myapi-vault-cli 0.1.0

package/README.md

@@ -0,0 +1,73 @@
+# myapi-vault-cli
+
+One-command access to your self-hosted **MyApi** credential vault from any machine. Browser login, ASC-signed requests (bypass per-device approval), and simple `get`/`put` of secrets — no manual env vars.
+
+## Install
+
+```bash
+npm install -g myapi-vault-cli
+```
+
+Requires Node ≥ 18. For per-user Cloudflare Access SSO, install [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) (optional; a shared service token also works).
+
+## Login
+
+```bash
+myapi login
+```
+
+`login` is **100% browser by default** — no secrets, no env vars:
+
+1. **Cloudflare Access** — opens browser SSO via `cloudflared` (install once: `brew install cloudflared` / [downloads](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/)). Use `--cf-token` for a shared service token instead.
+2. **App token** — a device-flow code you approve in the dashboard (no paste). Use `--paste` to supply an existing token instead.
+3. **ASC key** — generates + registers an Ed25519 identity so future requests skip per-device approval (approve it once under Devices).
+
+Config is cached at `~/.config/myapi/config.json` (mode 600). Approve the ASC device once in your MyApi dashboard when prompted.
+
+## Use
+
+```bash
+myapi whoami                                  # verify identity
+myapi list                                    # list stored entries
+myapi put "OpenAI" "sk-..." https://api.openai.com openai
+myapi get openai                              # reveal by label/service
+myapi reveal <id>                             # reveal by id
+myapi del <id>                                # delete
+myapi logout                                  # clear local config
+```
+
+## Reading a secret in scripts
+
+```bash
+KEY=$(myapi get openai | node -pe 'JSON.parse(require("fs").readFileSync(0)).token')
+```
+
+## Flags
+
+| Flag | Effect |
+|------|--------|
+| `--cf-token` | Use a Cloudflare Access **service token** instead of `cloudflared` browser SSO. |
+| `--paste` | Paste an existing MyApi token instead of the browser device flow. |
+
+With `--cf-token`, set the service-token credentials via env (recommended over the prompt):
+
+```bash
+export MYAPI_CF_CLIENT_ID='<...>.access'
+export MYAPI_CF_CLIENT_SECRET='<...>'
+myapi login --cf-token
+```
+
+## Env
+
+- `MYAPI_CONFIG_DIR` — override `~/.config/myapi`.
+- `MYAPI_CF_CLIENT_ID` / `MYAPI_CF_CLIENT_SECRET` — Cloudflare Access service token (for `--cf-token`).
+
+## Security
+
+- Your token + ASC key live only in `~/.config/myapi/` (0600). Keep to trusted machines.
+- The MyApi vault is full-access per token; each engineer should use their **own** token (revoke individually).
+- No secrets are printed to logs.
+
+## License
+
+MIT

