ds-01 1.0.4 → 1.0.6

package/src/commands/login.ts

@@ -1,103 +1,336 @@
 import { Command } from "commander";
-import { intro, outro, spinner, note, cancel } from "@clack/prompts";
+import {
+  intro,
+  outro,
+  spinner,
+  note,
+  cancel,
+} from "@clack/prompts";
 import pc from "picocolors";
 import open from "open";
 import machineIdPkg from "node-machine-id";
+
 import { saveToken } from "../utils/config.js";
+import {
+  createDeviceKey,
+  getDevicePublicKey,
+} from "../utils/secureKeyStore.js";
+
+const API_BASE_URL =
+  process.env.DS01_API_URL ||
+  "https://ds-01.vercel.app";
 
-const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
 const { machineIdSync } = machineIdPkg;
 
 export const login = new Command()
   .name("login")
-  .description("Authenticate your terminal with DS01 via browser")
+  .description(
+    "Authenticate your terminal with DS01 via browser",
+  )
   .action(async () => {
-    console.log(); // Spacing for breathing room
+    console.log();
 
-    // 1. Header banner
     intro(
-      `${pc.bgWhite(pc.black(pc.bold(" DS01 ")))} ${pc.gray("v1.0.0 — Terminal Authentication")}`
+      `${pc.bgWhite(
+        pc.black(
+          pc.bold(" DS01 "),
+        ),
+      )} ${pc.gray(
+        "v1.0.0 — Terminal Authentication",
+      )}`,
     );
 
     const s = spinner();
 
     try {
-      // 2. Hardware ID Generation & Device Code Request
-      s.start("Generating hardware fingerprint & requesting pairing code...");
-      const hardwareId = machineIdSync();
+      // --------------------------------------------------
+      // 1. Create / load the device's secure key
+      // --------------------------------------------------
+
+      s.start(
+        "Preparing secure device identity...",
+      );
+
+      await createDeviceKey();
+
+      // Only the PUBLIC key/certificate leaves
+      // the user's machine.
+      const publicKey =
+        await getDevicePublicKey();
+
+      // Existing machine fingerprint.
+      const hardwareId =
+        machineIdSync();
+
+      // Detect the cryptographic key type.
+      const publicKeyType =
+        process.platform === "win32"
+          ? "windows-rsa"
+          : "macos-ec";
+
+      // --------------------------------------------------
+      // 2. Start device authorization
+      // --------------------------------------------------
+
+      s.start(
+        "Requesting pairing code...",
+      );
+
+      const initResponse =
+        await fetch(
+          `${API_BASE_URL}/api/auth/device/code`,
+          {
+            method: "POST",
+
+            headers: {
+              "Content-Type":
+                "application/json",
+            },
+
+            body: JSON.stringify({
+              machineId:
+                hardwareId,
 
-      const initResponse = await fetch(`${API_BASE_URL}/api/auth/device/code`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ machineId: hardwareId }),
-      });
+              publicKey,
+
+              publicKeyType,
+            }),
+          },
+        );
 
       if (!initResponse.ok) {
-        s.stop(pc.red("Failed to reach DS01 authorization server."));
-        cancel(`Server responded with HTTP ${initResponse.status}`);
+        s.stop(
+          pc.red(
+            "Failed to reach DS01 authorization server.",
+          ),
+        );
+
+        cancel(
+          `Server responded with HTTP ${initResponse.status}`,
+        );
+
         process.exit(1);
       }
 
-      const { deviceCode, userCode, verificationUrl, interval } =
-        await initResponse.json();
+      const {
+        deviceCode,
+        userCode,
+        verificationUrl,
+        interval,
+      } = await initResponse.json();
 
-      s.stop(pc.green("Device authorization code generated."));
+      if (
+        !deviceCode ||
+        !userCode ||
+        !verificationUrl
+      ) {
+        throw new Error(
+          "Authorization server returned an invalid device response.",
+        );
+      }
+
+      s.stop(
+        pc.green(
+          "Secure device identity registered.",
+        ),
+      );
+
+      // --------------------------------------------------
+      // 3. Ask user to approve in browser
+      // --------------------------------------------------
 
