catalyst-core 1.1.0 → 1.2.0-canary.2

package/dist/native/credentials.js

@@ -0,0 +1,309 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.MAX_CREDENTIALS_SECRET_BYTES = void 0;
+exports.cleanupOnSignal = cleanupOnSignal;
+exports.credentialsDir = credentialsDir;
+exports.credentialsEnvName = credentialsEnvName;
+exports.maskSecret = maskSecret;
+exports.packCredentials = packCredentials;
+exports.resolveCredentials = resolveCredentials;
+exports.unpackCredentials = unpackCredentials;
+var _child_process = require("child_process");
+var _fs = _interopRequireDefault(require("fs"));
+var _os = _interopRequireDefault(require("os"));
+var _path = _interopRequireDefault(require("path"));
+var _utils = require("./utils.js");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+// Signing files live in git-ignored credentials/<platform>/ in the app. CI
+// gets the same folder from one secret per platform, CATALYST_<PLATFORM>_CREDENTIALS:
+// a base64 gzipped tar of that folder, made by `catalyst credentials:export`.
+// Everything that reads credentials goes through resolveCredentials, so the
+// folder and the secret behave the same.
+
+const PLATFORMS = ["android", "ios"];
+
+// GitHub's limit for one secret value.
+const MAX_CREDENTIALS_SECRET_BYTES = exports.MAX_CREDENTIALS_SECRET_BYTES = 48 * 1024;
+
+// macOS tar adds AppleDouble (._*) files for extended attributes unless told not to.
+const TAR_ENV = {
+  ...process.env,
+  COPYFILE_DISABLE: "1"
+};
+function assertPlatform(platform) {
+  if (!PLATFORMS.includes(platform)) {
+    throw new Error(`Unknown platform "${platform}": expected android or ios`);
+  }
+}
+
+/** @param {"android"|"ios"} platform */
+function credentialsEnvName(platform) {
+  assertPlatform(platform);
+  return `CATALYST_${platform.toUpperCase()}_CREDENTIALS`;
+}
+
+/**
+ * The project's credentials folder for a platform (it may not exist).
+ *
+ * @param {"android"|"ios"} platform
+ * @param {object} [options]
+ * @param {string} [options.cwd]
+ */
+function credentialsDir(platform, {
+  cwd = process.cwd()
+} = {}) {
+  assertPlatform(platform);
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - platform is one of two fixed names; cwd is the app root.
+  return _path.default.join(cwd, "credentials", platform);
+}
+function isDirectory(dir) {
+  try {
+    return _fs.default.statSync(dir).isDirectory();
+  } catch (error) {
+    return false;
+  }
+}
+
+/** GitHub Actions' escaping for workflow command data. */
+function escapeCommandData(value) {
+  return String(value).replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+}
+
+/**
+ * Hide a secret in GitHub Actions logs from here on. A no-op elsewhere.
+ * Call it for every password read from credentials before it can reach a
+ * log line or a child process's echoed output.
+ *
+ * @param {string} value
+ * @param {object} [options]
+ * @param {Record<string, string | undefined>} [options.env]
+ * @param {(text: string) => void} [options.write]
+ * @returns {boolean} whether a mask was printed
+ */
+function maskSecret(value, {
+  env = process.env,
+  write = text => process.stdout.write(text)
+} = {}) {
+  if (env.GITHUB_ACTIONS !== "true" || value === undefined || value === null || value === "") return false;
+  write(`::add-mask::${escapeCommandData(value)}\n`);
+  return true;
+}
+
+/**
+ * Pack credentials/<platform>/ into the CATALYST_<PLATFORM>_CREDENTIALS value.
+ *
+ * @param {"android"|"ios"} platform
+ * @param {object} [options]
+ * @param {string} [options.cwd]
+ * @returns {string} base64 of a gzipped tar of the folder's contents
+ */
+function packCredentials(platform, {
+  cwd = process.cwd()
+} = {}) {
+  const dir = credentialsDir(platform, {
+    cwd
+  });
+  const files = isDirectory(dir) ? _fs.default.readdirSync(dir).filter(name => name !== ".DS_Store") : [];
+  if (files.length === 0) {
+    throw (0, _utils.nativeError)("NATIVE-008", `credentials/${platform}/ is missing or empty in ${cwd}`);
+  }
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - fixed tar argv; dir is the app's own credentials folder.
