@forge/cli-shared 9.10.0-next.1 → 9.10.0-next.1-experimental-65945d2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @forge/cli-shared
 
+## 9.10.0-next.1-experimental-65945d2
+
+### Minor Changes
+
+- e865360: Bump @forge/util with latest aris and dependencies
+
+### Patch Changes
+
+- ffd952f: Add an experimental file-backed credential store with restricted macOS, Linux, and Windows permissions.
+- Updated dependencies [e865360]
+- Updated dependencies [5d8a857]
+  - @forge/util@3.1.0-next.0-experimental-65945d2
+  - @forge/manifest@13.8.1-next.0-experimental-65945d2
+
 ## 9.10.0-next.1
 
 ### Minor Changes

package/out/apps/get-app-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-app-owner.d.ts","sourceRoot":"","sources":["../../src/apps/get-app-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,qBAAa,oBAAqB,SAAQ,KAAK;;CAI9C;AAED,eAAO,MAAM,aAAa;QAuC+sx2G,8CAAc;GA9Brvx2G,CAAC;AAEH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,iBAAiB;IAGrC,OAAO;;;;;;;;;;;;;YAMN,WAAW;CAe1B"}
+{"version":3,"file":"get-app-owner.d.ts","sourceRoot":"","sources":["../../src/apps/get-app-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,qBAAa,oBAAqB,SAAQ,KAAK;;CAI9C;AAED,eAAO,MAAM,aAAa;QAuC83n3G,8CAAc;GA9Bp6n3G,CAAC;AAEH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,iBAAiB;IAGrC,OAAO;;;;;;;;;;;;;YAMN,WAAW;CAe1B"}

package/out/auth/personal/credential-store.d.ts

@@ -5,6 +5,7 @@ import { Logger } from '../../ui';
 import { UserRepository } from './user-repository';
 export declare const EMAIL_KEY = "FORGE_EMAIL";
 export declare const API_TOKEN_KEY = "FORGE_API_TOKEN";
+export declare const FILE_CREDENTIAL_STORE_FLAG = "FORGE_CLI_ENABLE_FILE_CREDENTIAL_STORE";
 export interface Keytar {
     getPassword(service: string, account: string): Promise<string | null>;
     setPassword(service: string, account: string, password: string): Promise<void>;
@@ -29,6 +30,9 @@ export declare class NoKeytarError extends UserError {
 }
 export declare class KeytarAccessError extends UserError {
 }
+export declare class CredentialStoreSecurityError extends UserError {
+    constructor();
+}
 export interface CredentialGetter {
     getCredentials(): Promise<PersonalApiCredentialsValidated>;
 }
@@ -36,6 +40,26 @@ export interface CredentialStore extends CredentialGetter {
     setCredentials(credentials: PersonalApiCredentialsValidated): Promise<void>;
     deleteCredentials(): Promise<void>;
 }
+export type CredentialStoreCommandRunner = (command: string, args: readonly string[]) => Promise<string>;
+export declare function getCredentialsFilePath(currentPlatform?: NodeJS.Platform, environment?: NodeJS.ProcessEnv, userHome?: string): string;
+export declare class FileCredentialStore implements CredentialStore {
+    private readonly userRepository;
+    private readonly account;
+    private readonly credentialsFilePath;
+    private readonly currentPlatform;
+    private readonly commandRunner;
+    private windowsUserSid;
+    constructor(userRepository: UserRepository, account: string, credentialsFilePath?: string, currentPlatform?: NodeJS.Platform, commandRunner?: CredentialStoreCommandRunner);
+    private getWindowsUserSid;
+    private applyWindowsAcl;
+    private secureWindowsStorage;
+    private securePosixStorage;
+    private secureStorage;
+    private readCredentialsFile;
+    getCredentials(): Promise<PersonalApiCredentialsValidated>;
+    setCredentials(credentials: PersonalApiCredentialsValidated): Promise<void>;
+    deleteCredentials(): Promise<void>;
+}
 export declare class CredentialStoreImpl implements CredentialStore {
     private readonly logger;
     private readonly instructionsURL;

