npm - smart-home-engine - Versions diffs - 1.3.0 → 1.5.0 - Mend

smart-home-engine 1.3.0 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/README.md +1 -1
package/dist/web/assets/{index-SmPJ7Vpm.js → index-76-mgKLK.js} +72 -72
package/dist/web/assets/{index-BTdLG-cS.css → index-CiYcuYTG.css} +1 -1
package/dist/web/assets/{tsMode-XvjcqT_Z.js → tsMode-DHTnwPoK.js} +1 -1
package/dist/web/index.html +2 -2
package/package.json +1 -1
package/src/lib/ca.js +209 -4
package/src/lib/dynsec.js +4 -1
package/src/web/broker-api.js +71 -1

package/dist/web/assets/{tsMode-XvjcqT_Z.js → tsMode-DHTnwPoK.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import{m as O}from"./monaco-langs-BW2J83t5.js";import{t as I}from"./index-SmPJ7Vpm.js";/*!-----------------------------------------------------------------------------
+import{m as O}from"./monaco-langs-BW2J83t5.js";import{t as I}from"./index-76-mgKLK.js";/*!-----------------------------------------------------------------------------
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Version: 0.52.2(404545bded1df6ffa41ea0af4e8ddb219018c6c1)
  * Released under the MIT license

package/dist/web/index.html CHANGED Viewed

@@ -172,10 +172,10 @@
                 }
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-SmPJ7Vpm.js"></script>
+      <script type="module" crossorigin src="/assets/index-76-mgKLK.js"></script>
       <link rel="modulepreload" crossorigin href="/assets/monaco-langs-BW2J83t5.js">
       <link rel="stylesheet" crossorigin href="/assets/monaco-langs-DyX1CsEw.css">
-      <link rel="stylesheet" crossorigin href="/assets/index-BTdLG-cS.css">
+      <link rel="stylesheet" crossorigin href="/assets/index-CiYcuYTG.css">
     </head>
     <body>
         <div id="app"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
     "name": "smart-home-engine",
-    "version": "1.3.0",
+    "version": "1.5.0",
     "description": "Node.js based script runner for use in MQTT based Smart Home environments",
     "main": "src/index.js",
     "scripts": {

