gnoman 0.1.0

package/licensingServer/src/routes/licenses.ts

@@ -0,0 +1,110 @@
+import { Router } from 'express';
+import crypto from 'crypto';
+import { canonicalizeLicenseJson } from '../lib/canonicalize';
+import { LICENSE_ALG, signBytesToB64, verifyB64Signature } from '../lib/crypto';
+import {
+  IssueInput,
+  LicensePayload,
+  assertString,
+  assertMaxBytes,
+  isIsoDateString,
+  assertExpiresNotBeforeIssued,
+  isExpired
+} from '../lib/validate';
+import { requireIssueApiKey } from '../middleware/auth';
+
+export function licensesRouter(keys: { privateKeyPem: string; publicKeyPem: string }) {
+  const r = Router();
+
+  r.post('/issue', requireIssueApiKey, (req, res) => {
+    try {
+      const body: IssueInput = req.body ?? {};
+
+      assertString('customer', body.customer);
+      assertString('product', body.product);
+      assertString('plan', body.plan);
+
+      const issuedAt = new Date().toISOString();
+      const expiresAt = body.expiresAt ?? null;
+
+      if (expiresAt !== null) {
+        if (!isIsoDateString(expiresAt)) {
+          throw new Error('expiresAt must be ISO string or null');
+        }
+        assertExpiresNotBeforeIssued(issuedAt, expiresAt);
+      }
+
+      const license: LicensePayload = {
+        licenseId: `LIC-${crypto.randomBytes(9).toString('hex').toUpperCase()}`,
+        issuedAt,
+        expiresAt,
+        customer: body.customer.trim(),
+        product: body.product.trim(),
+        plan: body.plan.trim(),
+        features: body.features && typeof body.features === 'object' ? body.features : {},
+        machineHash: body.machineHash ?? null,
+        nonce: crypto.randomBytes(16).toString('hex')
+      };
+
+      const canonical = canonicalizeLicenseJson(license);
+      const payloadBytes = Buffer.from(canonical, 'utf8');
+      assertMaxBytes('license', payloadBytes.length, 8 * 1024);
+
+      const signatureB64 = signBytesToB64(keys.privateKeyPem, payloadBytes);
+
+      return res.json({
+        license,
+        signatureB64,
+        alg: LICENSE_ALG
+      });
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : String(err);
+      return res.status(400).json({ error: message });
+    }
+  });
+
+  r.post('/verify', (req, res) => {
+    try {
+      const { license, signatureB64 } = req.body ?? {};
+      if (!license || typeof license !== 'object') {
+        throw new Error('license object required');
+      }
+      if (typeof signatureB64 !== 'string' || signatureB64.length === 0) {
+        throw new Error('signatureB64 required');
+      }
+
+      const canonical = canonicalizeLicenseJson(license);
+      const payloadBytes = Buffer.from(canonical, 'utf8');
+      assertMaxBytes('license', payloadBytes.length, 8 * 1024);
+
+      const sigOk = verifyB64Signature(keys.publicKeyPem, payloadBytes, signatureB64);
+      if (!sigOk) {
+        return res.json({ valid: false, reason: 'bad_signature' });
+      }
+
+      const expiresAt: string | null = license.expiresAt ?? null;
+      if (expiresAt !== null && !isIsoDateString(expiresAt)) {
+        return res.json({ valid: false, reason: 'bad_expiresAt' });
+      }
+      if (isExpired(expiresAt)) {
+        return res.json({ valid: false, reason: 'expired' });
+      }
+
+      const machineHash: string | null = license.machineHash ?? null;
+      const presentedMachineHash: string | null = req.body.machineHash ?? null;
+      if (machineHash && presentedMachineHash && machineHash !== presentedMachineHash) {
+        return res.json({ valid: false, reason: 'machine_mismatch' });
+      }
+      if (machineHash && !presentedMachineHash) {
+        return res.json({ valid: false, reason: 'machine_required' });
+      }
+
+      return res.json({ valid: true });
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : String(err);
+      return res.status(400).json({ valid: false, reason: message });
+    }
+  });
+
+  return r;
+}

