win-cliauth 1.0.3 → 1.0.4

package/LICENSE

@@ -1,27 +1,27 @@
-Copyright (c) <2022>, <Pedro Lucas Magalhães de Oliveira>
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this
-  list of conditions and the following disclaimer.
-
-* Redistributions in binary form must reproduce the above copyright notice,
-  this list of conditions and the following disclaimer in the documentation
-  and/or other materials provided with the distribution.
-
-* Neither the name of the copyright holder nor the names of its
-  contributors may be used to endorse or promote products derived from
-  this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+Copyright (c) <2022>, <Pedro Lucas Magalhães de Oliveira>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* Neither the name of the copyright holder nor the names of its
+  contributors may be used to endorse or promote products derived from
+  this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -1,53 +1,78 @@
-# win-cliauth
-
-win-cliauth is a CLI-based OTP (One-Time Password) authenticator management tool for Windows.
-
-## Installation
-
-You can install win-cliauth globally using npm:
-
-npm install -g win-cliauth
-
-## Usage
-
-win-cliauth provides a command-line interface for managing OTP (One-Time Password) authenticators. It supports the following commands:
-
-- `add <name> <secret-key>`: Adds an authenticator with the given name and secret key.
-- `add <name> <secret-key> --replace`: Adds an authenticator, replacing an existing one with the same name.
-- `remove <name>`: Removes the authenticator with the specified name.
-- `get <name>`: Retrieves the token from the authenticator with the specified name.
-- `get <name> --steam`: Retrieves the token from the Steam authenticator with the specified name.
-- `get <name> --clipboard`: Retrieves the token and adds it to the clipboard.
-- `list`: Lists all registered authenticators.
-- `list --showsecret`: Lists all registered authenticators, including the secret keys.
-
-To use win-cliauth, open a terminal or command prompt and run one of the commands listed above.
-
-For detailed information on the available commands and options, you can run:
-
-win-cliauth --help
-
-## Security
-
-- win-cliauth encrypts the secret keys using the `ConvertTo-SecureString` command in PowerShell before storing them on disk.
-- The secret keys are stored in an encrypted file in the user's data directory, protected by the user's operating system.
-- Please note that the encrypted file can only be read on the same Windows user account where it was created. It may not be readable on other user accounts or operating systems.
-
-## Credits
-
-This project uses the following open-source libraries:
-
-- [otpauth](https://github.com/hectorm/otpauth) - One Time Password (HOTP/TOTP) library for Node.js, Deno, Bun and browsers.
-- [steam-totp](https://github.com/DoctorMcKay/node-steam-totp) - A Node.js library for generating Steam-compatible 2FA tokens.
-- [yargs](https://github.com/yargs/yargs) - A command-line argument parsing library for Node.js.
-
-Please refer to the respective library documentation for detailed information on their usage, licensing, and contributions.
-
-
-## Contributing
-
-Contributions are welcome! If you find any issues or have suggestions for improvements, please feel free to open an issue or submit a pull request on [GitHub](https://github.com/pedrolucasmag/win-cliauth).
-
-## License
-
+# win-cliauth
+
+win-cliauth is a CLI-based OTP (One-Time Password) authenticator management tool for Windows.
+
+## Installation
+
+You can install win-cliauth globally using npm:
+
+npm install -g win-cliauth
+
+## Usage
+
+win-cliauth provides a command-line interface for managing OTP (One-Time Password) authenticators. It supports the following commands:
+
