slidemind 0.2.4 → 0.3.1

package/src/bridge/config.mjs

@@ -14,13 +14,24 @@
 // The legacy v1 shape ({ backendURL, sessionToken }) is migrated transparently
 // on read, so older installs and the raw-file test writers keep working.
 //
+// A record may additionally carry `msGraphRefreshToken` — the user's own Entra
+// refresh token from `slidemind login` (see graph-auth.mjs). It is a SECOND
+// credential with a different subject: the CLI session is minted by the add-in
+// for whoever clicked Connect CLI, the Graph token belongs to whoever completed
+// the browser sign-in. Written only when present, so a machine that never ran
+// `login` keeps a byte-identical file.
+//
 // Stored under XDG_CONFIG_HOME (config, not cache/state) so it persists and is
 // clearly user-scoped. 0600 — it holds bearer credentials.
 
+import { execFileSync } from "node:child_process";
+import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { register as registerSecret } from "./secrets.mjs";
+
 export function sessionConfigDir() {
   // An explicitly set XDG_CONFIG_HOME wins on EVERY platform — it's a
   // deliberate override (and how the test suite isolates the store, also on
@@ -60,6 +71,46 @@ export function deriveEnvLabel(backendURL) {
   return host;
 }
 
+// ---------------------------------------------------------------------------
+// How loudly to talk about environments
+// ---------------------------------------------------------------------------
+//
+// The env label exists because a slidemind DEVELOPER pairs local / dev / prod at
+// once. A normal user connects exactly one backend, and for them the label on
+// every line is noise that makes ordinary output read like a debugging session.
+// So it is routing metadata, shown only when it actually disambiguates: more
+// than one backend connected.
+//
+// Deliberately NOT gated: `--json` (agents route on it), `doctor` and `whoami`
+// (reporting environments is their whole job), and any label the user just
+// typed — `--backend prod`, `logout dev` — because suppressing an echo of their
+// own argument is confusing, not quiet.
+//
+// Memoised: `presentations` would otherwise re-read the session file once per
+// printed row. `writeAll` clears it, which covers every mutation (setup, login,
+// logout, use) inside a single process.
+let _sessionCount = null;
+
+export function isMultiEnv() {
+  if (_sessionCount === null) _sessionCount = readSessions().length;
+  return _sessionCount > 1;
+}
+
+/** " [dev]" when more than one backend is connected, "" otherwise. */
+export function envTag(env) {
+  return env && isMultiEnv() ? ` [${env}]` : "";
+}
+
+/**
+ * An in-sentence env mention — `envPhrase("dev", "for")` → " for dev" — or ""
+ * when there is only one environment to mean. Callers word the sentence so it
+ * reads correctly either way.
+ */
+export function envPhrase(env, preposition = "on") {
+  if (!env || !isMultiEnv()) return "";
+  return preposition === "on" ? ` on '${env}'` : ` ${preposition} ${env}`;
+}
+
 function isValidRecord(o) {
   return (
     o &&
@@ -84,6 +135,20 @@ function readRaw() {
   }
 }
 
+// Every credential this file hands out is registered for output scrubbing the
+// moment it is read, so a token spliced into an error message downstream — a
+// server echoing the request back, a response body used as an error detail —
+// renders as an opaque tag instead of the value. Reading the session file is
+// the single door every session token comes through, so this is the one place
+// that has to remember. The `@keychain` marker is a literal, not a secret.
+function registerRecordSecrets(record) {
+  registerSecret(record.sessionToken);
+  if (record.msGraphRefreshToken && record.msGraphRefreshToken !== KEYCHAIN_MARKER) {
+    registerSecret(record.msGraphRefreshToken);
+  }
+  return record;
+}
+
 // All paired sessions as [{ backendURL, sessionToken, label }]. Migrates the v1
 // single-record shape transparently. Returns [] when not paired / unreadable.
 export function readSessions() {
@@ -91,14 +156,18 @@ export function readSessions() {
   if (!obj) return [];
   // v2: { version, sessions: [...], default }
   if (Array.isArray(obj.sessions)) {
-    return obj.sessions.filter(isValidRecord).map((s) => ({
+    return obj.sessions.filter(isValidRecord).map(registerRecordSecrets).map((s) => ({
       backendURL: s.backendURL,
       sessionToken: s.sessionToken,
       label: typeof s.label === "string" && s.label ? s.label : deriveEnvLabel(s.backendURL),
+      ...(typeof s.msGraphRefreshToken === "string" && s.msGraphRefreshToken
+        ? { msGraphRefreshToken: s.msGraphRefreshToken }
+        : {}),
     }));
   }
   // v1: { backendURL, sessionToken }
   if (isValidRecord(obj)) {
+    registerRecordSecrets(obj);
     return [
       {
         backendURL: obj.backendURL,
@@ -122,6 +191,7 @@ export function getDefaultBackend() {
 }
 
 function writeAll(sessions, defaultBackend) {
+  _sessionCount = null; // the count just changed — see isMultiEnv()
   fs.mkdirSync(sessionConfigDir(), { recursive: true });
   const payload = {
     version: 2,
@@ -129,6 +199,7 @@ function writeAll(sessions, defaultBackend) {
       backendURL: s.backendURL,
       sessionToken: s.sessionToken,
       label: s.label || deriveEnvLabel(s.backendURL),
+      ...(s.msGraphRefreshToken ? { msGraphRefreshToken: s.msGraphRefreshToken } : {}),
     })),
   };
   const def =
@@ -143,6 +214,12 @@ function writeAll(sessions, defaultBackend) {
 
