@forge/cli-shared 9.10.0-next.1 → 9.10.0-next.1-experimental-1e95696

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @forge/cli-shared
 
+## 9.10.0-next.1-experimental-1e95696
+
+### Major Changes
+
+- ffd952f: Replace Keytar with a dedicated credential file protected by macOS and Linux permissions or Windows ACLs. This is a breaking authentication change: users with credentials stored in the OS keychain must run `forge login` once after upgrading. `FORGE_EMAIL` and `FORGE_API_TOKEN` continue to take precedence over saved credentials.
+
+### Minor Changes
+
+- e865360: Bump @forge/util with latest aris and dependencies
+
+### Patch Changes
+
+- Updated dependencies [e865360]
+- Updated dependencies [5d8a857]
+  - @forge/util@3.1.0-next.0-experimental-1e95696
+  - @forge/manifest@13.8.1-next.0-experimental-1e95696
+
 ## 9.10.0-next.1
 
 ### Minor Changes

package/out/apps/get-app-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-app-owner.d.ts","sourceRoot":"","sources":["../../src/apps/get-app-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,qBAAa,oBAAqB,SAAQ,KAAK;;CAI9C;AAED,eAAO,MAAM,aAAa;QAuC+sx2G,8CAAc;GA9Brvx2G,CAAC;AAEH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,iBAAiB;IAGrC,OAAO;;;;;;;;;;;;;YAMN,WAAW;CAe1B"}
+{"version":3,"file":"get-app-owner.d.ts","sourceRoot":"","sources":["../../src/apps/get-app-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,qBAAa,oBAAqB,SAAQ,KAAK;;CAI9C;AAED,eAAO,MAAM,aAAa;QAuC0tz4G,8CAAc;GA9Bhwz4G,CAAC;AAEH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,iBAAiB;IAGrC,OAAO;;;;;;;;;;;;;YAMN,WAAW;CAe1B"}

package/out/auth/personal/credential-store.d.ts

@@ -1,15 +1,8 @@
 import * as t from 'io-ts';
-import { CachedConf } from '../../cache';
 import { UserError } from '../../shared';
-import { Logger } from '../../ui';
 import { UserRepository } from './user-repository';
 export declare const EMAIL_KEY = "FORGE_EMAIL";
 export declare const API_TOKEN_KEY = "FORGE_API_TOKEN";
-export interface Keytar {
-    getPassword(service: string, account: string): Promise<string | null>;
-    setPassword(service: string, account: string, password: string): Promise<void>;
-    deletePassword(service: string, account: string): Promise<void>;
-}
 export declare const personalApiCredentialsShape: t.TypeC<{
     email: t.StringC;
     token: t.StringC;
@@ -24,11 +17,9 @@ export type PersonalApiCredentialsValidated = t.TypeOf<typeof personalApiCredent
 export declare class NoTokenInStoreError extends UserError {
     constructor();
 }
-export declare class NoKeytarError extends UserError {
+export declare class CredentialStoreSecurityError extends UserError {
     constructor();
 }
-export declare class KeytarAccessError extends UserError {
-}
 export interface CredentialGetter {
     getCredentials(): Promise<PersonalApiCredentialsValidated>;
 }
@@ -36,22 +27,25 @@ export interface CredentialStore extends CredentialGetter {
     setCredentials(credentials: PersonalApiCredentialsValidated): Promise<void>;
     deleteCredentials(): Promise<void>;
 }
-export declare class CredentialStoreImpl implements CredentialStore {
-    private readonly logger;
-    private readonly instructionsURL;
-    private readonly keytar;
-    private readonly cachedConfig;
+export type CredentialStoreCommandRunner = (command: string, args: readonly string[]) => Promise<string>;
+export declare function getCredentialsFilePath(currentPlatform?: NodeJS.Platform, environment?: NodeJS.ProcessEnv, userHome?: string): string;
+export declare class FileCredentialStore implements CredentialStore {
     private readonly userRepository;
-    private keytarAccount;
-    constructor(logger: Logger, instructionsURL: string, keytar: Keytar | null, cachedConfig: CachedConf, userRepository: UserRepository);
-    private wrapKeytarError;
-    decodeCredentials(credentialsString: string | null): PersonalApiCredentialsValidated;
-    getCredentialsKeytar(keytar: Keytar): Promise<PersonalApiCredentialsValidated | undefined>;
-    popInsecurePlaintextCredentials(): PersonalApiCredentialsValidated | undefined;
-    deleteInsecurePlaintextCredentials(): void;
+    private readonly account;
+    private readonly credentialsFilePath;
+    private readonly currentPlatform;
+    private readonly commandRunner;
+    private windowsUserSid;
+    constructor(userRepository: UserRepository, account: string, credentialsFilePath?: string, currentPlatform?: NodeJS.Platform, commandRunner?: CredentialStoreCommandRunner);
+    private getWindowsUserSid;
+    private applyWindowsAcl;
+    private secureWindowsStorage;
+    private securePosixStorage;
+    private secureStorage;
+    private readCredentialsFile;
     getCredentials(): Promise<PersonalApiCredentialsValidated>;
     setCredentials(credentials: PersonalApiCredentialsValidated): Promise<void>;
     deleteCredentials(): Promise<void>;
 }
-export declare function getCredentialStore(logger: Logger, userRepository: UserRepository): CredentialStore;
+export declare function getCredentialStore(userRepository: UserRepository): CredentialStore;
 //# sourceMappingURL=credential-store.d.ts.map

