@visa/cli 5.0.0-rc.364 → 5.0.0-rc.366

package/native/visa-keychain.m

@@ -1,367 +0,0 @@
-#import <Foundation/Foundation.h>
-#import <Security/Security.h>
-#import <LocalAuthentication/LocalAuthentication.h>
-#import <AppKit/AppKit.h>
-
-// SPKI DER header for P-256 (prime256v1) uncompressed public key
-static const unsigned char SPKI_HEADER[] = {
-    0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86,
-    0x48, 0xCE, 0x3D, 0x02, 0x01, 0x06, 0x08, 0x2A,
-    0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03,
-    0x42, 0x00
-};
-
-static NSString *kService   = @"visa-cli";
-static NSString *kKeyAcct   = @"attestation-key";
-static NSString *kTokenAcct = @"session-token";
-
-static NSString *spkiPublicKeyB64(SecKeyRef key) {
-    SecKeyRef pubKey = SecKeyCopyPublicKey(key);
-    if (!pubKey) return nil;
-
-    CFErrorRef pubErr = NULL;
-    CFDataRef rawPub = SecKeyCopyExternalRepresentation(pubKey, &pubErr);
-    CFRelease(pubKey);
-    if (!rawPub) {
-        if (pubErr) CFRelease(pubErr);
-        return nil;
-    }
-
-    NSMutableData *spki = [NSMutableData dataWithBytes:SPKI_HEADER length:sizeof(SPKI_HEADER)];
-    [spki appendData:(__bridge NSData *)rawPub];
-    CFRelease(rawPub);
-    return [spki base64EncodedStringWithOptions:0];
-}
-
-// ---------------------------------------------------------------------------
-// Keychain helpers for generic password items
-// ---------------------------------------------------------------------------
-
-static OSStatus storeItem(NSString *account, NSData *data) {
-    NSDictionary *delQ = @{
-        (__bridge id)kSecClass:       (__bridge id)kSecClassGenericPassword,
-        (__bridge id)kSecAttrService: kService,
-        (__bridge id)kSecAttrAccount: account,
-    };
-    SecItemDelete((__bridge CFDictionaryRef)delQ);
-
-    NSDictionary *addQ = @{
-        (__bridge id)kSecClass:       (__bridge id)kSecClassGenericPassword,
-        (__bridge id)kSecAttrService: kService,
-        (__bridge id)kSecAttrAccount: account,
-        (__bridge id)kSecValueData:   data,
-    };
-    return SecItemAdd((__bridge CFDictionaryRef)addQ, NULL);
-}
-
-static NSData *retrieveItem(NSString *account) {
-    NSDictionary *q = @{
-        (__bridge id)kSecClass:       (__bridge id)kSecClassGenericPassword,
-        (__bridge id)kSecAttrService: kService,
-        (__bridge id)kSecAttrAccount: account,
-        (__bridge id)kSecReturnData:  @YES,
-    };
-    CFTypeRef result = NULL;
-    OSStatus st = SecItemCopyMatching((__bridge CFDictionaryRef)q, &result);
-    if (st != errSecSuccess) return nil;
-    return (__bridge NSData *)result;
-}
-
-static void deleteItem(NSString *account) {
-    NSDictionary *q = @{
-        (__bridge id)kSecClass:       (__bridge id)kSecClassGenericPassword,
-        (__bridge id)kSecAttrService: kService,
-        (__bridge id)kSecAttrAccount: account,
-    };
-    SecItemDelete((__bridge CFDictionaryRef)q);
-}
-
-// ---------------------------------------------------------------------------
-// Key operations — raw EC key bytes stored as Keychain generic password,
-// imported as in-memory SecKeyRef for signing (avoids CDSA limitations)
-// ---------------------------------------------------------------------------
-
-int cmd_generate_key(void) {
-    // Generate P-256 key pair in memory
-    NSDictionary *attrs = @{
-        (__bridge id)kSecAttrKeyType:       (__bridge id)kSecAttrKeyTypeECSECPrimeRandom,
-        (__bridge id)kSecAttrKeySizeInBits: @256,
