@redaktyn/cli 0.0.0-stage → 1.1.0

package/redaktyn-scan.mjs

@@ -0,0 +1,565 @@
+#!/usr/bin/env node
+/**
+ * Redaktyn CLI — scan git staged files / paths for enrolled secret digests (ZK: sends HMAC hex only).
+ *
+ * Requires:
+ *   REDAKTYN_SERVER_URL       — API base URL
+ *   REDAKTYN_PASSPHRASE       — org passphrase (local HMAC only; never sent)
+ *   REDAKTYN_DEVICE_TOKEN or REDAKTYN_TOKEN — extension JWT or admin JWT (Bearer)
+ *
+ * Optional:
+ *   REDAKTYN_ORG_ID — must match JWT orgId when set (sanity check)
+ */
+
+import { execSync } from "node:child_process";
+import { createRequire } from "node:module";
+import {
+  readFileSync,
+  existsSync,
+  readdirSync,
+  statSync,
+  writeFileSync,
+  chmodSync,
+} from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const require = createRequire(import.meta.url);
+
+/** Resolve `@redaktyn/shared` from monorepo root or local install. */
+function loadShared() {
+  try {
+    return require("@redaktyn/shared");
+  } catch {
+    console.error(
+      "Cannot load @redaktyn/shared. Run `npm install` from the repo root, then `npm run build -w @redaktyn/shared`."
+    );
+    process.exit(2);
+  }
+}
+
+const {
+  deriveHmacKeyFromPassphrase,
+  hmacDigestHex,
+  normalizeSecretPlaintextForMatch,
+  normalizeSecretPlaintextCollapsed,
+  normalizeSecretPlaintextLower,
+  extractAddedLinesFromUnifiedDiff,
+} = loadShared();
+
+const MAX_FILE_BYTES = 5 * 1024 * 1024;
+const MAX_SCAN_CHARS = 512 * 1024;
+
+/**
+ * Digests per request. The server accepts 50,000 and rate-limits by principal,
+ * so this leaves headroom while keeping the number of round trips low.
+ */
+const DIGESTS_PER_REQUEST = 20000;
+
+/**
+ * Ceiling on total digests for one scan, as a guard against a pathological
+ * input rather than a budget anyone should hit. Passing it is reported on
+ * stderr and sets a non-zero exit, because a hook that ran out of budget and
+ * said "clean" is worse than one that says it could not finish.
+ */
+const MAX_TOTAL_DIGESTS = 3_000_000;
+
+/**
+ * The three passes the extension runs, in the same order and with the same
+ * normalisation.
+ *
+ * This file used to run the first one only, which made the hook weaker than the
+ * browser it stands in for: a secret committed with inserted spaces or altered
+ * case passed `--staged` and was then blocked on paste. Enrolment stores all
+ * three digests and the server checks every submitted digest against all three
+ * columns, so the gap was only ever here.
+ *
+ * Each pass normalises the whole text and then slides raw windows over it,
+ * which is what the extension does. Normalising each window instead — the
+ * previous behaviour — trims its ends, so a window could never align with a
+ * secret when the surrounding text carried CRLF or zero-width characters.