package/bin/myapi.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+// myapi — CLI for the self-hosted MyApi credential vault.
+const config = require('../lib/config');
+const vault = require('../lib/vault');
+const { login } = require('../lib/login');
+
+const HELP = `myapi — cliente de tu bóveda MyApi
+
+Uso:
+  myapi login [--paste] [--cf-token]      Inicia sesión (100% navegador por defecto)
+  myapi whoami                            Verifica identidad
+  myapi list                              Lista tus claves guardadas
+  myapi get <label|service>               Revela una clave por nombre/servicio
+  myapi reveal <id>                       Revela una clave por id
+  myapi put <name> <secret> <url> [svc]   Guarda una clave
+  myapi del <id>                          Borra una clave
+  myapi logout                            Borra la config local
+
+Login (por defecto: navegador vía cloudflared + aprobación en el dashboard):
+  --cf-token    Usa un CF service-token (env/prompt) en vez del SSO de cloudflared
+  --paste       Pega un token existente en vez del device flow
+
+Env: MYAPI_CONFIG_DIR sobreescribe ~/.config/myapi`;
+
+function out(x) { console.log(typeof x === 'string' ? x : JSON.stringify(x, null, 2)); }
+function die(m) { console.error(`error: ${m}`); process.exit(1); }
+
+async function main() {
+  const [cmd, ...rest] = process.argv.slice(2);
+  const flags = new Set(rest.filter((a) => a.startsWith('--')));
+  const args = rest.filter((a) => !a.startsWith('--'));
+
+  if (!cmd || cmd === 'help' || flags.has('--help')) return out(HELP);
+  if (cmd === 'login') {
+    return login({ paste: flags.has('--paste'), cf: flags.has('--cf-token') ? 'service-token' : undefined });
+  }
+  if (cmd === 'logout') { config.clear(); return out('✓ sesión borrada'); }
+
+  const cfg = config.load();
+  if (!cfg.token) die('no has iniciado sesión — corre: myapi login');
+
+  switch (cmd) {
+    case 'whoami': return out(await vault.whoami(cfg));
+    case 'list': return out(await vault.list(cfg));
+    case 'get': if (!args[0]) die('uso: myapi get <label|service>'); return out(await vault.get(cfg, args[0]));
+    case 'reveal': if (!args[0]) die('uso: myapi reveal <id>'); return out(await vault.reveal(cfg, args[0]));
+    case 'put': if (args.length < 3) die('uso: myapi put <name> <secret> <url> [service]'); return out(await vault.put(cfg, args[0], args[1], args[2], args[3]));
+    case 'del': if (!args[0]) die('uso: myapi del <id>'); return out(await vault.del(cfg, args[0]));
+    default: die(`comando desconocido: ${cmd}\n\n${HELP}`);
+  }
+}
+
+main().catch((e) => die(e.message));

package/lib/asc.js

@@ -0,0 +1,33 @@
+// ASC (Agentic Secure Connection): Ed25519 identity that lets signed requests
+// bypass MyApi's per-device approval. Server verifies sign("<ts>:<tokenId>").
+const crypto = require('crypto');
+const os = require('os');
+
+// Generate a keypair in the exact shape MyApi expects: a PKCS8 PEM private key
+// and the raw 32-byte Ed25519 public key, base64-encoded.
+function generateKeypair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+  const spkiDer = publicKey.export({ type: 'spki', format: 'der' });
+  const pubKeyB64 = spkiDer.subarray(spkiDer.length - 32).toString('base64');
+  return { privateKeyPem, pubKeyB64 };
+}
+
+// Build the X-Agent-* headers for this instant. Returns {} if no usable key,
+// so the same request path works before ASC is set up (falls back to approval).
+function ascHeaders(asc) {
+  if (!asc || !asc.privateKeyPem || !asc.tokenId) return {};
+  const ts = String(Math.floor(Date.now() / 1000));
+  const sig = crypto.sign(null, Buffer.from(`${ts}:${asc.tokenId}`), crypto.createPrivateKey(asc.privateKeyPem));
+  return {
+    'X-Agent-PublicKey': asc.pubKeyB64,
+    'X-Agent-Timestamp': ts,
+    'X-Agent-Signature': sig.toString('base64'),
+  };
+}
+
+function defaultLabel() {
+  return `myapi-cli @ ${os.hostname()}`;
+}
+
+module.exports = { generateKeypair, ascHeaders, defaultLabel };

