@sigma-auth/cli 0.0.1 → 0.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sigma-auth/cli",
-	"version": "0.0.1",
+	"version": "0.0.2",
 	"description": "Headless Sigma Auth CLI: create a BAP identity locally, sign in with Bitcoin-Auth, push encrypted backups, register OAuth clients",
 	"type": "module",
 	"bin": {

package/src/commands.ts

@@ -5,11 +5,12 @@ import { isLegacyBackup, isType42Backup } from "bitcoin-backup";
 import type { ParsedArgs } from "./args.ts";
 import { boolFlag, flag, flagList } from "./args.ts";
 import { backupPath, type RuntimeConfig } from "./config.ts";
-import { loadJar, sessionCookieNames } from "./cookies.ts";
-import { CliError, cryptoFail, usage } from "./error.ts";
+import { deleteJar, loadJar, sessionCookieNames } from "./cookies.ts";
+import { cryptoFail, usage } from "./error.ts";
 import { ensureDir, pathExists, readText, writeSecretFile } from "./fsutil.ts";
 import { createHttp, requestJson, throwHttp } from "./http.ts";
 import {
+	assertBitcoinBackupCiphertext,
 	bapFromBackup,
 	createMasterBackup,
 	decryptMaster,
@@ -76,7 +77,7 @@ export async function identityCreate(
 			positional: args.positional,
 			flags: { ...args.flags, backup: [out] },
 		};
-		const code = await authSignIn(signinArgs, cfg, false);
+		const code = await authSignIn(signinArgs, cfg, false, password);
 		if (code !== 0) {
 			return code;
 		}
@@ -157,9 +158,10 @@ export async function backupEncrypt(
 export async function authSignIn(
 	args: ParsedArgs,
 	cfg: RuntimeConfig,
-	emit = true
+	emit = true,
+	resolvedPassword?: string
 ): Promise<number> {
-	const password = await resolvePassword(args, true);
+	const password = resolvedPassword ?? (await resolvePassword(args, true));
 	if (!password) {
 		usage("password required");
 	}
@@ -183,7 +185,13 @@ export async function authSignIn(
 		saveCookies: true,
 	});
 	if (signed.status >= 400) {
-		throwHttp("/api/auth/sign-in/sigma", signed.status, signed.json, signed.text);
+		throwHttp(
+			"/api/auth/sign-in/sigma",
+			signed.status,
+			signed.json,
+			signed.text,
+			signed.headers
+		);
 	}
 	const payload = signed.json as {
 		user?: { id?: string; pubkey?: string };
@@ -204,7 +212,14 @@ export async function authSignIn(
 		await requestJson(client, "POST", "/api/auth/sign-out", {
 			withCookies: true,
 		});
-		throwHttp("/api/user/bap-ids", registered.status, registered.json, registered.text);
+		deleteJar(client.cookieJar);
+		throwHttp(
+			"/api/user/bap-ids",
+			registered.status,
+			registered.json,
+			registered.text,
+			registered.headers
+		);
 	}
 	if (!emit) {
 		return 0;
@@ -228,20 +243,14 @@ export async function backupPush(
 ): Promise<number> {
 	const path = backupPath(args, cfg.home);
 	const ciphertext = readText(path).replace(/\n+$/, "");
-	if (looksLikePlaintextBackup(ciphertext)) {
-		throw new CliError(
-			7,
-			"crypto",
-			"refusing to upload plaintext backup (rootPk/xprv/wif/mnemonic present)"
-		);
-	}
+	assertBitcoinBackupCiphertext(ciphertext);
 	const client = createHttp(cfg);
 	const result = await requestJson(client, "POST", "/api/backup", {
 		body: { encryptedBackup: ciphertext },
 		withCookies: true,
 	});
 	if (result.status >= 400) {
-		throwHttp("/api/backup", result.status, result.json, result.text);
+		throwHttp("/api/backup", result.status, result.json, result.text, result.headers);
 	}
 	const payload = result.json as { bapId?: string; message?: string };
 	if (!emit) {
@@ -285,7 +294,13 @@ export async function oauthRegister(
 			withCookies: true,
 		});
 		if (result.status >= 400) {
-			throwHttp("/api/oauth-clients", result.status, result.json, result.text);
+			throwHttp(
+				"/api/oauth-clients",
+				result.status,
+				result.json,
+				result.text,
+				result.headers
+			);
 		}
 		const payload = result.json as {
 			client?: { clientId?: string; accountPubkey?: string; ownerBapId?: string };
@@ -327,7 +342,8 @@ export async function oauthRegister(
 			"/api/auth/oauth2/register",
 			result.status,
 			result.json,
-			result.text
+			result.text,
+			result.headers
 		);
 	}
 	const payload = result.json as {

package/src/cookies.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { chmodSync, existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { ensureDir } from "./fsutil.ts";
 
@@ -83,6 +83,12 @@ export function loadJar(path: string): Cookie[] {
 	return cookies;
 }
 
+export function deleteJar(path: string): void {
+	if (existsSync(path)) {
+		unlinkSync(path);
+	}
+}
+
 export function saveJar(path: string, cookies: Cookie[]): void {
 	ensureDir(dirname(path));
 	const lines = [

package/src/http.ts

@@ -78,13 +78,23 @@ export async function requestJson(
 	return { status: response.status, headers: response.headers, json, text };
 }
 
