npm - smart-home-engine - Versions diffs - 1.4.0 → 1.5.1 - Mend

smart-home-engine 1.4.0 → 1.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/README.md +1 -1
package/dist/web/assets/{index-AxQ546-B.js → index-COVhu4fS.js} +69 -69
package/dist/web/assets/{index-Cp5N3a9H.css → index-CiYcuYTG.css} +1 -1
package/dist/web/assets/{tsMode-DEX2KSLC.js → tsMode-CVHEzKL2.js} +1 -1
package/dist/web/index.html +2 -2
package/package.json +1 -1
package/src/lib/ca.js +97 -1
package/src/lib/dynsec.js +4 -1
package/src/web/broker-api.js +146 -1

package/dist/web/assets/{tsMode-DEX2KSLC.js → tsMode-CVHEzKL2.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import{m as O}from"./monaco-langs-BW2J83t5.js";import{t as I}from"./index-AxQ546-B.js";/*!-----------------------------------------------------------------------------
+import{m as O}from"./monaco-langs-BW2J83t5.js";import{t as I}from"./index-COVhu4fS.js";/*!-----------------------------------------------------------------------------
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Version: 0.52.2(404545bded1df6ffa41ea0af4e8ddb219018c6c1)
  * Released under the MIT license

package/dist/web/index.html CHANGED Viewed

@@ -172,10 +172,10 @@
                 }
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-AxQ546-B.js"></script>
+      <script type="module" crossorigin src="/assets/index-COVhu4fS.js"></script>
       <link rel="modulepreload" crossorigin href="/assets/monaco-langs-BW2J83t5.js">
       <link rel="stylesheet" crossorigin href="/assets/monaco-langs-DyX1CsEw.css">
-      <link rel="stylesheet" crossorigin href="/assets/index-Cp5N3a9H.css">
+      <link rel="stylesheet" crossorigin href="/assets/index-CiYcuYTG.css">
     </head>
     <body>
         <div id="app"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
     "name": "smart-home-engine",
-    "version": "1.4.0",
+    "version": "1.5.1",
     "description": "Node.js based script runner for use in MQTT based Smart Home environments",
     "main": "src/index.js",
     "scripts": {

package/src/lib/ca.js CHANGED Viewed

@@ -228,7 +228,10 @@ async function generateServerCert(config, { cn, san = [], days = 365 } = {}) {
     const caCrtPath = path.join(dir, 'ca.crt');
     const srlPath = path.join(dir, 'ca.srl');
-    if (!fs.existsSync(caCrtPath)) throw new Error('No CA found — generate CA first');
+    // Auto-generate an internal CA if none exists (used for self-signed server certs)
+    if (!fs.existsSync(caCrtPath)) {
+        await generateCA(config, { cn: 'she-internal-ca', days: 3650 });
+    }
     const serverDir = path.join(dir, 'server');
     fs.mkdirSync(serverDir, { recursive: true });
@@ -288,6 +291,97 @@ async function generateServerCert(config, { cn, san = [], days = 365 } = {}) {
 // ── Client certificate issuance ────────────────────────────────────────────────
+/**
+ * Generate a server private key and CSR without signing it.
+ * The key is stored on disk as server/server.key; the CSR is returned as PEM.
+ * The user takes the CSR to an external CA to get it signed, then calls
+ * importServerCert() to install the resulting certificate.
+ *
+ * @param {object} config
+ * @param {{ cn?: string, san?: string[], days?: number }} options  (days ignored — for future use)
+ * @returns {Promise<{ csrPem: string }>}
+ */
+async function generateServerCSR(config, { cn, san = [] } = {}) {
+    const dir = caDir(config);
+    const serverDir = path.join(dir, 'server');
+    fs.mkdirSync(serverDir, { recursive: true });
