promocrypt_core/

machine_id.rs

//! Machine identification for hardware binding.
//!
//! Collects hardware identifiers (MAC addresses, CPU ID, disk serial)
//! and hashes them to create a stable machine ID.

use ring::digest::{Context, SHA256};

use crate::error::{PromocryptError, Result};

/// Salt for machine ID hashing
const MACHINE_ID_SALT: &[u8] = b"promocrypt-machine-id-v1";

/// Get the machine identifier for the current system.
///
/// Collects hardware identifiers and hashes them to create a stable 32-byte ID.
///
/// # Returns
/// 32-byte machine ID, or error if no hardware identifiers are available.
///
/// # Example
///
/// ```no_run
/// use promocrypt_core::get_machine_id;
///
/// let machine_id = get_machine_id().expect("Failed to get machine ID");
/// println!("Machine ID: {}", hex::encode(machine_id));
/// ```
pub fn get_machine_id() -> Result<[u8; 32]> {
    let components = get_machine_id_components();

    if components.is_empty() {
        return Err(PromocryptError::MachineIdUnavailable(
            "No hardware identifiers available".to_string(),
        ));
    }

    // Combine and hash
    let combined = components.join(":");
    let mut context = Context::new(&SHA256);
    context.update(combined.as_bytes());
    context.update(MACHINE_ID_SALT);
    let digest = context.finish();

    let mut id = [0u8; 32];
    id.copy_from_slice(digest.as_ref());
    Ok(id)
}

/// Check if machine ID is available on this system.
pub fn is_machine_id_available() -> bool {
    !get_machine_id_components().is_empty()
}

/// Get individual hardware components (for debugging).
///
/// Returns a list of hardware identifiers found on the system.
pub fn get_machine_id_components() -> Vec<String> {
    let mut components = Vec::new();

    // 1. MAC addresses
    if let Some(macs) = get_mac_addresses() {
        components.extend(macs);
    }

    // 2. CPU ID
    if let Some(cpu_id) = get_cpu_id() {
        components.push(cpu_id);
    }

    // 3. Disk serial
    if let Some(disk_id) = get_disk_serial() {
        components.push(disk_id);
    }

    components
}

/// Get MAC addresses from network interfaces.
fn get_mac_addresses() -> Option<Vec<String>> {
    #[cfg(any(target_os = "linux", target_os = "macos", target_os = "windows"))]
    {
        use mac_address::mac_address_by_name;
        use sysinfo::Networks;

        let networks = Networks::new_with_refreshed_list();
        let mut macs: Vec<String> = Vec::new();

        for (interface_name, _) in networks.iter() {
            // Skip loopback and virtual interfaces
            if interface_name.starts_with("lo")
                || interface_name.starts_with("veth")
                || interface_name.starts_with("docker")
                || interface_name.starts_with("br-")
            {
                continue;
            }

            if let Ok(Some(mac)) = mac_address_by_name(interface_name) {
                let mac_str = mac.to_string();
                // Skip zero/broadcast MACs
                if mac_str != "00:00:00:00:00:00" && mac_str != "ff:ff:ff:ff:ff:ff" {
                    macs.push(mac_str);
                }
            }
        }

        // Sort for consistency
        macs.sort();
        macs.dedup();

        if macs.is_empty() { None } else { Some(macs) }
    }

    #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
    {
        None
    }
}

/// Get CPU identifier.
fn get_cpu_id() -> Option<String> {
    #[cfg(any(target_os = "linux", target_os = "macos", target_os = "windows"))]
    {
        use sysinfo::System;

        let sys = System::new_all();

        // Combine CPU brand with core count for uniqueness
        let cpus = sys.cpus();
        if let Some(cpu) = cpus.first() {
            let brand = cpu.brand().trim();
            if !brand.is_empty() {
                return Some(format!("{}:{}", brand, cpus.len()));
            }
        }

        None
    }

    #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
    {
        None
    }
}

/// Get disk serial number.
fn get_disk_serial() -> Option<String> {
    #[cfg(target_os = "linux")]
    {
        // Try to read from /sys
        use std::fs;

        // Try common disk paths
        for disk in ["sda", "nvme0n1", "vda", "xvda"] {
            let serial_path = format!("/sys/block/{}/device/serial", disk);
            if let Ok(serial) = fs::read_to_string(&serial_path) {
                let serial = serial.trim();
                if !serial.is_empty() {
                    return Some(format!("disk:{}", serial));
                }
            }

            // Try alternate path for NVMe
            let serial_path = format!("/sys/block/{}/serial", disk);
            if let Ok(serial) = fs::read_to_string(&serial_path) {
                let serial = serial.trim();
                if !serial.is_empty() {
                    return Some(format!("disk:{}", serial));
                }
            }
        }