package/out/auth/personal/credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/auth/personal/credential-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,CAAC,MAAM,OAAO,CAAC;AAC3B,OAAO,EAAuB,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,SAAS,EAAa,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,MAAM,EAAQ,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,eAAO,MAAM,SAAS,gBAAgB,CAAC;AACvC,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAa/C,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/E,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAUD,eAAO,MAAM,2BAA2B;;;EAGtC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;;EAI/C,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAClF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAEpG,qBAAa,mBAAoB,SAAQ,SAAS;;CAIjD;AAED,qBAAa,aAAc,SAAQ,SAAS;;CAI3C;AAED,qBAAa,iBAAkB,SAAQ,SAAS;CAAG;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAIvD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,aAAa,CAAS;gBAGX,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,YAAY,EAAE,UAAU,EACxB,cAAc,EAAE,cAAc;IAKjD,OAAO,CAAC,eAAe;IAoBvB,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,+BAA+B;IAoB9E,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC;IAehG,+BAA+B,IAAI,+BAA+B,GAAG,SAAS;IAS9E,kCAAkC,IAAI,IAAI;IAIpC,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC;IAgC1D,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAWzC;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,GAAG,eAAe,CAKlG"}
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/auth/personal/credential-store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,CAAC,MAAM,OAAO,CAAC;AAC3B,OAAO,EAAuB,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,SAAS,EAAa,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,MAAM,EAAQ,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,eAAO,MAAM,SAAS,gBAAgB,CAAC;AACvC,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,0BAA0B,2CAA2C,CAAC;AAqBnF,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/E,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAUD,eAAO,MAAM,2BAA2B;;;EAGtC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;;EAI/C,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAClF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAEpG,qBAAa,mBAAoB,SAAQ,SAAS;;CAIjD;AAED,qBAAa,aAAc,SAAQ,SAAS;;CAI3C;AAED,qBAAa,iBAAkB,SAAQ,SAAS;CAAG;AAEnD,qBAAa,4BAA6B,SAAQ,SAAS;;CAI1D;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAID,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAezG,wBAAgB,sBAAsB,CACpC,eAAe,kBAAa,EAC5B,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,QAAQ,SAAY,GACnB,MAAM,CA4BR;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAIvD,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO,CAAC,cAAc,CAA8B;gBAGjC,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,MAAM,EACf,mBAAmB,SAA2B,EAC9C,eAAe,kBAAa,EAC5B,aAAa,GAAE,4BAAwD;YAG5E,iBAAiB;YAWjB,eAAe;YAaf,oBAAoB;YA0BpB,kBAAkB;YAmDlB,aAAa;YAab,mBAAmB;IA4B3B,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC;IAkB1D,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBzC;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAIvD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,aAAa,CAAS;gBAGX,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,YAAY,EAAE,UAAU,EACxB,cAAc,EAAE,cAAc;IAKjD,OAAO,CAAC,eAAe;IAoBvB,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,+BAA+B;IAoB9E,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC;IAehG,+BAA+B,IAAI,+BAA+B,GAAG,SAAS;IAS9E,kCAAkC,IAAI,IAAI;IAIpC,cAAc,IAAI,OAAO,CAAC,+BAA+B,CAAC;IAgC1D,cAAc,CAAC,WAAW,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3E,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;CAWzC;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,GAAG,eAAe,CAUlG"}

package/out/auth/personal/credential-store.js

@@ -1,9 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CredentialStoreImpl = exports.KeytarAccessError = exports.NoKeytarError = exports.NoTokenInStoreError = exports.personalApiCredentialsValidatedShape = exports.personalApiCredentialsShape = exports.API_TOKEN_KEY = exports.EMAIL_KEY = void 0;
