Foinse foilsithe

CH-J Server Manager

Brabhsáil comhadlanna agus comhaid chun feidhmchlár áirithe a scaoileadh.

Íosluchtaigh foinse ZIP

CH-J / Server Manager 377 Comhaid

core-20261019T111616Z-160a00bfcddc Suimigh: 19 DFómh 2026, 22:11 · Tógtha: 19 DFómh 2026, 13:16

biometricService.js Suimigh: Dáta gan taifeadadh 7.3 KB · 114 líne

Cód Íosluchtaigh comhad

1"use strict";

2const fs = require("node:fs");

3const path = require("node:path");

4const crypto = require("node:crypto");

5const { atomicWriteJson } = require("../../storage/atomicFile");

6const { biometricError } = require("./nativeRunner");

const REASONS = Object.freeze({ cs: "Ověřte svou totožnost pro CH-J Server Manager", de: "Identität für CH-J Server Manager bestätigen", en: "Verify your identity for CH-J Server Manager" });

8class BiometricService {

9 constructor({ storageRoot, vaultStore, configStore, adapter, timeoutMs = 70000 }) {

10 Object.assign(this, { vaultStore, configStore, adapter, timeoutMs });

11 this.file = path.join(storageRoot, "security", "biometrics.json"); this.epoch = 0; this.active = null;

12 // Automatic prompt: armed at launch and after an automatic lock, consumed by the first attempt,

13 // so a cancelled prompt is never re-shown on its own (the button stays available).

14 this.autoArmed = true; this.autoPending = null;

15 }

16 armAutoUnlock() { this.autoArmed = true; }

17 disarmAutoUnlock() { this.autoArmed = false; }

18 // Main-process decision whether to show the OS prompt now; single-flight across renderer calls.

19 autoUnlock() {

    if (this.vaultStore.status().unlocked) return Promise.resolve({ attempted: false, reason: "UNLOCKED", status: this.vaultStore.status() });

21 if (this.autoPending) return this.autoPending;

22 if (!this.autoArmed) return Promise.resolve({ attempted: false, reason: "NOT_ARMED" });

23 if (!this.validMetadata()) return Promise.resolve({ attempted: false, reason: "NOT_ENABLED" });

24 this.autoArmed = false;

25 this.autoPending = (async () => {

26 const availability = await this.adapter.getAvailability();

27 if (!availability.available) return { attempted: false, reason: availability.code || "BIOMETRIC_UNAVAILABLE" };

28 try { return { attempted: true, status: await this.unlock() }; }

29 catch (error) { return { attempted: true, error: { code: error.code || "BIOMETRIC_FAILED" } }; }

30 })().finally(() => { this.autoPending = null; });

31 return this.autoPending;

32 }

33 reason() { return REASONS[this.configStore.get().ui.language] || REASONS.en; }

34 metadata() {

35 try {

36 const value = JSON.parse(fs.readFileSync(this.file, "utf8"));

      if (value.schema !== 1 || !/^[a-f0-9]{64}$/.test(value.entryId) || !/^[a-f0-9]{64}$/.test(value.vaultId)) return null;

      if (value.wrapped !== undefined && (typeof value.wrapped !== "string" || value.wrapped.length > 8192)) return null;

39 return value;

40 } catch { return null; }

41 }

42 validMetadata() {

43 const value = this.metadata();

    return value && value.vaultId === this.vaultStore.instanceId() && value.provider === this.adapter.info.provider ? value : null;

45 }

46 async getStatus() {

47 const availability = await this.adapter.getAvailability();

48 const enrolled = this.metadata(), valid = this.validMetadata();

    return { ...availability, enrolled: Boolean(enrolled), enabled: Boolean(valid), code: enrolled && !valid ? "BIOMETRIC_ENROLLMENT_INVALIDATED" : availability.code };

50 }

51 cancel(code = "BIOMETRIC_CANCELLED") { this.epoch++; this.active?.abort(biometricError(code)); }

52 async run(work) {

53 if (this.active) throw biometricError("BIOMETRIC_BUSY");

54 const controller = new AbortController(), epoch = this.epoch; this.active = controller;

    const check = () => { if (controller.signal.aborted || epoch !== this.epoch) throw controller.signal.reason || biometricError("BIOMETRIC_CANCELLED"); };

56 let abort;

    const interrupted = new Promise((_, reject) => { abort = () => reject(controller.signal.reason || biometricError("BIOMETRIC_CANCELLED")); controller.signal.addEventListener("abort", abort, { once: true }); });

