ds-01 1.0.12 → 1.0.14

package/dist/native/macos-key-helper.swift

@@ -8,31 +8,20 @@ func fail(_ message: String) -> Never {
     exit(1)
 }
 
-func getAccessControl() -> SecAccessControl {
-    var error: Unmanaged<CFError>?
-
-    guard let access = SecAccessControlCreateWithFlags(
-        nil,
-        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-        .privateKeyUsage,
-        &error
-    ) else {
-        if let error {
-            fail(error.takeRetainedValue().localizedDescription)
-        }
+// Find our existing private key in the current user's Keychain.
+func findPrivateKey() -> SecKey? {
+    let query: [String: Any] = [
+        kSecClass as String:
+            kSecClassKey,
 
-        fail("Unable to create Secure Enclave access control.")
-    }
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
 
-    return access
-}
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
 
-func findPrivateKey() -> SecKey? {
-    let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
-        kSecAttrApplicationTag as String: keyTag.data(using: .utf8)!,
-        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
-        kSecReturnRef as String: true
+        kSecReturnRef as String:
+            true
     ]
 
     var result: CFTypeRef?
@@ -49,33 +38,33 @@ func findPrivateKey() -> SecKey? {
     return (result as! SecKey)
 }
 
+
+// Create a persistent EC P-256 private key.
 func createKey() {
+
+    // Don't create a second key if one already exists.
     if findPrivateKey() != nil {
         print("EXISTS")
         return
     }
 
-    let access = getAccessControl()
-
     let attributes: [String: Any] = [
+
+        // EC P-256 key.
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom,
 
         kSecAttrKeySizeInBits as String:
             256,
 
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave,
-
+        // Store the private key permanently in Keychain.
         kSecPrivateKeyAttrs as String: [
+
             kSecAttrIsPermanent as String:
                 true,
 
             kSecAttrApplicationTag as String:
-                keyTag.data(using: .utf8)!,
-
-            kSecAttrAccessControl as String:
-                access
+                keyTag.data(using: .utf8)!
         ]
     ]
 
@@ -85,22 +74,33 @@ func createKey() {
         attributes as CFDictionary,
         &error
     ) != nil else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Keychain key creation failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
-        fail("Unable to create Secure Enclave key.")
+        fail("Keychain key creation failed.")
     }
 
     print("CREATED")
 }
 
+
+// Return only the public key.
+//
+// The private key is never exported.
 func publicKey() {
+
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
-    guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
+    guard let publicKey = SecKeyCopyPublicKey(
+        privateKey
+    ) else {
         fail("Unable to obtain public key.")
     }
 
@@ -110,35 +110,45 @@ func publicKey() {
         publicKey,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Unable to export public key: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
         fail("Unable to export public key.")
     }
 
-    let base64 = (data as Data).base64EncodedString()
-
-    print(base64)
+    print(
+        (data as Data).base64EncodedString()
+    )
 }
 
+
+// Sign data using the Keychain private key.
 func sign(_ base64Data: String) {
+
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
-    guard let data = Data(base64Encoded: base64Data) else {
+    guard let data = Data(
+        base64Encoded: base64Data
+    ) else {
         fail("Invalid input data.")
     }
 
-    let algorithm = SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
+    let algorithm =
+        SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
 
     guard SecKeyIsAlgorithmSupported(
         privateKey,
         .sign,
         algorithm
     ) else {
-        fail("Secure Enclave key does not support signing.")
+        fail("Device key does not support signing.")
     }
 
     var error: Unmanaged<CFError>?
@@ -149,21 +159,33 @@ func sign(_ base64Data: String) {
         data as CFData,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Signing failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
-        fail("Secure Enclave signing failed.")
+        fail("Signing failed.")
     }
 
-    print((signature as Data).base64EncodedString())
+    print(
+        (signature as Data).base64EncodedString()
+    )
 }
 
+
+// Delete the DS01 private key from Keychain.
 func deleteKey() {
+
     let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
+        kSecClass as String:
+            kSecClassKey,
+
         kSecAttrApplicationTag as String:
             keyTag.data(using: .utf8)!,
+
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom
     ]
@@ -174,17 +196,23 @@ func deleteKey() {
 
     if status != errSecSuccess &&
        status != errSecItemNotFound {
-        fail("Unable to delete DS01 Secure Enclave key.")
+
+        fail(
+            "Unable to delete DS01 device key."
+        )
     }
 
     print("DELETED")
 }
 
+
+// Command dispatcher.
 guard CommandLine.arguments.count >= 2 else {
     fail("Missing operation.")
 }
 
 switch CommandLine.arguments[1] {
+
 case "create":
     createKey()
 
@@ -192,6 +220,7 @@ case "public":
     publicKey()
 
 case "sign":
+
     guard CommandLine.arguments.count >= 3 else {
         fail("Missing data to sign.")
     }

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "ds-01",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {
     "ds01": "dist/index.js"
   },
   "scripts": {
-    "build": "tsc && node scripts/copy-native.js"
+    "build": "tsc && node scripts/copy-native.js && node scripts/build-macos-helper.js"
   },
   "publishConfig": {
     "access": "public"

package/scripts/build-macos-helper.js

@@ -0,0 +1,52 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+
+if (process.platform !== "darwin") {
+  console.log("Skipping macOS native helper build.");
+  process.exit(0);
+}
+
+const root = process.cwd();
+
+const source = path.join(
+  root,
+  "src",
+  "native",
+  "macos-key-helper.swift",
+);
+
+const nativeDir = path.join(
+  root,
+  "dist",
+  "native",
+);
+
+const output = path.join(
+  nativeDir,
+  "macos-key-helper",
+);
+
+if (!fs.existsSync(source)) {
+  throw new Error(`Swift helper not found: ${source}`);
+}
+
+fs.mkdirSync(nativeDir, {
+  recursive: true,
+});
+
+console.log("Building macOS native helper...");
+
+execFileSync(
+  "swiftc",
+  [
+    source,
+    "-o",
+    output,
+  ],
+  {
+    stdio: "inherit",
+  },
+);
+
+console.log("macOS native helper built successfully.");

package/scripts/copy-native.js

@@ -12,4 +12,4 @@ fs.mkdirSync(destinationDir, { recursive: true });
 
 fs.copyFileSync(source, destination);
 