package/out/auth/personal/credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/auth/personal/credential-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,CAAC,MAAM,OAAO,CAAC;AAC3B,OAAO,EAAuB,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,SAAS,EAAa,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,MAAM,EAAQ,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,eAAO,MAAM,SAAS,gBAAgB,CAAC;AACvC,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAa/C,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/E,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAUD,eAAO,MAAM,2BAA2B;;;EAGtC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;;EAI/C,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAClF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAEpG,qBAAa,mBAAoB,SAAQ,SAAS;;CAIjD;AAED,qBAAa,aAAc,SAAQ,SAAS;;CAI3C;AAED,qBAAa,iBAAkB,SAAQ,SAAS;CAAG;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAIvD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,aAAa,CAAS;gBAGX,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,YAAY,EAAE,UAAU,EACxB,cAAc,EAAE,cAAc;IAKjD,OAAO,CAAC,eAAe;IAoBvB,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,+BAA+B;IAoB9E,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC;IAehG,+BAA+B,IAAI,+BAA+B,GAAG,SAAS;IAS9E,kCAAkC,IAAI,IAAI;IAIpC,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC;IAgC1D,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAWzC;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,GAAG,eAAe,CAKlG"}
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/auth/personal/credential-store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,CAAC,MAAM,OAAO,CAAC;AAE3B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,eAAO,MAAM,SAAS,gBAAgB,CAAC;AACvC,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAiB/C,eAAO,MAAM,2BAA2B;;;EAGtC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;;EAI/C,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAClF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAEpG,qBAAa,mBAAoB,SAAQ,SAAS;;CAIjD;AAED,qBAAa,4BAA6B,SAAQ,SAAS;;CAI1D;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAID,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAezG,wBAAgB,sBAAsB,CACpC,eAAe,kBAAa,EAC5B,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,QAAQ,SAAY,GACnB,MAAM,CAwBR;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAIvD,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO,CAAC,cAAc,CAA8B;gBAGjC,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,MAAM,EACf,mBAAmB,SAA2B,EAC9C,eAAe,kBAAa,EAC5B,aAAa,GAAE,4BAAwD;YAG5E,iBAAiB;YAWjB,eAAe;YAaf,oBAAoB;YA0BpB,kBAAkB;YAiDlB,aAAa;YAab,mBAAmB;IA4B3B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC;IAkB1D,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBzC;AAED,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,cAAc,GAAG,eAAe,CAElF"}