+- `add <name>`: Adds an authenticator, prompting for the secret key without echoing it (it can also be piped through stdin).
+- `add <name> <secret-key>`: Same, with the secret on the command line (note: it stays in your shell history).
+- `add <name> --replace`: Adds an authenticator, replacing an existing one with the same name.
+- `add <name> --steam`: Adds a Steam Guard authenticator (see [Steam Guard](#steam-guard)).
+- `add <name> --mafile <path>`: Imports a Steam Guard authenticator from a `.maFile`.
+- `remove <name>`: Removes the authenticator with the specified name.
+- `get <name>`: Retrieves the token from the authenticator with the specified name.
+- `get <name> --clipboard`: Retrieves the token and adds it to the clipboard.
+- `get <name> --sync`: Forces a fresh time sync before generating the token.
+- `list`: Lists all registered authenticators.
+- `list --showsecret`: Lists all registered authenticators, including the secret keys.
+
+The secret key can be a base32 secret or an `otpauth://totp/...` URI (its digits, period and algorithm are respected).
+
+Commands exit with a non-zero code when they fail (e.g. authenticator not found), so they can be used in scripts.
+
+To use win-cliauth, open a terminal or command prompt and run one of the commands listed above.
+
+For detailed information on the available commands and options, you can run:
+
+win-cliauth --help
+
+## Steam Guard
+
+Steam Guard authenticators can be imported from a `.maFile`:
+
+```
+win-cliauth add steam --mafile path\to\account.maFile
+```
+
+Encrypted `.maFile`s must be decrypted before importing. You can also add the secret directly with `add steam --steam`; it can be a base64 `shared_secret`, base32 secret, `steam://` value or `otpauth://` URI. Steam codes are synced against Steam's own time server.
+
+Anyone with your `shared_secret` can generate your Steam Guard codes, so keep `.maFile`s private and don't leave them lying around after importing (see [Backups](#backups)).
+
+## Security
+
+- Secret keys are encrypted with Windows DPAPI (`ConvertTo-SecureString` / `ConvertFrom-SecureString` in PowerShell) before being stored on disk. They are passed to PowerShell through stdin, never on the command line.
+- The encrypted file lives in `%AppData%\win-cliauth\keys` and is written atomically; the previous version is kept as `keys.bak`.
+- The encrypted file can only be read by the same Windows user account where it was created.
+- Time is synced over HTTPS (Google for TOTP, Steam for Steam Guard) and the offset is cached for 6 hours in `%AppData%\win-cliauth\time.json`.
+
+## Backups
+
+The vault is tied to your Windows user account: reinstalling Windows or switching accounts makes it unreadable, even if you copied the `keys` file. Before that happens, run `win-cliauth list --showsecret` and store the secrets somewhere safe (e.g. a password manager), along with each service's recovery codes, such as the Steam revocation code from your `.maFile`.
+
+win-cliauth is provided without warranty; see the [license](LICENSE).
+
+## Credits
+
+This project uses the following open-source libraries:
+
+- [otpauth](https://github.com/hectorm/otpauth) - One Time Password (HOTP/TOTP) library for Node.js, Deno, Bun and browsers.
+- [yargs](https://github.com/yargs/yargs) - A command-line argument parsing library for Node.js.
+
+Please refer to the respective library documentation for detailed information on their usage, licensing, and contributions.
+
+
+## Contributing
+
+Contributions are welcome! If you find any issues or have suggestions for improvements, please feel free to open an issue or submit a pull request on [GitHub](https://github.com/pedrolucasmag/win-cliauth).
+
+## License
+
 This project is licensed under the BSD-3-Clause License. See the LICENSE file for details.

