@raidiant/notifai 1.0.1 → 2.0.0

package/src/credentials.test.ts

@@ -0,0 +1,291 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+import {
+  FileStore,
+  WindowsDpapiStore,
+  defaultCredentialStore,
+  windowsDpapiOperation,
+  type MachineCredential,
+  type ProcessRunner,
+  type RunCommandSpec,
+} from './credentials.js'
+
+const tmp = mkdtempSync(path.join(os.tmpdir(), 'notifai-cred-'))
+afterAll(() => rmSync(tmp, { recursive: true, force: true }))
+
+const SAMPLE: MachineCredential = {
+  machineId: 'mach_fixture',
+  secret: 'fixture-secret',
+  baseUrl: 'https://example.test',
+  machineName: 'fixture-machine',
+}
+
+const OTHER: MachineCredential = {
+  machineId: 'mach_other',
+  secret: 'other-secret',
+  baseUrl: 'https://other.test',
+  machineName: 'other-machine',
+}
+
+function sandbox(name: string): {
+  env: NodeJS.ProcessEnv
+  local: string
+  roaming: string
+  config: string
+} {
+  const root = path.join(tmp, name)
+  const local = path.join(root, 'local')
+  const roaming = path.join(root, 'roaming')
+  const config = path.join(root, 'config')
+  mkdirSync(local, { recursive: true })
+  mkdirSync(roaming, { recursive: true })
+  mkdirSync(config, { recursive: true })
+  return {
+    local,
+    roaming,
+    config,
+    env: {
+      LOCALAPPDATA: local,
+      APPDATA: roaming,
+      XDG_CONFIG_HOME: config,
+      SystemRoot: 'C:\\Windows',
+    },
+  }
+}
+
+function writeRaw(file: string, contents: string): void {
+  mkdirSync(path.dirname(file), { recursive: true })
+  writeFileSync(file, contents)
+}
+
+function mockDpapi(options: { failProtect?: boolean; failUnprotect?: boolean } = {}): {
+  runner: ProcessRunner
+  calls: RunCommandSpec[]
+} {
+  const vault = new Map<string, string>()
+  const calls: RunCommandSpec[] = []
+  const runner: ProcessRunner = {
+    run(spec) {
+      calls.push({
+        command: spec.command,
+        args: spec.args,
+        input: spec.input,
+        ...(spec.timeoutMs === undefined ? {} : { timeoutMs: spec.timeoutMs }),
+      })
+      const operation = windowsDpapiOperation(spec.args)
+      if (operation === 'protect') {
+        if (options.failProtect) return { status: 1, stdout: Buffer.alloc(0) }
+        const token = Buffer.from(`dpapi:${vault.size}`, 'utf8').toString('base64')
+        vault.set(token, spec.input.toString('utf8'))
+        return { status: 0, stdout: Buffer.from(token, 'utf8') }
+      }
+      if (operation === 'unprotect') {
+        if (options.failUnprotect) return { status: 1, stdout: Buffer.alloc(0) }
+        const token = spec.input.toString('utf8').trim()
+        const plain = vault.get(token)
+        if (plain === undefined) return { status: 1, stdout: Buffer.alloc(0) }
+        return { status: 0, stdout: Buffer.from(plain, 'utf8') }
+      }
+      return { status: 1, stdout: Buffer.alloc(0) }
+    },
+  }
+  return { runner, calls }
+}
+
+function assertNoSecretInArgs(calls: RunCommandSpec[]): void {
+  for (const call of calls) {
+    const argv = [call.command, ...call.args].join('\0')
+    expect(argv).not.toContain(SAMPLE.secret)
+    expect(argv).not.toContain(OTHER.secret)
+    expect(argv).not.toContain(SAMPLE.machineId)
+    expect(argv).not.toContain('machineId')
+  }
+}
+
+describe('defaultCredentialStore', () => {
+  it('selects the DPAPI store on win32', () => {
+    const { env } = sandbox('default-win32')
+    const store = defaultCredentialStore(env, { platform: 'win32', run: mockDpapi().runner })
+    expect(store).toBeInstanceOf(WindowsDpapiStore)
+    expect(store.describe()).toMatch(/Windows DPAPI current-user/)
