vaultkit 1.2.1 → 1.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 693839ee170f79bd7012760053b2e0240f2730693741603029182066462b6c20
-  data.tar.gz: 5e200af5f55787dc471f8299f63e33f5aeb2613646aa3f28dd0012142559ca38
+  metadata.gz: 992511b9fff48dc39ffa343776721e9c24077c00cfdbe97b9f98e0f1454f4093
+  data.tar.gz: bcc02c8d21f7d0e66d1b30fd16ef2080aedf8271ac7159d775f05bf1e6db15d1
 SHA512:
-  metadata.gz: 89687754411a6d542d819443638129bfbb1650a0745e18e71e2cb6d677ab71d9d43bb57768af450d3a51a5d821c0297fe485bcaedee687b595220b3b47e69c38
-  data.tar.gz: 2771cbb8bbcb6a1c6570ddeaa9854a232c07f2583195cf9eb0dc2ed8615b52438b6da150cb415b7f95b53f2955e31b5b4101b2157b0c3da1823431dce811e8eb
+  metadata.gz: dd8c2496c757661ade482f3ac01bf68ab1d073903db14dec88d9a4d4d40721beb9ea36e8942deb4f9296b3f6e6f49014d1724b8bbfb3d67d351ed886024629bf
+  data.tar.gz: 2881996c7f00bb58a92a62d00dea1408ab2ea42c0e0d3acc2fb0f6fc782ac27aa6eac943b458ddcd5dee416debb8714b0f285a7f6954db9d2c9e00290f2206a7

data/README.md

@@ -200,6 +200,14 @@ Clear stored credentials and end session.
 vkit logout
 ```
 
+### Where the login is saved
+
+`vkit login` saves the endpoint and token in the macOS Keychain, or in the Secret
+Service keyring (GNOME Keyring, KWallet) on Linux when `secret-tool` is installed.
+Elsewhere, including Windows, or when saving to the keychain fails (for example, over
+SSH with no unlocked keyring), it saves them to `~/.vkit/credentials.json`, readable
+only by you, and says so. Login tokens expire after an hour.
+
 ### Credentials from the environment
 
 `vkit` normally uses the login saved by `vkit login`, in your OS keychain or

data/lib/vkit/core/credential_store.rb

@@ -15,6 +15,8 @@ module Vkit
     class CredentialStore
       SERVICE = "vkit"
       ACCOUNT = "credentials"
+      # security -i reads lines of about 4 KB; a login is well under that.
+      MAC_KEYCHAIN_MAX_HEX = 3_900
 
       @override_noticed = false
 
@@ -34,15 +36,7 @@ module Vkit
           "user" => user
         }
 
-        case
-        when mac?
-          mac_keychain_store(payload)
-        when linux? && secret_tool_available?
-          linux_secret_service_store(payload)
-        else
-          file_store(payload)
-        end
-
+        store(payload)
         true
       end
 
@@ -56,16 +50,8 @@ module Vkit
         return unless payload
       
         payload["user"] = user
-      
-        case
-        when mac?
-          mac_keychain_store(payload)
-        when linux? && secret_tool_available?
-          linux_secret_service_store(payload)
-        else
-          file_store(payload)
-        end
-      end      
+        store(payload)
+      end
 
       def endpoint
         load_payload&.dig("endpoint")
@@ -110,9 +96,8 @@ module Vkit
           mac_keychain_delete
         when linux? && secret_tool_available?
           linux_secret_service_delete
-        else
-          file_delete
         end
+        file_delete
       end
 
       def clear_token!
@@ -120,15 +105,7 @@ module Vkit
         return unless payload
       
         payload.delete("token")
-      
-        case
-        when mac?
-          mac_keychain_store(payload)
-        when linux? && secret_tool_available?
-          linux_secret_service_store(payload)
-        else
-          file_store(payload)
-        end
+        store(payload)
       end
 
       # endpoint and token only; the user is looked up separately (#user),
@@ -137,15 +114,40 @@ module Vkit
         env_override || stored_payload
       end
 
+      # The keychain first, then the file, which also holds the login when
+      # saving to the keychain failed.
       def stored_payload
-        case
-        when mac?
-          mac_keychain_load
-        when linux? && secret_tool_available?
-          linux_secret_service_load
-        else
-          file_load
+        keychain =
+          case
+          when mac?
+            mac_keychain_load
+          when linux? && secret_tool_available?
+            linux_secret_service_load
+          end
+
+        keychain || file_load
+      end
+
+      # Saves to the OS keychain when there is one. If that fails (no
+      # unlocked keyring over SSH, a locked login keychain), saves to
+      # ~/.vkit instead and says so, rather than reporting a login that
+      # wasn't kept.
+      def store(payload)
+        saved =
+          case
+          when mac?
+            mac_keychain_store(payload)
+          when linux? && secret_tool_available?
+            linux_secret_service_store(payload)
+          end
+
+        if saved
+          file_delete
+          return
         end
+
+        warn "vkit: couldn't save to the system keychain; saved to #{@fallback_path} instead." unless saved.nil?
+        file_store(payload)
       end
 
       def override_user(override)
@@ -171,15 +173,19 @@ module Vkit
         system("which secret-tool > /dev/null 2>&1")
       end
 
+      # `security -i` reads the command from stdin, so the token never
+      # appears in the process list, as it would with `-w` on the command
+      # line. The data goes in hex (-X) to avoid quoting.
       def mac_keychain_store(payload)
+        hex = payload.to_json.unpack1("H*")
+        return false if hex.bytesize > MAC_KEYCHAIN_MAX_HEX
+
         mac_keychain_delete
-        system(
-          "security", "add-generic-password",
-          "-a", ACCOUNT,
-          "-s", SERVICE,
-          "-w", payload.to_json,
-          "-U"
+        _stdout, _stderr, status = Open3.capture3(
+          "security", "-i",
+          stdin_data: "add-generic-password -a #{ACCOUNT} -s #{SERVICE} -U -X #{hex}\n"
         )
+        status.success?
       end
 
       def mac_keychain_load
@@ -208,7 +214,7 @@ module Vkit
       end
 
       def linux_secret_service_store(payload)
-        Open3.capture3(
+        _stdout, _stderr, status = Open3.capture3(
           "secret-tool",
           "store",
           "--label=VaultKit Credentials",
@@ -216,6 +222,7 @@ module Vkit
           "account", ACCOUNT,
           stdin_data: payload.to_json
         )
+        status.success?
       end
 
       def linux_secret_service_load
@@ -234,7 +241,7 @@ module Vkit
       end
 
       def linux_secret_service_delete
-        linux_secret_service_store({})
+        system("secret-tool", "clear", "service", SERVICE, "account", ACCOUNT, out: File::NULL, err: File::NULL)
       end
 
       def file_store(payload)

data/lib/vkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vkit
-  VERSION = "1.2.1"
+  VERSION = "1.2.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vaultkit
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.2.2
 platform: ruby
 authors:
 - Nnamdi Ogundu
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-29 00:00:00.000000000 Z
+date: 2026-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor