latchkey 0.1.0

package/src/apiCredentialStore.ts

@@ -0,0 +1,87 @@
+/**
+ * API credential store for persisting and loading API credentials.
+ */
+
+import {
+  ApiCredentials,
+  ApiCredentialsSchema,
+  deserializeCredentials,
+  serializeCredentials,
+} from './apiCredentials.js';
+import { EncryptedStorage } from './encryptedStorage.js';
+
+export class ApiCredentialStoreError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'ApiCredentialStoreError';
+  }
+}
+
+type StoreData = Record<string, unknown>;
+
+export class ApiCredentialStore {
+  readonly path: string;
+  private readonly encryptedStorage: EncryptedStorage;
+
+  constructor(path: string, encryptedStorage: EncryptedStorage) {
+    this.path = path;
+    this.encryptedStorage = encryptedStorage;
+  }
+
+  private loadStoreData(): StoreData {
+    try {
+      const content = this.encryptedStorage.readFile(this.path);
+      if (content === null) {
+        return {};
+      }
+      return JSON.parse(content) as StoreData;
+    } catch (error) {
+      throw new ApiCredentialStoreError(
+        `Failed to read credential store: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+
+  private saveStoreData(data: StoreData): void {
+    try {
+      this.encryptedStorage.writeFile(this.path, JSON.stringify(data, null, 2));
+    } catch (error) {
+      throw new ApiCredentialStoreError(
+        `Failed to write credential store: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+
+  get(serviceName: string): ApiCredentials | null {
+    const data = this.loadStoreData();
+    const credentialData = data[serviceName];
+    if (credentialData === undefined) {
+      return null;
+    }
+
+    const parseResult = ApiCredentialsSchema.safeParse(credentialData);
+    if (!parseResult.success) {
+      throw new ApiCredentialStoreError(
+        `Invalid credential data for service ${serviceName}: ${parseResult.error.message}`
+      );
+    }
+
+    return deserializeCredentials(parseResult.data);
+  }
+
+  save(serviceName: string, apiCredentials: ApiCredentials): void {
+    const data = this.loadStoreData();
+    data[serviceName] = serializeCredentials(apiCredentials);
+    this.saveStoreData(data);
+  }
+
+  delete(serviceName: string): boolean {
+    const data = this.loadStoreData();
+    if (!(serviceName in data)) {
+      return false;
+    }
+    const { [serviceName]: _, ...rest } = data;
+    this.saveStoreData(rest);
+    return true;
+  }
+}

