use std::{
collections::BTreeMap,
fs,
path::{Path, PathBuf},
};
use anyhow::{Context, Result};
use serde::{Deserialize, Serialize};
use crate::{fs_util, logs};
#[cfg(not(coverage))]
const SERVICE: &str = "ward";
#[cfg(coverage)]
pub fn set_secret(name: &str, secret: &str) -> Result<()> {
set_file_secret(name, secret)
}
#[cfg(not(coverage))]
pub fn set_secret(name: &str, secret: &str) -> Result<()> {
if use_keychain_store() {
let entry = keyring::Entry::new(SERVICE, name)
.with_context(|| format!("failed to open keychain entry {name}"))?;
return entry
.set_password(secret)
.with_context(|| format!("failed to store keychain entry {name}"));
}
set_file_secret(name, secret)
}
#[cfg(coverage)]
#[allow(dead_code)]
pub fn get_secret(name: &str) -> Result<Option<String>> {
get_file_secret(name)
}
#[cfg(not(coverage))]
#[allow(dead_code)]
pub fn get_secret(name: &str) -> Result<Option<String>> {
if use_keychain_store() {
let entry = keyring::Entry::new(SERVICE, name)
.with_context(|| format!("failed to open keychain entry {name}"))?;
return match entry.get_password() {
Ok(secret) => Ok(Some(secret)),
Err(keyring::Error::NoEntry) => Ok(None),
Err(error) => {
Err(error).with_context(|| format!("failed to read keychain entry {name}"))
}
};
}
get_file_secret(name)
}
#[cfg(coverage)]
pub fn delete_secret(name: &str) -> Result<()> {
delete_file_secret(name)
}
#[cfg(not(coverage))]
pub fn delete_secret(name: &str) -> Result<()> {
if use_keychain_store() {
let entry = keyring::Entry::new(SERVICE, name)
.with_context(|| format!("failed to open keychain entry {name}"))?;
return match entry.delete_credential() {
Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
Err(error) => {
Err(error).with_context(|| format!("failed to delete keychain entry {name}"))
}
};
}
delete_file_secret(name)
}
#[cfg(not(coverage))]
fn use_keychain_store() -> bool {
std::env::var("WARD_KEYCHAIN")
.ok()
.is_some_and(|value| value == "1")
}
fn file_store_path() -> PathBuf {
logs::ward_home().join("cache").join("keystore.json")
}
fn legacy_file_store_path() -> PathBuf {
logs::ward_home().join("cache").join("test-keyring.json")
}
fn set_file_secret(name: &str, secret: &str) -> Result<()> {
let path = file_store_path();
let mut store = load_file_store(&path)?;
store.entries.insert(name.to_string(), secret.to_string());
write_file_store(&path, &store)
}
#[allow(dead_code)]
fn get_file_secret(name: &str) -> Result<Option<String>> {
let path = file_store_path();
let store = load_file_store(&path)?;
Ok(store.entries.get(name).cloned())
}
fn delete_file_secret(name: &str) -> Result<()> {
let path = file_store_path();
let mut store = load_file_store(&path)?;
store.entries.remove(name);
write_file_store(&path, &store)
}
fn load_file_store(path: &Path) -> Result<FileStore> {
migrate_legacy_file_store(path)?;
if !path.exists() {
return Ok(FileStore::default());
}
let contents =
fs::read_to_string(path).with_context(|| format!("failed to read {}", path.display()))?;
serde_json::from_str(&contents).with_context(|| format!("failed to parse {}", path.display()))
}
fn migrate_legacy_file_store(path: &Path) -> Result<()> {
let legacy = legacy_file_store_path();
if path.exists() || !legacy.exists() || path == legacy {
return Ok(());
}
fs_util::ensure_private_parent_dir(path)?;
fs::rename(&legacy, path).or_else(|_| {
fs::copy(&legacy, path)?;
fs::remove_file(&legacy)
})?;