package/dist/main.js

@@ -7,21 +7,9 @@ All rights reserved.
 This source code is licensed under the BSD-style license found in the
 LICENSE file in the root directory of this source tree.
  */
-var _a, _b;
 Object.defineProperty(exports, "__esModule", { value: true });
 const commands_1 = require("./src/commands");
-const pshell_1 = require("./src/pshell");
-const childProcess = (0, pshell_1.decrypt)();
-let rawData = '';
-(_a = childProcess.stdout) === null || _a === void 0 ? void 0 : _a.on('data', (chunk) => {
-    rawData += chunk;
-});
-(_b = childProcess.stdout) === null || _b === void 0 ? void 0 : _b.on('end', () => {
-    try {
-        const svcs = JSON.parse(rawData);
-        (0, commands_1.handleCommands)(svcs);
-    }
-    catch (error) {
-        console.error('Error parsing JSON:', error);
-    }
+(0, commands_1.handleCommands)().catch((error) => {
+    console.error(`Error: ${error instanceof Error ? error.message : error}`);
+    process.exitCode = 1;
 });

package/dist/src/auth.js

@@ -6,83 +6,94 @@ All rights reserved.
 This source code is licensed under the BSD-style license found in the
 LICENSE file in the root directory of this source tree.
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.listAuth = exports.removeAuth = exports.addAuth = exports.getAuth = void 0;
+exports.getAuth = getAuth;
+exports.addAuth = addAuth;
+exports.removeAuth = removeAuth;
+exports.listAuth = listAuth;
 const child_process_1 = require("child_process");
-const otpauth_1 = require("otpauth");
-const steam_totp_1 = require("steam-totp");
+const promises_1 = require("fs/promises");
+const otp_1 = require("./otp");
+const prompt_1 = require("./prompt");
 const pshell_1 = require("./pshell");
-function synchronizeTime() {
-    var _a;
-    return __awaiter(this, void 0, void 0, function* () {
-        (_a = AbortSignal.timeout) !== null && _a !== void 0 ? _a : (AbortSignal.timeout = function timeout(ms) {
-            const ctrl = new AbortController();
-            setTimeout(() => ctrl.abort(), ms);
-            return ctrl.signal;
-        });
-        try {
-            const response = yield fetch('http://www.google.com', { signal: AbortSignal.timeout(5000) });
-            const responseHeaders = response.headers;
-            const headerDate = responseHeaders.get('date');
-            const serverTime = headerDate ? Date.parse(headerDate) : Date.now();
-            const localTime = Date.now();
-            const timeDifference = serverTime - localTime;
-            return Date.now() + timeDifference;
-        }
-        catch (error) {
-            return Date.now();
-        }
-    });
+const time_1 = require("./time");
+function parseEntry(entry) {
+    return typeof entry === 'string' ? { secret: entry, steam: false } : { secret: entry.secret, steam: !!entry.steam };
 }
-function getTOTP(key) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const auth = new otpauth_1.TOTP({ secret: key, digits: 6, period: 30 });
-        const timestamp = yield synchronizeTime();
-        return auth.generate({ timestamp });
+function notFound(name) {
+    console.error(`${name} not found.`);
+    process.exitCode = 1;
+}
+function copyToClipboard(text) {
+    return new Promise((resolve, reject) => {
+        const clip = (0, child_process_1.spawn)('clip');
+        clip.on('error', reject);
+        clip.on('close', (code) => (code === 0 ? resolve() : reject(new Error(`clip exited with code ${code}`))));
+        clip.stdin.end(text);
     });
 }
-function getToken({ key, steam }) {
-    return steam ? (0, steam_totp_1.generateAuthCode)(key) : getTOTP(key).then((code) => code);
+async function readMaFile(path) {
+    const maFile = JSON.parse(await (0, promises_1.readFile)(path, 'utf8'));
