codiedev 0.10.0-beta.5 → 0.10.0-beta.7

package/dist/securityPolicy.js

@@ -1,181 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BUILT_IN_POLICY_KEYS = void 0;
-exports.trustedPolicyKeysFromEnvironment = trustedPolicyKeysFromEnvironment;
-exports.verifyEndpointSecurityPolicySignature = verifyEndpointSecurityPolicySignature;
-exports.readEndpointSecurityPolicy = readEndpointSecurityPolicy;
-exports.inspectEndpointSecurityPolicy = inspectEndpointSecurityPolicy;
-exports.writeEndpointSecurityPolicy = writeEndpointSecurityPolicy;
-exports.syncEndpointSecurityPolicy = syncEndpointSecurityPolicy;
-const fs = __importStar(require("fs"));
-const crypto = __importStar(require("crypto"));
-const http = __importStar(require("http"));
-const https = __importStar(require("https"));
-const path = __importStar(require("path"));
-const configDir_1 = require("./configDir");
-const security_1 = require("./security");
-const version_1 = require("./version");
-const POLICY_FILE = "security-policy.json";
-function policyFile(companyId) {
-    if (!companyId)
-        return POLICY_FILE;
-    const scope = companyId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128);
-    return `security-policy.${scope}.json`;
-}
-exports.BUILT_IN_POLICY_KEYS = {
-    "codiedev-prod-2026-01": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA0H+UISjTn4zhd6Pk9YmrMBqnJEJmv9fXoavXorlV2cU=\n-----END PUBLIC KEY-----\n",
-};
-function stableJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(stableJson).join(",")}]`;
-    if (value && typeof value === "object") {
-        return `{${Object.entries(value)
-            .sort(([a], [b]) => a.localeCompare(b))
-            .map(([key, child]) => `${JSON.stringify(key)}:${stableJson(child)}`)
-            .join(",")}}`;
-    }
-    return JSON.stringify(value) ?? "null";
-}
-function trustedPolicyKeysFromEnvironment(env = process.env) {
-    const raw = env.CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS;
-    if (!raw)
-        return { ...exports.BUILT_IN_POLICY_KEYS };
-    try {
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-            return { ...exports.BUILT_IN_POLICY_KEYS };
-        const configured = Object.fromEntries(Object.entries(parsed)
-            .filter((entry) => typeof entry[1] === "string"));
-        return { ...configured, ...exports.BUILT_IN_POLICY_KEYS };
-    }
-    catch {
-        return { ...exports.BUILT_IN_POLICY_KEYS };
-    }
-}
-function verifyEndpointSecurityPolicySignature(policy, trustedKeys = trustedPolicyKeysFromEnvironment()) {
-    const configuredKeys = Object.keys(trustedKeys);
-    if (configuredKeys.length === 0) {
-        return { ok: true, trusted: false, detail: "no endpoint policy public keys are pinned" };
-    }
-    const envelope = policy.signature;
-    if (!envelope || envelope.algorithm !== "Ed25519") {
-        return { ok: false, trusted: false, detail: "policy signature is missing" };
-    }
-    const publicKey = trustedKeys[envelope.keyId];
-    if (!publicKey)
-        return { ok: false, trusted: false, detail: `policy signing key ${envelope.keyId} is not trusted` };
-    const unsigned = { ...policy };
-    delete unsigned.signature;
-    try {
-        const ok = crypto.verify(null, Buffer.from(`${envelope.signedAt}.${stableJson(unsigned)}`), crypto.createPublicKey(publicKey), Buffer.from(envelope.value, "base64"));
-        return ok
-            ? { ok: true, trusted: true, detail: `verified with ${envelope.keyId}` }
-            : { ok: false, trusted: false, detail: "policy signature does not match its content" };
-    }
-    catch (error) {
-        return { ok: false, trusted: false, detail: `policy signature could not be verified: ${error.message}` };
-    }
-}
-function readEndpointSecurityPolicy(stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment(), companyId) {
-    const inspection = inspectEndpointSecurityPolicy(stateDir, trustedKeys, companyId);
-    return inspection.verification.ok ? inspection.policy : undefined;
-}
-function inspectEndpointSecurityPolicy(stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment(), companyId) {
-    const target = path.join(stateDir, policyFile(companyId));
-    if (!fs.existsSync(target)) {
-        return { exists: false, verification: { ok: true, trusted: false, detail: "no cached endpoint policy" } };
-    }
-    try {
-        const value = JSON.parse(fs.readFileSync(target, "utf8"));
-        if (value?.schemaVersion !== 1 || !["alert", "block"].includes(value.enforcementMode)) {
-            return { exists: true, verification: { ok: false, trusted: false, detail: "cached endpoint policy has an invalid schema" } };
-        }
-        const policy = value;
-        return { exists: true, policy, verification: verifyEndpointSecurityPolicySignature(policy, trustedKeys) };
-    }
-    catch (error) {
-        return { exists: true, verification: { ok: false, trusted: false, detail: `cached endpoint policy could not be read: ${error.message}` } };
-    }
-}
-function writeEndpointSecurityPolicy(policy, stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment(), companyId) {
-    const verification = verifyEndpointSecurityPolicySignature(policy, trustedKeys);
-    if (!verification.ok)
-        throw new Error(`Refusing untrusted endpoint policy: ${verification.detail}`);
-    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-    const target = path.join(stateDir, policyFile(companyId));
-    const temporary = `${target}.${process.pid}.tmp`;
-    fs.writeFileSync(temporary, `${JSON.stringify(policy, null, 2)}\n`, { mode: 0o600 });
-    fs.chmodSync(temporary, 0o600);
-    fs.renameSync(temporary, target);
-}
-async function syncEndpointSecurityPolicy(config, source, timeoutMs = 3_000, stateDir = (0, configDir_1.codiedevStateDir)(), trustedKeys = trustedPolicyKeysFromEnvironment()) {
-    const url = new URL("/api/cli/securityPolicy", config.backendUrl);
-    if (source)
-        url.searchParams.set("source", source);
-    const cachedPolicy = readEndpointSecurityPolicy(stateDir, trustedKeys, config.companyId);
-    url.searchParams.set("securityRuntimeVersion", String(security_1.SECURITY_RUNTIME_VERSION));
-    url.searchParams.set("cliVersion", version_1.CLI_VERSION);
-    if (cachedPolicy?.policyVersion)
-        url.searchParams.set("securityPolicyVersion", String(cachedPolicy.policyVersion));
-    if (config.deviceId)
-        url.searchParams.set("endpointId", config.deviceId);
-    const transport = url.protocol === "https:" ? https : http;
-    const policy = await new Promise((resolve, reject) => {
-        const request = transport.request(url, {
-            method: "GET",
-            headers: { Authorization: `Bearer ${config.token}`, Accept: "application/json" },
-        }, (response) => {
-            let raw = "";
-            response.setEncoding("utf8");
-            response.on("data", (chunk) => { raw += chunk; });
-            response.on("end", () => {
-                if ((response.statusCode ?? 500) >= 300)
-                    return reject(new Error(`policy_http_${response.statusCode}`));
-                try {
-                    resolve(JSON.parse(raw));
-                }
-                catch {
-                    reject(new Error("invalid policy response"));
-                }
-            });
-        });
-        request.setTimeout(timeoutMs, () => request.destroy(new Error(`policy sync timeout after ${timeoutMs}ms`)));
-        request.on("error", reject);
-        request.end();
-    });
-    writeEndpointSecurityPolicy(policy, stateDir, trustedKeys, config.companyId);
-    return policy;
-}