-        (__bridge id)kSecAttrIsPermanent:   @NO,
-    };
-    CFErrorRef keyErr = NULL;
-    SecKeyRef privKey = SecKeyCreateRandomKey((__bridge CFDictionaryRef)attrs, &keyErr);
-    if (!privKey) {
-        if (keyErr) CFRelease(keyErr);
-        printf("ERROR:Key generation failed\n");
-        return 1;
-    }
-
-    // Export raw private key bytes (caller stores via `security` CLI)
-    CFErrorRef expErr = NULL;
-    CFDataRef rawPriv = SecKeyCopyExternalRepresentation(privKey, &expErr);
-    if (!rawPriv) {
-        CFRelease(privKey);
-        if (expErr) CFRelease(expErr);
-        printf("ERROR:Failed to export private key\n");
-        return 1;
-    }
-    NSString *privB64 = [(__bridge NSData *)rawPriv base64EncodedStringWithOptions:0];
-    CFRelease(rawPriv);
-
-    NSString *pubB64 = spkiPublicKeyB64(privKey);
-    CFRelease(privKey);
-    if (!pubB64) {
-        printf("ERROR:Failed to export public key\n");
-        return 1;
-    }
-
-    // Output both keys: OK:<private-b64>:<public-spki-b64>
-    printf("OK:%s:%s\n", privB64.UTF8String, pubB64.UTF8String);
-    return 0;
-}
-
-int cmd_public_key(void) {
-    NSFileHandle *input = [NSFileHandle fileHandleWithStandardInput];
-    NSData *stdinData = [input readDataToEndOfFile];
-    NSString *keyB64 = [[NSString alloc] initWithData:stdinData encoding:NSUTF8StringEncoding];
-    keyB64 = [keyB64 stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]];
-
-    if (!keyB64 || keyB64.length == 0) {
-        printf("ERROR:No key provided on stdin\n");
-        return 1;
-    }
-
-    NSData *rawKey = [[NSData alloc] initWithBase64EncodedString:keyB64 options:0];
-    if (!rawKey) {
-        printf("ERROR:Invalid base64 key data\n");
-        return 1;
-    }
-
-    NSDictionary *keyAttrs = @{
-        (__bridge id)kSecAttrKeyType:  (__bridge id)kSecAttrKeyTypeECSECPrimeRandom,
-        (__bridge id)kSecAttrKeyClass: (__bridge id)kSecAttrKeyClassPrivate,
-        (__bridge id)kSecAttrKeySizeInBits: @256,
-    };
-    CFErrorRef importErr = NULL;
-    SecKeyRef privKey = SecKeyCreateWithData(
-        (__bridge CFDataRef)rawKey,
-        (__bridge CFDictionaryRef)keyAttrs,
-        &importErr);
-    if (!privKey) {
-        if (importErr) CFRelease(importErr);
-        printf("ERROR:Failed to import key for public export\n");
-        return 1;
-    }
-
-    NSString *pubB64 = spkiPublicKeyB64(privKey);
-    CFRelease(privKey);
-    if (!pubB64) {
-        printf("ERROR:Failed to export public key\n");
-        return 1;
-    }
-
-    printf("OK:%s\n", pubB64.UTF8String);
-    return 0;
-}
-
-int cmd_sign(const char *challenge, const char *reason) {
-    // Read base64-encoded private key from stdin (avoids Keychain ACL issues
-    // and keeps the key out of the process argument list visible in `ps`)
-    NSFileHandle *input = [NSFileHandle fileHandleWithStandardInput];
-    NSData *stdinData = [input readDataToEndOfFile];
-    NSString *keyB64 = [[NSString alloc] initWithData:stdinData encoding:NSUTF8StringEncoding];
-    keyB64 = [keyB64 stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]];
-
-    if (!keyB64 || keyB64.length == 0) {
-        printf("ERROR:No key provided on stdin\n");
-        return 1;
-    }
-
-    NSData *rawKey = [[NSData alloc] initWithBase64EncodedString:keyB64 options:0];
-    if (!rawKey) {
-        printf("ERROR:Invalid base64 key data\n");
-        return 1;
-    }
-
-    // Authentication gate (Touch ID OR password — whichever the user has).