-      // 3. Highlighted Box for User Action
       note(
-        `${pc.bold("Pairing Code:")}    ${pc.cyan(pc.bold(` ${userCode} `))}\n` +
-          `${pc.bold("Verification URL:")} ${pc.underline(verificationUrl)}`,
-        "Action Required"
+        `${pc.bold(
+          "Pairing Code:",
+        )}    ${pc.cyan(
+          pc.bold(
+            ` ${userCode} `,
+          ),
+        )}\n` +
+          `${pc.bold(
+            "Verification URL:",
+          )} ${pc.underline(
+            verificationUrl,
+          )}`,
+        "Action Required",
       );
 
-      // 4. Auto-launch Browser
       try {
-        await open(verificationUrl);
+        await open(
+          verificationUrl,
+        );
       } catch {
-        // Non-blocking fallback if browser launch fails on headless setups
+        // Browser launch failure
+        // is non-fatal.
       }
 
-      // 5. Polling Loop
-      s.start("Waiting for web authorization...");
+      // --------------------------------------------------
+      // 4. Poll for authorization
+      // --------------------------------------------------
 
-      let token: string | null = null;
-      const pollInterval = (interval || 5) * 1000;
+      s.start(
+        "Waiting for web authorization...",
+      );
 
-      while (!token) {
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      const pollInterval =
+        (interval || 5) * 1000;
 
-        const tokenResponse = await fetch(
-          `${API_BASE_URL}/api/auth/device/token`,
-          {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ deviceCode, machineId: hardwareId }),
-          }
+      let token: string | null =
+        null;
+
+      while (true) {
+        await new Promise(
+          (resolve) =>
+            setTimeout(
+              resolve,
+              pollInterval,
+            ),
         );
 
-        const tokenData = await tokenResponse.json();
+        const tokenResponse =
+          await fetch(
+            `${API_BASE_URL}/api/auth/device/token`,
+            {
+              method: "POST",
+
+              headers: {
+                "Content-Type":
+                  "application/json",
+              },
+
+              body: JSON.stringify({
+                deviceCode,
+                machineId:
+                  hardwareId,
+              }),
+            },
+          );
+
+        let tokenData: any;
+
+        try {
+          tokenData =
+            await tokenResponse.json();
+        } catch {
+          s.stop(
+            pc.red(
+              "Authorization server returned invalid JSON.",
+            ),
+          );
+
+          cancel(
+            "Unable to read authorization response.",
+          );
 
-        if (tokenResponse.ok && tokenData.accessToken) {
-          token = tokenData.accessToken;
-        } else if (tokenData.error !== "authorization_pending") {
-          s.stop(pc.red("Authorization failed or expired."));
-          cancel(`Reason: ${tokenData.error || "Unknown authorization error"}`);
           process.exit(1);
         }
+
+        // --------------------------------------------------
+        // SUCCESS
+        // --------------------------------------------------
+
+        if (
+          tokenResponse.ok &&
+          typeof tokenData.accessToken ===
+            "string" &&
+          tokenData.accessToken.length > 0
+        ) {
+          token =
+            tokenData.accessToken;
+
+          // IMPORTANT:
+          // Stop the spinner immediately.
+          s.stop(
+            pc.green(
+              "Hardware signature linked & token verified!",
+            ),
+          );
+
+          // IMPORTANT:
+          // Leave the polling loop immediately.
+          break;
+        }
+
+        // --------------------------------------------------
+        // STILL WAITING
+        // --------------------------------------------------
+
+        if (
+          tokenData.error ===
+          "authorization_pending"
+        ) {
+          continue;
+        }
+
+        // --------------------------------------------------
+        // FAILED / EXPIRED
+        // --------------------------------------------------
+
+        s.stop(
+          pc.red(
+            "Authorization failed or expired.",
+          ),
+        );
+
+        cancel(
+          `Reason: ${
+            tokenData.error ||
+            "Unknown authorization error"
+          }`,
+        );
+
+        process.exit(1);
       }
 
-      // 6. Save token to local wallet
-      saveToken(token, hardwareId);
+      // --------------------------------------------------
+      // 5. Make absolutely sure token exists
+      // --------------------------------------------------
+
+      if (!token) {
+        throw new Error(
+          "Authorization completed without receiving an access token.",
+        );
+      }
 
-      s.stop(pc.green("Hardware signature linked & token verified!"));
+      // --------------------------------------------------
+      // 6. Save CLI token + machine ID
+      // --------------------------------------------------
+
+      saveToken(
+        token,
+        hardwareId,
+      );
+
+      // --------------------------------------------------
+      // 7. Success
+      // --------------------------------------------------
 
