@skrr-ai/auth-core 0.1.2

package/dist/esm/deviceIdentityBridge.js

@@ -0,0 +1,572 @@
+/**
+ * deviceIdentityBridge.ts — composed L11 runtime (init, sign, enroll).
+ *
+ * Lifts the previously-duplicated `daemon/src/deviceIdentity.ts` and
+ * `cli/src/lib/device-identity.ts` modules into a single shared
+ * implementation. Daemon and CLI both consume this module so they land
+ * on the SAME on-disk artifacts:
+ *
+ *   <configDir>/profiles/<p>/device-public-key.jwk    — plaintext JWK
+ *   <configDir>/profiles/<p>/device-private-key       — L12-wrapped JSON
+ *   <configDir>/profiles/<p>/device-enrollment.json   — server-ack marker
+ *
+ * Architectural decision (locked): CLI shares the daemon's keypair on
+ * the same machine. Same machine = same device identity. The scope
+ * discriminator is the JWT claim (`scope: 'cli'` vs `scope: 'daemon'`),
+ * not the key.
+ *
+ * NAMING NOTE — the suffix `Bridge` distinguishes this composed runtime
+ * (init + sign + enroll + telemetry) from the pure-crypto primitive
+ * file `deviceKey.ts` it composes.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, } from './deviceKey.js';
+import { isCredEnvelopeActive, maybeDecryptOnRead, wrapIfActiveOrPassthrough, } from './credentialEnvelopeBridge.js';
+import { emitAuthTelemetry, getAuthConfigDir, getAuthLogger } from './runtime.js';
+const PUBLIC_KEY_FILENAME = 'device-public-key.jwk';
+const PRIVATE_KEY_FILENAME = 'device-private-key';
+const ENROLLMENT_MARKER_FILENAME = 'device-enrollment.json';
+const ENROLLMENT_BACKOFF_FILENAME = 'device-enrollment-backoff.json';
+// A missing Daemon row cannot become enrollable until registration changes
+// server state. Persist the negative result across short-lived `sky` processes
+// so every CLI command does not repeat the same guaranteed 404.
+const DAEMON_NOT_FOUND_BACKOFF_MS = 15 * 60 * 1000;
+let _state = { kind: 'uninit' };
+/** @internal Test seam — force-set state. */
+export function __setStateForTest(next) {
+    const prev = _state;
+    _state = next;
+    return prev;
+}
+/** @internal Test seam — read state. */
+export function __getStateForTest() {
+    return _state;
+}
+function profileConfigDir(profile) {
+    return path.join(getAuthConfigDir(), 'profiles', profile);
+}
+function publicKeyPath(profile) {
+    return path.join(profileConfigDir(profile), PUBLIC_KEY_FILENAME);
+}
+function privateKeyPath(profile) {
+    return path.join(profileConfigDir(profile), PRIVATE_KEY_FILENAME);
+}
+function enrollmentMarkerPath(profile) {
+    return path.join(profileConfigDir(profile), ENROLLMENT_MARKER_FILENAME);
+}
+function enrollmentBackoffPath(profile) {
+    return path.join(profileConfigDir(profile), ENROLLMENT_BACKOFF_FILENAME);
+}
+function atomicWrite0600(target, value) {
+    const dir = path.dirname(target);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+    const buf = typeof value === 'string' ? Buffer.from(value, 'utf-8') : value;
+    const fd = fs.openSync(tmp, 'w', 0o600);
+    try {
+        fs.writeSync(fd, buf);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, target);
+    try {
+        const dirFd = fs.openSync(dir, 'r');
+        try {
+            fs.fsyncSync(dirFd);
+        }
+        finally {
+            fs.closeSync(dirFd);
+        }
+    }
+    catch {
+        /* best-effort; some platforms reject dir fsync */
+    }
+}
+function emit(eventName, success, metadata, opts = {}) {
+    emitAuthTelemetry({
+        timestamp: new Date().toISOString(),
+        eventType: 'auth',
+        success,
+        metadata: { source: 'deviceIdentity', event: eventName, ...metadata },
+    });
+    if (!success) {
+        const level = opts.logLevel ?? 'warn';
+        const log = getAuthLogger();
+        if (level === 'info') {
+            log.info(`[deviceIdentity] ${eventName}`, metadata);
+        }
+        else {
+            log.warn(`[deviceIdentity] ${eventName}`, metadata);
+        }
+    }
+}
+/**
+ * Persist a freshly-generated keypair. Public goes plaintext; private
+ * goes through `maybeEncryptForWrite` so L12 wraps it when active.