+exports.CredentialStoreImpl = exports.FileCredentialStore = exports.CredentialStoreSecurityError = exports.KeytarAccessError = exports.NoKeytarError = exports.NoTokenInStoreError = exports.personalApiCredentialsValidatedShape = exports.personalApiCredentialsShape = exports.FILE_CREDENTIAL_STORE_FLAG = exports.API_TOKEN_KEY = exports.EMAIL_KEY = void 0;
+exports.getCredentialsFilePath = getCredentialsFilePath;
 exports.getCredentialStore = getCredentialStore;
 const tslib_1 = require("tslib");
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
 const os_1 = require("os");
+const path_1 = tslib_1.__importDefault(require("path"));
+const util_1 = require("util");
 const Either_1 = require("fp-ts/lib/Either");
 const t = tslib_1.__importStar(require("io-ts"));
 const cache_1 = require("../../cache");
@@ -13,8 +18,17 @@ const shared_1 = require("../../shared");
 const ui_1 = require("../../ui");
 exports.EMAIL_KEY = 'FORGE_EMAIL';
 exports.API_TOKEN_KEY = 'FORGE_API_TOKEN';
+exports.FILE_CREDENTIAL_STORE_FLAG = 'FORGE_CLI_ENABLE_FILE_CREDENTIAL_STORE';
 const KEYTAR_SERVICE = 'Atlassian';
 const CACHE_CREDENTIALS_KEY = 'forge-credentials';
+const CREDENTIALS_FILE_NAME = 'credentials.json';
+const CONFIG_DIRECTORY_SUFFIX = 'nodejs';
+const CREDENTIALS_DIRECTORY_MODE = 0o700;
+const CREDENTIALS_FILE_MODE = 0o600;
+const PERMISSION_BITS_MASK = 0o777;
+const GROUP_OR_OTHER_WRITE_BITS_MASK = 0o022;
+const WINDOWS_SYSTEM_SID = 'S-1-5-18';
+const WINDOWS_ADMINISTRATORS_SID = 'S-1-5-32-544';
 var KeytarAccount;
 (function (KeytarAccount) {
     KeytarAccount["DEV"] = "Ecosystem-staging";
@@ -55,6 +69,225 @@ exports.NoKeytarError = NoKeytarError;
 class KeytarAccessError extends shared_1.UserError {
 }
 exports.KeytarAccessError = KeytarAccessError;
+class CredentialStoreSecurityError extends shared_1.UserError {
+    constructor() {
+        super(ui_1.Text.error.credentialsFilePermissions);
+    }
+}
+exports.CredentialStoreSecurityError = CredentialStoreSecurityError;
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+const runCredentialStoreCommand = async (command, args) => {
+    const { stdout } = await execFileAsync(command, [...args], { encoding: 'utf8', windowsHide: true });
+    return stdout;
+};
+const credentialsByAccountShape = t.record(t.string, exports.personalApiCredentialsValidatedShape);
+function isFileNotFoundError(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';
+}
+function getCredentialsFilePath(currentPlatform = (0, os_1.platform)(), environment = process.env, userHome = (0, os_1.homedir)()) {
+    const platformPath = currentPlatform === 'win32' ? path_1.default.win32 : path_1.default.posix;
+    let credentialsDirectory;
+    switch (currentPlatform) {
+        case 'darwin':
+            credentialsDirectory = platformPath.join(userHome, 'Library', 'Preferences', `${cache_1.CONFIG_PROJECT_NAME}-${CONFIG_DIRECTORY_SUFFIX}`);
+            break;
+        case 'win32':
+            credentialsDirectory = platformPath.join(environment.LOCALAPPDATA || platformPath.join(userHome, 'AppData', 'Local'), 'Atlassian', 'Forge');
+            break;
+        default:
+            credentialsDirectory = platformPath.join(environment.XDG_CONFIG_HOME || platformPath.join(userHome, '.config'), `${cache_1.CONFIG_PROJECT_NAME}-${CONFIG_DIRECTORY_SUFFIX}`);
+    }
+    return platformPath.join(credentialsDirectory, CREDENTIALS_FILE_NAME);
+}
+class FileCredentialStore {
+    userRepository;
+    account;
+    credentialsFilePath;
+    currentPlatform;
+    commandRunner;
+    windowsUserSid;
+    constructor(userRepository, account, credentialsFilePath = getCredentialsFilePath(), currentPlatform = (0, os_1.platform)(), commandRunner = runCredentialStoreCommand) {
