zcatalyst-cli 1.26.1 → 1.27.0

package/README.md

@@ -94,6 +94,7 @@ Command | Description
 **functions:setup** | Set up and configure the function directory in your project directory.
 **functions:add** | Add a function of the required stack to the function directory.
 **functions:shell** | Launch a node shell to test emulated functions of any stack or type, other than Advanced I/O functions.
+**functions:execute** | Execute Non-HTTP functions (Cron, Event, Integration, Job) locally. Accepts input via `--input <value>` (inline JSON, file path, or `-` for stdin), or interactively via inputs file.
 **functions:config** | Perform advanced configurations such as memory allocation on a function in your project.
 **functions:delete** | Delete a function from the remote console or the local directory.
 **appsail:add** | Link an already existing AppSail app to Catalyst Project.

package/lib/appsail-utils.d.ts

@@ -1,3 +1,3 @@
 import { TAppSailDetails } from './util_modules/config/lib/appsail';
 export declare function filterTargets(allTargets: Array<TAppSailDetails>): Array<TAppSailDetails>;
-export declare function validateAppSail(targDetails: Array<TAppSailDetails>): Promise<Array<TAppSailDetails>>;
+export declare function validateAppSail(targDetails: Array<TAppSailDetails>, resolveLocalRuntime?: boolean): [Promise<Array<TAppSailDetails>>, Record<string, string>];

