@tokenoftrust/cli 1.4.0-rc.0 → 1.4.0-rc.10

package/src/token-store.mjs

@@ -30,36 +30,59 @@
  *
  * `TOT_HOME` overrides the home dir (used by tests to point at a temp dir).
  *
- * PROFILES (`TOT_PROFILE`): single-plane auth means one active identity per
- * credential file, so to keep DIFFERENT identities live at once — e.g. a staff
- * `@tokenoftrust.com` sign-in in one terminal and a plain developer identity in
- * another — export a profile per shell (`export TOT_PROFILE=staff` / `=dev`).
- * Each profile gets its OWN `credentials.<profile>.json` under the same `~/.tot`
- * (the renderer cache, last-tenant, etc. stay shared — only the identity splits).
- * Unset → the default `credentials.json`, so existing sessions are untouched.
+ * PROFILES (`TOT_PROFILE`) — OPTIONAL, for parallel work. Almost every developer
+ * leaves this UNSET and uses the single default `credentials.json` — that path is
+ * unchanged and is the norm. It exists only when you want MORE THAN ONE identity
+ * live at once (a staff `@tokenoftrust.com` sign-in and a plain developer one, or
+ * many parallel test identities): export a profile per shell and each gets its OWN
+ * credential file under the same `~/.tot` (the renderer cache, last-tenant, etc.
+ * stay shared — only the identity splits). The value is an OPAQUE label — any
+ * string works, so `export TOT_PROFILE=$(uuidgen)` per terminal/test is fine:
+ *   - a clean short token (`staff`, `dev`, `test-7`) is used verbatim for a
+ *     readable `credentials.<profile>.json`;
+ *   - any other value (symbols, uppercase, long) is HASHED to a stable, safe
+ *     `credentials.h<hash>.json` — so an arbitrary opaque id can never collide
+ *     with another or escape `~/.tot`, while `tot whoami` still shows what you set.
  */
 import {
   readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync, existsSync, rmSync,
 } from "node:fs";
 import { homedir } from "node:os";
+import { createHash } from "node:crypto";
 import { join, dirname } from "node:path";
 
+/** A short token safe to drop straight into a filename (readable profiles). */
+const CLEAN_PROFILE_RE = /^[a-z0-9_-]{1,64}$/;
+
 /**
- * The active credential profile from `TOT_PROFILE`, sanitized to a safe filename
- * token (`[a-z0-9_-]`, lowercased, ≤64 chars), or null for the default
- * (unnamespaced) session. Sanitizing — not just trusting the value — keeps a
- * stray `/` or `..` from ever escaping the `~/.tot` dir.
+ * The active profile's DISPLAY label — the raw `TOT_PROFILE`, trimmed — or null
+ * when unset. This is what `tot whoami` shows; it is NOT the filename (see
+ * profileSlug, which makes any value filesystem-safe).
  */
 export function activeProfile(env = process.env) {
-  const safe = String(env.TOT_PROFILE || "").trim().toLowerCase().replace(/[^a-z0-9_-]/g, "").slice(0, 64);
-  return safe || null;
+  return String(env.TOT_PROFILE || "").trim() || null;
+}
+
+/**
+ * The active profile's safe filename token, or null for the default session. A
+ * clean short label passes through verbatim (readable files); ANY other opaque
+ * value is hashed — collision-resistant and incapable of a `/` or `..` path
+ * escape, so `TOT_PROFILE` can be a literally arbitrary identifier. Hashing the
+ * RAW value (not a stripped form) keeps distinct tokens distinct.
+ */
+export function profileSlug(env = process.env) {
+  const raw = String(env.TOT_PROFILE || "").trim();
+  if (!raw) return null;
+  const lower = raw.toLowerCase();
+  if (CLEAN_PROFILE_RE.test(lower)) return lower;
+  return `h${createHash("sha256").update(raw).digest("hex").slice(0, 16)}`;
 }
 
 /** Absolute path to the credential file for this environment (+ TOT_PROFILE). */
 export function defaultCredentialsPath(env = process.env) {
   const home = env.TOT_HOME || homedir();
-  const profile = activeProfile(env);
-  return join(home, ".tot", profile ? `credentials.${profile}.json` : "credentials.json");
+  const slug = profileSlug(env);
+  return join(home, ".tot", slug ? `credentials.${slug}.json` : "credentials.json");
 }
 
 /**