+ */
+function persistKeypair(profile, kp) {
+    const publicPayload = JSON.stringify({
+        publicJwk: kp.publicJwk,
+        thumbprint: kp.thumbprint,
+        createdAt: new Date().toISOString(),
+    });
+    atomicWrite0600(publicKeyPath(profile), publicPayload);
+    // Use the always-fail-open variant — device-identity wants the private
+    // key persisted even when the L12 envelope path is inactive (today's
+    // default on every platform). The daemon's `credEnvelopeFailClosed`
+    // policy applies only to the keychain.ts write path.
+    const privatePlaintext = JSON.stringify(kp.privateJwk);
+    const wireForm = wrapIfActiveOrPassthrough(privatePlaintext);
+    const envelopeProtected = wireForm !== privatePlaintext;
+    atomicWrite0600(privateKeyPath(profile), wireForm);
+    emit('keypair_persisted', true, {
+        profile,
+        thumbprint: kp.thumbprint,
+        envelopeProtected,
+    });
+    return { envelopeProtected };
+}
+/**
+ * Load a previously-persisted keypair. Returns null on missing files,
+ * decrypt failure, public/private mismatch (file-swap defense), or
+ * malformed JSON. Throws only on unexpected fs errors; init catches.
+ */
+function loadKeypair(profile) {
+    const pubPath = publicKeyPath(profile);
+    const privPath = privateKeyPath(profile);
+    if (!fs.existsSync(pubPath) || !fs.existsSync(privPath)) {
+        return null;
+    }
+    const pubRaw = fs.readFileSync(pubPath, 'utf-8');
+    const privRaw = fs.readFileSync(privPath, 'utf-8');
+    let publicJwk;
+    let storedThumbprint;
+    try {
+        const parsed = JSON.parse(pubRaw);
+        publicJwk = parsed.publicJwk;
+        storedThumbprint = parsed.thumbprint;
+    }
+    catch (err) {
+        emit('public_key_unreadable', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+    const decryptResult = maybeDecryptOnRead(privRaw);
+    if (decryptResult.plaintext === null) {
+        emit('private_key_decrypt_failed', false, { profile });
+        return null;
+    }
+    const privatePlaintext = decryptResult.plaintext;
+    let privateJwk;
+    try {
+        privateJwk = JSON.parse(privatePlaintext);
+    }
+    catch (err) {
+        emit('private_key_malformed', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+    // public.x must match private.x — any mismatch indicates a partial
+    // write race, manual edit, or attacker swapping one of the files.
+    if (publicJwk.x !== privateJwk.x) {
+        emit('keypair_inconsistent', false, { profile });
+        return null;
+    }
+    // Recompute the thumbprint; mismatch with stored is informational
+    // (we trust the recomputed value), not a failure.
+    const recomputed = jwkThumbprint(publicJwk);
+    if (recomputed !== storedThumbprint) {
+        emit('thumbprint_drift', false, {
+            profile,
+            stored: storedThumbprint,
+            recomputed,
+        });
+    }
+    return {
+        publicJwk,
+        privateJwk,
+        thumbprint: recomputed,
+    };
+}
+/**
+ * Initialize device identity. Idempotent.
+ *
+ * Order:
+ *   1. Try to load existing keypair from disk.
+ *      - Success → state = active.
+ *      - Missing files / corruption / decrypt failure → step 2.
+ *   2. Generate fresh keypair and persist. Failure to persist is a hard
+ *      error landing in disabled+persist_failed.
