ds-01 1.0.12 → 1.0.13

package/dist/native/macos-key-helper.swift

@@ -8,30 +8,16 @@ func fail(_ message: String) -> Never {
     exit(1)
 }
 
-func getAccessControl() -> SecAccessControl {
-    var error: Unmanaged<CFError>?
-
-    guard let access = SecAccessControlCreateWithFlags(
-        nil,
-        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-        .privateKeyUsage,
-        &error
-    ) else {
-        if let error {
-            fail(error.takeRetainedValue().localizedDescription)
-        }
-
-        fail("Unable to create Secure Enclave access control.")
-    }
-
-    return access
-}
-
+// Find the existing Secure Enclave private key.
 func findPrivateKey() -> SecKey? {
     let query: [String: Any] = [
         kSecClass as String: kSecClassKey,
-        kSecAttrApplicationTag as String: keyTag.data(using: .utf8)!,
-        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave,
         kSecReturnRef as String: true
     ]
 
@@ -50,33 +36,70 @@ func findPrivateKey() -> SecKey? {
 }
 
 func createKey() {
+
+    // If the key already exists, don't create another one.
     if findPrivateKey() != nil {
         print("EXISTS")
         return
     }
 
-    let access = getAccessControl()
+    // Keychain access control.
+    //
+    // WhenUnlockedThisDeviceOnly means:
+    // - available only while the device is unlocked
+    // - cannot be restored onto another device
+    //
+    // privateKeyUsage means the key can be used for signing.
+    var accessError: Unmanaged<CFError>?
+
+    guard let access = SecAccessControlCreateWithFlags(
+        nil,
+        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+        .privateKeyUsage,
+        &accessError
+    ) else {
+
+        if let error = accessError {
+            fail(
+                "Unable to create Keychain access control: " +
+                error.takeRetainedValue().localizedDescription
+            )
+        }
+
+        fail("Unable to create Keychain access control.")
+    }
+
+    let privateAttributes: [String: Any] = [
+
+        // Permanently store the private key.
+        kSecAttrIsPermanent as String: true,
+
+        // Identifier used to find the key later.
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+
+        // Access rules for the private key.
+        kSecAttrAccessControl as String:
+            access
+    ]
 
     let attributes: [String: Any] = [
+
+        // EC P-256 key.
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom,
 
         kSecAttrKeySizeInBits as String:
             256,
 
+        // IMPORTANT:
+        // The private key lives inside the Secure Enclave.
         kSecAttrTokenID as String:
             kSecAttrTokenIDSecureEnclave,
 
-        kSecPrivateKeyAttrs as String: [
-            kSecAttrIsPermanent as String:
-                true,
-
-            kSecAttrApplicationTag as String:
-                keyTag.data(using: .utf8)!,
-
-            kSecAttrAccessControl as String:
-                access
-        ]
+        // Private key configuration.
+        kSecPrivateKeyAttrs as String:
+            privateAttributes
     ]
 
     var error: Unmanaged<CFError>?
@@ -85,17 +108,26 @@ func createKey() {
         attributes as CFDictionary,
         &error
     ) != nil else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Secure Enclave key creation failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
-        fail("Unable to create Secure Enclave key.")
+        fail("Secure Enclave key creation failed.")
     }
 
     print("CREATED")
 }
 
+
+// Return ONLY the public key.
+//
+// The private key is never exported.
 func publicKey() {
+
     guard let privateKey = findPrivateKey() else {
         fail("DS01 Secure Enclave key not found.")
     }
@@ -110,35 +142,47 @@ func publicKey() {
         publicKey,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Unable to export public key: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
         fail("Unable to export public key.")
     }
 
-    let base64 = (data as Data).base64EncodedString()
-
-    print(base64)
+    print(
+        (data as Data).base64EncodedString()
+    )
 }
 
+
+// Sign data using the Secure Enclave private key.
 func sign(_ base64Data: String) {
+
     guard let privateKey = findPrivateKey() else {
         fail("DS01 Secure Enclave key not found.")
     }
 
-    guard let data = Data(base64Encoded: base64Data) else {
+    guard let data = Data(
+        base64Encoded: base64Data
+    ) else {
         fail("Invalid input data.")
     }
 
