ds-01 1.0.13 → 1.0.14

package/dist/native/macos-key-helper.swift

@@ -8,17 +8,20 @@ func fail(_ message: String) -> Never {
     exit(1)
 }
 
-// Find the existing Secure Enclave private key.
+// Find our existing private key in the current user's Keychain.
 func findPrivateKey() -> SecKey? {
     let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
+        kSecClass as String:
+            kSecClassKey,
+
         kSecAttrApplicationTag as String:
             keyTag.data(using: .utf8)!,
+
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom,
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave,
-        kSecReturnRef as String: true
+
+        kSecReturnRef as String:
+            true
     ]
 
     var result: CFTypeRef?
@@ -35,54 +38,16 @@ func findPrivateKey() -> SecKey? {
     return (result as! SecKey)
 }
 
+
+// Create a persistent EC P-256 private key.
 func createKey() {
 
-    // If the key already exists, don't create another one.
+    // Don't create a second key if one already exists.
     if findPrivateKey() != nil {
         print("EXISTS")
         return
     }
 
-    // Keychain access control.
-    //
-    // WhenUnlockedThisDeviceOnly means:
-    // - available only while the device is unlocked
-    // - cannot be restored onto another device
-    //
-    // privateKeyUsage means the key can be used for signing.
-    var accessError: Unmanaged<CFError>?
-
-    guard let access = SecAccessControlCreateWithFlags(
-        nil,
-        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-        .privateKeyUsage,
-        &accessError
-    ) else {
-
-        if let error = accessError {
-            fail(
-                "Unable to create Keychain access control: " +
-                error.takeRetainedValue().localizedDescription
-            )
-        }
-
-        fail("Unable to create Keychain access control.")
-    }
-
-    let privateAttributes: [String: Any] = [
-
-        // Permanently store the private key.
-        kSecAttrIsPermanent as String: true,
-
-        // Identifier used to find the key later.
-        kSecAttrApplicationTag as String:
-            keyTag.data(using: .utf8)!,
-
-        // Access rules for the private key.
-        kSecAttrAccessControl as String:
-            access
-    ]
-
     let attributes: [String: Any] = [
 
         // EC P-256 key.
@@ -92,14 +57,15 @@ func createKey() {
         kSecAttrKeySizeInBits as String:
             256,
 
-        // IMPORTANT:
-        // The private key lives inside the Secure Enclave.
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave,
+        // Store the private key permanently in Keychain.
+        kSecPrivateKeyAttrs as String: [
+
+            kSecAttrIsPermanent as String:
+                true,
 
-        // Private key configuration.
-        kSecPrivateKeyAttrs as String:
-            privateAttributes
+            kSecAttrApplicationTag as String:
+                keyTag.data(using: .utf8)!
+        ]
     ]
 
     var error: Unmanaged<CFError>?
@@ -111,28 +77,30 @@ func createKey() {
 
         if let error {
             fail(
-                "Secure Enclave key creation failed: " +
+                "Keychain key creation failed: " +
                 error.takeRetainedValue().localizedDescription
             )
         }
 
-        fail("Secure Enclave key creation failed.")
+        fail("Keychain key creation failed.")
     }
 
     print("CREATED")
 }
 
 
-// Return ONLY the public key.
+// Return only the public key.
 //
 // The private key is never exported.
 func publicKey() {
 
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
-    guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
+    guard let publicKey = SecKeyCopyPublicKey(
+        privateKey
+    ) else {
         fail("Unable to obtain public key.")
     }
 
@@ -159,11 +127,11 @@ func publicKey() {
 }
 
 
-// Sign data using the Secure Enclave private key.
+// Sign data using the Keychain private key.
 func sign(_ base64Data: String) {
 
