client_core/
auth.rs

1#![allow(dead_code)]
2//! Credential storage — `~/.cinch/config.json` (0600 permissions).
3//!
4//! This module is the source of truth for the disk credential format used
5//! by both CLI and desktop. The Go CLI's
6//! `cinch/cmd/internal/credstore/store.go` uses identical service/account
7//! conventions; do not change `SERVICE_NAME` or the account key format
8//! without coordinated updates on both sides.
9
10use std::fs;
11use std::path::PathBuf;
12
13use crate::config::{Config, MultiConfig, RelayProfile};
14
15pub const SERVICE_NAME: &str = "com.cinchcli";
16
17/// Legacy Keychain service name used by builds prior to 2026-04-29. The
18/// credstore reads this as a fallback and migrates entries forward on
19/// first successful read.
20pub const LEGACY_SERVICE_NAME: &str = "com.cinch.app";
21
22#[derive(Debug)]
23pub enum CredentialError {
24    NoEntry,
25    Io(String),
26    BadConfig(String),
27}
28
29impl std::fmt::Display for CredentialError {
30    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
31        match self {
32            CredentialError::NoEntry => write!(f, "no credential stored"),
33            CredentialError::Io(s) => write!(f, "io: {}", s),
34            CredentialError::BadConfig(s) => write!(f, "bad config: {}", s),
35        }
36    }
37}
38
39fn account_key(user_id: &str, device_id: &str) -> String {
40    format!("{}:{}", user_id, device_id)
41}
42
43fn config_path() -> Result<PathBuf, CredentialError> {
44    let home = dirs::home_dir()
45        .ok_or_else(|| CredentialError::Io("cannot determine home directory".into()))?;
46    Ok(home.join(".cinch").join("config.json"))
47}
48
49pub fn load_multi_config() -> Result<MultiConfig, CredentialError> {
50    let p = config_path()?;
51    if !p.exists() {
52        return Ok(MultiConfig::default());
53    }
54    let data =
55        fs::read_to_string(&p).map_err(|e| CredentialError::Io(format!("read config: {}", e)))?;
56    let v: serde_json::Value = serde_json::from_str(&data)
57        .map_err(|e| CredentialError::BadConfig(format!("parse config: {}", e)))?;
58    if v.get("relays").is_some() {
59        serde_json::from_value(v)
60            .map_err(|e| CredentialError::BadConfig(format!("parse multi_config: {}", e)))
61    } else {
62        let old: Config = serde_json::from_value(v)
63            .map_err(|e| CredentialError::BadConfig(format!("parse legacy config: {}", e)))?;
64        Ok(MultiConfig::from_legacy_pub(old))
65    }
66}
67
68pub fn save_multi_config(mc: &MultiConfig) -> Result<(), CredentialError> {
69    let p = config_path()?;
70    if let Some(dir) = p.parent() {
71        fs::create_dir_all(dir).map_err(|e| CredentialError::Io(format!("mkdir: {}", e)))?;
72    }
73    let data = serde_json::to_string_pretty(mc)
74        .map_err(|e| CredentialError::BadConfig(format!("marshal: {}", e)))?;
75    fs::write(&p, data).map_err(|e| CredentialError::Io(format!("write config: {}", e)))?;
76    #[cfg(unix)]
77    {
78        use std::os::unix::fs::PermissionsExt;
79        let mut perms = fs::metadata(&p)
80            .map_err(|e| CredentialError::Io(format!("stat: {}", e)))?