+    expect(store.describe()).toContain(path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi'))
+  })
+
+  it('keeps the explicit file escape hatch on win32 under APPDATA', () => {
+    const { env } = sandbox('default-file-win32')
+    const store = defaultCredentialStore(
+      { ...env, NOTIFAI_CREDENTIALS: 'file', XDG_CONFIG_HOME: undefined },
+      { platform: 'win32' },
+    )
+    expect(store).toBeInstanceOf(FileStore)
+    expect(store.describe()).toContain(path.join(env.APPDATA!, 'notifai', 'credentials.json'))
+    expect(store.describe()).toMatch(/plaintext file/)
+    expect(store.describe()).toMatch(/POSIX mode bits are not protection on NTFS/)
+    expect(store.describe()).not.toMatch(/0600/)
+  })
+
+  it('preserves macOS Keychain when available', () => {
+    const store = defaultCredentialStore({}, { platform: 'darwin', keychainAvailable: true })
+    expect(store.describe()).toBe('macOS Keychain (io.notifai.cli)')
+  })
+
+  it('falls back to the 0600 file store on linux', () => {
+    const { env } = sandbox('default-linux')
+    const store = defaultCredentialStore(env, { platform: 'linux' })
+    expect(store).toBeInstanceOf(FileStore)
+    expect(store.describe()).toMatch(/plaintext file/)
+    expect(store.describe()).toMatch(/mode 0600/)
+    expect(store.describe()).not.toMatch(/NTFS/)
+  })
+
+  it('uses the file store on macOS when Keychain is unavailable', () => {
+    const { env } = sandbox('default-darwin-file')
+    const store = defaultCredentialStore(env, { platform: 'darwin', keychainAvailable: false })
+    expect(store).toBeInstanceOf(FileStore)
+    expect(store.describe()).toMatch(/mode 0600/)
+  })
+})
+
+describe('FileStore', () => {
+  it('saves, loads, overwrites, and clears atomically', () => {
+    const { env } = sandbox('file-roundtrip')
+    const store = new FileStore(env, { platform: 'linux' })
+    expect(store.load()).toBeNull()
+    store.save(SAMPLE)
+    const file = path.join(env.XDG_CONFIG_HOME!, 'notifai', 'credentials.json')
+    expect(existsSync(file)).toBe(true)
+    if (process.platform !== 'win32') {
+      expect(statSync(file).mode & 0o777).toBe(0o600)
+    }
+    expect(JSON.parse(readFileSync(file, 'utf8'))).toEqual(SAMPLE)
+    expect(store.load()).toEqual(SAMPLE)
+    store.save(OTHER)
+    expect(store.load()).toEqual(OTHER)
+    store.clear()
+    expect(existsSync(file)).toBe(false)
+    expect(store.load()).toBeNull()
+  })
+
+  it('treats malformed JSON as missing', () => {
+    const { env } = sandbox('file-malformed')
+    const file = path.join(env.XDG_CONFIG_HOME!, 'notifai', 'credentials.json')
+    writeRaw(file, '{not-json')
+    expect(new FileStore(env).load()).toBeNull()
+  })
+
+  it('treats incomplete objects as missing', () => {
+    const { env } = sandbox('file-incomplete')
+    const file = path.join(env.XDG_CONFIG_HOME!, 'notifai', 'credentials.json')
+    writeRaw(file, `${JSON.stringify({ machineId: 'mach_fixture' })}\n`)
+    expect(new FileStore(env).load()).toBeNull()
+  })
+})
+
+describe('WindowsDpapiStore', () => {
+  it('protects under LOCALAPPDATA and never writes roaming or config trees', () => {
+    const { env, roaming, config } = sandbox('dpapi-location')
+    const { runner, calls } = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: runner })
+    store.save(SAMPLE)
+    const file = path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi')
+    expect(existsSync(file)).toBe(true)
+    const onDisk = readFileSync(file, 'utf8')
+    expect(onDisk).not.toContain(SAMPLE.secret)
+    expect(onDisk).not.toContain(SAMPLE.machineId)
+    expect(JSON.parse(onDisk)).toMatchObject({ format: 'notifai.dpapi.current-user.v1' })
