@forge/cli-shared 9.10.0-next.1-experimental-65945d2 → 9.10.0-next.1-experimental-1e95696

package/CHANGELOG.md

@@ -1,6 +1,10 @@
 # @forge/cli-shared
 
-## 9.10.0-next.1-experimental-65945d2
+## 9.10.0-next.1-experimental-1e95696
+
+### Major Changes
+
+- ffd952f: Replace Keytar with a dedicated credential file protected by macOS and Linux permissions or Windows ACLs. This is a breaking authentication change: users with credentials stored in the OS keychain must run `forge login` once after upgrading. `FORGE_EMAIL` and `FORGE_API_TOKEN` continue to take precedence over saved credentials.
 
 ### Minor Changes
 
@@ -8,11 +12,10 @@
 
 ### Patch Changes
 
-- ffd952f: Add an experimental file-backed credential store with restricted macOS, Linux, and Windows permissions.
 - Updated dependencies [e865360]
 - Updated dependencies [5d8a857]
-  - @forge/util@3.1.0-next.0-experimental-65945d2
-  - @forge/manifest@13.8.1-next.0-experimental-65945d2
+  - @forge/util@3.1.0-next.0-experimental-1e95696
+  - @forge/manifest@13.8.1-next.0-experimental-1e95696
 
 ## 9.10.0-next.1
 

package/out/apps/get-app-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-app-owner.d.ts","sourceRoot":"","sources":["../../src/apps/get-app-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,qBAAa,oBAAqB,SAAQ,KAAK;;CAI9C;AAED,eAAO,MAAM,aAAa;QAuC83n3G,8CAAc;GA9Bp6n3G,CAAC;AAEH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,iBAAiB;IAGrC,OAAO;;;;;;;;;;;;;YAMN,WAAW;CAe1B"}
+{"version":3,"file":"get-app-owner.d.ts","sourceRoot":"","sources":["../../src/apps/get-app-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,qBAAa,oBAAqB,SAAQ,KAAK;;CAI9C;AAED,eAAO,MAAM,aAAa;QAuC0tz4G,8CAAc;GA9Bhwz4G,CAAC;AAEH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,iBAAiB;IAGrC,OAAO;;;;;;;;;;;;;YAMN,WAAW;CAe1B"}

package/out/auth/personal/credential-store.d.ts

@@ -1,16 +1,8 @@
 import * as t from 'io-ts';
-import { CachedConf } from '../../cache';
 import { UserError } from '../../shared';
-import { Logger } from '../../ui';
 import { UserRepository } from './user-repository';
 export declare const EMAIL_KEY = "FORGE_EMAIL";
 export declare const API_TOKEN_KEY = "FORGE_API_TOKEN";
-export declare const FILE_CREDENTIAL_STORE_FLAG = "FORGE_CLI_ENABLE_FILE_CREDENTIAL_STORE";
-export interface Keytar {
-    getPassword(service: string, account: string): Promise<string | null>;
-    setPassword(service: string, account: string, password: string): Promise<void>;
-    deletePassword(service: string, account: string): Promise<void>;
-}
 export declare const personalApiCredentialsShape: t.TypeC<{
     email: t.StringC;
     token: t.StringC;
@@ -25,11 +17,6 @@ export type PersonalApiCredentialsValidated = t.TypeOf<typeof personalApiCredent
 export declare class NoTokenInStoreError extends UserError {
     constructor();
 }
-export declare class NoKeytarError extends UserError {
-    constructor();
-}
-export declare class KeytarAccessError extends UserError {
-}
 export declare class CredentialStoreSecurityError extends UserError {
     constructor();
 }
@@ -60,22 +47,5 @@ export declare class FileCredentialStore implements CredentialStore {
     setCredentials(credentials: PersonalApiCredentialsValidated): Promise<void>;
     deleteCredentials(): Promise<void>;
 }
-export declare class CredentialStoreImpl implements CredentialStore {
-    private readonly logger;
-    private readonly instructionsURL;
-    private readonly keytar;
-    private readonly cachedConfig;
-    private readonly userRepository;
-    private keytarAccount;
-    constructor(logger: Logger, instructionsURL: string, keytar: Keytar | null, cachedConfig: CachedConf, userRepository: UserRepository);
-    private wrapKeytarError;
-    decodeCredentials(credentialsString: string | null): PersonalApiCredentialsValidated;
-    getCredentialsKeytar(keytar: Keytar): Promise<PersonalApiCredentialsValidated | undefined>;
-    popInsecurePlaintextCredentials(): PersonalApiCredentialsValidated | undefined;
-    deleteInsecurePlaintextCredentials(): void;
-    getCredentials(): Promise<PersonalApiCredentialsValidated>;
-    setCredentials(credentials: PersonalApiCredentialsValidated): Promise<void>;
-    deleteCredentials(): Promise<void>;
-}
-export declare function getCredentialStore(logger: Logger, userRepository: UserRepository): CredentialStore;
+export declare function getCredentialStore(userRepository: UserRepository): CredentialStore;
 //# sourceMappingURL=credential-store.d.ts.map