81            .permissions();
82        perms.set_mode(0o600);
83        fs::set_permissions(&p, perms)
84            .map_err(|e| CredentialError::Io(format!("chmod 0600: {}", e)))?;
85    }
86    Ok(())
87}
88
89pub fn load_config() -> Result<Config, CredentialError> {
90    Ok(load_multi_config()?.to_active_config())
91}
92
93pub fn save_config_to_disk(cfg: &Config) -> Result<(), CredentialError> {
94    let mut mc = load_multi_config()?;
95    if let Some(profile) = mc.active_profile_mut() {
96        profile.token = cfg.token.clone();
97        profile.user_id = cfg.user_id.clone();
98        profile.relay_url = cfg.relay_url.clone();
99        profile.hostname = cfg.hostname.clone();
100        profile.device_id = cfg.active_device_id.clone();
101        profile.credential_version = cfg.credential_version;
102        profile.encryption_key = cfg.encryption_key.clone();
103        profile.device_private_key = cfg.device_private_key.clone();
104        if profile.machine_id.is_empty() {
105            profile.machine_id = crate::machine::stable_machine_id();
106        }
107    } else {
108        let profile = RelayProfile::from_config(cfg, None);
109        let id = profile.id.clone();
110        mc.relays.push(profile);
111        mc.active_relay_id = Some(id);
112    }
113    save_multi_config(&mc)
114}
115
116/// Add a new RelayProfile to MultiConfig for a freshly-authenticated relay.
117/// Used by the deep-link callback when PendingRelayAdd is set.
118/// Returns relay_id.
119pub fn add_relay_profile(
120    user_id: &str,
121    device_id: &str,
122    token: &str,
123    relay_url: &str,
124    hostname: &str,
125    label: Option<&str>,
126    device_private_key: &str,
127) -> Result<String, CredentialError> {
128    let mut mc = load_multi_config()?;
129
130    let label_str = label
131        .filter(|s| !s.is_empty())
132        .map(|s| s.to_string())
133        .unwrap_or_else(|| {
134            url::Url::parse(relay_url)
135                .ok()
136                .and_then(|u| u.host_str().map(|h| h.to_string()))
137                .unwrap_or_else(|| relay_url.to_string())
138        });
139
140    let next_version = mc
141        .relays
142        .iter()
143        .map(|r| r.credential_version)
144        .max()
145        .unwrap_or(0)
146        .checked_add(1)
147        .ok_or_else(|| CredentialError::BadConfig("credential_version overflow".into()))?;
148
149    use ulid::Ulid;
150    let relay_id = Ulid::new().to_string();
151    let profile = RelayProfile {
152        id: relay_id.clone(),
153        label: label_str,
154        relay_url: relay_url.to_string(),
155        user_id: user_id.to_string(),
156        device_id: device_id.to_string(),
157        hostname: hostname.to_string(),
158        encryption_key: String::new(),
159        device_private_key: device_private_key.to_string(),
160        credential_version: next_version,
161        token: token.to_string(),
162        machine_id: crate::machine::stable_machine_id(),
163        email: String::new(),
164        identity_provider: String::new(),
165    };
166    mc.relays.push(profile);
167    if mc.active_relay_id.is_none() {
168        mc.active_relay_id = Some(relay_id.clone());
169    }
170    save_multi_config(&mc)?;
171    Ok(relay_id)
172}
173
174/// Remove credentials for a specific relay from MultiConfig.
175pub fn wipe_relay_credentials(relay_id: &str) -> Result<(), CredentialError> {
176    let mut mc = load_multi_config()?;
177    mc.relays.retain(|r| r.id != relay_id);
178    if mc.active_relay_id.as_deref() == Some(relay_id) {
179        mc.active_relay_id = mc.relays.first().map(|r| r.id.clone());
180    }
181    let new_version = mc
182        .relays
183        .iter()
184        .map(|r| r.credential_version)
185        .max()
186        .unwrap_or(0)
187        .checked_add(1)
188        .ok_or_else(|| CredentialError::BadConfig("credential_version overflow".into()))?;
189    if let Some(p) = mc.active_profile_mut() {
190        p.credential_version = new_version;
191    }
192    save_multi_config(&mc)
193}
194
195/// write_credentials stores token in config.json (0600).
196/// Bumps credential_version and persists via save_config.