 // Add or replace a session (keyed by backendURL). Becomes the default if none
 // is set yet. Preserves the existing default otherwise.
+//
+// Any stored `msGraphRefreshToken` is deliberately NOT carried over: redeeming
+// a fresh claim can hand this machine to a different identity, and silently
+// pairing that session with the previous user's delegated Graph token would
+// fetch one person's content under another's session. `slidemind login` again
+// is one command; a mismatched identity is not recoverable by the user.
 export function upsertSession({ backendURL, sessionToken, label = null }) {
   if (!backendURL || !sessionToken) {
     throw new Error("upsertSession: backendURL and sessionToken are required");
@@ -200,6 +277,121 @@ export function getSessionFor(backendURL) {
   return readSessions().find((s) => s.backendURL === backendURL) || null;
 }
 
+// --- Graph refresh-token at-rest storage ------------------------------------
+//
+// On macOS the token goes into the login Keychain (encrypted at rest, absent
+// from file backups and accidental config-dir syncs); the session file then
+// carries only the marker below so hasGraphSession stays a file read. Any
+// keychain failure falls back to the plaintext field silently — the 0600 file
+// is the universal path and stays what Linux and Windows use.
+// ponytail: macOS-only at-rest hardening — upgrade path is libsecret on Linux
+// and DPAPI/Credential Manager on Windows, both of which need a dependency.
+//
+// The `security` CLI takes the secret as an argv, which is visible in a process
+// listing for the milliseconds the write takes — to the same user and root,
+// i.e. the same principals who can already read the 0600 fallback file. Judged
+// acceptable against what the keychain buys at rest.
+//
+// Never during tests: `node --test` sets NODE_TEST_CONTEXT, and a test writing
+// into the developer's real login keychain would outlive the test's isolated
+// XDG_CONFIG_HOME. SLIDEMIND_NO_KEYCHAIN is the explicit opt-out.
+const KEYCHAIN_MARKER = "@keychain";
+const KEYCHAIN_SERVICE = "slidemind-msgraph";
+
+function keychainUsable() {
+  return (
+    process.platform === "darwin" &&
+    !process.env.NODE_TEST_CONTEXT &&
+    !process.env.SLIDEMIND_NO_KEYCHAIN
+  );
+}
+
+// Stable per-backend account key. Hashed: keychain account fields end up in
+// `security dump-keychain` output and logs, and the backend URL is exactly the
+// thing user-facing output must never carry.
+function keychainAccount(backendURL) {
+  return crypto.createHash("sha256").update(String(backendURL)).digest("hex").slice(0, 32);
+}
+
+function keychainWrite(backendURL, token) {
+  execFileSync(
+    "security",
+    ["add-generic-password", "-U", "-s", KEYCHAIN_SERVICE, "-a", keychainAccount(backendURL), "-w", token],
+    { stdio: "ignore" },
+  );
+}
+
+function keychainRead(backendURL) {
+  const out = execFileSync(
+    "security",
+    ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", keychainAccount(backendURL), "-w"],
+    { stdio: ["ignore", "pipe", "ignore"] },
+  );
+  const token = out.toString("utf8").trim();
+  return token || null;
+}
+
+function keychainDelete(backendURL) {
+  try {
+    execFileSync(
+      "security",
+      ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", keychainAccount(backendURL)],
+      { stdio: "ignore" },
+    );
+  } catch {
+    /* nothing stored — logout of a file-stored or never-stored token */
+  }
+}
+
+// The user's stored Entra refresh token for one backend, or null. See
+// graph-auth.mjs — nothing else may read it, and it never leaves this machine
+// except as an Authorization on a token refresh.
+export function getGraphRefreshToken(backendURL) {
+  const stored = getSessionFor(backendURL)?.msGraphRefreshToken ?? null;
+  if (stored !== KEYCHAIN_MARKER) return stored;
+  try {
+    // The file held only the marker, so `readSessions` had nothing to register —
+    // the real value first exists here.
+    const fromKeychain = keychainRead(backendURL);
+    registerSecret(fromKeychain);
+    return fromKeychain;
+  } catch {
+    // Marker without a readable keychain item (locked keychain, item removed
+    // by hand): behave as signed out rather than erroring every engine op.
+    return null;
+  }
+}
+
+// Store (or, with a null token, drop) the Graph refresh token for one backend.
+// Every refresh returns a NEW refresh token, so this is called on each rotation.
+// Returns false when that backend is no longer paired — a session removed
+// mid-refresh must not resurrect itself as a token-only record.
+export function setGraphRefreshToken(backendURL, refreshToken) {
+  const sessions = readSessions();
+  const record = sessions.find((s) => s.backendURL === backendURL);
+  if (!record) return false;
+  if (refreshToken) {
+    record.msGraphRefreshToken = refreshToken;
+    if (keychainUsable()) {
+      try {
+        keychainWrite(backendURL, refreshToken);
+        // Migration is this line: a previously plaintext field becomes the
+        // marker on the first successful keychain write.
+        record.msGraphRefreshToken = KEYCHAIN_MARKER;
+      } catch {
+        /* keychain unavailable — the plaintext field above stands */
+      }
+    }
+  } else {
+    if (record.msGraphRefreshToken === KEYCHAIN_MARKER && keychainUsable()) {
+      keychainDelete(backendURL);
+    }
+    delete record.msGraphRefreshToken;
+  }
+  writeAll(sessions, getDefaultBackend());
+  return true;
+}
+
 // Back-compat writer: upsert a single session (used by tests and any v1 caller).
 export function writeSessionConfig({ backendURL, sessionToken }) {
   if (!backendURL || !sessionToken) {