ds-01 1.0.3 → 1.0.5

package/src/utils/secureKeyStore.ts

@@ -0,0 +1,361 @@
+// cli/src/utils/secureKeyStore.ts
+
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const execFileAsync = promisify(execFile);
+
+const KEY_NAME = "DS01-CLI-Device-Key";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+function getMacHelperPath(): string {
+  // dist/utils/secureKeyStore.js
+  // ../native/macos-key-helper.swift
+  return path.resolve(
+    __dirname,
+    "../native/macos-key-helper.swift",
+  );
+}
+
+function ensureSupportedOS() {
+  const platform = os.platform();
+
+  if (platform !== "win32" && platform !== "darwin") {
+    throw new Error(
+      "DS01 secure device keys currently support Windows and macOS.",
+    );
+  }
+}
+
+/**
+ * ---------------------------------------------------------
+ * WINDOWS
+ * ---------------------------------------------------------
+ */
+
+async function createWindowsDeviceKey(): Promise<void> {
+  const script = `
+$ErrorActionPreference = "Stop"
+
+$existing = Get-ChildItem Cert:\\CurrentUser\\My |
+  Where-Object {
+    $_.Subject -eq "CN=${KEY_NAME}"
+  } |
+  Select-Object -First 1
+
+if ($existing) {
+  Write-Output "EXISTS"
+  exit 0
+}
+
+$params = @{
+  Type = "Custom"
+  Subject = "CN=${KEY_NAME}"
+
+  Provider = "Microsoft Platform Crypto Provider"
+
+  KeyAlgorithm = "RSA"
+  KeyLength = 2048
+
+  KeyExportPolicy = "NonExportable"
+
+  KeyUsage = "DigitalSignature"
+  KeySpec = "Signature"
+
+  CertStoreLocation = "Cert:\\CurrentUser\\My"
+
+  NotAfter = (Get-Date).AddYears(10)
+}
+
+New-SelfSignedCertificate @params | Out-Null
+
+Write-Output "CREATED"
+`;
+
+  const { stdout } = await execFileAsync(
+    "powershell.exe",
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      script,
+    ],
+    {
+      windowsHide: true,
+    },
+  );
+
+  const result = stdout.trim();
+
+  if (result !== "CREATED" && result !== "EXISTS") {
+    throw new Error("Failed to create Windows DS01 device key.");
+  }
+}
+
+async function getWindowsPublicKey(): Promise<string> {
+  const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+  Where-Object {
+    $_.Subject -eq "CN=${KEY_NAME}"
+  } |
+  Select-Object -First 1
+
+if (-not $cert) {
+  throw "DS01 device key not found."
+}
+
+[Convert]::ToBase64String($cert.RawData)
+`;
+
+  const { stdout } = await execFileAsync(
+    "powershell.exe",
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      script,
+    ],
+    {
+      windowsHide: true,
+    },
+  );
+
+  const certificate = stdout.trim();
+
+  if (!certificate) {
+    throw new Error("Unable to read Windows DS01 public certificate.");
+  }
+
+  return certificate;
+}
+
+async function signWindowsDeviceKey(
+  data: Uint8Array,
+): Promise<Uint8Array> {
+  const dataBase64 = Buffer.from(data).toString("base64");
+
+  const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+  Where-Object {
+    $_.Subject -eq "CN=${KEY_NAME}"
+  } |
+  Select-Object -First 1
+
+if (-not $cert) {
+  throw "DS01 device key not found."
+}
+
+if (-not $cert.HasPrivateKey) {
+  throw "DS01 device certificate has no private key."
+}
+
+$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
+
+if (-not $rsa) {
+  throw "Unable to access DS01 private signing key."