197pub fn write_credentials(
198    user_id: &str,
199    device_id: &str,
200    token: &str,
201    relay_url: &str,
202    hostname: &str,
203) -> Result<(), CredentialError> {
204    let mut cfg = load_config()?;
205    cfg.token = token.to_string();
206    cfg.user_id = user_id.to_string();
207    cfg.active_device_id = device_id.to_string();
208    cfg.relay_url = relay_url.to_string();
209    cfg.hostname = hostname.to_string();
210    cfg.credential_version = cfg
211        .credential_version
212        .checked_add(1)
213        .ok_or_else(|| CredentialError::BadConfig("credential_version overflow".into()))?;
214    save_config_to_disk(&cfg)?;
215    Ok(())
216}
217
218/// read_credentials returns the token for the currently-configured (user_id, device_id).
219pub fn read_credentials(cfg: &Config) -> Result<String, CredentialError> {
220    if cfg.user_id.is_empty() || cfg.active_device_id.is_empty() {
221        return Err(CredentialError::NoEntry);
222    }
223    if cfg.token.is_empty() {
224        return Err(CredentialError::NoEntry);
225    }
226    Ok(cfg.token.clone())
227}
228
229/// wipe_credentials clears all credential fields from config, bumps
230/// credential_version, and best-effort deletes any Keychain entries left over
231/// from pre-2026-05-08 CLI builds.
232pub fn wipe_credentials() -> Result<(), CredentialError> {
233    let mut cfg = load_config()?;
234    let user_id = std::mem::take(&mut cfg.user_id);
235    let device_id = std::mem::take(&mut cfg.active_device_id);
236    cfg.token = String::new();
237    cfg.encryption_key = String::new();
238    cfg.device_private_key = String::new();
239    cfg.credential_version = cfg
240        .credential_version
241        .checked_add(1)
242        .ok_or_else(|| CredentialError::BadConfig("credential_version overflow".into()))?;
243    save_config_to_disk(&cfg)?;
244    crate::credstore::wipe_keyring_for(&user_id, &device_id);
245    Ok(())
246}
247
248/// Read the encryption key for a user from config.
249pub fn read_encryption_key(user_id: &str) -> Result<Vec<u8>, CredentialError> {
250    if user_id.is_empty() {
251        return Err(CredentialError::NoEntry);
252    }
253    let cfg = load_config()?;
254    if !cfg.encryption_key.is_empty() {
255        use base64::engine::general_purpose::URL_SAFE_NO_PAD;
256        use base64::Engine;
257        if let Ok(key_bytes) = URL_SAFE_NO_PAD.decode(&cfg.encryption_key) {
258            if key_bytes.len() == 32 {
259                return Ok(key_bytes);
260            }
261        }
262    }
263    Err(CredentialError::NoEntry)
264}
265
266/// Write the encryption key for a user to config.
267pub fn write_encryption_key(user_id: &str, key_bytes: &[u8]) -> Result<(), CredentialError> {
268    use base64::engine::general_purpose::URL_SAFE_NO_PAD;
269    use base64::Engine;
270    let _ = user_id;
271    let key_b64 = URL_SAFE_NO_PAD.encode(key_bytes);
272    let mut cfg = load_config()?;
273    cfg.encryption_key = key_b64;
274    save_config_to_disk(&cfg)?;
275    Ok(())
276}
277
278/// Poll `GET /auth/key-bundle` for up to 30s waiting for a key-bearer
279/// device to publish our encrypted user-key bundle. Returns `true` if
280/// a bundle arrived and the decrypted master key was persisted via
281/// `credstore::write_encryption_key`; returns `false` on timeout or
282/// any decode failure (with a single line printed to stderr per
283/// observed failure mode, mirroring the original CLI behavior).
284///
285/// `priv_b64` is the local device's freshly-generated ephemeral
286/// X25519 private key (matches the public key registered with the
287/// relay during `auth login`); `user_id` scopes the credstore entry.