-    let algorithm = SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
+    let algorithm =
+        SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
 
     guard SecKeyIsAlgorithmSupported(
         privateKey,
         .sign,
         algorithm
     ) else {
-        fail("Secure Enclave key does not support signing.")
+        fail(
+            "Secure Enclave key does not support signing."
+        )
     }
 
     var error: Unmanaged<CFError>?
@@ -149,23 +193,38 @@ func sign(_ base64Data: String) {
         data as CFData,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Secure Enclave signing failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
         fail("Secure Enclave signing failed.")
     }
 
-    print((signature as Data).base64EncodedString())
+    print(
+        (signature as Data).base64EncodedString()
+    )
 }
 
+
+// Remove the DS01 key from this Mac.
 func deleteKey() {
+
     let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
+        kSecClass as String:
+            kSecClassKey,
+
         kSecAttrApplicationTag as String:
             keyTag.data(using: .utf8)!,
+
         kSecAttrKeyType as String:
-            kSecAttrKeyTypeECSECPrimeRandom
+            kSecAttrKeyTypeECSECPrimeRandom,
+
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave
     ]
 
     let status = SecItemDelete(
@@ -174,17 +233,23 @@ func deleteKey() {
 
     if status != errSecSuccess &&
        status != errSecItemNotFound {
-        fail("Unable to delete DS01 Secure Enclave key.")
+
+        fail(
+            "Unable to delete DS01 Secure Enclave key."
+        )
     }
 
     print("DELETED")
 }
 
+
+// Command dispatcher.
 guard CommandLine.arguments.count >= 2 else {
     fail("Missing operation.")
 }
 
 switch CommandLine.arguments[1] {
+
 case "create":
     createKey()
 
@@ -192,6 +257,7 @@ case "public":
     publicKey()
 
 case "sign":
+
     guard CommandLine.arguments.count >= 3 else {
         fail("Missing data to sign.")
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ds-01",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {

package/scripts/copy-native.js

@@ -12,4 +12,4 @@ fs.mkdirSync(destinationDir, { recursive: true });
 
 fs.copyFileSync(source, destination);
 
-console.log("✅ Copied macOS native helper.");
+

package/src/native/macos-key-helper.swift

@@ -8,30 +8,16 @@ func fail(_ message: String) -> Never {
     exit(1)
 }
 
-func getAccessControl() -> SecAccessControl {
-    var error: Unmanaged<CFError>?
-
-    guard let access = SecAccessControlCreateWithFlags(
-        nil,
-        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-        .privateKeyUsage,
-        &error
-    ) else {
-        if let error {
-            fail(error.takeRetainedValue().localizedDescription)
-        }
-
-        fail("Unable to create Secure Enclave access control.")
-    }
-
-    return access
-}
-
+// Find the existing Secure Enclave private key.
 func findPrivateKey() -> SecKey? {
     let query: [String: Any] = [
         kSecClass as String: kSecClassKey,
-        kSecAttrApplicationTag as String: keyTag.data(using: .utf8)!,
-        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave,
         kSecReturnRef as String: true
     ]
 
@@ -50,33 +36,70 @@ func findPrivateKey() -> SecKey? {
 }
 
 func createKey() {
+
+    // If the key already exists, don't create another one.
     if findPrivateKey() != nil {
         print("EXISTS")
         return
     }
 
-    let access = getAccessControl()
+    // Keychain access control.
+    //
+    // WhenUnlockedThisDeviceOnly means:
+    // - available only while the device is unlocked
+    // - cannot be restored onto another device
+    //
+    // privateKeyUsage means the key can be used for signing.
+    var accessError: Unmanaged<CFError>?
+
+    guard let access = SecAccessControlCreateWithFlags(
+        nil,
+        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+        .privateKeyUsage,
+        &accessError
+    ) else {
+
+        if let error = accessError {
+            fail(
+                "Unable to create Keychain access control: " +
+                error.takeRetainedValue().localizedDescription
+            )
+        }
+
+        fail("Unable to create Keychain access control.")
+    }
+
+    let privateAttributes: [String: Any] = [
+
+        // Permanently store the private key.
+        kSecAttrIsPermanent as String: true,
+
+        // Identifier used to find the key later.
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+
+        // Access rules for the private key.
+        kSecAttrAccessControl as String:
+            access
+    ]
 
     let attributes: [String: Any] = [
+
+        // EC P-256 key.
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom,
 
         kSecAttrKeySizeInBits as String:
             256,
 
+        // IMPORTANT:
+        // The private key lives inside the Secure Enclave.
         kSecAttrTokenID as String:
             kSecAttrTokenIDSecureEnclave,
 