+ */
+const PASSES = [
+  { name: "exact", transform: normalizeSecretPlaintextForMatch, lengthKey: "length" },
+  { name: "whitespace-collapse", transform: normalizeSecretPlaintextCollapsed, lengthKey: "lengthStripped" },
+  { name: "case-fold", transform: normalizeSecretPlaintextLower, lengthKey: "lengthLower" },
+];
+
+const BINARY_EXT = new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".ico",
+  ".pdf",
+  ".zip",
+  ".gz",
+  ".exe",
+  ".dll",
+  ".so",
+  ".dylib",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".mp4",
+  ".mp3",
+  ".wasm",
+  ".bin",
+]);
+
+function parseArgs(argv) {
+  const opts = { exclude: [], _: [] };
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--staged") opts.staged = true;
+    else if (a === "--json") opts.json = true;
+    else if (a === "--no-color") opts.noColor = true;
+    else if (a === "--verbose") opts.verbose = true;
+    else if (a === "--file") opts.file = argv[++i];
+    else if (a === "--dir") opts.dir = argv[++i];
+    else if (a === "--org-id") opts.orgId = argv[++i];
+    else if (a === "--server") opts.server = argv[++i];
+    else if (a === "--exclude") opts.exclude.push(argv[++i]);
+    else if (a.startsWith("-")) {
+      console.error(`Unknown flag: ${a}`);
+      process.exit(1);
+    } else opts._.push(a);
+  }
+  const cmd = opts._[0];
+  return { ...opts, cmd };
+}
+
+function decodeJwtPayload(token) {
+  try {
+    const p = token.split(".")[1];
+    if (!p) return null;
+    const padded = p + "=".repeat((4 - (p.length % 4)) % 4);
+    const json = Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+
+function shouldSkipPath(rel, excludeGlobs) {
+  const n = rel.replace(/\\/g, "/");
+  if (n.includes("node_modules/") || n.startsWith(".git/")) return true;
+  for (const g of excludeGlobs) {
+    if (g.includes("*")) {
+      const re = new RegExp("^" + g.replace(/\*/g, ".*").replace(/\//g, "\\/") + "$");
+      if (re.test(n)) return true;
+    } else if (n.includes(g)) return true;
+  }
+  return false;
+}
+
+function readTextFileSafe(fp, verbose) {
+  const st = statSync(fp);
+  if (!st.isFile()) return null;
+  if (st.size > MAX_FILE_BYTES) {
+    if (verbose) console.warn(`Skipping large file (${st.size} bytes): ${fp}`);
+    return null;
+  }
+  const ext = path.extname(fp).toLowerCase();
+  if (BINARY_EXT.has(ext)) return null;
+  try {
+    const buf = readFileSync(fp);
+    if (buf.includes(0)) return null;
+    return buf.toString("utf8");
+  } catch {
+    return null;
+  }
+}
+
+function collectFilesRecursive(dir, exclude, out = []) {
+  for (const name of readdirSync(dir)) {
+    const fp = path.join(dir, name);
+    const rel = path.relative(process.cwd(), fp);
+    if (shouldSkipPath(rel, exclude)) continue;
+    const st = statSync(fp);
+    if (st.isDirectory()) collectFilesRecursive(fp, exclude, out);
+    else out.push(fp);
+  }
+  return out;
+}
+
+/**
+ * Yields every window digest for every pass, in batches ready to POST.
+ *
+ * A generator rather than one array because the previous version stopped at
+ * 8,000 digests and returned what it had — silently, so a large diff was
+ * scanned for its first few kilobytes and reported clean for the rest. Batching
+ * lets the whole input be checked instead of the beginning of it.
+ */
+function* digestBatches(text, secrets, key, stats) {
+  const t = text.length > MAX_SCAN_CHARS ? text.slice(0, MAX_SCAN_CHARS) : text;
+  if (text.length > MAX_SCAN_CHARS) {
+    console.warn(`Content truncated to ${MAX_SCAN_CHARS} characters for scan.`);
+    stats.truncatedChars = true;
+  }
+
+  let batch = [];
+  for (const pass of PASSES) {
+    const lengths = new Set(
+      secrets
+        .map((s) => Number(s[pass.lengthKey]))
+        .filter((n) => Number.isFinite(n) && n > 0)
+    );
+    if (lengths.size === 0) continue;
+
+    const passText = pass.transform(t);
+    stats.passesRun.push(pass.name);
+
+    for (const L of lengths) {
+      if (L > passText.length) continue;
+      for (let i = 0; i + L <= passText.length; i++) {
+        batch.push(hmacDigestHex(passText.slice(i, i + L), key));
+        stats.total++;
