@aiwg/cockpit 2026.8.3 → 2026.8.5

package/shell-core/keychain.mjs

@@ -3,7 +3,6 @@ import { platform } from 'node:os';
 
 const SERVICE = 'aiwg-cockpit-bridge';
 const FOLDER = 'AIWG Cockpit';
-const WALLET = process.env.AIWG_COCKPIT_KWALLET || 'kdewallet';
 
 function collect(cmd, args, input, timeoutMs = 2_000) {
   return new Promise((resolve, reject) => {
@@ -37,74 +36,94 @@ async function canRun(cmd) {
   }
 }
 
-async function windowsPowerShell() {
-  if (await canRun('powershell')) return 'powershell';
-  if (await canRun('pwsh')) return 'pwsh';
-  throw new Error('no supported Windows PowerShell command found');
-}
+/**
+ * Build the cross-platform keychain adapter around injectable platform and
+ * process seams. Production uses the defaults below; tests exercise the exact
+ * argv/stdin contract for every OS without pretending the CI host is macOS or
+ * Windows.
+ */
+export function createKeychainAdapter({
+  os = platform(),
+  env = process.env,
+  run = collect,
+  commandAvailable = canRun,
+} = {}) {
+  const wallet = env.AIWG_COCKPIT_KWALLET || 'kdewallet';
 
-async function storeWindowsCredential(token, account) {
-  const ps = await windowsPowerShell();
-  const script = [
-    '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]',
-    '$vault = New-Object Windows.Security.Credentials.PasswordVault',
-    'try { $vault.Remove($vault.Retrieve($args[0], $args[1])) } catch {}',
-    '$password = [Console]::In.ReadToEnd()',
-    '$credential = New-Object Windows.Security.Credentials.PasswordCredential -ArgumentList $args[0], $args[1], $password',
-    '$vault.Add($credential)',
-  ].join('; ');
-  await collect(ps, ['-NoProfile', '-NonInteractive', '-Command', script, SERVICE, account], token);
-  return { backend: 'windows-credential-manager', service: SERVICE, account, target: `${SERVICE}:${account}` };
-}
+  async function windowsPowerShell() {
+    if (await commandAvailable('powershell')) return 'powershell';
+    if (await commandAvailable('pwsh')) return 'pwsh';
+    throw new Error('no supported Windows PowerShell command found');
+  }
+
+  async function storeWindowsCredential(token, account) {
+    const ps = await windowsPowerShell();
+    const script = [
+      '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]',
+      '$vault = New-Object Windows.Security.Credentials.PasswordVault',
+      'try { $vault.Remove($vault.Retrieve($args[0], $args[1])) } catch {}',
+      '$password = [Console]::In.ReadToEnd()',
+      '$credential = New-Object Windows.Security.Credentials.PasswordCredential -ArgumentList $args[0], $args[1], $password',
+      '$vault.Add($credential)',
+    ].join('; ');
+    await run(ps, ['-NoProfile', '-NonInteractive', '-Command', script, SERVICE, account], token);
+    return { backend: 'windows-credential-manager', service: SERVICE, account, target: `${SERVICE}:${account}` };
+  }
 