-    //
-    // We use LAPolicyDeviceOwnerAuthentication, which presents a single
-    // system dialog: Touch ID on enrolled hardware, password fallback
-    // everywhere else (including users who skipped biometric setup and
-    // Macs without a Touch ID sensor). This front-focus fix applies to
-    // BOTH dialogs — they are the same system-level window, just with
-    // different input modes. If we only fixed the Touch ID path we would
-    // still be burying the password prompt behind the terminal for every
-    // non-biometric user.
-    //
-    // Front-focus fix: bare CLI binaries have no NSApplication, so the
-    // system LAContext dialog gets parented to whichever process happens to
-    // be frontmost (usually the terminal or Claude Code), which puts the
-    // prompt *behind* the user's current window — users never see it, time
-    // out, and their spend gets cancelled.
-    //
-    // Making the binary an Accessory-policy NSApplication and explicitly
-    // calling activateIgnoringOtherApps: before evaluatePolicy tells the
-    // window server this process is the new frontmost app, so the auth
-    // prompt (biometric or password) is raised on top of all other
-    // windows. Accessory policy means no Dock icon, no menu bar — the
-    // binary stays invisible except for the dialog itself.
-    [NSApplication sharedApplication];
-    [NSApp setActivationPolicy:NSApplicationActivationPolicyAccessory];
-    [NSApp activateIgnoringOtherApps:YES];
-
-    LAContext *ctx = [[LAContext alloc] init];
-    NSString *reasonStr = reason
-        ? [NSString stringWithUTF8String:reason]
-        : @"approve payment";
-
-    __block BOOL done = NO;
-    __block BOOL authOk = NO;
-    [ctx evaluatePolicy:LAPolicyDeviceOwnerAuthentication
-        localizedReason:reasonStr
-                  reply:^(BOOL success, NSError *err) {
-        authOk = success;
-        done = YES;
-    }];
-
-    // Pump the main run loop while waiting for the reply block. Using
-    // dispatch_semaphore_wait here would freeze the main thread and
-    // prevent the WindowServer from delivering the activation we just
-    // requested — the dialog would come up, but not on top.
-    NSDate *timeout = [NSDate dateWithTimeIntervalSinceNow:55.0];
-    while (!done) {
-        @autoreleasepool {
-            [[NSRunLoop currentRunLoop] runMode:NSDefaultRunLoopMode
-                                     beforeDate:[NSDate dateWithTimeIntervalSinceNow:0.05]];
-            if ([[NSDate date] compare:timeout] == NSOrderedDescending) {
-                printf("ERROR:Authentication timed out\n");
-                return 1;
-            }
-        }
-    }
-
-    if (!authOk) {
-        printf("ERROR:Authentication cancelled by user\n");
-        return 1;
-    }
-
-    // Import as in-memory SecKeyRef (modern API, not CDSA)
-    NSDictionary *keyAttrs = @{
-        (__bridge id)kSecAttrKeyType:  (__bridge id)kSecAttrKeyTypeECSECPrimeRandom,
-        (__bridge id)kSecAttrKeyClass: (__bridge id)kSecAttrKeyClassPrivate,
-        (__bridge id)kSecAttrKeySizeInBits: @256,
-    };
-    CFErrorRef importErr = NULL;
-    SecKeyRef privKey = SecKeyCreateWithData(
-        (__bridge CFDataRef)rawKey,
-        (__bridge CFDictionaryRef)keyAttrs,
-        &importErr);
-    if (!privKey) {
-        if (importErr) CFRelease(importErr);
-        printf("ERROR:Failed to import key for signing\n");
-        return 1;
-    }
-
-    // Sign (ECDSA-SHA256, same format as Node.js crypto.createSign('SHA256'))
