ds-01 1.0.11 → 1.0.12

package/dist/native/macos-key-helper.swift

@@ -0,0 +1,206 @@
+import Foundation
+import Security
+
+let keyTag = "com.ds01.cli.device-key"
+
+func fail(_ message: String) -> Never {
+    fputs(message + "\n", stderr)
+    exit(1)
+}
+
+func getAccessControl() -> SecAccessControl {
+    var error: Unmanaged<CFError>?
+
+    guard let access = SecAccessControlCreateWithFlags(
+        nil,
+        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+        .privateKeyUsage,
+        &error
+    ) else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Unable to create Secure Enclave access control.")
+    }
+
+    return access
+}
+
+func findPrivateKey() -> SecKey? {
+    let query: [String: Any] = [
+        kSecClass as String: kSecClassKey,
+        kSecAttrApplicationTag as String: keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+        kSecReturnRef as String: true
+    ]
+
+    var result: CFTypeRef?
+
+    let status = SecItemCopyMatching(
+        query as CFDictionary,
+        &result
+    )
+
+    guard status == errSecSuccess else {
+        return nil
+    }
+
+    return (result as! SecKey)
+}
+
+func createKey() {
+    if findPrivateKey() != nil {
+        print("EXISTS")
+        return
+    }
+
+    let access = getAccessControl()
+
+    let attributes: [String: Any] = [
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
+
+        kSecAttrKeySizeInBits as String:
+            256,
+
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave,
+
+        kSecPrivateKeyAttrs as String: [
+            kSecAttrIsPermanent as String:
+                true,
+
+            kSecAttrApplicationTag as String:
+                keyTag.data(using: .utf8)!,
+
+            kSecAttrAccessControl as String:
+                access
+        ]
+    ]
+
+    var error: Unmanaged<CFError>?
+
+    guard SecKeyCreateRandomKey(
+        attributes as CFDictionary,
+        &error
+    ) != nil else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Unable to create Secure Enclave key.")
+    }
+
+    print("CREATED")
+}
+
+func publicKey() {
+    guard let privateKey = findPrivateKey() else {
+        fail("DS01 Secure Enclave key not found.")
+    }
+
+    guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
+        fail("Unable to obtain public key.")
+    }
+
+    var error: Unmanaged<CFError>?
+
+    guard let data = SecKeyCopyExternalRepresentation(
+        publicKey,
+        &error
+    ) else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Unable to export public key.")
+    }
+
+    let base64 = (data as Data).base64EncodedString()
+
+    print(base64)
+}
+
+func sign(_ base64Data: String) {
+    guard let privateKey = findPrivateKey() else {
+        fail("DS01 Secure Enclave key not found.")
+    }
+
+    guard let data = Data(base64Encoded: base64Data) else {
+        fail("Invalid input data.")
+    }
+
+    let algorithm = SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
+
+    guard SecKeyIsAlgorithmSupported(
+        privateKey,
+        .sign,
+        algorithm
+    ) else {
+        fail("Secure Enclave key does not support signing.")
+    }
+
+    var error: Unmanaged<CFError>?
+
+    guard let signature = SecKeyCreateSignature(
+        privateKey,
+        algorithm,
+        data as CFData,
+        &error
+    ) else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Secure Enclave signing failed.")
+    }
+
+    print((signature as Data).base64EncodedString())
+}
+
+func deleteKey() {
+    let query: [String: Any] = [
+        kSecClass as String: kSecClassKey,
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom
+    ]
+
+    let status = SecItemDelete(
+        query as CFDictionary
+    )
+
+    if status != errSecSuccess &&
+       status != errSecItemNotFound {
+        fail("Unable to delete DS01 Secure Enclave key.")
+    }
+
+    print("DELETED")
+}
+
+guard CommandLine.arguments.count >= 2 else {
+    fail("Missing operation.")
+}
+
+switch CommandLine.arguments[1] {
+case "create":
+    createKey()
+
+case "public":
+    publicKey()
+
+case "sign":
+    guard CommandLine.arguments.count >= 3 else {
+        fail("Missing data to sign.")
+    }
+
+    sign(CommandLine.arguments[2])
+
+case "delete":
+    deleteKey()
+
+default:
+    fail("Unknown operation.")
+}

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "ds-01",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {
     "ds01": "dist/index.js"
   },
   "scripts": {
-    "build": "tsc"
+    "build": "tsc && node scripts/copy-native.js"
   },
   "publishConfig": {
     "access": "public"

package/scripts/copy-native.js

@@ -0,0 +1,15 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const source = path.resolve("src/native/macos-key-helper.swift");
+const destinationDir = path.resolve("dist/native");
+const destination = path.join(
+  destinationDir,
+  "macos-key-helper.swift",
+);
+
+fs.mkdirSync(destinationDir, { recursive: true });
+
+fs.copyFileSync(source, destination);
+
+console.log("✅ Copied macOS native helper.");