-async function readWindowsCredential(ref) {
-  const ps = await windowsPowerShell();
-  const script = [
-    '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]',
-    '$vault = New-Object Windows.Security.Credentials.PasswordVault',
-    '$credential = $vault.Retrieve($args[0], $args[1])',
-    '$credential.RetrievePassword()',
-    '[Console]::Out.Write($credential.Password)',
-  ].join('; ');
-  return (await collect(ps, ['-NoProfile', '-NonInteractive', '-Command', script, ref.service || SERVICE, ref.account])).trim();
+  async function readWindowsCredential(ref) {
+    const ps = await windowsPowerShell();
+    const script = [
+      '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]',
+      '$vault = New-Object Windows.Security.Credentials.PasswordVault',
+      '$credential = $vault.Retrieve($args[0], $args[1])',
+      '$credential.RetrievePassword()',
+      '[Console]::Out.Write($credential.Password)',
+    ].join('; ');
+    return (await run(ps, ['-NoProfile', '-NonInteractive', '-Command', script, ref.service || SERVICE, ref.account])).trim();
+  }
+
+  return {
+    async store(token, account = `bridge-${process.pid}`) {
+      if (env.AIWG_COCKPIT_KEYCHAIN_DISABLED === '1') {
+        throw new Error('OS keychain disabled by AIWG_COCKPIT_KEYCHAIN_DISABLED');
+      }
+      if (os === 'darwin' && await commandAvailable('security')) {
+        await run('security', ['add-generic-password', '-a', account, '-s', SERVICE, '-w', token, '-U']);
+        return { backend: 'macos-keychain', service: SERVICE, account };
+      }
+      if (os === 'win32') return storeWindowsCredential(token, account);
+      if (await commandAvailable('secret-tool')) {
+        await run('secret-tool', ['store', '--label', 'AIWG Cockpit Bridge', 'service', SERVICE, 'account', account], token);
+        return { backend: 'libsecret', service: SERVICE, account };
+      }
+      if (env.AIWG_COCKPIT_ENABLE_KWALLET === '1' && await commandAvailable('kwallet-query')) {
+        await run('kwallet-query', ['-f', FOLDER, '-w', account, wallet], token);
+        return { backend: 'kwallet', service: SERVICE, account, wallet, folder: FOLDER };
+      }
+      throw new Error('no supported OS keychain command found');
+    },
+
+    async read(ref) {
+      if (!ref || typeof ref !== 'object') throw new Error('missing keychain reference');
+      if (ref.backend === 'macos-keychain') {
+        return (await run('security', ['find-generic-password', '-a', ref.account, '-s', ref.service || SERVICE, '-w'])).trim();
+      }
+      if (ref.backend === 'windows-credential-manager') return readWindowsCredential(ref);
+      if (ref.backend === 'libsecret') {
+        return (await run('secret-tool', ['lookup', 'service', ref.service || SERVICE, 'account', ref.account])).trim();
+      }
+      if (ref.backend === 'kwallet') {
+        return (await run('kwallet-query', ['-f', ref.folder || FOLDER, '-r', ref.account, ref.wallet || wallet])).trim();
+      }
+      throw new Error(`unsupported keychain backend: ${ref.backend}`);
+    },
+  };
 }
 
 export async function storeCockpitToken(token, account = `bridge-${process.pid}`) {
-  if (process.env.AIWG_COCKPIT_KEYCHAIN_DISABLED === '1') {
-    throw new Error('OS keychain disabled by AIWG_COCKPIT_KEYCHAIN_DISABLED');
-  }
-  const os = platform();
-  if (os === 'darwin' && await canRun('security')) {
-    await collect('security', ['add-generic-password', '-a', account, '-s', SERVICE, '-w', token, '-U']);
-    return { backend: 'macos-keychain', service: SERVICE, account };
-  }
-  if (os === 'win32') {
-    return storeWindowsCredential(token, account);
-  }
-  if (await canRun('secret-tool')) {
-    await collect('secret-tool', ['store', '--label', 'AIWG Cockpit Bridge', 'service', SERVICE, 'account', account], token);
-    return { backend: 'libsecret', service: SERVICE, account };
-  }
-  if (process.env.AIWG_COCKPIT_ENABLE_KWALLET === '1' && await canRun('kwallet-query')) {
-    await collect('kwallet-query', ['-f', FOLDER, '-w', account, WALLET], token);
-    return { backend: 'kwallet', service: SERVICE, account, wallet: WALLET, folder: FOLDER };
-  }
-  throw new Error('no supported OS keychain command found');
+  return createKeychainAdapter().store(token, account);
 }
 
 export async function readCockpitToken(ref) {
-  if (!ref || typeof ref !== 'object') throw new Error('missing keychain reference');
-  if (ref.backend === 'macos-keychain') {
-    return (await collect('security', ['find-generic-password', '-a', ref.account, '-s', ref.service || SERVICE, '-w'])).trim();
-  }
-  if (ref.backend === 'windows-credential-manager') {
-    return readWindowsCredential(ref);
-  }
-  if (ref.backend === 'libsecret') {
-    return (await collect('secret-tool', ['lookup', 'service', ref.service || SERVICE, 'account', ref.account])).trim();
-  }
-  if (ref.backend === 'kwallet') {
-    return (await collect('kwallet-query', ['-f', ref.folder || FOLDER, '-r', ref.account, ref.wallet || WALLET])).trim();
-  }
-  throw new Error(`unsupported keychain backend: ${ref.backend}`);
+  return createKeychainAdapter().read(ref);
 }