+ */
+export async function initDeviceIdentity(profile) {
+    if (_state.kind !== 'uninit')
+        return;
+    if (typeof profile !== 'string' || profile.length === 0) {
+        _state = { kind: 'disabled', reason: 'init_failed' };
+        emit('init_failed', false, { reason: 'empty_profile' });
+        return;
+    }
+    let keypair = null;
+    try {
+        keypair = loadKeypair(profile);
+    }
+    catch (err) {
+        emit('load_failed', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        keypair = null;
+    }
+    if (keypair) {
+        const envelopeProtected = isCredEnvelopeActive();
+        _state = { kind: 'active', keypair, profile, envelopeProtected };
+        emit('active', true, {
+            profile,
+            thumbprint: keypair.thumbprint,
+            envelopeProtected,
+            regenerated: false,
+        });
+        return;
+    }
+    let fresh;
+    try {
+        fresh = generateDeviceKeyPair();
+    }
+    catch (err) {
+        _state = { kind: 'disabled', reason: 'init_failed' };
+        emit('init_failed', false, {
+            profile,
+            reason: 'keygen_threw',
+            message: err?.message ?? 'unknown',
+        });
+        return;
+    }
+    let persistResult;
+    try {
+        persistResult = persistKeypair(profile, fresh);
+    }
+    catch (err) {
+        _state = { kind: 'disabled', reason: 'persist_failed' };
+        emit('persist_failed', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        return;
+    }
+    _state = {
+        kind: 'active',
+        keypair: fresh,
+        profile,
+        envelopeProtected: persistResult.envelopeProtected,
+    };
+    emit('active', true, {
+        profile,
+        thumbprint: fresh.thumbprint,
+        envelopeProtected: persistResult.envelopeProtected,
+        regenerated: true,
+    });
+}
+/**
+ * Reset state. With `clearOnDisk=true` deletes both keypair files —
+ * used by `oversky logout` / `sky logout` so a freshly-logged-in user
+ * gets a fresh device identity that the daemon will see on its next start.
+ */
+export async function resetDeviceIdentity(opts) {
+    if (opts?.clearOnDisk && opts.profile) {
+        for (const p of [publicKeyPath(opts.profile), privateKeyPath(opts.profile)]) {
+            try {
+                fs.unlinkSync(p);
+            }
+            catch (err) {
+                if (err.code !== 'ENOENT') {
+                    emit('clear_failed', false, {
+                        profile: opts.profile,
+                        file: path.basename(p),
+                        message: err?.message ?? 'unknown',
+                    });
+                }
+            }
+        }
+    }
+    _state = { kind: 'uninit' };
+}
+/** True iff init has completed and a keypair is in memory. */
+export function isDeviceIdentityActive() {
+    return _state.kind === 'active';
+}
+/**
+ * Export the public key for server enrollment / dashboard display.
+ * Returns null when not active so callers know to skip the JWS header
+ * on the in-flight request.
+ */
+export function getDevicePublicKey() {
+    if (_state.kind !== 'active')
+        return null;
+    return { jwk: _state.keypair.publicJwk, thumbprint: _state.keypair.thumbprint };
+}
+/**
+ * Operator-readable summary of device-identity state. Used by
+ * `oversky status` and CLI debug commands. Never includes the private key.
+ */
+export function describeDeviceIdentityState() {
+    if (_state.kind === 'disabled') {
+        return { kind: 'disabled', reason: _state.reason };
+    }
+    if (_state.kind === 'active') {
+        return {
+            kind: 'active',
+            thumbprint: _state.keypair.thumbprint,
+            profile: _state.profile,
+            envelopeProtected: _state.envelopeProtected,
+        };
+    }
+    return { kind: 'uninit' };
+}
+/**
+ * Sign an outgoing request with the device key. Returns the JWS Compact
+ * Serialization, or null when device identity is not active. NEVER
+ * throws — a failed sign returns null and emits a telemetry event so
+ * the caller can fall back to bearer-only auth without an outage.
