ds-01 1.0.8 → 1.0.9

package/dist/utils/secureKeyStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secureKeyStore.d.ts","sourceRoot":"","sources":["../../src/utils/secureKeyStore.ts"],"names":[],"mappings":"AAwTA;;;;GAIG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD"}
+{"version":3,"file":"secureKeyStore.d.ts","sourceRoot":"","sources":["../../src/utils/secureKeyStore.ts"],"names":[],"mappings":"AAmZA;;;;GAIG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD"}

package/dist/utils/secureKeyStore.js

@@ -23,24 +23,66 @@ function ensureSupportedOS() {
  * ---------------------------------------------------------
  * WINDOWS
  * ---------------------------------------------------------
+ *
+ * Windows uses:
+ *
+ * Microsoft Platform Crypto Provider
+ * RSA 2048
+ * NonExportable private key
+ *
+ * The private key never enters Node.js.
+ *
+ * Node -> PowerShell -> Windows crypto provider
+ *                         ↓
+ *                    private key
+ *                         ↓
+ *                    signature
+ *                         ↓
+ *                      Node
+ *
+ * IMPORTANT:
+ *
+ * We identify the certificate using its properties rather
+ * than blindly taking the first certificate with the same
+ * subject.
  */
+/**
+ * PowerShell expression used to identify a valid DS01
+ * certificate.
+ *
+ * Requirements:
+ *
+ * - Correct subject
+ * - Has private key
+ * - RSA certificate
+ * - Platform Crypto Provider
+ */
+const WINDOWS_CERT_FILTER = `
+$_.Subject -eq "CN=${KEY_NAME}" -and
+$_.HasPrivateKey -and
+$_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+`;
 async function createWindowsDeviceKey() {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$existing = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
+
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found. Remove old DS01 device certificates before continuing."
+}
 
-if ($existing) {
+if ($certificates.Count -eq 1) {
   Write-Output "EXISTS"
   exit 0
 }
 
 $params = @{
   Type = "Custom"
+
   Subject = "CN=${KEY_NAME}"
 
   Provider = "Microsoft Platform Crypto Provider"
@@ -48,6 +90,7 @@ $params = @{
   KeyAlgorithm = "RSA"
   KeyLength = 2048
 
+  # Private key cannot be exported.
   KeyExportPolicy = "NonExportable"
 
   KeyUsage = "DigitalSignature"
@@ -58,7 +101,11 @@ $params = @{
   NotAfter = (Get-Date).AddYears(10)
 }
 
-New-SelfSignedCertificate @params | Out-Null
+$certificate = New-SelfSignedCertificate @params
+
+if (-not $certificate) {
+  throw "Windows failed to create the DS01 device certificate."
+}
 
 Write-Output "CREATED"
 `;
@@ -77,20 +124,42 @@ Write-Output "CREATED"
         throw new Error("Failed to create Windows DS01 device key.");
     }
 }
-async function getWindowsPublicKey() {
-    const script = `
-$ErrorActionPreference = "Stop"
-
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+/**
+ * Find the exact DS01 certificate.
+ *
+ * We deliberately DO NOT use Select-Object -First 1.
+ *
+ * If multiple matching certificates exist, we fail instead
+ * of potentially using the wrong private key.
+ */
+function windowsCertificateLookupScript() {
+    return `
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
 
-if (-not $cert) {
+if ($certificates.Count -eq 0) {
   throw "DS01 device key not found."
 }
 
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
+}
+
+$certificates[0]
+`;
+}
+async function getWindowsPublicKey() {
+    const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = ${windowsCertificateLookupScript()}
+
+# Return the complete public certificate.
+#
+# The certificate contains the public key and certificate
+# metadata, but never the private key.
 [Convert]::ToBase64String($cert.RawData)
 `;
     const { stdout } = await execFileAsync("powershell.exe", [
@@ -114,21 +183,14 @@ async function signWindowsDeviceKey(data) {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
-  Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
-
-if (-not $cert) {
-  throw "DS01 device key not found."
-}
+$cert = ${windowsCertificateLookupScript()}
 
 if (-not $cert.HasPrivateKey) {
   throw "DS01 device certificate has no private key."
 }
 