-console.log("✅ Copied macOS native helper.");
+

package/src/native/macos-key-helper.swift

@@ -8,31 +8,20 @@ func fail(_ message: String) -> Never {
     exit(1)
 }
 
-func getAccessControl() -> SecAccessControl {
-    var error: Unmanaged<CFError>?
-
-    guard let access = SecAccessControlCreateWithFlags(
-        nil,
-        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-        .privateKeyUsage,
-        &error
-    ) else {
-        if let error {
-            fail(error.takeRetainedValue().localizedDescription)
-        }
+// Find our existing private key in the current user's Keychain.
+func findPrivateKey() -> SecKey? {
+    let query: [String: Any] = [
+        kSecClass as String:
+            kSecClassKey,
 
-        fail("Unable to create Secure Enclave access control.")
-    }
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
 
-    return access
-}
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
 
-func findPrivateKey() -> SecKey? {
-    let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
-        kSecAttrApplicationTag as String: keyTag.data(using: .utf8)!,
-        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
-        kSecReturnRef as String: true
+        kSecReturnRef as String:
+            true
     ]
 
     var result: CFTypeRef?
@@ -49,33 +38,33 @@ func findPrivateKey() -> SecKey? {
     return (result as! SecKey)
 }
 
+
+// Create a persistent EC P-256 private key.
 func createKey() {
+
+    // Don't create a second key if one already exists.
     if findPrivateKey() != nil {
         print("EXISTS")
         return
     }
 
-    let access = getAccessControl()
-
     let attributes: [String: Any] = [
+
+        // EC P-256 key.
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom,
 
         kSecAttrKeySizeInBits as String:
             256,
 
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave,
-
+        // Store the private key permanently in Keychain.
         kSecPrivateKeyAttrs as String: [
+
             kSecAttrIsPermanent as String:
                 true,
 
             kSecAttrApplicationTag as String:
-                keyTag.data(using: .utf8)!,
-
-            kSecAttrAccessControl as String:
-                access
+                keyTag.data(using: .utf8)!
         ]
     ]
 
@@ -85,22 +74,33 @@ func createKey() {
         attributes as CFDictionary,
         &error
     ) != nil else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Keychain key creation failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
-        fail("Unable to create Secure Enclave key.")
+        fail("Keychain key creation failed.")
     }
 
     print("CREATED")
 }
 
+
+// Return only the public key.
+//
+// The private key is never exported.
 func publicKey() {
+
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
-    guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
+    guard let publicKey = SecKeyCopyPublicKey(
+        privateKey
+    ) else {
         fail("Unable to obtain public key.")
     }
 
@@ -110,35 +110,45 @@ func publicKey() {
         publicKey,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Unable to export public key: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
         fail("Unable to export public key.")
     }
 
-    let base64 = (data as Data).base64EncodedString()
-
-    print(base64)
+    print(
+        (data as Data).base64EncodedString()
+    )
 }
 
+
+// Sign data using the Keychain private key.
 func sign(_ base64Data: String) {
+
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
-    guard let data = Data(base64Encoded: base64Data) else {
+    guard let data = Data(
+        base64Encoded: base64Data
+    ) else {
         fail("Invalid input data.")
     }
 
-    let algorithm = SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
+    let algorithm =
+        SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
 
     guard SecKeyIsAlgorithmSupported(
         privateKey,
         .sign,
         algorithm
     ) else {
-        fail("Secure Enclave key does not support signing.")
+        fail("Device key does not support signing.")
     }
 
     var error: Unmanaged<CFError>?
@@ -149,21 +159,33 @@ func sign(_ base64Data: String) {
         data as CFData,
         &error
     ) else {
+
         if let error {
-            fail(error.takeRetainedValue().localizedDescription)
+            fail(
+                "Signing failed: " +
+                error.takeRetainedValue().localizedDescription
+            )
         }
 
-        fail("Secure Enclave signing failed.")
+        fail("Signing failed.")
     }
 
-    print((signature as Data).base64EncodedString())
+    print(
+        (signature as Data).base64EncodedString()
+    )
 }
 
+
+// Delete the DS01 private key from Keychain.
 func deleteKey() {
+
     let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
+        kSecClass as String:
+            kSecClassKey,
+
         kSecAttrApplicationTag as String:
             keyTag.data(using: .utf8)!,
+
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom
     ]
@@ -174,17 +196,23 @@ func deleteKey() {
 
     if status != errSecSuccess &&
        status != errSecItemNotFound {
-        fail("Unable to delete DS01 Secure Enclave key.")
+
+        fail(
+            "Unable to delete DS01 device key."
+        )
     }
 
     print("DELETED")
 }
 
+
+// Command dispatcher.
 guard CommandLine.arguments.count >= 2 else {
     fail("Missing operation.")
 }
 
 switch CommandLine.arguments[1] {
+
 case "create":
     createKey()
 
@@ -192,6 +220,7 @@ case "public":
     publicKey()
 
 case "sign":
+
     guard CommandLine.arguments.count >= 3 else {
         fail("Missing data to sign.")
     }