gnoman 0.1.0

package/gnoman2.0/licensingServer/src/config/keys.ts

@@ -0,0 +1,84 @@
+import fs from 'fs';
+import crypto from 'crypto';
+
+export type LoadedKeys = {
+  privateKeyPem: string;
+  publicKeyPem: string;
+};
+
+function readPemOrThrow(path: string, label: string): string {
+  try {
+    const pem = fs.readFileSync(path, 'utf8');
+    if (!pem.includes('BEGIN')) {
+      throw new Error('Not PEM formatted');
+    }
+    return pem;
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`${label} read failed at ${path}: ${message}`);
+  }
+}
+
+function parsePrivateKeyOrThrow(pem: string): crypto.KeyObject {
+  try {
+    return crypto.createPrivateKey(pem);
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Private key parse failed: ${message}`);
+  }
+}
+
+function parsePublicKeyOrThrow(pem: string): crypto.KeyObject {
+  try {
+    return crypto.createPublicKey(pem);
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Public key parse failed: ${message}`);
+  }
+}
+
+function assertMatchingKeypairOrThrow(privateKey: crypto.KeyObject, publicKey: crypto.KeyObject) {
+  const msg = Buffer.from('license-key-selftest', 'utf8');
+
+  const signer = crypto.createSign('RSA-SHA256');
+  signer.update(msg);
+  signer.end();
+  const sig = signer.sign(privateKey);
+
+  const verifier = crypto.createVerify('RSA-SHA256');
+  verifier.update(msg);
+  verifier.end();
+  const ok = verifier.verify(publicKey, sig);
+
+  if (!ok) {
+    throw new Error('Keypair self-test failed: public key does not verify private key signatures');
+  }
+}
+
+export function loadKeysOrExit(): LoadedKeys {
+  const privatePath = process.env.LICENSE_PRIVATE_KEY_PATH ?? './keys/license-private.pem';
+  const publicPath = process.env.LICENSE_PUBLIC_KEY_PATH ?? './keys/license-public.pem';
+
+  try {
+    const privateKeyPem = readPemOrThrow(privatePath, 'LICENSE_PRIVATE_KEY_PATH');
+    const publicKeyPem = readPemOrThrow(publicPath, 'LICENSE_PUBLIC_KEY_PATH');
+
+    const priv = parsePrivateKeyOrThrow(privateKeyPem);
+    const pub = parsePublicKeyOrThrow(publicKeyPem);
+
+    if (priv.asymmetricKeyType !== 'rsa') {
+      throw new Error(`Private key is not RSA (got ${priv.asymmetricKeyType})`);
+    }
+    if (pub.asymmetricKeyType !== 'rsa') {
+      throw new Error(`Public key is not RSA (got ${pub.asymmetricKeyType})`);
+    }
+
+    assertMatchingKeypairOrThrow(priv, pub);
+
+    return { privateKeyPem, publicKeyPem };
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`FATAL: License key configuration error: ${message}`);
+    process.exit(1);
+  }
+}

package/gnoman2.0/licensingServer/src/index.ts

@@ -0,0 +1,30 @@
+import express from 'express';
+import rateLimit from 'express-rate-limit';
+import { loadKeysOrExit } from './config/keys';
+import { licensesRouter } from './routes/licenses';
+
+const keys = loadKeysOrExit();
+
+const app = express();
+
+app.use(express.json({ limit: '16kb' }));
+
+app.use(
+  rateLimit({
+    windowMs: 60_000,
+    limit: 120,
+    standardHeaders: 'draft-7',
+    legacyHeaders: false
+  })
+);
+
+app.get('/health', (_req, res) => {
+  res.json({ ok: true });
+});
+
+app.use('/licenses', licensesRouter(keys));
+
+const port = Number(process.env.PORT ?? 3000);
+app.listen(port, () => {
+  console.log(`licensingServer listening on :${port}`);
+});

package/gnoman2.0/licensingServer/src/lib/canonicalize.ts

@@ -0,0 +1,5 @@
+import stringify from 'json-stable-stringify';
+
+export function canonicalizeLicenseJson(obj: unknown): string {
+  return stringify(obj);
+}