+    const keyPath = path.join(serverDir, 'server.key');
+    const csrPath = path.join(serverDir, 'server.csr');
+    // Generate key
+    await openssl(['genpkey', '-algorithm', 'ed25519', '-out', keyPath]);
+    try { fs.chmodSync(keyPath, 0o600); } catch { /* ignore */ }
+    // Build subject and optional SAN extension for the CSR
+    const sanEntries = [cn, ...san].filter(Boolean).map((s, i) => {
+        return /^\d+\.\d+\.\d+\.\d+$/.test(s) ? `IP.${i + 1}:${s}` : `DNS.${i + 1}:${s}`;
+    });
+    const subjArgs = ['-subj', `/CN=${cn || 'mosquitto'}`];
+    let reqArgs = ['req', '-new', '-key', keyPath, '-out', csrPath, ...subjArgs];
+    if (sanEntries.length) {
+        const extPath = path.join(serverDir, 'server-csr.conf');
+        fs.writeFileSync(extPath, `[req]\ndistinguished_name=dn\nreq_extensions=SAN\n[dn]\n[SAN]\nsubjectAltName=${sanEntries.join(',')}\n`, 'utf8');
+        reqArgs = ['req', '-new', '-key', keyPath, '-out', csrPath, ...subjArgs, '-config', extPath];
+    }
+    await openssl(reqArgs);
+    const csrPem = fs.readFileSync(csrPath, 'utf8');
+    return { csrPem };
+}
+/**
+ * Install an externally-signed certificate as the server certificate.
+ * If keyPem is provided it is written as server.key; otherwise the existing
+ * server.key on disk (e.g. from a prior generateServerCSR call) is used.
+ *
+ * @param {object} config
+ * @param {{ certPem: string, keyPem?: string|null }} options
+ * @returns {Promise<{ fingerprint: string, expires: string, cn: string }>}
+ */
+async function importServerCert(config, { certPem, keyPem = null } = {}) {
+    const dir = caDir(config);
+    const serverDir = path.join(dir, 'server');
+    fs.mkdirSync(serverDir, { recursive: true });
+    const crtPath = path.join(serverDir, 'server.crt');
+    const keyPath = path.join(serverDir, 'server.key');
+    // Validate cert
+    const tmpCrt = crtPath + '.tmp';
+    fs.writeFileSync(tmpCrt, certPem.trim() + '\n', 'utf8');
+    try {
+        await openssl(['x509', '-in', tmpCrt, '-noout']);
+    } catch (e) {
+        try { fs.unlinkSync(tmpCrt); } catch { /* ignore */ }
+        throw new Error(`Invalid certificate: ${e.message}`);
+    }
+    if (keyPem) {
+        const tmpKey = keyPath + '.tmp';
+        fs.writeFileSync(tmpKey, keyPem.trim() + '\n', 'utf8');
+        try {
+            await openssl(['pkey', '-in', tmpKey, '-noout']);
+        } catch (e) {
+            try { fs.unlinkSync(tmpCrt); } catch { /* ignore */ }
+            try { fs.unlinkSync(tmpKey); } catch { /* ignore */ }
+            throw new Error(`Invalid private key: ${e.message}`);
+        }
+        fs.renameSync(tmpKey, keyPath);
+        try { fs.chmodSync(keyPath, 0o600); } catch { /* ignore */ }
+    } else if (!fs.existsSync(keyPath)) {
+        try { fs.unlinkSync(tmpCrt); } catch { /* ignore */ }
+        throw new Error('No private key provided and no existing server.key on disk');
+    }
+    fs.renameSync(tmpCrt, crtPath);
+    const fingerprint = await certFingerprint(crtPath);
+    const expires = await certExpiry(crtPath);
+    const cn = await certCN(crtPath);
+    return { fingerprint, expires, cn };
+}
 /**
  * Issue a client certificate signed by the local CA.
  * Returns paths to .p12, .crt, .key and the p12 passphrase.
@@ -570,6 +664,8 @@ module.exports = {
     importCA,
     extractFromP12,
     generateServerCert,
+    generateServerCSR,
+    importServerCert,
     issueClientCert,
     generateCRL,
     listTrustedCerts,

