credential-daemon.js

#!/usr/bin/env node
/**
 * credential-daemon.js - Secure Private Key Server
 *
 * DEXBot credential daemon for multi-bot private key management.
 * Enables bot processes to request pre-decrypted keys via Unix socket.
 * Keeps the derived vault secret in RAM so key updates remain visible while the daemon runs.
 *
 * ===============================================================================
 * DAEMON OPERATION
 * ===============================================================================
 *
 * STARTUP:
 * 1. Prompts for master password ONCE at startup
 * 2. Authenticates with profiles/keys.json
 * 3. Re-wraps the decrypted account cache with a random session secret
 * 4. Keeps the derived vault secret and session cache in RAM during operation
 * 5. Listens on Unix socket for credential requests
 * 6. Services private key requests from bot processes
 *
 * COMMUNICATION:
 * - Socket: profiles/run/dexbot-cred-daemon.sock (or $DEXBOT_CRED_RUNTIME_DIR, or $XDG_RUNTIME_DIR/dexbot2/)
 * - Ready file: profiles/run/dexbot-cred-daemon.ready (or $DEXBOT_CRED_RUNTIME_DIR, or $XDG_RUNTIME_DIR/dexbot2/)
 * - Startup timeout: 60 seconds (DAEMON_STARTUP_TIMEOUT_MS)
 * - Windows 10+: Supported; earlier Windows not supported
 *
 * REQUEST FORMAT:
 *   {"type": "private-key", "accountName": "account-name"}
 *
 * RESPONSE FORMAT:
 *   Success:  {"success": true, "privateKey": "5K..."}
 *   Failure:  {"success": false, "error": "Error message"}
 *
 * ===============================================================================
 * SECURITY BENEFITS
 * ===============================================================================
 *
 * - Master password prompt only once (at daemon startup)
 * - Individual bot processes have no access to the derived vault secret
 * - No persisted raw password in environment variables or config files
 * - Private keys never written to disk unencrypted
 * - Centralized key management
 * - Unix socket provides process-level isolation
 *
 * ===============================================================================
 * USAGE
 * ===============================================================================
 *
 * Direct:
 *   node credential-daemon.js
 *
 * Via PM2 (recommended):
 *   npm run pm2:unlock-start
 *   or: node dexbot.js pm2
 *
 * Bot processes then access keys automatically via socket connection.
 *
 * ===============================================================================
 */

process.umask(0o077);

const net = require('net');
const fs = require('fs');
const path = require('path');
const os = require('os');
const crypto = require('crypto');
const chainKeys = require('./modules/chain_keys');
const credentialPolicy = require('./modules/credential_policy');
const { createAccountClient } = require('./modules/bitshares_client');
const {
    assertPrivatePathSecurity,
    ensureCredentialRuntimeDirSync,
    getCredentialReadyFilePath,
    getCredentialRuntimeDir,
    getCredentialSocketPath,
} = require('./modules/credential_runtime');
const {
    buildSessionAccountCache,
    loadDaemonPrivateKey,
} = require('./modules/credential_session_cache');
const { fetchBootstrapPassword } = require('./modules/launcher/credential_bootstrap');
const { normalizeBootstrapCredential } = require('./modules/launcher/credential_secret');

// Platform check - Unix sockets require Unix-like systems or Windows 10+
const platform = os.platform();
if (platform === 'win32') {
    const release = os.release();
    const majorVersion = parseInt(release.split('.')[0], 10);
    if (majorVersion < 10) {
        console.error('❌ Credential daemon requires Windows 10 or later');
        console.error('   On older Windows, use: node bot.js <bot-name> with interactive prompt');
        process.exit(1);
    }
}

const RUNTIME_DIR = getCredentialRuntimeDir({ root: __dirname });
const SOCKET_PATH = getCredentialSocketPath({ root: __dirname, runtimeDir: RUNTIME_DIR });
const READY_FILE = getCredentialReadyFilePath({ root: __dirname, runtimeDir: RUNTIME_DIR });

let vaultSecret = null;
let sessionSecret = null;
let sessionAccountKeys = new Map();
let server = null;

