ds-01 1.0.8 → 1.0.10

package/dist/utils/secureKeyStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secureKeyStore.d.ts","sourceRoot":"","sources":["../../src/utils/secureKeyStore.ts"],"names":[],"mappings":"AAwTA;;;;GAIG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD"}
+{"version":3,"file":"secureKeyStore.d.ts","sourceRoot":"","sources":["../../src/utils/secureKeyStore.ts"],"names":[],"mappings":"AA2WA;;;;GAIG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD"}

package/dist/utils/secureKeyStore.js

@@ -9,8 +9,6 @@ const KEY_NAME = "DS01-CLI-Device-Key";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 function getMacHelperPath() {
-    // dist/utils/secureKeyStore.js
-    // ../native/macos-key-helper.swift
     return path.resolve(__dirname, "../native/macos-key-helper.swift");
 }
 function ensureSupportedOS() {
@@ -28,13 +26,18 @@ async function createWindowsDeviceKey() {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$existing = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+  })
 
-if ($existing) {
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found. Remove old DS01 device certificates before continuing."
+}
+
+if ($certificates.Count -eq 1) {
   Write-Output "EXISTS"
   exit 0
 }
@@ -58,7 +61,11 @@ $params = @{
   NotAfter = (Get-Date).AddYears(10)
 }
 
-New-SelfSignedCertificate @params | Out-Null
+$certificate = New-SelfSignedCertificate @params
+
+if (-not $certificate) {
+  throw "Windows failed to create the DS01 device certificate."
+}
 
 Write-Output "CREATED"
 `;
@@ -77,20 +84,41 @@ Write-Output "CREATED"
         throw new Error("Failed to create Windows DS01 device key.");
     }
 }
-async function getWindowsPublicKey() {
-    const script = `
-$ErrorActionPreference = "Stop"
-
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+/**
+ * Find exactly one valid DS01 certificate.
+ *
+ * We intentionally do not use Select-Object -First 1.
+ *
+ * 0 certificates  -> error
+ * 1 certificate   -> use it
+ * 2+ certificates -> error
+ */
+function getWindowsCertificateLookup() {
+    return `
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+  })
 
-if (-not $cert) {
+if ($certificates.Count -eq 0) {
   throw "DS01 device key not found."
 }
 
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
+}
+
+$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]$certificates[0]
+`;
+}
+async function getWindowsPublicKey() {
+    const script = `
+$ErrorActionPreference = "Stop"
+
+${getWindowsCertificateLookup()}
+
 [Convert]::ToBase64String($cert.RawData)
 `;
     const { stdout } = await execFileAsync("powershell.exe", [
@@ -114,21 +142,14 @@ async function signWindowsDeviceKey(data) {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
-  Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
-
-if (-not $cert) {
-  throw "DS01 device key not found."
-}
+${getWindowsCertificateLookup()}
 
 if (-not $cert.HasPrivateKey) {
   throw "DS01 device certificate has no private key."
 }
 
-$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
+$rsa =
+  [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
 
 if (-not $rsa) {
   throw "Unable to access DS01 private signing key."
@@ -169,15 +190,22 @@ async function deleteWindowsDeviceKey() {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+  })
+
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
+}
 
-if ($cert) {
-  Remove-Item $cert.PSPath
+if ($certificates.Count -eq 1) {
+  Remove-Item $certificates[0].PSPath
 }
+
+Write-Output "DELETED"
 `;
     await execFileAsync("powershell.exe", [
         "-NoProfile",
@@ -208,8 +236,10 @@ async function runMacHelper(operation, data) {
 }
 async function createMacDeviceKey() {
     const result = await runMacHelper("create");
-    if (result !== "CREATED" && result !== "EXISTS") {
-        throw new Error(result || "Failed to create macOS Secure Enclave device key.");
+    if (result !== "CREATED" &&
+        result !== "EXISTS") {
+        throw new Error(result ||
+            "Failed to create macOS Secure Enclave device key.");
     }
 }
 async function getMacPublicKey() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ds-01",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {

package/src/utils/secureKeyStore.ts

@@ -14,15 +14,13 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 function getMacHelperPath(): string {
-  // dist/utils/secureKeyStore.js
-  // ../native/macos-key-helper.swift
   return path.resolve(
     __dirname,
     "../native/macos-key-helper.swift",
   );
 }
 
-function ensureSupportedOS() {
+function ensureSupportedOS(): void {
   const platform = os.platform();
 
   if (platform !== "win32" && platform !== "darwin") {
@@ -42,13 +40,18 @@ async function createWindowsDeviceKey(): Promise<void> {
   const script = `
 $ErrorActionPreference = "Stop"
 
-$existing = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+  })
 
-if ($existing) {
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found. Remove old DS01 device certificates before continuing."
+}
+
+if ($certificates.Count -eq 1) {
   Write-Output "EXISTS"
   exit 0
 }
@@ -72,7 +75,11 @@ $params = @{
   NotAfter = (Get-Date).AddYears(10)
 }
 