+    if (!maFile?.shared_secret)
+        throw new Error('No shared_secret in maFile (if it is encrypted, decrypt it first).');
+    return maFile.shared_secret;
 }
-function getAuth({ objAuth, svc, clipboard, steam }) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const skey = objAuth[`${svc}`];
-        if (skey) {
-            const token = yield getToken({ key: skey, steam: steam });
-            if (clipboard)
-                (0, child_process_1.spawn)('clip').stdin.end(token);
-            return console.info(token);
-        }
-        return console.info(`${svc} not found.`);
-    });
+async function getAuth({ name, steam, clipboard, sync }) {
+    const objAuth = await (0, pshell_1.decrypt)();
+    if (!objAuth[name])
+        return notFound(name);
+    const entry = parseEntry(objAuth[name]);
+    const token = steam || entry.steam
+        ? (0, otp_1.steamCode)(entry.secret, await (0, time_1.syncedNow)('steam', sync))
+        : (0, otp_1.totpCode)(entry.secret, await (0, time_1.syncedNow)('totp', sync));
+    if (clipboard)
+        await copyToClipboard(token);
+    console.info(token);
 }
-exports.getAuth = getAuth;
-function addAuth({ objAuth, svc, sk, replace }) {
-    if (objAuth[`${svc}`] && !replace)
-        return console.info(`${svc} already exists, adds --replace to overwrite it.`);
-    objAuth[`${svc}`] = String(sk);
-    (0, pshell_1.encrypt)({ str: JSON.stringify(objAuth) });
-    return console.info(`${svc} added!`);
+async function addAuth({ name, secretKey, steam, mafile, replace }) {
+    let secret;
+    if (mafile) {
+        secret = await readMaFile(mafile);
+        steam = true;
+    }
+    else if (secretKey) {
+        secret = secretKey;
+        console.warn('Tip: omit <secret-key> to be prompted for it, so it does not end up in your shell history.');
+    }
+    else {
+        secret = await (0, prompt_1.readSecret)('Secret key: ');
+    }
+    if (!secret)
+        throw new Error('No secret key given.');
+    if (/^steam:\/\//i.test(secret))
+        steam = true;
+    // validates the secret before storing it
+    if (steam)
+        (0, otp_1.steamSecret)(secret);
+    else
+        (0, otp_1.totpCode)(secret, Date.now());
+    const objAuth = await (0, pshell_1.decrypt)();
+    if (objAuth[name] && !replace) {
+        console.error(`${name} already exists, add --replace to overwrite it.`);
+        process.exitCode = 1;
+        return;
+    }
+    objAuth[name] = steam ? { secret, steam: true } : secret;
+    await (0, pshell_1.encrypt)(objAuth);
+    console.info(`${name} added!`);
 }
-exports.addAuth = addAuth;
-function removeAuth({ objAuth, svc }) {
-    if (!objAuth[`${svc}`])
-        return console.info(`${svc} not found.`);
-    delete objAuth[`${svc}`];
-    (0, pshell_1.encrypt)({ str: JSON.stringify(objAuth) });
-    return console.info(`${svc} removed!`);
+async function removeAuth({ name }) {
+    const objAuth = await (0, pshell_1.decrypt)();
+    if (!objAuth[name])
+        return notFound(name);
+    delete objAuth[name];
+    await (0, pshell_1.encrypt)(objAuth);
+    console.info(`${name} removed!`);
 }
-exports.removeAuth = removeAuth;
-function listAuth({ objAuth, showsecret }) {
-    return showsecret ? console.table(objAuth) : console.table(Object.keys(objAuth));
+async function listAuth({ showsecret }) {
+    const objAuth = await (0, pshell_1.decrypt)();
+    if (!showsecret)
+        return console.table(Object.keys(objAuth));
+    console.warn('Warning: secret keys are shown in plain text.');
+    console.table(Object.fromEntries(Object.entries(objAuth).map(([name, entry]) => [name, parseEntry(entry)])));
 }
-exports.listAuth = listAuth;