package/out/auth/personal/credential-store.js

@@ -1,36 +1,35 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CredentialStoreImpl = exports.KeytarAccessError = exports.NoKeytarError = exports.NoTokenInStoreError = exports.personalApiCredentialsValidatedShape = exports.personalApiCredentialsShape = exports.API_TOKEN_KEY = exports.EMAIL_KEY = void 0;
+exports.FileCredentialStore = exports.CredentialStoreSecurityError = exports.NoTokenInStoreError = exports.personalApiCredentialsValidatedShape = exports.personalApiCredentialsShape = exports.API_TOKEN_KEY = exports.EMAIL_KEY = void 0;
+exports.getCredentialsFilePath = getCredentialsFilePath;
 exports.getCredentialStore = getCredentialStore;
 const tslib_1 = require("tslib");
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
 const os_1 = require("os");
+const path_1 = tslib_1.__importDefault(require("path"));
+const util_1 = require("util");
 const Either_1 = require("fp-ts/lib/Either");
 const t = tslib_1.__importStar(require("io-ts"));
-const cache_1 = require("../../cache");
-const instruction_1 = require("../instruction");
 const graphql_1 = require("../../graphql");
 const shared_1 = require("../../shared");
 const ui_1 = require("../../ui");
 exports.EMAIL_KEY = 'FORGE_EMAIL';
 exports.API_TOKEN_KEY = 'FORGE_API_TOKEN';
-const KEYTAR_SERVICE = 'Atlassian';
-const CACHE_CREDENTIALS_KEY = 'forge-credentials';
-var KeytarAccount;
-(function (KeytarAccount) {
-    KeytarAccount["DEV"] = "Ecosystem-staging";
-    KeytarAccount["STG"] = "Ecosystem-staging";
-    KeytarAccount["PROD"] = "Ecosystem";
-    KeytarAccount["FEDRAMP_MODERATE_STAGING"] = "Ecosystem-fedm-staging";
-    KeytarAccount["FEDRAMP_MODERATE_PROD"] = "Ecosystem-fedm-prod";
-})(KeytarAccount || (KeytarAccount = {}));
-function getKeytar() {
-    try {
-        return require('keytar');
-    }
-    catch {
-        return null;
-    }
-}
+const CREDENTIALS_FILE_NAME = 'credentials.json';
+const CREDENTIALS_DIRECTORY_MODE = 0o700;
+const CREDENTIALS_FILE_MODE = 0o600;
+const PERMISSION_BITS_MASK = 0o777;
+const WINDOWS_SYSTEM_SID = 'S-1-5-18';
+const WINDOWS_ADMINISTRATORS_SID = 'S-1-5-32-544';
+var CredentialAccount;
+(function (CredentialAccount) {
+    CredentialAccount["DEV"] = "Ecosystem-staging";
+    CredentialAccount["STG"] = "Ecosystem-staging";
+    CredentialAccount["PROD"] = "Ecosystem";
+    CredentialAccount["FEDRAMP_MODERATE_STAGING"] = "Ecosystem-fedm-staging";
+    CredentialAccount["FEDRAMP_MODERATE_PROD"] = "Ecosystem-fedm-prod";
+})(CredentialAccount || (CredentialAccount = {}));
 exports.personalApiCredentialsShape = t.type({
     email: t.string,
     token: t.string
@@ -46,146 +45,223 @@ class NoTokenInStoreError extends shared_1.UserError {
     }
 }
 exports.NoTokenInStoreError = NoTokenInStoreError;
-class NoKeytarError extends shared_1.UserError {
+class CredentialStoreSecurityError extends shared_1.UserError {
     constructor() {
-        super(ui_1.Text.error.noKeytar);
+        super(ui_1.Text.error.credentialsFilePermissions);
     }
 }
-exports.NoKeytarError = NoKeytarError;
-class KeytarAccessError extends shared_1.UserError {
+exports.CredentialStoreSecurityError = CredentialStoreSecurityError;
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+const runCredentialStoreCommand = async (command, args) => {
+    const { stdout } = await execFileAsync(command, [...args], { encoding: 'utf8', windowsHide: true });
+    return stdout;
+};
+const credentialsByAccountShape = t.record(t.string, exports.personalApiCredentialsValidatedShape);
+function isFileNotFoundError(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';
 }
-exports.KeytarAccessError = KeytarAccessError;
-class CredentialStoreImpl {
-    logger;
-    instructionsURL;
-    keytar;
-    cachedConfig;
+function getCredentialsFilePath(currentPlatform = (0, os_1.platform)(), environment = process.env, userHome = (0, os_1.homedir)()) {
+    const platformPath = currentPlatform === 'win32' ? path_1.default.win32 : path_1.default.posix;
+    let credentialsDirectory;
+    switch (currentPlatform) {
+        case 'darwin':
+            credentialsDirectory = platformPath.join(userHome, 'Library', 'Application Support', 'Atlassian', 'Forge');