package/licensingServer/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "CommonJS",
+    "moduleResolution": "Node",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  }
+}

package/main/ipcHandlers/index.ts

@@ -0,0 +1,23 @@
+import type { IpcMain } from 'electron';
+import keyringManager from '../../src/core/keyringManager';
+
+export const registerIpcHandlers = (ipcMain: IpcMain) => {
+  ipcMain.handle('keyring:list', async () => {
+    const secrets = await keyringManager.list();
+    return Object.keys(secrets).map((key) => ({ alias: key }));
+  });
+
+  ipcMain.handle('keyring:add', async (_event, payload: { alias: string; secret: string }) => {
+    await keyringManager.set(payload.alias, payload.secret);
+    return true;
+  });
+
+  ipcMain.handle('keyring:get', async (_event, payload: { alias: string }) => {
+    return keyringManager.get(payload.alias);
+  });
+
+  ipcMain.handle('keyring:delete', async (_event, payload: { alias: string }) => {
+    await keyringManager.delete(payload.alias);
+    return true;
+  });
+};

package/main/keyring/keyringmanager.ts

@@ -0,0 +1,154 @@
+const DEFAULT_PORT = Number.parseInt(process.env.PORT ?? '4399', 10);
+
+type KeyringSecretSummary = {
+  key: string;
+  maskedValue: string | null;
+};
+
+type KeyringListResponse = {
+  backend: string;
+  secrets: KeyringSecretSummary[];
+};
+
+type KeyringGetResponse = {
+  key: string;
+  value: string;
+  backend: string;
+};
+
+type KeyringDeleteResponse = {
+  key: string;
+  deleted: boolean;
+  backend: string;
+};
+
+type KeyringBackendResponse = {
+  active: string;
+  available: string[];
+};
+
+
+type KeyringSetResponse = {
+  service: string;
+  key: string;
+  maskedValue: string | null;
+};
+
+type HttpRequestInit = {
+  method?: string;
+  headers?: Record<string, string>;
+  body?: string;
+};
+
+class KeyringRequestError extends Error {
+  constructor(message: string, readonly status: number, cause?: unknown) {
+    super(message);
+    this.name = 'KeyringRequestError';
+    if (cause !== undefined) {
+      (this as { cause?: unknown }).cause = cause;
+    }
+  }
+};
+
+const sanitizePayload = (payload: Record<string, unknown>) => {
+  const entries = Object.entries(payload).filter(([, value]) => value !== undefined);
+  if (entries.length === 0) {
+    return undefined;
+  }
+  return JSON.stringify(Object.fromEntries(entries));
+};
+
+const encodeKey = (key: string) => `/${encodeURIComponent(key)}`;
+
+const safeParseJson = <T>(raw: string): T | undefined => {
+  try {
+    return JSON.parse(raw) as T;
+  } catch (error) {
+    console.warn('Keyring request returned a non-JSON payload.', error);
+    return undefined;
+  }
+};
+
+export class KeyringManager {
+  private readonly baseUrl: string;
+
+  constructor(baseUrl?: string) {
+    this.baseUrl = baseUrl ?? `http://127.0.0.1:${DEFAULT_PORT}/api/keyring`;
+  }
+
+  private async request<T>(path: string, init: HttpRequestInit = {}): Promise<T> {
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+      'X-Request-ID': crypto.randomUUID(),
+      ...(init.headers ?? {})
+    };
+
+    const requestInit: RequestInit = {
+      method: init.method ?? (init.body ? 'POST' : 'GET'),
+      headers
+    };
+
+    if (init.body !== undefined) {
+      requestInit.body = init.body;
+    }
+
+    let response: Response;
+    try {
+      response = await fetch(`${this.baseUrl}${path}`, requestInit);
+    } catch (error) {
+      throw new KeyringRequestError('Unable to reach keyring service.', -1, error);
+    }
+
+    const raw = await response.text();
+
+    if (!response.ok) {
+      let detail = `Keyring request failed with status ${response.status}`;
+      const payload = raw ? safeParseJson<{ message?: string }>(raw) : undefined;
+      if (payload?.message) {
+        detail = payload.message;
+      }
+      throw new KeyringRequestError(detail, response.status);
+    }
+
+    if (!raw) {
+      return undefined as T;
+    }
+
+    return safeParseJson<T>(raw) ?? (undefined as T);
+  }
+
+  async listEntries(): Promise<KeyringListResponse> {
+    return this.request<KeyringListResponse>('/', { method: 'GET' });
+  }
+
+  async getEntry(key: string): Promise<KeyringGetResponse> {
+    return this.request<KeyringGetResponse>(encodeKey(key), { method: 'GET' });
+  }
+
+  async addEntry(key: string, value: string): Promise<KeyringSetResponse> {
+    return this.request<KeyringSetResponse>(encodeKey(key), {
+      method: 'POST',
+      body: sanitizePayload({ value })
+    });
+  }
+
+  async removeEntry(key: string): Promise<KeyringDeleteResponse> {
+    return this.request<KeyringDeleteResponse>(encodeKey(key), {
+      method: 'DELETE'
+    });
+  }
+
+  async currentBackend(): Promise<KeyringBackendResponse> {
+    return this.request<KeyringBackendResponse>('/backend', { method: 'GET' });
+  }
+
+  async switchBackend(name: string): Promise<KeyringBackendResponse> {
+    return this.request<KeyringBackendResponse>(`/backend/${encodeURIComponent(name)}`, {
+      method: 'POST'
+    });
+  }
+};
+
+export const keyringManager = new KeyringManager();
+
+export default keyringManager;

