Move to libs

libs/node/src/cli/baseProgram.ts

@@ -0,0 +1,113 @@
+import * as chalk from "chalk";
+
+import { StateService } from "jslib-common/abstractions/state.service";
+
+import { Response } from "./models/response";
+import { ListResponse } from "./models/response/listResponse";
+import { MessageResponse } from "./models/response/messageResponse";
+import { StringResponse } from "./models/response/stringResponse";
+
+export abstract class BaseProgram {
+  constructor(
+    protected stateService: StateService,
+    private writeLn: (s: string, finalLine: boolean, error: boolean) => void
+  ) {}
+
+  protected processResponse(
+    response: Response,
+    exitImmediately = false,
+    dataProcessor: () => string = null
+  ) {
+    if (!response.success) {
+      if (process.env.BW_QUIET !== "true") {
+        if (process.env.BW_RESPONSE === "true") {
+          this.writeLn(this.getJson(response), true, false);
+        } else {
+          this.writeLn(chalk.redBright(response.message), true, true);
+        }
+      }
+      const exitCode = process.env.BW_CLEANEXIT ? 0 : 1;
+      if (exitImmediately) {
+        process.exit(exitCode);
+      } else {
+        process.exitCode = exitCode;
+      }
+      return;
+    }
+
+    if (process.env.BW_RESPONSE === "true") {
+      this.writeLn(this.getJson(response), true, false);
+    } else if (response.data != null) {
+      let out: string = dataProcessor != null ? dataProcessor() : null;
+      if (out == null) {
+        if (response.data.object === "string") {
+          const data = (response.data as StringResponse).data;
+          if (data != null) {
+            out = data;
+          }
+        } else if (response.data.object === "list") {
+          out = this.getJson((response.data as ListResponse).data);
+        } else if (response.data.object === "message") {
+          out = this.getMessage(response);
+        } else {
+          out = this.getJson(response.data);
+        }
+      }
+
+      if (out != null && process.env.BW_QUIET !== "true") {
+        this.writeLn(out, true, false);
+      }
+    }
+    if (exitImmediately) {
+      process.exit(0);
+    } else {
+      process.exitCode = 0;
+    }
+  }
+
+  protected getJson(obj: any): string {
+    if (process.env.BW_PRETTY === "true") {
+      return JSON.stringify(obj, null, "  ");
+    } else {
+      return JSON.stringify(obj);
+    }
+  }
+
+  protected getMessage(response: Response): string {
+    const message = response.data as MessageResponse;
+    if (process.env.BW_RAW === "true") {
+      return message.raw;
+    }
+
+    let out = "";
+    if (message.title != null) {
+      if (message.noColor) {
+        out = message.title;
+      } else {
+        out = chalk.greenBright(message.title);
+      }
+    }
+    if (message.message != null) {
+      if (message.title != null) {
+        out += "\n";
+      }
+      out += message.message;
+    }
+    return out.trim() === "" ? null : out;
+  }
+
+  protected async exitIfAuthed() {
+    const authed = await this.stateService.getIsAuthenticated();
+    if (authed) {
+      const email = await this.stateService.getEmail();
+      this.processResponse(Response.error("You are already logged in as " + email + "."), true);
+    }
+  }
+
+  protected async exitIfNotAuthed() {
+    const authed = await this.stateService.getIsAuthenticated();
+    if (!authed) {
+      this.processResponse(Response.error("You are not logged in."), true);
+    }
+  }
+}

