@tomato414941/foundation 0.18.0 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomato414941/foundation",
-  "version": "0.18.0",
+  "version": "0.23.0",
   "description": "Foundation CLI: give this machine a WebAuthn credential, and hand what is kept to a command without it passing through the agent.",
   "type": "module",
   "engines": {

package/runtime.mjs

@@ -231,9 +231,9 @@ async function main() {
   async function upgrade(label) {
     const me = await send('/v1/principals/me', undefined, { method: 'GET' });
     if (me.key?.environment) return;
-    const { options } = await send('/v1/credentials?as=' + encodeURIComponent(me.principal.id), { kind: 'webauthn' });
+    const { options } = await send('/v1/principals/' + encodeURIComponent(me.principal.id) + '/credentials', { kind: 'webauthn' });
     const made = createCredential(options, url.origin);
-    await send('/v1/credentials?as=' + encodeURIComponent(me.principal.id), { kind: 'webauthn', name: label, credential: made.response }, { method: 'PUT' });
+    await send('/v1/principals/' + encodeURIComponent(me.principal.id) + '/credentials', { kind: 'webauthn', name: label, credential: made.response }, { method: 'PUT' });
     await writeKey(keyPath, JSON.stringify({ webauthn_credential: made.credential }), !process.env.FOUNDATION_RUNTIME_KEY_FILE);
     key = { credential: made.credential };
   }
@@ -242,7 +242,7 @@ async function main() {
   async function publishKey() {
     if (key.own) return;
     const made = generateKey();
-    const published = await send('/v1/key', { public_key: made.publicKey.toString('base64url') }, { method: 'PUT', accept: data => data.error?.code === 'key_exists' });
+    const published = await send('/v1/principals/me/key', { public_key: made.publicKey.toString('base64url') }, { method: 'PUT', accept: data => data.error?.code === 'key_exists' });
     if (published.error) return;
     key.own = { private_key: made.privateKey.toString('base64url') };
     await writeKey(keyPath, JSON.stringify({ webauthn_credential: key.credential, key: key.own }), !process.env.FOUNDATION_RUNTIME_KEY_FILE);
@@ -256,10 +256,6 @@ async function main() {
   if (action === 'token') { console.log(token); return; }
   // One request, as this machine, and the answer printed as it came. Nothing here knows the endpoints.
   if (action === 'api') {
-    if (!publicSpec && !/[?&]as=/.test(call.target)) {
-      const me = await send('/v1/principals/me', undefined, { method: 'GET', accept: () => true });
-      if (me.acts_for?.length === 1) call.target += (call.target.includes('?') ? '&' : '?') + 'as=' + encodeURIComponent(me.acts_for[0]);
-    }
     const response = await fetch(url.origin + call.target, { method: call.method, headers: { ...(token ? { authorization: 'Bearer ' + token } : {}), ...(call.body === undefined ? {} : { 'content-type': call.type }) },
       ...(call.body === undefined ? {} : { body: call.body }), redirect: 'error', signal: AbortSignal.timeout(30_000) });
     const bytes = Buffer.from(await response.arrayBuffer());
@@ -278,7 +274,7 @@ async function main() {
       // No key, or one this server does not know: a WebAuthn credential made here, proven by nobody, makes this machine a
       // principal there, of nobody's - the same call a browser's passkey makes.
       key = null; me = null;
-      const post = (method, payload) => fetch(url.origin + '/v1/credentials', { method, headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload), redirect: 'error', signal: AbortSignal.timeout(30_000) });
+      const post = (method, payload) => fetch(url.origin + '/v1/principals', { method, headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload), redirect: 'error', signal: AbortSignal.timeout(30_000) });
       const begun = await post('POST', { kind: 'webauthn', name: wanted });
       const { options, error } = await begun.json();
       if (!begun.ok) throw new Error('Foundation did not begin a credential (' + begun.status + ', ' + (error?.code || 'unknown') + ').');
@@ -307,8 +303,8 @@ async function main() {
   // Reading a secret this machine was handed an envelope for: its own, or one shown to it along a line.
   if (action === 'read') {
     if (!key.own) throw new Error('This machine has no key of its own here, so nothing sealed for it can be opened.');
-    const own = await send('/v1/resources?kind=secret&name=' + encodeURIComponent(call.name), undefined, { method: 'GET', accept: () => true });
-    const resource = own.resource ?? (await send('/v1/resources?shown=me', undefined, { method: 'GET' })).resources.find(item => item.kind === 'secret' && item.name === call.name);
+    const own = await send('/v1/principals/me/resources?kind=secret&name=' + encodeURIComponent(call.name), undefined, { method: 'GET', accept: () => true });
+    const resource = own.resource ?? (await send('/v1/principals/me/resources?shown=me', undefined, { method: 'GET' })).resources.find(item => item.kind === 'secret' && item.name === call.name);
     if (!resource) throw new Error('No secret named ' + JSON.stringify(call.name) + ' is kept by this machine or shown to it.');
     const kept = await send('/v1/resources/' + resource.id + '/content', undefined, { method: 'GET' });
     if (!kept.envelope) throw new Error('No envelope was made for this machine: it may read about this secret, but was not handed its key.');
@@ -327,25 +323,47 @@ async function main() {
   const acting = current.acts_for ?? [];
   const owner = process.env.FOUNDATION_AS || (acting.length === 1 ? acting[0] : null);
   if (!owner && acting.length > 1) throw new Error('This key acts for several principals. Set FOUNDATION_AS=<principal id> to say which one this run is for.');
-  const forHolder = target => owner ? target + (target.includes('?') ? '&' : '?') + 'as=' + encodeURIComponent(owner) : target;
+  const holder = '/v1/principals/' + encodeURIComponent(owner || 'me');
   // A secret is sealed here, with a key of its own, for each of the owner's recipients: the server keeps what it
   // cannot open. This machine is not among them; it places the bytes and does not read them back.