package/dist/src/commands.js

@@ -10,43 +10,42 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleCommands = void 0;
+exports.handleCommands = handleCommands;
 const yargs_1 = __importDefault(require("yargs"));
 const helpers_1 = require("yargs/helpers");
 const auth_1 = require("./auth");
-function handleCommands(objAuth) {
-    return (0, yargs_1.default)((0, helpers_1.hideBin)(process.argv))
+async function handleCommands() {
+    await (0, yargs_1.default)((0, helpers_1.hideBin)(process.argv))
         .scriptName("win-cliauth")
-        .command('add <name> <secret-key>', 'adds authenticator with given secret key.', (y) => y.options({
-        'replace': {
-            description: "forces replacement of existing service.",
-            require: false
-        },
-    }), (argv) => (0, auth_1.addAuth)({ objAuth, svc: argv.name, sk: argv.secretKey, replace: argv.replace }))
-        .command('remove <name>', 'removes the given <name> authenticator.', {}, (argv) => (0, auth_1.removeAuth)({ objAuth, svc: argv.name }))
-        .command('get <name>', 'gets the token from service <name> (for steam guard, add --steam)', (y) => y.options({
-        'steam': {
-            description: "gets token from steam authenticator.",
-            required: false
-        },
-        'clipboard': {
-            description: 'adds authenticator code to clipboard',
-            required: false
-        }
-    }), (argv) => {
-        (0, auth_1.getAuth)({ objAuth, svc: argv.name, clipboard: argv.clipboard, steam: argv.steam });
-    })
+        .command('add <name> [secret-key]', 'adds authenticator with given secret key (prompts for it when omitted).', (y) => y
+        .positional('name', { type: 'string', demandOption: true })
+        .positional('secret-key', { type: 'string', description: 'base32 secret, otpauth:// URI, or Steam shared_secret' })
+        .options({
+        'replace': { type: 'boolean', description: "forces replacement of existing service." },
+        'steam': { type: 'boolean', description: "stores it as a Steam Guard authenticator." },
+        'mafile': { type: 'string', description: "imports the Steam shared_secret from a .maFile." },
+    }), (argv) => (0, auth_1.addAuth)(argv))
+        .command('remove <name>', 'removes the given <name> authenticator.', (y) => y.positional('name', { type: 'string', demandOption: true }), (argv) => (0, auth_1.removeAuth)(argv))
+        .command('get <name>', 'gets the token from service <name>', (y) => y
+        .positional('name', { type: 'string', demandOption: true })
+        .options({
+        'steam': { type: 'boolean', description: "gets token from steam authenticator." },
+        'clipboard': { type: 'boolean', description: 'adds authenticator code to clipboard' },
+        'sync': { type: 'boolean', description: 'forces a time re-sync instead of using the cached offset' },
+    }), (argv) => (0, auth_1.getAuth)(argv))
         .command('list', 'Prints out the list of authenticators.', (y) => y.options({
-        'showsecret': {
-            description: "Prints out the list with secret keys",
-            require: false
-        },
-    }), (argv) => (0, auth_1.listAuth)({ objAuth, showsecret: argv.showsecret }))
+        'showsecret': { type: 'boolean', description: "Prints out the list with secret keys" },
+    }), (argv) => (0, auth_1.listAuth)(argv))
         .wrap(null)
-        .showHelpOnFail(true)
         .demandCommand()
         .recommendCommands()
         .strict()
-        .parse();
+        .fail((msg, err, y) => {
+        if (err)
+            throw err;
+        y.showHelp();
+        console.error(`\n${msg}`);
+        process.exit(1);
+    })
+        .parseAsync();
 }
-exports.handleCommands = handleCommands;

package/dist/src/otp.js

@@ -0,0 +1,69 @@
+"use strict";
+/*
+Copyright (c) <2022>, <Pedro Lucas Magalhães de Oliveira>
+All rights reserved.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.steamSecret = steamSecret;
+exports.steamCode = steamCode;
+exports.totpCode = totpCode;
+const crypto_1 = require("crypto");
+const otpauth_1 = require("otpauth");
+const STEAM_CHARS = '23456789BCDFGHJKMNPQRTVWXY';
+function parseUri(uri) {
+    const otp = otpauth_1.URI.parse(uri);
+    if (!(otp instanceof otpauth_1.TOTP))
+        throw new Error('Only TOTP (time-based) otpauth:// URIs are supported.');
+    return otp;
+}
+function fromBase32(str) {
+    return Buffer.from(otpauth_1.Secret.fromBase32(str.replace(/[\s-]/g, '').toUpperCase()).bytes);
+}
+/**
+ * Decodes a Steam Guard secret in any of the formats tools export it in:
+ * - base64 `shared_secret` (as in a .maFile)
+ * - 40-char hex
+ * - base32, `steam://BASE32` or an otpauth:// URI
+ */
+function steamSecret(secret) {
+    const s = secret.trim();
+    let key;
+    if (/^otpauth:\/\//i.test(s))
+        key = Buffer.from(parseUri(s).secret.bytes);
+    else if (/^steam:\/\//i.test(s))
+        key = fromBase32(s.slice('steam://'.length));
+    else if (/^[0-9a-f]{40}$/i.test(s))
+        key = Buffer.from(s, 'hex');
+    else if (/^[A-Z2-7]{32}=*$/i.test(s.replace(/[\s-]/g, '')))
+        key = fromBase32(s.replace(/=+$/, ''));
+    else if (/^[A-Za-z0-9+/]+={0,2}$/.test(s))
+        key = Buffer.from(s, 'base64');
+    else
+        throw new Error('Invalid Steam secret: expected a base64 shared_secret, base32 secret or otpauth:// URI.');
+    if (key.length < 10)
+        throw new Error('Invalid Steam secret: decoded key is too short.');
+    return key;
+}
+function steamCode(secret, timestamp) {
+    const counter = Buffer.alloc(8);
+    counter.writeUInt32BE(Math.floor(timestamp / 1000 / 30), 4);
+    const hmac = (0, crypto_1.createHmac)('sha1', steamSecret(secret)).update(counter).digest();
+    const offset = hmac[19] & 0x0f;
+    let fullCode = hmac.readUInt32BE(offset) & 0x7fffffff;
+    let code = '';
+    for (let i = 0; i < 5; i++) {
+        code += STEAM_CHARS[fullCode % STEAM_CHARS.length];
+        fullCode = Math.floor(fullCode / STEAM_CHARS.length);
+    }
+    return code;
+}
+function totpCode(secret, timestamp) {
+    const s = secret.trim();
+    const totp = /^otpauth:\/\//i.test(s)
+        ? parseUri(s)
+        : new otpauth_1.TOTP({ secret: otpauth_1.Secret.fromBase32(s.replace(/[\s-]/g, '').replace(/=+$/, '').toUpperCase()), digits: 6, period: 30 });
+    return totp.generate({ timestamp });
+}