-        kSecPrivateKeyAttrs as String: [
-            kSecAttrIsPermanent as String:
-                true,
-
-            kSecAttrApplicationTag as String:
-                keyTag.data(using: .utf8)!,
-
-            kSecAttrAccessControl as String:
-                access
-        ]
+        // Private key configuration.
+        kSecPrivateKeyAttrs as String:
+            privateAttributes
     ]
 
     var error: Unmanaged<CFError>?
@@ -85,17 +108,26 @@ func createKey() {
         attributes as CFDictionary,
         &error
     ) != nil else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Secure Enclave key creation failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
-        fail("Unable to create Secure Enclave key.")
+        fail("Secure Enclave key creation failed.")
     }
 
     print("CREATED")
 }
 
+
+// Return ONLY the public key.
+//
+// The private key is never exported.
 func publicKey() {
+
     guard let privateKey = findPrivateKey() else {
         fail("DS01 Secure Enclave key not found.")
     }
@@ -110,35 +142,47 @@ func publicKey() {
         publicKey,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Unable to export public key: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
         fail("Unable to export public key.")
     }
 
-    let base64 = (data as Data).base64EncodedString()
-
-    print(base64)
+    print(
+        (data as Data).base64EncodedString()
+    )
 }
 
+
+// Sign data using the Secure Enclave private key.
 func sign(_ base64Data: String) {
+
     guard let privateKey = findPrivateKey() else {
         fail("DS01 Secure Enclave key not found.")
     }
 
-    guard let data = Data(base64Encoded: base64Data) else {
+    guard let data = Data(
+        base64Encoded: base64Data
+    ) else {
         fail("Invalid input data.")
     }
 
-    let algorithm = SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
+    let algorithm =
+        SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
 
     guard SecKeyIsAlgorithmSupported(
         privateKey,
         .sign,
         algorithm
     ) else {
-        fail("Secure Enclave key does not support signing.")
+        fail(
+            "Secure Enclave key does not support signing."
+        )
     }
 
     var error: Unmanaged<CFError>?
@@ -149,23 +193,38 @@ func sign(_ base64Data: String) {
         data as CFData,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Secure Enclave signing failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
         fail("Secure Enclave signing failed.")
     }
 
-    print((signature as Data).base64EncodedString())
+    print(
+        (signature as Data).base64EncodedString()
+    )
 }
 
+
+// Remove the DS01 key from this Mac.
 func deleteKey() {
+
     let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
+        kSecClass as String:
+            kSecClassKey,
+
         kSecAttrApplicationTag as String:
             keyTag.data(using: .utf8)!,
+
         kSecAttrKeyType as String:
-            kSecAttrKeyTypeECSECPrimeRandom
+            kSecAttrKeyTypeECSECPrimeRandom,
+
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave
     ]
 
     let status = SecItemDelete(
@@ -174,17 +233,23 @@ func deleteKey() {
 
     if status != errSecSuccess &&
        status != errSecItemNotFound {
-        fail("Unable to delete DS01 Secure Enclave key.")
+
+        fail(
+            "Unable to delete DS01 Secure Enclave key."
+        )
     }
 
     print("DELETED")
 }
 
+
+// Command dispatcher.
 guard CommandLine.arguments.count >= 2 else {
     fail("Missing operation.")
 }
 
 switch CommandLine.arguments[1] {
+
 case "create":
     createKey()
 
@@ -192,6 +257,7 @@ case "public":
     publicKey()
 
 case "sign":
+
     guard CommandLine.arguments.count >= 3 else {
         fail("Missing data to sign.")
     }