+        this.userRepository = userRepository;
+        this.account = account;
+        this.credentialsFilePath = credentialsFilePath;
+        this.currentPlatform = currentPlatform;
+        this.commandRunner = commandRunner;
+    }
+    async getWindowsUserSid() {
+        this.windowsUserSid ??= this.commandRunner('whoami.exe', ['/user', '/fo', 'csv', '/nh']).then((output) => {
+            const sid = output.trim().match(/"?(S-\d(?:-\d+)+)"?$/)?.[1];
+            if (!sid) {
+                throw new Error('Could not determine the current Windows user SID');
+            }
+            return sid;
+        });
+        return this.windowsUserSid;
+    }
+    async applyWindowsAcl(targetPath, directory) {
+        const userSid = await this.getWindowsUserSid();
+        const permission = directory ? '(OI)(CI)F' : 'F';
+        await this.commandRunner('icacls.exe', [
+            targetPath,
+            '/inheritance:r',
+            '/grant:r',
+            `*${userSid}:${permission}`,
+            `*${WINDOWS_SYSTEM_SID}:${permission}`,
+            `*${WINDOWS_ADMINISTRATORS_SID}:${permission}`
+        ]);
+    }
+    async secureWindowsStorage(createFile) {
+        let fileExists = true;
+        try {
+            await fs_1.promises.access(this.credentialsFilePath);
+        }
+        catch (error) {
+            if (!isFileNotFoundError(error)) {
+                throw error;
+            }
+            fileExists = false;
+        }
+        if (!fileExists && !createFile) {
+            return;
+        }
+        const credentialsDirectory = path_1.default.dirname(this.credentialsFilePath);
+        await fs_1.promises.mkdir(credentialsDirectory, { recursive: true });
+        await this.applyWindowsAcl(credentialsDirectory, true);
+        if (!fileExists) {
+            await fs_1.promises.writeFile(this.credentialsFilePath, '', { flag: 'wx' });
+        }
+        await this.applyWindowsAcl(this.credentialsFilePath, false);
+    }
+    async securePosixStorage(createFile) {
+        let fileExists = true;
+        try {
+            await fs_1.promises.access(this.credentialsFilePath);
+        }
+        catch (error) {
+            if (!isFileNotFoundError(error)) {
+                throw error;
+            }
+            fileExists = false;
+        }
+        if (!fileExists && !createFile) {
+            return;
+        }
+        const credentialsDirectory = path_1.default.dirname(this.credentialsFilePath);
+        const createdDirectory = await fs_1.promises.mkdir(credentialsDirectory, {
+            recursive: true,
+            mode: CREDENTIALS_DIRECTORY_MODE
+        });
+        if (createdDirectory !== undefined) {
+            await fs_1.promises.chmod(credentialsDirectory, CREDENTIALS_DIRECTORY_MODE);
+        }
+        const directoryStat = await fs_1.promises.stat(credentialsDirectory);
+        const currentUserId = process.getuid?.();
+        if (currentUserId === undefined ||
+            !directoryStat.isDirectory() ||
+            directoryStat.uid !== currentUserId ||
+            (directoryStat.mode & GROUP_OR_OTHER_WRITE_BITS_MASK) !== 0) {
+            throw new Error('The credentials directory is not owned exclusively by the current user');
+        }
+        if (!fileExists) {
+            const file = await fs_1.promises.open(this.credentialsFilePath, 'wx', CREDENTIALS_FILE_MODE);
+            await file.close();
+        }
+        await fs_1.promises.chmod(this.credentialsFilePath, CREDENTIALS_FILE_MODE);
+        const fileStat = await fs_1.promises.stat(this.credentialsFilePath);
+        if (!fileStat.isFile() ||
+            fileStat.uid !== currentUserId ||
+            (fileStat.mode & PERMISSION_BITS_MASK) !== CREDENTIALS_FILE_MODE) {
+            throw new Error('Could not restrict access to the credentials file');
+        }
+    }