+    expect(readdirSync(roaming, { recursive: true })).toEqual([])
+    expect(existsSync(config) ? readdirSync(config, { recursive: true }) : []).toEqual([])
+    expect(store.load()).toEqual(SAMPLE)
+    expect(store.describe()).toBe(`Windows DPAPI current-user (${file})`)
+    expect(calls[0]?.command).toMatch(/powershell\.exe$/i)
+    expect(calls[0]?.args).toEqual(
+      expect.arrayContaining(['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass']),
+    )
+    assertNoSecretInArgs(calls)
+  })
+
+  it('overwrites and clears the protected blob', () => {
+    const { env } = sandbox('dpapi-overwrite')
+    const { runner, calls } = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: runner })
+    store.save(SAMPLE)
+    store.save(OTHER)
+    expect(store.load()).toEqual(OTHER)
+    store.clear()
+    expect(store.load()).toBeNull()
+    expect(
+      existsSync(path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi')),
+    ).toBe(false)
+    assertNoSecretInArgs(calls)
+  })
+
+  it('returns null for missing, malformed, and corrupt envelopes', () => {
+    const { env } = sandbox('dpapi-corrupt')
+    const { runner } = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: runner })
+    expect(store.load()).toBeNull()
+    const file = path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi')
+    writeRaw(file, 'not-json')
+    expect(store.load()).toBeNull()
+    writeRaw(file, `${JSON.stringify({ format: 'unknown', data: 'AAAA' })}\n`)
+    expect(store.load()).toBeNull()
+    writeRaw(
+      file,
+      `${JSON.stringify({ format: 'notifai.dpapi.current-user.v1', data: '@@@' })}\n`,
+    )
+    expect(store.load()).toBeNull()
+  })
+
+  it('leaves the existing blob in place when protection fails', () => {
+    const { env } = sandbox('dpapi-protect-fail')
+    const good = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: good.runner })
+    store.save(SAMPLE)
+    const failing = mockDpapi({ failProtect: true })
+    const broken = new WindowsDpapiStore(env, { run: failing.runner })
+    expect(() => broken.save(OTHER)).toThrow(/Windows credential protection failed/)
+    expect(store.load()).toEqual(SAMPLE)
+    const onDisk = readFileSync(path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi'), 'utf8')
+    expect(onDisk).not.toContain(OTHER.secret)
+    assertNoSecretInArgs([...good.calls, ...failing.calls])
+  })
+
+  it('returns null when unprotect fails', () => {
+    const { env } = sandbox('dpapi-unprotect-fail')
+    const saved = mockDpapi()
+    new WindowsDpapiStore(env, { run: saved.runner }).save(SAMPLE)
+    const failing = mockDpapi({ failUnprotect: true })
+    expect(new WindowsDpapiStore(env, { run: failing.runner }).load()).toBeNull()
+    assertNoSecretInArgs([...saved.calls, ...failing.calls])
+  })
+
+  it('refuses to save when LOCALAPPDATA is missing', () => {
+    const store = new WindowsDpapiStore({}, { run: mockDpapi().runner })
+    expect(store.load()).toBeNull()
+    expect(() => store.save(SAMPLE)).toThrow(/LOCALAPPDATA is missing/)
+    expect(store.describe()).toBe('Windows DPAPI current-user (LOCALAPPDATA unset)')
+    store.clear()
+  })
+
+  it('does not invoke a process for a missing or corrupt file', () => {
+    const { env } = sandbox('dpapi-no-process')
+    const { runner, calls } = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: runner })
+    expect(store.load()).toBeNull()
+    const file = path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi')
+    writeRaw(file, 'corrupt')
+    expect(store.load()).toBeNull()
+    expect(calls).toEqual([])
+  })
+})