package/lib/cf.js

@@ -0,0 +1,37 @@
+// Cloudflare Access layer. MyApi sits behind CF Access, so every request must
+// pass the edge. Two modes:
+//   - 'cloudflared'   : per-user browser SSO; a short-lived JWT via the cloudflared CLI
+//   - 'service-token' : static shared Client-Id/Secret headers (admin fallback)
+const { execFileSync } = require('child_process');
+
+function cfHeaders(cfg) {
+  const cf = cfg.cf || {};
+  if (cf.mode === 'service-token') {
+    return {
+      'CF-Access-Client-Id': cf.clientId || '',
+      'CF-Access-Client-Secret': cf.clientSecret || '',
+    };
+  }
+  if (cf.mode === 'cloudflared') {
+    try {
+      const jwt = execFileSync('cloudflared', ['access', 'token', `-app=${cfg.base}`], { encoding: 'utf8' }).trim();
+      if (!jwt) throw new Error('empty token');
+      return { 'cf-access-token': jwt };
+    } catch (e) {
+      throw new Error(`cloudflared token failed — run \`cloudflared access login ${cfg.base}\` or \`myapi login\` again. (${String(e.message).split('\n')[0]})`);
+    }
+  }
+  return {};
+}
+
+// One-time interactive browser SSO for the Access app.
+function cloudflaredLogin(base) {
+  execFileSync('cloudflared', ['access', 'login', base], { stdio: 'inherit' });
+}
+
+function hasCloudflared() {
+  try { execFileSync('cloudflared', ['--version'], { stdio: 'ignore' }); return true; }
+  catch { return false; }
+}
+
+module.exports = { cfHeaders, cloudflaredLogin, hasCloudflared };

package/lib/config.js

@@ -0,0 +1,29 @@
+// Local config for the myapi CLI. Stored at ~/.config/myapi/config.json (0600).
+// Holds: base URL, app token, ASC keypair, and the Cloudflare Access mode.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const DIR = process.env.MYAPI_CONFIG_DIR || path.join(os.homedir(), '.config', 'myapi');
+const FILE = path.join(DIR, 'config.json');
+const DEFAULT_BASE = 'https://myapi.boxlab.cloud';
+
+function load() {
+  try {
+    return JSON.parse(fs.readFileSync(FILE, 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+function save(cfg) {
+  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(FILE, JSON.stringify(cfg, null, 2), { mode: 0o600 });
+  return FILE;
+}
+
+function clear() {
+  try { fs.unlinkSync(FILE); } catch { /* already gone */ }
+}
+
+module.exports = { load, save, clear, FILE, DIR, DEFAULT_BASE };

package/lib/http.js

@@ -0,0 +1,40 @@
+// Single authenticated request path for every MyApi call.
+// Layers all three auth headers: Cloudflare Access + Bearer token + ASC signature.
+const http = require('http');
+const https = require('https');
+const { cfHeaders } = require('./cf');
+const { ascHeaders } = require('./asc');
+
+function request(cfg, method, path, bodyObj) {
+  const url = new URL(cfg.base + path);
+  const headers = { Accept: 'application/json', ...cfHeaders(cfg), ...ascHeaders(cfg.asc) };
+  if (cfg.token) headers.Authorization = `Bearer ${cfg.token}`;
+
+  let payload;
+  if (bodyObj !== undefined) {
+    payload = JSON.stringify(bodyObj);
+    headers['Content-Type'] = 'application/json';
+    headers['Content-Length'] = Buffer.byteLength(payload);
+  }
+
+  const lib = url.protocol === 'http:' ? http : https;
+  return new Promise((resolve, reject) => {
+    const req = lib.request(
+      { hostname: url.hostname, port: url.port || undefined, path: url.pathname + url.search, method, headers },
+      (res) => {
+        let data = '';
+        res.on('data', (c) => { data += c; });
+        res.on('end', () => {
+          let body;
+          try { body = data ? JSON.parse(data) : {}; } catch { body = { raw: data }; }
+          resolve({ status: res.statusCode, body });
+        });
+      }
+    );
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+module.exports = { request };

