ds-01 1.0.3 → 1.0.5

package/src/commands/login.ts

@@ -3,64 +3,106 @@ import { intro, outro, spinner, note, cancel } from "@clack/prompts";
 import pc from "picocolors";
 import open from "open";
 import machineIdPkg from "node-machine-id";
+
 import { saveToken } from "../utils/config.js";
+import {
+  createDeviceKey,
+  getDevicePublicKey,
+} from "../utils/secureKeyStore.js";
 
 const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
+
 const { machineIdSync } = machineIdPkg;
 
 export const login = new Command()
   .name("login")
   .description("Authenticate your terminal with DS01 via browser")
   .action(async () => {
-    console.log(); // Spacing for breathing room
+    console.log();
 
-    // 1. Header banner
     intro(
-      `${pc.bgWhite(pc.black(pc.bold(" DS01 ")))} ${pc.gray("v1.0.0 — Terminal Authentication")}`
+      `${pc.bgWhite(pc.black(pc.bold(" DS01 ")))} ${pc.gray(
+        "v1.0.0 — Terminal Authentication",
+      )}`,
     );
 
     const s = spinner();
 
     try {
-      // 2. Hardware ID Generation & Device Code Request
-      s.start("Generating hardware fingerprint & requesting pairing code...");
+      // --------------------------------------------------
+      // 1. Create / load the device's secure key
+      // --------------------------------------------------
+      s.start("Preparing secure device identity...");
+
+      await createDeviceKey();
+
+      // Only the PUBLIC certificate/key leaves the machine.
+      const publicKey = await getDevicePublicKey();
+
+      // Existing machine fingerprint.
       const hardwareId = machineIdSync();
 
+      // --------------------------------------------------
+      // 2. Start device authorization
+      // --------------------------------------------------
+      s.start("Requesting pairing code...");
+
       const initResponse = await fetch(`${API_BASE_URL}/api/auth/device/code`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ machineId: hardwareId }),
+        headers: {
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          machineId: hardwareId,
+          publicKey,
+          publicKeyType:
+            process.platform === "win32" ? "windows-rsa" : "macos-ec",
+        }),
       });
 
       if (!initResponse.ok) {
         s.stop(pc.red("Failed to reach DS01 authorization server."));
+
         cancel(`Server responded with HTTP ${initResponse.status}`);
+
         process.exit(1);
       }
 
       const { deviceCode, userCode, verificationUrl, interval } =
         await initResponse.json();
 
-      s.stop(pc.green("Device authorization code generated."));
+      if (!deviceCode || !userCode || !verificationUrl) {
+        throw new Error(
+          "Authorization server returned an invalid device response.",
+        );
+      }
 
-      // 3. Highlighted Box for User Action
+      s.stop(pc.green("Secure device identity registered."));
+
+      // --------------------------------------------------
+      // 3. Ask user to approve in browser
+      // --------------------------------------------------
       note(
-        `${pc.bold("Pairing Code:")}    ${pc.cyan(pc.bold(` ${userCode} `))}\n` +
+        `${pc.bold("Pairing Code:")}    ${pc.cyan(
+          pc.bold(` ${userCode} `),
+        )}\n` +
           `${pc.bold("Verification URL:")} ${pc.underline(verificationUrl)}`,
-        "Action Required"
+        "Action Required",
       );
 
-      // 4. Auto-launch Browser
       try {
         await open(verificationUrl);
       } catch {
-        // Non-blocking fallback if browser launch fails on headless setups
+        // Browser launch failure is non-fatal.
       }
 
-      // 5. Polling Loop
+      // --------------------------------------------------
+      // 4. Poll for authorization
+      // --------------------------------------------------
       s.start("Waiting for web authorization...");
 
       let token: string | null = null;
+
       const pollInterval = (interval || 5) * 1000;
 
       while (!token) {
@@ -70,9 +112,14 @@ export const login = new Command()
           `${API_BASE_URL}/api/auth/device/token`,
           {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ deviceCode, machineId: hardwareId }),
-          }
+            headers: {
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+              deviceCode,
+              machineId: hardwareId,
+            }),
+          },
         );
 
         const tokenData = await tokenResponse.json();
@@ -81,23 +128,29 @@ export const login = new Command()
           token = tokenData.accessToken;
         } else if (tokenData.error !== "authorization_pending") {
           s.stop(pc.red("Authorization failed or expired."));
+
           cancel(`Reason: ${tokenData.error || "Unknown authorization error"}`);
+
           process.exit(1);
         }
       }
 
