pitboard 0.1.0

Park and restore your own Claude Code logins on one machine, and see what each one has left.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

//! Where pitboard parks logins on platforms with no keychain: one 0600 file per parked
//! login, inside pitboard's own 0700 directory.

use super::{Backend, Error, RawStore};
use crate::{atomic, home};
use std::path::PathBuf;

pub(super) struct FileVault;

pub(super) const FILE: FileVault = FileVault;

impl FileVault {
    fn dir(&self) -> PathBuf {
        home::dir().join("vault")
    }

    /// Service names are generated by pitboard and contain only hex, hyphens and ASCII
    /// words, so they are used as file names directly. Anything else is refused rather
    /// than escaped, because escaping invites a traversal bug for no benefit.
    fn path(&self, service: &str) -> Result<PathBuf, Error> {
        if service.is_empty()
            || !service
                .bytes()
                .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_' | b'.'))
        {
            return Err(Error::Write(format!(
                "{service} is not a name this vault will store"
            )));
        }
        Ok(self.dir().join(format!("{service}.json")))
    }
}

impl RawStore for FileVault {
    fn kind(&self) -> Backend {
        Backend::File
    }

    fn contains(&self, service: &str) -> Result<bool, Error> {
        super::exists(&self.path(service)?)
    }

    fn read(&self, service: &str) -> Result<Option<String>, Error> {
        let path = self.path(service)?;
        match std::fs::read_to_string(&path) {
            Ok(s) => Ok(Some(s)),
            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
            Err(e) => Err(Error::Unreadable(format!(
                "cannot read {}: {e}",
                path.display()
            ))),
        }
    }

    fn write(&self, service: &str, contents: &str) -> Result<(), Error> {
        let path = self.path(service)?;
        home::create_private(&self.dir()).map_err(|e| Error::Write(e.to_string()))?;
        atomic::write(&path, contents.as_bytes(), atomic::Perms::Secret)
            .map_err(|e| Error::Write(format!("cannot write {}: {e}", path.display())))?;
        match self.read(service)? {
            Some(back) if back == contents => Ok(()),
            _ => Err(Error::NotDurable(format!(
                "{} does not hold what was written",
                path.display()
            ))),
        }
    }

    fn delete(&self, service: &str) -> Result<(), Error> {
        let path = self.path(service)?;
        match std::fs::remove_file(&path) {
            Ok(()) => Ok(()),
            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
            Err(e) => Err(Error::Write(e.to_string())),
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn only_names_pitboard_generates_are_accepted() {
        for good in [
            "pitboard-park-9aeb9c89-316c-4344-84c5-603d71dc5c9a-1789935600123",
            "a.b_c-1",
        ] {
            assert!(FILE.path(good).is_ok(), "{good}");
        }
        for bad in ["", "../escape", "has space", "a/b", "sl\\ash"] {
            assert!(
                FILE.path(bad).is_err(),
                "{bad:?} must be refused, not escaped"
            );
        }
    }
}