package/lib/login.js

@@ -0,0 +1,119 @@
+// Login flows:
+//   v1 (paste)       : paste an existing MyApi token once; CLI auto-registers ASC.
+//   v2 (device flow) : browser approval, no paste; needs the MyApi /device/authorize patch.
+// Both end by registering a fresh ASC key so future requests skip device approval.
+const readline = require('readline');
+const os = require('os');
+const { request } = require('./http');
+const config = require('./config');
+const asc = require('./asc');
+const cf = require('./cf');
+
+function prompt(question, hidden = false) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    rl.question(question, (answer) => {
+      if (hidden) process.stdout.write('\n');
+      rl.close();
+      resolve(answer.trim());
+    });
+    if (hidden) rl._writeToOutput = () => {}; // suppress echo of the secret
+  });
+}
+
+// Generate + register a fresh ASC keypair against the current token.
+// asc/register is device-approval-exempt and returns our own token_id, so this
+// works on a brand-new machine with no prior approval.
+async function registerAsc(cfg) {
+  const kp = asc.generateKeypair();
+  const reg = await request({ ...cfg, asc: null }, 'POST', '/api/v1/agentic/asc/register', {
+    public_key: kp.pubKeyB64,
+    label: asc.defaultLabel(),
+  });
+  if (reg.status >= 300 && reg.status !== 202) {
+    throw new Error(`asc/register failed (HTTP ${reg.status}): ${JSON.stringify(reg.body).slice(0, 200)}`);
+  }
+  const tokenId = reg.body.token_id;
+  if (!tokenId) throw new Error('asc/register did not return token_id — MyApi server patch missing');
+  const fingerprint = reg.body.key_fingerprint || null;
+  const alreadyApproved = reg.body.status === 'already_approved';
+  return { ...kp, tokenId, fingerprint, alreadyApproved };
+}
+
+// v2: OAuth 2.0 device grant. Requires MyApi to expose /device/authorize publicly.
+async function deviceFlow(cfg) {
+  const authz = await request(cfg, 'POST', '/api/v1/agentic/device/authorize', { label: asc.defaultLabel() });
+  if (authz.status >= 300) {
+    throw new Error(`device flow unavailable (HTTP ${authz.status}) — needs MyApi v2 patch. Use paste login instead.`);
+  }
+  const a = authz.body;
+  const uri = a.verification_uri_complete || a.verification_uri;
+  const interval = (a.interval || 5) * 1000;
+  const deadline = Date.now() + (a.expires_in || 900) * 1000;
+  console.log(`\n  Abre en tu navegador:  ${uri}`);
+  console.log(`  Código:                ${a.user_code}\n  Esperando aprobación…`);
+
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, interval));
+    const tok = await request(cfg, 'POST', '/api/v1/agentic/device/token', { device_code: a.device_code });
+    const token = tok.body.access_token || tok.body.token || (tok.body.data && tok.body.data.token);
+    if (tok.status === 200 && token) return token;
+    const err = tok.body && tok.body.error;
+    if (err && !/pending|slow_down/i.test(err)) throw new Error(`device/token: ${err}`);
+  }
+  throw new Error('device flow timed out');
+}
+
+async function login(opts = {}) {
+  const cfg = config.load();
+  cfg.base = opts.base || cfg.base || config.DEFAULT_BASE;
+
+  // 1) Cloudflare Access — default is browser SSO via cloudflared (no shared secret).
+  //    --cf-token switches to a static service token (env or prompt).
+  if (opts.cf === 'service-token') {
+    console.log('→ Cloudflare Access (service token)');
+    let clientId = process.env.MYAPI_CF_CLIENT_ID;
+    let clientSecret = process.env.MYAPI_CF_CLIENT_SECRET;
+    if (!clientId) clientId = await prompt('  CF-Access-Client-Id: ');
+    if (!clientSecret) clientSecret = await prompt('  CF-Access-Client-Secret: ', true);
+    if (!clientId || !clientSecret) throw new Error('faltan CF-Access-Client-Id/Secret');
+    cfg.cf = { mode: 'service-token', clientId: clientId.trim(), clientSecret: clientSecret.trim() };
+  } else {
+    if (!cf.hasCloudflared()) {
+      throw new Error(
+        'Necesitas cloudflared para el login por navegador. Instálalo:\n' +
+        '    macOS:  brew install cloudflared\n' +
+        '    Linux:  https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/\n' +
+        '  (o usa un token de servicio:  myapi login --cf-token)'
+      );
+    }
+    console.log(`→ Cloudflare Access: abriendo tu navegador para iniciar sesión (${cfg.base}) …`);
+    cf.cloudflaredLogin(cfg.base);
+    cfg.cf = { mode: 'cloudflared' };
+  }
+
+  // 2) App token — default is the browser device flow; --paste uses an existing token.
+  if (opts.paste) {
+    cfg.token = await prompt('  Pega tu token de MyApi: ', true);
+  } else {
+    console.log('→ Aprobación por navegador (device flow)…');
+    cfg.token = await deviceFlow(cfg);
+  }
+  if (!cfg.token) throw new Error('token vacío');
+
+  // 3) Auto-ASC (bypass device approval from any machine)
+  console.log('→ Registrando llave ASC…');
+  cfg.asc = await registerAsc(cfg);
+
+  const file = config.save(cfg);
+  console.log(`\n✓ Sesión guardada en ${file}`);
+  if (cfg.asc.alreadyApproved) {
+    console.log('  Llave ASC ya aprobada — listo.');
+  } else if (cfg.asc.fingerprint) {
+    console.log(`  Aprueba esta llave 1 vez en el dashboard (${cfg.base}/dashboard → Devices/Approvals):`);
+    console.log(`    ${cfg.asc.fingerprint}`);
+  }
+  console.log('  Prueba:  myapi whoami');
+}
+
+module.exports = { login, registerAsc, deviceFlow };