package/src/apiCredentials.ts

@@ -0,0 +1,180 @@
+/**
+ * API credentials types and utilities for authentication with various services.
+ */
+
+import { z } from 'zod';
+
+export enum ApiCredentialStatus {
+  Missing = 'missing',
+  Valid = 'valid',
+  Invalid = 'invalid',
+}
+
+/**
+ * Base interface for all API credentials.
+ * Each credential type must specify how to convert itself to curl arguments.
+ */
+export interface ApiCredentials {
+  readonly objectType: string;
+  asCurlArguments(): readonly string[];
+}
+
+/**
+ * Bearer token authentication (Authorization: Bearer <token>).
+ */
+export const AuthorizationBearerSchema = z.object({
+  objectType: z.literal('authorizationBearer'),
+  token: z.string(),
+});
+
+export type AuthorizationBearerData = z.infer<typeof AuthorizationBearerSchema>;
+
+export class AuthorizationBearer implements ApiCredentials {
+  readonly objectType = 'authorizationBearer' as const;
+  readonly token: string;
+
+  constructor(token: string) {
+    this.token = token;
+  }
+
+  asCurlArguments(): readonly string[] {
+    return ['-H', `Authorization: Bearer ${this.token}`];
+  }
+
+  toJSON(): AuthorizationBearerData {
+    return {
+      objectType: this.objectType,
+      token: this.token,
+    };
+  }
+
+  static fromJSON(data: AuthorizationBearerData): AuthorizationBearer {
+    return new AuthorizationBearer(data.token);
+  }
+}
+
+/**
+ * Raw authorization header (Authorization: <token>).
+ */
+export const AuthorizationBareSchema = z.object({
+  objectType: z.literal('authorizationBare'),
+  token: z.string(),
+});
+
+export type AuthorizationBareData = z.infer<typeof AuthorizationBareSchema>;
+
+export class AuthorizationBare implements ApiCredentials {
+  readonly objectType = 'authorizationBare' as const;
+  readonly token: string;
+
+  constructor(token: string) {
+    this.token = token;
+  }
+
+  asCurlArguments(): readonly string[] {
+    return ['-H', `Authorization: ${this.token}`];
+  }
+
+  toJSON(): AuthorizationBareData {
+    return {
+      objectType: this.objectType,
+      token: this.token,
+    };
+  }
+
+  static fromJSON(data: AuthorizationBareData): AuthorizationBare {
+    return new AuthorizationBare(data.token);
+  }
+}
+
+/**
+ * Slack-specific credentials (token + d cookie).
+ */
+export const SlackApiCredentialsSchema = z.object({
+  objectType: z.literal('slack'),
+  token: z.string(),
+  dCookie: z.string(),
+});
+
+export type SlackApiCredentialsData = z.infer<typeof SlackApiCredentialsSchema>;
+
+export class SlackApiCredentials implements ApiCredentials {
+  readonly objectType = 'slack' as const;
+  readonly token: string;
+  readonly dCookie: string;
+
+  constructor(token: string, dCookie: string) {
+    this.token = token;
+    this.dCookie = dCookie;
+  }
+
+  asCurlArguments(): readonly string[] {
+    return ['-H', `Authorization: Bearer ${this.token}`, '-H', `Cookie: d=${this.dCookie}`];
+  }
+
+  toJSON(): SlackApiCredentialsData {
+    return {
+      objectType: this.objectType,
+      token: this.token,
+      dCookie: this.dCookie,
+    };
+  }
+
+  static fromJSON(data: SlackApiCredentialsData): SlackApiCredentials {
+    return new SlackApiCredentials(data.token, data.dCookie);
+  }
+}
+
+/**
+ * Union schema for all credential types.
+ */
+export const ApiCredentialsSchema = z.discriminatedUnion('objectType', [
+  AuthorizationBearerSchema,
+  AuthorizationBareSchema,
+  SlackApiCredentialsSchema,
+]);
+
+export type ApiCredentialsData = z.infer<typeof ApiCredentialsSchema>;
+
+/**
+ * Deserialize credentials from JSON data.
+ */
+export function deserializeCredentials(data: ApiCredentialsData): ApiCredentials {
+  switch (data.objectType) {
+    case 'authorizationBearer':
+      return AuthorizationBearer.fromJSON(data);
+    case 'authorizationBare':
+      return AuthorizationBare.fromJSON(data);
+    case 'slack':
+      return SlackApiCredentials.fromJSON(data);
+    default: {
+      const exhaustiveCheck: never = data;
+      throw new ApiCredentialsSerializationError(
+        `Unknown credential type: ${(exhaustiveCheck as { objectType: string }).objectType}`
+      );
+    }
+  }
+}
+
+/**
+ * Serialize credentials to JSON data.
+ */
+export function serializeCredentials(credentials: ApiCredentials): ApiCredentialsData {
+  if (credentials instanceof AuthorizationBearer) {
+    return credentials.toJSON();
+  }
+  if (credentials instanceof AuthorizationBare) {
+    return credentials.toJSON();
+  }
+  if (credentials instanceof SlackApiCredentials) {
+    return credentials.toJSON();
+  }
+  throw new ApiCredentialsSerializationError(`Unknown credential type: ${credentials.objectType}`);
+}
+
+export class ApiCredentialsSerializationError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'ApiCredentialsSerializationError';
+  }
+}

package/src/cli.ts

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+/**
+ * Command-line interface entry point for latchkey.
+ */
+
+import { program } from 'commander';
+import { registerCommands, createDefaultDependencies } from './cliCommands.js';
+import { InsecureFilePermissionsError } from './config.js';
+
+const deps = createDefaultDependencies();
+
+try {
+  deps.config.checkSensitiveFilePermissions();
+} catch (error) {
+  if (error instanceof InsecureFilePermissionsError) {
+    console.error(`Error: ${error.message}`);
+    process.exit(1);
+  }
+  throw error;
+}
+
+program
+  .name('latchkey')
+  .description(
+    'A command-line tool that injects API credentials to curl requests to known public APIs.'
+  )
+  .version('0.1.0');
+
+registerCommands(program, deps);
+
+program.parse();