// Policy layer and session management
let policyConfig = null;
let activeSessions = new Map(); // sessionId → { accountName, createdAt }
let auditLogPath = null;

function debugLog(message, err = null) {
    const suffix = err && err.message ? `: ${err.message}` : '';
    console.error(`[credential-daemon][debug] ${message}${suffix}`);
}

/**
 * Policy and session management helpers
 */

function generateSessionId() {
    return crypto.randomBytes(16).toString('hex');
}

function purgeExpiredSessions() {
    const ttl = (policyConfig && policyConfig.sessionTtlMs) || 86400000;
    const now = Date.now();
    for (const [id, session] of activeSessions) {
        if (now - session.createdAt > ttl) {
            activeSessions.delete(id);
        }
    }
}

function checkSessionValid(accountName, sessionId) {
    purgeExpiredSessions();
    if (!sessionId) {
        return false;
    }
    const session = activeSessions.get(sessionId);
    return session && session.accountName === accountName;
}

function appendAuditLog(entry) {
    if (!auditLogPath) return;
    const line = JSON.stringify(entry) + '\n';
    fs.appendFile(auditLogPath, line, (err) => {
        if (err) debugLog('Audit log write failed', err);
    });
}

async function resolveVaultSecret() {
    const envSecret = process.env.DAEMON_PASSWORD;
    if (envSecret) {
        delete process.env.DAEMON_PASSWORD;
        return normalizeBootstrapCredential(envSecret);
    }

    const bootstrapSocket = process.env.DEXBOT_CRED_BOOTSTRAP_SOCKET;
    delete process.env.DEXBOT_CRED_BOOTSTRAP_SOCKET;

    if (bootstrapSocket) {
        return normalizeBootstrapCredential(await fetchBootstrapPassword({
            socketPath: bootstrapSocket,
        }));
    }

    return chainKeys.authenticate();
}

function removeSecureStaleFile(filePath, expectedType) {
    if (!fs.existsSync(filePath)) {
        return;
    }

    // Intentionally throws rather than silently cleaning up: if the path fails
    // the security check (wrong owner, wrong permissions, or a symlink) we must
    // not remove it — doing so could mask an attack. The caller is expected to
    // surface the error and abort daemon startup.
    assertPrivatePathSecurity(filePath, {
        expectedType,
        requiredMode: 0o600,
    });

    fs.unlinkSync(filePath);
}

async function loadCurrentPrivateKey(accountName) {
    return loadDaemonPrivateKey(accountName, {
        vaultSecret,
        sessionAccountKeys,
        sessionSecret,
    });
}

async function executeOperationsWithClient(client, operations) {
    const ops = Array.isArray(operations) ? operations.filter(Boolean) : [];
    if (ops.length === 0) {
        return { success: true, operation_results: [], raw: null };
    }

    if (client.initPromise) {
        await client.initPromise;
    }

    if (typeof client.newTx !== 'function') {
        throw new Error('Signing client does not support newTx()');
    }

    const tx = client.newTx();
    for (const op of ops) {
        if (!op || !op.op_name || !op.op_data) {
            throw new Error('Each operation requires op_name and op_data');
        }
        if (typeof tx[op.op_name] !== 'function') {
            throw new Error(`Transaction builder does not support ${op.op_name}`);
        }
        tx[op.op_name](op.op_data);
    }

    const result = await tx.broadcast();
    const operationResults =
        (result && Array.isArray(result.operation_results) && result.operation_results) ||
        (result && result.trx && Array.isArray(result.trx.operation_results) && result.trx.operation_results) ||
        (Array.isArray(result) && result[0] && result[0].trx && Array.isArray(result[0].trx.operation_results) && result[0].trx.operation_results) ||
        [];

    return {
        success: true,
        raw: result,
        operation_results: operationResults,
    };
}

/**
 * Initialize daemon: authenticate and start listening
 */
async function initialize() {
    try {
        // Check if profiles/keys.json exists
        const keysPath = path.join(__dirname, 'profiles', 'keys.json');
        if (!fs.existsSync(keysPath)) {
            throw new Error('profiles/keys.json not found. Please run: node dexbot.js keys');
        }