58 const timer = setTimeout(() => this.cancel("BIOMETRIC_TIMEOUT"), this.timeoutMs);

    try { return await Promise.race([Promise.resolve().then(() => work({ signal: controller.signal, check })), interrupted]); }

    finally { clearTimeout(timer); controller.signal.removeEventListener("abort", abort); if (this.active === controller) this.active = null; }

61 }

62 async enable() {

63 this.vaultStore._assertUnlocked();

64 return this.run(async options => {

65 const availability = await this.adapter.getAvailability(); options.check();

66 if (!availability.available) throw biometricError(availability.code || "BIOMETRIC_UNAVAILABLE");

      const vaultId = this.vaultStore.instanceId(), entryId = crypto.randomBytes(32).toString("hex"), previous = this.metadata();

68 await this.adapter.enroll(entryId, this.reason(), options); options.check();

69 let attempted = false;

70 try {

71 let stored;

        await this.vaultStore.withUnlockKey(async key => { options.check(); attempted = true; stored = await this.adapter.storeProtectedKey(entryId, key, options); options.check(); });

73 if (vaultId !== this.vaultStore.instanceId()) throw biometricError("BIOMETRIC_ENROLLMENT_INVALIDATED");

74 // `wrapped` (macOS) is ciphertext only openable by this Mac's Secure Enclave after Touch ID.

        options.check(); atomicWriteJson(this.file, { schema: 1, vaultId, entryId, provider: this.adapter.info.provider, ...(stored?.wrapped ? { wrapped: stored.wrapped } : {}) });

76 } catch (error) { if (attempted) await this.adapter.removeEnrollment(entryId).catch(() => {}); throw error; }

      if (previous && previous.entryId !== entryId) await this.adapter.removeEnrollment(previous.entryId).catch(() => {});

78 return this.getStatus();

79 });

80 }

81 async disable({ reset = false } = {}) {

82 if (!reset) this.vaultStore._assertUnlocked();

83 this.cancel(); const previous = this.metadata();

84 // Revocation takes effect locally even if the OS credential store is currently offline.

85 try { fs.unlinkSync(this.file); } catch (error) { if (error.code !== "ENOENT") throw error; }

86 if (previous) await this.adapter.removeEnrollment(previous.entryId).catch(() => {});

87 return { enabled: false, enrolled: false };

88 }

89 async unlock() {

90 if (this.vaultStore.status().unlocked) return this.vaultStore.status();

91 const meta = this.validMetadata(); if (!meta) throw biometricError("BIOMETRIC_MASTER_PASSWORD_REQUIRED");

92 return this.run(async options => {

93 let key;

94 try {

        key = await this.adapter.retrieveProtectedKey(meta.entryId, this.reason(), options, meta.wrapped); options.check();

        if (meta.vaultId !== this.vaultStore.instanceId() || this.validMetadata()?.entryId !== meta.entryId) throw biometricError("BIOMETRIC_ENROLLMENT_INVALIDATED");

97 const status = await this.vaultStore.unlockWithKey(key);

98 this.disarmAutoUnlock();

99 return status;

100 } catch (error) {

101

        if (["BIOMETRIC_ENROLLMENT_INVALIDATED", "BIOMETRIC_INVALID_KEY"].includes(error.code)) { try { fs.unlinkSync(this.file); } catch {} await this.adapter.removeEnrollment(meta.entryId).catch(() => {}); }

102 throw error;

103 } finally { if (Buffer.isBuffer(key)) key.fill(0); }

104 });

105 }

106 async authenticateSensitiveAction() {

107 this.vaultStore._assertUnlocked();

108

    return this.run(async options => { await this.adapter.authenticate(this.reason(), options); options.check(); return { authenticated: true }; });

109 }

110 async requireSensitiveAction() {

111 if (this.configStore.get().security.requireSystemAuthentication) await this.authenticateSensitiveAction();

112 }

113}

114module.exports = { BiometricService, REASONS };

115

SHA-256

e02b4dccf186103683ee541b3ebf3ebe1d558c10a9f7a38576f5165237cb066a

CH-J Proprietary Software License 1.14 · Tá Foinse ar fáil faoin CH-J Proprietary Software License 1.14. Ní chuireann a infhaighteacht a athrú ar na téarmaí ceadúnais nó cearta breise a dheonú.

Cartlann SHA-256

a9605c0870a223b6a8542bb0705edd51d8b04f3069582653417a8397fabcc09a