package/src/credentials.ts

@@ -1,6 +1,7 @@
-import { execFileSync } from 'node:child_process'
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { execFileSync, spawnSync } from 'node:child_process'
+import { existsSync, readFileSync, rmSync } from 'node:fs'
 import path from 'node:path'
+import { atomicWriteFileSync } from './atomic-file.js'
 import { globalConfigDir } from './config.js'
 
 export interface MachineCredential {
@@ -18,7 +19,94 @@ export interface CredentialStore {
   describe(): string
 }
 
+export interface RunCommandSpec {
+  command: string
+  args: readonly string[]
+  input: Buffer
+  timeoutMs?: number
+}
+
+export interface RunCommandResult {
+  status: number
+  stdout: Buffer
+}
+
+/** Injected process seam. Production uses `defaultProcessRunner`. */
+export interface ProcessRunner {
+  run(spec: RunCommandSpec): RunCommandResult
+}
+
+export interface CredentialStoreOptions {
+  env?: NodeJS.ProcessEnv
+  platform?: NodeJS.Platform
+  run?: ProcessRunner
+  keychainAvailable?: boolean
+}
+
 const SERVICE = 'io.notifai.cli'
+const DPAPI_FORMAT = 'notifai.dpapi.current-user.v1'
+const DPAPI_ENTROPY = 'io.notifai.cli'
+const DPAPI_TIMEOUT_MS = 15_000
+const DPAPI_FILE = 'credentials.dpapi'
+
+const PROTECT_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  'Add-Type -AssemblyName System.Security',
+  '$in = New-Object System.IO.MemoryStream',
+  '[Console]::OpenStandardInput().CopyTo($in)',
+  `$entropy = [System.Text.Encoding]::UTF8.GetBytes('${DPAPI_ENTROPY}')`,
+  '$protected = [System.Security.Cryptography.ProtectedData]::Protect($in.ToArray(), $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
+  '$bytes = [System.Text.Encoding]::ASCII.GetBytes([Convert]::ToBase64String($protected))',
+  '[Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length)',
+].join('; ')
+
+const UNPROTECT_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  'Add-Type -AssemblyName System.Security',
+  '$b64 = [System.Text.Encoding]::ASCII.GetString((& { $in = New-Object System.IO.MemoryStream; [Console]::OpenStandardInput().CopyTo($in); $in.ToArray() })).Trim()',
+  '$protected = [Convert]::FromBase64String($b64)',
+  `$entropy = [System.Text.Encoding]::UTF8.GetBytes('${DPAPI_ENTROPY}')`,
+  '$plain = [System.Security.Cryptography.ProtectedData]::Unprotect($protected, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
+  '[Console]::OpenStandardOutput().Write($plain, 0, $plain.Length)',
+].join('; ')
+
+const PROTECT_ENCODED = encodePowerShell(PROTECT_SCRIPT)
+const UNPROTECT_ENCODED = encodePowerShell(UNPROTECT_SCRIPT)
+
+function encodePowerShell(script: string): string {
+  return Buffer.from(script, 'utf16le').toString('base64')
+}
+
+function powerShellInvocation(encoded: string, env: NodeJS.ProcessEnv): { command: string; args: string[] } {
+  const root = env['SystemRoot'] || env['SYSTEMROOT'] || 'C:\\Windows'
+  return {
+    command: path.win32.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
+    args: ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-EncodedCommand', encoded],
+  }
+}
+
+/** Which DPAPI operation a process invocation asked for. Args never carry secrets. */
+export function windowsDpapiOperation(args: readonly string[]): 'protect' | 'unprotect' | null {
+  const index = args.indexOf('-EncodedCommand')
+  const encoded = index >= 0 ? args[index + 1] : undefined
+  if (encoded === PROTECT_ENCODED) return 'protect'
+  if (encoded === UNPROTECT_ENCODED) return 'unprotect'
+  return null
+}
+
+export const defaultProcessRunner: ProcessRunner = {
+  run(spec) {
+    const result = spawnSync(spec.command, [...spec.args], {
+      input: spec.input,
+      timeout: spec.timeoutMs ?? DPAPI_TIMEOUT_MS,
+      maxBuffer: 1024 * 1024,
+      windowsHide: true,
+    })
+    const stdout = Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.alloc(0)
+    if (result.error) return { status: 1, stdout: Buffer.alloc(0) }
+    return { status: result.status ?? 1, stdout }
+  },
+}
 