+        if (stats.total >= MAX_TOTAL_DIGESTS) {
+          stats.exhausted = true;
+          if (batch.length > 0) yield batch;
+          return;
+        }
+        if (batch.length >= DIGESTS_PER_REQUEST) {
+          yield batch;
+          batch = [];
+        }
+      }
+    }
+  }
+  if (batch.length > 0) yield batch;
+}
+
+async function httpPostJson(url, token, body) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify(body),
+  });
+  const txt = await res.text();
+  let data;
+  try {
+    data = txt ? JSON.parse(txt) : {};
+  } catch {
+    data = { raw: txt };
+  }
+  if (!res.ok) {
+    const err = new Error(data.error || res.statusText || "HTTP error");
+    err.status = res.status;
+    err.body = data;
+    throw err;
+  }
+  return data;
+}
+
+async function fetchSecretsMeta(serverUrl, token) {
+  const url = `${serverUrl.replace(/\/+$/, "")}/api/secrets`;
+  const res = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`GET /api/secrets failed: ${res.status} ${body.slice(0, 200)}`);
+  }
+  const text = await res.text();
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`GET /api/secrets: invalid JSON response`);
+  }
+}
+
+async function main() {
+  if (process.argv.includes("--help") || process.argv.includes("-h")) {
+    printHelp();
+    process.exit(0);
+  }
+
+  const args = parseArgs(process.argv);
+  const cmd = args.cmd;
+
+  if (cmd === "install-hooks") {
+    installGitHooks();
+    return;
+  }
+  if (cmd === "uninstall-hooks") {
+    uninstallGitHooks();
+    return;
+  }
+  if (cmd === "status") {
+    await cmdStatus(args);
+    return;
+  }
+
+  if (!args.staged && !args.file && !args.dir) {
+    printHelp();
+    process.exit(2);
+  }
+
+  const serverUrl =
+    args.server || process.env["REDAKTYN_SERVER_URL"] || process.env["REDAKTYN_SERVER"];
+  const token =
+    process.env["REDAKTYN_DEVICE_TOKEN"] ||
+    process.env["REDAKTYN_TOKEN"] ||
+    process.env["REDAKTYN_JWT"];
+  const passphrase = process.env["REDAKTYN_PASSPHRASE"];
+  const envOrgId = args.orgId || process.env["REDAKTYN_ORG_ID"];
+
+  if (!serverUrl || !token || !passphrase) {
+    console.error(
+      "Missing env: REDAKTYN_SERVER_URL, REDAKTYN_PASSPHRASE, and REDAKTYN_DEVICE_TOKEN (or REDAKTYN_TOKEN)."
+    );
+    process.exit(2);
+  }
+
+  const payload = decodeJwtPayload(token);
+  const orgId = payload?.orgId ?? payload?.org_id ?? envOrgId;
+  if (!orgId) {
+    console.error("Could not determine orgId (JWT payload orgId or REDAKTYN_ORG_ID).");
+    process.exit(2);
+  }
+  if (envOrgId && payload?.orgId && envOrgId !== payload.orgId) {
+    console.error("REDAKTYN_ORG_ID does not match JWT orgId.");
+    process.exit(2);
+  }
+
+  let scanText = "";
+  /** Set when the requested target produced no text to scan at all. */
+  let unscannedTarget = false;
+
+  if (args.staged) {
+    try {
+      const diff = execSync("git diff --cached --unified=0", {
+        encoding: "utf8",
+        maxBuffer: 20 * 1024 * 1024,
+      });
+      scanText = extractAddedLinesFromUnifiedDiff(diff);
+    } catch {
+      console.error("Not a git repository or git diff failed.");
+      process.exit(2);
+    }
+  } else if (args.file) {
+    const txt = readTextFileSafe(path.resolve(args.file), args.verbose);
+    // `null` is "skipped", not "empty": a directory, a binary extension, a
+    // file with a NUL byte, one over the size cap, or one that would not
+    // read. An empty file returns "" and genuinely has nothing in it.
+    if (txt === null) {
+      unscannedTarget = true;
+      console.error(`Could not read ${args.file} as text — nothing was scanned.`);
+    }
+    scanText = txt ?? "";
+  } else if (args.dir) {
+    const files = collectFilesRecursive(path.resolve(args.dir), args.exclude || []);
+    const chunks = [];
+    for (const fp of files) {
+      const txt = readTextFileSafe(fp, args.verbose);
+      if (txt !== null) chunks.push(txt);
+    }
+    // Individual skips are ordinary — every repository holds images and
+    // binaries. Reading nothing at all is not: it means the directory was
+    // wrong, entirely excluded, or entirely unreadable.