package/gnoman2.0/licensingServer/src/lib/crypto.ts

@@ -0,0 +1,25 @@
+import crypto from 'crypto';
+
+export const LICENSE_ALG = 'RSA-SHA256';
+
+export function signBytesToB64(privateKeyPem: string, payloadBytes: Buffer): string {
+  const sign = crypto.createSign(LICENSE_ALG);
+  sign.update(payloadBytes);
+  sign.end();
+  const signature = sign.sign(privateKeyPem);
+  return signature.toString('base64');
+}
+
+export function verifyB64Signature(publicKeyPem: string, payloadBytes: Buffer, signatureB64: string): boolean {
+  let sig: Buffer;
+  try {
+    sig = Buffer.from(signatureB64, 'base64');
+  } catch {
+    return false;
+  }
+
+  const verify = crypto.createVerify(LICENSE_ALG);
+  verify.update(payloadBytes);
+  verify.end();
+  return verify.verify(publicKeyPem, sig);
+}

package/gnoman2.0/licensingServer/src/lib/validate.ts

@@ -0,0 +1,62 @@
+export type IssueInput = {
+  customer: string;
+  product: string;
+  plan: string;
+  expiresAt?: string | null;
+  features?: Record<string, unknown>;
+  machineHash?: string | null;
+};
+
+export type LicensePayload = {
+  licenseId: string;
+  issuedAt: string;
+  expiresAt: string | null;
+  customer: string;
+  product: string;
+  plan: string;
+  features: Record<string, unknown>;
+  machineHash?: string | null;
+  nonce: string;
+};
+
+export function isIsoDateString(s: unknown): boolean {
+  if (typeof s !== 'string') {
+    return false;
+  }
+  const t = Date.parse(s);
+  return Number.isFinite(t);
+}
+
+export function assertString(name: string, v: unknown) {
+  if (typeof v !== 'string' || v.trim().length === 0) {
+    throw new Error(`${name} is required`);
+  }
+}
+
+export function assertMaxBytes(name: string, bytes: number, maxBytes: number) {
+  if (bytes > maxBytes) {
+    throw new Error(`${name} too large (${bytes} bytes > ${maxBytes} bytes)`);
+  }
+}
+
+export function assertExpiresNotBeforeIssued(issuedAtIso: string, expiresAtIso: string) {
+  const i = Date.parse(issuedAtIso);
+  const e = Date.parse(expiresAtIso);
+  if (!Number.isFinite(i) || !Number.isFinite(e)) {
+    throw new Error('Invalid issuedAt/expiresAt');
+  }
+  if (e < i) {
+    throw new Error('expiresAt cannot be before issuedAt');
+  }
+}
+
+export function isExpired(expiresAt: string | null): boolean {
+  if (!expiresAt) {
+    return false;
+  }
+  const e = Date.parse(expiresAt);
+  if (!Number.isFinite(e)) {
+    return true;
+  }
+  return Date.now() > e;
+}

package/gnoman2.0/licensingServer/src/middleware/auth.ts

@@ -0,0 +1,20 @@
+import { Request, Response, NextFunction } from 'express';
+
+export function requireIssueApiKey(req: Request, res: Response, next: NextFunction) {
+  const isProd = (process.env.NODE_ENV ?? '').toLowerCase() === 'production';
+  if (!isProd) {
+    return next();
+  }
+
+  const required = process.env.LICENSE_ISSUE_API_KEY;
+  if (!required || required.trim().length === 0) {
+    return res.status(500).json({ error: 'Server misconfigured: LICENSE_ISSUE_API_KEY missing' });
+  }
+
+  const provided = req.header('x-license-issue-key') ?? '';
+  if (provided !== required) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  return next();
+}