+  const archive = (0, _child_process.execFileSync)("tar", ["-czf", "-", "--exclude", ".DS_Store", "-C", dir, "."], {
+    env: TAR_ENV,
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const value = archive.toString("base64");
+  if (value.length > MAX_CREDENTIALS_SECRET_BYTES) {
+    throw (0, _utils.nativeError)("NATIVE-009", `credentials/${platform}/ packs to ${Math.ceil(value.length / 1024)} KB; the limit is 48 KB`);
+  }
+  return value;
+}
+
+/** Tar entries that could write outside the destination, or are links. */
+function unsafeEntries(listing, verbose) {
+  const names = listing.split("\n").filter(Boolean);
+  const bad = names.filter(name => {
+    const clean = name.replace(/^\.\//, "");
+    return clean.startsWith("/") || clean.split("/").includes("..");
+  });
+  // Long listings start each line with the entry type: "-" file, "d" folder.
+  const links = verbose.split("\n").filter(Boolean).filter(line => !/^[-d]/.test(line));
+  return [...bad, ...links];
+}
+
+/**
+ * Unpack a CATALYST_<PLATFORM>_CREDENTIALS value into `destDir`.
+ * Only plain files and folders inside `destDir` are accepted.
+ *
+ * @param {string} value
+ * @param {string} destDir - created when missing
+ * @param {object} [options]
+ * @param {string} [options.envName] - for the error message
+ */
+function unpackCredentials(value, destDir, {
+  envName = "the credentials secret"
+} = {}) {
+  const archive = Buffer.from(String(value || "").trim(), "base64");
+  if (archive.length < 2 || archive[0] !== 0x1f || archive[1] !== 0x8b) {
+    throw (0, _utils.nativeError)("NATIVE-007", `${envName} is not a base64 gzipped tar`);
+  }
+  const work = _fs.default.mkdtempSync(_path.default.join(_os.default.tmpdir(), "catalyst-credentials-archive-"));
+  try {
+    const file = _path.default.join(work, "credentials.tgz");
+    _fs.default.writeFileSync(file, archive, {
+      mode: 0o600
+    });
+    let listing;
+    let verbose;
+    try {
+      // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - fixed tar argv on a temp file.
+      listing = (0, _child_process.execFileSync)("tar", ["-tzf", file], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - fixed tar argv on a temp file.
+      verbose = (0, _child_process.execFileSync)("tar", ["-tvzf", file], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+    } catch (error) {
+      throw (0, _utils.nativeError)("NATIVE-007", `${envName} could not be read as a tar archive`);
+    }
+    const unsafe = unsafeEntries(listing, verbose);
+    if (unsafe.length) {
+      throw (0, _utils.nativeError)("NATIVE-007", `${envName} holds links or paths outside the folder`);
+    }
+    _fs.default.mkdirSync(destDir, {
+      recursive: true,
+      mode: 0o700
+    });
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - fixed tar argv; entries were checked above.
+    (0, _child_process.execFileSync)("tar", ["-xzf", file, "-C", destDir], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } finally {
+    _fs.default.rmSync(work, {
+      recursive: true,
+      force: true
+    });
+  }
+}
+
+/**
+ * Run `cleanup` on SIGINT and SIGTERM too: a Ctrl+C ends the process
+ * without running any `finally`, which would leave unpacked secrets in the
+ * temp folder. After cleaning up it exits (130 or 143), unless another
+ * handler for the signal is still to run, in which case that one exits.
+ *
+ * @param {() => void} cleanup
+ * @param {object} [options]
+ * @param {{ once: Function, removeListener: Function, listenerCount?: Function }} [options.signals]
+ * @param {(code: number) => void} [options.exit]
+ * @returns {() => void} removes the handlers; call it from the normal cleanup
+ */
+function cleanupOnSignal(cleanup, {
+  signals = process,
+  exit = code => process.exit(code)
+} = {}) {
+  const release = () => {
+    signals.removeListener("SIGINT", onSignal);
+    signals.removeListener("SIGTERM", onSignal);
+  };
+  function onSignal(signal) {
+    release();
+    cleanup();
+    const others = typeof signals.listenerCount === "function" ? signals.listenerCount(signal) : 0;
+    if (others === 0) exit(signal === "SIGINT" ? 130 : 143);
+  }
+  signals.once("SIGINT", onSignal);
+  signals.once("SIGTERM", onSignal);
+  return release;
+}
+
+/**
+ * Where this build reads its credentials for a platform.
+ *
+ * 1. credentials/<platform>/ in the app, when it exists.
+ * 2. Otherwise CATALYST_<PLATFORM>_CREDENTIALS, unpacked into a private temp
+ *    folder that `cleanup()` removes, and that an interrupted build (Ctrl+C,
+ *    SIGTERM) removes too. The project folder is never written.