+    if (chunks.length === 0) {
+      unscannedTarget = true;
+      console.error(`No readable text files under ${args.dir} — nothing was scanned.`);
+    }
+    scanText = chunks.join("\n");
+  } else {
+    printHelp();
+    process.exit(args.cmd ? 2 : 0);
+  }
+
+  const secrets = await fetchSecretsMeta(serverUrl, token);
+  if (!Array.isArray(secrets) || secrets.length === 0) {
+    console.error("No enforced secrets returned from server.");
+    process.exit(2);
+  }
+
+  const key = await deriveHmacKeyFromPassphrase(passphrase, orgId);
+  const stats = { total: 0, passesRun: [], exhausted: false, truncatedChars: false };
+  const endpoint = `${serverUrl.replace(/\/+$/, "")}/api/cli/scan`;
+
+  // Deduplicated across the whole scan, not per batch: the same window recurs
+  // constantly in real files, and the three passes overlap heavily on text with
+  // no whitespace in it.
+  const seen = new Set();
+  const byId = new Map();
+  for (const batch of digestBatches(scanText, secrets, key, stats)) {
+    const fresh = [];
+    for (const d of batch) {
+      if (seen.has(d)) continue;
+      seen.add(d);
+      fresh.push(d);
+    }
+    if (fresh.length === 0) continue;
+    const data = await httpPostJson(endpoint, token, { digestHex: fresh });
+    for (const m of Array.isArray(data.matches) ? data.matches : []) {
+      if (m && m.secretId) byId.set(m.secretId, m);
+    }
+  }
+  const matches = [...byId.values()];
+
+  // Never reported as clean. An incomplete scan that exits 0 is the failure
+  // mode a pre-commit hook is least able to survive, because nobody looks
+  // again. A target that was never read belongs in the same bucket and used
+  // not to be: pointing `--file` at a binary, a directory, or something over
+  // the size cap scanned zero bytes and exited 0, so the hook passed on a
+  // file nobody had checked.
+  const incomplete = stats.exhausted || stats.truncatedChars || unscannedTarget;
+
+  if (args.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: matches.length === 0 && !incomplete,
+          matches,
+          scan: {
+            passes: stats.passesRun,
+            digests: stats.total,
+            complete: !incomplete,
+          },
+        },
+        null,
+        2
+      )
+    );
+    process.exit(matches.length > 0 || incomplete ? 1 : 0);
+  }
+  if (matches.length > 0) {
+    console.error("");
+    console.error(`Redaktyn: ${matches.length} registered fingerprint${matches.length === 1 ? "" : "s"} matched in scanned content:`);
+    for (const m of matches) {
+      console.error(`  • ${m.label} (${m.secretId})`);
+    }
+    console.error("");
+    console.error("Remove the secret material, or rotate it and register the new fingerprint, before committing.");
+    process.exit(1);
+  }
+  if (incomplete) {
+    console.error("");
+    console.error("Redaktyn could not finish scanning this input, so this is not a clean result.");
+    if (stats.truncatedChars) {
+      console.error(`  • Content was truncated at ${MAX_SCAN_CHARS} characters.`);
+    }
+    if (stats.exhausted) {
+      console.error(`  • Hit the ${MAX_TOTAL_DIGESTS} digest ceiling before the end of the input.`);
+    }
+    if (unscannedTarget) {
+      console.error("  • Nothing was read from the path given, so no content was checked.");
+    }
+    console.error("Scan a narrower path with --file or --dir, or split the commit.");
+    process.exit(1);
+  }
+  if (args.verbose) {
+    console.log(
+      `Redaktyn: no registered fingerprint matches (${stats.passesRun.join(", ")}; ${stats.total} windows).`
+    );
+  }
+  process.exit(0);
+}
+