package/src/lib/ca.js CHANGED Viewed

@@ -104,18 +104,116 @@ async function generateCA(config, { cn = 'she-broker-ca', days = 365 } = {}) {
 async function getCA(config) {
     const dir = caDir(config);
     const crtPath = path.join(dir, 'ca.crt');
+    const chainPath = path.join(dir, 'ca-chain.crt');
     if (!fs.existsSync(crtPath)) return null;
     try {
         const fingerprint = await certFingerprint(crtPath);
         const expires = await certExpiry(crtPath);
         const cn = await certCN(crtPath);
         const crt = fs.readFileSync(crtPath, 'utf8');
-        return { crt, fingerprint, expires, cn };
+        const hasChain = fs.existsSync(chainPath);
+        const chainCn = hasChain ? await certCN(chainPath).catch(() => null) : null;
+        return { crt, fingerprint, expires, cn, hasChain, chainCn };
     } catch {
         return null;
     }
 }
+/**
+ * Import an existing CA keypair (PEM format) into the CA directory.
+ * Overwrites any existing ca.crt / ca.key.
+ * Optionally accepts a PEM chain (intermediate/root certs above this CA) stored
+ * as ca-chain.crt; used to build complete certificate chains in issued P12 bundles.
+ *
+ * @param {object} config
+ * @param {{ certPem: string, keyPem: string, chainPem?: string|null }} options
+ */
+async function importCA(config, { certPem, keyPem, chainPem = null }) {
+    const dir = caDir(config);
+    fs.mkdirSync(dir, { recursive: true });
+    const tmpCert = path.join(dir, '_import_cert.tmp');
+    const tmpKey = path.join(dir, '_import_key.tmp');
+    fs.writeFileSync(tmpCert, certPem.trim() + '\n', 'utf8');
+    fs.writeFileSync(tmpKey, keyPem.trim() + '\n', 'utf8');
+    try {
+        await openssl(['x509', '-in', tmpCert, '-noout']);
+        await openssl(['pkey', '-in', tmpKey, '-noout']);
+    } catch (e) {
+        try { fs.unlinkSync(tmpCert); } catch { /* ignore */ }
+        try { fs.unlinkSync(tmpKey); } catch { /* ignore */ }
+        throw new Error(`Invalid certificate or key: ${e.message}`);
+    }
+    const keyPath = path.join(dir, 'ca.key');
+    const crtPath = path.join(dir, 'ca.crt');
+    const srlPath = path.join(dir, 'ca.srl');
+    const chainPath = path.join(dir, 'ca-chain.crt');
+    fs.renameSync(tmpCert, crtPath);
+    fs.renameSync(tmpKey, keyPath);
+    try { fs.chmodSync(keyPath, 0o600); } catch { /* ignore */ }
+    if (!fs.existsSync(srlPath)) {
+        fs.writeFileSync(srlPath, '01\n', 'utf8');
+    }
+    if (chainPem && chainPem.trim()) {
+        const tmpChain = path.join(dir, '_import_chain.tmp');
+        fs.writeFileSync(tmpChain, chainPem.trim() + '\n', 'utf8');
+        try {
+            await openssl(['x509', '-in', tmpChain, '-noout']);
+        } catch (e) {
+            try { fs.unlinkSync(tmpChain); } catch { /* ignore */ }
+            throw new Error(`Invalid chain certificate: ${e.message}`);
+        }
+        fs.renameSync(tmpChain, chainPath);
+    } else if (fs.existsSync(chainPath)) {
+        fs.unlinkSync(chainPath);
+    }
+    const fingerprint = await certFingerprint(crtPath);
+    const expires = await certExpiry(crtPath);
+    const cn = await certCN(crtPath);
+    const crt = fs.readFileSync(crtPath, 'utf8');
+    return { crt, fingerprint, expires, cn };
+}
+/**
+ * Extract certificate and private key PEM strings from a PKCS#12 file.
+ * Tries OpenSSL 3 defaults first, falls back to -legacy for older P12 files.
+ *
+ * @param {Buffer} p12Buffer  raw .p12/.pfx file bytes
+ * @param {string} passphrase decryption passphrase (may be empty string)
+ * @returns {Promise<{ certPem: string, keyPem: string }>}
+ */
+async function extractFromP12(p12Buffer, passphrase) {
+    const tmpP12 = path.join(os.tmpdir(), `she_p12_${Date.now()}.tmp`);
