mobbdev 0.0.30 → 0.0.32

package/dist/index.js

@@ -69,6 +69,7 @@ var WEB_APP_URL = envVariables.WEB_APP_URL;
 var API_URL = envVariables.API_URL;
 
 // src/features/analysis/index.ts
+import crypto from "node:crypto";
 import fs3 from "node:fs";
 import path5 from "node:path";
 
@@ -408,6 +409,20 @@ var CREATE_COMMUNITY_USER = gql`
     }
   }
 `;
+var CREATE_CLI_LOGIN = gql`
+  mutation CreateCliLogin($publicKey: String!) {
+    insert_cli_login_one(object: { publicKey: $publicKey }) {
+      id
+    }
+  }
+`;
+var PERFORM_CLI_LOGIN = gql`
+  mutation performCliLogin($loginId: String!) {
+    performCliLogin(loginId: $loginId) {
+      status
+    }
+  }
+`;
 
 // src/features/analysis/graphql/queries.ts
 import { gql as gql2 } from "graphql-request";
@@ -434,6 +449,13 @@ var GET_ORG_AND_PROJECT_ID = gql2`
     }
   }
 `;
+var GET_ENCRYPTED_API_TOKEN = gql2`
+  query GetEncryptedApiToken($loginId: uuid!) {
+    cli_login_by_pk(id: $loginId) {
+      encryptedApiToken
+    }
+  }
+`;
 
 // src/features/analysis/graphql/types.ts
 import { z as z3 } from "zod";
@@ -487,22 +509,40 @@ var GetOrgAndProjectIdQueryZ = z3.object({
     })
   ).nonempty()
 });
+var CreateCliLoginZ = z3.object({
+  insert_cli_login_one: z3.object({
+    id: z3.string()
+  })
+});
+var GetEncryptedApiTokenZ = z3.object({
+  cli_login_by_pk: z3.object({
+    encryptedApiToken: z3.string().nullable()
+  })
+});
 
