4bnode/scripts/reveal-passkey.mjs

4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.

#!/usr/bin/env node
// Reveal the 6-digit dashboard PIN for a 4bnode app by reversing its hash.
//
//   node scripts/reveal-passkey.mjs /path/to/app
//
// The PIN is stored as a SHA-256 hash in .4bnode/.passkey. A 6-digit PIN has
// only 1,000,000 possibilities, so we just hash them all and match. (This is
// exactly why a 6-digit PIN is weak — but it lets you recover/audit it.)

import fs from 'fs';
import path from 'path';
import crypto from 'crypto';

const appDir = path.resolve(process.argv[2] || '.');
const pkFile = path.join(appDir, '.4bnode', '.passkey');

if (!fs.existsSync(pkFile)) {
  console.log(`No .passkey file in ${path.join(appDir, '.4bnode')} — the dashboard had NO password set (open).`);
  process.exit(0);
}

const target = fs.readFileSync(pkFile, 'utf8').trim();
const sha = (s) => crypto.createHash('sha256').update(s).digest('hex');

// Try all 6-digit PINs (000000–999999), including shorter numeric values.
for (let n = 0; n < 1_000_000; n++) {
  const pin = String(n).padStart(6, '0');
  if (sha(pin) === target) { console.log(`PIN: ${pin}`); process.exit(0); }
}
// Fallback: also try the value un-padded (e.g. "1234") in case it wasn't 6 digits.
for (let n = 0; n < 1_000_000; n++) {
  if (sha(String(n)) === target) { console.log(`PIN: ${n}`); process.exit(0); }
}
console.log('Not a numeric PIN up to 6 digits — the passkey is something else (longer/alphanumeric).');
console.log(`Stored hash: ${target}`);