sdtk-kit 0.3.0

package/src/lib/state.js

@@ -0,0 +1,83 @@
+"use strict";
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+function ensureDir(dirPath) {
+  fs.mkdirSync(dirPath, { recursive: true });
+}
+
+function getAuthFile() {
+  return path.join(os.homedir(), ".sdtkrc");
+}
+
+/**
+ * Harden file permissions so only the current user can read/write.
+ * - POSIX: chmod 600
+ * - Windows: icacls to grant only current user Full Control
+ * @returns {boolean} true if hardening succeeded, false otherwise.
+ */
+function hardenFilePermissions(filePath) {
+  try {
+    if (process.platform === "win32") {
+      const username = os.userInfo().username;
+      execFileSync("icacls", [
+        filePath,
+        "/inheritance:r",
+        "/grant:r",
+        `${username}:(F)`,
+      ], { stdio: "ignore" });
+    } else {
+      fs.chmodSync(filePath, 0o600);
+    }
+    return true;
+  } catch (_err) {
+    return false;
+  }
+}
+
+function readAuthState() {
+  const authFile = getAuthFile();
+  if (!fs.existsSync(authFile)) {
+    return { authenticated: false, token: "" };
+  }
+  try {
+    const payload = JSON.parse(fs.readFileSync(authFile, "utf8"));
+    const token = payload.github_token || "";
+    return { authenticated: token.length > 0, token };
+  } catch (_error) {
+    return { authenticated: false, token: "" };
+  }
+}
+
+/**
+ * Write auth state and harden file permissions.
+ * @returns {{ path: string, hardened: boolean }}
+ */
+function writeAuthState(token) {
+  const authFile = getAuthFile();
+  const payload = {
+    github_token: token,
+    updated_at: new Date().toISOString(),
+  };
+  fs.writeFileSync(authFile, JSON.stringify(payload, null, 2), "utf8");
+  const hardened = hardenFilePermissions(authFile);
+  return { path: authFile, hardened };
+}
+
+function clearAuthState() {
+  const authFile = getAuthFile();
+  if (fs.existsSync(authFile)) {
+    fs.unlinkSync(authFile);
+  }
+}
+
+module.exports = {
+  ensureDir,
+  getAuthFile,
+  readAuthState,
+  writeAuthState,
+  clearAuthState,
+};

package/src/lib/toolkit-payload.js

@@ -0,0 +1,99 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const { IntegrityError } = require("./errors");
+
+const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
+const ASSETS_DIR = path.join(PACKAGE_ROOT, "assets", "toolkit");
+const MANIFEST_PATH = path.join(
+  PACKAGE_ROOT,
+  "assets",
+  "manifest",
+  "toolkit-bundle.manifest.json"
+);
+
+/**
+ * Load and parse the toolkit bundle manifest.
+ * @returns {Object} Parsed manifest object.
+ */
+function loadManifest() {
+  if (!fs.existsSync(MANIFEST_PATH)) {
+    throw new IntegrityError(
+      `Toolkit manifest not found: ${MANIFEST_PATH}\n` +
+        'Run "npm run build:payload" to sync toolkit assets.'
+    );
+  }
+  try {
+    const raw = fs.readFileSync(MANIFEST_PATH, "utf-8");
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new IntegrityError(`Failed to parse manifest: ${err.message}`);
+  }
+}
+
+/**
+ * Compute SHA256 hash of a file.
+ * @param {string} filePath
+ * @returns {string} Lowercase hex hash.
+ */
+function hashFile(filePath) {
+  const data = fs.readFileSync(filePath);
+  return crypto.createHash("sha256").update(data).digest("hex");
+}
+
+/**
+ * Verify payload integrity against manifest.
+ * Checks all files exist and SHA256 hashes match.
+ * @throws {IntegrityError} on mismatch or missing file.
+ */
+function verify() {
+  const manifest = loadManifest();
+
+  if (!manifest.files || !Array.isArray(manifest.files)) {
+    throw new IntegrityError("Manifest has no files array.");
+  }
+
+  const errors = [];
+
+  for (const entry of manifest.files) {
+    const filePath = path.join(ASSETS_DIR, entry.path);
+
+    if (!fs.existsSync(filePath)) {
+      errors.push(`MISSING: ${entry.path}`);
+      continue;
+    }
+
+    const actualHash = hashFile(filePath);
+    if (actualHash !== entry.sha256) {
+      errors.push(
+        `HASH MISMATCH: ${entry.path}\n` +
+          `  expected: ${entry.sha256}\n` +
+          `  actual:   ${actualHash}`
+      );
+    }
+  }
+
+  if (errors.length > 0) {
+    throw new IntegrityError(
+      `Toolkit payload integrity check failed:\n${errors.join("\n")}`
+    );
+  }
+}
+
+/**
+ * Resolve absolute path to a file inside the bundled toolkit payload.
+ * @param {string} relativePath - Path relative to assets/toolkit/ (e.g., "toolkit/install.ps1").
+ * @returns {string} Absolute path.
+ */
+function resolvePayloadFile(relativePath) {
+  return path.join(ASSETS_DIR, relativePath);
+}
+
+module.exports = {
+  verify,
+  loadManifest,
+  resolvePayloadFile,
+  ASSETS_DIR,
+};