+}
+
+try {
+  $data = [Convert]::FromBase64String("${dataBase64}")
+
+  $signature = $rsa.SignData(
+    $data,
+    [System.Security.Cryptography.HashAlgorithmName]::SHA256,
+    [System.Security.Cryptography.RSASignaturePadding]::Pkcs1
+  )
+
+  [Convert]::ToBase64String($signature)
+}
+finally {
+  $rsa.Dispose()
+}
+`;
+
+  const { stdout } = await execFileAsync(
+    "powershell.exe",
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      script,
+    ],
+    {
+      windowsHide: true,
+    },
+  );
+
+  const signature = stdout.trim();
+
+  if (!signature) {
+    throw new Error("Failed to sign data with Windows device key.");
+  }
+
+  return new Uint8Array(Buffer.from(signature, "base64"));
+}
+
+async function deleteWindowsDeviceKey(): Promise<void> {
+  const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+  Where-Object {
+    $_.Subject -eq "CN=${KEY_NAME}"
+  } |
+  Select-Object -First 1
+
+if ($cert) {
+  Remove-Item $cert.PSPath
+}
+`;
+
+  await execFileAsync(
+    "powershell.exe",
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      script,
+    ],
+    {
+      windowsHide: true,
+    },
+  );
+}
+
+/**
+ * ---------------------------------------------------------
+ * MACOS
+ * ---------------------------------------------------------
+ */
+
+async function runMacHelper(
+  operation: "create" | "public" | "sign" | "delete",
+  data?: Uint8Array,
+): Promise<string> {
+  const helper = getMacHelperPath();
+
+  const args = [helper, operation];
+
+  if (data) {
+    args.push(Buffer.from(data).toString("base64"));
+  }
+
+  const { stdout } = await execFileAsync(
+    "swift",
+    args,
+    {
+      windowsHide: true,
+    },
+  );
+
+  return stdout.trim();
+}
+
+async function createMacDeviceKey(): Promise<void> {
+  const result = await runMacHelper("create");
+
+  if (result !== "CREATED" && result !== "EXISTS") {
+    throw new Error(
+      result || "Failed to create macOS Secure Enclave device key.",
+    );
+  }
+}
+
+async function getMacPublicKey(): Promise<string> {
+  const result = await runMacHelper("public");
+
+  if (!result) {
+    throw new Error(
+      "Unable to read macOS DS01 public key.",
+    );
+  }
+
+  return result;
+}
+
+async function signMacDeviceKey(
+  data: Uint8Array,
+): Promise<Uint8Array> {
+  const result = await runMacHelper("sign", data);
+
+  if (!result) {
+    throw new Error(
+      "Failed to sign data with macOS Secure Enclave key.",
+    );
+  }
+
+  return new Uint8Array(
+    Buffer.from(result, "base64"),
+  );
+}
+
+async function deleteMacDeviceKey(): Promise<void> {
+  await runMacHelper("delete");
+}
+
+/**
+ * ---------------------------------------------------------
+ * PUBLIC API
+ * ---------------------------------------------------------
+ */
+
+export async function createDeviceKey(): Promise<void> {
+  ensureSupportedOS();
+
+  if (os.platform() === "win32") {
+    await createWindowsDeviceKey();
+    return;
+  }
+
+  await createMacDeviceKey();
+}
+
+export async function getDevicePublicKey(): Promise<string> {
+  ensureSupportedOS();
+
+  if (os.platform() === "win32") {
+    return getWindowsPublicKey();
+  }
+
+  return getMacPublicKey();
+}
+
+export async function signWithDeviceKey(
+  data: Uint8Array,
+): Promise<Uint8Array> {
+  ensureSupportedOS();
+
+  if (os.platform() === "win32") {
+    return signWindowsDeviceKey(data);
+  }
+
+  return signMacDeviceKey(data);
+}
+
+export async function deleteDeviceKey(): Promise<void> {
+  ensureSupportedOS();
+
+  if (os.platform() === "win32") {
+    await deleteWindowsDeviceKey();
+    return;
+  }
+
+  await deleteMacDeviceKey();
+}