+    fs.writeFileSync(tmpP12, p12Buffer);
+    try {
+        const passArg = `pass:${passphrase}`;
+        const tryExtract = async (extraFlags = []) => {
+            const { stdout: certOut } = await openssl(['pkcs12', '-in', tmpP12, '-clcerts', '-nokeys', '-passin', passArg, '-nodes', ...extraFlags]);
+            const { stdout: keyOut }  = await openssl(['pkcs12', '-in', tmpP12, '-nocerts',  '-nodes', '-passin', passArg, ...extraFlags]);
+            return { certOut, keyOut };
+        };
+        let certOut, keyOut;
+        try {
+            ({ certOut, keyOut } = await tryExtract());
+        } catch {
+            ({ certOut, keyOut } = await tryExtract(['-legacy']));
+        }
+        const certMatch = certOut.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/);
+        const keyMatch  = keyOut.match(/-----BEGIN [\w ]+ KEY-----[\s\S]+?-----END [\w ]+ KEY-----/);
+        if (!certMatch) throw new Error('No certificate found in P12 file');
+        if (!keyMatch)  throw new Error('No private key found in P12 file');
+        return { certPem: certMatch[0] + '\n', keyPem: keyMatch[0] + '\n' };
+    } finally {
+        try { fs.unlinkSync(tmpP12); } catch { /* ignore */ }
+    }
+}
 // ── Server certificate ─────────────────────────────────────────────────────────
 /**
@@ -130,7 +228,10 @@ async function generateServerCert(config, { cn, san = [], days = 365 } = {}) {
     const caCrtPath = path.join(dir, 'ca.crt');
     const srlPath = path.join(dir, 'ca.srl');
-    if (!fs.existsSync(caCrtPath)) throw new Error('No CA found — generate CA first');
+    // Auto-generate an internal CA if none exists (used for self-signed server certs)
+    if (!fs.existsSync(caCrtPath)) {
+        await generateCA(config, { cn: 'she-internal-ca', days: 3650 });
+    }
     const serverDir = path.join(dir, 'server');
     fs.mkdirSync(serverDir, { recursive: true });
@@ -190,6 +291,97 @@ async function generateServerCert(config, { cn, san = [], days = 365 } = {}) {
 // ── Client certificate issuance ────────────────────────────────────────────────
+/**
+ * Generate a server private key and CSR without signing it.
+ * The key is stored on disk as server/server.key; the CSR is returned as PEM.
+ * The user takes the CSR to an external CA to get it signed, then calls
+ * importServerCert() to install the resulting certificate.
+ *
+ * @param {object} config
+ * @param {{ cn?: string, san?: string[], days?: number }} options  (days ignored — for future use)
+ * @returns {Promise<{ csrPem: string }>}
+ */
+async function generateServerCSR(config, { cn, san = [] } = {}) {
+    const dir = caDir(config);
+    const serverDir = path.join(dir, 'server');
+    fs.mkdirSync(serverDir, { recursive: true });
+    const keyPath = path.join(serverDir, 'server.key');
+    const csrPath = path.join(serverDir, 'server.csr');
+    // Generate key
+    await openssl(['genpkey', '-algorithm', 'ed25519', '-out', keyPath]);
+    try { fs.chmodSync(keyPath, 0o600); } catch { /* ignore */ }
+    // Build subject and optional SAN extension for the CSR
+    const sanEntries = [cn, ...san].filter(Boolean).map((s, i) => {
+        return /^\d+\.\d+\.\d+\.\d+$/.test(s) ? `IP.${i + 1}:${s}` : `DNS.${i + 1}:${s}`;
+    });
+    const subjArgs = ['-subj', `/CN=${cn || 'mosquitto'}`];
+    let reqArgs = ['req', '-new', '-key', keyPath, '-out', csrPath, ...subjArgs];
+    if (sanEntries.length) {
+        const extPath = path.join(serverDir, 'server-csr.conf');
+        fs.writeFileSync(extPath, `[req]\ndistinguished_name=dn\nreq_extensions=SAN\n[dn]\n[SAN]\nsubjectAltName=${sanEntries.join(',')}\n`, 'utf8');
+        reqArgs = ['req', '-new', '-key', keyPath, '-out', csrPath, ...subjArgs, '-config', extPath];
+    }
+    await openssl(reqArgs);
