@zachjxyz/moxie 0.2.4 → 0.3.0

package/lib/gateway-keys.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# moxie/lib/gateway-keys.sh — Secure API key storage for AI Gateway
+# Compatible with Bash 3.2. Requires platform.sh (MOXIE_PLATFORM).
+
+MOXIE_KEY_DIR="$HOME/.moxie"
+
+# Detect WSL (subset of linux)
+_is_wsl() {
+    [ "$MOXIE_PLATFORM" = "linux" ] && grep -qi microsoft /proc/version 2>/dev/null
+}
+
+# ---- Store an API key ----
+# Usage: gateway_store_key <service_label>
+# Reads key interactively from /dev/tty (never from args or stdin pipe).
+
+gateway_store_key() {
+    local label="${1:-vercel-ai-gateway}"
+
+    printf "Enter API key for %s: " "$label" >&2
+    local key
+    # Read without echo so the key isn't visible
+    stty -echo < /dev/tty 2>/dev/null
+    IFS= read -r key < /dev/tty
+    stty echo < /dev/tty 2>/dev/null
+    printf "\n" >&2
+
+    if [ -z "$key" ]; then
+        echo "ERROR: No key provided." >&2
+        return 1
+    fi
+
+    if _is_wsl; then
+        powershell.exe -Command "[System.Environment]::SetEnvironmentVariable('MOXIE_GATEWAY_KEY_${label}', '${key}', 'User')" 2>/dev/null
+        if [ $? -eq 0 ]; then
+            echo "Key stored in Windows User environment." >&2
+        else
+            echo "ERROR: Failed to store key via powershell.exe." >&2
+            return 1
+        fi
+    elif [ "$MOXIE_PLATFORM" = "darwin" ]; then
+        security add-generic-password -a moxie -s "$label" -w "$key" -U 2>/dev/null
+        if [ $? -eq 0 ]; then
+            echo "Key stored in macOS Keychain." >&2
+        else
+            echo "ERROR: Failed to store key in Keychain." >&2
+            return 1
+        fi
+    elif [ "$MOXIE_PLATFORM" = "linux" ]; then
+        mkdir -p "$MOXIE_KEY_DIR"
+        chmod 700 "$MOXIE_KEY_DIR"
+        local enc_file="$MOXIE_KEY_DIR/${label}.key.enc"
+        printf "Set a passphrase to encrypt your key (you'll need this when moxie starts):\n" >&2
+        echo "$key" | openssl enc -aes-256-cbc -pbkdf2 -salt -out "$enc_file" -pass file:/dev/tty 2>/dev/null
+        if [ $? -eq 0 ]; then
+            chmod 600 "$enc_file"
+            echo "Key encrypted and stored at $enc_file" >&2
+        else
+            echo "ERROR: Failed to encrypt key." >&2
+            return 1
+        fi
+    else
+        echo "ERROR: Unsupported platform for key storage." >&2
+        return 1
+    fi
+}
+
+# ---- Retrieve an API key ----
+# Usage: key=$(gateway_get_key <service_label>)
+# Outputs key to stdout. Returns 1 if not found.
+
+gateway_get_key() {
+    local label="${1:-vercel-ai-gateway}"
+
+    if _is_wsl; then
+        local key
+        key=$(powershell.exe -Command "[System.Environment]::GetEnvironmentVariable('MOXIE_GATEWAY_KEY_${label}', 'User')" 2>/dev/null | tr -d '\r\n')
+        if [ -n "$key" ]; then
+            echo "$key"
+            return 0
+        fi
+        return 1
+    elif [ "$MOXIE_PLATFORM" = "darwin" ]; then
+        security find-generic-password -a moxie -s "$label" -w 2>/dev/null
+        return $?
+    elif [ "$MOXIE_PLATFORM" = "linux" ]; then
+        local enc_file="$MOXIE_KEY_DIR/${label}.key.enc"
+        if [ ! -f "$enc_file" ]; then
+            return 1
+        fi
+        # Use MOXIE_KEY_PASSPHRASE env var for non-interactive, otherwise prompt
+        if [ -n "${MOXIE_KEY_PASSPHRASE:-}" ]; then
+            openssl enc -aes-256-cbc -pbkdf2 -d -in "$enc_file" -pass "pass:$MOXIE_KEY_PASSPHRASE" 2>/dev/null
+        else
+            openssl enc -aes-256-cbc -pbkdf2 -d -in "$enc_file" -pass file:/dev/tty 2>/dev/null
+        fi
+        return $?
+    fi
+    return 1
+}
+
+# ---- Check if a key exists (no output) ----
+# Usage: gateway_has_key <service_label> && echo "yes"
+
+gateway_has_key() {
+    local label="${1:-vercel-ai-gateway}"
+
+    if _is_wsl; then
+        local key
+        key=$(powershell.exe -Command "[System.Environment]::GetEnvironmentVariable('MOXIE_GATEWAY_KEY_${label}', 'User')" 2>/dev/null | tr -d '\r\n')
+        [ -n "$key" ]
+    elif [ "$MOXIE_PLATFORM" = "darwin" ]; then
+        security find-generic-password -a moxie -s "$label" -w &>/dev/null
+    elif [ "$MOXIE_PLATFORM" = "linux" ]; then
+        [ -f "$MOXIE_KEY_DIR/${label}.key.enc" ]
+    else
+        return 1
+    fi
+}