libs/node/src/cli/commands/login.command.ts

@@ -0,0 +1,624 @@
+import * as http from "http";
+
+import * as program from "commander";
+import * as inquirer from "inquirer";
+import Separator from "inquirer/lib/objects/separator";
+
+import { ApiService } from "jslib-common/abstractions/api.service";
+import { AuthService } from "jslib-common/abstractions/auth.service";
+import { CryptoService } from "jslib-common/abstractions/crypto.service";
+import { CryptoFunctionService } from "jslib-common/abstractions/cryptoFunction.service";
+import { EnvironmentService } from "jslib-common/abstractions/environment.service";
+import { I18nService } from "jslib-common/abstractions/i18n.service";
+import { PasswordGenerationService } from "jslib-common/abstractions/passwordGeneration.service";
+import { PlatformUtilsService } from "jslib-common/abstractions/platformUtils.service";
+import { PolicyService } from "jslib-common/abstractions/policy.service";
+import { StateService } from "jslib-common/abstractions/state.service";
+import { TwoFactorService } from "jslib-common/abstractions/twoFactor.service";
+import { TwoFactorProviderType } from "jslib-common/enums/twoFactorProviderType";
+import { NodeUtils } from "jslib-common/misc/nodeUtils";
+import { Utils } from "jslib-common/misc/utils";
+import { AuthResult } from "jslib-common/models/domain/authResult";
+import {
+  ApiLogInCredentials,
+  PasswordLogInCredentials,
+  SsoLogInCredentials,
+} from "jslib-common/models/domain/logInCredentials";
+import { TokenRequestTwoFactor } from "jslib-common/models/request/identityToken/tokenRequestTwoFactor";
+import { TwoFactorEmailRequest } from "jslib-common/models/request/twoFactorEmailRequest";
+import { UpdateTempPasswordRequest } from "jslib-common/models/request/updateTempPasswordRequest";
+import { ErrorResponse } from "jslib-common/models/response/errorResponse";
+
+import { Response } from "../models/response";
+import { MessageResponse } from "../models/response/messageResponse";
+
+export class LoginCommand {
+  protected validatedParams: () => Promise<any>;
+  protected success: () => Promise<MessageResponse>;
+  protected logout: () => Promise<void>;
+  protected canInteract: boolean;
+  protected clientId: string;
+  protected clientSecret: string;
+  protected email: string;
+
+  private ssoRedirectUri: string = null;
+
+  constructor(
+    protected authService: AuthService,
+    protected apiService: ApiService,
+    protected i18nService: I18nService,
+    protected environmentService: EnvironmentService,
+    protected passwordGenerationService: PasswordGenerationService,
+    protected cryptoFunctionService: CryptoFunctionService,
+    protected platformUtilsService: PlatformUtilsService,
+    protected stateService: StateService,
+    protected cryptoService: CryptoService,
+    protected policyService: PolicyService,
+    protected twoFactorService: TwoFactorService,
+    clientId: string
+  ) {
+    this.clientId = clientId;
+  }
+
+  async run(email: string, password: string, options: program.OptionValues) {
+    this.canInteract = process.env.BW_NOINTERACTION !== "true";
+
+    let ssoCodeVerifier: string = null;
+    let ssoCode: string = null;
+    let orgIdentifier: string = null;
+
+    let clientId: string = null;
+    let clientSecret: string = null;
+
+    let selectedProvider: any = null;
+
+    if (options.apikey != null) {
+      const apiIdentifiers = await this.apiIdentifiers();
+      clientId = apiIdentifiers.clientId;
+      clientSecret = apiIdentifiers.clientSecret;
+    } else if (options.sso != null && this.canInteract) {
+      const passwordOptions: any = {
+        type: "password",
+        length: 64,
+        uppercase: true,
+        lowercase: true,
+        numbers: true,
+        special: false,
+      };
+      const state = await this.passwordGenerationService.generatePassword(passwordOptions);
+      ssoCodeVerifier = await this.passwordGenerationService.generatePassword(passwordOptions);
+      const codeVerifierHash = await this.cryptoFunctionService.hash(ssoCodeVerifier, "sha256");
+      const codeChallenge = Utils.fromBufferToUrlB64(codeVerifierHash);
+      try {
+        const ssoParams = await this.openSsoPrompt(codeChallenge, state);
+        ssoCode = ssoParams.ssoCode;
+        orgIdentifier = ssoParams.orgIdentifier;
+      } catch {
+        return Response.badRequest("Something went wrong. Try again.");
+      }
+    } else {
+      if ((email == null || email === "") && this.canInteract) {
+        const answer: inquirer.Answers = await inquirer.createPromptModule({
+          output: process.stderr,
+        })({
+          type: "input",
+          name: "email",
+          message: "Email address:",
+        });
+        email = answer.email;
+      }
+      if (email == null || email.trim() === "") {
+        return Response.badRequest("Email address is required.");
+      }
+      if (email.indexOf("@") === -1) {
+        return Response.badRequest("Email address is invalid.");
+      }
+      this.email = email;
+
+      if (password == null || password === "") {
+        if (options.passwordfile) {
+          password = await NodeUtils.readFirstLine(options.passwordfile);
+        } else if (options.passwordenv && process.env[options.passwordenv]) {
+          password = process.env[options.passwordenv];
+        } else if (this.canInteract) {
+          const answer: inquirer.Answers = await inquirer.createPromptModule({
+            output: process.stderr,
+          })({
+            type: "password",
+            name: "password",
+            message: "Master password:",
+          });
+          password = answer.password;
+        }
+      }
+
+      if (password == null || password === "") {
+        return Response.badRequest("Master password is required.");
+      }
+    }
+
+    let twoFactorToken: string = options.code;
+    let twoFactorMethod: TwoFactorProviderType = null;
+    try {
+      if (options.method != null) {
+        twoFactorMethod = parseInt(options.method, null);
+      }
+    } catch (e) {
+      return Response.error("Invalid two-step login method.");
+    }
+
+    const twoFactor =
+      twoFactorToken == null
+        ? null
+        : new TokenRequestTwoFactor(twoFactorMethod, twoFactorToken, false);
+
+    try {
+      if (this.validatedParams != null) {
+        await this.validatedParams();
+      }
+
+      let response: AuthResult = null;
+      if (clientId != null && clientSecret != null) {
+        response = await this.authService.logIn(new ApiLogInCredentials(clientId, clientSecret));
+      } else if (ssoCode != null && ssoCodeVerifier != null) {
+        response = await this.authService.logIn(
+          new SsoLogInCredentials(
+            ssoCode,
+            ssoCodeVerifier,
+            this.ssoRedirectUri,
+            orgIdentifier,
+            twoFactor
+          )
+        );
+      } else {
+        response = await this.authService.logIn(
+          new PasswordLogInCredentials(email, password, null, twoFactor)
+        );
+      }
+      if (response.captchaSiteKey) {
+        const credentials = new PasswordLogInCredentials(email, password);
+        const handledResponse = await this.handleCaptchaRequired(twoFactor, credentials);
+
+        // Error Response
+        if (handledResponse instanceof Response) {
+          return handledResponse;
+        } else {
+          response = handledResponse;
+        }
+      }
+      if (response.requiresTwoFactor) {
+        const twoFactorProviders = this.twoFactorService.getSupportedProviders(null);
+        if (twoFactorProviders.length === 0) {
+          return Response.badRequest("No providers available for this client.");
+        }
+
+        if (twoFactorMethod != null) {
+          try {
+            selectedProvider = twoFactorProviders.filter((p) => p.type === twoFactorMethod)[0];
+          } catch (e) {
+            return Response.error("Invalid two-step login method.");
+          }
+        }
+
+        if (selectedProvider == null) {
+          if (twoFactorProviders.length === 1) {
+            selectedProvider = twoFactorProviders[0];
+          } else if (this.canInteract) {
+            const twoFactorOptions: (string | Separator)[] = twoFactorProviders.map((p) => p.name);
+            twoFactorOptions.push(new inquirer.Separator());
+            twoFactorOptions.push("Cancel");
+            const answer: inquirer.Answers = await inquirer.createPromptModule({
+              output: process.stderr,
+            })({
+              type: "list",
+              name: "method",
+              message: "Two-step login method:",
+              choices: twoFactorOptions,
+            });
+            const i = twoFactorOptions.indexOf(answer.method);
+            if (i === twoFactorOptions.length - 1) {
+              return Response.error("Login failed.");
+            }
+            selectedProvider = twoFactorProviders[i];
+          }
+          if (selectedProvider == null) {
+            return Response.error("Login failed. No provider selected.");
+          }
+        }
+
+        if (
+          twoFactorToken == null &&
+          response.twoFactorProviders.size > 1 &&
+          selectedProvider.type === TwoFactorProviderType.Email
+        ) {
+          const emailReq = new TwoFactorEmailRequest();
+          emailReq.email = this.authService.email;
+          emailReq.masterPasswordHash = this.authService.masterPasswordHash;
+          await this.apiService.postTwoFactorEmail(emailReq);
+        }
+
+        if (twoFactorToken == null) {
+          if (this.canInteract) {
+            const answer: inquirer.Answers = await inquirer.createPromptModule({
+              output: process.stderr,
+            })({
+              type: "input",
+              name: "token",
+              message: "Two-step login code:",
+            });
+            twoFactorToken = answer.token;
+          }
+          if (twoFactorToken == null || twoFactorToken === "") {
+            return Response.badRequest("Code is required.");
+          }
+        }
+
+        response = await this.authService.logInTwoFactor(
+          new TokenRequestTwoFactor(selectedProvider.type, twoFactorToken),
+          null
+        );
+      }
+
+      if (response.captchaSiteKey) {
+        const twoFactorRequest = new TokenRequestTwoFactor(selectedProvider.type, twoFactorToken);
+        const handledResponse = await this.handleCaptchaRequired(twoFactorRequest);
+
+        // Error Response
+        if (handledResponse instanceof Response) {
+          return handledResponse;
+        } else {
+          response = handledResponse;
+        }
+      }
+
+      if (response.requiresTwoFactor) {
+        return Response.error("Login failed.");
+      }
+
+      if (response.resetMasterPassword) {
+        return Response.error(
+          "In order to log in with SSO from the CLI, you must first log in" +
+            " through the web vault to set your master password."
+        );
+      }
+
+      // Handle Updating Temp Password if NOT using an API Key for authentication
+      if (response.forcePasswordReset && clientId == null && clientSecret == null) {
+        return await this.updateTempPassword();
+      }
+
+      return await this.handleSuccessResponse();