package/lib/appsail-utils.js

@@ -24,6 +24,10 @@ const container_1 = require("./util_modules/container");
 const image_1 = require("@zcatalyst/container-plugin/out/endpoints/image");
 const fs_1 = require("./util_modules/fs");
 const util_1 = require("util");
+const node_1 = require("./fn-utils/lib/node");
+const java_1 = require("./fn-utils/lib/java");
+const ensure_python_1 = require("./init/dependencies/python/ensure-python");
+const path_1 = require("path");
 const OCI_IMAGE_INDEX_MEDIA_TYPES = [
     'application/vnd.oci.image.index.v1+json',
     'application/vnd.docker.distribution.manifest.list.v2+json'
@@ -98,158 +102,195 @@ function filterTargets(allTargets) {
     }
     return allTargets;
 }
-function validateAppSail(targDetails) {
-    return __awaiter(this, void 0, void 0, function* () {
-        let isSocket;
-        const getImageInfo = (target) => __awaiter(this, void 0, void 0, function* () {
-            switch (true) {
-                case target.source.startsWith(appsail_1.CONTAINER_IMAGE_PROTOCOLS.docker): {
-                    const imgTag = target.source.replace(appsail_1.CONTAINER_IMAGE_PROTOCOLS.docker, '');
-                    return (0, image_1.inspectImage)(imgTag);
+function validateAppSail(targDetails, resolveLocalRuntime = true) {
+    let isSocket;
+    const binPathMap = {};
+    const getImageInfo = (target) => __awaiter(this, void 0, void 0, function* () {
+        switch (true) {
+            case target.source.startsWith(appsail_1.CONTAINER_IMAGE_PROTOCOLS.docker): {
+                const imgTag = target.source.replace(appsail_1.CONTAINER_IMAGE_PROTOCOLS.docker, '');
+                return (0, image_1.inspectImage)(imgTag);
+            }
+            case target.source.startsWith(appsail_1.CONTAINER_IMAGE_PROTOCOLS.dockerArchive): {
+                const imgTar = target.source.replace(appsail_1.CONTAINER_IMAGE_PROTOCOLS.dockerArchive, '');
+                const isFile = yield fs_1.ASYNC.fileExists(imgTar);
+                if (!isFile) {
+                    throw new error_1.default('Invalid image tar path: ' + imgTar, { exit: 1 });
                 }
-                case target.source.startsWith(appsail_1.CONTAINER_IMAGE_PROTOCOLS.dockerArchive): {
-                    const imgTar = target.source.replace(appsail_1.CONTAINER_IMAGE_PROTOCOLS.dockerArchive, '');
-                    const isFile = yield fs_1.ASYNC.fileExists(imgTar);
-                    if (!isFile) {
-                        throw new error_1.default('Invalid image tar path: ' + imgTar, { exit: 1 });
-                    }
-                    return new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
-                        var _a;
-                        try {
-                            const manifestJsonStream = yield (0, image_1.getTarEntry)(imgTar, 'manifest.json');
-                            const repositoriesStream = yield (0, image_1.getTarEntry)(imgTar, 'repositories');
-                            const indexJsonStream = yield (0, image_1.getTarEntry)(imgTar, 'index.json');
-                            if (!indexJsonStream) {
-                                if (manifestJsonStream || repositoriesStream) {
-                                    throw new error_1.default('Legacy docker-archive format is not supported. Only OCI-compliant docker-archive formats (pure OCI or hybrid OCI) are supported.', { exit: 1 });
-                                }
-                                throw new error_1.default('Corrupted image tar :: required OCI metadata index.json not found in the tar', { exit: 1 });
-                            }
-                            const indexJson = yield fs_1.ASYNC.readStreamAsJSON(indexJsonStream);
-                            if (indexJson.schemaVersion !== 2) {
-                                throw new error_1.default('Corrupted image tar :: invalid index.json file. Unsupported schemaVersion', { exit: 1 });
+                return new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    try {
+                        const manifestJsonStream = yield (0, image_1.getTarEntry)(imgTar, 'manifest.json');
+                        const repositoriesStream = yield (0, image_1.getTarEntry)(imgTar, 'repositories');
+                        const indexJsonStream = yield (0, image_1.getTarEntry)(imgTar, 'index.json');
+                        if (!indexJsonStream) {
+                            if (manifestJsonStream || repositoriesStream) {
+                                throw new error_1.default('Legacy docker-archive format is not supported. Only OCI-compliant docker-archive formats (pure OCI or hybrid OCI) are supported.', { exit: 1 });
                             }
-                            const traversedDigests = new Set();
-                            const resolveImageManifestPath = (manifestIndex, sourceFile) => __awaiter(this, void 0, void 0, function* () {
-                                var _a;
-                                const imageDescriptor = (_a = manifestIndex.manifests) === null || _a === void 0 ? void 0 : _a.find((manifest) => {
-                                    if (!(manifest === null || manifest === void 0 ? void 0 : manifest.digest)) {
-                                        return false;
-                                    }
-                                    if (!manifest.mediaType) {