        // Accept a one-shot bootstrap secret when launched by a wrapper,
        // otherwise prompt once interactively.
        vaultSecret = await resolveVaultSecret();
        const accountsData = chainKeys.loadAccounts();
        const sessionState = buildSessionAccountCache(accountsData, vaultSecret, {
            onDecryptError: (accountName, err) => {
                debugLog(`Skipping account '${accountName}' — decryption failed: ${err.message}`);
            },
        });
        sessionAccountKeys = sessionState.cache;
        sessionSecret = sessionState.sessionSecret;
        if (accountsData && typeof accountsData === 'object') {
            accountsData.accounts = null;
        }

        // Load policy config
        const policyConfigPath = path.join(__dirname, 'profiles', 'daemon-policies.json');
        policyConfig = credentialPolicy.loadPolicyConfig(policyConfigPath);
        if (policyConfig === null) {
            debugLog('No policy config loaded — using built-in defaults');
        }

        // Set audit log path
        const auditLogDir = path.join(__dirname, 'profiles', 'logs');
        if (!fs.existsSync(auditLogDir)) {
            try {
                fs.mkdirSync(auditLogDir, { recursive: true });
            } catch (err) {
                debugLog(`Failed to create audit log directory ${auditLogDir}: ${err.message}`);
            }
        }
        auditLogPath = path.join(auditLogDir, 'daemon-audit.jsonl');

        // Register SIGHUP handler for policy reload
        process.on('SIGHUP', () => {
            debugLog('Reloading policy config...');
            const newConfig = credentialPolicy.loadPolicyConfig(policyConfigPath, { forceReload: true });
            policyConfig = newConfig;
            debugLog(newConfig ? 'Policy config reloaded' : 'Policy config reload failed, using built-in defaults');
        });

        ensureCredentialRuntimeDirSync({ root: __dirname, runtimeDir: RUNTIME_DIR, socketPath: SOCKET_PATH, readyFilePath: READY_FILE });

        // Clean up old socket if it exists
        try {
            removeSecureStaleFile(SOCKET_PATH, 'socket');
            removeSecureStaleFile(READY_FILE, 'file');
        } catch (err) {
            throw new Error(`Insecure credential runtime path detected: ${err.message}`);
        }

        // Create server
        server = net.createServer(handleConnection);
        server.listen(SOCKET_PATH, () => {
            try {
                fs.chmodSync(SOCKET_PATH, 0o600);
                assertPrivatePathSecurity(SOCKET_PATH, { expectedType: 'socket', requiredMode: 0o600 });
            } catch (err) {
                debugLog(`Unable to chmod socket ${SOCKET_PATH}`, err);
            }
            // Create ready file to signal startup completion
            try {
                fs.writeFileSync(READY_FILE, Date.now().toString());
                fs.chmodSync(READY_FILE, 0o600);
                assertPrivatePathSecurity(READY_FILE, { expectedType: 'file', requiredMode: 0o600 });
            } catch (err) {
                debugLog(`Unable to update ready file permissions ${READY_FILE}`, err);
            }
        });

        server.on('error', (error) => {
            console.error('❌ Server error:', error.message);
            process.exit(1);
        });

        // Handle graceful shutdown
        process.on('SIGINT', shutdown);
        process.on('SIGTERM', shutdown);

    } catch (error) {
        console.error('❌', error.message);
        process.exit(1);
    }
}

/**
 * Handle incoming client connection to daemon.
 * Reads newline-delimited JSON requests and processes credential requests.
 * 
 * @param {net.Socket} socket - Connected client socket
 */
function handleConnection(socket) {
    let buffer = '';

    socket.on('data', (data) => {
        try {
            buffer += data.toString();

            // Look for newline-delimited JSON
            const lines = buffer.split('\n');
            buffer = lines.pop(); // Keep incomplete line in buffer

            for (const line of lines) {
                if (line.trim()) {
                    processRequest(line.trim(), socket);
                }
            }
        } catch (error) {
            sendError(socket, 'Invalid request');
        }
    });

    socket.on('end', () => {
        // Connection closed
    });

    socket.on('error', (error) => {
        // Client disconnected or error
    });
}