package/dist/securitySession.js

@@ -1,72 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readSessionSecuritySignal = readSessionSecuritySignal;
-exports.recordSensitiveReadSignal = recordSensitiveReadSignal;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const configDir_1 = require("./configDir");
-const SIGNAL_FILE = "security-session-signals.json";
-const MAX_AGE_MS = 2 * 60 * 60 * 1_000;
-function readSignals(stateDir, now) {
-    try {
-        const parsed = JSON.parse(fs.readFileSync(path.join(stateDir, SIGNAL_FILE), "utf8"));
-        if (parsed.schemaVersion !== 1 || !parsed.sessions || typeof parsed.sessions !== "object")
-            throw new Error("invalid signals");
-        parsed.sessions = Object.fromEntries(Object.entries(parsed.sessions)
-            .filter(([, signal]) => signal.sensitiveReadAt && now - signal.sensitiveReadAt <= MAX_AGE_MS)
-            .slice(-250));
-        return parsed;
-    }
-    catch {
-        return { schemaVersion: 1, sessions: {} };
-    }
-}
-function readSessionSecuritySignal(sessionId, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now()) {
-    if (!sessionId)
-        return undefined;
-    return readSignals(stateDir, now).sessions[sessionId];
-}
-function recordSensitiveReadSignal(sessionId, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now()) {
-    if (!sessionId)
-        return;
-    const signals = readSignals(stateDir, now);
-    signals.sessions[sessionId] = { sensitiveReadAt: now };
-    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-    const target = path.join(stateDir, SIGNAL_FILE);
-    const temporary = `${target}.${process.pid}.tmp`;
-    fs.writeFileSync(temporary, `${JSON.stringify(signals)}\n`, { mode: 0o600 });
-    fs.renameSync(temporary, target);
-}