+ *
+ * Shape matches `DeviceProofSigner` from `./refresh.ts` so the function
+ * passes directly into `refreshDaemonToken`'s `signRequestProof` slot.
+ */
+export function signServerRequest(opts) {
+    if (_state.kind !== 'active')
+        return null;
+    try {
+        return buildDeviceProof(_state.keypair.privateJwk, _state.keypair.publicJwk, {
+            method: opts.method,
+            url: opts.url,
+            refreshToken: opts.refreshToken,
+            accessToken: opts.accessToken,
+        });
+    }
+    catch (err) {
+        emit('sign_failed', false, {
+            profile: _state.profile,
+            thumbprint: _state.keypair.thumbprint,
+            method: opts.method,
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+}
+/** @internal Test seams — file path resolvers. */
+export function __publicKeyPathForTest(profile) {
+    return publicKeyPath(profile);
+}
+export function __privateKeyPathForTest(profile) {
+    return privateKeyPath(profile);
+}
+export function __enrollmentMarkerPathForTest(profile) {
+    return enrollmentMarkerPath(profile);
+}
+export function __enrollmentBackoffPathForTest(profile) {
+    return enrollmentBackoffPath(profile);
+}
+/** Remove the enrollment marker so re-login gets a fresh enrollment. */
+export function clearEnrollmentMarker(profile) {
+    for (const markerPath of [enrollmentMarkerPath(profile), enrollmentBackoffPath(profile)]) {
+        try {
+            fs.unlinkSync(markerPath);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT') {
+                emit('enrollment_marker_clear_failed', false, {
+                    profile,
+                    file: path.basename(markerPath),
+                    message: err?.message ?? 'unknown',
+                });
+            }
+        }
+    }
+}
+/**
+ * POST the device public key to the server for enrollment.
+ *
+ * Idempotent across boots — the marker file short-circuits subsequent
+ * calls. The marker stores serverUrl + thumbprint so a URL change
+ * (staging → prod swap) forces fresh enrollment.
+ *
+ * Fire-and-forget contract — callers should `.catch()` so a network
+ * partition at startup cannot stall the consumer's command path.
+ *
+ * NOTE: Both `sky` and `oversky` may race to enroll the same shared
+ * keypair. The server's `enroll-device-key` route is idempotent on
+ * `(machineUuid, publicJwkX)` so a duplicate POST is safe; whichever
+ * binary writes its marker file first short-circuits the other.
+ */
+export async function enrollWithServer(opts) {
+    const { serverUrl, accessToken, machineUuid } = opts;
+    if (_state.kind !== 'active') {
+        return { enrolled: false, reason: 'not_active' };
+    }
+    const profile = _state.profile;
+    const keypair = _state.keypair;
+    const markerPath = enrollmentMarkerPath(profile);
+    const backoffPath = enrollmentBackoffPath(profile);
+    try {
+        if (fs.existsSync(markerPath)) {
+            return { enrolled: false, reason: 'already_persisted' };
+        }
+    }
+    catch {
+        /* best-effort */
+    }
+    try {
+        const raw = JSON.parse(fs.readFileSync(backoffPath, 'utf-8'));
+        const retryAfter = Date.parse(raw.retryAfter || '');
+        if (raw.serverUrl === serverUrl &&
+            raw.machineUuid === machineUuid &&
+            raw.thumbprint === keypair.thumbprint &&
+            Number.isFinite(retryAfter) &&
+            retryAfter > Date.now()) {
+            return { enrolled: false, reason: 'backoff_active' };
+        }
+        fs.unlinkSync(backoffPath);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            // A corrupt/stale marker must never suppress enrollment indefinitely.
+            try {
+                fs.unlinkSync(backoffPath);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+    const base = serverUrl.replace(/\/+$/, '');
+    const htu = `${base}/api/daemon-resources/enroll-device-key`;
+    const proofJws = buildDeviceProof(keypair.privateJwk, keypair.publicJwk, {
+        method: 'POST',
+        url: htu,
+    });
+    const body = JSON.stringify({
+        machineUuid,
+        publicJwkX: keypair.publicJwk.x,
+        proofJws,
+    });
+    // 10-second bound — enrollment is best-effort at startup.