288pub async fn poll_key_bundle(
289    client: &crate::http::RestClient,
290    priv_b64: &str,
291    user_id: &str,
292) -> bool {
293    use std::time::{Duration, Instant};
294    let deadline = Instant::now() + Duration::from_secs(30);
295    while Instant::now() < deadline {
296        match client.get_key_bundle().await {
297            Ok(bundle) if !bundle.encrypted_bundle.is_empty() => {
298                let aes_key = match crate::crypto::derive_shared_key(
299                    priv_b64,
300                    &bundle.ephemeral_public_key,
301                ) {
302                    Ok(k) => k,
303                    Err(e) => {
304                        eprintln!("  ECDH derive failed: {}", e);
305                        return false;
306                    }
307                };
308                let user_key_bytes =
309                    match crate::crypto::decrypt(&aes_key, &bundle.encrypted_bundle) {
310                        Ok(b) => b,
311                        Err(e) => {
312                            eprintln!("  Bundle decrypt failed: {}", e);
313                            return false;
314                        }
315                    };
316                if user_key_bytes.len() != 32 {
317                    eprintln!("  Unexpected user-key length: {}", user_key_bytes.len());
318                    return false;
319                }
320                let mut key = [0u8; 32];
321                key.copy_from_slice(&user_key_bytes);
322                if let Err(e) = crate::credstore::write_encryption_key(user_id, &key) {
323                    eprintln!("  Saving encryption key: {}", e);
324                    return false;
325                }
326                return true;
327            }
328            // 404 means the desktop has not published yet — keep polling.
329            _ => {}
330        }
331        tokio::time::sleep(Duration::from_secs(2)).await;
332    }
333    false
334}
335
336/// rotate_credentials persists a new token after a WS `token_rotated` event.
337pub fn rotate_credentials(
338    user_id: &str,
339    device_id: &str,
340    token: &str,
341    hostname: &str,
342) -> Result<(), CredentialError> {
343    let cfg = load_config()?;
344    write_credentials(user_id, device_id, token, &cfg.relay_url, hostname)
345}
346
347/// stdout marker emitted by `cinch auth login --headless` so the
348/// orchestrating side (e.g. `cinch pair` running over SSH) can pick
349/// up the device-code URL without parsing free-form output.
350///
351/// Format (single line, no trailing whitespace):
352///   <<CINCH-DEVICE-CODE>>{"url":"...","user_code":"..."}<<END>>
353pub const DEVICE_CODE_MARKER_START: &str = "<<CINCH-DEVICE-CODE>>";
354pub const DEVICE_CODE_MARKER_END: &str = "<<END>>";
355
356#[derive(Debug, serde::Serialize, serde::Deserialize)]
357pub struct DeviceCodeMarker {
358    pub url: String,
359    pub user_code: String,
360    #[serde(default, skip_serializing_if = "Option::is_none")]
361    pub approve_command: Option<String>,
362}
363
364pub fn format_device_code_marker(url: &str, user_code: &str) -> String {
365    let payload = serde_json::to_string(&DeviceCodeMarker {
366        url: url.to_string(),
367        user_code: user_code.to_string(),
368        approve_command: Some(format!("cinch auth approve {}", user_code)),
369    })
370    .expect("serialize DeviceCodeMarker");
371    format!(
372        "{}{}{}",
373        DEVICE_CODE_MARKER_START, payload, DEVICE_CODE_MARKER_END
374    )
375}
376
377pub fn parse_device_code_marker(line: &str) -> Option<DeviceCodeMarker> {
378    let start = line.find(DEVICE_CODE_MARKER_START)?;
379    let after_start = start + DEVICE_CODE_MARKER_START.len();
380    let end = line[after_start..].find(DEVICE_CODE_MARKER_END)?;
381    let payload = &line[after_start..after_start + end];
382    serde_json::from_str(payload).ok()
383}
384
385/// stdout marker emitted by the SSH pair script when the remote machine
386/// has either reused an existing matching pairing or completed a fresh
387/// device-code login. The orchestrating desktop uses this marker to
388/// verify that the remote's `user_id` matches the local active profile —
389/// without it, an exit-0 SSH session can falsely look successful when
390/// the remote was already signed in as a different user (or `cinch auth
391/// login` short-circuited before emitting any pairing evidence).