+    } catch (e) {
+      return Response.error(e);
+    }
+  }
+
+  private async handleSuccessResponse(): Promise<Response> {
+    if (this.success != null) {
+      const res = await this.success();
+      return Response.success(res);
+    } else {
+      const res = new MessageResponse("You are logged in!", null);
+      return Response.success(res);
+    }
+  }
+
+  private async updateTempPassword(error?: string): Promise<Response> {
+    // If no interaction available, alert user to use web vault
+    if (!this.canInteract) {
+      await this.logout();
+      this.authService.logOut(() => {
+        /* Do nothing */
+      });
+      return Response.error(
+        new MessageResponse(
+          "An organization administrator recently changed your master password. In order to access the vault, you must update your master password now via the web vault. You have been logged out.",
+          null
+        )
+      );
+    }
+
+    if (this.email == null || this.email === "undefined") {
+      this.email = await this.stateService.getEmail();
+    }
+
+    // Get New Master Password
+    const baseMessage =
+      "An organization administrator recently changed your master password. In order to access the vault, you must update your master password now.\n" +
+      "Master password: ";
+    const firstMessage = error != null ? error + baseMessage : baseMessage;
+    const mp: inquirer.Answers = await inquirer.createPromptModule({ output: process.stderr })({
+      type: "password",
+      name: "password",
+      message: firstMessage,
+    });
+    const masterPassword = mp.password;
+
+    // Master Password Validation
+    if (masterPassword == null || masterPassword === "") {
+      return this.updateTempPassword("Master password is required.\n");
+    }
+
+    if (masterPassword.length < 8) {
+      return this.updateTempPassword("Master password must be at least 8 characters long.\n");
+    }
+
+    // Strength & Policy Validation
+    const strengthResult = this.passwordGenerationService.passwordStrength(
+      masterPassword,
+      this.getPasswordStrengthUserInput()
+    );
+
+    // Get New Master Password Re-type
+    const reTypeMessage = "Re-type New Master password (Strength: " + strengthResult.score + ")";
+    const retype: inquirer.Answers = await inquirer.createPromptModule({ output: process.stderr })({
+      type: "password",
+      name: "password",
+      message: reTypeMessage,
+    });
+    const masterPasswordRetype = retype.password;
+
+    // Re-type Validation
+    if (masterPassword !== masterPasswordRetype) {
+      return this.updateTempPassword("Master password confirmation does not match.\n");
+    }
+
+    // Get Hint (optional)
+    const hint: inquirer.Answers = await inquirer.createPromptModule({ output: process.stderr })({
+      type: "input",
+      name: "input",
+      message: "Master Password Hint (optional):",
+    });
+    const masterPasswordHint = hint.input;
+
+    // Retrieve details for key generation
+    const enforcedPolicyOptions = await this.policyService.getMasterPasswordPolicyOptions();
+    const kdf = await this.stateService.getKdfType();
+    const kdfIterations = await this.stateService.getKdfIterations();
+
+    if (
+      enforcedPolicyOptions != null &&
+      !this.policyService.evaluateMasterPassword(
+        strengthResult.score,
+        masterPassword,
+        enforcedPolicyOptions
+      )
+    ) {
+      return this.updateTempPassword(
+        "Your new master password does not meet the policy requirements.\n"
+      );
+    }
+
+    try {
+      // Create new key and hash new password
+      const newKey = await this.cryptoService.makeKey(
+        masterPassword,
+        this.email.trim().toLowerCase(),
+        kdf,
+        kdfIterations
+      );
+      const newPasswordHash = await this.cryptoService.hashPassword(masterPassword, newKey);
+
+      // Grab user's current enc key
+      const userEncKey = await this.cryptoService.getEncKey();
+
+      // Create new encKey for the User
+      const newEncKey = await this.cryptoService.remakeEncKey(newKey, userEncKey);
+
+      // Create request
+      const request = new UpdateTempPasswordRequest();
+      request.key = newEncKey[1].encryptedString;
+      request.newMasterPasswordHash = newPasswordHash;
+      request.masterPasswordHint = masterPasswordHint;
+
+      // Update user's password
+      await this.apiService.putUpdateTempPassword(request);
+      return this.handleSuccessResponse();
+    } catch (e) {
+      await this.logout();
+      this.authService.logOut(() => {
+        /* Do nothing */
+      });
+      return Response.error(e);
+    }
+  }
+
+  private async handleCaptchaRequired(
+    twoFactorRequest: TokenRequestTwoFactor,
+    credentials: PasswordLogInCredentials = null
+  ): Promise<AuthResult | Response> {
+    const badCaptcha = Response.badRequest(
+      "Your authentication request has been flagged and will require user interaction to proceed.\n" +
+        "Please use your API key to validate this request and ensure BW_CLIENTSECRET is correct, if set.\n" +
+        "(https://bitwarden.com/help/cli-auth-challenges)"
+    );
+
+    try {
+      const captchaClientSecret = await this.apiClientSecret(true);
+      if (Utils.isNullOrWhitespace(captchaClientSecret)) {
+        return badCaptcha;
+      }
+
+      let authResultResponse: AuthResult = null;
+      if (credentials != null) {
+        credentials.captchaToken = captchaClientSecret;
+        credentials.twoFactor = twoFactorRequest;
+        authResultResponse = await this.authService.logIn(credentials);
+      } else {
+        authResultResponse = await this.authService.logInTwoFactor(
+          twoFactorRequest,
+          captchaClientSecret
+        );
+      }
+
+      return authResultResponse;
+    } catch (e) {
+      if (
+        e instanceof ErrorResponse ||
+        (e.constructor.name === ErrorResponse.name &&
+          (e as ErrorResponse).message.includes("Captcha is invalid"))
+      ) {
+        return badCaptcha;
+      } else {
+        return Response.error(e);
+      }
+    }
+  }
+
+  private getPasswordStrengthUserInput() {
+    let userInput: string[] = [];
+    const atPosition = this.email.indexOf("@");
+    if (atPosition > -1) {
+      userInput = userInput.concat(
+        this.email
+          .substr(0, atPosition)
+          .trim()
+          .toLowerCase()
+          .split(/[^A-Za-z0-9]/)
+      );
+    }
+    return userInput;
+  }
+
+  private async apiClientId(): Promise<string> {
+    let clientId: string = null;
+
+    const storedClientId: string = process.env.BW_CLIENTID;
+    if (storedClientId == null) {
+      if (this.canInteract) {
+        const answer: inquirer.Answers = await inquirer.createPromptModule({
+          output: process.stderr,
+        })({
+          type: "input",
+          name: "clientId",
+          message: "client_id:",
+        });
+        clientId = answer.clientId;
+      } else {
+        clientId = null;
+      }
+    } else {
+      clientId = storedClientId;
+    }
+
+    return clientId;
+  }
+
+  private async apiClientSecret(isAdditionalAuthentication = false): Promise<string> {
+    const additionalAuthenticationMessage = "Additional authentication required.\nAPI key ";
+    let clientSecret: string = null;
+
+    const storedClientSecret: string = this.clientSecret || process.env.BW_CLIENTSECRET;
+    if (this.canInteract && storedClientSecret == null) {
+      const answer: inquirer.Answers = await inquirer.createPromptModule({
+        output: process.stderr,
+      })({
+        type: "input",
+        name: "clientSecret",
+        message:
+          (isAdditionalAuthentication ? additionalAuthenticationMessage : "") + "client_secret:",
+      });
+      clientSecret = answer.clientSecret;
+    } else {
+      clientSecret = storedClientSecret;
+    }
+
+    return clientSecret;
+  }
+
+  private async apiIdentifiers(): Promise<{ clientId: string; clientSecret: string }> {
+    return {
+      clientId: await this.apiClientId(),
+      clientSecret: await this.apiClientSecret(),
+    };
+  }
+
+  private async openSsoPrompt(
+    codeChallenge: string,
+    state: string
+  ): Promise<{ ssoCode: string; orgIdentifier: string }> {
+    return new Promise((resolve, reject) => {
+      const callbackServer = http.createServer((req, res) => {
+        const urlString = "http://localhost" + req.url;
+        const url = new URL(urlString);
+        const code = url.searchParams.get("code");
+        const receivedState = url.searchParams.get("state");
+        const orgIdentifier = this.getOrgIdentifierFromState(receivedState);
+        res.setHeader("Content-Type", "text/html");
+        if (code != null && receivedState != null && this.checkState(receivedState, state)) {
+          res.writeHead(200);
+          res.end(
+            "<html><head><title>Success | Bitwarden CLI</title></head><body>" +
+              "<h1>Successfully authenticated with the Bitwarden CLI</h1>" +
+              "<p>You may now close this tab and return to the terminal.</p>" +
+              "</body></html>"
+          );
+          callbackServer.close(() =>
+            resolve({
+              ssoCode: code,
+              orgIdentifier: orgIdentifier,
+            })
+          );
+        } else {
+          res.writeHead(400);
+          res.end(
+            "<html><head><title>Failed | Bitwarden CLI</title></head><body>" +
+              "<h1>Something went wrong logging into the Bitwarden CLI</h1>" +
+              "<p>You may now close this tab and return to the terminal.</p>" +
+              "</body></html>"
+          );
+          callbackServer.close(() => reject());
+        }
+      });
+      let foundPort = false;
+      const webUrl = this.environmentService.getWebVaultUrl();
+      for (let port = 8065; port <= 8070; port++) {
+        try {
+          this.ssoRedirectUri = "http://localhost:" + port;
+          callbackServer.listen(port, () => {
+            this.platformUtilsService.launchUri(
+              webUrl +
+                "/#/sso?clientId=" +
+                this.clientId +
+                "&redirectUri=" +
+                encodeURIComponent(this.ssoRedirectUri) +
+                "&state=" +
+                state +
+                "&codeChallenge=" +
+                codeChallenge
+            );
+          });
+          foundPort = true;
+          break;
+        } catch {
+          // Ignore error since we run the same command up to 5 times.
+        }
+      }
+      if (!foundPort) {
+        reject();
+      }
+    });
+  }
+
+  private getOrgIdentifierFromState(state: string): string {
+    if (state === null || state === undefined) {
+      return null;
+    }
+
+    const stateSplit = state.split("_identifier=");
+    return stateSplit.length > 1 ? stateSplit[1] : null;
+  }
+
+  private checkState(state: string, checkState: string): boolean {
+    if (state === null || state === undefined) {
+      return false;
+    }
+    if (checkState === null || checkState === undefined) {
+      return false;
+    }
+
+    const stateSplit = state.split("_identifier=");
+    const checkStateSplit = checkState.split("_identifier=");
+    return stateSplit[0] === checkStateSplit[0];
+  }
+}