package/gnoman2.0/licensingServer/src/routes/licenses.ts

@@ -0,0 +1,110 @@
+import { Router } from 'express';
+import crypto from 'crypto';
+import { canonicalizeLicenseJson } from '../lib/canonicalize';
+import { LICENSE_ALG, signBytesToB64, verifyB64Signature } from '../lib/crypto';
+import {
+  IssueInput,
+  LicensePayload,
+  assertString,
+  assertMaxBytes,
+  isIsoDateString,
+  assertExpiresNotBeforeIssued,
+  isExpired
+} from '../lib/validate';
+import { requireIssueApiKey } from '../middleware/auth';
+
+export function licensesRouter(keys: { privateKeyPem: string; publicKeyPem: string }) {
+  const r = Router();
+
+  r.post('/issue', requireIssueApiKey, (req, res) => {
+    try {
+      const body: IssueInput = req.body ?? {};
+
+      assertString('customer', body.customer);
+      assertString('product', body.product);
+      assertString('plan', body.plan);
+
+      const issuedAt = new Date().toISOString();
+      const expiresAt = body.expiresAt ?? null;
+
+      if (expiresAt !== null) {
+        if (!isIsoDateString(expiresAt)) {
+          throw new Error('expiresAt must be ISO string or null');
+        }
+        assertExpiresNotBeforeIssued(issuedAt, expiresAt);
+      }
+
+      const license: LicensePayload = {
+        licenseId: `LIC-${crypto.randomBytes(9).toString('hex').toUpperCase()}`,
+        issuedAt,
+        expiresAt,
+        customer: body.customer.trim(),
+        product: body.product.trim(),
+        plan: body.plan.trim(),
+        features: body.features && typeof body.features === 'object' ? body.features : {},
+        machineHash: body.machineHash ?? null,
+        nonce: crypto.randomBytes(16).toString('hex')
+      };
+
+      const canonical = canonicalizeLicenseJson(license);
+      const payloadBytes = Buffer.from(canonical, 'utf8');
+      assertMaxBytes('license', payloadBytes.length, 8 * 1024);
+
+      const signatureB64 = signBytesToB64(keys.privateKeyPem, payloadBytes);
+
+      return res.json({
+        license,
+        signatureB64,
+        alg: LICENSE_ALG
+      });
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : String(err);
+      return res.status(400).json({ error: message });
+    }
+  });
+
+  r.post('/verify', (req, res) => {
+    try {
+      const { license, signatureB64 } = req.body ?? {};
+      if (!license || typeof license !== 'object') {
+        throw new Error('license object required');
+      }
+      if (typeof signatureB64 !== 'string' || signatureB64.length === 0) {
+        throw new Error('signatureB64 required');
+      }
+
+      const canonical = canonicalizeLicenseJson(license);
+      const payloadBytes = Buffer.from(canonical, 'utf8');
+      assertMaxBytes('license', payloadBytes.length, 8 * 1024);
+
+      const sigOk = verifyB64Signature(keys.publicKeyPem, payloadBytes, signatureB64);
+      if (!sigOk) {
+        return res.json({ valid: false, reason: 'bad_signature' });
+      }
+
+      const expiresAt: string | null = license.expiresAt ?? null;
+      if (expiresAt !== null && !isIsoDateString(expiresAt)) {
+        return res.json({ valid: false, reason: 'bad_expiresAt' });
+      }
+      if (isExpired(expiresAt)) {
+        return res.json({ valid: false, reason: 'expired' });
+      }
+
+      const machineHash: string | null = license.machineHash ?? null;
+      const presentedMachineHash: string | null = req.body.machineHash ?? null;
+      if (machineHash && presentedMachineHash && machineHash !== presentedMachineHash) {
+        return res.json({ valid: false, reason: 'machine_mismatch' });
+      }
+      if (machineHash && !presentedMachineHash) {
+        return res.json({ valid: false, reason: 'machine_required' });
+      }
+
+      return res.json({ valid: true });
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : String(err);
+      return res.status(400).json({ valid: false, reason: message });
+    }
+  });
+
+  return r;
+}

package/gnoman2.0/licensingServer/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "CommonJS",
+    "moduleResolution": "Node",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  }
+}

package/gnoman2.0/main/ipcHandlers/index.ts

@@ -0,0 +1,23 @@
+import type { IpcMain } from 'electron';
+import keyringManager from '../../src/core/keyringManager';
+
+export const registerIpcHandlers = (ipcMain: IpcMain) => {
+  ipcMain.handle('keyring:list', async () => {
+    const secrets = await keyringManager.list();
+    return Object.keys(secrets).map((key) => ({ alias: key }));
+  });
+
+  ipcMain.handle('keyring:add', async (_event, payload: { alias: string; secret: string }) => {
+    await keyringManager.set(payload.alias, payload.secret);
+    return true;
+  });
+
+  ipcMain.handle('keyring:get', async (_event, payload: { alias: string }) => {
+    return keyringManager.get(payload.alias);
+  });
+
+  ipcMain.handle('keyring:delete', async (_event, payload: { alias: string }) => {
+    await keyringManager.delete(payload.alias);
+    return true;
+  });
+};