package/main/main.ts

@@ -0,0 +1,234 @@
+import type { BrowserWindow as BrowserWindowType } from 'electron';
+import { app, BrowserWindow as BrowserWindowCtor, ipcMain } from 'electron';
+import { fork, type ChildProcess } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as url from 'url';
+import { registerIpcHandlers } from './ipcHandlers';
+
+const isDev = process.env.NODE_ENV === 'development';
+const backendPort = Number.parseInt(process.env.PORT ?? '4399', 10);
+
+const sleep = (ms: number) => new Promise((resolve) => {
+  setTimeout(resolve, ms);
+});
+
+let backendProcess: ChildProcess | null = null;
+
+const resolveBackendEntry = () => {
+  const searchRoots = new Set<string>();
+  let current = path.resolve(__dirname);
+
+  for (let depth = 0; depth < 6; depth += 1) {
+    searchRoots.add(current);
+
+    const distDir = path.join(current, 'dist');
+    if (fs.existsSync(distDir)) {
+      searchRoots.add(distDir);
+    }
+
+    const parent = path.dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+
+  const suffixes: string[][] = [
+    ['backend', 'index.js'],
+    ['backend', 'backend', 'index.js']
+  ];
+
+  for (const root of searchRoots) {
+    for (const parts of suffixes) {
+      const candidate = path.join(root, ...parts);
+      if (fs.existsSync(candidate)) {
+        return candidate;
+      }
+    }
+  }
+
+  return undefined;
+};
+
+const backendHealthUrl = `http://127.0.0.1:${backendPort}/api/health`;
+
+const isBackendReachable = async () => {
+  try {
+    const response = await fetch(backendHealthUrl, { cache: 'no-store' });
+    return response.ok;
+  } catch (error) {
+    const maybeErrno = error as { code?: string };
+    if (maybeErrno.code !== 'ECONNREFUSED') {
+      console.warn('Backend health probe failed:', error);
+    }
+    return false;
+  }
+};
+
+const ensureBackendRunning = async () => {
+  if (await isBackendReachable()) {
+    return;
+  }
+
+  if (!backendProcess) {
+    const backendEntry = resolveBackendEntry();
+
+    if (!backendEntry) {
+      console.error('Unable to locate backend bundle. Have you run `npm run build:backend`?');
+      return;
+    }
+
+    backendProcess = fork(backendEntry, {
+      cwd: path.join(__dirname, '..'),
+      env: {
+        ...process.env,
+        PORT: backendPort.toString()
+      },
+      stdio: 'inherit'
+    });
+
+    backendProcess.on('exit', (code, signal) => {
+      backendProcess = null;
+      if (signal) {
+        console.warn(`Backend exited after receiving signal ${signal}.`);
+        return;
+      }
+
+      if (code && code !== 0) {
+        console.error(`Backend process exited with code ${code}.`);
+      }
+    });
+
+    backendProcess.on('error', (error) => {
+      console.error('Failed to launch embedded backend:', error);
+    });
+  }
+
+  for (let attempt = 0; attempt < 40; attempt += 1) {
+    if (await isBackendReachable()) {