+            break;
+        case 'win32':
+            credentialsDirectory = platformPath.join(environment.LOCALAPPDATA || platformPath.join(userHome, 'AppData', 'Local'), 'Atlassian', 'Forge');
+            break;
+        default:
+            credentialsDirectory = platformPath.join(environment.XDG_DATA_HOME || platformPath.join(userHome, '.local', 'share'), 'Atlassian', 'Forge');
+    }
+    return platformPath.join(credentialsDirectory, CREDENTIALS_FILE_NAME);
+}
+class FileCredentialStore {
     userRepository;
-    keytarAccount;
-    constructor(logger, instructionsURL, keytar, cachedConfig, userRepository) {
-        this.logger = logger;
-        this.instructionsURL = instructionsURL;
-        this.keytar = keytar;
-        this.cachedConfig = cachedConfig;
+    account;
+    credentialsFilePath;
+    currentPlatform;
+    commandRunner;
+    windowsUserSid;
+    constructor(userRepository, account, credentialsFilePath = getCredentialsFilePath(), currentPlatform = (0, os_1.platform)(), commandRunner = runCredentialStoreCommand) {
         this.userRepository = userRepository;
-        this.keytarAccount = (0, graphql_1.getEnvironmentConfig)(KeytarAccount);
+        this.account = account;
+        this.credentialsFilePath = credentialsFilePath;
+        this.currentPlatform = currentPlatform;
+        this.commandRunner = commandRunner;
+    }
+    async getWindowsUserSid() {
+        this.windowsUserSid ??= this.commandRunner('whoami.exe', ['/user', '/fo', 'csv', '/nh']).then((output) => {
+            const sid = output.trim().match(/"?(S-\d(?:-\d+)+)"?$/)?.[1];
+            if (!sid) {
+                throw new Error('Could not determine the current Windows user SID');
+            }
+            return sid;
+        });
+        return this.windowsUserSid;
     }
-    wrapKeytarError(e) {
-        const message = (0, shared_1.wrapError)(e).message;
-        let error;
-        const currentPlatform = (0, os_1.platform)();
-        switch (currentPlatform) {
-            case 'darwin':
-                error = ui_1.Text.error.keytarAccessError.mac(message);
-                break;
-            case 'linux':
-                error = ui_1.Text.error.keytarAccessError.linux(message);
-                break;
-            case 'win32':
-                error = ui_1.Text.error.keytarAccessError.windows(message);
-                break;
-            default:
-                error = ui_1.Text.error.keytarAccessError.other(message);
-        }
-        throw new KeytarAccessError(error);
+    async applyWindowsAcl(targetPath, directory) {
+        const userSid = await this.getWindowsUserSid();
+        const permission = directory ? '(OI)(CI)F' : 'F';
+        await this.commandRunner('icacls.exe', [
+            targetPath,
+            '/inheritance:r',
+            '/grant:r',
+            `*${userSid}:${permission}`,
+            `*${WINDOWS_SYSTEM_SID}:${permission}`,
+            `*${WINDOWS_ADMINISTRATORS_SID}:${permission}`
+        ]);
     }
-    decodeCredentials(credentialsString) {
-        if (!credentialsString) {
-            throw new NoTokenInStoreError();
-        }
-        let credentials;
+    async secureWindowsStorage(createFile) {
+        let fileExists = true;
         try {
-            credentials = JSON.parse(credentialsString);
+            await fs_1.promises.access(this.credentialsFilePath);
         }
-        catch {
-            throw new NoTokenInStoreError();
+        catch (error) {
+            if (!isFileNotFoundError(error)) {
+                throw error;
+            }
+            fileExists = false;
         }
-        const decodeResult = exports.personalApiCredentialsValidatedShape.decode(credentials);
-        if ((0, Either_1.isLeft)(decodeResult)) {
-            throw new NoTokenInStoreError();
+        if (!fileExists && !createFile) {
+            return;
         }
-        return decodeResult.right;
+        const credentialsDirectory = path_1.default.dirname(this.credentialsFilePath);
+        await fs_1.promises.mkdir(credentialsDirectory, { recursive: true });
+        await this.applyWindowsAcl(credentialsDirectory, true);