libs/node/src/cli/commands/logout.command.ts

@@ -0,0 +1,22 @@
+import { AuthService } from "jslib-common/abstractions/auth.service";
+import { I18nService } from "jslib-common/abstractions/i18n.service";
+
+import { Response } from "../models/response";
+import { MessageResponse } from "../models/response/messageResponse";
+
+export class LogoutCommand {
+  constructor(
+    private authService: AuthService,
+    private i18nService: I18nService,
+    private logoutCallback: () => Promise<void>
+  ) {}
+
+  async run() {
+    await this.logoutCallback();
+    this.authService.logOut(() => {
+      /* Do nothing */
+    });
+    const res = new MessageResponse("You have logged out.", null);
+    return Response.success(res);
+  }
+}

libs/node/src/cli/commands/update.command.ts

@@ -0,0 +1,104 @@
+import * as fetch from "node-fetch";
+
+import { I18nService } from "jslib-common/abstractions/i18n.service";
+import { PlatformUtilsService } from "jslib-common/abstractions/platformUtils.service";
+
+import { Response } from "../models/response";
+import { MessageResponse } from "../models/response/messageResponse";
+
+export class UpdateCommand {
+  inPkg = false;
+
+  constructor(
+    private platformUtilsService: PlatformUtilsService,
+    private i18nService: I18nService,
+    private repoName: string,
+    private executableName: string,
+    private showExtendedMessage: boolean
+  ) {
+    this.inPkg = !!(process as any).pkg;
+  }
+
+  async run(): Promise<Response> {
+    const currentVersion = await this.platformUtilsService.getApplicationVersion();
+
+    const response = await fetch.default(
+      "https://api.github.com/repos/bitwarden/" + this.repoName + "/releases/latest"
+    );
+    if (response.status === 200) {
+      const responseJson = await response.json();
+      const res = new MessageResponse(null, null);
+
+      const tagName: string = responseJson.tag_name;
+      if (tagName === "v" + currentVersion) {
+        res.title = "No update available.";
+        res.noColor = true;
+        return Response.success(res);
+      }
+
+      let downloadUrl: string = null;
+      if (responseJson.assets != null) {
+        for (const a of responseJson.assets) {
+          const download: string = a.browser_download_url;
+          if (download == null) {
+            continue;
+          }
+
+          if (download.indexOf(".zip") === -1) {
+            continue;
+          }
+
+          if (
+            process.platform === "win32" &&
+            download.indexOf(this.executableName + "-windows") > -1
+          ) {
+            downloadUrl = download;
+            break;
+          } else if (
+            process.platform === "darwin" &&
+            download.indexOf(this.executableName + "-macos") > -1
+          ) {
+            downloadUrl = download;
+            break;
+          } else if (
+            process.platform === "linux" &&
+            download.indexOf(this.executableName + "-linux") > -1
+          ) {
+            downloadUrl = download;
+            break;
+          }
+        }
+      }
+
+      res.title = "A new version is available: " + tagName;
+      if (downloadUrl == null) {
+        downloadUrl = "https://github.com/bitwarden/" + this.repoName + "/releases";
+      } else {
+        res.raw = downloadUrl;
+      }
+      res.message = "";
+      if (responseJson.body != null && responseJson.body !== "") {
+        res.message = responseJson.body + "\n\n";
+      }
+
+      res.message += "You can download this update at " + downloadUrl;
+
+      if (this.showExtendedMessage) {
+        if (this.inPkg) {
+          res.message +=
+            "\n\nIf you installed this CLI through a package manager " +
+            "you should probably update using its update command instead.";
+        } else {
+          res.message +=
+            "\n\nIf you installed this CLI through NPM " +
+            "you should update using `npm install -g @bitwarden/" +
+            this.repoName +
+            "`";
+        }
+      }
+      return Response.success(res);
+    } else {
+      return Response.error("Error contacting update API: " + response.status);
+    }
+  }
+}

