ctx-sync 1.1.2 → 1.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../src/core/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,oDAAoD;AACpD,eAAO,MAAM,cAAc,MAAQ,CAAC;AAEpC,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAEtC,4BAA4B;AAC5B,eAAO,MAAM,aAAa,YAAY,CAAC;AAEvC;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,
|
|
1
|
+
{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../src/core/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,oDAAoD;AACpD,eAAO,MAAM,cAAc,MAAQ,CAAC;AAEpC,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,MAAQ,CAAC;AAEtC,4BAA4B;AAC5B,eAAO,MAAM,aAAa,YAAY,CAAC;AAEvC;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAcnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA0BjD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG;IACpD,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAgDA"}
|
package/dist/core/key-store.js
CHANGED
|
@@ -26,10 +26,14 @@ export const KEY_FILE_NAME = 'key.txt';
|
|
|
26
26
|
* @param privateKey - The Age private key string (AGE-SECRET-KEY-...).
|
|
27
27
|
*/
|
|
28
28
|
export function saveKey(configDir, privateKey) {
|
|
29
|
+
const isWindows = process.platform === 'win32';
|
|
29
30
|
// Create directory with 0o700 if it doesn't exist
|
|
30
31
|
fs.mkdirSync(configDir, { recursive: true, mode: CONFIG_DIR_PERMS });
|
|
31
32
|
// Ensure directory has correct permissions even if it already existed
|
|
32
|
-
|
|
33
|
+
// (chmod is a no-op on Windows — NTFS uses ACLs, not Unix modes)
|
|
34
|
+
if (!isWindows) {
|
|
35
|
+
fs.chmodSync(configDir, CONFIG_DIR_PERMS);
|
|
36
|
+
}
|
|
33
37
|
const keyPath = path.join(configDir, KEY_FILE_NAME);
|
|
34
38
|
fs.writeFileSync(keyPath, privateKey, { mode: KEY_FILE_PERMS });
|
|
35
39
|
}
|
|
@@ -51,12 +55,14 @@ export function loadKey(configDir) {
|
|
|
51
55
|
'Run `ctx-sync init` to generate an encryption key, or\n' +
|
|
52
56
|
'Run `ctx-sync init --restore` to restore from a backup.');
|
|
53
57
|
}
|
|
54
|
-
// Verify permissions before reading
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
`
|
|
58
|
+
// Verify permissions before reading (skip on Windows — NTFS uses ACLs, not Unix modes)
|
|
59
|
+
if (process.platform !== 'win32') {
|
|
60
|
+
const stats = fs.statSync(keyPath);
|
|
61
|
+
const mode = stats.mode & 0o777;
|
|
62
|
+
if (mode !== KEY_FILE_PERMS) {
|
|
63
|
+
throw new Error(`Key file has insecure permissions (${mode.toString(8)}). Expected 600.\n` +
|
|
64
|
+
`Fix with: chmod 600 ${keyPath}`);
|
|
65
|
+
}
|
|
60
66
|
}
|
|
61
67
|
return fs.readFileSync(keyPath, 'utf-8').trim();
|
|
62
68
|
}
|
|
@@ -72,11 +78,13 @@ export function verifyPermissions(configDir) {
|
|
|
72
78
|
let keyFileExists = false;
|
|
73
79
|
let keyFilePerms = null;
|
|
74
80
|
let configDirPerms = null;
|
|
81
|
+
const isWindows = process.platform === 'win32';
|
|
75
82
|
// Check config directory
|
|
76
83
|
if (fs.existsSync(configDir)) {
|
|
77
84
|
const dirStats = fs.statSync(configDir);
|
|
78
85
|
configDirPerms = dirStats.mode & 0o777;
|
|
79
|
-
|
|
86
|
+
// Skip permission checks on Windows (NTFS uses ACLs, not Unix modes)
|
|
87
|
+
if (!isWindows && configDirPerms !== CONFIG_DIR_PERMS) {
|
|
80
88
|
issues.push(`Config directory has permissions ${configDirPerms.toString(8)}, expected 700. ` +
|
|
81
89
|
`Fix with: chmod 700 ${configDir}`);
|
|
82
90
|
}
|
|
@@ -89,7 +97,8 @@ export function verifyPermissions(configDir) {
|
|
|
89
97
|
keyFileExists = true;
|
|
90
98
|
const fileStats = fs.statSync(keyPath);
|
|
91
99
|
keyFilePerms = fileStats.mode & 0o777;
|
|
92
|
-
|
|
100
|
+
// Skip permission checks on Windows (NTFS uses ACLs, not Unix modes)
|
|
101
|
+
if (!isWindows && keyFilePerms !== KEY_FILE_PERMS) {
|
|
93
102
|
issues.push(`Key file has permissions ${keyFilePerms.toString(8)}, expected 600. ` +
|
|
94
103
|
`Fix with: chmod 600 ${keyPath}`);
|
|
95
104
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../../src/core/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAEpC,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,4BAA4B;AAC5B,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,UAAkB;IAC3D,kDAAkD;IAClD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAErE,sEAAsE;IACtE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../../src/core/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAEpC,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,4BAA4B;AAC5B,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,UAAkB;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAE/C,kDAAkD;IAClD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAErE,sEAAsE;IACtE,iEAAiE;IACjE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAEpD,oBAAoB;IACpB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,IAAI;YAChC,yDAAyD;YACzD,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;QAEhC,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB;gBACxE,uBAAuB,OAAO,EAAE,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAOjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAEpD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,cAAc,GAAkB,IAAI,CAAC;IAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAE/C,yBAAyB;IACzB,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxC,cAAc,GAAG,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC;QACvC,qEAAqE;QACrE,IAAI,CAAC,SAAS,IAAI,cAAc,KAAK,gBAAgB,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CACT,oCAAoC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB;gBAC9E,uBAAuB,SAAS,EAAE,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,iBAAiB;IACjB,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,YAAY,GAAG,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC;QACtC,qEAAqE;QACrE,IAAI,CAAC,SAAS,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CACT,4BAA4B,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB;gBACpE,uBAAuB,OAAO,EAAE,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,aAAa;QACb,YAAY;QACZ,cAAc;QACd,MAAM;KACP,CAAC;AACJ,CAAC"}
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
* Shared constants for ctx-sync.
|
|
3
3
|
*/
|
|
4
4
|
/** Current CLI version */
|
|
5
|
-
export declare const VERSION = "1.1.
|
|
5
|
+
export declare const VERSION = "1.1.3";
|
|
6
6
|
/** Default safe-list: env var keys that MAY be stored as plaintext (with --allow-plain) */
|
|
7
7
|
export declare const DEFAULT_SAFE_LIST: readonly string[];
|
|
8
8
|
/** State file names (encrypted) */
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
* Shared constants for ctx-sync.
|
|
3
3
|
*/
|
|
4
4
|
/** Current CLI version */
|
|
5
|
-
export const VERSION = '1.1.
|
|
5
|
+
export const VERSION = '1.1.3';
|
|
6
6
|
/** Default safe-list: env var keys that MAY be stored as plaintext (with --allow-plain) */
|
|
7
7
|
export const DEFAULT_SAFE_LIST = [
|
|
8
8
|
'NODE_ENV',
|