ds-01 1.0.13 → 1.1.1

package/src/native/macos-key-helper.swift

@@ -8,17 +8,20 @@ func fail(_ message: String) -> Never {
     exit(1)
 }
 
-// Find the existing Secure Enclave private key.
+// Find our existing private key in the current user's Keychain.
 func findPrivateKey() -> SecKey? {
     let query: [String: Any] = [
-        kSecClass as String: kSecClassKey,
+        kSecClass as String:
+            kSecClassKey,
+
         kSecAttrApplicationTag as String:
             keyTag.data(using: .utf8)!,
+
         kSecAttrKeyType as String:
             kSecAttrKeyTypeECSECPrimeRandom,
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave,
-        kSecReturnRef as String: true
+
+        kSecReturnRef as String:
+            true
     ]
 
     var result: CFTypeRef?
@@ -35,54 +38,16 @@ func findPrivateKey() -> SecKey? {
     return (result as! SecKey)
 }
 
+
+// Create a persistent EC P-256 private key.
 func createKey() {
 
-    // If the key already exists, don't create another one.
+    // Don't create a second key if one already exists.
     if findPrivateKey() != nil {
         print("EXISTS")
         return
     }
 
-    // Keychain access control.
-    //
-    // WhenUnlockedThisDeviceOnly means:
-    // - available only while the device is unlocked
-    // - cannot be restored onto another device
-    //
-    // privateKeyUsage means the key can be used for signing.
-    var accessError: Unmanaged<CFError>?
-
-    guard let access = SecAccessControlCreateWithFlags(
-        nil,
-        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-        .privateKeyUsage,
-        &accessError
-    ) else {
-
-        if let error = accessError {
-            fail(
-                "Unable to create Keychain access control: " +
-                error.takeRetainedValue().localizedDescription
-            )
-        }
-
-        fail("Unable to create Keychain access control.")
-    }
-
-    let privateAttributes: [String: Any] = [
-
-        // Permanently store the private key.
-        kSecAttrIsPermanent as String: true,
-
-        // Identifier used to find the key later.
-        kSecAttrApplicationTag as String:
-            keyTag.data(using: .utf8)!,
-
-        // Access rules for the private key.
-        kSecAttrAccessControl as String:
-            access
-    ]
-
     let attributes: [String: Any] = [
 
         // EC P-256 key.
@@ -92,14 +57,15 @@ func createKey() {
         kSecAttrKeySizeInBits as String:
             256,
 
-        // IMPORTANT:
-        // The private key lives inside the Secure Enclave.
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave,
+        // Store the private key permanently in Keychain.
+        kSecPrivateKeyAttrs as String: [
+
+            kSecAttrIsPermanent as String:
+                true,
 
-        // Private key configuration.
-        kSecPrivateKeyAttrs as String:
-            privateAttributes
+            kSecAttrApplicationTag as String:
+                keyTag.data(using: .utf8)!
+        ]
     ]
 
     var error: Unmanaged<CFError>?
@@ -111,28 +77,30 @@ func createKey() {
 
         if let error {
             fail(
-                "Secure Enclave key creation failed: " +
+                "Keychain key creation failed: " +
                 error.takeRetainedValue().localizedDescription
             )
         }
 
-        fail("Secure Enclave key creation failed.")
+        fail("Keychain key creation failed.")
     }
 
     print("CREATED")
 }
 
 
-// Return ONLY the public key.
+// Return only the public key.
 //
 // The private key is never exported.
 func publicKey() {
 
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
-    guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
+    guard let publicKey = SecKeyCopyPublicKey(
+        privateKey
+    ) else {
         fail("Unable to obtain public key.")
     }
 
@@ -159,11 +127,11 @@ func publicKey() {
 }
 
 
-// Sign data using the Secure Enclave private key.
+// Sign data using the Keychain private key.
 func sign(_ base64Data: String) {
 
     guard let privateKey = findPrivateKey() else {
-        fail("DS01 Secure Enclave key not found.")
+        fail("DS01 device key not found.")
     }
 
     guard let data = Data(
@@ -180,9 +148,7 @@ func sign(_ base64Data: String) {
         .sign,
         algorithm
     ) else {
-        fail(
-            "Secure Enclave key does not support signing."
-        )
+        fail("Device key does not support signing.")
     }
 
     var error: Unmanaged<CFError>?
@@ -196,12 +162,12 @@ func sign(_ base64Data: String) {
 
         if let error {
             fail(
-                "Secure Enclave signing failed: " +
+                "Signing failed: " +
                 error.takeRetainedValue().localizedDescription
             )
         }
 