+        if (!fileExists) {
+            await fs_1.promises.writeFile(this.credentialsFilePath, '', { flag: 'wx' });
+        }
+        await this.applyWindowsAcl(this.credentialsFilePath, false);
     }
-    async getCredentialsKeytar(keytar) {
-        let stringifiedPersonalApiCredentials;
+    async securePosixStorage(createFile) {
+        let fileExists = true;
         try {
-            stringifiedPersonalApiCredentials = await keytar.getPassword(KEYTAR_SERVICE, this.keytarAccount);
+            await fs_1.promises.access(this.credentialsFilePath);
         }
-        catch (e) {
-            this.wrapKeytarError(e);
+        catch (error) {
+            if (!isFileNotFoundError(error)) {
+                throw error;
+            }
+            fileExists = false;
         }
-        if (!stringifiedPersonalApiCredentials) {
-            return undefined;
+        if (!fileExists && !createFile) {
+            return;
         }
-        return this.decodeCredentials(stringifiedPersonalApiCredentials);
-    }
-    popInsecurePlaintextCredentials() {
-        const result = this.cachedConfig.get(CACHE_CREDENTIALS_KEY);
-        if (result) {
-            this.logger.warn(ui_1.Text.warning.plaintextCredentialsFound(this.instructionsURL));
-            this.deleteInsecurePlaintextCredentials();
+        const credentialsDirectory = path_1.default.dirname(this.credentialsFilePath);
+        await fs_1.promises.mkdir(credentialsDirectory, {
+            recursive: true,
+            mode: CREDENTIALS_DIRECTORY_MODE
+        });
+        await fs_1.promises.chmod(credentialsDirectory, CREDENTIALS_DIRECTORY_MODE);
+        const directoryStat = await fs_1.promises.stat(credentialsDirectory);
+        const currentUserId = process.getuid?.();
+        if (currentUserId === undefined ||
+            !directoryStat.isDirectory() ||
+            directoryStat.uid !== currentUserId ||
+            (directoryStat.mode & PERMISSION_BITS_MASK) !== CREDENTIALS_DIRECTORY_MODE) {
+            throw new Error('The credentials directory is not owned exclusively by the current user');
+        }
+        if (!fileExists) {
+            const file = await fs_1.promises.open(this.credentialsFilePath, 'wx', CREDENTIALS_FILE_MODE);
+            await file.close();
+        }
+        await fs_1.promises.chmod(this.credentialsFilePath, CREDENTIALS_FILE_MODE);
+        const fileStat = await fs_1.promises.stat(this.credentialsFilePath);
+        if (!fileStat.isFile() ||
+            fileStat.uid !== currentUserId ||
+            (fileStat.mode & PERMISSION_BITS_MASK) !== CREDENTIALS_FILE_MODE) {
+            throw new Error('Could not restrict access to the credentials file');
         }
-        return result;
-    }
-    deleteInsecurePlaintextCredentials() {
-        this.cachedConfig.delete(CACHE_CREDENTIALS_KEY);
     }
-    async getCredentials() {
-        let result;
-        const plaintextCredentials = this.popInsecurePlaintextCredentials();
-        if (plaintextCredentials) {
-            if (this.keytar) {
-                await this.setCredentials(plaintextCredentials);
-                this.logger.warn(ui_1.Text.warning.plaintextCredentialsMigrated);
+    async secureStorage(createFile) {
+        try {
+            if (this.currentPlatform === 'win32') {
+                await this.secureWindowsStorage(createFile);
             }
             else {
-                this.logger.warn(ui_1.Text.warning.plaintextCredentialsNotMigrated);
+                await this.securePosixStorage(createFile);
+            }
+        }
+        catch {
+            await fs_1.promises.rm(this.credentialsFilePath, { force: true }).catch(() => undefined);
+            throw new CredentialStoreSecurityError();
+        }
+    }
+    async readCredentialsFile() {
+        let contents;
+        try {
+            await this.secureStorage(false);
+            contents = await fs_1.promises.readFile(this.credentialsFilePath, 'utf8');
+        }
+        catch (error) {
+            if (isFileNotFoundError(error)) {
+                return {};
             }
+            throw error;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(contents);