 // src/features/analysis/graphql/gql.ts
 var debug5 = Debug5("mobbdev:gql");
 var GQLClient = class {
   constructor(args) {
-    const { token, apiKey } = args;
-    debug5(`init with apiKey ${apiKey} token ${token}`);
-    const headers = apiKey ? { "x-mobb-key": apiKey } : {
-      authorization: `Bearer ${token}`
-    };
-    this._client = new GraphQLClient(API_URL, { headers });
+    const { apiKey } = args;
+    debug5(`init with apiKey ${apiKey}`);
+    this._client = new GraphQLClient(API_URL, {
+      headers: { "x-mobb-key": apiKey || "" }
+    });
   }
   async getUserInfo() {
     const { me } = await this._client.request(ME);
     return me;
   }
+  async createCliLogin(variables) {
+    const res = CreateCliLoginZ.parse(
+      await this._client.request(
+        CREATE_CLI_LOGIN,
+        variables
+      )
+    );
+    return res.insert_cli_login_one.id;
+  }
   async verifyToken() {
     await this.createCommunityUser();
     try {
@@ -526,6 +566,13 @@ var GQLClient = class {
       projectId: org.projects[0].id
     };
   }
+  async getEncryptedApiToken(variables) {
+    const res = await this._client.request(
+      GET_ENCRYPTED_API_TOKEN,
+      variables
+    );
+    return GetEncryptedApiTokenZ.parse(res).cli_login_by_pk.encryptedApiToken;
+  }
   async createCommunityUser() {
     try {
       await this._client.request(CREATE_COMMUNITY_USER);
@@ -761,6 +808,8 @@ var { CliError: CliError2, Spinner: Spinner2, keypress: keypress2, getDirName: g
 var webLoginUrl = `${WEB_APP_URL}/cli-login`;
 var githubSubmitUrl = `${WEB_APP_URL}/gh-callback`;
 var githubAuthUrl = `${WEB_APP_URL}/github-auth`;
+var LOGIN_MAX_WAIT = 10 * 60 * 1e3;
+var LOGIN_CHECK_DELAY = 5 * 1e3;
 var MOBB_LOGIN_REQUIRED_MSG = `\u{1F513} Login to Mobb is Required, you will be redirected to our login page, once the authorization is complete return to this prompt, ${chalk3.bgBlue(
   "press any key to continue"
 )};`;
@@ -781,7 +830,7 @@ if (!semver.satisfies(process.version, packageJson.engines.node)) {
     `${packageJson.name} requires node version ${packageJson.engines.node}, but running ${process.version}.`
   );
 }
-var config2 = new Configstore(packageJson.name, { token: "" });
+var config2 = new Configstore(packageJson.name, { apiToken: "" });
 debug9("config %o", config2);
 async function runAnalysis(params, options) {
   try {
@@ -809,10 +858,9 @@ async function _scan({
   debug9("start %s %s", dirname, repo);
   const { createSpinner: createSpinner3 } = Spinner2({ ci });
   skipPrompts = skipPrompts || ci;
-  let token = config2.get("token");
-  debug9("token %s", token);
-  apiKey ?? debug9("token %s", apiKey);
-  let gqlClient = new GQLClient(apiKey ? { apiKey } : { token });
+  let gqlClient = new GQLClient({
+    apiKey: apiKey || config2.get("apiToken")
+  });
   await handleMobbLogin();
   const { projectId, organizationId } = await gqlClient.getOrgAndProjectId();
   const {
@@ -836,8 +884,8 @@ async function _scan({
         `Cannot access repo ${repo} with the provided token, please visit ${githubAuthUrl} to refresh your Github token`
       );
     }
-    const { token: token2 } = await handleGithubIntegration();
-    githubToken = token2;
+    const { token } = await handleGithubIntegration();
+    githubToken = token;
   }
   const reference = ref ?? (await getRepo(repo, { token: githubToken })).data.default_branch;
   debug9("org id %s", organizationId);
@@ -907,41 +955,67 @@ async function _scan({
     );
   }
   async function handleMobbLogin() {
-    if (token && await gqlClient.verifyToken() || apiKey && await gqlClient.verifyToken()) {
+    if (await gqlClient.verifyToken()) {
       createSpinner3().start().success({
         text: "\u{1F513} Logged in to Mobb successfully"
       });
       return;
-    }
-    if (apiKey && !await gqlClient.verifyToken()) {
+    } else if (apiKey) {
       createSpinner3().start().error({
         text: "\u{1F513} Logged in to Mobb failed - check your api-key"
       });
       throw new CliError2();
     }
-    const mobbLoginSpinner = createSpinner3().start();
+    const loginSpinner = createSpinner3().start();
     if (!skipPrompts) {
-      mobbLoginSpinner.update({ text: MOBB_LOGIN_REQUIRED_MSG });
+      loginSpinner.update({ text: MOBB_LOGIN_REQUIRED_MSG });
       await keypress2();
     }
-    mobbLoginSpinner.update({
+    loginSpinner.update({
       text: "\u{1F513} Waiting for Mobb login..."
     });
-    const loginResponse = await callbackServer({
-      url: webLoginUrl,
-      redirectUrl: `${webLoginUrl}?done=true`
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("rsa", {
+      modulusLength: 2048
+    });
+    const loginId = await gqlClient.createCliLogin({
+      publicKey: publicKey.export({ format: "pem", type: "pkcs1" }).toString()
     });
-    token = loginResponse.token;
-    gqlClient = new GQLClient({ token });
-    if (!await gqlClient.verifyToken()) {
-      mobbLoginSpinner.error({
+    const browserUrl = `${webLoginUrl}/${loginId}`;
+    !ci && console.log(
+      `If the page does not open automatically, kindly access it through ${browserUrl}.`
+    );
+    await open3(browserUrl);
+    let newApiToken = null;
+    for (let i = 0; i < LOGIN_MAX_WAIT / LOGIN_CHECK_DELAY; i++) {
+      const encryptedApiToken = await gqlClient.getEncryptedApiToken({
+        loginId
+      });
+      loginSpinner.spin();
+      if (encryptedApiToken) {
+        debug9("encrypted API token received %s", encryptedApiToken);
+        newApiToken = crypto.privateDecrypt(privateKey, Buffer.from(encryptedApiToken, "base64")).toString("utf-8");
+        debug9("API token decrypted");
+        break;
+      }
+      await sleep(LOGIN_CHECK_DELAY);
+    }
+    if (!newApiToken) {
+      loginSpinner.error({
+        text: "Login timeout error"
+      });
+      throw new CliError2();
+    }
+    gqlClient = new GQLClient({ apiKey: newApiToken });
+    if (await gqlClient.verifyToken()) {
+      debug9("set api token %s", newApiToken);
+      config2.set("apiToken", newApiToken);
+      loginSpinner.success({ text: "\u{1F513} Login to Mobb successful!" });
+    } else {
+      loginSpinner.error({
         text: "Something went wrong, API token is invalid."
       });
       throw new CliError2();
     }
-    debug9("set token %s", token);
-    config2.set("token", token);
-    mobbLoginSpinner.success({ text: "\u{1F513} Login to Mobb successful!" });
   }
   async function handleGithubIntegration() {
     const addGithubIntegration = skipPrompts ? true : await githubIntegrationPrompt();
@@ -976,7 +1050,7 @@ async function _scan({
         uploadKey: reportUploadInfo.uploadKey
       });
     } catch (e) {
-      uploadReportSpinner2.error({ text: "\u{1F4C1} Repo upload failed" });
+      uploadReportSpinner2.error({ text: "\u{1F4C1} Report upload failed" });
       throw e;
     }
     uploadReportSpinner2.success({
@@ -991,7 +1065,7 @@ async function _scan({
         uploadKey: repoUploadInfo.uploadKey
       });
     } catch (e) {
-      uploadRepoSpinner.error({ text: "\u{1F4C1} Report upload failed" });
+      uploadRepoSpinner.error({ text: "\u{1F4C1} Repo upload failed" });
       throw e;
     }
     uploadRepoSpinner.success({ text: "\u{1F4C1} Uploading Repo successful!" });
@@ -1081,6 +1155,15 @@ var ciOption = {
   type: "boolean",
   default: false
 };
+var apiKeyOption = {
+  type: "string",
+  describe: chalk4.bold("Mobb authentication api-key")
+};
+var commitHashOption = {
+  alias: "ch",
+  describe: chalk4.bold("Hash of the commit"),
+  type: "string"
+};
 