package/dist/src/prompt.js

@@ -0,0 +1,52 @@
+"use strict";
+/*
+Copyright (c) <2022>, <Pedro Lucas Magalhães de Oliveira>
+All rights reserved.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSecret = readSecret;
+async function readPiped() {
+    let data = '';
+    for await (const chunk of process.stdin)
+        data += chunk;
+    return data.split(/\r?\n/)[0].trim();
+}
+/** Reads a secret without echoing it (or the first line of piped stdin). */
+function readSecret(prompt) {
+    const { stdin, stderr } = process;
+    if (!stdin.isTTY)
+        return readPiped();
+    return new Promise((resolve) => {
+        let value = '';
+        stderr.write(prompt);
+        stdin.setRawMode(true);
+        stdin.setEncoding('utf8');
+        stdin.resume();
+        const done = () => {
+            stdin.setRawMode(false);
+            stdin.pause();
+            stdin.off('data', onData);
+            stderr.write('\n');
+        };
+        const onData = (chunk) => {
+            for (const ch of chunk) {
+                if (ch === '\r' || ch === '\n') {
+                    done();
+                    return resolve(value.trim());
+                }
+                if (ch === '\u0003') {
+                    done();
+                    process.exit(130);
+                }
+                if (ch === '\u007f' || ch === '\b')
+                    value = value.slice(0, -1);
+                else
+                    value += ch;
+            }
+        };
+        stdin.on('data', onData);
+    });
+}

