@tomato414941/foundation 0.18.0 → 0.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomato414941/foundation",
-  "version": "0.18.0",
+  "version": "0.22.0",
   "description": "Foundation CLI: give this machine a WebAuthn credential, and hand what is kept to a command without it passing through the agent.",
   "type": "module",
   "engines": {

package/runtime.mjs

@@ -231,9 +231,9 @@ async function main() {
   async function upgrade(label) {
     const me = await send('/v1/principals/me', undefined, { method: 'GET' });
     if (me.key?.environment) return;
-    const { options } = await send('/v1/credentials?as=' + encodeURIComponent(me.principal.id), { kind: 'webauthn' });
+    const { options } = await send('/v1/principals/' + encodeURIComponent(me.principal.id) + '/credentials', { kind: 'webauthn' });
     const made = createCredential(options, url.origin);
-    await send('/v1/credentials?as=' + encodeURIComponent(me.principal.id), { kind: 'webauthn', name: label, credential: made.response }, { method: 'PUT' });
+    await send('/v1/principals/' + encodeURIComponent(me.principal.id) + '/credentials', { kind: 'webauthn', name: label, credential: made.response }, { method: 'PUT' });
     await writeKey(keyPath, JSON.stringify({ webauthn_credential: made.credential }), !process.env.FOUNDATION_RUNTIME_KEY_FILE);
     key = { credential: made.credential };
   }
@@ -242,7 +242,7 @@ async function main() {
   async function publishKey() {
     if (key.own) return;
     const made = generateKey();
-    const published = await send('/v1/key', { public_key: made.publicKey.toString('base64url') }, { method: 'PUT', accept: data => data.error?.code === 'key_exists' });
+    const published = await send('/v1/principals/me/key', { public_key: made.publicKey.toString('base64url') }, { method: 'PUT', accept: data => data.error?.code === 'key_exists' });
     if (published.error) return;
     key.own = { private_key: made.privateKey.toString('base64url') };
     await writeKey(keyPath, JSON.stringify({ webauthn_credential: key.credential, key: key.own }), !process.env.FOUNDATION_RUNTIME_KEY_FILE);
@@ -278,7 +278,7 @@ async function main() {
       // No key, or one this server does not know: a WebAuthn credential made here, proven by nobody, makes this machine a
       // principal there, of nobody's - the same call a browser's passkey makes.
       key = null; me = null;
-      const post = (method, payload) => fetch(url.origin + '/v1/credentials', { method, headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload), redirect: 'error', signal: AbortSignal.timeout(30_000) });
+      const post = (method, payload) => fetch(url.origin + '/v1/principals', { method, headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload), redirect: 'error', signal: AbortSignal.timeout(30_000) });
       const begun = await post('POST', { kind: 'webauthn', name: wanted });
       const { options, error } = await begun.json();
       if (!begun.ok) throw new Error('Foundation did not begin a credential (' + begun.status + ', ' + (error?.code || 'unknown') + ').');
@@ -331,21 +331,43 @@ async function main() {
   // A secret is sealed here, with a key of its own, for each of the owner's recipients: the server keeps what it
   // cannot open. This machine is not among them; it places the bytes and does not read them back.
   const sealedFor = async bytes => {
-    const { recipients } = await send(forHolder('/v1/recipients'), undefined, { method: 'GET' });
+    const { recipients } = await send('/v1/principals/' + encodeURIComponent(owner || 'me') + '/recipients', undefined, { method: 'GET' });
     if (!Array.isArray(recipients) || !recipients.length) throw new Error('Nobody can open a secret kept for this owner yet: the owner needs a key, or Foundation needs to act for them.');
     const contentKey = newContentKey();
     return { content: sealContent(contentKey, bytes).toString('base64url'), envelopes: Object.fromEntries(recipients.map(item => [item.principal_id, seal(contentKey, Buffer.from(item.public_key, 'base64url')).toString('base64url')])) };
   };
   if (action === 'keep') {
     const saved = await send(forHolder('/v1/resources?kind=secret&name=' + encodeURIComponent(call.name)), await sealedFor(call.body), { method: 'PUT' });
-    try { await send('/v1/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
+    try { await send('/v1/principals/me/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
     console.log(JSON.stringify(saved));
     return;
   }
+  // A secret this machine was handed an envelope for is opened here, with its own key: the server keeps what it cannot
+  // open, and nobody else has to be able to open it for this machine to use it. Everything else - a connection, a secret
+  // not handed to this machine - is asked of the server, which hands over only what Foundation may open for the owner.
+  const handed = { environment: {}, files: [] };
+  let asked = names;
+  if (key.own && names.some(item => typeof item.name === 'string')) {
+    const shown = owner ? (await send('/v1/resources?shown=me', undefined, { method: 'GET', accept: () => true })).resources ?? [] : [];
+    asked = [];
+    for (const item of names) {
+      let resource = null;
+      if (typeof item.name === 'string') {
+        resource = owner ? shown.find(row => row.kind === 'secret' && row.name === item.name && row.owner_id === owner)
+          : (await send('/v1/resources?kind=secret&name=' + encodeURIComponent(item.name), undefined, { method: 'GET', accept: () => true })).resource;
+      }
+      const kept = resource ? await send('/v1/resources/' + resource.id + '/content', undefined, { method: 'GET', accept: () => true }) : null;
+      if (!kept?.envelope) { asked.push(item); continue; }
+      const bytes = openContent(openEnvelope(Buffer.from(kept.envelope, 'base64url'), Buffer.from(key.own.private_key, 'base64url')), Buffer.from(kept.content, 'base64url'));
+      if (item.filename !== undefined) handed.files.push({ env: item.as, filename: item.filename, content: bytes.toString('base64'), encoding: 'base64' });
+      else handed.environment[item.as] = bytes.toString('utf8');
+    }
+  }
   let injection;
-  if (names.length) ({ injection } = await send(forHolder('/v1/injections'), { names }));
+  if (asked.length) ({ injection } = await send(forHolder('/v1/injections'), { names: asked }));
   else injection = { environment: {}, files: [] };
   if (!injection || typeof injection.environment !== 'object' || !Array.isArray(injection.files)) throw new Error('Foundation returned an invalid injection.');
+  injection = { environment: { ...injection.environment, ...handed.environment }, files: [...injection.files, ...handed.files] };
   // What each of them sets is the server's to say; this applies it and refuses anything it may not set.
   const environment = { ...process.env };
   delete environment.FOUNDATION_RUNTIME_KEY_FILE;
@@ -414,7 +436,7 @@ async function main() {
       let saved;
       try { saved = await send(forHolder('/v1/resources?kind=secret&name=' + encodeURIComponent(output.name)), await sealedFor(bytes), { method: 'PUT' }); }
       catch { throw new Error(recovery()); }
-      try { await send('/v1/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
+      try { await send('/v1/principals/me/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
       retainOutput = false;
       console.error('Saved output as ' + JSON.stringify(output.name) + '.');
     }