-export function throwHttp(path: string, status: number, json: unknown, text: string): never {
+export function throwHttp(
+	path: string,
+	status: number,
+	json: unknown,
+	text: string,
+	headers?: Headers
+): never {
 	const record = json && typeof json === "object" ? (json as Record<string, unknown>) : {};
-	const message =
+	let message =
 		(typeof record.error_description === "string" && record.error_description) ||
 		(typeof record.message === "string" && record.message) ||
 		(typeof record.error === "string" && record.error) ||
 		text ||
 		`${path} failed with ${status}`;
+	const retryAfter = headers?.get("retry-after");
+	if (retryAfter) {
+		message = `${message} (Retry-After: ${retryAfter})`;
+	}
 	throw new CliError(exitForHttp(status), codeForHttp(status), message, status);
 }

package/src/identity.ts

@@ -1,4 +1,4 @@
-import { HD, Mnemonic, PrivateKey } from "@bsv/sdk";
+import { HD, Mnemonic, PrivateKey, Utils } from "@bsv/sdk";
 import {
 	type BapMasterBackup,
 	decryptBackup,
@@ -9,6 +9,12 @@ import {
 import { BAP } from "bsv-bap";
 import { cryptoFail } from "./error.ts";
 
+/** bitcoin-backup encryptData: salt(16) || iv(12) || AES-GCM ciphertext (16-byte tag). */
+const SALT_LENGTH_BYTES = 16;
+const IV_LENGTH_BYTES = 12;
+const AES_GCM_TAG_BYTES = 16;
+const MIN_ENVELOPE_BYTES = SALT_LENGTH_BYTES + IV_LENGTH_BYTES + AES_GCM_TAG_BYTES;
+
 export type PublicIdentity = {
 	bapId: string;
 	pubkey: string;
@@ -153,3 +159,89 @@ export function looksLikePlaintextBackup(text: string): boolean {
 		return false;
 	}
 }
+
+function looksLikeWif(text: string): boolean {
+	return /^[5KL][1-9A-HJ-NP-Za-km-z]{50,51}$/.test(text);
+}
+
+function looksLikeExtendedKey(text: string): boolean {
+	return /^(xprv|tprv|yprv|zprv|Yprv|Zprv)/.test(text);
+}
+
+function looksLikeMnemonic(text: string): boolean {
+	const words: string[] = [];
+	let current = "";
+	for (const ch of text) {
+		if (ch === " " || ch === "\t" || ch === "\n" || ch === "\r") {
+			if (current.length > 0) {
+				words.push(current);
+				current = "";
+			}
+		} else {
+			current += ch;
+		}
+	}
+	if (current.length > 0) {
+		words.push(current);
+	}
+	const wordCount = words.length;
+	if (
+		wordCount !== 12 &&
+		wordCount !== 15 &&
+		wordCount !== 18 &&
+		wordCount !== 21 &&
+		wordCount !== 24
+	) {
+		return false;
+	}
+	return words.every((word) => /^[a-z]+$/i.test(word));
+}
+
+function looksLikeJsonObject(text: string): boolean {
+	try {
+		const parsed = JSON.parse(text) as unknown;
+		return parsed !== null && typeof parsed === "object";
+	} catch {
+		return false;
+	}
+}
+
+export function isBitcoinBackupCiphertext(text: string): boolean {
+	if (text.length === 0) {
+		return false;
+	}
+	if (
+		looksLikePlaintextBackup(text) ||
+		looksLikeJsonObject(text) ||
+		looksLikeWif(text) ||
+		looksLikeExtendedKey(text) ||
+		looksLikeMnemonic(text)
+	) {
+		return false;
+	}
+	try {
+		const bytes = Utils.toArray(text, "base64");
+		if (bytes.length < MIN_ENVELOPE_BYTES) {
+			return false;
+		}
+		return Utils.toBase64(bytes) === text;
+	} catch {
+		return false;
+	}
+}
+
+export function assertBitcoinBackupCiphertext(text: string): void {
+	if (
+		looksLikePlaintextBackup(text) ||
+		looksLikeWif(text) ||
+		looksLikeExtendedKey(text) ||
+		looksLikeMnemonic(text)
+	) {
+		cryptoFail(
+			"refusing to upload plaintext backup (rootPk/xprv/wif/mnemonic present)"
+		);
+	}
+	if (!isBitcoinBackupCiphertext(text)) {
+		cryptoFail("refusing to upload: not opaque bitcoin-backup ciphertext");
+	}
+}

package/src/output.ts

@@ -10,7 +10,14 @@ export function printJson(ok: boolean, data: unknown, error?: unknown): void {
 		process.stdout.write(`${JSON.stringify({ ok: true, data })}\n`);
 		return;
 	}
-	process.stdout.write(`${JSON.stringify({ ok: false, error })}\n`);
+	const body: Record<string, unknown> = { ok: false };
+	if (error !== undefined) {
+		body.error = error;
+	}
+	if (data !== undefined) {
+		body.data = data;
+	}
+	process.stdout.write(`${JSON.stringify(body)}\n`);
 }
 
 export function printHuman(mode: OutputMode, text: string): void {

package/src/password.ts

@@ -4,6 +4,15 @@ import { boolFlag, flag } from "./args.ts";
 import { MIN_PASSWORD_LENGTH } from "./config.ts";
 import { cryptoFail, usage } from "./error.ts";
 
+function isAllWhitespace(value: string): boolean {
+	for (const ch of value) {
+		if (!/\s/.test(ch)) {
+			return false;
+		}
+	}
+	return true;
+}
+
 function envPassword(): string | undefined {
 	if (!("SIGMA_BACKUP_PASSWORD" in process.env)) {
 		return undefined;
@@ -12,6 +21,9 @@ function envPassword(): string | undefined {
 	if (value === undefined || value === "") {
 		usage("SIGMA_BACKUP_PASSWORD is set but empty");
 	}
+	if (isAllWhitespace(value)) {
+		usage("SIGMA_BACKUP_PASSWORD is whitespace-only");
+	}
 	return value;
 }