package/dist/src/pshell.js

@@ -7,33 +7,65 @@ This source code is licensed under the BSD-style license found in the
 LICENSE file in the root directory of this source tree.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decrypt = exports.encrypt = void 0;
+exports.encrypt = encrypt;
+exports.decrypt = decrypt;
 const child_process_1 = require("child_process");
-function pshell({ cmd }) {
-    return (0, child_process_1.spawn)('powershell.exe', ['/c', cmd], { stdio: 'pipe' });
+// Secrets never appear in the script text (which is visible in process listings):
+// they travel through stdin/stdout as base64-encoded UTF-8.
+function pshell({ script, input = '' }) {
+    const encoded = Buffer.from(`$ErrorActionPreference = 'Stop'\n${script}`, 'utf16le').toString('base64');
+    return new Promise((resolve, reject) => {
+        const ps = (0, child_process_1.spawn)('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded], { stdio: 'pipe', windowsHide: true });
+        let stdout = '';
+        let stderr = '';
+        ps.stdout.on('data', (chunk) => (stdout += chunk));
+        ps.stderr.on('data', (chunk) => (stderr += chunk));
+        ps.on('error', (err) => reject(new Error(`Could not start PowerShell: ${err.message}`)));
+        ps.on('close', (code) => {
+            if (code === 0)
+                return resolve(stdout.trim());
+            reject(new Error(stderr.trim() || `PowerShell exited with code ${code}`));
+        });
+        ps.stdin.end(input);
+    });
 }
-function encrypt({ str }) {
-    return pshell({
-        cmd: `
-    $keyPath = "$($env:AppData)/win-cliauth/keys"
-    if (!(Test-Path "$keyPath")) { New-Item -Path $keyPath -Force } 
-    $secureString = ConvertTo-SecureString '${str}' -AsPlainText -Force
-    $encrypted = ConvertFrom-SecureString -SecureString $secureString
-    $encrypted > $keyPath
-  `
+const KEY_PATH = `
+$dir = Join-Path $env:AppData 'win-cliauth'
+$keyPath = Join-Path $dir 'keys'
+`;
+async function encrypt(vault) {
+    await pshell({
+        input: Buffer.from(JSON.stringify(vault), 'utf8').toString('base64'),
+        script: `${KEY_PATH}
+    $plain = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([Console]::In.ReadToEnd().Trim()))
+    $secureString = ConvertTo-SecureString $plain -AsPlainText -Force
+    $encrypted = ConvertFrom-SecureString -SecureString $secureString
+    New-Item -ItemType Directory -Path $dir -Force | Out-Null
+    $tmp = "$keyPath.tmp"
+    [IO.File]::WriteAllText($tmp, $encrypted)
+    if (Test-Path $keyPath) { [IO.File]::Replace($tmp, $keyPath, "$keyPath.bak") }
+    else { [IO.File]::Move($tmp, $keyPath) }
+    `,
     });
 }
-exports.encrypt = encrypt;
-function decrypt() {
-    return pshell({
-        cmd: `
-    $keyPath = "$($env:AppData)/win-cliauth/keys"
-    if (!(Test-Path "$keyPath")) { '{}' } 
-    else {
-      $secureString = Get-Content $keyPath | ConvertTo-SecureString
-      $decrypted = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureString))
-      $decrypted
-      }`
+async function decrypt() {
+    const output = await pshell({
+        script: `${KEY_PATH}
+    if (Test-Path $keyPath) {
+      $secureString = (Get-Content $keyPath -Raw).Trim() | ConvertTo-SecureString
+      $bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureString)
+      try { $decrypted = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr) }
+      finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr) }
+      [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($decrypted))
+    }
+    `,
     });
+    if (!output)
+        return {};
+    try {
+        return JSON.parse(Buffer.from(output, 'base64').toString('utf8'));
+    }
+    catch {
+        throw new Error('The key file is corrupted (a backup may exist at %AppData%\\win-cliauth\\keys.bak).');
+    }
 }
-exports.decrypt = decrypt;

package/dist/src/time.js

@@ -0,0 +1,74 @@
+"use strict";
+/*
+Copyright (c) <2022>, <Pedro Lucas Magalhães de Oliveira>
+All rights reserved.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncedNow = syncedNow;
+const promises_1 = require("fs/promises");
+const os_1 = require("os");
+const path_1 = require("path");
+const CACHE_PATH = (0, path_1.join)(process.env.APPDATA ?? (0, os_1.homedir)(), 'win-cliauth', 'time.json');
+const MAX_AGE = 6 * 60 * 60 * 1000;
+const TIMEOUT = 5000;
+async function readCache() {
+    try {
+        return JSON.parse(await (0, promises_1.readFile)(CACHE_PATH, 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+async function writeCache(cache) {
+    try {
+        await (0, promises_1.mkdir)((0, path_1.dirname)(CACHE_PATH), { recursive: true });
+        await (0, promises_1.writeFile)(CACHE_PATH, JSON.stringify(cache));
+    }
+    catch {
+        // the cache is an optimisation only
+    }
+}
+// Returns server time minus local time, in ms, measured at the request midpoint.
+async function fetchOffset(source) {
+    const start = Date.now();
+    let serverTime;
+    if (source === 'steam') {
+        const response = await fetch('https://api.steampowered.com/ITwoFactorService/QueryTime/v1/', {
+            method: 'POST',
+            body: '',
+            signal: AbortSignal.timeout(TIMEOUT),
+        });
+        const json = (await response.json());
+        serverTime = Number(json?.response?.server_time) * 1000;
+    }
+    else {
+        const response = await fetch('https://www.google.com', { method: 'HEAD', signal: AbortSignal.timeout(TIMEOUT) });
+        serverTime = Date.parse(response.headers.get('date') ?? '');
+    }
+    if (!Number.isFinite(serverTime))
+        throw new Error('Invalid server time');
+    return serverTime - (start + Date.now()) / 2;
+}
+/**
+ * Current time corrected by the offset to a trusted HTTPS time source.
+ * The offset is cached for a few hours; `force` re-syncs. On network failure
+ * the last known offset (or the local clock) is used.
+ */
+async function syncedNow(source, force = false) {
+    const cache = await readCache();
+    const cached = cache[source];
+    if (!force && cached && Date.now() - cached.checkedAt < MAX_AGE)
+        return Date.now() + cached.offset;
+    try {
+        const offset = await fetchOffset(source);
+        cache[source] = { offset, checkedAt: Date.now() };
+        await writeCache(cache);
+        return Date.now() + offset;
+    }
+    catch {
+        return Date.now() + (cached?.offset ?? 0);
+    }
+}