libs/node/src/cli/models/response.ts

@@ -0,0 +1,50 @@
+import { BaseResponse } from "./response/baseResponse";
+
+export class Response {
+  static error(error: any, data?: any): Response {
+    const res = new Response();
+    res.success = false;
+    if (typeof error === "string") {
+      res.message = error;
+    } else {
+      res.message =
+        error.message != null
+          ? error.message
+          : error.toString() === "[object Object]"
+          ? JSON.stringify(error)
+          : error.toString();
+    }
+    res.data = data;
+    return res;
+  }
+
+  static notFound(): Response {
+    return Response.error("Not found.");
+  }
+
+  static badRequest(message: string): Response {
+    return Response.error(message);
+  }
+
+  static multipleResults(ids: string[]): Response {
+    let msg =
+      "More than one result was found. Try getting a specific object by `id` instead. " +
+      "The following objects were found:";
+    ids.forEach((id) => {
+      msg += "\n" + id;
+    });
+    return Response.error(msg, ids);
+  }
+
+  static success(data?: BaseResponse): Response {
+    const res = new Response();
+    res.success = true;
+    res.data = data;
+    return res;
+  }
+
+  success: boolean;
+  message: string;
+  errorCode: number;
+  data: BaseResponse;
+}

libs/node/src/cli/models/response/baseResponse.ts

@@ -0,0 +1,3 @@
+export interface BaseResponse {
+  object: string;
+}

libs/node/src/cli/models/response/fileResponse.ts

@@ -0,0 +1,13 @@
+import { BaseResponse } from "./baseResponse";
+
+export class FileResponse implements BaseResponse {
+  object: string;
+  data: Buffer;
+  fileName: string;
+
+  constructor(data: Buffer, fileName: string) {
+    this.object = "file";
+    this.data = data;
+    this.fileName = fileName;
+  }
+}

libs/node/src/cli/models/response/listResponse.ts

@@ -0,0 +1,11 @@
+import { BaseResponse } from "./baseResponse";
+
+export class ListResponse implements BaseResponse {
+  object: string;
+  data: BaseResponse[];
+
+  constructor(data: BaseResponse[]) {
+    this.object = "list";
+    this.data = data;
+  }
+}

libs/node/src/cli/models/response/messageResponse.ts

@@ -0,0 +1,15 @@
+import { BaseResponse } from "./baseResponse";
+
+export class MessageResponse implements BaseResponse {
+  object: string;
+  title: string;
+  message: string;
+  raw: string;
+  noColor = false;
+
+  constructor(title: string, message: string) {
+    this.object = "message";
+    this.title = title;
+    this.message = message;
+  }
+}

libs/node/src/cli/models/response/stringResponse.ts

@@ -0,0 +1,11 @@
+import { BaseResponse } from "./baseResponse";
+
+export class StringResponse implements BaseResponse {
+  object: string;
+  data: string;
+
+  constructor(data: string) {
+    this.object = "string";
+    this.data = data;
+  }
+}

libs/node/src/cli/services/cliPlatformUtils.service.ts

@@ -0,0 +1,166 @@
+import * as child_process from "child_process";
+
+import { PlatformUtilsService } from "jslib-common/abstractions/platformUtils.service";
+import { ClientType } from "jslib-common/enums/clientType";
+import { DeviceType } from "jslib-common/enums/deviceType";
+import { ThemeType } from "jslib-common/enums/themeType";
+
+// eslint-disable-next-line
+const open = require("open");
+
+export class CliPlatformUtilsService implements PlatformUtilsService {
+  clientType: ClientType;
+
+  private deviceCache: DeviceType = null;
+
+  constructor(clientType: ClientType, private packageJson: any) {
+    this.clientType = clientType;
+  }
+
+  getDevice(): DeviceType {
+    if (!this.deviceCache) {
+      switch (process.platform) {
+        case "win32":
+          this.deviceCache = DeviceType.WindowsDesktop;
+          break;
+        case "darwin":
+          this.deviceCache = DeviceType.MacOsDesktop;
+          break;
+        case "linux":
+        default:
+          this.deviceCache = DeviceType.LinuxDesktop;
+          break;
+      }
+    }
+
+    return this.deviceCache;
+  }
+
+  getDeviceString(): string {
+    const device = DeviceType[this.getDevice()].toLowerCase();
+    return device.replace("desktop", "");
+  }
+
+  getClientType() {
+    return this.clientType;
+  }
+
+  isFirefox() {
+    return false;
+  }
+
+  isChrome() {
+    return false;
+  }
+
+  isEdge() {
+    return false;
+  }
+
+  isOpera() {
+    return false;
+  }
+
+  isVivaldi() {
+    return false;
+  }
+
+  isSafari() {
+    return false;
+  }
+
+  isMacAppStore() {
+    return false;
+  }
+
+  isViewOpen() {
+    return Promise.resolve(false);
+  }
+
+  launchUri(uri: string, options?: any): void {
+    if (process.platform === "linux") {
+      child_process.spawnSync("xdg-open", [uri]);
+    } else {
+      open(uri);
+    }
+  }
+
+  saveFile(win: Window, blobData: any, blobOptions: any, fileName: string): void {
+    throw new Error("Not implemented.");
+  }
+
+  getApplicationVersion(): Promise<string> {
+    return Promise.resolve(this.packageJson.version);
+  }
+
+  getApplicationVersionSync(): string {
+    return this.packageJson.version;
+  }
+
+  supportsWebAuthn(win: Window) {
+    return false;
+  }
+
+  supportsDuo(): boolean {
+    return false;
+  }
+
+  showToast(
+    type: "error" | "success" | "warning" | "info",
+    title: string,
+    text: string | string[],
+    options?: any
+  ): void {
+    throw new Error("Not implemented.");
+  }
+
+  showDialog(
+    text: string,
+    title?: string,
+    confirmText?: string,
+    cancelText?: string,
+    type?: string
+  ): Promise<boolean> {
+    throw new Error("Not implemented.");
+  }
+
+  isDev(): boolean {
+    return process.env.BWCLI_ENV === "development";
+  }
+
+  isSelfHost(): boolean {
+    return false;
+  }
+
+  copyToClipboard(text: string, options?: any): void {
+    throw new Error("Not implemented.");
+  }
+
+  readFromClipboard(options?: any): Promise<string> {
+    throw new Error("Not implemented.");
+  }
+
+  supportsBiometric(): Promise<boolean> {
+    return Promise.resolve(false);
+  }
+
+  authenticateBiometric(): Promise<boolean> {
+    return Promise.resolve(false);
+  }
+
+  getDefaultSystemTheme() {
+    return Promise.resolve(ThemeType.Light as ThemeType.Light | ThemeType.Dark);
+  }
+
+  onDefaultSystemThemeChange() {
+    /* noop */
+  }
+
+  getEffectiveTheme() {
+    return Promise.resolve(ThemeType.Light);
+  }
+
+  supportsSecureStorage(): boolean {
+    return false;
+  }
+}