        // Fallback to machine-id
        if let Ok(machine_id) = fs::read_to_string("/etc/machine-id") {
            let machine_id = machine_id.trim();
            if !machine_id.is_empty() {
                return Some(format!("machine-id:{}", machine_id));
            }
        }

        None
    }

    #[cfg(target_os = "macos")]
    {
        use std::process::Command;

        // Get hardware UUID via system_profiler
        if let Ok(output) = Command::new("system_profiler")
            .args(["SPHardwareDataType"])
            .output()
        {
            let stdout = String::from_utf8_lossy(&output.stdout);
            for line in stdout.lines() {
                if line.contains("Hardware UUID:")
                    && let Some(uuid) = line.split(':').nth(1)
                {
                    let uuid = uuid.trim();
                    if !uuid.is_empty() {
                        return Some(format!("hw-uuid:{}", uuid));
                    }
                }
            }
        }

        // Fallback: IOPlatformSerialNumber
        if let Ok(output) = Command::new("ioreg")
            .args(["-rd1", "-c", "IOPlatformExpertDevice"])
            .output()
        {
            let stdout = String::from_utf8_lossy(&output.stdout);
            for line in stdout.lines() {
                if line.contains("IOPlatformSerialNumber")
                    && let Some(serial) = line.split('"').nth(3)
                    && !serial.is_empty()
                {
                    return Some(format!("serial:{}", serial));
                }
            }
        }

        None
    }

    #[cfg(target_os = "windows")]
    {
        use std::process::Command;

        // Get motherboard serial via WMIC
        if let Ok(output) = Command::new("wmic")
            .args(["baseboard", "get", "serialnumber"])
            .output()
        {
            let stdout = String::from_utf8_lossy(&output.stdout);
            for line in stdout.lines().skip(1) {
                let serial = line.trim();
                if !serial.is_empty() && serial != "To be filled by O.E.M." {
                    return Some(format!("baseboard:{}", serial));
                }
            }
        }

        // Fallback: machine GUID from registry
        if let Ok(output) = Command::new("reg")
            .args([
                "query",
                "HKLM\\SOFTWARE\\Microsoft\\Cryptography",
                "/v",
                "MachineGuid",
            ])
            .output()
        {
            let stdout = String::from_utf8_lossy(&output.stdout);
            for line in stdout.lines() {
                if line.contains("MachineGuid") {
                    if let Some(guid) = line.split_whitespace().last() {
                        return Some(format!("machine-guid:{}", guid));
                    }
                }
            }
        }

        None
    }

    #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
    {
        None
    }
}

/// Create a machine ID from custom components.
///
/// Useful for testing or creating machine IDs from known values.
pub fn machine_id_from_components(components: &[&str]) -> [u8; 32] {
    let combined = components.join(":");
    let mut context = Context::new(&SHA256);
    context.update(combined.as_bytes());
    context.update(MACHINE_ID_SALT);
    let digest = context.finish();

    let mut id = [0u8; 32];
    id.copy_from_slice(digest.as_ref());
    id
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_machine_id_from_components() {
        let components = ["mac:00:11:22:33:44:55", "cpu:Intel:8"];
        let id1 = machine_id_from_components(&components);
        let id2 = machine_id_from_components(&components);

        assert_eq!(id1, id2);
        assert_eq!(id1.len(), 32);
    }

    #[test]
    fn test_different_components_different_id() {
        let id1 = machine_id_from_components(&["component1"]);
        let id2 = machine_id_from_components(&["component2"]);

        assert_ne!(id1, id2);
    }

    #[test]
    fn test_get_machine_id_components() {
        // This test just verifies it doesn't panic
        let components = get_machine_id_components();
        // On CI or containers, might be empty
        println!("Found {} components", components.len());
        for comp in &components {
            println!("  {}", comp);
        }
    }

    #[test]
    fn test_get_machine_id() {
        // May fail in containers/CI without hardware access
        match get_machine_id() {
            Ok(id) => {
                assert_eq!(id.len(), 32);
                println!("Machine ID: {}", hex::encode(id));
            }
            Err(e) => {
                println!("Could not get machine ID: {}", e);
            }
        }
    }

    #[test]
    fn test_is_machine_id_available() {
        let available = is_machine_id_available();
        println!("Machine ID available: {}", available);
        // Just ensure it doesn't panic
    }

    #[test]
    fn test_machine_id_deterministic() {
        // If machine ID is available, it should be deterministic
        if is_machine_id_available() {
            let id1 = get_machine_id().unwrap();
            let id2 = get_machine_id().unwrap();
            assert_eq!(id1, id2);
        }
    }
}