-      // 6. Save token to local wallet
+      // --------------------------------------------------
+      // 5. Save CLI token + machine ID
+      // --------------------------------------------------
       saveToken(token, hardwareId);
 
       s.stop(pc.green("Hardware signature linked & token verified!"));
 
-      // 7. Clean Success Outro
       outro(
-        `${pc.white("✔")} ${pc.bold("Terminal synced successfully")} ${pc.gray("Session token saved locally.")}`
+        `${pc.white("✔")} ${pc.bold("Terminal synced successfully")}\n` +
+          pc.gray("Secure device key and session token are ready."),
       );
     } catch (error: any) {
       s.stop(pc.red("An error occurred during login."));
-      cancel(pc.gray(error.message || "Unknown CLI Error"));
+
+      cancel(pc.gray(error?.message || "Unknown CLI Error"));
+
       process.exit(1);
     }
-  });
+  });

package/src/commands/logout.ts

@@ -2,28 +2,57 @@ import { Command } from "commander";
 import chalk from "chalk";
 import ora from "ora";
 import { deleteToken, getToken } from "../utils/config.js";
+import machineIdPkg from "node-machine-id";
+const { machineIdSync } = machineIdPkg;
+const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
 
 export const logout = new Command()
   .name("logout")
-  .description("Log out of your DS01 account and clear local credentials")
+  .description("Log out of your DS01 account and revoke the CLI session")
   .action(async () => {
     const token = getToken();
+    const machineId = machineIdSync();
 
-    if (!token) {
+    if (!token || !machineId) {
       console.log(chalk.yellow("You are already logged out."));
       return;
     }
 
-    const spinner = ora("Logging out...").start();
+    const spinner = ora("Revoking CLI session...").start();
 
     try {
-      // Throw away the digital wallet / token
+      const response = await fetch(`${API_BASE_URL}/api/auth/cli/logout`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "X-Machine-ID": machineId,
+        },
+      });
+
+      // NEW: Do not silently delete local credentials if the server
+      // failed to revoke the session.
+      if (!response.ok) {
+        const data = await response.json().catch(() => null);
+
+        throw new Error(
+          data?.error || `Logout failed (HTTP ${response.status})`,
+        );
+      }
+
+      // NEW: Delete local credentials only after the server confirms
+      // that the CLI session has been revoked.
+      console.log("✅ Server confirmed CLI session was revoked.");
       deleteToken();
-      
+      console.log("✅ Local credentials deleted.");
       spinner.succeed(chalk.green("Successfully logged out."));
-      console.log(chalk.gray("Your local credentials have been cleared."));
-    } catch (error) {
-      spinner.fail(chalk.red("Failed to log out cleanly."));
-      console.error(error);
+      console.log(
+        chalk.gray(
+          "Your CLI session has been revoked and local credentials have been cleared.",
+        ),
+      );
+    } catch (error: any) {
+      spinner.fail(chalk.red("Failed to log out."));
+
+      console.error(chalk.red(error.message || "Unknown logout error."));
     }
-  });
+  });

package/src/index.ts

@@ -22,4 +22,6 @@ program.addCommand(init);
 program.addCommand(add); // <-- 2. Register the add command!
 
 // Parse the arguments from the terminal
+// It is the point where Commander reads the user's terminal input and decides 
+// which registered command's .action() function should execute.
 program.parse(process.argv);