-                                        return true;
-                                    }
-                                    return (OCI_IMAGE_MANIFEST_MEDIA_TYPES.includes(manifest.mediaType) ||
-                                        OCI_IMAGE_INDEX_MEDIA_TYPES.includes(manifest.mediaType));
-                                });
-                                if (!(imageDescriptor === null || imageDescriptor === void 0 ? void 0 : imageDescriptor.digest)) {
-                                    throw new error_1.default(`Corrupted image tar :: invalid ${sourceFile} file. Unable to identify image manifest`, { exit: 1 });
-                                }
-                                if (traversedDigests.has(imageDescriptor.digest)) {
-                                    throw new error_1.default(`Corrupted image tar :: circular descriptor reference found for digest ${imageDescriptor.digest}`, { exit: 1 });
-                                }
-                                if (!imageDescriptor.mediaType ||
-                                    OCI_IMAGE_MANIFEST_MEDIA_TYPES.includes(imageDescriptor.mediaType)) {
-                                    return getBlobPathFromDigest(imageDescriptor.digest, sourceFile);
-                                }
-                                traversedDigests.add(imageDescriptor.digest);
-                                const nestedIndexPath = getBlobPathFromDigest(imageDescriptor.digest, sourceFile);
-                                const nestedIndexStream = yield (0, image_1.getTarEntry)(imgTar, nestedIndexPath);
-                                if (!nestedIndexStream) {
-                                    throw new error_1.default(`Corrupted image tar :: nested image index ${nestedIndexPath} not found in the tar`, { exit: 1 });
+                            throw new error_1.default('Corrupted image tar :: required OCI metadata index.json not found in the tar', { exit: 1 });
+                        }
+                        const indexJson = yield fs_1.ASYNC.readStreamAsJSON(indexJsonStream);
+                        if (indexJson.schemaVersion !== 2) {
+                            throw new error_1.default('Corrupted image tar :: invalid index.json file. Unsupported schemaVersion', { exit: 1 });
+                        }
+                        const traversedDigests = new Set();
+                        const resolveImageManifestPath = (manifestIndex, sourceFile) => __awaiter(this, void 0, void 0, function* () {
+                            var _a;
+                            const imageDescriptor = (_a = manifestIndex.manifests) === null || _a === void 0 ? void 0 : _a.find((manifest) => {
+                                if (!(manifest === null || manifest === void 0 ? void 0 : manifest.digest)) {
+                                    return false;
                                 }
-                                const nestedIndex = yield fs_1.ASYNC.readStreamAsJSON(nestedIndexStream);
-                                if (nestedIndex.schemaVersion !== 2) {
-                                    throw new error_1.default(`Corrupted image tar :: invalid nested image index ${nestedIndexPath}. Unsupported schemaVersion`, { exit: 1 });
+                                if (!manifest.mediaType) {
+                                    return true;
                                 }
-                                return resolveImageManifestPath(nestedIndex, nestedIndexPath);
+                                return (OCI_IMAGE_MANIFEST_MEDIA_TYPES.includes(manifest.mediaType) ||
+                                    OCI_IMAGE_INDEX_MEDIA_TYPES.includes(manifest.mediaType));
                             });
-                            const imageManifestPath = yield resolveImageManifestPath(indexJson, 'index.json');
-                            const imageManifestStream = yield (0, image_1.getTarEntry)(imgTar, imageManifestPath);
-                            if (!imageManifestStream) {
-                                throw new error_1.default(`Corrupted image tar :: image manifest ${imageManifestPath} not found in the tar`, { exit: 1 });
+                            if (!(imageDescriptor === null || imageDescriptor === void 0 ? void 0 : imageDescriptor.digest)) {
+                                throw new error_1.default(`Corrupted image tar :: invalid ${sourceFile} file. Unable to identify image manifest`, { exit: 1 });
+                            }
+                            if (traversedDigests.has(imageDescriptor.digest)) {
+                                throw new error_1.default(`Corrupted image tar :: circular descriptor reference found for digest ${imageDescriptor.digest}`, { exit: 1 });
                             }
-                            const imageManifest = yield fs_1.ASYNC.readStreamAsJSON(imageManifestStream);
-                            if (imageManifest.schemaVersion !== 2) {
-                                throw new error_1.default('Corrupted image tar :: invalid image manifest file. Unsupported schemaVersion', { exit: 1 });
+                            if (!imageDescriptor.mediaType ||
+                                OCI_IMAGE_MANIFEST_MEDIA_TYPES.includes(imageDescriptor.mediaType)) {
+                                return getBlobPathFromDigest(imageDescriptor.digest, sourceFile);
                             }