package/src/cliCommands.ts

@@ -0,0 +1,321 @@
+/**
+ * CLI command implementations with dependency injection for testability.
+ */
+
+import type { Command } from 'commander';
+import { existsSync, unlinkSync } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { ApiCredentialStore } from './apiCredentialStore.js';
+import { ApiCredentialStatus, ApiCredentials } from './apiCredentials.js';
+import { Config, CONFIG } from './config.js';
+import type { CurlResult } from './curl.js';
+import { EncryptedStorage } from './encryptedStorage.js';
+import { Registry, REGISTRY } from './registry.js';
+import { LoginCancelledError, LoginFailedError } from './services/index.js';
+import { run as curlRun } from './curl.js';
+
+// Curl flags that don't affect the HTTP request semantics but may not be supported by URL extraction.
+const CURL_PASSTHROUGH_FLAGS = new Set(['-v', '--verbose']);
+
+/**
+ * Dependencies that can be injected for testing.
+ */
+export interface CliDependencies {
+  readonly registry: Registry;
+  readonly config: Config;
+  readonly runCurl: (args: readonly string[]) => CurlResult;
+  readonly confirm: (message: string) => Promise<boolean>;
+  readonly exit: (code: number) => never;
+  readonly log: (message: string) => void;
+  readonly errorLog: (message: string) => void;
+}
+
+/**
+ * Default implementation of CLI dependencies.
+ */
+export function createDefaultDependencies(): CliDependencies {
+  return {
+    registry: REGISTRY,
+    config: CONFIG,
+    runCurl: curlRun,
+    confirm: defaultConfirm,
+    exit: (code: number) => process.exit(code),
+    log: (message: string) => {
+      console.log(message);
+    },
+    errorLog: (message: string) => {
+      console.error(message);
+    },
+  };
+}
+
+function filterPassthroughFlags(args: string[]): string[] {
+  return args.filter((arg) => !CURL_PASSTHROUGH_FLAGS.has(arg));
+}
+
+export function extractUrlFromCurlArguments(args: string[]): string | null {
+  const filteredArgs = filterPassthroughFlags(args);
+
+  // Simple URL extraction: look for arguments that look like URLs
+  // or parse known curl argument patterns
+  for (let i = 0; i < filteredArgs.length; i++) {
+    const arg = filteredArgs[i];
+    if (arg === undefined) continue;
+
+    // Skip flags and their values
+    if (arg.startsWith('-')) {
+      // Skip flags that take a value
+      if (['-H', '-d', '-X', '-o', '-w', '-u', '-A', '-e', '-b', '-c', '-F', '-T'].includes(arg)) {
+        i++; // Skip the next argument which is the value
+      }
+      continue;
+    }
+
+    // This looks like a URL
+    if (arg.startsWith('http://') || arg.startsWith('https://')) {
+      return arg;
+    }
+  }
+
+  return null;
+}
+
+async function defaultConfirm(message: string): Promise<boolean> {
+  const readline = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  return new Promise((resolve) => {
+    readline.question(`${message} (y/N) `, (answer) => {
+      readline.close();
+      resolve(answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
+    });
+  });
+}
+
+async function clearAll(deps: CliDependencies, yes: boolean): Promise<void> {
+  const latchkeyStore = deps.config.credentialStorePath;
+  const browserState = deps.config.browserStatePath;
+
+  const filesToDelete: string[] = [];
+  if (existsSync(latchkeyStore)) {
+    filesToDelete.push(latchkeyStore);
+  }
+  if (existsSync(browserState)) {
+    filesToDelete.push(browserState);
+  }
+
+  if (filesToDelete.length === 0) {
+    deps.log('No files to delete.');
+    return;
+  }
+
+  if (!yes) {
+    deps.log('This will delete the following files:');
+    for (const filePath of filesToDelete) {
+      deps.log(`  ${filePath}`);
+    }
+
+    const confirmed = await deps.confirm('Are you sure you want to continue?');
+    if (!confirmed) {
+      deps.log('Aborted.');
+      deps.exit(1);
+    }
+  }
+
+  for (const filePath of filesToDelete) {
+    unlinkSync(filePath);
+    if (filePath === latchkeyStore) {
+      deps.log(`Deleted credentials store: ${filePath}`);
+    } else {
+      deps.log(`Deleted browser state: ${filePath}`);
+    }
+  }
+}
+
+function createEncryptedStorageFromConfig(config: Config) {
+  return new EncryptedStorage({
+    encryptionKeyOverride: config.encryptionKeyOverride,
+    serviceName: config.serviceName,
+    accountName: config.accountName,
+  });
+}
+
+function clearService(deps: CliDependencies, serviceName: string): void {
+  const service = deps.registry.getByName(serviceName);
+  if (service === null) {
+    deps.errorLog(`Error: Unknown service: ${serviceName}`);
+    deps.errorLog("Use 'latchkey services' to see available services.");
+    deps.exit(1);
+  }
+
+  const encryptedStorage = createEncryptedStorageFromConfig(deps.config);
+  const apiCredentialStore = new ApiCredentialStore(
+    deps.config.credentialStorePath,
+    encryptedStorage
+  );
+  const deleted = apiCredentialStore.delete(serviceName);
+
+  if (deleted) {
+    deps.log(`API credentials for ${serviceName} have been cleared.`);
+  } else {
+    deps.log(`No API credentials found for ${serviceName}.`);
+  }
+}
+
+/**
+ * Register all CLI commands on the given program.
+ */
+export function registerCommands(program: Command, deps: CliDependencies): void {
+  program