   const sealedFor = async bytes => {
-    const { recipients } = await send(forHolder('/v1/recipients'), undefined, { method: 'GET' });
+    const { recipients } = await send(holder + '/recipients', undefined, { method: 'GET' });
     if (!Array.isArray(recipients) || !recipients.length) throw new Error('Nobody can open a secret kept for this owner yet: the owner needs a key, or Foundation needs to act for them.');
     const contentKey = newContentKey();
     return { content: sealContent(contentKey, bytes).toString('base64url'), envelopes: Object.fromEntries(recipients.map(item => [item.principal_id, seal(contentKey, Buffer.from(item.public_key, 'base64url')).toString('base64url')])) };
   };
   if (action === 'keep') {
-    const saved = await send(forHolder('/v1/resources?kind=secret&name=' + encodeURIComponent(call.name)), await sealedFor(call.body), { method: 'PUT' });
-    try { await send('/v1/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
+    const saved = await send(holder + '/resources?kind=secret&name=' + encodeURIComponent(call.name), await sealedFor(call.body), { method: 'PUT' });
+    try { await send('/v1/principals/me/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
     console.log(JSON.stringify(saved));
     return;
   }
+  // A secret this machine was handed an envelope for is opened here, with its own key: the server keeps what it cannot
+  // open, and nobody else has to be able to open it for this machine to use it. Everything else - a connection, a secret
+  // not handed to this machine - is asked of the server, which hands over only what Foundation may open for the owner.
+  const handed = { environment: {}, files: [] };
+  let asked = names;
+  if (key.own && names.some(item => typeof item.name === 'string')) {
+    const shown = owner ? (await send('/v1/principals/me/resources?shown=me', undefined, { method: 'GET', accept: () => true })).resources ?? [] : [];
+    asked = [];
+    for (const item of names) {
+      let resource = null;
+      if (typeof item.name === 'string') {
+        resource = owner ? shown.find(row => row.kind === 'secret' && row.name === item.name && row.owner_id === owner)
+          : (await send('/v1/principals/me/resources?kind=secret&name=' + encodeURIComponent(item.name), undefined, { method: 'GET', accept: () => true })).resource;
+      }
+      const kept = resource ? await send('/v1/resources/' + resource.id + '/content', undefined, { method: 'GET', accept: () => true }) : null;
+      if (!kept?.envelope) { asked.push(item); continue; }
+      const bytes = openContent(openEnvelope(Buffer.from(kept.envelope, 'base64url'), Buffer.from(key.own.private_key, 'base64url')), Buffer.from(kept.content, 'base64url'));
+      if (item.filename !== undefined) handed.files.push({ env: item.as, filename: item.filename, content: bytes.toString('base64'), encoding: 'base64' });
+      else handed.environment[item.as] = bytes.toString('utf8');
+    }
+  }
   let injection;
-  if (names.length) ({ injection } = await send(forHolder('/v1/injections'), { names }));
+  if (asked.length) ({ injection } = await send(holder + '/injections', { names: asked }));
   else injection = { environment: {}, files: [] };
   if (!injection || typeof injection.environment !== 'object' || !Array.isArray(injection.files)) throw new Error('Foundation returned an invalid injection.');
+  injection = { environment: { ...injection.environment, ...handed.environment }, files: [...injection.files, ...handed.files] };
   // What each of them sets is the server's to say; this applies it and refuses anything it may not set.
   const environment = { ...process.env };
   delete environment.FOUNDATION_RUNTIME_KEY_FILE;
@@ -412,9 +430,9 @@ async function main() {
       retainOutput = true;
       // The command wrote it; the agent never saw it, and keeps it that way: the line drawn for the one who kept it is declined.
       let saved;
-      try { saved = await send(forHolder('/v1/resources?kind=secret&name=' + encodeURIComponent(output.name)), await sealedFor(bytes), { method: 'PUT' }); }
+      try { saved = await send(holder + '/resources?kind=secret&name=' + encodeURIComponent(output.name), await sealedFor(bytes), { method: 'PUT' }); }
       catch { throw new Error(recovery()); }
-      try { await send('/v1/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
+      try { await send('/v1/principals/me/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
       retainOutput = false;
       console.error('Saved output as ' + JSON.stringify(output.name) + '.');
     }