libs/node/src/cli/services/consoleLog.service.ts

@@ -0,0 +1,22 @@
+import { LogLevelType } from "jslib-common/enums/logLevelType";
+import { ConsoleLogService as BaseConsoleLogService } from "jslib-common/services/consoleLog.service";
+
+export class ConsoleLogService extends BaseConsoleLogService {
+  constructor(isDev: boolean, filter: (level: LogLevelType) => boolean = null) {
+    super(isDev, filter);
+  }
+
+  write(level: LogLevelType, message: string) {
+    if (this.filter != null && this.filter(level)) {
+      return;
+    }
+
+    if (process.env.BW_RESPONSE === "true") {
+      // eslint-disable-next-line
+      console.error(message);
+      return;
+    }
+
+    super.write(level, message);
+  }
+}

libs/node/src/services/lowdbStorage.service.ts

@@ -0,0 +1,148 @@
+import * as fs from "fs";
+import * as path from "path";
+
+import * as lowdb from "lowdb";
+import * as FileSync from "lowdb/adapters/FileSync";
+
+import { LogService } from "jslib-common/abstractions/log.service";
+import { StorageService } from "jslib-common/abstractions/storage.service";
+import { NodeUtils } from "jslib-common/misc/nodeUtils";
+import { sequentialize } from "jslib-common/misc/sequentialize";
+import { Utils } from "jslib-common/misc/utils";
+
+export class LowdbStorageService implements StorageService {
+  protected dataFilePath: string;
+  private db: lowdb.LowdbSync<any>;
+  private defaults: any;
+  private ready = false;
+
+  constructor(
+    protected logService: LogService,
+    defaults?: any,
+    private dir?: string,
+    private allowCache = false
+  ) {
+    this.defaults = defaults;
+  }
+
+  @sequentialize(() => "lowdbStorageInit")
+  async init() {
+    if (this.ready) {
+      return;
+    }
+
+    this.logService.info("Initializing lowdb storage service.");
+    let adapter: lowdb.AdapterSync<any>;
+    if (Utils.isNode && this.dir != null) {
+      if (!fs.existsSync(this.dir)) {
+        this.logService.warning(`Could not find dir, "${this.dir}"; creating it instead.`);
+        NodeUtils.mkdirpSync(this.dir, "700");
+        this.logService.info(`Created dir "${this.dir}".`);
+      }
+      this.dataFilePath = path.join(this.dir, "data.json");
+      if (!fs.existsSync(this.dataFilePath)) {
+        this.logService.warning(
+          `Could not find data file, "${this.dataFilePath}"; creating it instead.`
+        );
+        fs.writeFileSync(this.dataFilePath, "", { mode: 0o600 });
+        fs.chmodSync(this.dataFilePath, 0o600);
+        this.logService.info(`Created data file "${this.dataFilePath}" with chmod 600.`);
+      } else {
+        this.logService.info(`db file "${this.dataFilePath} already exists"; using existing db`);
+      }
+      await this.lockDbFile(() => {
+        adapter = new FileSync(this.dataFilePath);
+      });
+    }
+    try {
+      this.logService.info("Attempting to create lowdb storage adapter.");
+      this.db = lowdb(adapter);
+      this.logService.info("Successfully created lowdb storage adapter.");
+    } catch (e) {
+      if (e instanceof SyntaxError) {
+        this.logService.warning(
+          `Error creating lowdb storage adapter, "${e.message}"; emptying data file.`
+        );
+        if (fs.existsSync(this.dataFilePath)) {
+          const backupPath = this.dataFilePath + ".bak";
+          this.logService.warning(`Writing backup of data file to ${backupPath}`);
+          await fs.copyFile(this.dataFilePath, backupPath, () => {
+            this.logService.warning(
+              `Error while creating data file backup, "${e.message}". No backup may have been created.`
+            );
+          });
+        }
+        adapter.write({});
+        this.db = lowdb(adapter);
+      } else {
+        this.logService.error(`Error creating lowdb storage adapter, "${e.message}".`);
+        throw e;
+      }
+    }
+
+    if (this.defaults != null) {
+      this.lockDbFile(() => {
+        this.logService.info("Writing defaults.");
+        this.readForNoCache();
+        this.db.defaults(this.defaults).write();
+        this.logService.info("Successfully wrote defaults to db.");
+      });
+    }
+
+    this.ready = true;
+  }
+
+  async get<T>(key: string): Promise<T> {
+    await this.waitForReady();
+    return this.lockDbFile(() => {
+      this.readForNoCache();
+      const val = this.db.get(key).value();
+      this.logService.debug(`Successfully read ${key} from db`);
+      if (val == null) {
+        return null;
+      }
+      return val as T;
+    });
+  }
+
+  has(key: string): Promise<boolean> {
+    return this.get(key).then((v) => v != null);
+  }
+
+  async save(key: string, obj: any): Promise<any> {
+    await this.waitForReady();
+    return this.lockDbFile(() => {
+      this.readForNoCache();
+      this.db.set(key, obj).write();
+      this.logService.debug(`Successfully wrote ${key} to db`);
+      return;
+    });
+  }
+
+  async remove(key: string): Promise<any> {
+    await this.waitForReady();
+    return this.lockDbFile(() => {
+      this.readForNoCache();
+      this.db.unset(key).write();
+      this.logService.debug(`Successfully removed ${key} from db`);
+      return;
+    });
+  }
+
+  protected async lockDbFile<T>(action: () => T): Promise<T> {
+    // Lock methods implemented in clients
+    return Promise.resolve(action());
+  }
+
+  private readForNoCache() {
+    if (!this.allowCache) {
+      this.db.read();
+    }
+  }
+
+  private async waitForReady() {
+    if (!this.ready) {
+      await this.init();
+    }
+  }
+}