392///
393/// Format (single line, no trailing whitespace):
394///   <<CINCH-PAIRED-OK>>{"user_id":"...","device_id":"...","reused":bool}<<END>>
395pub const PAIRING_COMPLETE_MARKER_START: &str = "<<CINCH-PAIRED-OK>>";
396pub const PAIRING_COMPLETE_MARKER_END: &str = "<<END>>";
397
398#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
399pub struct PairingCompleteMarker {
400    pub user_id: String,
401    pub device_id: String,
402    /// `true` when the remote already had a matching pairing on disk and
403    /// the script skipped device-code; `false` when a fresh login ran.
404    #[serde(default)]
405    pub reused: bool,
406}
407
408pub fn parse_pairing_complete_marker(line: &str) -> Option<PairingCompleteMarker> {
409    let start = line.find(PAIRING_COMPLETE_MARKER_START)?;
410    let after_start = start + PAIRING_COMPLETE_MARKER_START.len();
411    let end = line[after_start..].find(PAIRING_COMPLETE_MARKER_END)?;
412    let payload = &line[after_start..after_start + end];
413    serde_json::from_str(payload).ok()
414}
415
416#[cfg(test)]
417mod tests {
418    use super::*;
419
420    #[test]
421    fn account_key_format() {
422        assert_eq!(account_key("u1", "d1"), "u1:d1");
423    }
424}
425
426#[cfg(test)]
427mod marker_tests {
428    use super::*;
429
430    #[test]
431    fn round_trip() {
432        let s = format_device_code_marker("https://x/y", "AB12");
433        let parsed = parse_device_code_marker(&s).unwrap();
434        assert_eq!(parsed.url, "https://x/y");
435        assert_eq!(parsed.user_code, "AB12");
436        assert_eq!(
437            parsed.approve_command.as_deref(),
438            Some("cinch auth approve AB12")
439        );
440    }
441
442    #[test]
443    fn old_marker_without_approve_command_still_parses() {
444        let s = "<<CINCH-DEVICE-CODE>>{\"url\":\"https://x/y\",\"user_code\":\"AB12\"}<<END>>";
445        let parsed = parse_device_code_marker(s).unwrap();
446        assert_eq!(parsed.url, "https://x/y");
447        assert_eq!(parsed.user_code, "AB12");
448        assert_eq!(parsed.approve_command, None);
449    }
450
451    #[test]
452    fn no_marker_returns_none() {
453        assert!(parse_device_code_marker("just some log line").is_none());
454    }
455
456    #[test]
457    fn truncated_marker_returns_none() {
458        assert!(
459            parse_device_code_marker("<<CINCH-DEVICE-CODE>>{\"url\":\"x\",\"user_code\":")
460                .is_none()
461        );
462    }
463
464    #[test]
465    fn pairing_complete_marker_round_trip() {
466        let s =
467            "<<CINCH-PAIRED-OK>>{\"user_id\":\"u1\",\"device_id\":\"d1\",\"reused\":true}<<END>>";
468        let parsed = parse_pairing_complete_marker(s).unwrap();
469        assert_eq!(parsed.user_id, "u1");
470        assert_eq!(parsed.device_id, "d1");
471        assert!(parsed.reused);
472    }
473
474    #[test]
475    fn pairing_complete_marker_defaults_reused_false() {
476        let s = "<<CINCH-PAIRED-OK>>{\"user_id\":\"u1\",\"device_id\":\"d1\"}<<END>>";
477        let parsed = parse_pairing_complete_marker(s).unwrap();
478        assert!(!parsed.reused);
479    }
480
481    #[test]
482    fn pairing_complete_marker_rejects_garbage() {
483        assert!(parse_pairing_complete_marker("just a log line").is_none());
484        assert!(parse_pairing_complete_marker("<<CINCH-PAIRED-OK>>not json<<END>>").is_none());
485    }
486}
client_core/auth.rs

client_core/
auth.rs
