@zqagent/shared 0.0.0-stage → 0.1.0

package/dist/secrets.js

@@ -0,0 +1,82 @@
+// src/secrets.ts
+import * as crypto from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+function encryptWithKey(key, plain) {
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+  const enc = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return [
+    "v1",
+    iv.toString("base64"),
+    tag.toString("base64"),
+    enc.toString("base64")
+  ].join(":");
+}
+function decryptWithKey(key, payload) {
+  try {
+    const parts = payload.split(":");
+    if (parts.length !== 4 || parts[0] !== "v1") return null;
+    const iv = Buffer.from(parts[1], "base64");
+    const tag = Buffer.from(parts[2], "base64");
+    const data = Buffer.from(parts[3], "base64");
+    const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([
+      decipher.update(data),
+      decipher.final()
+    ]).toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function loadOrCreateMasterKey(masterKeyFile) {
+  if (fs.existsSync(masterKeyFile)) {
+    const hex = fs.readFileSync(masterKeyFile, "utf8").trim();
+    if (/^[0-9a-f]{64}$/i.test(hex)) {
+      return Buffer.from(hex, "hex");
+    }
+    console.warn(`\u26A0\uFE0F  \u4E3B\u5BC6\u94A5\u6587\u4EF6\u635F\u574F\uFF0C\u5DF2\u91CD\u65B0\u751F\u6210\uFF08\u65E7\u5BC6\u6587\u5C06\u65E0\u6CD5\u89E3\u5BC6\uFF09`);
+  }
+  const key = crypto.randomBytes(32);
+  fs.mkdirSync(path.dirname(masterKeyFile), { recursive: true, mode: 448 });
+  fs.writeFileSync(masterKeyFile, key.toString("hex"), {
+    mode: 384,
+    encoding: "utf8"
+  });
+  return key;
+}
+function masterKeyFromHex(hex) {
+  const h = hex.trim();
+  return /^[0-9a-f]{64}$/i.test(h) ? Buffer.from(h, "hex") : null;
+}
+var SecretBox = class _SecretBox {
+  constructor(key) {
+    this.key = key;
+  }
+  key;
+  /** 主密钥来源一：本机密钥文件（不存在则创建） */
+  static fromFile(masterKeyFile) {
+    return new _SecretBox(loadOrCreateMasterKey(masterKeyFile));
+  }
+  /** 主密钥来源二：hex 字符串（如环境变量 SECRET_KEY）；非法返回 null */
+  static fromHex(hex) {
+    const key = masterKeyFromHex(hex);
+    return key ? new _SecretBox(key) : null;
+  }
+  encrypt(plain) {
+    return encryptWithKey(this.key, plain);
+  }
+  decrypt(payload) {
+    return decryptWithKey(this.key, payload);
+  }
+};
+export {
+  SecretBox,
+  decryptWithKey,
+  encryptWithKey,
+  loadOrCreateMasterKey,
+  masterKeyFromHex
+};
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secrets.ts"],"sourcesContent":["/**\n * 对称加密共享模块\n *\n * 从 CLI 的 connection.ts 抽出的 AES-256-GCM 加解密实现，供 CLI 与\n * 云端 Server 复用。密文格式 `v1:iv:tag:ciphertext`（均 base64）。\n *\n * 安全说明：这是「本机混淆式加密」（纯 Node 无外部依赖），主密钥与密文\n * 可存于同一台机器，能防止明文泄露 / 被 grep / 误提交，但无法抵御能读取\n * 本机主密钥文件的攻击者（如需 OS 级密钥链，可替换为 keytar / libsecret 等）。\n */\nimport * as crypto from \"crypto\";\nimport * as fs from \"fs\";\nimport * as path from \"path\";\n\n/** 用给定主密钥做 AES-256-GCM 加密，输出 `v1:iv:tag:ciphertext`（base64） */\nexport function encryptWithKey(key: Buffer, plain: string): string {\n  const iv = crypto.randomBytes(12);\n  const cipher = crypto.createCipheriv(\"aes-256-gcm\", key, iv);\n  const enc = Buffer.concat([cipher.update(plain, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return [\n    \"v1\",\n    iv.toString(\"base64\"),\n    tag.toString(\"base64\"),\n    enc.toString(\"base64\"),\n  ].join(\":\");\n}\n\n/** 用给定主密钥解密；格式非法 / 认证失败返回 null */\nexport function decryptWithKey(key: Buffer, payload: string): string | null {\n  try {\n    const parts = payload.split(\":\");\n    if (parts.length !== 4 || parts[0] !