+        }
+        catch {
+            throw new NoTokenInStoreError();
+        }
+        const decodeResult = credentialsByAccountShape.decode(parsed);
+        if ((0, Either_1.isLeft)(decodeResult)) {
+            throw new NoTokenInStoreError();
         }
+        return decodeResult.right;
+    }
+    async getCredentials() {
         if (process.env[exports.API_TOKEN_KEY] && process.env[exports.EMAIL_KEY]) {
             const credentials = {
                 email: process.env[exports.EMAIL_KEY],
                 token: process.env[exports.API_TOKEN_KEY]
             };
             const { accountId } = await this.userRepository.getUser(credentials);
-            result = { ...credentials, accountId };
-        }
-        else if (this.keytar) {
-            result = await this.getCredentialsKeytar(this.keytar);
+            return { ...credentials, accountId };
         }
-        if (result) {
-            return result;
+        const credentials = (await this.readCredentialsFile())[this.account];
+        if (!credentials) {
+            throw new NoTokenInStoreError();
         }
-        throw new NoTokenInStoreError();
+        return credentials;
     }
     async setCredentials(credentials) {
-        if (this.keytar) {
-            try {
-                await this.keytar.setPassword(KEYTAR_SERVICE, this.keytarAccount, JSON.stringify(credentials));
-            }
-            catch (e) {
-                throw new NoKeytarError();
-            }
+        let credentialsByAccount;
+        try {
+            credentialsByAccount = await this.readCredentialsFile();
         }
-        else {
-            throw new NoKeytarError();
+        catch (error) {
+            if (!(error instanceof NoTokenInStoreError)) {
+                throw error;
+            }
+            credentialsByAccount = {};
         }
+        credentialsByAccount[this.account] = credentials;
+        await this.secureStorage(true);
+        await fs_1.promises.writeFile(this.credentialsFilePath, `${JSON.stringify(credentialsByAccount, null, 2)}\n`, 'utf8');
+        await this.secureStorage(false);
     }
     async deleteCredentials() {
-        if (this.keytar) {
+        const credentialsByAccount = await this.readCredentialsFile();
+        delete credentialsByAccount[this.account];
+        if (Object.keys(credentialsByAccount).length === 0) {
             try {
-                await this.keytar.deletePassword(KEYTAR_SERVICE, this.keytarAccount);
+                await fs_1.promises.unlink(this.credentialsFilePath);
             }
-            catch (e) {
+            catch (error) {
+                if (!isFileNotFoundError(error)) {
+                    throw error;
+                }
             }
+            return;
         }
-        this.deleteInsecurePlaintextCredentials();
+        await fs_1.promises.writeFile(this.credentialsFilePath, `${JSON.stringify(credentialsByAccount, null, 2)}\n`, 'utf8');
+        await this.secureStorage(false);
     }
 }
-exports.CredentialStoreImpl = CredentialStoreImpl;
-function getCredentialStore(logger, userRepository) {
-    const keytar = getKeytar();
-    const cachedConfig = cache_1.CachedConf.getCache(cache_1.CONFIG_PROJECT_NAME);
-    const instructionsUrl = (0, instruction_1.getInstructionsUrl)();
-    return new CredentialStoreImpl(logger, instructionsUrl, keytar, cachedConfig, userRepository);
+exports.FileCredentialStore = FileCredentialStore;
+function getCredentialStore(userRepository) {
+    return new FileCredentialStore(userRepository, (0, graphql_1.getEnvironmentConfig)(CredentialAccount));
 }

package/out/auth/personal/token-authenticator.js

@@ -19,7 +19,7 @@ class PersonalTokenAuthenticator {
         if (process.env[credential_store_1.API_TOKEN_KEY] && process.env[credential_store_1.EMAIL_KEY]) {
             return ui_1.Text.error.invalidTokenInEnv(instructionsUrl, credential_store_1.EMAIL_KEY, credential_store_1.API_TOKEN_KEY);
         }
-        return ui_1.Text.error.invalidTokenInKeytar;
+        return ui_1.Text.error.invalidTokenInCredentialFile;
     }
 }
 exports.PersonalTokenAuthenticator = PersonalTokenAuthenticator;