package/lib/vault.js

@@ -0,0 +1,47 @@
+// Vault operations. Every endpoint here is master/full-scope only on the server.
+const { request } = require('./http');
+
+function ok(r, what) {
+  if (r.status >= 200 && r.status < 300) return r.body;
+  const msg = (r.body && (r.body.error || r.body.message)) || JSON.stringify(r.body);
+  throw new Error(`${what} failed (HTTP ${r.status}): ${msg}`);
+}
+
+async function whoami(cfg) {
+  const b = ok(await request(cfg, 'GET', '/api/v1/gateway/context'), 'whoami');
+  return b.data || b;
+}
+
+async function list(cfg) {
+  const b = ok(await request(cfg, 'GET', '/api/v1/vault/tokens'), 'list');
+  return b.data || b.tokens || b;
+}
+
+async function put(cfg, name, secret, url, service) {
+  const body = { name, token: secret, websiteUrl: url, ...(service ? { service } : {}) };
+  const b = ok(await request(cfg, 'POST', '/api/v1/vault/tokens', body), 'put');
+  return b.data || b;
+}
+
+async function reveal(cfg, id) {
+  const b = ok(await request(cfg, 'GET', `/api/v1/vault/tokens/${encodeURIComponent(id)}/reveal`), 'reveal');
+  return b.data || b;
+}
+
+async function del(cfg, id) {
+  const b = ok(await request(cfg, 'DELETE', `/api/v1/vault/tokens/${encodeURIComponent(id)}`), 'del');
+  return b.data || b;
+}
+
+// Convenience: find one entry by label/name/service, then reveal its secret.
+async function get(cfg, needle) {
+  const items = await list(cfg);
+  const n = String(needle).toLowerCase();
+  const match = (Array.isArray(items) ? items : []).find(
+    (t) => [t.label, t.name, t.service].some((v) => String(v || '').toLowerCase() === n)
+  );
+  if (!match) throw new Error(`no vault entry matching "${needle}"`);
+  return reveal(cfg, match.id);
+}
+
+module.exports = { whoami, list, put, reveal, del, get };

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "myapi-vault-cli",
+  "version": "0.1.0",
+  "description": "CLI for the self-hosted MyApi credential vault: browser login, ASC-signed access, connect from any machine.",
+  "bin": {
+    "myapi": "bin/myapi.js"
+  },
+  "type": "commonjs",
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "README.md"
+  ],
+  "keywords": [
+    "myapi",
+    "vault",
+    "credentials",
+    "secrets",
+    "cli",
+    "asc",
+    "cloudflare-access"
+  ],
+  "author": "emiliovt3",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/emiliovt3/myapi-vault-cli.git"
+  }
+}