-      // 7. Clean Success Outro
       outro(
-        `${pc.white("✔")} ${pc.bold("Terminal synced successfully")} ${pc.gray("Session token saved locally.")}`
+        `${pc.white(
+          "✔",
+        )} ${pc.bold(
+          "Terminal synced successfully",
+        )}\n` +
+          pc.gray(
+            "Secure device key and session token are ready.",
+          ),
       );
     } catch (error: any) {
-      s.stop(pc.red("An error occurred during login."));
-      cancel(pc.gray(error.message || "Unknown CLI Error"));
+      // Only stop the spinner if it is
+      // still running.
+      s.stop(
+        pc.red(
+          "An error occurred during login.",
+        ),
+      );
+
+      cancel(
+        pc.gray(
+          error?.message ||
+            "Unknown CLI Error",
+        ),
+      );
+
       process.exit(1);
     }
   });

package/src/commands/logout.ts

@@ -2,28 +2,57 @@ import { Command } from "commander";
 import chalk from "chalk";
 import ora from "ora";
 import { deleteToken, getToken } from "../utils/config.js";
+import machineIdPkg from "node-machine-id";
+const { machineIdSync } = machineIdPkg;
+const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
 
 export const logout = new Command()
   .name("logout")
-  .description("Log out of your DS01 account and clear local credentials")
+  .description("Log out of your DS01 account and revoke the CLI session")
   .action(async () => {
     const token = getToken();
+    const machineId = machineIdSync();
 
-    if (!token) {
+    if (!token || !machineId) {
       console.log(chalk.yellow("You are already logged out."));
       return;
     }
 
-    const spinner = ora("Logging out...").start();
+    const spinner = ora("Revoking CLI session...").start();
 
     try {
-      // Throw away the digital wallet / token
+      const response = await fetch(`${API_BASE_URL}/api/auth/cli/logout`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "X-Machine-ID": machineId,
+        },
+      });
+
+      // NEW: Do not silently delete local credentials if the server
+      // failed to revoke the session.
+      if (!response.ok) {
+        const data = await response.json().catch(() => null);
+
+        throw new Error(
+          data?.error || `Logout failed (HTTP ${response.status})`,
+        );
+      }
+
+      // NEW: Delete local credentials only after the server confirms
+      // that the CLI session has been revoked.
+      console.log("✅ Server confirmed CLI session was revoked.");
       deleteToken();
-      
+      console.log("✅ Local credentials deleted.");
       spinner.succeed(chalk.green("Successfully logged out."));
-      console.log(chalk.gray("Your local credentials have been cleared."));
-    } catch (error) {
-      spinner.fail(chalk.red("Failed to log out cleanly."));
-      console.error(error);
+      console.log(
+        chalk.gray(
+          "Your CLI session has been revoked and local credentials have been cleared.",
+        ),
+      );
+    } catch (error: any) {
+      spinner.fail(chalk.red("Failed to log out."));
+
+      console.error(chalk.red(error.message || "Unknown logout error."));
     }
-  });
+  });

package/src/index.ts

@@ -22,4 +22,6 @@ program.addCommand(init);
 program.addCommand(add); // <-- 2. Register the add command!
 
 // Parse the arguments from the terminal
+// It is the point where Commander reads the user's terminal input and decides 
+// which registered command's .action() function should execute.
 program.parse(process.argv);