-                            const configDigest = (_a = imageManifest.config) === null || _a === void 0 ? void 0 : _a.digest;
-                            if (!configDigest) {
-                                throw new error_1.default('Corrupted image tar :: invalid image manifest file. Unable to identify the config blob', { exit: 1 });
+                            traversedDigests.add(imageDescriptor.digest);
+                            const nestedIndexPath = getBlobPathFromDigest(imageDescriptor.digest, sourceFile);
+                            const nestedIndexStream = yield (0, image_1.getTarEntry)(imgTar, nestedIndexPath);
+                            if (!nestedIndexStream) {
+                                throw new error_1.default(`Corrupted image tar :: nested image index ${nestedIndexPath} not found in the tar`, { exit: 1 });
                             }
-                            const configBlobPath = getBlobPathFromDigest(configDigest, imageManifestPath);
-                            const configFileStream = yield (0, image_1.getTarEntry)(imgTar, configBlobPath);
-                            if (!configFileStream) {
-                                throw new error_1.default(`Corrupted image tar :: config blob ${configBlobPath} not found in the tar`, { exit: 1 });
+                            const nestedIndex = yield fs_1.ASYNC.readStreamAsJSON(nestedIndexStream);
+                            if (nestedIndex.schemaVersion !== 2) {
+                                throw new error_1.default(`Corrupted image tar :: invalid nested image index ${nestedIndexPath}. Unsupported schemaVersion`, { exit: 1 });
                             }
-                            const configFile = yield fs_1.ASYNC.readStreamAsJSON(configFileStream);
-                            resolve(configFile);
+                            return resolveImageManifestPath(nestedIndex, nestedIndexPath);
+                        });
+                        const imageManifestPath = yield resolveImageManifestPath(indexJson, 'index.json');
+                        const imageManifestStream = yield (0, image_1.getTarEntry)(imgTar, imageManifestPath);
+                        if (!imageManifestStream) {
+                            throw new error_1.default(`Corrupted image tar :: image manifest ${imageManifestPath} not found in the tar`, { exit: 1 });
                         }
-                        catch (er) {
-                            er instanceof error_1.default
-                                ? reject(er)
-                                : reject(error_1.default.getErrorInstance(er));
+                        const imageManifest = yield fs_1.ASYNC.readStreamAsJSON(imageManifestStream);
+                        if (imageManifest.schemaVersion !== 2) {
+                            throw new error_1.default('Corrupted image tar :: invalid image manifest file. Unsupported schemaVersion', { exit: 1 });
                         }
-                    }));
-                }
-                default: {
-                    throw new error_1.default('Unsupported image source: ' + target.source, { exit: 1 });
-                }
-            }
-        });
-        const _details = targDetails.map((targ) => __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
-            if (targ.validity.valid) {
-                if (targ.runtime === 'custom') {
-                    if (isSocket === undefined) {
-                        isSocket = yield (0, container_1.isSocketAccessible)(false);
-                    }
-                    if (isSocket === false) {
-                        targ.validity = {
-                            valid: false,
-                            reason: 'ZCatalyst-CLI is unable to communicate with the Container runtime'
-                        };
-                        return targ;
-                    }
-                    try {
-                        const imgInfo = (yield getImageInfo(targ));
-                        const os = 'os' in imgInfo ? imgInfo.os : imgInfo.Os;
-                        if ((os === null || os === void 0 ? void 0 : os.toLowerCase()) !== 'linux') {
-                            targ.validity = {
-                                valid: false,
-                                reason: 'container image should be Linux based'
-                            };
-                            return targ;
+                        const configDigest = (_a = imageManifest.config) === null || _a === void 0 ? void 0 : _a.digest;
+                        if (!configDigest) {
+                            throw new error_1.default('Corrupted image tar :: invalid image manifest file. Unable to identify the config blob', { exit: 1 });
                         }
-                        const arch = 'architecture' in imgInfo
-                            ? imgInfo.architecture
-                            : imgInfo.Architecture;
-                        if ((arch === null || arch === void 0 ? void 0 : arch.toLowerCase()) !== 'amd64') {
-                            targ.validity = {
-                                valid: false,
-                                reason: 'container image should be amd64 based'
-                            };
-                            return targ;
+                        const configBlobPath = getBlobPathFromDigest(configDigest, imageManifestPath);