libs/node/src/services/nodeApi.service.ts

@@ -0,0 +1,43 @@
+import * as FormData from "form-data";
+import { HttpsProxyAgent } from "https-proxy-agent";
+import * as fe from "node-fetch";
+
+import { AppIdService } from "jslib-common/abstractions/appId.service";
+import { EnvironmentService } from "jslib-common/abstractions/environment.service";
+import { PlatformUtilsService } from "jslib-common/abstractions/platformUtils.service";
+import { TokenService } from "jslib-common/abstractions/token.service";
+import { ApiService } from "jslib-common/services/api.service";
+
+(global as any).fetch = fe.default;
+(global as any).Request = fe.Request;
+(global as any).Response = fe.Response;
+(global as any).Headers = fe.Headers;
+(global as any).FormData = FormData;
+
+export class NodeApiService extends ApiService {
+  constructor(
+    tokenService: TokenService,
+    platformUtilsService: PlatformUtilsService,
+    environmentService: EnvironmentService,
+    appIdService: AppIdService,
+    logoutCallback: (expired: boolean) => Promise<void>,
+    customUserAgent: string = null
+  ) {
+    super(
+      tokenService,
+      platformUtilsService,
+      environmentService,
+      appIdService,
+      logoutCallback,
+      customUserAgent
+    );
+  }
+
+  nativeFetch(request: Request): Promise<Response> {
+    const proxy = process.env.http_proxy || process.env.https_proxy;
+    if (proxy) {
+      (request as any).agent = new HttpsProxyAgent(proxy);
+    }
+    return fetch(request);
+  }
+}