package/src/native/macos-key-helper.swift

@@ -0,0 +1,206 @@
+import Foundation
+import Security
+
+let keyTag = "com.ds01.cli.device-key"
+
+func fail(_ message: String) -> Never {
+    fputs(message + "\n", stderr)
+    exit(1)
+}
+
+func getAccessControl() -> SecAccessControl {
+    var error: Unmanaged<CFError>?
+
+    guard let access = SecAccessControlCreateWithFlags(
+        nil,
+        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+        .privateKeyUsage,
+        &error
+    ) else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Unable to create Secure Enclave access control.")
+    }
+
+    return access
+}
+
+func findPrivateKey() -> SecKey? {
+    let query: [String: Any] = [
+        kSecClass as String: kSecClassKey,
+        kSecAttrApplicationTag as String: keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+        kSecReturnRef as String: true
+    ]
+
+    var result: CFTypeRef?
+
+    let status = SecItemCopyMatching(
+        query as CFDictionary,
+        &result
+    )
+
+    guard status == errSecSuccess else {
+        return nil
+    }
+
+    return (result as! SecKey)
+}
+
+func createKey() {
+    if findPrivateKey() != nil {
+        print("EXISTS")
+        return
+    }
+
+    let access = getAccessControl()
+
+    let attributes: [String: Any] = [
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom,
+
+        kSecAttrKeySizeInBits as String:
+            256,
+
+        kSecAttrTokenID as String:
+            kSecAttrTokenIDSecureEnclave,
+
+        kSecPrivateKeyAttrs as String: [
+            kSecAttrIsPermanent as String:
+                true,
+
+            kSecAttrApplicationTag as String:
+                keyTag.data(using: .utf8)!,
+
+            kSecAttrAccessControl as String:
+                access
+        ]
+    ]
+
+    var error: Unmanaged<CFError>?
+
+    guard SecKeyCreateRandomKey(
+        attributes as CFDictionary,
+        &error
+    ) != nil else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Unable to create Secure Enclave key.")
+    }
+
+    print("CREATED")
+}
+
+func publicKey() {
+    guard let privateKey = findPrivateKey() else {
+        fail("DS01 Secure Enclave key not found.")
+    }
+
+    guard let publicKey = SecKeyCopyPublicKey(privateKey) else {
+        fail("Unable to obtain public key.")
+    }
+
+    var error: Unmanaged<CFError>?
+
+    guard let data = SecKeyCopyExternalRepresentation(
+        publicKey,
+        &error
+    ) else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Unable to export public key.")
+    }
+
+    let base64 = (data as Data).base64EncodedString()
+
+    print(base64)
+}
+
+func sign(_ base64Data: String) {
+    guard let privateKey = findPrivateKey() else {
+        fail("DS01 Secure Enclave key not found.")
+    }
+
+    guard let data = Data(base64Encoded: base64Data) else {
+        fail("Invalid input data.")
+    }
+
+    let algorithm = SecKeyAlgorithm.ecdsaSignatureMessageX962SHA256
+
+    guard SecKeyIsAlgorithmSupported(
+        privateKey,
+        .sign,
+        algorithm
+    ) else {
+        fail("Secure Enclave key does not support signing.")
+    }
+
+    var error: Unmanaged<CFError>?
+
+    guard let signature = SecKeyCreateSignature(
+        privateKey,
+        algorithm,
+        data as CFData,
+        &error
+    ) else {
+        if let error {
+            fail(error.takeRetainedValue().localizedDescription)
+        }
+
+        fail("Secure Enclave signing failed.")
+    }
+
+    print((signature as Data).base64EncodedString())
+}
+
+func deleteKey() {
+    let query: [String: Any] = [
+        kSecClass as String: kSecClassKey,
+        kSecAttrApplicationTag as String:
+            keyTag.data(using: .utf8)!,
+        kSecAttrKeyType as String:
+            kSecAttrKeyTypeECSECPrimeRandom
+    ]
+
+    let status = SecItemDelete(
+        query as CFDictionary
+    )
+
+    if status != errSecSuccess &&
+       status != errSecItemNotFound {
+        fail("Unable to delete DS01 Secure Enclave key.")
+    }
+
+    print("DELETED")
+}
+
+guard CommandLine.arguments.count >= 2 else {
+    fail("Missing operation.")
+}
+
+switch CommandLine.arguments[1] {
+case "create":
+    createKey()
+
+case "public":
+    publicKey()
+
+case "sign":
+    guard CommandLine.arguments.count >= 3 else {
+        fail("Missing data to sign.")
+    }
+
+    sign(CommandLine.arguments[2])
+
+case "delete":
+    deleteKey()
+
+default:
+    fail("Unknown operation.")
+}

package/src/test-key.ts

@@ -0,0 +1,20 @@
+import {
+  createDeviceKey,
+  getDevicePublicKey,
+  signWithDeviceKey,
+} from "./utils/secureKeyStore.js";
+
+await createDeviceKey();
+
+const publicKey = await getDevicePublicKey();
+
+console.log("Public key:", publicKey);
+
+const message = new TextEncoder().encode("hello DS01");
+
+const signature = await signWithDeviceKey(message);
+
+console.log(
+  "Signature:",
+  Buffer.from(signature).toString("base64"),
+);