pal-explorer-cli 0.4.0

package/lib/commands/su.js

@@ -0,0 +1,187 @@
+import chalk from 'chalk';
+import readline from 'readline';
+import config from '../utils/config.js';
+import { setSuToken, hasSuToken, authenticate, isAuthenticated, requireSu, removeSuToken } from '../core/su.js';
+import { getPrimaryServer, getServers, addServer as addDiscoveryServer, removeServer as removeDiscoveryServer, setPrimaryServer, addUserServer } from '../core/discoveryClient.js';
+import { refreshServerList, healthCheckServers, getServerRoles, SERVER_ROLES, isWriteTrusted } from '../core/serverList.js';
+import { parseCommaList } from '../utils/cli.js';
+
+function prompt(question, { hidden = false } = {}) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  if (hidden) {
+    const origWrite = process.stdout.write.bind(process.stdout);
+    process.stdout.write = (s) => {
+      if (s === question) return origWrite(s);
+      return origWrite('');
+    };
+    return new Promise(resolve => rl.question(question, answer => {
+      process.stdout.write = origWrite;
+      origWrite('\n');
+      rl.close();
+      resolve(answer.trim());
+    }));
+  }
+  return new Promise(resolve => rl.question(question, answer => { rl.close(); resolve(answer.trim()); }));
+}
+
+function confirm(question) {
+  return prompt(question).then(a => a.toLowerCase() === 'y');
+}
+
+export default function suCommand(program) {
+  const su = program.command('su').description('super user commands (network-level administration)');
+
+  su.addHelpText('after', `
+The super user (SU) controls the discovery server network.
+SU is separate from the local device owner role.
+
+Setup:
+  $ pe su setup                       Set the SU token (first time only)
+  $ pe su auth                        Authenticate for this session
+
+Server management:
+  $ pe su server add <url>            Add a server to the network
+  $ pe su server remove <url>         Remove a server
+  $ pe su server set-primary <url>    Change primary server
+
+Other:
+  $ pe su reset                       Remove the SU token
+`);
+
+  su
+    .command('setup')
+    .description('set the super user token (first time or reset)')
+    .action(async () => {
+      if (hasSuToken()) {
+        const current = await prompt('Enter current SU token: ', { hidden: true });
+        if (!authenticate(current)) {
+          console.log(chalk.red('Invalid SU token.'));
+          return;
+        }
+      }
+      const token = await prompt('Enter new SU token: ', { hidden: true });
+      if (!token || token.length < 8) {
+        console.log(chalk.red('Token must be at least 8 characters.'));
+        return;
+      }
+      const confirm2 = await prompt('Confirm SU token: ', { hidden: true });
+      if (token !== confirm2) {
+        console.log(chalk.red('Tokens do not match.'));
+        return;
+      }
+      setSuToken(token);
+      authenticate(token);
+      console.log(chalk.green('SU token set and authenticated for this session.'));
+    });
+
+  su
+    .command('auth')
+    .description('authenticate as super user for this session')
+    .action(async () => {
+      if (!hasSuToken()) {
+        console.log(chalk.red('No SU token configured. Run "pe su setup" first.'));
+        return;
+      }
+      if (isAuthenticated()) {
+        console.log(chalk.green('Already authenticated as SU.'));
+        return;
+      }
+      const token = await prompt('SU token: ', { hidden: true });
+      if (authenticate(token)) {
+        console.log(chalk.green('Authenticated as super user.'));
+      } else {
+        console.log(chalk.red('Invalid SU token.'));
+      }
+    });
+
+  su
+    .command('reset')
+    .description('remove the SU token')
+    .action(async () => {
+      if (!hasSuToken()) {
+        console.log(chalk.yellow('No SU token is set.'));
+        return;
+      }
+      const token = await prompt('Enter current SU token to confirm: ', { hidden: true });
+      if (!authenticate(token)) {
+        console.log(chalk.red('Invalid SU token.'));
+        return;
+      }
+      removeSuToken();
+      console.log(chalk.green('SU token removed.'));
+    });
+
+  // Server management subcommands
+  const server = su.command('server').description('manage discovery servers (SU only)');
+
+  server
+    .command('add <url>')
+    .description('add a discovery server to the network')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--skip-verify', 'Skip server verification (not recommended)')
+    .option('--read-only', 'Add as read-only (no writes sent to this server)')
+    .option('--roles <roles>', 'Comma-separated roles (discovery,signaling,turn,stun,relay,billing)')
+    .action(async (url, opts) => {
+      try { requireSu(); } catch (e) { console.log(chalk.red(e.message)); return; }
+      const roles = parseCommaList(opts.roles).filter(r => SERVER_ROLES.includes(r));
+      const trustWrites = !opts.readOnly;
+
+      if (opts.skipVerify) {
+        addDiscoveryServer(url, { skipVerify: true });
+        if (roles.length > 0) {
+          await addUserServer(url, roles, { trustWrites });
+        }
+        console.log(chalk.yellow('Added without verification (no pinned key).'));
+        return;
+      }
+
+      try {
+        console.log(chalk.blue(`Verifying server at ${url}...`));
+        const result = await addDiscoveryServer(url);
+        console.log('');
+        console.log(chalk.white(`  Server key fingerprint: ${chalk.cyan(result.fingerprint)}`));
+        console.log(chalk.gray(`  Trust: ${trustWrites ? 'read + write' : 'read-only'}`));
+        console.log('');
+
+        if (!opts.yes) {
+          const ok = await confirm(chalk.white('  Trust this server and add it? (y/N) '));
+          if (!ok) {
+            removeDiscoveryServer(url);
+            const pinned = config.get('pinnedServerKeys') || {};
+            delete pinned[url.replace(/\/+$/, '')];
+            config.set('pinnedServerKeys', pinned);
+            console.log(chalk.yellow('  Aborted.'));
+            return;
+          }
+        }
+
+        const roleResult = await addUserServer(url, roles, { trustWrites });
+        console.log(chalk.green(`Added server: ${url}`));
+        console.log(chalk.gray(`  Roles: ${roleResult.roles.join(', ')}`));
+        console.log(chalk.gray(`  Trust: ${trustWrites ? 'read + write' : 'read-only'}`));
+        console.log(chalk.gray(`  Key pinned. Run 'pe server verify' to re-check.`));
+      } catch (err) {
+        console.log(chalk.red(`${err.message}`));
+      }
+    });
+
+  server
+    .command('remove <url>')
+    .description('remove a discovery server from the network')
+    .action((url) => {
+      try { requireSu(); } catch (e) { console.log(chalk.red(e.message)); return; }
+      const servers = removeDiscoveryServer(url);
+      console.log(chalk.green(`Removed: ${url}`));
+      console.log(chalk.gray(`  Remaining: ${servers.length}`));
+    });
+
+  server
+    .command('set-primary <url>')
+    .description('set a discovery server as the primary')
+    .action((url) => {
+      try { requireSu(); } catch (e) { console.log(chalk.red(e.message)); return; }
+      const servers = setPrimaryServer(url);
+      console.log(chalk.green(`Primary set to: ${url}`));
+      console.log(chalk.gray(`  Order: ${servers.join(', ')}`));
+    });
+}