+      return;
+    }
+
+    await sleep(250);
+  }
+
+  console.error('Timed out waiting for embedded backend to report healthy.');
+};
+
+if (!isDev) {
+  app.commandLine.appendSwitch('allow-file-access-from-files');
+}
+
+if (process.platform === 'linux') {
+  const sanitizeGtkModules = (envVar: string) => {
+    const modules = process.env[envVar];
+
+    if (!modules) {
+      return;
+    }
+
+    const sanitizedModules = modules
+      .split(':')
+      .map((moduleName) => moduleName.trim())
+      .filter((moduleName) => moduleName && moduleName !== 'colorreload-gtk-module');
+
+    if (sanitizedModules.length === 0) {
+      delete process.env[envVar];
+      return;
+    }
+
+    const normalized = sanitizedModules.join(':');
+
+    if (normalized !== modules) {
+      process.env[envVar] = normalized;
+    }
+  };
+
+  sanitizeGtkModules('GTK_MODULES');
+  sanitizeGtkModules('GTK3_MODULES');
+}
+
+let mainWindow: BrowserWindowType | null = null;
+
+const createWindow = async () => {
+  mainWindow = new BrowserWindowCtor({
+    width: 1280,
+    height: 840,
+    webPreferences: {
+      preload: path.join(__dirname, 'preload/index.js'),
+      contextIsolation: true,
+      nodeIntegration: false,
+      sandbox: true
+    }
+  });
+
+  mainWindow.setTitle('GNOMAN 2.0');
+
+  if (isDev) {
+    const devServerURL = process.env.VITE_DEV_SERVER_URL || 'http://localhost:5173';
+    await mainWindow.loadURL(devServerURL);
+    mainWindow.webContents.openDevTools({ mode: 'detach' });
+  } else {
+    const resolveRendererIndex = () => {
+      const candidates = [
+        path.resolve(__dirname, '..', '..', 'renderer', 'index.html'),
+        path.resolve(__dirname, '..', 'renderer', 'index.html')
+      ];
+
+      for (const candidate of candidates) {
+        if (fs.existsSync(candidate)) {
+          return candidate;
+        }
+      }
+
+      console.error('Unable to locate renderer bundle. Have you run `npm run build:renderer`?');
+      return undefined;
+    };
+
+    const rendererIndex = resolveRendererIndex();
+
+    if (!rendererIndex) {
+      throw new Error('Renderer bundle missing from build output.');
+    }
+
+    await mainWindow.loadURL(
+      url.format({
+        pathname: rendererIndex,
+        protocol: 'file:',
+        slashes: true
+      })
+    );
+  }
+
+  mainWindow.on('closed', () => {
+    mainWindow = null;
+  });
+};
+
+app.on('window-all-closed', () => {
+  if (process.platform !== 'darwin') {
+    app.quit();
+  }
+});
+
+app.on('before-quit', () => {
+  if (backendProcess) {
+    backendProcess.removeAllListeners();
+    backendProcess.kill();
+    backendProcess = null;
+  }
+});
+
+app.on('activate', () => {
+  if (mainWindow === null) {
+    void createWindow();
+  }
+});
+
+app.whenReady().then(async () => {
+  registerIpcHandlers(ipcMain);
+  await ensureBackendRunning();
+  await createWindow();
+});
+