package/gnoman2.0/main/keyring/keyringmanager.ts

@@ -0,0 +1,154 @@
+const DEFAULT_PORT = Number.parseInt(process.env.PORT ?? '4399', 10);
+
+type KeyringSecretSummary = {
+  key: string;
+  maskedValue: string | null;
+};
+
+type KeyringListResponse = {
+  backend: string;
+  secrets: KeyringSecretSummary[];
+};
+
+type KeyringGetResponse = {
+  key: string;
+  value: string;
+  backend: string;
+};
+
+type KeyringDeleteResponse = {
+  key: string;
+  deleted: boolean;
+  backend: string;
+};
+
+type KeyringBackendResponse = {
+  active: string;
+  available: string[];
+};
+
+
+type KeyringSetResponse = {
+  service: string;
+  key: string;
+  maskedValue: string | null;
+};
+
+type HttpRequestInit = {
+  method?: string;
+  headers?: Record<string, string>;
+  body?: string;
+};
+
+class KeyringRequestError extends Error {
+  constructor(message: string, readonly status: number, cause?: unknown) {
+    super(message);
+    this.name = 'KeyringRequestError';
+    if (cause !== undefined) {
+      (this as { cause?: unknown }).cause = cause;
+    }
+  }
+};
+
+const sanitizePayload = (payload: Record<string, unknown>) => {
+  const entries = Object.entries(payload).filter(([, value]) => value !== undefined);
+  if (entries.length === 0) {
+    return undefined;
+  }
+  return JSON.stringify(Object.fromEntries(entries));
+};
+
+const encodeKey = (key: string) => `/${encodeURIComponent(key)}`;
+
+const safeParseJson = <T>(raw: string): T | undefined => {
+  try {
+    return JSON.parse(raw) as T;
+  } catch (error) {
+    console.warn('Keyring request returned a non-JSON payload.', error);
+    return undefined;
+  }
+};
+
+export class KeyringManager {
+  private readonly baseUrl: string;
+
+  constructor(baseUrl?: string) {
+    this.baseUrl = baseUrl ?? `http://127.0.0.1:${DEFAULT_PORT}/api/keyring`;
+  }
+
+  private async request<T>(path: string, init: HttpRequestInit = {}): Promise<T> {
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+      'X-Request-ID': crypto.randomUUID(),
+      ...(init.headers ?? {})
+    };
+
+    const requestInit: RequestInit = {
+      method: init.method ?? (init.body ? 'POST' : 'GET'),
+      headers
+    };
+
+    if (init.body !== undefined) {
+      requestInit.body = init.body;
+    }
+
+    let response: Response;
+    try {
+      response = await fetch(`${this.baseUrl}${path}`, requestInit);
+    } catch (error) {
+      throw new KeyringRequestError('Unable to reach keyring service.', -1, error);
+    }
+
+    const raw = await response.text();
+
+    if (!response.ok) {
+      let detail = `Keyring request failed with status ${response.status}`;
+      const payload = raw ? safeParseJson<{ message?: string }>(raw) : undefined;
+      if (payload?.message) {
+        detail = payload.message;
+      }
+      throw new KeyringRequestError(detail, response.status);
+    }
+
+    if (!raw) {
+      return undefined as T;
+    }
+
+    return safeParseJson<T>(raw) ?? (undefined as T);
+  }
+
+  async listEntries(): Promise<KeyringListResponse> {
+    return this.request<KeyringListResponse>('/', { method: 'GET' });
+  }
+
+  async getEntry(key: string): Promise<KeyringGetResponse> {
+    return this.request<KeyringGetResponse>(encodeKey(key), { method: 'GET' });
+  }
+
+  async addEntry(key: string, value: string): Promise<KeyringSetResponse> {
+    return this.request<KeyringSetResponse>(encodeKey(key), {
+      method: 'POST',
+      body: sanitizePayload({ value })
+    });
+  }
+
+  async removeEntry(key: string): Promise<KeyringDeleteResponse> {
+    return this.request<KeyringDeleteResponse>(encodeKey(key), {
+      method: 'DELETE'
+    });
+  }
+
+  async currentBackend(): Promise<KeyringBackendResponse> {
+    return this.request<KeyringBackendResponse>('/backend', { method: 'GET' });
+  }
+
+  async switchBackend(name: string): Promise<KeyringBackendResponse> {
+    return this.request<KeyringBackendResponse>(`/backend/${encodeURIComponent(name)}`, {
+      method: 'POST'
+    });
+  }
+};
+
+export const keyringManager = new KeyringManager();
+
+export default keyringManager;