package/out/auth/personal/credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/auth/personal/credential-store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,CAAC,MAAM,OAAO,CAAC;AAC3B,OAAO,EAAuB,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,SAAS,EAAa,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,MAAM,EAAQ,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,eAAO,MAAM,SAAS,gBAAgB,CAAC;AACvC,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,0BAA0B,2CAA2C,CAAC;AAqBnF,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/E,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAUD,eAAO,MAAM,2BAA2B;;;EAGtC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;;EAI/C,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAClF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAEpG,qBAAa,mBAAoB,SAAQ,SAAS;;CAIjD;AAED,qBAAa,aAAc,SAAQ,SAAS;;CAI3C;AAED,qBAAa,iBAAkB,SAAQ,SAAS;CAAG;AAEnD,qBAAa,4BAA6B,SAAQ,SAAS;;CAI1D;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAID,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAezG,wBAAgB,sBAAsB,CACpC,eAAe,kBAAa,EAC5B,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,QAAQ,SAAY,GACnB,MAAM,CA4BR;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAIvD,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO,CAAC,cAAc,CAA8B;gBAGjC,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,MAAM,EACf,mBAAmB,SAA2B,EAC9C,eAAe,kBAAa,EAC5B,aAAa,GAAE,4BAAwD;YAG5E,iBAAiB;YAWjB,eAAe;YAaf,oBAAoB;YA0BpB,kBAAkB;YAmDlB,aAAa;YAab,mBAAmB;IA4B3B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC;IAkB1D,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBzC;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAIvD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,aAAa,CAAS;gBAGX,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,YAAY,EAAE,UAAU,EACxB,cAAc,EAAE,cAAc;IAKjD,OAAO,CAAC,eAAe;IAoBvB,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,+BAA+B;IAoB9E,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC;IAehG,+BAA+B,IAAI,+BAA+B,GAAG,SAAS;IAS9E,kCAAkC,IAAI,IAAI;IAIpC,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC;IAgC1D,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAWzC;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,GAAG,eAAe,CAUlG"}
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/auth/personal/credential-store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,CAAC,MAAM,OAAO,CAAC;AAE3B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,eAAO,MAAM,SAAS,gBAAgB,CAAC;AACvC,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAiB/C,eAAO,MAAM,2BAA2B;;;EAGtC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;;EAI/C,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAClF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAEpG,qBAAa,mBAAoB,SAAQ,SAAS;;CAIjD;AAED,qBAAa,4BAA6B,SAAQ,SAAS;;CAI1D;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAID,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAezG,wBAAgB,sBAAsB,CACpC,eAAe,kBAAa,EAC5B,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,QAAQ,SAAY,GACnB,MAAM,CAwBR;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAIvD,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO,CAAC,cAAc,CAA8B;gBAGjC,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,MAAM,EACf,mBAAmB,SAA2B,EAC9C,eAAe,kBAAa,EAC5B,aAAa,GAAE,4BAAwD;YAG5E,iBAAiB;YAWjB,eAAe;YAaf,oBAAoB;YA0BpB,kBAAkB;YAiDlB,aAAa;YAab,mBAAmB;IA4B3B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC;IAkB1D,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBzC;AAED,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,cAAc,GAAG,eAAe,CAElF"}

