claude-code/packages/acp-link/src/cert.ts

/**
 * Self-signed certificate generation for HTTPS support
 */

import { X509Certificate } from 'node:crypto'
import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
import { homedir, networkInterfaces } from 'node:os'
import { join } from 'node:path'
import { generate } from 'selfsigned'

/**
 * Get all LAN IPv4 addresses
 */
export function getLanIPs(): string[] {
  const ips: string[] = []
  const nets = networkInterfaces()
  for (const name of Object.keys(nets)) {
    for (const net of nets[name] || []) {
      // Skip internal (loopback) and non-IPv4 addresses
      if (!net.internal && net.family === 'IPv4') {
        ips.push(net.address)
      }
    }
  }
  return ips
}

/**
 * Extract IP addresses from certificate's Subject Alternative Name (SAN)
 * SAN format: "IP Address:192.168.1.100, IP Address:127.0.0.1, DNS:localhost"
 */
function extractSanIPs(x509: X509Certificate): string[] {
  const san = x509.subjectAltName
  if (!san) return []

  const ips: string[] = []
  // Parse "IP Address:x.x.x.x" entries from SAN string
  const parts = san.split(', ')
  for (const part of parts) {
    const match = part.match(/^IP Address:(.+)$/)
    if (match && match[1]) {
      ips.push(match[1])
    }
  }
  return ips
}

const CERT_DIR = join(homedir(), '.acp-proxy')
const KEY_PATH = join(CERT_DIR, 'key.pem')
const CERT_PATH = join(CERT_DIR, 'cert.pem')

// Certificate validity in days
const CERT_VALIDITY_DAYS = 365

export interface TlsOptions {
  key: string
  cert: string
}

/**
 * Get or generate self-signed certificate
 * Certificates are cached in ~/.acp-proxy/
 */
export async function getOrCreateCertificate(): Promise<TlsOptions> {
  // Ensure directory exists
  if (!existsSync(CERT_DIR)) {
    mkdirSync(CERT_DIR, { recursive: true })
  }

  // Check if certificates already exist and are still valid
  if (existsSync(KEY_PATH) && existsSync(CERT_PATH)) {
    const certPem = readFileSync(CERT_PATH, 'utf-8')
    const keyPem = readFileSync(KEY_PATH, 'utf-8')

    try {
      const x509 = new X509Certificate(certPem)
      const validTo = new Date(x509.validTo)
      const now = new Date()

      // Check if cert is expired or will expire within 7 days
      const daysUntilExpiry = Math.floor(
        (validTo.getTime() - now.getTime()) / (1000 * 60 * 60 * 24),
      )

      if (daysUntilExpiry <= 7) {
        // Certificate expired or expiring soon
        console.log(
          `⚠️  Certificate ${daysUntilExpiry <= 0 ? 'expired' : `expires in ${daysUntilExpiry} days`}, regenerating...`,
        )
      } else {
        // Check if current LAN IPs are in the certificate's SAN
        const currentLanIPs = getLanIPs()
        const certSanIPs = extractSanIPs(x509)

        // Check if all current LAN IPs are covered by the certificate
        const missingIPs = currentLanIPs.filter(ip => !certSanIPs.includes(ip))

        if (missingIPs.length === 0) {
          console.log(`🔐 Using existing certificate from ${CERT_DIR}`)
          console.log(`   Valid for ${daysUntilExpiry} more days`)
          return { key: keyPem, cert: certPem }
        }

        // LAN IP changed, regenerate
        console.log(
          `⚠️  LAN IP changed (missing: ${missingIPs.join(', ')}), regenerating certificate...`,
        )
      }
    } catch {
      // Failed to parse certificate, regenerate
      console.log(`⚠️  Invalid certificate, regenerating...`)
    }
  }

  // Generate new self-signed certificate
  console.log(`🔐 Generating self-signed certificate...`)

  const attrs = [{ name: 'commonName', value: 'ACP Proxy Server' }]

  // Calculate expiry date
  const notAfterDate = new Date()
  notAfterDate.setDate(notAfterDate.getDate() + CERT_VALIDITY_DAYS)

  // Build altNames: localhost + loopback + all LAN IPs
  const altNames: Array<{ type: 1 | 2 | 6 | 7; value?: string; ip?: string }> =
    [
      { type: 2, value: 'localhost' },
      { type: 7, ip: '127.0.0.1' },
      { type: 7, ip: '::1' },
    ]

  // Add all current LAN IPs
  const lanIPs = getLanIPs()
  for (const ip of lanIPs) {
    altNames.push({ type: 7, ip })
  }

  if (lanIPs.length > 0) {
    console.log(`   Including LAN IPs: ${lanIPs.join(', ')}`)
  }

  const pems = await generate(attrs, {
    keySize: 2048,
    notAfterDate,
    algorithm: 'sha256',
    extensions: [
      {
        name: 'basicConstraints',
        cA: true,
      },
      {
        name: 'keyUsage',
        keyCertSign: true,
        digitalSignature: true,
        keyEncipherment: true,
      },
      {
        name: 'extKeyUsage',
        serverAuth: true,
      },
      {
        name: 'subjectAltName',
        altNames,
      },
    ],
  })

  // Save certificates
  writeFileSync(KEY_PATH, pems.private)
  writeFileSync(CERT_PATH, pems.cert)

  console.log(`✅ Certificate saved to ${CERT_DIR}`)
  console.log(`   Valid for ${CERT_VALIDITY_DAYS} days`)
  console.log(
    `   ⚠️  First access will show a security warning - click "Advanced" → "Proceed"`,
  )

  return {
    key: pems.private,
    cert: pems.cert,
  }
}