+                        const configFileStream = yield (0, image_1.getTarEntry)(imgTar, configBlobPath);
+                        if (!configFileStream) {
+                            throw new error_1.default(`Corrupted image tar :: config blob ${configBlobPath} not found in the tar`, { exit: 1 });
                         }
+                        const configFile = yield fs_1.ASYNC.readStreamAsJSON(configFileStream);
+                        resolve(configFile);
                     }
                     catch (er) {
-                        targ.validity = {
-                            valid: false,
-                            reason: er instanceof error_1.default ? er.message : (0, util_1.inspect)(er)
-                        };
+                        er instanceof error_1.default
+                            ? reject(er)
+                            : reject(error_1.default.getErrorInstance(er));
                     }
+                }));
+            }
+            default: {
+                throw new error_1.default('Unsupported image source: ' + target.source, { exit: 1 });
+            }
+        }
+    });
+    const _details = targDetails.map((targ) => __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        if (!targ.validity.valid) {
+            return targ;
+        }
+        if (targ.runtime === 'custom') {
+            if (isSocket === undefined) {
+                isSocket = yield (0, container_1.isSocketAccessible)(false);
+            }
+            if (isSocket === false) {
+                targ.validity = {
+                    valid: false,
+                    reason: 'ZCatalyst-CLI is unable to communicate with the Container runtime'
+                };
+                return targ;
+            }
+            try {
+                const imgInfo = (yield getImageInfo(targ));
+                const os = 'os' in imgInfo ? imgInfo.os : imgInfo.Os;
+                if ((os === null || os === void 0 ? void 0 : os.toLowerCase()) !== 'linux') {
+                    targ.validity = {
+                        valid: false,
+                        reason: 'container image should be Linux based'
+                    };
                     return targ;
                 }
-                if (((_a = targ.config) === null || _a === void 0 ? void 0 : _a.platform) !== 'war' && !((_b = targ.config) === null || _b === void 0 ? void 0 : _b.command)) {
+                const arch = 'architecture' in imgInfo
+                    ? imgInfo.architecture
+                    : imgInfo.Architecture;
+                if ((arch === null || arch === void 0 ? void 0 : arch.toLowerCase()) !== 'amd64') {
                     targ.validity = {
                         valid: false,
-                        reason: 'Start-up command missing'
+                        reason: 'container image should be amd64 based'
                     };
                     return targ;
                 }
             }
+            catch (er) {
+                targ.validity = {
+                    valid: false,
+                    reason: er instanceof error_1.default ? er.message : (0, util_1.inspect)(er)
+                };
+            }
             return targ;
-        }));
-        return Promise.all(_details);
-    });
+        }
+        try {
+            const stack = (_a = targ.config) === null || _a === void 0 ? void 0 : _a.stack;
+            if (!stack) {
+                throw new error_1.default(`Stack is not defined for AppSail target ${targ.name}`, {
+                    exit: 2
+                });
+            }
+            if (((_b = targ.config) === null || _b === void 0 ? void 0 : _b.platform) !== 'war' && !((_c = targ.config) === null || _c === void 0 ? void 0 : _c.command)) {
+                throw new error_1.default(`Start-up command missing for AppSail target ${targ.name}`, {
+                    exit: 2
+                });
+            }
+            if (resolveLocalRuntime === false) {
+                return targ;
+            }
+            if (binPathMap[stack]) {
+                return targ;
+            }
+            switch (true) {
+                case stack.startsWith('node'): {
+                    binPathMap[stack] = yield (0, node_1.ensureNodeVersion)(stack, true);
+                    break;
+                }
+                case stack.startsWith('java'): {
+                    const javaBinPath = yield (0, java_1.ensureJava)(stack);
+                    if (!javaBinPath) {
+                        throw new error_1.default(`Invalid bin path for ${stack}`, { exit: 1 });
+                    }
+                    binPathMap[stack] = javaBinPath;
+                    break;
+                }
+                case stack.startsWith('python'): {
+                    const stackVersion = stack.replace('python_', '');
+                    const pyExe = yield (0, ensure_python_1.ensurePython)(stackVersion.replace('_', '.'), false, true);
+                    binPathMap[stack] = (0, path_1.dirname)(pyExe);
+                    break;
+                }
+            }
+        }
+        catch (err) {
+            const error = error_1.default.getErrorInstance(err);
+            targ.validity.valid = false;
+            targ.validity.reason = error.message;
+        }
+        return targ;
+    }));
+    return [Promise.all(_details), binPathMap];
 }