-    NSData *data = [[NSString stringWithUTF8String:challenge] dataUsingEncoding:NSUTF8StringEncoding];
-    CFErrorRef sigErr = NULL;
-    CFDataRef sig = SecKeyCreateSignature(
-        privKey,
-        kSecKeyAlgorithmECDSASignatureMessageX962SHA256,
-        (__bridge CFDataRef)data,
-        &sigErr);
-    CFRelease(privKey);
-
-    if (!sig) {
-        if (sigErr) CFRelease(sigErr);
-        printf("ERROR:Signing failed\n");
-        return 1;
-    }
-
-    printf("OK:%s\n", [(__bridge NSData *)sig base64EncodedStringWithOptions:0].UTF8String);
-    CFRelease(sig);
-    return 0;
-}
-
-int cmd_delete_key(void) {
-    // Legacy: also clean up any old keychain item from previous versions
-    deleteItem(kKeyAcct);
-    printf("OK\n");
-    return 0;
-}
-
-// ---------------------------------------------------------------------------
-// Session token operations
-// ---------------------------------------------------------------------------
-
-int cmd_store_token(const char *token) {
-    NSData *val = [[NSString stringWithUTF8String:token] dataUsingEncoding:NSUTF8StringEncoding];
-    OSStatus st = storeItem(kTokenAcct, val);
-    if (st != errSecSuccess) {
-        printf("ERROR:Failed to store token (status %d)\n", (int)st);
-        return 1;
-    }
-    printf("OK\n");
-    return 0;
-}
-
-int cmd_get_token(void) {
-    NSData *d = retrieveItem(kTokenAcct);
-    if (!d) {
-        printf("ERROR:not_found\n");
-        return 1;
-    }
-    NSString *tok = [[NSString alloc] initWithData:d encoding:NSUTF8StringEncoding];
-    printf("OK:%s\n", tok.UTF8String);
-    return 0;
-}
-
-int cmd_delete_token(void) {
-    deleteItem(kTokenAcct);
-    printf("OK\n");
-    return 0;
-}
-
-// ---------------------------------------------------------------------------
-// Check
-// ---------------------------------------------------------------------------
-
-int cmd_check(void) {
-    LAContext *ctx = [[LAContext alloc] init];
-    NSError *err = nil;
-    if (![ctx canEvaluatePolicy:LAPolicyDeviceOwnerAuthentication error:&err]) {
-        printf("ERROR:Touch ID unavailable\n");
-        return 1;
-    }
-    printf("OK\n");
-    return 0;
-}
-
-// ---------------------------------------------------------------------------
-// Main
-// ---------------------------------------------------------------------------
-
-int main(int argc, const char *argv[]) {
-    @autoreleasepool {
-        if (argc < 2) {
-            fprintf(stderr, "Usage: visa-keychain <command> [args...]\n");
-            return 1;
-        }
-        const char *cmd = argv[1];
-        if      (strcmp(cmd, "generate-key") == 0) return cmd_generate_key();
-        else if (strcmp(cmd, "public-key") == 0) return cmd_public_key();
-        else if (strcmp(cmd, "sign") == 0) {
-            if (argc < 3) { fprintf(stderr, "Usage: visa-keychain sign <challenge> [reason]\n"); return 1; }
-            return cmd_sign(argv[2], argc >= 4 ? argv[3] : NULL);
-        }
-        else if (strcmp(cmd, "delete-key")   == 0) return cmd_delete_key();
-        else if (strcmp(cmd, "store-token")  == 0) {
-            if (argc < 3) { fprintf(stderr, "Usage: visa-keychain store-token <token>\n"); return 1; }
-            return cmd_store_token(argv[2]);
-        }
-        else if (strcmp(cmd, "get-token")    == 0) return cmd_get_token();
-        else if (strcmp(cmd, "delete-token") == 0) return cmd_delete_token();
-        else if (strcmp(cmd, "check")        == 0) return cmd_check();
-        else { fprintf(stderr, "Unknown command: %s\n", cmd); return 1; }
-    }
-}