151 lines
9.1 KiB
JavaScript
151 lines
9.1 KiB
JavaScript
/** Owner-run private portal preparation. Access codes are accepted only by hidden TTY prompts. */
|
|
import fs from 'node:fs/promises';
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { decryptPortalStream, encryptPortalStream, validatePortalPayload } from '../src/utils/portal-crypto.mjs';
|
|
import { extractPayload, resourceReferences, rewriteResources } from './portal-resources.mjs';
|
|
import { applyRoleMappings, assertProductionMappings, manifestDigest, payloadDigest, summarizeMappings } from './portal-production.mjs';
|
|
|
|
const defaultRoot = fileURLToPath(new URL('../private/employee-portal/', import.meta.url));
|
|
const privateRoot = path.resolve(process.env.AIA_PORTAL_PRIVATE_ROOT || defaultRoot);
|
|
const timestamp = () => new Date().toISOString().replaceAll(':', '-');
|
|
|
|
async function hiddenPrompt(label) {
|
|
if (!process.stdin.isTTY || !process.stdin.setRawMode) throw new Error('An interactive private terminal is required');
|
|
process.stderr.write(label);
|
|
process.stdin.setRawMode(true); process.stdin.resume();
|
|
return new Promise((resolve, reject) => {
|
|
let value = '';
|
|
const finish = () => { process.stdin.off('data', onData); process.stdin.setRawMode(false); process.stdin.pause(); process.stderr.write('\n'); };
|
|
const onData = (data) => {
|
|
for (const char of data.toString('utf8')) {
|
|
if (char === '\u0003' || char === '\u0004') { finish(); reject(new Error('Canceled')); return; }
|
|
if (char === '\r' || char === '\n') { finish(); resolve(value); return; }
|
|
if (char === '\u007f' || char === '\b') value = value.slice(0, -1);
|
|
else if (char >= ' ') value += char;
|
|
}
|
|
};
|
|
process.stdin.on('data', onData);
|
|
});
|
|
}
|
|
async function readJson(file) { return JSON.parse(await fs.readFile(file, 'utf8')); }
|
|
async function atomicPrivateJson(file, value) {
|
|
const temporary = `${file}.tmp-${process.pid}`;
|
|
await fs.writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
|
|
await fs.chmod(temporary, 0o600);
|
|
await fs.rename(temporary, file);
|
|
}
|
|
async function backup(file, label) {
|
|
try { await fs.copyFile(file, path.join(privateRoot, `${label}-${timestamp()}.json`), fs.constants.COPYFILE_EXCL); }
|
|
catch (error) { if (error.code !== 'ENOENT') throw error; }
|
|
}
|
|
async function sourcePayload(source) {
|
|
if (!path.isAbsolute(source)) throw new Error('The private legacy source path must be absolute');
|
|
return validatePortalPayload(extractPayload(await fs.readFile(source, 'utf8')));
|
|
}
|
|
async function identifyStreams(payload) {
|
|
const staffCode = await hiddenPrompt('Staff access code: ');
|
|
const managementCode = await hiddenPrompt('Management access code: ');
|
|
const identify = async (code) => {
|
|
const unlocked = [];
|
|
for (const stream of payload.streams) if (await decryptPortalStream(stream, code) !== null) unlocked.push(stream.id);
|
|
if (unlocked.length !== 1) throw new Error('Each owner code must authenticate exactly one encrypted stream');
|
|
return unlocked[0];
|
|
};
|
|
const staff = await identify(staffCode), management = await identify(managementCode);
|
|
if (staff === management) throw new Error('Staff and management codes must identify different streams');
|
|
return { staff, management, staffCode, managementCode };
|
|
}
|
|
async function identifyCommand(payload) {
|
|
const roles = await identifyStreams(payload);
|
|
const metadata = { schema: 1, payloadSha256: payloadDigest(payload), staff: roles.staff, management: roles.management, verifiedAt: new Date().toISOString() };
|
|
roles.staffCode = ''; roles.managementCode = '';
|
|
await atomicPrivateJson(path.join(privateRoot, 'stream-role-map.json'), metadata);
|
|
console.log(JSON.stringify({ identified: true, staffStream: metadata.staff, managementStream: metadata.management }, null, 2));
|
|
}
|
|
async function loadRoleMap(payload) {
|
|
const roles = await readJson(path.join(privateRoot, 'stream-role-map.json'));
|
|
if (roles.schema !== 1 || roles.payloadSha256 !== payloadDigest(payload) || !roles.staff || !roles.management || roles.staff === roles.management) throw new Error('The private stream-role map is missing or does not match this ciphertext');
|
|
return roles;
|
|
}
|
|
async function mapCommand(payload, approve) {
|
|
const roles = await loadRoleMap(payload);
|
|
const manifestPath = path.join(privateRoot, 'manifest.json');
|
|
const manifest = await readJson(manifestPath);
|
|
const summary = summarizeMappings(manifest, roles);
|
|
const report = {
|
|
schema: 1,
|
|
generatedAt: new Date().toISOString(),
|
|
staffOnly: summary.staffOnly,
|
|
managementOnly: summary.managementOnly,
|
|
shared: summary.shared,
|
|
ambiguous: summary.ambiguous,