package/src/native/macos-key-helper.swift

@@ -0,0 +1,206 @@
+import Foundation
+import Security
+
+let keyTag = "com.ds01.cli.device-key"
+
+func fail(_ message: String) -> Never {
+    fputs(message + "\n", stderr)
+    exit(1)
+}
+
+func getAccessControl() -> SecAccessControl {
+    var error: Unmanaged<CFError>?
+
+    guard let access = SecAccessControlCreateWithFlags(
+        nil,
+        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+        .privateKeyUsage,
+        &error
+    ) else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Unable to create Secure Enclave access control.")
+    }
+
+    return access
+}
+
+func findPrivateKey() -> SecKey? {
+    let query: [String: Any] = [
+        kSecClass as String: kSecClassKey,
+        kSecAttrApplicationTag as String: keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+        kSecReturnRef as String: true
+    ]
+
+    var result: CFTypeRef?
+
+    let status = SecItemCopyMatching(
+        query as CFDictionary,
+        &result
+    )
+
+    guard status == errSecSuccess else {
+        return nil
+    }
+
+    return (result as! SecKey)
+}
+
+func createKey() {
+    if findPrivateKey() != nil {
+        print("EXISTS")
+        return
+    }
+
+    let access = getAccessControl()
+
+    let attributes: [String: Any] = [
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
+
+        kSecAttrKeySizeInBits as String:
+            256,
+
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave,
+
+        kSecPrivateKeyAttrs as String: [
+            kSecAttrIsPermanent as String:
+                true,
+
+            kSecAttrApplicationTag as String:
+                keyTag.data(using: .utf8)!,
+
+            kSecAttrAccessControl as String:
+                access
+        ]
+    ]
+
+    var error: Unmanaged<CFError>?
+
+    guard SecKeyCreateRandomKey(
+        attributes as CFDictionary,
+        &error
+    ) != nil else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Unable to create Secure Enclave key.")
+    }
+
+    print("CREATED")
+}
+
+func publicKey() {
+    guard let privateKey = findPrivateKey() else {
+        fail("DS01 Secure Enclave key not found.")
+    }
+
+    guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
+        fail("Unable to obtain public key.")
+    }
+
+    var error: Unmanaged<CFError>?
+
+    guard let data = SecKeyCopyExternalRepresentation(
+        publicKey,
+        &error
+    ) else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Unable to export public key.")
+    }
+
+    let base64 = (data as Data).base64EncodedString()
+
+    print(base64)
+}
+
+func sign(_ base64Data: String) {
+    guard let privateKey = findPrivateKey() else {
+        fail("DS01 Secure Enclave key not found.")
+    }
+
+    guard let data = Data(base64Encoded: base64Data) else {
+        fail("Invalid input data.")
+    }
+
+    let algorithm = SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
+
+    guard SecKeyIsAlgorithmSupported(
+        privateKey,
+        .sign,
+        algorithm
+    ) else {
+        fail("Secure Enclave key does not support signing.")
+    }
+
+    var error: Unmanaged<CFError>?
+
+    guard let signature = SecKeyCreateSignature(
+        privateKey,
+        algorithm,
+        data as CFData,
+        &error
+    ) else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Secure Enclave signing failed.")
+    }
+
+    print((signature as Data).base64EncodedString())
+}
+
+func deleteKey() {
+    let query: [String: Any] = [
+        kSecClass as String: kSecClassKey,
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom
+    ]
+
+    let status = SecItemDelete(
+        query as CFDictionary
+    )
+
+    if status != errSecSuccess &&
+       status != errSecItemNotFound {
+        fail("Unable to delete DS01 Secure Enclave key.")
+    }
+
+    print("DELETED")
+}
+
+guard CommandLine.arguments.count >= 2 else {
+    fail("Missing operation.")
+}
+
+switch CommandLine.arguments[1] {
+case "create":
+    createKey()
+
+case "public":
+    publicKey()
+
+case "sign":
+    guard CommandLine.arguments.count >= 3 else {
+        fail("Missing data to sign.")
+    }
+
+    sign(CommandLine.arguments[2])
+
+case "delete":
+    deleteKey()
+
+default:
+    fail("Unknown operation.")
+}

package/src/test-key.ts

@@ -0,0 +1,20 @@
+import {
+  createDeviceKey,
+  getDevicePublicKey,
+  signWithDeviceKey,
+} from "./utils/secureKeyStore.js";
+
+await createDeviceKey();
+
+const publicKey = await getDevicePublicKey();
+
+console.log("Public key:", publicKey);
+
+const message = new TextEncoder().encode("hello DS01");
+
+const signature = await signWithDeviceKey(message);
+
+console.log(
+  "Signature:",
+  Buffer.from(signature).toString("base64"),
+);

package/src/utils/config.ts

@@ -35,18 +35,7 @@ export function getToken(): string | null {
   return null;
 }
 
-export function getMachineId(): string | null {
-  if (fs.existsSync(credentialsPath)) {
-    try {
-      const data = fs.readFileSync(credentialsPath, "utf-8");
-      const parsed = JSON.parse(data);
-      return parsed.machineId || null;
-    } catch {
-      return null;
-    }
-  }
-  return null;
-}
+
 
 export function deleteToken() {
   if (fs.existsSync(credentialsPath)) {

package/src/utils/deviceKey.ts

@@ -0,0 +1,19 @@
+import { webcrypto } from "node:crypto";
+
+const { subtle } = webcrypto;
+
+export async function generateDeviceKeyPair() {
+  // Generate an asymmetric key pair:
+  // - publicKey  → can be shared with the server
+  // - privateKey → stays on this device
+  const keyPair = await subtle.generateKey(
+    {
+      name: "ECDSA",
+      namedCurve: "P-256",
+    },
+    false, // 🔐 Private key is NON-EXPORTABLE
+    ["sign", "verify"],
+  );
+
+  return keyPair;
+}