+    async secureStorage(createFile) {
+        try {
+            if (this.currentPlatform === 'win32') {
+                await this.secureWindowsStorage(createFile);
+            }
+            else {
+                await this.securePosixStorage(createFile);
+            }
+        }
+        catch {
+            await fs_1.promises.rm(this.credentialsFilePath, { force: true }).catch(() => undefined);
+            throw new CredentialStoreSecurityError();
+        }
+    }
+    async readCredentialsFile() {
+        let contents;
+        try {
+            await this.secureStorage(false);
+            contents = await fs_1.promises.readFile(this.credentialsFilePath, 'utf8');
+        }
+        catch (error) {
+            if (isFileNotFoundError(error)) {
+                return {};
+            }
+            throw error;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(contents);
+        }
+        catch {
+            throw new NoTokenInStoreError();
+        }
+        const decodeResult = credentialsByAccountShape.decode(parsed);
+        if ((0, Either_1.isLeft)(decodeResult)) {
+            throw new NoTokenInStoreError();
+        }
+        return decodeResult.right;
+    }
+    async getCredentials() {
+        if (process.env[exports.API_TOKEN_KEY] && process.env[exports.EMAIL_KEY]) {
+            const credentials = {
+                email: process.env[exports.EMAIL_KEY],
+                token: process.env[exports.API_TOKEN_KEY]
+            };
+            const { accountId } = await this.userRepository.getUser(credentials);
+            return { ...credentials, accountId };
+        }
+        const credentials = (await this.readCredentialsFile())[this.account];
+        if (!credentials) {
+            throw new NoTokenInStoreError();
+        }
+        return credentials;
+    }
+    async setCredentials(credentials) {
+        let credentialsByAccount;
+        try {
+            credentialsByAccount = await this.readCredentialsFile();
+        }
+        catch (error) {
+            if (!(error instanceof NoTokenInStoreError)) {
+                throw error;
+            }
+            credentialsByAccount = {};
+        }
+        credentialsByAccount[this.account] = credentials;
+        await this.secureStorage(true);
+        await fs_1.promises.writeFile(this.credentialsFilePath, `${JSON.stringify(credentialsByAccount, null, 2)}\n`, 'utf8');
+        await this.secureStorage(false);
+    }
+    async deleteCredentials() {
+        const credentialsByAccount = await this.readCredentialsFile();
+        delete credentialsByAccount[this.account];
+        if (Object.keys(credentialsByAccount).length === 0) {
+            try {
+                await fs_1.promises.unlink(this.credentialsFilePath);
+            }
+            catch (error) {
+                if (!isFileNotFoundError(error)) {
+                    throw error;
+                }
+            }
+            return;
+        }
+        await fs_1.promises.writeFile(this.credentialsFilePath, `${JSON.stringify(credentialsByAccount, null, 2)}\n`, 'utf8');
+        await this.secureStorage(false);
+    }
+}
+exports.FileCredentialStore = FileCredentialStore;
 class CredentialStoreImpl {
     logger;
     instructionsURL;
@@ -184,6 +417,10 @@ class CredentialStoreImpl {
 }
 exports.CredentialStoreImpl = CredentialStoreImpl;
 function getCredentialStore(logger, userRepository) {
+    const credentialAccount = (0, graphql_1.getEnvironmentConfig)(KeytarAccount);
+    if (process.env[exports.FILE_CREDENTIAL_STORE_FLAG] === 'true') {
+        return new FileCredentialStore(userRepository, credentialAccount);
+    }
     const keytar = getKeytar();
     const cachedConfig = cache_1.CachedConf.getCache(cache_1.CONFIG_PROJECT_NAME);
     const instructionsUrl = (0, instruction_1.getInstructionsUrl)();