configuredPath1 = configManager1.getPrivateKeyPath();
+                        this.encryptedKeyPath = resolvePrivateKeyPath(configuredPath1);
+                        this.initError = _instanceof(error, Error) ? error : new Error('Key is encrypted');
+                    } else {
+                        this.initError = _instanceof(error, Error) ? error : new Error('Failed to initialize JWT auth provider');
+                    }
+                }
+            }
+        },
+        {
+            /**
+   * Check if the provider is ready to create JWTs
+   * Returns true if we have a direct key OR if we have an encrypted key
+   * that might work with agent fallback
+   */ key: "isReady",
+            value: function isReady() {
+                // Direct key is loaded and ready
+                if (this.initialized && this.privateKey !== null) {
+                    return true;
+                }
+                // Encrypted key might work with agent fallback
+                if (this.encryptedKeyPath !== null) {
+                    return true;
+                }
+                return false;
+            }
+        },
+        {
+            /**
+   * Check if we have an encrypted key that requires agent fallback
+   */ key: "hasEncryptedKey",
+            value: function hasEncryptedKey() {
+                return this.encryptedKeyPath !== null;
+            }
+        },
+        {
+            /**
+   * Get the error that occurred during initialization, if any
+   */ key: "getError",
+            value: function getError() {
+                return this.initError;
+            }
+        },
+        {
+            /**
+   * Get the fingerprint of the loaded private key
+   */ key: "getFingerprint",
+            value: function getFingerprint() {
+                return this.fingerprint;
+            }
+        },
+        {
+            key: "getAlgorithm",
+            value: /**
+   * Map SSH key type to JWT algorithm
+   */ function getAlgorithm() {
+                if (!this.privateKey) {
+                    throw new Error('Private key not loaded');
+                }
+                return this.getAlgorithmForKeyType(this.privateKey.type, this.privateKey.curve);
+            }
+        },
+        {
+            key: "getAlgorithmForKeyType",
+            value: /**
+   * Map SSH key type string to JWT algorithm
+   */ function getAlgorithmForKeyType(keyType, curve) {
+                if (keyType === 'rsa') {
+                    return 'RS256';
+                } else if (keyType === 'ecdsa') {
+                    // ECDSA curve determines algorithm
+                    if (curve === 'nistp256') {
+                        return 'ES256';
+                    } else if (curve === 'nistp384') {
+                        return 'ES384';
+                    } else if (curve === 'nistp521') {
+                        return 'ES512';
+                    }
+                    // Default to ES256 for unknown curves
+                    return 'ES256';
+                } else if (keyType === 'ed25519') {
+                    return 'EdDSA';
+                }
+                throw new Error("Unsupported key type: ".concat(keyType));
+            }
+        },
+        {
+            key: "getPkcs8Pem",
+            value: /**
+   * Convert the SSH private key to PKCS8 PEM format
+   * Ed25519 keys need special handling because sshpk's PKCS8 output
+   * is not compatible with Node.js/OpenSSL
+   */ function getPkcs8Pem() {
+                if (!this.privateKey) {
+                    throw new Error('Private key not loaded');
+                }
+                if (this.privateKey.type === 'ed25519') {
+                    // For Ed25519, sshpk's PKCS8 output includes the public key in a format
+                    // that Node.js/OpenSSL doesn't understand. Instead, we construct a JWK
+                    // from the raw key parts and let Node's crypto handle the conversion.
+                    // sshpk stores Ed25519 key data in 'k' (seed) and 'A' (public) parts
+                    var parts = this.privateKey.part;
+                    var seed = parts.k.data;
+                    var publicKey = parts.A.data;
+                    // Construct JWK and let Node's crypto convert to PKCS8
+                    var jwk = {
+                        kty: 'OKP',
+                        crv: 'Ed25519',
+                        d: seed.toString('base64url'),
+                        x: publicKey.toString('base64url')
+                    };
+                    var keyObj = createPrivateKey({
+                        key: jwk,
+                        format: 'jwk'
+                    });
+                    return keyObj.export({
+                        type: 'pkcs8',
+                        format: 'pem'
+                    });
+                }
+                // For RSA and ECDSA, sshpk's PKCS8 output works fine
+                return this.privateKey.toString('pkcs8');
+            }
+        },
+        {
+            key: "createToken",
+            value: /**
+   * Create a short-lived JWT for authentication
+   */ function createToken() {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                // If we have a direct private key, use the standard jose signing path
+                                if (this.privateKey && this.fingerprint) {
+                                    return [
+                                        2,
+                                        this.createTokenDirect()
+                                    ];
+                                }
+                                if (!this.encryptedKeyPath) return [
+                                    3,
+                                    2
+                                ];
+                                return [
+                                    4,
+                                    this.tryAgentFallback()
+                                ];
+                            case 1:
+                                _state.sent();
+                                _state.label = 2;
+                            case 2:
+                                // If agent fallback succeeded, use agent signing
+                                if (this.useAgent && this.agentSigner && this.agentKey && this.fingerprint) {
+                                    return [
+                                        2,
+                                        this.createTokenWithAgent()
+                                    ];
+                                }
+                                // No authentication method available
+                                throw this.initError || new Error('JWT auth provider not initialized');
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "createTokenDirect",
+            value: /**
+   * Create JWT using direct private key (jose library)
+   */ function createTokenDirect() {
+                return _async_to_generator(function() {
+                    var algorithm, pkcs8Pem, joseKey, jwt;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                if (!this.privateKey || !this.fingerprint) {
+                                    throw new Error('Private key not loaded');
+                                }
+                                algorithm = this.getAlgorithm();
+                                // Convert SSH private key to PKCS8 PEM format
+                                pkcs8Pem = this.getPkcs8Pem();
+                                return [
+                                    4,
+                                    importPKCS8(pkcs8Pem, algorithm)
+                                ];