package/out/auth/personal/credential-store.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CredentialStoreImpl = exports.FileCredentialStore = exports.CredentialStoreSecurityError = exports.KeytarAccessError = exports.NoKeytarError = exports.NoTokenInStoreError = exports.personalApiCredentialsValidatedShape = exports.personalApiCredentialsShape = exports.FILE_CREDENTIAL_STORE_FLAG = exports.API_TOKEN_KEY = exports.EMAIL_KEY = void 0;
+exports.FileCredentialStore = exports.CredentialStoreSecurityError = exports.NoTokenInStoreError = exports.personalApiCredentialsValidatedShape = exports.personalApiCredentialsShape = exports.API_TOKEN_KEY = exports.EMAIL_KEY = void 0;
 exports.getCredentialsFilePath = getCredentialsFilePath;
 exports.getCredentialStore = getCredentialStore;
 const tslib_1 = require("tslib");
@@ -11,40 +11,25 @@ const path_1 = tslib_1.__importDefault(require("path"));
 const util_1 = require("util");
 const Either_1 = require("fp-ts/lib/Either");
 const t = tslib_1.__importStar(require("io-ts"));
-const cache_1 = require("../../cache");
-const instruction_1 = require("../instruction");
 const graphql_1 = require("../../graphql");
 const shared_1 = require("../../shared");
 const ui_1 = require("../../ui");
 exports.EMAIL_KEY = 'FORGE_EMAIL';
 exports.API_TOKEN_KEY = 'FORGE_API_TOKEN';
-exports.FILE_CREDENTIAL_STORE_FLAG = 'FORGE_CLI_ENABLE_FILE_CREDENTIAL_STORE';
-const KEYTAR_SERVICE = 'Atlassian';
-const CACHE_CREDENTIALS_KEY = 'forge-credentials';
 const CREDENTIALS_FILE_NAME = 'credentials.json';
-const CONFIG_DIRECTORY_SUFFIX = 'nodejs';
 const CREDENTIALS_DIRECTORY_MODE = 0o700;
 const CREDENTIALS_FILE_MODE = 0o600;
 const PERMISSION_BITS_MASK = 0o777;
-const GROUP_OR_OTHER_WRITE_BITS_MASK = 0o022;
 const WINDOWS_SYSTEM_SID = 'S-1-5-18';
 const WINDOWS_ADMINISTRATORS_SID = 'S-1-5-32-544';
-var KeytarAccount;
-(function (KeytarAccount) {
-    KeytarAccount["DEV"] = "Ecosystem-staging";
-    KeytarAccount["STG"] = "Ecosystem-staging";
-    KeytarAccount["PROD"] = "Ecosystem";
-    KeytarAccount["FEDRAMP_MODERATE_STAGING"] = "Ecosystem-fedm-staging";
-    KeytarAccount["FEDRAMP_MODERATE_PROD"] = "Ecosystem-fedm-prod";
-})(KeytarAccount || (KeytarAccount = {}));
-function getKeytar() {
-    try {
-        return require('keytar');
-    }
-    catch {
-        return null;
-    }
-}
+var CredentialAccount;
+(function (CredentialAccount) {
+    CredentialAccount["DEV"] = "Ecosystem-staging";
+    CredentialAccount["STG"] = "Ecosystem-staging";
+    CredentialAccount["PROD"] = "Ecosystem";
+    CredentialAccount["FEDRAMP_MODERATE_STAGING"] = "Ecosystem-fedm-staging";
+    CredentialAccount["FEDRAMP_MODERATE_PROD"] = "Ecosystem-fedm-prod";
+})(CredentialAccount || (CredentialAccount = {}));
 exports.personalApiCredentialsShape = t.type({
     email: t.string,
     token: t.string
@@ -60,15 +45,6 @@ class NoTokenInStoreError extends shared_1.UserError {
     }
 }
 exports.NoTokenInStoreError = NoTokenInStoreError;
-class NoKeytarError extends shared_1.UserError {
-    constructor() {
-        super(ui_1.Text.error.noKeytar);
-    }
-}
-exports.NoKeytarError = NoKeytarError;
-class KeytarAccessError extends shared_1.UserError {
-}
-exports.KeytarAccessError = KeytarAccessError;
 class CredentialStoreSecurityError extends shared_1.UserError {
     constructor() {
         super(ui_1.Text.error.credentialsFilePermissions);
@@ -89,13 +65,13 @@ function getCredentialsFilePath(currentPlatform = (0, os_1.platform)(), environm
     let credentialsDirectory;
     switch (currentPlatform) {
         case 'darwin':
-            credentialsDirectory = platformPath.join(userHome, 'Library', 'Preferences', `${cache_1.CONFIG_PROJECT_NAME}-${CONFIG_DIRECTORY_SUFFIX}`);
+            credentialsDirectory = platformPath.join(userHome, 'Library', 'Application Support', 'Atlassian', 'Forge');
             break;
         case 'win32':
