android-native-keyring-store 1.0.0

Android CredentialStore for keyring-core
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

use std::sync::Arc;

use keyring_core::{Credential, api::CredentialApi};

use crate::crypto::{decrypt, encrypt};

use super::vault::AtomicVault;

/// The Cred struct is public, so you can read the cred's ID and specifiers.
///
/// Every Cred also points back to its vault, which is needed for its operation,
/// but that is not a public member since vaults aren't public.
///
/// Every Cred operation works by locking its containing vault and then asking
/// the vault to perform the operation. This means that all credential operations
/// are serialized and never interfere with one another.
pub struct Cred {
    vault: AtomicVault,
    pub id: String,
    pub specifiers: (String, String),
}

impl std::fmt::Debug for Cred {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("AndroidCredential")
            .field("vault", &self.vault)
            .field("key", &self.id)
            .field("specifiers", &self.specifiers)
            .finish()
    }
}

impl Cred {
    /// Create a new credential object in the given vault with the given ID for the given
    /// service and user.
    ///
    /// No validity checking is done, that's assumed to be done by the caller.
    pub fn new_specifier(vault: AtomicVault, id: &str, service: &str, user: &str) -> Self {
        Self {
            vault,
            id: id.to_owned(),
            specifiers: (service.to_owned(), user.to_owned()),
        }
    }
}

impl CredentialApi for Cred {
    fn set_secret(&self, secret: &[u8]) -> keyring_core::Result<()> {
        let vault = self
            .vault
            .lock()
            .expect("Vault lock poisoned: report a bug!");
        vault.with_key_and_file(|env, key, file| {
            let ciphertext = encrypt(env, key, secret)?;
            let edit = file.edit(env)?;
            edit.put_binary(env, &self.id, &ciphertext)?.commit(env)?;
            Ok(())
        })?;
        Ok(())
    }

    fn get_secret(&self) -> keyring_core::Result<Vec<u8>> {
        let vault = self
            .vault
            .lock()
            .expect("Vault lock poisoned: report a bug!");
        let result = vault.with_key_and_file(|env, key, file| {
            let ciphertext = file.get_binary(env, &self.id)?;
            if let Some(data) = ciphertext {
                log::debug!("Found secret for id {:?}", self.id);
                let plaintext = decrypt(env, key, data)?;
                Ok(Some(plaintext))
            } else {
                log::debug!("No secret found for id {:?}", self.id);
                Ok(None)
            }
        })?;
        match result {
            Some(secret) => Ok(secret),
            None => Err(keyring_core::Error::NoEntry),
        }
    }

    fn delete_credential(&self) -> keyring_core::Result<()> {
        let vault = self
            .vault
            .lock()
            .expect("Vault lock poisoned: report a bug!");
        vault.with_env(|env| {
            let file = vault.get_file(env)?;
            if !file.contains(env, &self.id)? {
                log::debug!("No credential to delete for id {:?}", self.id);
                return Err(keyring_core::Error::NoEntry.into());
            }
            log::debug!("Deleting credential for id {:?}", self.id);
            let editor = file.edit(env)?;
            editor.remove(env, &self.id)?.commit(env)?;
            Ok(())
        })?;
        Ok(())
    }

    fn get_credential(&self) -> keyring_core::Result<Option<Arc<Credential>>> {
        let vault = self
            .vault
            .lock()
            .expect("Vault lock poisoned: report a bug!");
        vault.with_env(|env| {
            let file = vault.get_file(env)?;
            if !file.contains(env, &self.id)? {
                log::debug!("No credential for id {:?}", self.id);
                Err(keyring_core::Error::NoEntry)?;
            }
            log::debug!("Found credential for id {:?}", self.id);
            Ok(())
        })?;
        Ok(None)
    }

    fn get_specifiers(&self) -> Option<(String, String)> {
        Some(self.specifiers.clone())
    }

    fn as_any(&self) -> &dyn std::any::Any {
        self
    }

    fn debug_fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        std::fmt::Debug::fmt(self, f)
    }
}