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
     guard let data = Data(
@@ -180,9 +148,7 @@ func sign(_ base64Data: String) {
         .sign,
         algorithm
     ) else {
-        fail(
-            "Secure Enclave key does not support signing."
-        )
+        fail("Device key does not support signing.")
     }
 
     var error: Unmanaged<CFError>?
@@ -196,12 +162,12 @@ func sign(_ base64Data: String) {
 
         if let error {
             fail(
-                "Secure Enclave signing failed: " +
+                "Signing failed: " +
                 error.takeRetainedValue().localizedDescription
             )
         }
 
-        fail("Secure Enclave signing failed.")
+        fail("Signing failed.")
     }
 
     print(
@@ -210,7 +176,7 @@ func sign(_ base64Data: String) {
 }
 
 
-// Remove the DS01 key from this Mac.
+// Delete the DS01 private key from Keychain.
 func deleteKey() {
 
     let query: [String: Any] = [
@@ -221,10 +187,7 @@ func deleteKey() {
             keyTag.data(using: .utf8)!,
 
         kSecAttrKeyType as String:
-            kSecAttrKeyTypeECSECPrimeRandom,
-
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave
+            kSecAttrKeyTypeECSECPrimeRandom
     ]
 
     let status = SecItemDelete(
@@ -235,7 +198,7 @@ func deleteKey() {
        status != errSecItemNotFound {
 
         fail(
-            "Unable to delete DS01 Secure Enclave key."
+            "Unable to delete DS01 device key."
         )
     }
 

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "ds-01",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {
     "ds01": "dist/index.js"
   },
   "scripts": {
-    "build": "tsc && node scripts/copy-native.js"
+    "build": "tsc && node scripts/copy-native.js && node scripts/build-macos-helper.js"
   },
   "publishConfig": {
     "access": "public"

package/scripts/build-macos-helper.js

@@ -0,0 +1,52 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+
+if (process.platform !== "darwin") {
+  console.log("Skipping macOS native helper build.");
+  process.exit(0);
+}
+
+const root = process.cwd();
+
+const source = path.join(
+  root,
+  "src",
+  "native",
+  "macos-key-helper.swift",
+);
+
+const nativeDir = path.join(
+  root,
+  "dist",
+  "native",
+);
+
+const output = path.join(
+  nativeDir,
+  "macos-key-helper",
+);
+
+if (!fs.existsSync(source)) {
+  throw new Error(`Swift helper not found: ${source}`);
+}
+
+fs.mkdirSync(nativeDir, {
+  recursive: true,
+});
+
+console.log("Building macOS native helper...");
+
+execFileSync(
+  "swiftc",
+  [
+    source,
+    "-o",
+    output,
+  ],
+  {
+    stdio: "inherit",
+  },
+);
+
+console.log("macOS native helper built successfully.");

package/src/native/macos-key-helper.swift

@@ -8,17 +8,20 @@ func fail(_ message: String) -> Never {
     exit(1)
 }
 
-// Find the existing Secure Enclave private key.
+// Find our existing private key in the current user's Keychain.
 func findPrivateKey() -> SecKey? {
     let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
+        kSecClass as String:
+            kSecClassKey,
+
         kSecAttrApplicationTag as String:
             keyTag.data(using: .utf8)!,
+
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom,
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave,
-        kSecReturnRef as String: true
+
+        kSecReturnRef as String:
+            true
     ]
 
     var result: CFTypeRef?
@@ -35,54 +38,16 @@ func findPrivateKey() -> SecKey? {
     return (result as! SecKey)
 }
 
+
+// Create a persistent EC P-256 private key.
 func createKey() {
 
-    // If the key already exists, don't create another one.
+    // Don't create a second key if one already exists.
     if findPrivateKey() != nil {
         print("EXISTS")
         return
     }
 