+    const csrPem = fs.readFileSync(csrPath, 'utf8');
+    return { csrPem };
+}
+/**
+ * Install an externally-signed certificate as the server certificate.
+ * If keyPem is provided it is written as server.key; otherwise the existing
+ * server.key on disk (e.g. from a prior generateServerCSR call) is used.
+ *
+ * @param {object} config
+ * @param {{ certPem: string, keyPem?: string|null }} options
+ * @returns {Promise<{ fingerprint: string, expires: string, cn: string }>}
+ */
+async function importServerCert(config, { certPem, keyPem = null } = {}) {
+    const dir = caDir(config);
+    const serverDir = path.join(dir, 'server');
+    fs.mkdirSync(serverDir, { recursive: true });
+    const crtPath = path.join(serverDir, 'server.crt');
+    const keyPath = path.join(serverDir, 'server.key');
+    // Validate cert
+    const tmpCrt = crtPath + '.tmp';
+    fs.writeFileSync(tmpCrt, certPem.trim() + '\n', 'utf8');
+    try {
+        await openssl(['x509', '-in', tmpCrt, '-noout']);
+    } catch (e) {
+        try { fs.unlinkSync(tmpCrt); } catch { /* ignore */ }
+        throw new Error(`Invalid certificate: ${e.message}`);
+    }
+    if (keyPem) {
+        const tmpKey = keyPath + '.tmp';
+        fs.writeFileSync(tmpKey, keyPem.trim() + '\n', 'utf8');
+        try {
+            await openssl(['pkey', '-in', tmpKey, '-noout']);
+        } catch (e) {
+            try { fs.unlinkSync(tmpCrt); } catch { /* ignore */ }
+            try { fs.unlinkSync(tmpKey); } catch { /* ignore */ }
+            throw new Error(`Invalid private key: ${e.message}`);
+        }
+        fs.renameSync(tmpKey, keyPath);
+        try { fs.chmodSync(keyPath, 0o600); } catch { /* ignore */ }
+    } else if (!fs.existsSync(keyPath)) {
+        try { fs.unlinkSync(tmpCrt); } catch { /* ignore */ }
+        throw new Error('No private key provided and no existing server.key on disk');
+    }
+    fs.renameSync(tmpCrt, crtPath);
+    const fingerprint = await certFingerprint(crtPath);
+    const expires = await certExpiry(crtPath);
+    const cn = await certCN(crtPath);
+    return { fingerprint, expires, cn };
+}
 /**
  * Issue a client certificate signed by the local CA.
  * Returns paths to .p12, .crt, .key and the p12 passphrase.
@@ -235,9 +427,18 @@ async function issueClientCert(config, { cn, days = 365 } = {}) {
     // Read serial from the signed cert
     const serial = await certSerial(crtPath);
-    // Bundle to .p12
+    // Bundle to .p12 — include signing chain if ca-chain.crt exists
     const passphrase = crypto.randomBytes(10).toString('hex');
-    await openssl(['pkcs12', '-export', '-in', crtPath, '-inkey', keyPath, '-certfile', caCrtPath, '-out', p12Path, '-passout', `pass:${passphrase}`, '-legacy']);
+    const chainPath = path.join(dir, 'ca-chain.crt');
+    let p12CertfileArg = caCrtPath;
+    let combinedChainTmp = null;
+    if (fs.existsSync(chainPath)) {
+        combinedChainTmp = path.join(dir, '.combined-chain-tmp.crt');
+        fs.writeFileSync(combinedChainTmp, fs.readFileSync(caCrtPath, 'utf8') + fs.readFileSync(chainPath, 'utf8'));
+        p12CertfileArg = combinedChainTmp;
+    }
+    await openssl(['pkcs12', '-export', '-in', crtPath, '-inkey', keyPath, '-certfile', p12CertfileArg, '-out', p12Path, '-passout', `pass:${passphrase}`, '-legacy']);
+    if (combinedChainTmp) try { fs.unlinkSync(combinedChainTmp); } catch { /* ignore */ }
     const fingerprint = await certFingerprint(crtPath);
     const expires = await certExpiry(crtPath);
@@ -460,7 +661,11 @@ module.exports = {
     caCertsDir,
     generateCA,
     getCA,
+    importCA,
+    extractFromP12,
     generateServerCert,
+    generateServerCSR,
+    importServerCert,
     issueClientCert,
     generateCRL,
     listTrustedCerts,