package/lib/authentication/credential.d.ts

@@ -12,11 +12,12 @@ declare class Credential {
     private rToken;
     private client;
     maxExpiry: number;
-    private static crypt;
+    private static _crypt;
     private static isTempCred;
     static globalSelf: null | Credential;
     static oneTimeToken: null | string;
     private static credentialObject;
+    private static get crypt();
     constructor(tokenObj: ITokenObject);
     private _getClientForSalt;
     private _getTokenObjFromStore;

package/lib/authentication/credential.js

@@ -21,11 +21,18 @@ const js_js_1 = require("../util_modules/js.js");
 const index_1 = require("../util_modules/logger/index");
 const api_js_1 = __importDefault(require("../internal/api.js"));
 const crypt_1 = __importDefault(require("./crypt"));
+const key_manager_1 = __importDefault(require("./key-manager"));
 const util_1 = require("util");
 const dc_js_1 = require("../util_modules/dc.js");
 const option_js_1 = require("../util_modules/option.js");
 const path_1 = require("path");
 class Credential {
+    static get crypt() {
+        if (Credential._crypt === null) {
+            Credential._crypt = new crypt_1.default(key_manager_1.default.getEncryptionKey());
+        }
+        return Credential._crypt;
+    }
     constructor(tokenObj) {
         if (tokenObj.token === undefined ||
             js_js_1.JS.isEmpty(tokenObj.token) ||
@@ -66,9 +73,16 @@ class Credential {
         if (encryptedToken === null) {
             return null;
         }
-        const tokenObj = Credential.crypt.decrypt(encryptedToken);
+        const decrypted = Credential.crypt.decrypt(encryptedToken);
+        if (decrypted === null) {
+            return null;
+        }
+        const tokenObj = decrypted;
         const confCredential = new Credential(tokenObj);
         if (this.rToken === confCredential.rToken) {
+            if (Credential.crypt.isLegacyEncrypted(encryptedToken)) {
+                config_store_js_1.default.set((0, dc_js_1.getActiveDC)() + '.' + pth, Credential.crypt.encrypt(tokenObj));
+            }
             return tokenObj;
         }
         return null;
@@ -195,7 +209,10 @@ class Credential {
         let tokenObj;
         if (Credential.crypt.isEncrypted(token)) {
             const decryptToken = Credential.crypt.decrypt(token);
-            if (typeof decryptToken === 'string') {
+            if (decryptToken === null) {
+                tokenObj = {};
+            }
+            else if (typeof decryptToken === 'string') {
                 tokenObj = {
                     token: decryptToken
                 };
@@ -254,7 +271,7 @@ class Credential {
         });
     }
 }
-Credential.crypt = new crypt_1.default('ZC_TRAM');
+Credential._crypt = null;
 Credential.isTempCred = false;
 Credential.globalSelf = null;
 Credential.oneTimeToken = null;

