修雨
1637ae16c7
In sandboxed macOS runtimes (e.g. Codex App), `security` / Keychain APIs are blocked, so `keyring.Get`/`Set` for the DEK fails on every token read/write. Add an opt-in env var that switches the macOS implementation to the same file-based DEK scheme already used on Linux. Default behavior is unchanged. - Extract shared `fileDEK(service)` into `file_dek.go` (darwin || linux) - Linux `getDEK` now delegates to `fileDEK` - Darwin `getDEK` short-circuits to `fileDEK` when DWS_DISABLE_KEYCHAIN=1 - Document the tradeoff in reference.md (DEK and ciphertext co-located) - Add darwin-only tests covering fallback path + overwrite
72 lines
2.7 KiB
Go
72 lines
2.7 KiB
Go
// Copyright 2026 Alibaba Group
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Package keychain provides cross-platform secure storage for secrets.
|
|
// - macOS: System Keychain stores DEK (Data Encryption Key), data encrypted with AES-256-GCM
|
|
// - Linux: File-based DEK storage with AES-256-GCM encryption
|
|
// - Windows: DPAPI + Registry storage
|
|
package keychain
|
|
|
|
const (
|
|
// Service is the unified keychain service name for all secrets.
|
|
Service = "dws-cli"
|
|
|
|
// AccountToken is the account key for storing auth token data.
|
|
AccountToken = "auth-token"
|
|
|
|
// StorageDirEnv overrides the on-disk keychain storage root on
|
|
// platforms that use file-backed storage (macOS, Linux). It is
|
|
// intended for tests that need to isolate keychain state from the
|
|
// real user environment and from sibling test packages running in
|
|
// parallel. When empty, the platform default applies.
|
|
StorageDirEnv = "DWS_KEYCHAIN_DIR"
|
|
|
|
// DisableKeychainEnv opts the macOS implementation out of system
|
|
// Keychain access for the DEK, falling back to a file-based DEK
|
|
// (same scheme as Linux). Intended for sandboxed runtimes where
|
|
// Keychain APIs are blocked (e.g. Codex App). This weakens the
|
|
// at-rest protection — DEK and ciphertext live in the same
|
|
// directory — and is therefore opt-in.
|
|
DisableKeychainEnv = "DWS_DISABLE_KEYCHAIN"
|
|
)
|
|
|
|
// KeychainAccess abstracts keychain Get/Set/Remove for dependency injection.
|
|
type KeychainAccess interface {
|
|
Get(service, account string) (string, error)
|
|
Set(service, account, value string) error
|
|
Remove(service, account string) error
|
|
}
|
|
|
|
// Get retrieves a value from the keychain.
|
|
// Returns empty string and nil error if the entry does not exist.
|
|
func Get(service, account string) (string, error) {
|
|
return platformGet(service, account)
|
|
}
|
|
|
|
// Set stores a value in the keychain, overwriting any existing entry.
|
|
func Set(service, account, data string) error {
|
|
return platformSet(service, account, data)
|
|
}
|
|
|
|
// Remove deletes an entry from the keychain.
|
|
// Returns nil if the entry does not exist.
|
|
func Remove(service, account string) error {
|
|
return platformRemove(service, account)
|
|
}
|
|
|
|
// Exists checks if an entry exists in the keychain.
|
|
func Exists(service, account string) bool {
|
|
val, err := Get(service, account)
|
|
return err == nil && val != ""
|
|
}
|