-$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
+$rsa =
+  [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
 
 if (-not $rsa) {
   throw "Unable to access DS01 private signing key."
@@ -169,15 +231,20 @@ async function deleteWindowsDeviceKey() {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
 
-if ($cert) {
-  Remove-Item $cert.PSPath
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
 }
+
+if ($certificates.Count -eq 1) {
+  Remove-Item $certificates[0].PSPath
+}
+
+Write-Output "DELETED"
 `;
     await execFileAsync("powershell.exe", [
         "-NoProfile",
@@ -208,8 +275,10 @@ async function runMacHelper(operation, data) {
 }
 async function createMacDeviceKey() {
     const result = await runMacHelper("create");
-    if (result !== "CREATED" && result !== "EXISTS") {
-        throw new Error(result || "Failed to create macOS Secure Enclave device key.");
+    if (result !== "CREATED" &&
+        result !== "EXISTS") {
+        throw new Error(result ||
+            "Failed to create macOS Secure Enclave device key.");
     }
 }
 async function getMacPublicKey() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ds-01",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {

package/src/utils/secureKeyStore.ts

@@ -22,7 +22,7 @@ function getMacHelperPath(): string {
   );
 }
 
-function ensureSupportedOS() {
+function ensureSupportedOS(): void {
   const platform = os.platform();
 
   if (platform !== "win32" && platform !== "darwin") {
@@ -36,25 +36,68 @@ function ensureSupportedOS() {
  * ---------------------------------------------------------
  * WINDOWS
  * ---------------------------------------------------------
+ *
+ * Windows uses:
+ *
+ * Microsoft Platform Crypto Provider
+ * RSA 2048
+ * NonExportable private key
+ *
+ * The private key never enters Node.js.
+ *
+ * Node -> PowerShell -> Windows crypto provider
+ *                         ↓
+ *                    private key
+ *                         ↓
+ *                    signature
+ *                         ↓
+ *                      Node
+ *
+ * IMPORTANT:
+ *
+ * We identify the certificate using its properties rather
+ * than blindly taking the first certificate with the same
+ * subject.
  */
 
+/**
+ * PowerShell expression used to identify a valid DS01
+ * certificate.
+ *
+ * Requirements:
+ *
+ * - Correct subject
+ * - Has private key
+ * - RSA certificate
+ * - Platform Crypto Provider
+ */
+const WINDOWS_CERT_FILTER = `
+$_.Subject -eq "CN=${KEY_NAME}" -and
+$_.HasPrivateKey -and
+$_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+`;
+
 async function createWindowsDeviceKey(): Promise<void> {
   const script = `
 $ErrorActionPreference = "Stop"
 
-$existing = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
+
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found. Remove old DS01 device certificates before continuing."
+}
 
-if ($existing) {
+if ($certificates.Count -eq 1) {
   Write-Output "EXISTS"
   exit 0
 }
 
 $params = @{
   Type = "Custom"
+
   Subject = "CN=${KEY_NAME}"
 
   Provider = "Microsoft Platform Crypto Provider"
@@ -62,6 +105,7 @@ $params = @{
   KeyAlgorithm = "RSA"
   KeyLength = 2048
 
+  # Private key cannot be exported.
   KeyExportPolicy = "NonExportable"
 
   KeyUsage = "DigitalSignature"
@@ -72,7 +116,11 @@ $params = @{
   NotAfter = (Get-Date).AddYears(10)
 }
 
-New-SelfSignedCertificate @params | Out-Null
+$certificate = New-SelfSignedCertificate @params
+
+if (-not $certificate) {
+  throw "Windows failed to create the DS01 device certificate."
+}
 
 Write-Output "CREATED"
 `;
@@ -95,24 +143,49 @@ Write-Output "CREATED"
   const result = stdout.trim();
 
   if (result !== "CREATED" && result !== "EXISTS") {
-    throw new Error("Failed to create Windows DS01 device key.");
+    throw new Error(
+      "Failed to create Windows DS01 device key.",
+    );
   }
 }
 
-async function getWindowsPublicKey(): Promise<string> {
-  const script = `
-$ErrorActionPreference = "Stop"
-
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+/**
+ * Find the exact DS01 certificate.
+ *
+ * We deliberately DO NOT use Select-Object -First 1.
+ *
+ * If multiple matching certificates exist, we fail instead
+ * of potentially using the wrong private key.
+ */
+function windowsCertificateLookupScript(): string {
+  return `
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
 