package/package.json

@@ -1,49 +1,56 @@
-{
-  "name": "win-cliauth",
-  "version": "1.0.3",
-  "description": "win-cliauth is a CLI-based OTP (One-Time Password) authenticator management tool for Windows.",
-  "author": "Pedro Lucas Magalhães <pedrolucasmag@gmail.com>",
-  "license": "BSD-3-Clause",
-  "scripts": {
-    "build": "tsc",
-    "release": "standard-version",
-    "prepack": "tsc"
-  },
-  "bin": {
-    "win-cliauth": "./dist/main.js"
-  },
-  "repository": "github:pedrolucasmag/win-cliauth",
-  "files": [
-    "dist",
-    "LICENSE",
-    "!dist/keys"
-  ],
-  "devDependencies": {
-    "@commitlint/cli": "^17.7.1",
-    "@commitlint/config-conventional": "^17.7.0",
-    "@types/node": "^18.11.10",
-    "@types/steam-totp": "^2.1.0",
-    "@types/yargs": "^17.0.10",
-    "@typescript-eslint/eslint-plugin": "^5.33.1",
-    "@typescript-eslint/parser": "^5.33.1",
-    "eslint": "^8.22.0",
-    "husky": "^8.0.3"
-  },
-  "os": [
-    "win32"
-  ],
-  "keywords": [
-    "otp",
-    "authenticator",
-    "cli",
-    "windows",
-    "steamguard",
-    "2fa",
-    "totp"
-  ],
-  "dependencies": {
-    "otpauth": "^9.1.4",
-    "steam-totp": "^2.1.2",
-    "yargs": "^17.5.1"
-  }
-}
+{
+  "name": "win-cliauth",
+  "version": "1.0.4",
+  "description": "win-cliauth is a CLI-based OTP (One-Time Password) authenticator management tool for Windows.",
+  "author": "Pedro Lucas Magalhães <pedrolucasmag@gmail.com>",
+  "license": "BSD-3-Clause",
+  "scripts": {
+    "build": "tsc",
+    "lint": "eslint . --ext .ts",
+    "test": "tsc && node --test \"dist/test/**/*.test.js\"",
+    "prepack": "tsc"
+  },
+  "bin": {
+    "win-cliauth": "dist/main.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pedrolucasmag/win-cliauth.git"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "!dist/test"
+  ],
+  "devDependencies": {
+    "@commitlint/cli": "^17.7.1",
+    "@commitlint/config-conventional": "^17.7.0",
+    "@types/node": "^18.11.10",
+    "@types/yargs": "^17.0.10",
+    "@typescript-eslint/eslint-plugin": "^8.0.0",
+    "@typescript-eslint/parser": "^8.0.0",
+    "eslint": "^8.57.0",
+    "husky": "^8.0.3",
+    "typescript": "^5.4.0"
+  },
+  "os": [
+    "win32"
+  ],
+  "keywords": [
+    "otp",
+    "authenticator",
+    "cli",
+    "windows",
+    "steamguard",
+    "2fa",
+    "totp",
+    "steam"
+  ],
+  "dependencies": {
+    "otpauth": "^9.1.4",
+    "yargs": "^17.5.1"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}