             credentialsDirectory = platformPath.join(environment.LOCALAPPDATA || platformPath.join(userHome, 'AppData', 'Local'), 'Atlassian', 'Forge');
             break;
         default:
-            credentialsDirectory = platformPath.join(environment.XDG_CONFIG_HOME || platformPath.join(userHome, '.config'), `${cache_1.CONFIG_PROJECT_NAME}-${CONFIG_DIRECTORY_SUFFIX}`);
+            credentialsDirectory = platformPath.join(environment.XDG_DATA_HOME || platformPath.join(userHome, '.local', 'share'), 'Atlassian', 'Forge');
     }
     return platformPath.join(credentialsDirectory, CREDENTIALS_FILE_NAME);
 }
@@ -172,19 +148,17 @@ class FileCredentialStore {
             return;
         }
         const credentialsDirectory = path_1.default.dirname(this.credentialsFilePath);
-        const createdDirectory = await fs_1.promises.mkdir(credentialsDirectory, {
+        await fs_1.promises.mkdir(credentialsDirectory, {
             recursive: true,
             mode: CREDENTIALS_DIRECTORY_MODE
         });
-        if (createdDirectory !== undefined) {
-            await fs_1.promises.chmod(credentialsDirectory, CREDENTIALS_DIRECTORY_MODE);
-        }
+        await fs_1.promises.chmod(credentialsDirectory, CREDENTIALS_DIRECTORY_MODE);
         const directoryStat = await fs_1.promises.stat(credentialsDirectory);
         const currentUserId = process.getuid?.();
         if (currentUserId === undefined ||
             !directoryStat.isDirectory() ||
             directoryStat.uid !== currentUserId ||
-            (directoryStat.mode & GROUP_OR_OTHER_WRITE_BITS_MASK) !== 0) {
+            (directoryStat.mode & PERMISSION_BITS_MASK) !== CREDENTIALS_DIRECTORY_MODE) {
             throw new Error('The credentials directory is not owned exclusively by the current user');
         }
         if (!fileExists) {
@@ -288,141 +262,6 @@ class FileCredentialStore {
     }
 }
 exports.FileCredentialStore = FileCredentialStore;
-class CredentialStoreImpl {
-    logger;
-    instructionsURL;
-    keytar;
-    cachedConfig;
-    userRepository;
-    keytarAccount;
-    constructor(logger, instructionsURL, keytar, cachedConfig, userRepository) {
-        this.logger = logger;
-        this.instructionsURL = instructionsURL;
-        this.keytar = keytar;
-        this.cachedConfig = cachedConfig;
-        this.userRepository = userRepository;
-        this.keytarAccount = (0, graphql_1.getEnvironmentConfig)(KeytarAccount);
-    }
-    wrapKeytarError(e) {
-        const message = (0, shared_1.wrapError)(e).message;
-        let error;
-        const currentPlatform = (0, os_1.platform)();
-        switch (currentPlatform) {
-            case 'darwin':
-                error = ui_1.Text.error.keytarAccessError.mac(message);
-                break;
-            case 'linux':
-                error = ui_1.Text.error.keytarAccessError.linux(message);
-                break;
-            case 'win32':
-                error = ui_1.Text.error.keytarAccessError.windows(message);
-                break;
-            default:
-                error = ui_1.Text.error.keytarAccessError.other(message);
-        }
-        throw new KeytarAccessError(error);
-    }
-    decodeCredentials(credentialsString) {
-        if (!credentialsString) {
-            throw new NoTokenInStoreError();
-        }
-        let credentials;
-        try {
-            credentials = JSON.parse(credentialsString);
-        }
-        catch {
-            throw new NoTokenInStoreError();
-        }
-        const decodeResult = exports.personalApiCredentialsValidatedShape.decode(credentials);
-        if ((0, Either_1.isLeft)(decodeResult)) {
-            throw new NoTokenInStoreError();
-        }
-        return decodeResult.right;
-    }
-    async getCredentialsKeytar(keytar) {
-        let stringifiedPersonalApiCredentials;
-        try {