libs/node/src/services/nodeCryptoFunction.service.ts

@@ -0,0 +1,301 @@
+import * as crypto from "crypto";
+
+import * as forge from "node-forge";
+
+import { CryptoFunctionService } from "jslib-common/abstractions/cryptoFunction.service";
+import { Utils } from "jslib-common/misc/utils";
+import { DecryptParameters } from "jslib-common/models/domain/decryptParameters";
+import { SymmetricCryptoKey } from "jslib-common/models/domain/symmetricCryptoKey";
+
+export class NodeCryptoFunctionService implements CryptoFunctionService {
+  pbkdf2(
+    password: string | ArrayBuffer,
+    salt: string | ArrayBuffer,
+    algorithm: "sha256" | "sha512",
+    iterations: number
+  ): Promise<ArrayBuffer> {
+    const len = algorithm === "sha256" ? 32 : 64;
+    const nodePassword = this.toNodeValue(password);
+    const nodeSalt = this.toNodeValue(salt);
+    return new Promise<ArrayBuffer>((resolve, reject) => {
+      crypto.pbkdf2(nodePassword, nodeSalt, iterations, len, algorithm, (error, key) => {
+        if (error != null) {
+          reject(error);
+        } else {
+          resolve(this.toArrayBuffer(key));
+        }
+      });
+    });
+  }
+
+  // ref: https://tools.ietf.org/html/rfc5869
+  async hkdf(
+    ikm: ArrayBuffer,
+    salt: string | ArrayBuffer,
+    info: string | ArrayBuffer,
+    outputByteSize: number,
+    algorithm: "sha256" | "sha512"
+  ): Promise<ArrayBuffer> {
+    const saltBuf = this.toArrayBuffer(salt);
+    const prk = await this.hmac(ikm, saltBuf, algorithm);
+    return this.hkdfExpand(prk, info, outputByteSize, algorithm);
+  }
+
+  // ref: https://tools.ietf.org/html/rfc5869
+  async hkdfExpand(
+    prk: ArrayBuffer,
+    info: string | ArrayBuffer,
+    outputByteSize: number,
+    algorithm: "sha256" | "sha512"
+  ): Promise<ArrayBuffer> {
+    const hashLen = algorithm === "sha256" ? 32 : 64;
+    if (outputByteSize > 255 * hashLen) {
+      throw new Error("outputByteSize is too large.");
+    }
+    const prkArr = new Uint8Array(prk);
+    if (prkArr.length < hashLen) {
+      throw new Error("prk is too small.");
+    }
+    const infoBuf = this.toArrayBuffer(info);
+    const infoArr = new Uint8Array(infoBuf);
+    let runningOkmLength = 0;
+    let previousT = new Uint8Array(0);
+    const n = Math.ceil(outputByteSize / hashLen);
+    const okm = new Uint8Array(n * hashLen);
+    for (let i = 0; i < n; i++) {
+      const t = new Uint8Array(previousT.length + infoArr.length + 1);
+      t.set(previousT);
+      t.set(infoArr, previousT.length);
+      t.set([i + 1], t.length - 1);
+      previousT = new Uint8Array(await this.hmac(t.buffer, prk, algorithm));
+      okm.set(previousT, runningOkmLength);
+      runningOkmLength += previousT.length;
+      if (runningOkmLength >= outputByteSize) {
+        break;
+      }
+    }
+    return okm.slice(0, outputByteSize).buffer;
+  }
+
+  hash(
+    value: string | ArrayBuffer,
+    algorithm: "sha1" | "sha256" | "sha512" | "md5"
+  ): Promise<ArrayBuffer> {
+    const nodeValue = this.toNodeValue(value);
+    const hash = crypto.createHash(algorithm);
+    hash.update(nodeValue);
+    return Promise.resolve(this.toArrayBuffer(hash.digest()));
+  }
+
+  hmac(
+    value: ArrayBuffer,
+    key: ArrayBuffer,
+    algorithm: "sha1" | "sha256" | "sha512"
+  ): Promise<ArrayBuffer> {
+    const nodeValue = this.toNodeBuffer(value);
+    const nodeKey = this.toNodeBuffer(key);
+    const hmac = crypto.createHmac(algorithm, nodeKey);
+    hmac.update(nodeValue);
+    return Promise.resolve(this.toArrayBuffer(hmac.digest()));
+  }
+
+  async compare(a: ArrayBuffer, b: ArrayBuffer): Promise<boolean> {
+    const key = await this.randomBytes(32);
+    const mac1 = await this.hmac(a, key, "sha256");
+    const mac2 = await this.hmac(b, key, "sha256");
+    if (mac1.byteLength !== mac2.byteLength) {
+      return false;
+    }
+
+    const arr1 = new Uint8Array(mac1);
+    const arr2 = new Uint8Array(mac2);
+    for (let i = 0; i < arr2.length; i++) {
+      if (arr1[i] !== arr2[i]) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  hmacFast(
+    value: ArrayBuffer,
+    key: ArrayBuffer,
+    algorithm: "sha1" | "sha256" | "sha512"
+  ): Promise<ArrayBuffer> {
+    return this.hmac(value, key, algorithm);
+  }
+
+  compareFast(a: ArrayBuffer, b: ArrayBuffer): Promise<boolean> {
+    return this.compare(a, b);
+  }
+
+  aesEncrypt(data: ArrayBuffer, iv: ArrayBuffer, key: ArrayBuffer): Promise<ArrayBuffer> {
+    const nodeData = this.toNodeBuffer(data);
+    const nodeIv = this.toNodeBuffer(iv);
+    const nodeKey = this.toNodeBuffer(key);
+    const cipher = crypto.createCipheriv("aes-256-cbc", nodeKey, nodeIv);
+    const encBuf = Buffer.concat([cipher.update(nodeData), cipher.final()]);
+    return Promise.resolve(this.toArrayBuffer(encBuf));
+  }
+
+  aesDecryptFastParameters(
+    data: string,
+    iv: string,
+    mac: string,
+    key: SymmetricCryptoKey
+  ): DecryptParameters<ArrayBuffer> {
+    const p = new DecryptParameters<ArrayBuffer>();
+    p.encKey = key.encKey;
+    p.data = Utils.fromB64ToArray(data).buffer;
+    p.iv = Utils.fromB64ToArray(iv).buffer;
+
+    const macData = new Uint8Array(p.iv.byteLength + p.data.byteLength);
+    macData.set(new Uint8Array(p.iv), 0);
+    macData.set(new Uint8Array(p.data), p.iv.byteLength);
+    p.macData = macData.buffer;
+
+    if (key.macKey != null) {
+      p.macKey = key.macKey;
+    }
+    if (mac != null) {
+      p.mac = Utils.fromB64ToArray(mac).buffer;
+    }
+
+    return p;
+  }
+
+  async aesDecryptFast(parameters: DecryptParameters<ArrayBuffer>): Promise<string> {
+    const decBuf = await this.aesDecrypt(parameters.data, parameters.iv, parameters.encKey);
+    return Utils.fromBufferToUtf8(decBuf);
+  }
+
+  aesDecrypt(data: ArrayBuffer, iv: ArrayBuffer, key: ArrayBuffer): Promise<ArrayBuffer> {
+    const nodeData = this.toNodeBuffer(data);
+    const nodeIv = this.toNodeBuffer(iv);
+    const nodeKey = this.toNodeBuffer(key);
+    const decipher = crypto.createDecipheriv("aes-256-cbc", nodeKey, nodeIv);
+    const decBuf = Buffer.concat([decipher.update(nodeData), decipher.final()]);
+    return Promise.resolve(this.toArrayBuffer(decBuf));
+  }
+
+  rsaEncrypt(
+    data: ArrayBuffer,
+    publicKey: ArrayBuffer,
+    algorithm: "sha1" | "sha256"
+  ): Promise<ArrayBuffer> {
+    if (algorithm === "sha256") {
+      throw new Error("Node crypto does not support RSA-OAEP SHA-256");
+    }
+
+    const pem = this.toPemPublicKey(publicKey);
+    const decipher = crypto.publicEncrypt(pem, this.toNodeBuffer(data));
+    return Promise.resolve(this.toArrayBuffer(decipher));
+  }
+
+  rsaDecrypt(
+    data: ArrayBuffer,
+    privateKey: ArrayBuffer,
+    algorithm: "sha1" | "sha256"
+  ): Promise<ArrayBuffer> {
+    if (algorithm === "sha256") {
+      throw new Error("Node crypto does not support RSA-OAEP SHA-256");
+    }
+
+    const pem = this.toPemPrivateKey(privateKey);
+    const decipher = crypto.privateDecrypt(pem, this.toNodeBuffer(data));
+    return Promise.resolve(this.toArrayBuffer(decipher));
+  }
+
+  rsaExtractPublicKey(privateKey: ArrayBuffer): Promise<ArrayBuffer> {
+    const privateKeyByteString = Utils.fromBufferToByteString(privateKey);
+    const privateKeyAsn1 = forge.asn1.fromDer(privateKeyByteString);
+    const forgePrivateKey: any = forge.pki.privateKeyFromAsn1(privateKeyAsn1);
+    const forgePublicKey = (forge.pki as any).setRsaPublicKey(forgePrivateKey.n, forgePrivateKey.e);
+    const publicKeyAsn1 = forge.pki.publicKeyToAsn1(forgePublicKey);
+    const publicKeyByteString = forge.asn1.toDer(publicKeyAsn1).data;
+    const publicKeyArray = Utils.fromByteStringToArray(publicKeyByteString);
+    return Promise.resolve(publicKeyArray.buffer);
+  }
+
+  async rsaGenerateKeyPair(length: 1024 | 2048 | 4096): Promise<[ArrayBuffer, ArrayBuffer]> {
+    return new Promise<[ArrayBuffer, ArrayBuffer]>((resolve, reject) => {
+      forge.pki.rsa.generateKeyPair(
+        {
+          bits: length,
+          workers: -1,
+          e: 0x10001, // 65537
+        },
+        (error, keyPair) => {
+          if (error != null) {
+            reject(error);
+            return;
+          }
+
+          const publicKeyAsn1 = forge.pki.publicKeyToAsn1(keyPair.publicKey);
+          const publicKeyByteString = forge.asn1.toDer(publicKeyAsn1).getBytes();
+          const publicKey = Utils.fromByteStringToArray(publicKeyByteString);
+
+          const privateKeyAsn1 = forge.pki.privateKeyToAsn1(keyPair.privateKey);
+          const privateKeyPkcs8 = forge.pki.wrapRsaPrivateKey(privateKeyAsn1);
+          const privateKeyByteString = forge.asn1.toDer(privateKeyPkcs8).getBytes();
+          const privateKey = Utils.fromByteStringToArray(privateKeyByteString);
+
+          resolve([publicKey.buffer, privateKey.buffer]);
+        }
+      );
+    });
+  }
+
+  randomBytes(length: number): Promise<ArrayBuffer> {
+    return new Promise<ArrayBuffer>((resolve, reject) => {
+      crypto.randomBytes(length, (error, bytes) => {
+        if (error != null) {
+          reject(error);
+        } else {
+          resolve(this.toArrayBuffer(bytes));
+        }
+      });
+    });
+  }
+
+  private toNodeValue(value: string | ArrayBuffer): string | Buffer {
+    let nodeValue: string | Buffer;
+    if (typeof value === "string") {
+      nodeValue = value;
+    } else {
+      nodeValue = this.toNodeBuffer(value);
+    }
+    return nodeValue;
+  }
+
+  private toNodeBuffer(value: ArrayBuffer): Buffer {
+    return Buffer.from(new Uint8Array(value) as any);
+  }
+
+  private toArrayBuffer(value: Buffer | string | ArrayBuffer): ArrayBuffer {
+    let buf: ArrayBuffer;
+    if (typeof value === "string") {
+      buf = Utils.fromUtf8ToArray(value).buffer;
+    } else {
+      buf = new Uint8Array(value).buffer;
+    }
+    return buf;
+  }
+
+  private toPemPrivateKey(key: ArrayBuffer): string {
+    const byteString = Utils.fromBufferToByteString(key);
+    const asn1 = forge.asn1.fromDer(byteString);
+    const privateKey = forge.pki.privateKeyFromAsn1(asn1);
+    const rsaPrivateKey = forge.pki.privateKeyToAsn1(privateKey);
+    const privateKeyInfo = forge.pki.wrapRsaPrivateKey(rsaPrivateKey);
+    return forge.pki.privateKeyInfoToPem(privateKeyInfo);
+  }
+
+  private toPemPublicKey(key: ArrayBuffer): string {
+    const byteString = Utils.fromBufferToByteString(key);
+    const asn1 = forge.asn1.fromDer(byteString);
+    const publicKey = forge.pki.publicKeyFromAsn1(asn1);
+    return forge.pki.publicKeyToPem(publicKey);
+  }
+}