+    .command('services')
+    .description('List known and supported third-party services.')
+    .action(() => {
+      const serviceNames = deps.registry.services.map((service) => service.name);
+      deps.log(serviceNames.join(' '));
+    });
+
+  program
+    .command('clear')
+    .description('Clear stored API credentials.')
+    .argument('[service_name]', 'Name of the service to clear API credentials for')
+    .option('-y, --yes', 'Skip confirmation prompt when clearing all data')
+    .action(async (serviceName: string | undefined, options: { yes?: boolean }) => {
+      if (serviceName === undefined) {
+        await clearAll(deps, options.yes ?? false);
+      } else {
+        clearService(deps, serviceName);
+      }
+    });
+
+  program
+    .command('status')
+    .description('Check the API credential status for a service.')
+    .argument('[service_name]', 'Name of the service to check status for')
+    .action((serviceName: string | undefined) => {
+      const encryptedStorage = createEncryptedStorageFromConfig(deps.config);
+      const apiCredentialStore = new ApiCredentialStore(
+        deps.config.credentialStorePath,
+        encryptedStorage
+      );
+
+      if (serviceName === undefined) {
+        for (const service of deps.registry.services) {
+          const apiCredentials = apiCredentialStore.get(service.name);
+          if (apiCredentials === null) {
+            deps.log(`${service.name}: ${ApiCredentialStatus.Missing}`);
+          } else {
+            const status = service.checkApiCredentials(apiCredentials);
+            deps.log(`${service.name}: ${status}`);
+          }
+        }
+        return;
+      }
+
+      const service = deps.registry.getByName(serviceName);
+      if (service === null) {
+        deps.errorLog(`Error: Unknown service: ${serviceName}`);
+        deps.errorLog("Use 'latchkey services' to see available services.");
+        deps.exit(1);
+      }
+
+      const apiCredentials = apiCredentialStore.get(serviceName);
+
+      if (apiCredentials === null) {
+        deps.log(ApiCredentialStatus.Missing);
+        return;
+      }
+
+      const apiCredentialStatus = service.checkApiCredentials(apiCredentials);
+      deps.log(apiCredentialStatus);
+    });
+
+  program
+    .command('login')
+    .description('Login to a service and store the API credentials.')
+    .argument('<service_name>', 'Name of the service to login to')
+    .action(async (serviceName: string) => {
+      const service = deps.registry.getByName(serviceName);
+      if (service === null) {
+        deps.errorLog(`Error: Unknown service: ${serviceName}`);
+        deps.errorLog("Use 'latchkey services' to see available services.");
+        deps.exit(1);
+      }
+
+      const encryptedStorage = createEncryptedStorageFromConfig(deps.config);
+      const apiCredentialStore = new ApiCredentialStore(
+        deps.config.credentialStorePath,
+        encryptedStorage
+      );
+
+      try {
+        const apiCredentials = await service
+          .getSession()
+          .login(encryptedStorage, deps.config.browserStatePath);
+        apiCredentialStore.save(service.name, apiCredentials);
+        deps.log('Done');
+      } catch (error) {
+        if (error instanceof LoginCancelledError) {
+          deps.errorLog('Login cancelled.');
+          deps.exit(1);
+        }
+        if (error instanceof LoginFailedError) {
+          deps.errorLog(error.message);
+          deps.exit(1);
+        }
+        throw error;
+      }
+    });
+
+  program
+    .command('curl')
+    .description('Run curl with API credential injection.')
+    .allowUnknownOption()
+    .allowExcessArguments()
+    .action(async (_options: unknown, command: { args: string[] }) => {
+      const curlArguments = command.args;
+
+      const url = extractUrlFromCurlArguments(curlArguments);
+      if (url === null) {
+        deps.errorLog('Error: Could not extract URL from curl arguments.');
+        deps.exit(1);
+      }
+
+      const service = deps.registry.getByUrl(url);
+      if (service === null) {
+        deps.errorLog(`Error: No service matches URL: ${url}`);
+        deps.exit(1);
+      }
+
+      const encryptedStorage = createEncryptedStorageFromConfig(deps.config);
+      const apiCredentialStore = new ApiCredentialStore(
+        deps.config.credentialStorePath,
+        encryptedStorage
+      );
+      let apiCredentials: ApiCredentials | null = apiCredentialStore.get(service.name);
+
+      if (apiCredentials === null) {
+        try {
+          apiCredentials = await service
+            .getSession()
+            .login(encryptedStorage, deps.config.browserStatePath);
+          apiCredentialStore.save(service.name, apiCredentials);
+        } catch (error) {
+          if (error instanceof LoginCancelledError) {
+            deps.errorLog('Login cancelled.');
+            deps.exit(1);
+          }
+          if (error instanceof LoginFailedError) {
+            deps.errorLog(error.message);
+            deps.exit(1);
+          }
+          throw error;
+        }
+      }
+
+      const allArguments = [...apiCredentials.asCurlArguments(), ...curlArguments];
+      const result = deps.runCurl(allArguments);
+      deps.exit(result.returncode);
+    });
+}