/**
 * Process incoming credential request from client.
 * Validates request format and retrieves private key if valid.
 * Sends success or error response back to client.
 * 
 * @param {string} requestStr - JSON string with {type, accountName}
 * @param {net.Socket} socket - Client socket to send response
 */
function processRequest(requestStr, socket) {
    // The outer try/catch handles JSON parse errors and any synchronous throws.
    // Each async branch manages its own errors via .catch() → sendError(), so
    // the outer catch is not expected to fire for async operation failures.
    try {
        const request = JSON.parse(requestStr);
        const { type, accountName } = request;

        if (!type) {
            return sendError(socket, 'Missing "type" field');
        }

        if (!accountName) {
            return sendError(socket, 'Missing "accountName" field');
        }

        if (type === 'probe-account') {
            loadCurrentPrivateKey(accountName)
                .then(() => {
                    // Session registration
                    const sessionId = generateSessionId();
                    activeSessions.set(sessionId, {
                        accountName,
                        createdAt: Date.now(),
                    });
                    appendAuditLog({
                        event: 'session_created',
                        accountName,
                        sessionId,
                        timestamp: new Date().toISOString(),
                    });
                    sendSuccess(socket, { sessionId });
                })
                .catch((error) => sendError(socket, error.message));
            return;
        }

        if (type === 'broadcast-operation') {
            const operation = request.operation;
            if (!operation || typeof operation !== 'object') {
                return sendError(socket, 'Missing "operation" field');
            }

            const sessionId = request.sessionId || null;

            // Session validation
            if (!checkSessionValid(accountName, sessionId)) {
                const reason = 'invalid or expired session';
                appendAuditLog({
                    event: 'sign_denied',
                    accountName,
                    sessionId,
                    reason: 'session: ' + reason,
                    timestamp: new Date().toISOString(),
                });
                return sendError(socket, credentialPolicy.POLICY_DENIED_PREFIX + reason);
            }

            // Source authentication (HMAC verification)
            // For broadcast-operation, we verify HMAC over [operation] (single-element array)
            const hmacResult = credentialPolicy.verifySourceHmac(
                { ...request, operations: [operation] },
                policyConfig
            );
            if (!hmacResult.valid) {
                appendAuditLog({
                    event: 'sign_denied',
                    accountName,
                    sessionId,
                    reason: 'source: ' + hmacResult.reason,
                    timestamp: new Date().toISOString(),
                });
                return sendError(socket, credentialPolicy.POLICY_DENIED_PREFIX + 'invalid source authentication');
            }
            if (hmacResult.skipped) {
                debugLog(`[warn] no botHmacSecret configured for ${accountName} — source authentication skipped`);
            }

            // Policy evaluation — treat as single-operation batch
            const policy = credentialPolicy.resolveAccountPolicy(policyConfig, accountName);
            const context = credentialPolicy.buildPolicyContext({
                ...request,
                operations: [operation],
            });

            credentialPolicy.evaluatePolicy(policy, context)
                .then((result) => {
                    if (!result.allow) {
                        appendAuditLog({
                            event: 'sign_denied',
                            accountName,
                            sessionId,
                            policyId: result.policyId,
                            reason: result.reason,
                            opCount: 1,
                            opTypes: [operation && operation.op_name].filter(Boolean),
                            timestamp: new Date().toISOString(),
                        });
                        sendError(socket, credentialPolicy.POLICY_DENIED_PREFIX + result.reason);
                        return;
                    }

                    // Policy passed — now load key material
                    return loadCurrentPrivateKey(accountName)
                        .then((privateKey) => {
                            const client = createAccountClient(accountName, privateKey);
                            return client.broadcast(operation);
                        })
                        .then((signResult) => {
                            appendAuditLog({
                                event: 'sign_allowed',
                                accountName,
                                sessionId,
                                opCount: 1,
                                opTypes: [operation && operation.op_name].filter(Boolean),
                                timestamp: new Date().toISOString(),
                            });
                            sendSuccess(socket, signResult);
                        });
                })
                .catch((error) => sendError(socket, error.message));
            return;
        }

        if (type === 'execute-operations') {
            const operations = request.operations;
            if (!Array.isArray(operations)) {
                return sendError(socket, 'Missing "operations" field');
            }

            const sessionId = request.sessionId || null;