-if (-not $cert) {
+if ($certificates.Count -eq 0) {
   throw "DS01 device key not found."
 }
 
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
+}
+
+$certificates[0]
+`;
+}
+
+async function getWindowsPublicKey(): Promise<string> {
+  const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = ${windowsCertificateLookupScript()}
+
+# Return the complete public certificate.
+#
+# The certificate contains the public key and certificate
+# metadata, but never the private key.
 [Convert]::ToBase64String($cert.RawData)
 `;
 
@@ -134,7 +207,9 @@ if (-not $cert) {
   const certificate = stdout.trim();
 
   if (!certificate) {
-    throw new Error("Unable to read Windows DS01 public certificate.");
+    throw new Error(
+      "Unable to read Windows DS01 public certificate.",
+    );
   }
 
   return certificate;
@@ -143,26 +218,20 @@ if (-not $cert) {
 async function signWindowsDeviceKey(
   data: Uint8Array,
 ): Promise<Uint8Array> {
-  const dataBase64 = Buffer.from(data).toString("base64");
+  const dataBase64 =
+    Buffer.from(data).toString("base64");
 
   const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
-  Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
-
-if (-not $cert) {
-  throw "DS01 device key not found."
-}
+$cert = ${windowsCertificateLookupScript()}
 
 if (-not $cert.HasPrivateKey) {
   throw "DS01 device certificate has no private key."
 }
 
-$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
+$rsa =
+  [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
 
 if (-not $rsa) {
   throw "Unable to access DS01 private signing key."
@@ -202,25 +271,34 @@ finally {
   const signature = stdout.trim();
 
   if (!signature) {
-    throw new Error("Failed to sign data with Windows device key.");
+    throw new Error(
+      "Failed to sign data with Windows device key.",
+    );
   }
 
-  return new Uint8Array(Buffer.from(signature, "base64"));
+  return new Uint8Array(
+    Buffer.from(signature, "base64"),
+  );
 }
 
 async function deleteWindowsDeviceKey(): Promise<void> {
   const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
 
-if ($cert) {
-  Remove-Item $cert.PSPath
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
 }
+
+if ($certificates.Count -eq 1) {
+  Remove-Item $certificates[0].PSPath
+}
+
+Write-Output "DELETED"
 `;
 
   await execFileAsync(
@@ -246,7 +324,11 @@ if ($cert) {
  */
 
 async function runMacHelper(
-  operation: "create" | "public" | "sign" | "delete",
+  operation:
+    | "create"
+    | "public"
+    | "sign"
+    | "delete",
   data?: Uint8Array,
 ): Promise<string> {
   const helper = getMacHelperPath();
@@ -254,7 +336,9 @@ async function runMacHelper(
   const args = [helper, operation];
 
   if (data) {
-    args.push(Buffer.from(data).toString("base64"));
+    args.push(
+      Buffer.from(data).toString("base64"),
+    );
   }
 
   const { stdout } = await execFileAsync(
@@ -269,17 +353,23 @@ async function runMacHelper(
 }
 
 async function createMacDeviceKey(): Promise<void> {
-  const result = await runMacHelper("create");
+  const result =
+    await runMacHelper("create");
 
-  if (result !== "CREATED" && result !== "EXISTS") {
+  if (
+    result !== "CREATED" &&
+    result !== "EXISTS"
+  ) {
     throw new Error(
-      result || "Failed to create macOS Secure Enclave device key.",
+      result ||
+        "Failed to create macOS Secure Enclave device key.",
     );
   }
 }
 
 async function getMacPublicKey(): Promise<string> {
-  const result = await runMacHelper("public");
+  const result =
+    await runMacHelper("public");
 
   if (!result) {
     throw new Error(
@@ -293,7 +383,8 @@ async function getMacPublicKey(): Promise<string> {
 async function signMacDeviceKey(
   data: Uint8Array,
 ): Promise<Uint8Array> {
-  const result = await runMacHelper("sign", data);
+  const result =
+    await runMacHelper("sign", data);
 
   if (!result) {
     throw new Error(