== \"v1\") return null;\n    const iv = Buffer.from(parts[1]!, \"base64\");\n    const tag = Buffer.from(parts[2]!, \"base64\");\n    const data = Buffer.from(parts[3]!, \"base64\");\n    const decipher = crypto.createDecipheriv(\"aes-256-gcm\", key, iv);\n    decipher.setAuthTag(tag);\n    return Buffer.concat([\n      decipher.update(data),\n      decipher.final(),\n    ]).toString(\"utf8\");\n  } catch {\n    return null;\n  }\n}\n\n/** 读取或生成主密钥（32 字节随机，权限 600）。文件损坏则重建。 */\nexport function loadOrCreateMasterKey(masterKeyFile: string): Buffer {\n  if (fs.existsSync(masterKeyFile)) {\n    const hex = fs.readFileSync(masterKeyFile, \"utf8\").trim();\n    if (/^[0-9a-f]{64}$/i.test(hex)) {\n      return Buffer.from(hex, \"hex\");\n    }\n    console.warn(`⚠️  主密钥文件损坏，已重新生成（旧密文将无法解密）`);\n  }\n  const key = crypto.randomBytes(32);\n  fs.mkdirSync(path.dirname(masterKeyFile), { recursive: true, mode: 0o700 });\n  fs.writeFileSync(masterKeyFile, key.toString(\"hex\"), {\n    mode: 0o600,\n    encoding: \"utf8\",\n  });\n  return key;\n}\n\n/** 从 64 位 hex 字符串解析主密钥；非法返回 null */\nexport function masterKeyFromHex(hex: string): Buffer | null {\n  const h = hex.trim();\n  return /^[0-9a-f]{64}$/i.test(h) ? Buffer.from(h, \"hex\") : null;\n}\n\n/**\n * 密文工具：持有固定主密钥，对字符串做加解密。\n * CLI 与 Server 各自构造实例（CLI 用 ~/.config/zqagent/secret.key，\n * Server 用 DATA_DIR/secret.key 或 SECRET_KEY 环境变量）。\n */\nexport class SecretBox {\n  constructor(private readonly key: Buffer) {}\n\n  /** 主密钥来源一：本机密钥文件（不存在则创建） */\n  static fromFile(masterKeyFile: string): SecretBox {\n    return new SecretBox(loadOrCreateMasterKey(masterKeyFile));\n  }\n\n  /** 主密钥来源二：hex 字符串（如环境变量 SECRET_KEY）；非法返回 null */\n  static fromHex(hex: string): SecretBox | null {\n    const key = masterKeyFromHex(hex);\n    return key ? new SecretBox(key) : null;\n  }\n\n  encrypt(plain: string): string {\n    return encryptWithKey(this.key, plain);\n  }\n\n  decrypt(payload: string): string | null {\n    return decryptWithKey(this.key, payload);\n  }\n}\n"],"mappings":";AAUA,YAAY,YAAY;AACxB,YAAY,QAAQ;AACpB,YAAY,UAAU;AAGf,SAAS,eAAe,KAAa,OAAuB;AACjE,QAAM,KAAY,mBAAY,EAAE;AAChC,QAAM,SAAgB,sBAAe,eAAe,KAAK,EAAE;AAC3D,QAAM,MAAM,OAAO,OAAO,CAAC,OAAO,OAAO,OAAO,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;AACxE,QAAM,MAAM,OAAO,WAAW;AAC9B,SAAO;AAAA,IACL;AAAA,IACA,GAAG,SAAS,QAAQ;AAAA,IACpB,IAAI,SAAS,QAAQ;AAAA,IACrB,IAAI,SAAS,QAAQ;AAAA,EACvB,EAAE,KAAK,GAAG;AACZ;AAGO,SAAS,eAAe,KAAa,SAAgC;AAC1E,MAAI;AACF,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,QAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,KAAM,QAAO;AACpD,UAAM,KAAK,OAAO,KAAK,MAAM,CAAC,GAAI,QAAQ;AAC1C,UAAM,MAAM,OAAO,KAAK,MAAM,CAAC,GAAI,QAAQ;AAC3C,UAAM,OAAO,OAAO,KAAK,MAAM,CAAC,GAAI,QAAQ;AAC5C,UAAM,WAAkB,wBAAiB,eAAe,KAAK,EAAE;AAC/D,aAAS,WAAW,GAAG;AACvB,WAAO,OAAO,OAAO;AAAA,MACnB,SAAS,OAAO,IAAI;AAAA,MACpB,SAAS,MAAM;AAAA,IACjB,CAAC,EAAE,SAAS,MAAM;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,sBAAsB,eAA+B;AACnE,MAAO,cAAW,aAAa,GAAG;AAChC,UAAM,MAAS,gBAAa,eAAe,MAAM,EAAE,KAAK;AACxD,QAAI,kBAAkB,KAAK,GAAG,GAAG;AAC/B,aAAO,OAAO,KAAK,KAAK,KAAK;AAAA,IAC/B;AACA,YAAQ,KAAK,0JAA6B;AAAA,EAC5C;AACA,QAAM,MAAa,mBAAY,EAAE;AACjC,EAAG,aAAe,aAAQ,aAAa,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC1E,EAAG,iBAAc,eAAe,IAAI,SAAS,KAAK,GAAG;AAAA,IACnD,MAAM;AAAA,IACN,UAAU;AAAA,EACZ,CAAC;AACD,SAAO;AACT;AAGO,SAAS,iBAAiB,KAA4B;AAC3D,QAAM,IAAI,IAAI,KAAK;AACnB,SAAO,kBAAkB,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,KAAK,IAAI;AAC7D;AAOO,IAAM,YAAN,MAAM,WAAU;AAAA,EACrB,YAA6B,KAAa;AAAb;AAAA,EAAc;AAAA,EAAd;AAAA;AAAA,EAG7B,OAAO,SAAS,eAAkC;AAChD,WAAO,IAAI,WAAU,sBAAsB,aAAa,CAAC;AAAA,EAC3D;AAAA;AAAA,EAGA,OAAO,QAAQ,KAA+B;AAC5C,UAAM,MAAM,iBAAiB,GAAG;AAChC,WAAO,MAAM,IAAI,WAAU,GAAG,IAAI;AAAA,EACpC;AAAA,EAEA,QAAQ,OAAuB;AAC7B,WAAO,eAAe,KAAK,KAAK,KAAK;AAAA,EACvC;AAAA,EAEA,QAAQ,SAAgC;AACtC,WAAO,eAAe,KAAK,KAAK,OAAO;AAAA,EACzC;AACF;","names":[]}