package/src/lib/dynsec.js CHANGED Viewed

@@ -346,7 +346,10 @@ function setDefaultACLAccess(acls) {
 // ── Anonymous group ────────────────────────────────────────────────────────────
 function getAnonymousGroup() {
-    return _request('getAnonymousGroup').then((r) => r.data?.group ?? r.group ?? null);
+    return _request('getAnonymousGroup').then((r) => {
+        const g = r.data?.group ?? r.group ?? null;
+        return g?.groupname ?? g ?? null;
+    });
 }
 function setAnonymousGroup(groupname) {

package/src/web/broker-api.js CHANGED Viewed

@@ -577,6 +577,51 @@ router.post('/ca/import', async (req, res) => {
     }
 });
+/**
+ * GET /she/broker/fs/complete?path=<prefix>
+ * Returns filesystem path completions for a partial absolute path.
+ * Works locally or via SSH when broker.ssh is configured.
+ */
+router.get('/fs/complete', async (req, res) => {
+    try {
+        const bc = getBrokerConfig(req);
+        const inputPath = String(req.query.path || '').trim();
+        if (!inputPath.startsWith('/')) return res.json({ suggestions: [] });
+        const endsWithSlash = inputPath.endsWith('/');
+        const posix = require('path').posix;
+        const dir = endsWithSlash ? inputPath : posix.dirname(inputPath);
+        const prefix = endsWithSlash ? '' : posix.basename(inputPath);
+        let entries = [];
+        if (bc.ssh && bc.ssh.host) {
+            try {
+                const { stdout } = await sshDeploy.runCommand(bc.ssh, `ls -1p -- "${dir}" 2>/dev/null`);
+                entries = stdout.split('\n').filter(Boolean);
+            } catch {
+                entries = [];
+            }
+        } else {
+            try {
+                const items = fs.readdirSync(dir, { withFileTypes: true });
+                entries = items.map((d) => d.name + (d.isDirectory() ? '/' : ''));
+            } catch {
+                entries = [];
+            }
+        }
+        const base = dir.endsWith('/') ? dir : dir + '/';
+        const suggestions = entries
+            .filter((e) => e.startsWith(prefix))
+            .map((e) => base + e)
+            .slice(0, 25);
+        res.json({ suggestions });
+    } catch {
+        res.json({ suggestions: [] });
+    }
+});
 /** GET /she/broker/ca/server — Server cert info */
 router.get('/ca/server', async (req, res) => {
     try {
@@ -593,7 +638,7 @@ router.get('/ca/server', async (req, res) => {
     }
 });
-/** POST /she/broker/ca/server/generate — Generate server cert */
+/** POST /she/broker/ca/server/generate — Generate self-signed server cert (auto-creates internal CA) */
 router.post('/ca/server/generate', async (req, res) => {
     try {
         const bc = getBrokerConfig(req);
@@ -605,6 +650,79 @@ router.post('/ca/server/generate', async (req, res) => {
     }
 });
+/**
+ * POST /she/broker/ca/server/csr
+ * Generate a private key + CSR for the server cert.
+ * The CSR PEM is returned for external signing; the key is kept on disk.
+ * Body: { cn?, san?: string[], days?: number }
+ */
+router.post('/ca/server/csr', async (req, res) => {
+    try {
+        const bc = getBrokerConfig(req);
+        const { cn, san, days } = req.body;
+        const result = await ca.generateServerCSR(bc, { cn, san, days });
+        res.json({ ok: true, csrPem: result.csrPem });
+    } catch (err) {
+        handleError(res, err);
+    }
+});
+/**
+ * POST /she/broker/ca/server/import
+ * Install an externally-signed server certificate (PEM or PKCS#12).
+ * Body (PEM):  { cert: string, key?: string }
+ *   key is optional when a key already exists on disk (e.g. from /csr).
+ * Body (P12):  { p12base64: string, passphrase?: string }
+ */
+router.post('/ca/server/import', async (req, res) => {
+    try {
+        const bc = getBrokerConfig(req);
+        const { cert, key, p12base64, passphrase } = req.body;
+        let certPem, keyPem;
+        if (p12base64 !== undefined) {
+            const p12Buffer = Buffer.from(p12base64, 'base64');
+            ({ certPem, keyPem } = await ca.extractFromP12(p12Buffer, passphrase ?? ''));
+        } else {
+            if (!cert) return res.status(400).json({ error: 'cert is required' });
+            certPem = cert;
+            keyPem = key || null;
+        }
+        const result = await ca.importServerCert(bc, { certPem, keyPem });
+        res.json({ ok: true, server: result });
+    } catch (err) {
+        handleError(res, err);
+    }
+});
+/**
+ * POST /she/broker/ca/server/pathlink
+ * Install a server cert+key from existing file paths on the broker host.
+ * Reads via SSH if broker.ssh is configured, otherwise reads local files.
+ * Body: { certPath: string, keyPath: string }
+ */
+router.post('/ca/server/pathlink', async (req, res) => {
+    try {
+        const bc = getBrokerConfig(req);
+        const { certPath, keyPath } = req.body;
+        if (!certPath || !keyPath) return res.status(400).json({ error: 'certPath and keyPath are required' });
+        if (!certPath.startsWith('/') || !keyPath.startsWith('/')) return res.status(400).json({ error: 'Absolute paths required' });
+        let certPem, keyPem;
+        if (bc.ssh && bc.ssh.host) {
+            certPem = await sshDeploy.readRemoteFile(bc.ssh, certPath);
+            keyPem = await sshDeploy.readRemoteFile(bc.ssh, keyPath);
+        } else {
+            certPem = fs.readFileSync(certPath, 'utf8');
+            keyPem = fs.readFileSync(keyPath, 'utf8');
+        }
+        const result = await ca.importServerCert(bc, { certPem, keyPem });
+        res.json({ ok: true, server: result });
+    } catch (err) {
+        handleError(res, err);
+    }
+});
 /** GET /she/broker/ca/certs — List issued client certs (from sheDB) */
 router.get('/ca/certs', async (req, res) => {
     try {
@@ -782,6 +900,33 @@ router.delete('/ca/trusted/:fingerprint', async (req, res) => {
     }
 });
+/**
+ * POST /she/broker/ca/trusted/addpath
+ * Add a trusted CA cert from an existing file path on the broker host.
+ * Reads via SSH if broker.ssh is configured, otherwise reads local file.
+ * Body: { path: string }
+ */
+router.post('/ca/trusted/addpath', async (req, res) => {
+    try {
+        const bc = getBrokerConfig(req);
+        const { path: filePath } = req.body;
+        if (!filePath || typeof filePath !== 'string') return res.status(400).json({ error: 'path required' });
+        if (!filePath.startsWith('/')) return res.status(400).json({ error: 'Absolute path required' });
+        let pemContent;
+        if (bc.ssh && bc.ssh.host) {
+            pemContent = await sshDeploy.readRemoteFile(bc.ssh, filePath);
+        } else {
+            pemContent = fs.readFileSync(filePath, 'utf8');
+        }
+        const result = await ca.addTrustedCert(bc, pemContent);
+        res.json({ ok: true, ...result });
+    } catch (err) {
+        handleError(res, err);
+    }
+});
 module.exports = { router, setLogger, setStore };
 // ── SSH routes ─────────────────────────────────────────────────────────────────