-        fail("Secure Enclave signing failed.")
+        fail("Signing failed.")
     }
 
     print(
@@ -210,7 +176,7 @@ func sign(_ base64Data: String) {
 }
 
 
-// Remove the DS01 key from this Mac.
+// Delete the DS01 private key from Keychain.
 func deleteKey() {
 
     let query: [String: Any] = [
@@ -221,10 +187,7 @@ func deleteKey() {
             keyTag.data(using: .utf8)!,
 
         kSecAttrKeyType as String:
-            kSecAttrKeyTypeECSECPrimeRandom,
-
-        kSecAttrTokenID as String:
-            kSecAttrTokenIDSecureEnclave
+            kSecAttrKeyTypeECSECPrimeRandom
     ]
 
     let status = SecItemDelete(
@@ -235,7 +198,7 @@ func deleteKey() {
        status != errSecItemNotFound {
 
         fail(
-            "Unable to delete DS01 Secure Enclave key."
+            "Unable to delete DS01 device key."
         )
     }
 

package/src/utils/secureKeyStore.ts

@@ -11,13 +11,16 @@ const execFileAsync = promisify(execFile);
 const KEY_NAME = "DS01-CLI-Device-Key";
 
 const __filename = fileURLToPath(import.meta.url);
+// import.meta.ur -- current module ka location URL form mein deta hai
+
 const __dirname = path.dirname(__filename);
+//C:\Projects\DS01\cli\dist\utils
+
+// __filename = where is THIS FILE?
+// __dirname  = which folder contains THIS FILE?
 
 function getMacHelperPath(): string {
-  return path.resolve(
-    __dirname,
-    "../native/macos-key-helper.swift",
-  );
+  return path.resolve(__dirname, "../native/macos-key-helper.swift");
 }
 
 function ensureSupportedOS(): void {
@@ -30,11 +33,7 @@ function ensureSupportedOS(): void {
   }
 }
 
-/**
- * ---------------------------------------------------------
- * WINDOWS
- * ---------------------------------------------------------
- */
+// for windows
 
 async function createWindowsDeviceKey(): Promise<void> {
   const script = `
@@ -102,21 +101,10 @@ Write-Output "CREATED"
   const result = stdout.trim();
 
   if (result !== "CREATED" && result !== "EXISTS") {
-    throw new Error(
-      "Failed to create Windows DS01 device key.",
-    );
+    throw new Error("Failed to create Windows DS01 device key.");
   }
 }
 
-/**
- * Find exactly one valid DS01 certificate.
- *
- * We intentionally do not use Select-Object -First 1.
- *
- * 0 certificates  -> error
- * 1 certificate   -> use it
- * 2+ certificates -> error
- */
 function getWindowsCertificateLookup(): string {
   return `
 $certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
@@ -138,6 +126,12 @@ $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]$certifi
 `;
 }
 
+// cert - just a variable holding the certificate object
+// X509Certificate2 is a Windows/.NET certificate object 
+// that gives the code a standard way to work with the certificate and its associated key information
+// X509Certificate2 a class/type, rather than simply a "format"
+
+
 async function getWindowsPublicKey(): Promise<string> {
   const script = `
 $ErrorActionPreference = "Stop"
@@ -165,19 +159,14 @@ ${getWindowsCertificateLookup()}
   const certificate = stdout.trim();
 
   if (!certificate) {
-    throw new Error(
-      "Unable to read Windows DS01 public certificate.",
-    );
+    throw new Error("Unable to read Windows DS01 public certificate.");
   }
 
   return certificate;
 }
 
-async function signWindowsDeviceKey(
-  data: Uint8Array,
-): Promise<Uint8Array> {
-  const dataBase64 =
-    Buffer.from(data).toString("base64");
+async function signWindowsDeviceKey(data: Uint8Array): Promise<Uint8Array> {
+  const dataBase64 = Buffer.from(data).toString("base64");
 
   const script = `
 $ErrorActionPreference = "Stop"
@@ -226,17 +215,16 @@ finally {
     },
   );
 
+
+  
+
   const signature = stdout.trim();
 
   if (!signature) {
-    throw new Error(
-      "Failed to sign data with Windows device key.",
-    );
+    throw new Error("Failed to sign data with Windows device key.");
   }
 
-  return new Uint8Array(
-    Buffer.from(signature, "base64"),
-  );
+  return new Uint8Array(Buffer.from(signature, "base64"));
 }
 
 async function deleteWindowsDeviceKey(): Promise<void> {
@@ -277,18 +265,10 @@ Write-Output "DELETED"
   );
 }
 
