dingtalk-workspace-cli/internal/keychain/keychain_linux.go

// Copyright 2026 Alibaba Group
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//go:build linux

package keychain

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"fmt"
	"os"
	"path/filepath"
	"regexp"

	"github.com/google/uuid"
)

// getDEK retrieves or generates the Data Encryption Key from local file.
func getDEK(service string) ([]byte, error) {
	return fileDEK(service)
}

func getDEKReadOnly(service string) ([]byte, error) {
	return fileDEKReadOnly(service)
}

const (
	dekBytes = 32 // DEK = Data Encryption Key (AES-256)
	ivBytes  = 12
	tagBytes = 16
)

// StorageDir returns the storage directory for a given service name.
// Follows XDG Base Directory Specification: ~/.local/share/<service>.
// When the DWS_KEYCHAIN_DIR environment variable is set (used by tests for
// isolation), the storage root is taken from that env var instead.
func StorageDir(service string) string {
	if override := os.Getenv(StorageDirEnv); override != "" {
		return filepath.Join(override, service)
	}
	home, err := os.UserHomeDir()
	if err != nil || home == "" {
		fmt.Fprintf(os.Stderr, "warning: unable to determine home directory: %v\n", err)
		return filepath.Join(".dws", "keychain", service)
	}
	xdgData := filepath.Join(home, ".local", "share")
	return filepath.Join(xdgData, service)
}

var safeFileNameRe = regexp.MustCompile(`[^a-zA-Z0-9._-]`)

func safeFileName(account string) string {
	return safeFileNameRe.ReplaceAllString(account, "_") + ".enc"
}

func encryptData(plaintext string, key []byte) ([]byte, error) {
	return encryptDataWithGCM(plaintext, key, cipher.NewGCM)
}

func encryptDataWithGCM(plaintext string, key []byte, newGCM keychainGCMFactory) ([]byte, error) {
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}
	aesGCM, err := newGCM(block)
	if err != nil {
		return nil, err
	}

	iv := make([]byte, ivBytes)
	if _, err := rand.Read(iv); err != nil {
		return nil, err
	}

	ciphertext := aesGCM.Seal(nil, iv, []byte(plaintext), nil)
	result := make([]byte, 0, ivBytes+len(ciphertext))
	result = append(result, iv...)
	result = append(result, ciphertext...)
	return result, nil
}

func decryptData(data []byte, key []byte) (string, error) {
	return decryptDataWithGCM(data, key, cipher.NewGCM)
}

func decryptDataWithGCM(data []byte, key []byte, newGCM keychainGCMFactory) (string, error) {
	if len(data) < ivBytes+tagBytes {
		return "", fmt.Errorf("ciphertext too short")
	}
	block, err := aes.NewCipher(key)
	if err != nil {
		return "", err
	}
	aesGCM, err := newGCM(block)
	if err != nil {
		return "", err
	}

	iv := data[:ivBytes]
	ciphertext := data[ivBytes:]
	plaintext, err := aesGCM.Open(nil, iv, ciphertext, nil)
	if err != nil {
		return "", fmt.Errorf("decryption failed: %w", err)
	}
	return string(plaintext), nil
}

func platformGet(service, account string) (string, error) {
	data, err := os.ReadFile(filepath.Join(StorageDir(service), safeFileName(account)))
	if err != nil {
		if os.IsNotExist(err) {
			return "", nil // Not found is not an error
		}
		return "", err
	}
	key, err := getDEKReadOnly(service)
	if err != nil {
		return "", err
	}
	plaintext, err := decryptData(data, key)
	if err != nil {
		return "", err
	}
	return plaintext, nil
}

func platformSet(service, account, data string) error {
	key, err := getDEK(service)
	if err != nil {
		return err
	}
	dir := StorageDir(service)
	if err := os.MkdirAll(dir, 0700); err != nil {
		return err
	}
	encrypted, err := encryptData(data, key)
	if err != nil {
		return err
	}

	targetPath := filepath.Join(dir, safeFileName(account))
	tmpPath := filepath.Join(dir, safeFileName(account)+"."+uuid.New().String()+".tmp")
	defer os.Remove(tmpPath)

	if err := os.WriteFile(tmpPath, encrypted, 0600); err != nil {
		return err
	}

	// Atomic rename to prevent file corruption during multi-process writes
	if err := os.Rename(tmpPath, targetPath); err != nil {
		return err
	}
	return nil
}

func platformValidateAuthTokenEntries(service string) error {
	paths, err := authTokenCiphertextPaths(service)
	if err != nil || len(paths) == 0 {
		return err
	}
	key, err := getDEKReadOnly(service)
	if err != nil {
		return fmt.Errorf("read DEK for auth token validation: %w", err)
	}
	for _, path := range paths {
		ciphertext, err := os.ReadFile(path)
		if err != nil {
			return fmt.Errorf("read keychain entry %q: %w", filepath.Base(path), err)
		}
		if _, err := decryptData(ciphertext, key); err != nil {
			return fmt.Errorf("validate keychain entry %q: %w", filepath.Base(path), err)
		}
	}
	return nil
}

func platformRemove(service, account string) error {
	err := os.Remove(filepath.Join(StorageDir(service), safeFileName(account)))
	if err != nil && !os.IsNotExist(err) {
		return err
	}
	return nil
}