 /** macOS Keychain via the `security` CLI — no native addons (proposal concern). */
 export class KeychainStore implements CredentialStore {
@@ -31,7 +119,7 @@ export class KeychainStore implements CredentialStore {
       )
         .toString()
         .trim()
-      return JSON.parse(raw) as MachineCredential
+      return parseCredentialJson(raw)
     } catch {
       return null
     }
@@ -69,29 +157,43 @@ export class KeychainStore implements CredentialStore {
   }
 }
 
-/** 0600 file fallback for hosts without a keychain. */
+/**
+ * Explicit plaintext file store.
+ *
+ * Default on Linux, where mode 0600 is a real ACL. Also the
+ * `NOTIFAI_CREDENTIALS=file` development and test escape hatch on every
+ * platform. POSIX mode bits are not an NTFS ACL, so this is not a protected
+ * Windows store.
+ */
 export class FileStore implements CredentialStore {
-  constructor(private readonly env: NodeJS.ProcessEnv = process.env) {}
+  private readonly env: NodeJS.ProcessEnv
+  private readonly platform: NodeJS.Platform
+
+  constructor(env: NodeJS.ProcessEnv = process.env, options: CredentialStoreOptions = {}) {
+    this.env = env
+    this.platform = options.platform ?? process.platform
+  }
 
   private filePath(): string {
-    return path.join(globalConfigDir(this.env), 'credentials.json')
+    return path.join(globalConfigDir(this.env, this.platform), 'credentials.json')
   }
 
   load(): MachineCredential | null {
     const file = this.filePath()
     if (!existsSync(file)) return null
     try {
-      return JSON.parse(readFileSync(file, 'utf8')) as MachineCredential
+      return parseCredentialJson(readFileSync(file, 'utf8'))
     } catch {
       return null
     }
   }
 
   save(credential: MachineCredential): void {
-    const file = this.filePath()
-    mkdirSync(path.dirname(file), { recursive: true })
-    writeFileSync(file, `${JSON.stringify(credential, null, 2)}\n`, { mode: 0o600 })
-    chmodSync(file, 0o600)
+    atomicWriteFileSync(this.filePath(), `${JSON.stringify(credential, null, 2)}\n`, {
+      mode: 0o600,
+      preserveMode: false,
+      requireCurrentUserOwner: true,
+    })
   }
 
   clear(): void {
@@ -99,12 +201,157 @@ export class FileStore implements CredentialStore {
   }
 