-New-SelfSignedCertificate @params | Out-Null
+$certificate = New-SelfSignedCertificate @params
+
+if (-not $certificate) {
+  throw "Windows failed to create the DS01 device certificate."
+}
 
 Write-Output "CREATED"
 `;
@@ -95,24 +102,48 @@ Write-Output "CREATED"
   const result = stdout.trim();
 
   if (result !== "CREATED" && result !== "EXISTS") {
-    throw new Error("Failed to create Windows DS01 device key.");
+    throw new Error(
+      "Failed to create Windows DS01 device key.",
+    );
   }
 }
 
-async function getWindowsPublicKey(): Promise<string> {
-  const script = `
-$ErrorActionPreference = "Stop"
-
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+/**
+ * Find exactly one valid DS01 certificate.
+ *
+ * We intentionally do not use Select-Object -First 1.
+ *
+ * 0 certificates  -> error
+ * 1 certificate   -> use it
+ * 2+ certificates -> error
+ */
+function getWindowsCertificateLookup(): string {
+  return `
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+  })
 
-if (-not $cert) {
+if ($certificates.Count -eq 0) {
   throw "DS01 device key not found."
 }
 
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
+}
+
+$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]$certificates[0]
+`;
+}
+
+async function getWindowsPublicKey(): Promise<string> {
+  const script = `
+$ErrorActionPreference = "Stop"
+
+${getWindowsCertificateLookup()}
+
 [Convert]::ToBase64String($cert.RawData)
 `;
 
@@ -134,7 +165,9 @@ if (-not $cert) {
   const certificate = stdout.trim();
 
   if (!certificate) {
-    throw new Error("Unable to read Windows DS01 public certificate.");
+    throw new Error(
+      "Unable to read Windows DS01 public certificate.",
+    );
   }
 
   return certificate;
@@ -143,26 +176,20 @@ if (-not $cert) {
 async function signWindowsDeviceKey(
   data: Uint8Array,
 ): Promise<Uint8Array> {
-  const dataBase64 = Buffer.from(data).toString("base64");
+  const dataBase64 =
+    Buffer.from(data).toString("base64");
 
   const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
-  Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
-
-if (-not $cert) {
-  throw "DS01 device key not found."
-}
+${getWindowsCertificateLookup()}
 
 if (-not $cert.HasPrivateKey) {
   throw "DS01 device certificate has no private key."
 }
 
-$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
+$rsa =
+  [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
 
 if (-not $rsa) {
   throw "Unable to access DS01 private signing key."
@@ -202,25 +229,36 @@ finally {
   const signature = stdout.trim();
 
   if (!signature) {
-    throw new Error("Failed to sign data with Windows device key.");
+    throw new Error(
+      "Failed to sign data with Windows device key.",
+    );
   }
 
-  return new Uint8Array(Buffer.from(signature, "base64"));
+  return new Uint8Array(
+    Buffer.from(signature, "base64"),
+  );
 }
 
 async function deleteWindowsDeviceKey(): Promise<void> {
   const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    $_.Subject -eq "CN=${KEY_NAME}" -and
+    $_.HasPrivateKey -and
+    $_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+  })
 
-if ($cert) {
-  Remove-Item $cert.PSPath
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
 }
+
+if ($certificates.Count -eq 1) {
+  Remove-Item $certificates[0].PSPath
+}
+
+Write-Output "DELETED"
 `;
 
   await execFileAsync(
@@ -246,7 +284,11 @@ if ($cert) {
  */
 
 async function runMacHelper(
-  operation: "create" | "public" | "sign" | "delete",
+  operation:
+    | "create"
+    | "public"
+    | "sign"
+    | "delete",
   data?: Uint8Array,
 ): Promise<string> {
   const helper = getMacHelperPath();
@@ -254,7 +296,9 @@ async function runMacHelper(
   const args = [helper, operation];
 
   if (data) {
-    args.push(Buffer.from(data).toString("base64"));
+    args.push(
+      Buffer.from(data).toString("base64"),
+    );
   }
 
   const { stdout } = await execFileAsync(
@@ -269,17 +313,23 @@ async function runMacHelper(
 }
 
 async function createMacDeviceKey(): Promise<void> {
-  const result = await runMacHelper("create");
+  const result =
+    await runMacHelper("create");
 
-  if (result !== "CREATED" && result !== "EXISTS") {
+  if (
+    result !== "CREATED" &&
+    result !== "EXISTS"
+  ) {
     throw new Error(
-      result || "Failed to create macOS Secure Enclave device key.",
+      result ||
+        "Failed to create macOS Secure Enclave device key.",
     );
   }
 }
 
 async function getMacPublicKey(): Promise<string> {
-  const result = await runMacHelper("public");
+  const result =
+    await runMacHelper("public");
 
   if (!result) {
     throw new Error(
@@ -293,7 +343,8 @@ async function getMacPublicKey(): Promise<string> {
 async function signMacDeviceKey(
   data: Uint8Array,
 ): Promise<Uint8Array> {
-  const result = await runMacHelper("sign", data);
+  const result =
+    await runMacHelper("sign", data);
 
   if (!result) {
     throw new Error(