+ * 3. Otherwise `source: "none"` and `dir` is the (missing) project folder,
+ *    where a first-time setup should create it.
+ *
+ * The caller still masks each password it reads with maskSecret().
+ *
+ * @param {"android"|"ios"} platform
+ * @param {object} [options]
+ * @param {string} [options.cwd]
+ * @param {Record<string, string | undefined>} [options.env]
+ * @param {(message: string, type?: string) => void} [options.log]
+ * @param {object} [options.signals] - for tests; see cleanupOnSignal
+ * @param {(code: number) => void} [options.exit] - for tests
+ * @returns {{ dir: string, source: "folder" | "env" | "none", envName: string, cleanup: () => void }}
+ */
+function resolveCredentials(platform, {
+  cwd = process.cwd(),
+  env = process.env,
+  log = () => {},
+  signals,
+  exit
+} = {}) {
+  const dir = credentialsDir(platform, {
+    cwd
+  });
+  const envName = credentialsEnvName(platform);
+  if (isDirectory(dir)) return {
+    dir,
+    source: "folder",
+    envName,
+    cleanup: () => {}
+  };
+  const value = env[envName];
+  if (value && String(value).trim()) {
+    const temp = _fs.default.mkdtempSync(_path.default.join(_os.default.tmpdir(), `catalyst-${platform}-credentials-`));
+    _fs.default.chmodSync(temp, 0o700);
+    try {
+      unpackCredentials(value, temp, {
+        envName
+      });
+    } catch (error) {
+      _fs.default.rmSync(temp, {
+        recursive: true,
+        force: true
+      });
+      throw error;
+    }
+    log(`Using ${platform} credentials from ${envName}`, "info");
+    const remove = () => _fs.default.rmSync(temp, {
+      recursive: true,
+      force: true
+    });
+    const releaseSignals = cleanupOnSignal(remove, {
+      ...(signals ? {
+        signals
+      } : {}),
+      ...(exit ? {
+        exit
+      } : {})
+    });
+    return {
+      dir: temp,
+      source: "env",
+      envName,
+      cleanup: () => {
+        releaseSignals();
+        remove();
+      }
+    };
+  }
+  return {
+    dir,
+    source: "none",
+    envName,
+    cleanup: () => {}
+  };
+}

package/dist/native/exportCredentials.js

@@ -0,0 +1,51 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.runExportCredentials = runExportCredentials;
+var _credentials = require("./credentials.js");
+// `catalyst credentials:export <android|ios>`: print credentials/<platform>/
+// as the value of the CATALYST_<PLATFORM>_CREDENTIALS CI secret. The value
+// goes to stdout alone (so it can be piped to pbcopy); the one line on where
+// to paste it goes to stderr. The same value is the backup of the folder.
+
+const GUTTER = "  ";
+
+/**
+ * @param {object} [options]
+ * @param {string[]} [options.argv]
+ * @param {string} [options.cwd]
+ * @param {(text: string) => void} [options.stdout]
+ * @param {(text: string) => void} [options.stderr]
+ * @returns {number} the exit code
+ */
+function runExportCredentials({
+  argv = process.argv.slice(2),
+  cwd = process.cwd(),
+  stdout = text => process.stdout.write(text),
+  stderr = text => process.stderr.write(text)
+} = {}) {
+  const platform = argv.find(arg => !arg.startsWith("-"));
+  if (platform !== "android" && platform !== "ios") {
+    stderr(`\n${GUTTER}Usage: catalyst credentials:export <android|ios>\n\n`);
+    return 1;
+  }
+  try {
+    const value = (0, _credentials.packCredentials)(platform, {
+      cwd
+    });
+    stdout(`${value}\n`);
+    stderr(`\n${GUTTER}Paste this into a GitHub Actions secret named ${(0, _credentials.credentialsEnvName)(platform)} ` + "(Settings > Secrets and variables > Actions), and keep a copy somewhere safe as your backup.\n\n");
+    return 0;
+  } catch (error) {
+    const lines = [`\n${GUTTER}error ${error.code ? `[${error.code}] ` : ""}${error.message}`];
+    if (error.hint) lines.push(`${GUTTER}hint  ${error.hint}`);
+    if (error.docUrl) lines.push(`${GUTTER}docs  ${error.docUrl}`);
+    stderr(`${lines.join("\n")}\n\n`);
+    return 1;
+  }
+}
+if (typeof require !== "undefined" && typeof module !== "undefined" && require.main === module) {
+  process.exit(runExportCredentials());
+}