+    const ownAbort = new AbortController();
+    const timer = setTimeout(() => ownAbort.abort(), 10_000);
+    let response;
+    try {
+        response = await fetch(htu, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${accessToken}`,
+            },
+            body,
+            signal: opts.signal ?? ownAbort.signal,
+        });
+    }
+    catch (err) {
+        clearTimeout(timer);
+        const message = err?.message ?? 'unknown';
+        emit('enrollment_network_error', false, {
+            profile,
+            thumbprint: keypair.thumbprint,
+            serverUrl,
+            message,
+        });
+        return { enrolled: false, reason: 'network_error', message };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    const responseText = await response.text().catch(() => '');
+    if (!response.ok) {
+        // Some rejection statuses are expected, non-actionable states rather
+        // than failures — log them at info so they don't read as auth errors or
+        // spam stderr on every invocation. Other statuses (proof failures, 5xx,
+        // etc.) keep the louder warn level for ops visibility.
+        //   • 404 DAEMON_NOT_FOUND — pre-enrollment window: the daemon row for
+        //     this (user, machineUuid) pair does not exist yet (fresh install,
+        //     server swap, or daemon hasn't started). Fires every CLI command
+        //     in that window.
+        //   • 403 OPAQUE_AUTH_REFUSED — the enroll route is JWT-only (M11); an
+        //     opaque `osk_dmn_*` daemon token is refused by design (OSK-1660 #5).
+        //     Enrollment is the CLI's (JWT) job; the daemon holding an opaque
+        //     token should not enroll. Guarded at the daemon call site, this is
+        //     defense-in-depth for any other opaque caller.
+        //   • 409 already-enrolled — a concurrent binary won the enrollment race
+        //     for the shared keypair; idempotent, nothing to do.
+        const isBenignRejection = (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) ||
+            (response.status === 403 && responseText.includes('OPAQUE_AUTH_REFUSED')) ||
+            response.status === 409;
+        if (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) {
+            try {
+                atomicWrite0600(backoffPath, JSON.stringify({
+                    serverUrl,
+                    machineUuid,
+                    thumbprint: keypair.thumbprint,
+                    retryAfter: new Date(Date.now() + DAEMON_NOT_FOUND_BACKOFF_MS).toISOString(),
+                }));
+            }
+            catch (err) {
+                emit('enrollment_backoff_write_failed', false, {
+                    profile,
+                    message: err?.message ?? 'unknown',
+                });
+            }
+        }
+        emit('enrollment_rejected', false, {
+            profile,
+            thumbprint: keypair.thumbprint,
+            serverUrl,
+            status: response.status,
+            body: responseText,
+        }, { logLevel: isBenignRejection ? 'info' : 'warn' });
+        return {
+            enrolled: false,
+            reason: 'http_error',
+            status: response.status,
+            body: responseText,
+        };
+    }
+    const marker = JSON.stringify({
+        enrolledAt: new Date().toISOString(),
+        serverUrl,
+        thumbprint: keypair.thumbprint,
+        machineUuid,
+    });
+    try {
+        atomicWrite0600(markerPath, marker);
+    }
+    catch (err) {
+        // Non-fatal — server enrolled us; we may re-POST next run, which
+        // the server handles idempotently.
+        emit('enrollment_marker_write_failed', false, {
+            profile,
+            thumbprint: keypair.thumbprint,
+            message: err?.message ?? 'unknown',
+        });
+    }
+    try {
+        fs.unlinkSync(backoffPath);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            emit('enrollment_backoff_clear_failed', false, {
+                profile,
+                message: err?.message ?? 'unknown',
+            });
+        }
+    }
+    emit('enrolled_with_server', true, {
+        profile,
+        thumbprint: keypair.thumbprint,
+        serverUrl,
+    });
+    return { enrolled: true, thumbprint: keypair.thumbprint };
+}