            // Session validation
            if (!checkSessionValid(accountName, sessionId)) {
                const reason = 'invalid or expired session';
                appendAuditLog({
                    event: 'sign_denied',
                    accountName,
                    sessionId,
                    reason: 'session: ' + reason,
                    timestamp: new Date().toISOString(),
                });
                return sendError(socket, credentialPolicy.POLICY_DENIED_PREFIX + reason);
            }

            // Source authentication (HMAC verification)
            const hmacResult = credentialPolicy.verifySourceHmac(request, policyConfig);
            if (!hmacResult.valid) {
                appendAuditLog({
                    event: 'sign_denied',
                    accountName,
                    sessionId,
                    reason: 'source: ' + hmacResult.reason,
                    timestamp: new Date().toISOString(),
                });
                return sendError(socket, credentialPolicy.POLICY_DENIED_PREFIX + 'invalid source authentication');
            }
            if (hmacResult.skipped) {
                debugLog(`[warn] no botHmacSecret configured for ${accountName} — source authentication skipped`);
            }

            // Policy evaluation — before any key material is touched
            const policy = credentialPolicy.resolveAccountPolicy(policyConfig, accountName);
            const context = credentialPolicy.buildPolicyContext(request);

            credentialPolicy.evaluatePolicy(policy, context)
                .then((result) => {
                    if (!result.allow) {
                        appendAuditLog({
                            event: 'sign_denied',
                            accountName,
                            sessionId,
                            policyId: result.policyId,
                            reason: result.reason,
                            opCount: operations.length,
                            opTypes: operations.map((o) => o && o.op_name).filter(Boolean),
                            timestamp: new Date().toISOString(),
                        });
                        sendError(socket, credentialPolicy.POLICY_DENIED_PREFIX + result.reason);
                        return;
                    }

                    // Policy passed — now load key material
                    return loadCurrentPrivateKey(accountName)
                        .then((privateKey) => {
                            const client = createAccountClient(accountName, privateKey);
                            return executeOperationsWithClient(client, operations);
                        })
                        .then((signResult) => {
                            appendAuditLog({
                                event: 'sign_allowed',
                                accountName,
                                sessionId,
                                opCount: operations.length,
                                opTypes: operations.map((o) => o && o.op_name).filter(Boolean),
                                timestamp: new Date().toISOString(),
                            });
                            sendSuccess(socket, signResult);
                        });
                })
                .catch((error) => sendError(socket, error.message));
            return;
        }

        if (type === 'private-key') {
            loadCurrentPrivateKey(accountName)
                .then((privateKey) => sendSuccess(socket, { privateKey }))
                .catch((error) => sendError(socket, error.message));
            return;
        }

        return sendError(socket, `Unknown credential type: ${type}`);
    } catch (error) {
        sendError(socket, error.message);
    }
}

/**
 * Send successful credential response to client.
 * 
 * @param {net.Socket} socket - Client socket
 * @param {Object} data - Response data (e.g., {privateKey: "5K..."})
 */
function sendSuccess(socket, data) {
    const response = JSON.stringify({
        success: true,
        ...data
    });
    socket.write(response + '\n');
}

/**
 * Send error response to client.
 * 
 * @param {net.Socket} socket - Client socket
 * @param {string} message - Error message
 */
function sendError(socket, message) {
    const response = JSON.stringify({
        success: false,
        error: message
    });
    socket.write(response + '\n');
}

/**
 * Gracefully shutdown daemon.
 * Clears the derived vault secret from memory and closes server.
 */
function shutdown() {
    // Clear derived vault secret from memory
    if (vaultSecret) {
        if (Buffer.isBuffer(vaultSecret)) vaultSecret.fill(0);
        vaultSecret = null;
    }
    if (sessionSecret) {
        if (Buffer.isBuffer(sessionSecret)) sessionSecret.fill(0);
        sessionSecret = null;
    }
    if (sessionAccountKeys) {
        for (const [key, val] of sessionAccountKeys) {
            if (Buffer.isBuffer(val)) {
                val.fill(0);
            }
        }
        sessionAccountKeys.clear();
    }

    // Close server
    if (server) {
        server.close(() => {
            process.exit(0);
        });
    } else {
        process.exit(0);
    }
}

// Start daemon
initialize().catch(error => {
    console.error('❌', error.message);
    process.exit(1);
});