|
|
proposed: summary.proposed.map(({ localFile, roles: proposedRoles, filename }) => ({ localFile, roles: proposedRoles, filename })),
|
|
};
|
|
await atomicPrivateJson(path.join(privateRoot, `mapping-summary-${timestamp()}.json`), report);
|
|
if (approve) {
|
|
if (summary.ambiguous) throw new Error('Ambiguous resources require specific private resolution before mapping approval');
|
|
await backup(manifestPath, 'manifest-before-role-mapping');
|
|
await atomicPrivateJson(manifestPath, applyRoleMappings(manifest, roles, { approveShared: true }));
|
|
}
|
|
console.log(JSON.stringify({ staffOnly: report.staffOnly, managementOnly: report.managementOnly, shared: report.shared, ambiguous: report.ambiguous, approved: approve, automaticallyMapped: approve ? summary.proposed.length : 0 }, null, 2));
|
|
}
|
|
async function rewriteProduction(payload) {
|
|
const roles = await loadRoleMap(payload);
|
|
const manifestPath = path.join(privateRoot, 'manifest.json');
|
|
const manifest = await readJson(manifestPath);
|
|
const mappingCount = assertProductionMappings(manifest);
|
|
const codes = await identifyStreams(payload);
|
|
if (codes.staff !== roles.staff || codes.management !== roles.management) throw new Error('Entered codes do not match the previously verified stream-role relationship');
|
|
const codeByRole = { staff: codes.staffCode, management: codes.managementCode };
|
|
const roleByStream = new Map([[roles.staff, 'staff'], [roles.management, 'management']]);
|
|
const rewrittenStreams = []; let rewritten = 0; let legacyHubfsReferences = 0;
|
|
try {
|
|
for (const stream of payload.streams) {
|
|
const role = roleByStream.get(stream.id);
|
|
if (!role) throw new Error('Encrypted payload includes an unidentified stream');
|
|
let html = await decryptPortalStream(stream, codeByRole[role]);
|
|
if (html === null) throw new Error('Owner code no longer authenticates the expected stream');
|
|
const result = rewriteResources(html, manifest.resources, role);
|
|
rewritten += result.count;
|
|
legacyHubfsReferences += resourceReferences(result.html, stream.id).length;
|
|
if (legacyHubfsReferences) throw new Error('Legacy employee-resource links remain after rewriting');
|
|
const encrypted = await encryptPortalStream(stream.id, result.html, codeByRole[role]);
|
|
if (await decryptPortalStream(encrypted, codeByRole[role]) !== result.html) throw new Error('Private round-trip verification failed');
|
|
const otherRole = role === 'staff' ? 'management' : 'staff';
|
|
if (await decryptPortalStream(encrypted, codeByRole[otherRole]) !== null) throw new Error('Encrypted view role separation failed');
|
|
rewrittenStreams.push(encrypted);
|
|
html = '';
|
|
}
|
|
} finally { codes.staffCode = ''; codes.managementCode = ''; codeByRole.staff = ''; codeByRole.management = ''; }
|
|
const finalPayload = validatePortalPayload({ ...payload, streams: rewrittenStreams });
|
|
const output = path.join(privateRoot, 'approved-production-ciphertext.json');
|
|
await backup(output, 'approved-production-ciphertext-before-rewrite');
|
|
await atomicPrivateJson(output, finalPayload);
|
|
const readiness = {
|
|
schema: 1,
|
|
generatedAt: new Date().toISOString(),
|
|
payloadSha256: payloadDigest(finalPayload),
|
|
manifestSha256: manifestDigest(manifest),
|
|
protectedMappings: mappingCount,
|
|
legacyHubfsReferences,
|
|
rewrittenReferences: rewritten,
|
|
};
|
|
await atomicPrivateJson(path.join(privateRoot, 'production-readiness.json'), readiness);
|
|
console.log(JSON.stringify({ installed: true, payloadSha256: readiness.payloadSha256, protectedMappings: mappingCount, rewrittenReferences: rewritten, legacyHubfsReferences }, null, 2));
|
|
}
|
|
|
|
async function main() {
|
|
const [command, source, ...flags] = process.argv.slice(2);
|
|
const valid = new Set(['identify', 'propose-mappings', 'approve-mappings', 'rewrite-production']);
|
|
if (!valid.has(command) || !source || flags.length) throw new Error('Usage: node tools/employee-portal-migrate.mjs identify|propose-mappings|approve-mappings|rewrite-production /absolute/private/footer-source.txt');
|
|
await fs.mkdir(privateRoot, { recursive: true, mode: 0o700 });
|
|
await fs.chmod(privateRoot, 0o700);
|
|
const payload = await sourcePayload(source);
|
|
if (command === 'identify') await identifyCommand(payload);
|
|
else if (command === 'propose-mappings') await mapCommand(payload, false);
|
|
else if (command === 'approve-mappings') await mapCommand(payload, true);
|
|
else await rewriteProduction(payload);
|
|
}
|
|
main().catch(() => { console.error('Private portal preparation stopped. Check codes, source, mapping evidence and private-file permissions locally. No credential or decrypted content details are logged.'); process.exitCode = 1; });
|