+async function cmdStatus(args) {
+  const serverUrl =
+    args.server || process.env["REDAKTYN_SERVER_URL"] || process.env["REDAKTYN_SERVER"];
+  const token =
+    process.env["REDAKTYN_DEVICE_TOKEN"] ||
+    process.env["REDAKTYN_TOKEN"] ||
+    process.env["REDAKTYN_JWT"];
+  const json = args.json === true;
+  if (!serverUrl || !token) {
+    const line = { connected: false, reason: "missing REDAKTYN_SERVER_URL or token env" };
+    console.log(json ? JSON.stringify(line) : line.reason);
+    process.exit(2);
+  }
+  try {
+    const secrets = await fetchSecretsMeta(serverUrl, token);
+    const row = {
+      connected: true,
+      serverUrl,
+      enrolledSecrets: Array.isArray(secrets) ? secrets.length : 0,
+      hasPassphrase: !!process.env["REDAKTYN_PASSPHRASE"],
+    };
+    console.log(json ? JSON.stringify(row, null, 2) : Object.entries(row).map(([k, v]) => `${k}: ${v}`).join("\n"));
+    process.exit(0);
+  } catch (e) {
+    const row = { connected: false, error: String(e?.message || e) };
+    console.log(json ? JSON.stringify(row) : row.error);
+    process.exit(1);
+  }
+}
+
+function installGitHooks() {
+  const root = execSync("git rev-parse --show-toplevel", { encoding: "utf8" }).trim();
+  const hookPath = path.join(root, ".git", "hooks", "pre-commit");
+  const here = fileURLToPath(import.meta.url);
+  const body = [
+    "#!/bin/sh",
+    "# Redaktyn pre-commit — blocks commits when registered fingerprints appear in staged text.",
+    'export REDAKTYN_SERVER_URL="${REDAKTYN_SERVER_URL:-}"',
+    'export REDAKTYN_PASSPHRASE="${REDAKTYN_PASSPHRASE:-}"',
+    'export REDAKTYN_DEVICE_TOKEN="${REDAKTYN_DEVICE_TOKEN:-${REDAKTYN_TOKEN:-}}"',
+    'echo "Redaktyn: scanning staged changes..."',
+    "set +e",
+    `node "${here}" --staged`,
+    "CODE=$?",
+    "set -e",
+    'if [ "$CODE" -ne 0 ]; then',
+    '  echo "Redaktyn blocked this commit."',
+    "  exit 1",
+    "fi",
+    'echo "Redaktyn: OK"',
+    "exit 0",
+    "",
+  ].join("\n");
+  writeFileSync(hookPath, body, { mode: 0o755 });
+  chmodSync(hookPath, 0o755);
+  console.log("Installed pre-commit hook at", hookPath);
+}
+
+function uninstallGitHooks() {
+  const root = execSync("git rev-parse --show-toplevel", { encoding: "utf8" }).trim();
+  const hookPath = path.join(root, ".git", "hooks", "pre-commit");
+  if (!existsSync(hookPath)) {
+    console.log("No pre-commit hook found.");
+    return;
+  }
+  const txt = readFileSync(hookPath, "utf8");
+  if (!txt.includes("Redaktyn")) {
+    console.log("pre-commit exists but is not a Redaktyn hook — not removing.");
+    return;
+  }
+  writeFileSync(hookPath, "");
+  console.log("Removed Redaktyn pre-commit hook body at", hookPath);
+}
+
+function printHelp() {
+  console.log(`
+redaktyn-scan — Redaktyn digest scanner (ZK: HMAC hex batches only)
+
+Commands:
+  (default)     --staged | --file <path> | --dir <path>
+  status        Show connection + registered fingerprint count
+  install-hooks Write .git/hooks/pre-commit
+  uninstall-hooks Clear Redaktyn pre-commit hook
+
+Flags:
+  --staged          Scan git staged additions (git diff --cached)
+  --file <path>     Scan a single file
+  --dir <path>      Scan all text files under directory
+  --server <url>    Override REDAKTYN_SERVER_URL
+  --org-id <uuid>   Override org id (must match JWT)
+  --json            JSON output
+  --verbose         Extra logs
+  --exclude <pat>   Skip paths containing pattern (repeatable)
+
+Environment:
+  REDAKTYN_SERVER_URL, REDAKTYN_PASSPHRASE, REDAKTYN_DEVICE_TOKEN (or REDAKTYN_TOKEN)
+`);
+}
+
+main().catch((e) => {
+  console.error(e?.message || e);
+  process.exit(2);
+});