fs_util::set_private_file_permissions(path)
}
fn write_file_store(path: &Path, store: &FileStore) -> Result<()> {
let contents =
serde_json::to_string_pretty(store).expect("file store serialization is infallible");
ensure_ward_home_for(path)?;
fs_util::write_private_file(path, format!("{contents}\n").as_bytes())
}
fn ensure_ward_home_for(path: &Path) -> Result<()> {
let home = logs::ward_home();
if path.starts_with(&home) {
fs_util::ensure_private_dir(&home)?;
}
Ok(())
}
#[derive(Debug, Default, Serialize, Deserialize)]
struct FileStore {
entries: BTreeMap<String, String>,
}
#[cfg(test)]
mod tests {
use super::*;
use std::sync::{Mutex, OnceLock};
fn env_lock() -> std::sync::MutexGuard<'static, ()> {
static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
LOCK.get_or_init(|| Mutex::new(())).lock().unwrap()
}
#[test]
#[serial_test::serial]
fn file_store_sets_gets_and_deletes_secrets() {
let _guard = env_lock();
let tempdir = tempfile::tempdir().unwrap();
std::env::set_var("WARD_HOME", tempdir.path());
std::env::set_var("WARD_UNSAFE_TEST_KEYRING", "1");
set_secret("demo", "secret").unwrap();
assert!(file_store_path().ends_with("cache/keystore.json"));
assert_eq!(get_secret("demo").unwrap().as_deref(), Some("secret"));
delete_secret("demo").unwrap();
assert!(get_secret("demo").unwrap().is_none());
std::env::remove_var("WARD_HOME");
std::env::remove_var("WARD_UNSAFE_TEST_KEYRING");
}
#[test]
#[serial_test::serial]
fn migrates_legacy_test_keyring_file_to_keystore() {
let _guard = env_lock();
let tempdir = tempfile::tempdir().unwrap();
std::env::set_var("WARD_HOME", tempdir.path());
let legacy = legacy_file_store_path();
std::fs::create_dir_all(legacy.parent().unwrap()).unwrap();
std::fs::write(&legacy, r#"{"entries":{"demo":"secret"}}"#).unwrap();
assert_eq!(get_secret("demo").unwrap().as_deref(), Some("secret"));
assert!(file_store_path().exists());
assert!(!legacy.exists());
std::env::remove_var("WARD_HOME");
}
#[test]
#[serial_test::serial]
#[cfg(not(coverage))]
fn keychain_is_explicit_opt_in_only() {
let _guard = env_lock();
std::env::remove_var("WARD_KEYCHAIN");
std::env::set_var("WARD_UNSAFE_TEST_KEYRING", "1");
assert!(!use_keychain_store());
std::env::set_var("WARD_KEYCHAIN", "1");
assert!(use_keychain_store());
std::env::remove_var("WARD_KEYCHAIN");
std::env::remove_var("WARD_UNSAFE_TEST_KEYRING");
}
#[test]
fn load_file_store_reports_invalid_json() {
let tempdir = tempfile::tempdir().unwrap();
let path = tempdir.path().join("store.json");
std::fs::write(&path, "{bad-json}").unwrap();
assert!(load_file_store(&path).is_err());
let directory_path = tempdir.path().join("store-dir.json");
std::fs::create_dir(&directory_path).unwrap();
assert!(load_file_store(&directory_path).is_err());
assert!(write_file_store(&directory_path, &FileStore::default()).is_err());
}
#[test]
#[serial_test::serial]
fn file_store_operations_report_corrupt_store() {
let _guard = env_lock();
let tempdir = tempfile::tempdir().unwrap();
std::env::set_var("WARD_HOME", tempdir.path());
std::env::set_var("WARD_UNSAFE_TEST_KEYRING", "1");
let path = file_store_path();
std::fs::create_dir_all(path.parent().unwrap()).unwrap();
std::fs::write(&path, "{bad-json}").unwrap();
assert!(set_secret("demo", "secret").is_err());
assert!(get_secret("demo").is_err());
assert!(delete_secret("demo").is_err());
std::env::remove_var("WARD_HOME");
std::env::remove_var("WARD_UNSAFE_TEST_KEYRING");
}
}