package/src/lib/dynsec.js CHANGED Viewed

@@ -346,7 +346,10 @@ function setDefaultACLAccess(acls) {
 // ── Anonymous group ────────────────────────────────────────────────────────────
 function getAnonymousGroup() {
-    return _request('getAnonymousGroup').then((r) => r.data?.group ?? r.group ?? null);
+    return _request('getAnonymousGroup').then((r) => {
+        const g = r.data?.group ?? r.group ?? null;
+        return g?.groupname ?? g ?? null;
+    });
 }
 function setAnonymousGroup(groupname) {

package/src/web/broker-api.js CHANGED Viewed

@@ -551,6 +551,32 @@ router.post('/ca/generate', async (req, res) => {
     }
 });
+/**
+ * POST /she/broker/ca/import
+ * Import an existing CA from PEM text or a PKCS#12 file.
+ * Body (PEM mode):  { cert: string, key: string, chain?: string }
+ * Body (P12 mode):  { p12base64: string, passphrase: string, chain?: string }
+ */
+router.post('/ca/import', async (req, res) => {
+    try {
+        const bc = getBrokerConfig(req);
+        const { cert, key, chain, p12base64, passphrase } = req.body;
+        let certPem, keyPem;
+        if (p12base64 !== undefined) {
+            const p12Buffer = Buffer.from(p12base64, 'base64');
+            ({ certPem, keyPem } = await ca.extractFromP12(p12Buffer, passphrase ?? ''));
+        } else {
+            if (!cert || !key) return res.status(400).json({ error: 'cert and key are required' });
+            certPem = cert;
+            keyPem = key;
+        }
+        const result = await ca.importCA(bc, { certPem, keyPem, chainPem: chain || null });
+        res.json({ ok: true, ca: result });
+    } catch (err) {
+        handleError(res, err);
+    }
+});
 /** GET /she/broker/ca/server — Server cert info */
 router.get('/ca/server', async (req, res) => {
     try {
@@ -567,7 +593,7 @@ router.get('/ca/server', async (req, res) => {
     }
 });
-/** POST /she/broker/ca/server/generate — Generate server cert */
+/** POST /she/broker/ca/server/generate — Generate self-signed server cert (auto-creates internal CA) */
 router.post('/ca/server/generate', async (req, res) => {
     try {
         const bc = getBrokerConfig(req);
@@ -579,6 +605,50 @@ router.post('/ca/server/generate', async (req, res) => {
     }
 });
+/**
+ * POST /she/broker/ca/server/csr
+ * Generate a private key + CSR for the server cert.
+ * The CSR PEM is returned for external signing; the key is kept on disk.
+ * Body: { cn?, san?: string[], days?: number }
+ */
+router.post('/ca/server/csr', async (req, res) => {
+    try {
+        const bc = getBrokerConfig(req);
+        const { cn, san, days } = req.body;
+        const result = await ca.generateServerCSR(bc, { cn, san, days });
+        res.json({ ok: true, csrPem: result.csrPem });
+    } catch (err) {
+        handleError(res, err);
+    }
+});
+/**
+ * POST /she/broker/ca/server/import
+ * Install an externally-signed server certificate (PEM or PKCS#12).
+ * Body (PEM):  { cert: string, key?: string }
+ *   key is optional when a key already exists on disk (e.g. from /csr).
+ * Body (P12):  { p12base64: string, passphrase?: string }
+ */
+router.post('/ca/server/import', async (req, res) => {
+    try {
+        const bc = getBrokerConfig(req);
+        const { cert, key, p12base64, passphrase } = req.body;
+        let certPem, keyPem;
+        if (p12base64 !== undefined) {
+            const p12Buffer = Buffer.from(p12base64, 'base64');
+            ({ certPem, keyPem } = await ca.extractFromP12(p12Buffer, passphrase ?? ''));
+        } else {
+            if (!cert) return res.status(400).json({ error: 'cert is required' });
+            certPem = cert;
+            keyPem = key || null;
+        }
+        const result = await ca.importServerCert(bc, { certPem, keyPem });
+        res.json({ ok: true, server: result });
+    } catch (err) {
+        handleError(res, err);
+    }
+});
 /** GET /she/broker/ca/certs — List issued client certs (from sheDB) */
 router.get('/ca/certs', async (req, res) => {
     try {