package/main/preload/index.ts

@@ -0,0 +1,31 @@
+import { contextBridge } from "electron";
+import { validateAndSave, loadToken } from "./licenseBridge";
+
+contextBridge.exposeInMainWorld("safevault", {
+  validateLicense: (key: string) => validateAndSave(key),
+  loadLicense: () => {
+    const token = loadToken();
+    if (!token) return { ok: false, reason: "none" };
+    return validateAndSave(token);
+  },
+});
+
+import { ipcRenderer } from "electron";
+
+type IpcChannels = "keyring:list" | "keyring:add" | "keyring:get" | "keyring:delete";
+
+type GnomanAPI = {
+  invoke: <T = unknown>(channel: IpcChannels, payload?: unknown) => Promise<T>;
+};
+
+const api: GnomanAPI = {
+  invoke: (channel, payload) => ipcRenderer.invoke(channel, payload)
+};
+
+contextBridge.exposeInMainWorld("gnoman", api);
+
+declare global {
+  interface Window {
+    gnoman: GnomanAPI;
+  }
+}

package/main/preload/licenseBridge.ts

@@ -0,0 +1,73 @@
+// main/preload/licenseBridge.ts
+import { execFileSync } from "node:child_process";
+import * as path from "node:path";
+import * as fs from "node:fs";
+
+const ROOT = process.cwd();
+const PUB_KEY_PATH = path.join(ROOT, "backend/licenses/license_public.pem");
+const SAFEVAULT_DIR = path.join(ROOT, ".safevault");
+const ENV_PATH = path.join(SAFEVAULT_DIR, "license.env");
+const PYTHON_BRIDGE = `
+import sys
+from backend.licenses.verify_license import verify_token
+
+
+def main():
+    _, pub_path, token, product, version = sys.argv
+    result = verify_token(pub_path, token, product, version)
+    print("True" if result else "False")
+
+
+if __name__ == "__main__":
+    main()
+`;
+
+// ensure .safevault exists
+if (!fs.existsSync(SAFEVAULT_DIR)) fs.mkdirSync(SAFEVAULT_DIR, { recursive: true });
+
+/**
+ * Run verify_license.py directly to confirm the token offline.
+ * Returns true if valid, false otherwise.
+ */
+export function verifyOfflineLicense(token: string): boolean {
+  try {
+    const out = execFileSync(
+      "python3",
+      ["-c", PYTHON_BRIDGE, PUB_KEY_PATH, token, "GNOMAN", "2.0.0"],
+      {
+        encoding: "utf8",
+        timeout: 5000,
+      }
+    );
+    return out.trim() === "True";
+  } catch {
+    return false;
+  }
+}
+
+/** Persist valid token in .safevault/license.env */
+function persistToken(token: string) {
+  const content = [
+    `LICENSE_KEY=${token}`,
+    `VALIDATED_AT=${Math.floor(Date.now() / 1000)}`,
+  ].join("\n");
+  fs.writeFileSync(ENV_PATH, content, "utf8");
+}
+
+/** Load previously saved token (if any) */
+export function loadToken(): string | null {
+  if (!fs.existsSync(ENV_PATH)) return null;
+  const lines = fs.readFileSync(ENV_PATH, "utf8").split(/\r?\n/);
+  const kv = Object.fromEntries(lines.filter(Boolean).map(l => l.split("=", 2)));
+  return kv.LICENSE_KEY || null;
+}
+
+/** Validate key and save if valid */
+export function validateAndSave(token: string): { ok: boolean; reason?: string } {
+  const valid = verifyOfflineLicense(token);
+  if (valid) {
+    persistToken(token);
+    return { ok: true };
+  }
+  return { ok: false, reason: "invalid_or_expired" };
+}