-/**
- * ---------------------------------------------------------
- * MACOS
- * ---------------------------------------------------------
- */
+// for Mac
 
 async function runMacHelper(
-  operation:
-    | "create"
-    | "public"
-    | "sign"
-    | "delete",
+  operation: "create" | "public" | "sign" | "delete",
   data?: Uint8Array,
 ): Promise<string> {
   const helper = getMacHelperPath();
@@ -296,76 +276,51 @@ async function runMacHelper(
   const args = [helper, operation];
 
   if (data) {
-    args.push(
-      Buffer.from(data).toString("base64"),
-    );
+    args.push(Buffer.from(data).toString("base64"));
   }
 
-  const { stdout } = await execFileAsync(
-    "swift",
-    args,
-    {
-      windowsHide: true,
-    },
-  );
+  const { stdout } = await execFileAsync("swift", args, {
+    windowsHide: true,
+  });
 
   return stdout.trim();
 }
 
 async function createMacDeviceKey(): Promise<void> {
-  const result =
-    await runMacHelper("create");
+  const result = await runMacHelper("create");
 
-  if (
-    result !== "CREATED" &&
-    result !== "EXISTS"
-  ) {
+  if (result !== "CREATED" && result !== "EXISTS") {
     throw new Error(
-      result ||
-        "Failed to create macOS Secure Enclave device key.",
+      result || "Failed to create macOS Secure Enclave device key.",
     );
   }
 }
 
 async function getMacPublicKey(): Promise<string> {
-  const result =
-    await runMacHelper("public");
+  const result = await runMacHelper("public");
 
   if (!result) {
-    throw new Error(
-      "Unable to read macOS DS01 public key.",
-    );
+    throw new Error("Unable to read macOS DS01 public key.");
   }
 
   return result;
 }
 
-async function signMacDeviceKey(
-  data: Uint8Array,
-): Promise<Uint8Array> {
-  const result =
-    await runMacHelper("sign", data);
+async function signMacDeviceKey(data: Uint8Array): Promise<Uint8Array> {
+  const result = await runMacHelper("sign", data);
 
   if (!result) {
-    throw new Error(
-      "Failed to sign data with macOS Secure Enclave key.",
-    );
+    throw new Error("Failed to sign data with macOS Secure Enclave key.");
   }
 
-  return new Uint8Array(
-    Buffer.from(result, "base64"),
-  );
+  return new Uint8Array(Buffer.from(result, "base64"));
 }
 
 async function deleteMacDeviceKey(): Promise<void> {
   await runMacHelper("delete");
 }
 
-/**
- * ---------------------------------------------------------
- * PUBLIC API
- * ---------------------------------------------------------
- */
+// Public APIs which we use this for creating keys and certificate
 
 export async function createDeviceKey(): Promise<void> {
   ensureSupportedOS();
@@ -388,9 +343,7 @@ export async function getDevicePublicKey(): Promise<string> {
   return getMacPublicKey();
 }
 
-export async function signWithDeviceKey(
-  data: Uint8Array,
-): Promise<Uint8Array> {
+export async function signWithDeviceKey(data: Uint8Array): Promise<Uint8Array> {
   ensureSupportedOS();
 
   if (os.platform() === "win32") {
@@ -409,4 +362,4 @@ export async function deleteDeviceKey(): Promise<void> {
   }
 
   await deleteMacDeviceKey();
-}
+}

package/src/test-key.ts

@@ -1,20 +0,0 @@
-import {
-  createDeviceKey,
-  getDevicePublicKey,
-  signWithDeviceKey,
-} from "./utils/secureKeyStore.js";
-
-await createDeviceKey();
-
-const publicKey = await getDevicePublicKey();
-
-console.log("Public key:", publicKey);
-
-const message = new TextEncoder().encode("hello DS01");
-
-const signature = await signWithDeviceKey(message);
-
-console.log(
-  "Signature:",
-  Buffer.from(signature).toString("base64"),
-);

package/src/utils/deviceKey.ts

@@ -1,19 +0,0 @@
-import { webcrypto } from "node:crypto";
-
-const { subtle } = webcrypto;
-
-export async function generateDeviceKeyPair() {
-  // Generate an asymmetric key pair:
-  // - publicKey  → can be shared with the server
-  // - privateKey → stays on this device
-  const keyPair = await subtle.generateKey(
-    {
-      name: "ECDSA",
-      namedCurve: "P-256",
-    },
-    false, // 🔐 Private key is NON-EXPORTABLE
-    ["sign", "verify"],
-  );
-
-  return keyPair;
-}