-            stringifiedPersonalApiCredentials = await keytar.getPassword(KEYTAR_SERVICE, this.keytarAccount);
-        }
-        catch (e) {
-            this.wrapKeytarError(e);
-        }
-        if (!stringifiedPersonalApiCredentials) {
-            return undefined;
-        }
-        return this.decodeCredentials(stringifiedPersonalApiCredentials);
-    }
-    popInsecurePlaintextCredentials() {
-        const result = this.cachedConfig.get(CACHE_CREDENTIALS_KEY);
-        if (result) {
-            this.logger.warn(ui_1.Text.warning.plaintextCredentialsFound(this.instructionsURL));
-            this.deleteInsecurePlaintextCredentials();
-        }
-        return result;
-    }
-    deleteInsecurePlaintextCredentials() {
-        this.cachedConfig.delete(CACHE_CREDENTIALS_KEY);
-    }
-    async getCredentials() {
-        let result;
-        const plaintextCredentials = this.popInsecurePlaintextCredentials();
-        if (plaintextCredentials) {
-            if (this.keytar) {
-                await this.setCredentials(plaintextCredentials);
-                this.logger.warn(ui_1.Text.warning.plaintextCredentialsMigrated);
-            }
-            else {
-                this.logger.warn(ui_1.Text.warning.plaintextCredentialsNotMigrated);
-            }
-        }
-        if (process.env[exports.API_TOKEN_KEY] && process.env[exports.EMAIL_KEY]) {
-            const credentials = {
-                email: process.env[exports.EMAIL_KEY],
-                token: process.env[exports.API_TOKEN_KEY]
-            };
-            const { accountId } = await this.userRepository.getUser(credentials);
-            result = { ...credentials, accountId };
-        }
-        else if (this.keytar) {
-            result = await this.getCredentialsKeytar(this.keytar);
-        }
-        if (result) {
-            return result;
-        }
-        throw new NoTokenInStoreError();
-    }
-    async setCredentials(credentials) {
-        if (this.keytar) {
-            try {
-                await this.keytar.setPassword(KEYTAR_SERVICE, this.keytarAccount, JSON.stringify(credentials));
-            }
-            catch (e) {
-                throw new NoKeytarError();
-            }
-        }
-        else {
-            throw new NoKeytarError();
-        }
-    }
-    async deleteCredentials() {
-        if (this.keytar) {
-            try {
-                await this.keytar.deletePassword(KEYTAR_SERVICE, this.keytarAccount);
-            }
-            catch (e) {
-            }
-        }
-        this.deleteInsecurePlaintextCredentials();
-    }
-}
-exports.CredentialStoreImpl = CredentialStoreImpl;
-function getCredentialStore(logger, userRepository) {
-    const credentialAccount = (0, graphql_1.getEnvironmentConfig)(KeytarAccount);
-    if (process.env[exports.FILE_CREDENTIAL_STORE_FLAG] === 'true') {
-        return new FileCredentialStore(userRepository, credentialAccount);
-    }
-    const keytar = getKeytar();
-    const cachedConfig = cache_1.CachedConf.getCache(cache_1.CONFIG_PROJECT_NAME);
-    const instructionsUrl = (0, instruction_1.getInstructionsUrl)();
-    return new CredentialStoreImpl(logger, instructionsUrl, keytar, cachedConfig, userRepository);
+function getCredentialStore(userRepository) {
+    return new FileCredentialStore(userRepository, (0, graphql_1.getEnvironmentConfig)(CredentialAccount));
 }

package/out/auth/personal/token-authenticator.js

@@ -19,7 +19,7 @@ class PersonalTokenAuthenticator {
         if (process.env[credential_store_1.API_TOKEN_KEY] && process.env[credential_store_1.EMAIL_KEY]) {
             return ui_1.Text.error.invalidTokenInEnv(instructionsUrl, credential_store_1.EMAIL_KEY, credential_store_1.API_TOKEN_KEY);
         }
-        return ui_1.Text.error.invalidTokenInKeytar;
+        return ui_1.Text.error.invalidTokenInCredentialFile;
     }
 }
 exports.PersonalTokenAuthenticator = PersonalTokenAuthenticator;