-    // Keychain access control.
-    //
-    // WhenUnlockedThisDeviceOnly means:
-    // - available only while the device is unlocked
-    // - cannot be restored onto another device
-    //
-    // privateKeyUsage means the key can be used for signing.
-    var accessError: Unmanaged<CFError>?
-
-    guard let access = SecAccessControlCreateWithFlags(
-        nil,
-        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-        .privateKeyUsage,
-        &accessError
-    ) else {
-
-        if let error = accessError {
-            fail(
-                "Unable to create Keychain access control: " +
-                error.takeRetainedValue().localizedDescription
-            )
-        }
-
-        fail("Unable to create Keychain access control.")
-    }
-
-    let privateAttributes: [String: Any] = [
-
-        // Permanently store the private key.
-        kSecAttrIsPermanent as String: true,
-
-        // Identifier used to find the key later.
-        kSecAttrApplicationTag as String:
-            keyTag.data(using: .utf8)!,
-
-        // Access rules for the private key.
-        kSecAttrAccessControl as String:
-            access
-    ]
-
     let attributes: [String: Any] = [
 
         // EC P-256 key.
@@ -92,14 +57,15 @@ func createKey() {
         kSecAttrKeySizeInBits as String:
             256,
 
-        // IMPORTANT:
-        // The private key lives inside the Secure Enclave.
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave,
+        // Store the private key permanently in Keychain.
+        kSecPrivateKeyAttrs as String: [
+
+            kSecAttrIsPermanent as String:
+                true,
 
-        // Private key configuration.
-        kSecPrivateKeyAttrs as String:
-            privateAttributes
+            kSecAttrApplicationTag as String:
+                keyTag.data(using: .utf8)!
+        ]
     ]
 
     var error: Unmanaged<CFError>?
@@ -111,28 +77,30 @@ func createKey() {
 
         if let error {
             fail(
-                "Secure Enclave key creation failed: " +
+                "Keychain key creation failed: " +
                 error.takeRetainedValue().localizedDescription
             )
         }
 
-        fail("Secure Enclave key creation failed.")
+        fail("Keychain key creation failed.")
     }
 
     print("CREATED")
 }
 
 
-// Return ONLY the public key.
+// Return only the public key.
 //
 // The private key is never exported.
 func publicKey() {
 
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
-    guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
+    guard let publicKey = SecKeyCopyPublicKey(
+        privateKey
+    ) else {
         fail("Unable to obtain public key.")
     }
 
@@ -159,11 +127,11 @@ func publicKey() {
 }
 
 
-// Sign data using the Secure Enclave private key.
+// Sign data using the Keychain private key.
 func sign(_ base64Data: String) {
 
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
     guard let data = Data(
@@ -180,9 +148,7 @@ func sign(_ base64Data: String) {
         .sign,
         algorithm
     ) else {
-        fail(
-            "Secure Enclave key does not support signing."
-        )
+        fail("Device key does not support signing.")
     }
 
     var error: Unmanaged<CFError>?
@@ -196,12 +162,12 @@ func sign(_ base64Data: String) {
 
         if let error {
             fail(
-                "Secure Enclave signing failed: " +
+                "Signing failed: " +
                 error.takeRetainedValue().localizedDescription
             )
         }
 
-        fail("Secure Enclave signing failed.")
+        fail("Signing failed.")
     }
 
     print(
@@ -210,7 +176,7 @@ func sign(_ base64Data: String) {
 }
 
 
-// Remove the DS01 key from this Mac.
+// Delete the DS01 private key from Keychain.
 func deleteKey() {
 
     let query: [String: Any] = [
@@ -221,10 +187,7 @@ func deleteKey() {
             keyTag.data(using: .utf8)!,
 
         kSecAttrKeyType as String:
-            kSecAttrKeyTypeECSECPrimeRandom,
-
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave
+            kSecAttrKeyTypeECSECPrimeRandom
     ]
 
     let status = SecItemDelete(
@@ -235,7 +198,7 @@ func deleteKey() {
        status != errSecItemNotFound {
 
         fail(
-            "Unable to delete DS01 Secure Enclave key."
+            "Unable to delete DS01 device key."
         )
     }