+                            case 1:
+                                joseKey = _state.sent();
+                                return [
+                                    4,
+                                    new SignJWT({}).setProtectedHeader({
+                                        alg: algorithm
+                                    }).setSubject(this.fingerprint).setIssuedAt().setExpirationTime('30s').sign(joseKey)
+                                ];
+                            case 2:
+                                jwt = _state.sent();
+                                return [
+                                    2,
+                                    jwt
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "tryAgentFallback",
+            value: /**
+   * Try to use ssh-agent for signing when private key is encrypted
+   */ function tryAgentFallback() {
+                return _async_to_generator(function() {
+                    var pubKeyPath, fingerprint, agent, agentKey;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                if (!this.encryptedKeyPath) {
+                                    return [
+                                        2
+                                    ];
+                                }
+                                // Get fingerprint from public key file
+                                pubKeyPath = this.encryptedKeyPath + '.pub';
+                                if (!existsSync(pubKeyPath)) {
+                                    throw new Error("Key is encrypted and public key file not found at ".concat(pubKeyPath, ".\n") + "Cannot determine key fingerprint for ssh-agent lookup.");
+                                }
+                                fingerprint = getPublicKeyFingerprint(pubKeyPath);
+                                agent = new AgentSigner();
+                                if (!agent.isAvailable()) {
+                                    throw new Error("Key is encrypted and ssh-agent is not running.\n" + "Start ssh-agent or use an unencrypted key.");
+                                }
+                                return [
+                                    4,
+                                    agent.hasKey(fingerprint)
+                                ];
+                            case 1:
+                                agentKey = _state.sent();
+                                if (!agentKey) {
+                                    throw new Error("Key is encrypted and not loaded in ssh-agent.\n" + "Run: ssh-add ".concat(this.encryptedKeyPath));
+                                }
+                                this.agentSigner = agent;
+                                this.agentKey = agentKey;
+                                this.fingerprint = fingerprint;
+                                this.useAgent = true;
+                                this.initError = null;
+                                this.initialized = true;
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "createTokenWithAgent",
+            value: /**
+   * Create JWT using ssh-agent for signing
+   * Manually constructs the JWT since jose expects to do signing itself
+   */ function createTokenWithAgent() {
+                return _async_to_generator(function() {
+                    var keyType, curve, algorithm, header, encodedHeader, now, payload, encodedPayload, signingInput, signature, signatureBytes, encodedSignature;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                if (!this.agentSigner || !this.agentKey || !this.fingerprint) {
+                                    throw new Error('Agent signing not configured');
+                                }
+                                // Get algorithm from agent key type
+                                keyType = this.agentKey.type;
+                                curve = this.agentKey.curve;
+                                algorithm = this.getAlgorithmForKeyType(keyType, curve);
+                                // Build JWT header
+                                header = {
+                                    alg: algorithm
+                                };
+                                encodedHeader = base64url.encode(JSON.stringify(header));
+                                // Build JWT payload
+                                now = Math.floor(Date.now() / 1000);
+                                payload = {
+                                    sub: this.fingerprint,
+                                    iat: now,
+                                    exp: now + 30
+                                };
+                                encodedPayload = base64url.encode(JSON.stringify(payload));
+                                // Create signing input
+                                signingInput = "".concat(encodedHeader, ".").concat(encodedPayload);
+                                return [
+                                    4,
+                                    this.agentSigner.sign(this.agentKey, Buffer.from(signingInput))
+                                ];
+                            case 1:
+                                signature = _state.sent();
+                                // Convert sshpk.Signature to raw bytes for JWT
+                                // sshpk's toBuffer() gives us the raw signature bytes
+                                signatureBytes = signature.toBuffer('raw');
+                                encodedSignature = base64url.encode(signatureBytes);
+                                return [
+                                    2,
+                                    "".concat(signingInput, ".").concat(encodedSignature)
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return JwtAuthProvider;
+}();
+// Singleton instance
+var providerInstance = null;
+/**
+ * Get the singleton JWT auth provider instance
+ */ export function getJwtAuthProvider() {
+    if (!providerInstance) {
+        providerInstance = new JwtAuthProvider();
+    }
+    return providerInstance;
+}
+/**
+ * Reset the JWT auth provider singleton
+ * Call this after auth config changes to force reinitialization with new key
+ */ export function resetJwtAuthProvider() {
+    providerInstance = null;
+}
+/**
+ * Check if JWT auth is available
+ */ export function isAuthAvailable() {
+    return getJwtAuthProvider().isReady();
+}
+/**
+ * Get the Authorization header if auth is available
+ * Throws if there's an auth configuration error
+ * Returns empty object with warning if no key is configured
+ */ export function getAuthHeader() {
+    return _async_to_generator(function() {
+        var provider, error, token;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    provider = getJwtAuthProvider();
+                    if (!provider.isReady()) {
+                        error = provider.getError();
+                        if (error) {
+                            throw error;
+                        }
+                        console.warn('Warning: No SSH key configured for authentication. Run "px auth login" to configure.');
+                        return [
+                            2,
+                            {}
+                        ];
+                    }
+                    return [
+                        4,
+                        provider.createToken()
+                    ];
+                case 1:
+                    token = _state.sent();
+                    return [
+                        2,
+                        {
+                            Authorization: "Bearer ".concat(token)
+                        }
+                    ];
+            }
+        });
+    })();
+}