@rightkit/release 0.2.14 → 0.2.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.14",
+  "version": "0.2.15",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/publish-update.mjs

@@ -5,6 +5,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
 import { pruneReleaseObjects } from "./prune-r2.mjs";
+import { loadReleaseToken } from "./release-token.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
@@ -37,8 +38,19 @@ const target = config?.targets?.[platform];
 const artifacts = target?.updater?.artifacts ?? [];
 const installers = target?.installer?.artifacts ?? [];
 
+if (tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
+if (tier === "update" && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
+
+let releaseToken = null;
+if (!dryRun && (tier === "update" || artifacts.length > 0)) {
+  try {
+    releaseToken = await loadReleaseToken();
+  } catch (error) {
+    fail(error.message);
+  }
+}
+
 if (tier === "patch") {
-  if (!installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
   for (const installer of installers) {
     assertCurrentKey(installer.key, "installer");
     const file = path.resolve(root, installer.file);
@@ -145,8 +157,6 @@ if (tier === "patch") {
   process.exit(0);
 }
 
-if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
-
 const platforms = {};
 const registrations = new Map();
 const updaterManifestArtifacts = new Map();
@@ -262,12 +272,11 @@ function patchInstallerKey(artifact) {
 }
 
 async function register(route, body) {
-  const token = process.env.RIGHTAPPS_ADMIN_TOKEN;
-  if (!token) fail("RIGHTAPPS_ADMIN_TOKEN is required to register an update");
+  if (!releaseToken) fail("RIGHTAPPS_RELEASE_TOKEN is required to register an update");
   const response = await fetch(`${API_BASE}${route}`, {
     method: "POST",
     headers: {
-      authorization: `Bearer ${token}`,
+      authorization: `Bearer ${releaseToken}`,
       "content-type": "application/json",
       "x-store-slug": process.env.RIGHTAPPS_STORE_SLUG || "rightapps",
     },

package/publish-update.test.mjs

@@ -8,7 +8,7 @@ import test from "node:test";
 
 const publisher = fileURLToPath(new URL("./publish-update.mjs", import.meta.url));
 
-function fixture() {
+function fixture({ materialize = false } = {}) {
   const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
   const config = path.join(dir, "right-release.config.mjs");
   writeFileSync(config, `export default ${JSON.stringify({
@@ -27,6 +27,11 @@ function fixture() {
       },
     },
   })};\n`);
+  if (materialize) {
+    writeFileSync(path.join(dir, "Fixture-Setup.exe"), "signed installer");
+    writeFileSync(path.join(dir, "Fixture.exe"), "signed updater");
+    writeFileSync(path.join(dir, "Fixture.exe.sig"), "updater signature");
+  }
   return config;
 }
 
@@ -181,3 +186,17 @@ test("refuses versioned updater object keys for gated feature updates", () => {
   assert.notEqual(result.status, 0);
   assert.match(result.stderr, /current R2 object/);
 });
+
+test("requires the durable release credential before the first patch upload", () => {
+  const config = fixture({ materialize: true });
+  const env = { ...process.env, RIGHT_RELEASE_TIER: "patch", RIGHTAPPS_ADMIN_TOKEN: "expired-admin-session" };
+  delete env.RIGHTAPPS_RELEASE_TOKEN;
+  delete env.RIGHTAPPS_RELEASE_TOKEN_FILE;
+  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win"], {
+    encoding: "utf8",
+    env,
+  });
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /RIGHTAPPS_RELEASE_TOKEN/);
+  assert.doesNotMatch(result.stdout, /UPLOAD /, "credential preflight must run before R2 mutation");
+});

package/release-token.mjs

@@ -0,0 +1,54 @@
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+const KEYCHAIN_SERVICE = "rightkit-rightapps-release-token";
+
+export function defaultWindowsReleaseTokenFile(env = process.env) {
+  const appData = env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+  return path.join(appData, "RightKit", "rightapps-release.token");
+}
+
+async function readTokenFile(file) {
+  const token = (await readFile(file, "utf8")).trim();
+  if (!token) throw new Error(`release token file is empty: ${file}`);
+  return token;
+}
+
+export async function loadReleaseToken({ env = process.env, platform = process.platform } = {}) {
+  const direct = env.RIGHTAPPS_RELEASE_TOKEN?.trim();
+  if (direct) return direct;
+
+  if (env.RIGHTAPPS_RELEASE_TOKEN_FILE) {
+    return readTokenFile(path.resolve(env.RIGHTAPPS_RELEASE_TOKEN_FILE));
+  }
+
+  if (platform === "win32") {
+    try {
+      return await readTokenFile(defaultWindowsReleaseTokenFile(env));
+    } catch (error) {
+      throw new Error(`RIGHTAPPS_RELEASE_TOKEN is unavailable (${error.message})`);
+    }
+  }
+
+  if (platform === "darwin") {
+    try {
+      const { stdout } = await execFileAsync("security", [
+        "find-generic-password",
+        "-a", env.USER || os.userInfo().username,
+        "-s", KEYCHAIN_SERVICE,
+        "-w",
+      ], { windowsHide: true });
+      const token = stdout.trim();
+      if (!token) throw new Error("Keychain item is empty");
+      return token;
+    } catch (error) {
+      throw new Error(`RIGHTAPPS_RELEASE_TOKEN is unavailable (macOS Keychain service ${KEYCHAIN_SERVICE}: ${error.message})`);
+    }
+  }
+
+  throw new Error("RIGHTAPPS_RELEASE_TOKEN or RIGHTAPPS_RELEASE_TOKEN_FILE is required");
+}

package/release-token.test.mjs

@@ -0,0 +1,21 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { defaultWindowsReleaseTokenFile, loadReleaseToken } from "./release-token.mjs";
+
+test("loads an explicit release token without exposing admin-session fallback", async () => {
+  assert.equal(await loadReleaseToken({ env: { RIGHTAPPS_RELEASE_TOKEN: " durable-token ", RIGHTAPPS_ADMIN_TOKEN: "admin-session" } }), "durable-token");
+});
+
+test("loads the release token from an explicit protected-file path", async () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-release-token-"));
+  const file = path.join(dir, "token");
+  writeFileSync(file, "file-token\n");
+  assert.equal(await loadReleaseToken({ env: { RIGHTAPPS_RELEASE_TOKEN_FILE: file }, platform: "linux" }), "file-token");
+});
+
+test("uses the portable Windows token location", () => {
+  assert.equal(defaultWindowsReleaseTokenFile({ APPDATA: "C:\\Users\\fixture\\AppData\\Roaming" }), path.join("C:\\Users\\fixture\\AppData\\Roaming", "RightKit", "rightapps-release.token"));
+});

package/right-suite-contract.test.mjs

@@ -19,10 +19,10 @@ const apps = [
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.14");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.15");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
-  assert.equal(versions.npm["@rightkit/updates"], "0.1.1");
+  assert.equal(versions.npm["@rightkit/updates"], "0.2.1");
   assert.equal(versions.cargo["rightkit-license"], "0.1.1");
   assert.equal(versions.cargo["rightkit-logs"], "0.1.0");
   for (const [crate, version] of Object.entries(versions.cargo)) {

package/rightkit-versions.json

@@ -4,8 +4,8 @@
   "npm": {
     "@rightkit/license": "0.1.5",
     "@rightkit/logs": "0.1.3",
-    "@rightkit/release": "0.2.14",
-    "@rightkit/updates": "0.1.1"
+    "@rightkit/release": "0.2.15",
+    "@rightkit/updates": "0.2.1"
   },
   "cargo": {
     "rightkit-license": "0.1.1",