 // src/args/validation.ts
 import chalk5 from "chalk";
@@ -1157,7 +1240,7 @@ function analyzeBuilder(yargs2) {
     alias: "commit-hash",
     describe: chalk6.bold("Hash of the commit"),
     type: "string"
-  }).option("y", yesOption).option("ci", ciOption).example(
+  }).option("y", yesOption).option("ci", ciOption).option("api-key", apiKeyOption).option("commit-hash", commitHashOption).example(
     "$0 analyze -r https://github.com/WebGoat/WebGoat -f <your_vulirabitliy_report_path>",
     "analyze an existing repository"
   ).help();
@@ -1190,7 +1273,7 @@ function scanBuilder(args) {
     alias: "scanner",
     choices: Object.values(SCANNERS),
     describe: chalk7.bold("Select the scanner to use")
-  }).option("y", yesOption).option("ci", ciOption).example(
+  }).option("y", yesOption).option("ci", ciOption).option("api-key", apiKeyOption).example(
     "$0 scan -r https://github.com/WebGoat/WebGoat",
     "Scan an existing repository"
   ).help();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "0.0.30",
+  "version": "0.0.32",
   "description": "Automated secure code remediation tool",
   "repository": "https://github.com/mobb-dev/bugsy",
   "main": "dist/index.js",
@@ -13,7 +13,7 @@
     "lint": "eslint --cache --max-warnings 0 --ignore-path .eslintignore --ext .ts,.tsx,.jsx .",
     "lint:fix": "eslint --fix --cache --max-warnings 0 --ignore-path .eslintignore --ext .js,.ts,.tsx,.jsx .",
     "lint:fix:files": "eslint --fix --cache --max-warnings 0 --ignore-path .eslintignore --ext .js,.ts,.tsx,.jsx",
-    "prepack": "pnpm build && dotenv-vault pull production .env"
+    "prepack": "dotenv-vault pull production .env && pnpm build"
   },
   "bin": {
     "mobbdev": "bin/cli.mjs"