package/lib/authentication/crypt.d.ts

@@ -1,12 +1,16 @@
 declare class Crypt {
     private encryptionKey;
-    private cryptAlgo;
-    constructor(password: string);
+    constructor(key: Buffer | string);
     decrypt(value: string): string | {
         [x: string]: unknown;
-    };
+    } | null;
     encrypt(value: unknown): string;
     isEncrypted(value: string): boolean;
+    isLegacyEncrypted(value: string): boolean;
+    private _hasMarkerAt;
+    private _decryptCurrent;
+    private _decryptLegacy;
+    private _deriveKey;
     private _serialize;
     private _deserialize;
 }

package/lib/authentication/crypt.js

@@ -1,39 +1,61 @@
 'use strict';
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
+const CRYPT_ALGO = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const DERIVED_KEY_LENGTH = 32;
+const PBKDF2_ITERATIONS = 100000;
+const PBKDF2_DIGEST = 'sha512';
+const MIN_PAYLOAD_LENGTH = IV_LENGTH + 1 + AUTH_TAG_LENGTH;
+const LEGACY_CRYPT_ALGO = 'aes-256-cbc';
+const LEGACY_IV_LENGTH = 16;
+const LEGACY_PBKDF2_ITERATIONS = 1000;
+const LEGACY_KEY = 'ZC_TRAM';
+const LEGACY_MIN_PAYLOAD_LENGTH = LEGACY_IV_LENGTH + 1;
 class Crypt {
-    constructor(password) {
-        this.encryptionKey = password;
-        this.cryptAlgo = 'aes-256-cbc';
+    constructor(key) {
+        this.encryptionKey = Buffer.isBuffer(key) ? key : Buffer.from(key);
     }
     decrypt(value) {
-        let data = Buffer.from(value, 'hex');
-        if (data.slice(16, 17).toString() !== ':') {
+        let data;
+        try {
+            data = Buffer.from(value, 'hex');
+        }
+        catch (err) {
             return value;
         }
-        const initializationVector = data.slice(0, 16);
-        const password = (0, crypto_1.pbkdf2Sync)(this.encryptionKey, initializationVector.toString(), 1000, 32, 'sha512');
-        const decipher = (0, crypto_1.createDecipheriv)(this.cryptAlgo, password, initializationVector);
-        data = Buffer.concat([decipher.update(data.slice(17)), decipher.final()]);
-        return this._deserialize(data.toString());
+        if (data.length >= MIN_PAYLOAD_LENGTH && this._hasMarkerAt(data, IV_LENGTH)) {
+            return this._decryptCurrent(data);
+        }
+        if (data.length >= LEGACY_MIN_PAYLOAD_LENGTH && this._hasMarkerAt(data, LEGACY_IV_LENGTH)) {
+            return this._decryptLegacy(data);
+        }
+        return value;
     }
     encrypt(value) {
         const data = this._serialize(value);
-        const initializationVector = (0, crypto_1.randomBytes)(16);
-        const password = (0, crypto_1.pbkdf2Sync)(this.encryptionKey, initializationVector.toString(), 1000, 32, 'sha512');
-        const cipher = (0, crypto_1.createCipheriv)(this.cryptAlgo, password, initializationVector);
+        const initializationVector = (0, crypto_1.randomBytes)(IV_LENGTH);
+        const derivedKey = this._deriveKey(initializationVector);
+        const cipher = (0, crypto_1.createCipheriv)(CRYPT_ALGO, derivedKey, initializationVector);
+        const encrypted = Buffer.concat([cipher.update(Buffer.from(data)), cipher.final()]);
+        const authTag = cipher.getAuthTag();
         const dataBuff = Buffer.concat([
             initializationVector,
             Buffer.from(':'),
-            cipher.update(Buffer.from(data)),
-            cipher.final()
+            authTag,
+            encrypted
         ]);
         return dataBuff.toString('hex');
     }
     isEncrypted(value) {
         try {
             const data = Buffer.from(value, 'hex');
-            if (data.slice(16, 17).toString() === ':') {
+            if (data.length >= MIN_PAYLOAD_LENGTH && this._hasMarkerAt(data, IV_LENGTH)) {
+                return true;
+            }
+            if (data.length >= LEGACY_MIN_PAYLOAD_LENGTH &&
+                this._hasMarkerAt(data, LEGACY_IV_LENGTH)) {
                 return true;
             }
         }
@@ -42,6 +64,55 @@ class Crypt {
         }
         return false;
     }
+    isLegacyEncrypted(value) {
+        try {
+            const data = Buffer.from(value, 'hex');
+            if (data.length >= MIN_PAYLOAD_LENGTH && this._hasMarkerAt(data, IV_LENGTH)) {
+                return false;
+            }
+            return (data.length >= LEGACY_MIN_PAYLOAD_LENGTH &&
+                this._hasMarkerAt(data, LEGACY_IV_LENGTH));
+        }
+        catch (err) {
+            return false;
+        }
+    }
+    _hasMarkerAt(data, offset) {
+        return data.slice(offset, offset + 1).toString() === ':';
+    }
+    _decryptCurrent(data) {
+        const initializationVector = data.slice(0, IV_LENGTH);
+        const authTag = data.slice(IV_LENGTH + 1, IV_LENGTH + 1 + AUTH_TAG_LENGTH);
+        const cipherText = data.slice(IV_LENGTH + 1 + AUTH_TAG_LENGTH);
+        const derivedKey = this._deriveKey(initializationVector);
+        try {
+            const decipher = (0, crypto_1.createDecipheriv)(CRYPT_ALGO, derivedKey, initializationVector);
+            decipher.setAuthTag(authTag);
+            const decrypted = Buffer.concat([decipher.update(cipherText), decipher.final()]);
+            return this._deserialize(decrypted.toString());
+        }
+        catch (err) {
+            return null;
+        }
+    }
+    _decryptLegacy(data) {
+        const initializationVector = data.slice(0, LEGACY_IV_LENGTH);
+        const password = (0, crypto_1.pbkdf2Sync)(LEGACY_KEY, initializationVector.toString(), LEGACY_PBKDF2_ITERATIONS, DERIVED_KEY_LENGTH, PBKDF2_DIGEST);
+        try {
+            const decipher = (0, crypto_1.createDecipheriv)(LEGACY_CRYPT_ALGO, password, initializationVector);
+            const decrypted = Buffer.concat([
+                decipher.update(data.slice(LEGACY_IV_LENGTH + 1)),
+                decipher.final()
+            ]);
+            return this._deserialize(decrypted.toString());
+        }
+        catch (err) {
+            return null;
+        }
+    }
+    _deriveKey(initializationVector) {
+        return (0, crypto_1.pbkdf2Sync)(this.encryptionKey, initializationVector, PBKDF2_ITERATIONS, DERIVED_KEY_LENGTH, PBKDF2_DIGEST);
+    }
     _serialize(value) {
         return JSON.stringify(value, null, '');
     }

package/lib/authentication/index.js

@@ -152,6 +152,7 @@ function login() {
         const localhost = (0, option_js_1.getOptionValue)('localhost', true);
         const result = yield new login_js_1.default(localhost).init();
         activeDC = result.dc;
+        (0, dc_js_1.updateActiveDC)(activeDC);
         config_store_js_1.default.set('usage', ans.collectUsage);
         config_store_js_1.default.set(`${activeDC}.user`, result.user);
         config_store_js_1.default.set(`${activeDC}.scopes`, result.scopes);

package/lib/authentication/key-manager.d.ts

@@ -0,0 +1,7 @@
+declare class KeyManager {
+    private static cachedKey;
+    private static get keyFilePath();
+    static getEncryptionKey(): Buffer;
+    private static _lockDownPermissions;
+}
+export default KeyManager;