   describe(): string {
-    return this.filePath()
+    const file = this.filePath()
+    if (this.platform === 'win32') {
+      return `plaintext file ${file} (NOTIFAI_CREDENTIALS=file; POSIX mode bits are not protection on NTFS)`
+    }
+    return `plaintext file ${file} (mode 0600)`
+  }
+}
+
+/**
+ * Windows default: DPAPI CurrentUser via first-party PowerShell.
+ *
+ * The protected blob lives under LOCALAPPDATA, never roaming APPDATA.
+ * Plaintext crosses the process boundary only on stdin/stdout — never as a
+ * command-line argument.
+ */
+export class WindowsDpapiStore implements CredentialStore {
+  private readonly env: NodeJS.ProcessEnv
+  private readonly run: ProcessRunner
+
+  constructor(env: NodeJS.ProcessEnv = process.env, options: CredentialStoreOptions = {}) {
+    this.env = env
+    this.run = options.run ?? defaultProcessRunner
   }
+
+  private filePath(): string | null {
+    const local = this.env['LOCALAPPDATA']
+    if (typeof local !== 'string' || local.trim() === '') return null
+    return path.join(local, 'notifai', DPAPI_FILE)
+  }
+
+  load(): MachineCredential | null {
+    const file = this.filePath()
+    if (file === null || !existsSync(file)) return null
+    let text: string
+    try {
+      text = readFileSync(file, 'utf8')
+    } catch {
+      return null
+    }
+    const blob = parseDpapiEnvelope(text)
+    if (blob === null) return null
+    const plain = this.unprotect(blob)
+    return plain === null ? null : parseCredentialJson(plain)
+  }
+
+  save(credential: MachineCredential): void {
+    const file = this.filePath()
+    if (file === null) {
+      throw new Error('Windows credential store path is not configured (LOCALAPPDATA is missing)')
+    }
+    const blob = this.protect(Buffer.from(JSON.stringify(credential), 'utf8'))
+    atomicWriteFileSync(file, `${JSON.stringify({ format: DPAPI_FORMAT, data: blob })}\n`, {
+      mode: 0o600,
+      preserveMode: false,
+      requireCurrentUserOwner: true,
+    })
+  }
+
+  clear(): void {
+    const file = this.filePath()
+    if (file === null) return
+    rmSync(file, { force: true })
+  }
+
+  describe(): string {
+    const file = this.filePath()
+    if (file === null) return 'Windows DPAPI current-user (LOCALAPPDATA unset)'
+    return `Windows DPAPI current-user (${file})`
+  }
+
+  private protect(plaintext: Buffer): string {
+    const result = this.invoke('protect', plaintext)
+    if (result.status !== 0) {
+      throw new Error('Windows credential protection failed')
+    }
+    const encoded = result.stdout.toString('utf8').trim()
+    if (!isBase64(encoded)) {
+      throw new Error('Windows credential protection failed')
+    }
+    return encoded
+  }
+
+  private unprotect(blob: string): string | null {
+    const result = this.invoke('unprotect', Buffer.from(blob, 'utf8'))
+    if (result.status !== 0) return null
+    const plain = result.stdout.toString('utf8')
+    return plain === '' ? null : plain
+  }
+
+  private invoke(operation: 'protect' | 'unprotect', input: Buffer): RunCommandResult {
+    const encoded = operation === 'protect' ? PROTECT_ENCODED : UNPROTECT_ENCODED
+    const invocation = powerShellInvocation(encoded, this.env)
+    return this.run.run({
+      command: invocation.command,
+      args: invocation.args,
+      input,
+      timeoutMs: DPAPI_TIMEOUT_MS,
+    })
+  }
+}
+
+function parseCredentialJson(raw: string): MachineCredential | null {
+  try {
+    return parseCredential(JSON.parse(raw) as unknown)
+  } catch {
+    return null
+  }
+}
+
+function parseCredential(raw: unknown): MachineCredential | null {
+  if (raw === null || typeof raw !== 'object') return null
+  const value = raw as Record<string, unknown>
+  const machineId = value['machineId']
+  const secret = value['secret']
+  const baseUrl = value['baseUrl']
+  const machineName = value['machineName']
+  if (
+    typeof machineId !== 'string' ||
+    machineId === '' ||
+    typeof secret !== 'string' ||
+    secret === '' ||
+    typeof baseUrl !== 'string' ||
+    baseUrl === '' ||
+    typeof machineName !== 'string' ||
+    machineName === ''
+  ) {
+    return null
+  }
+  return { machineId, secret, baseUrl, machineName }
+}
+
+function parseDpapiEnvelope(text: string): string | null {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(text)
+  } catch {
+    return null
+  }
+  if (parsed === null || typeof parsed !== 'object') return null
+  const value = parsed as Record<string, unknown>
+  if (value['format'] !== DPAPI_FORMAT) return null
+  const data = value['data']
+  if (typeof data !== 'string' || !isBase64(data)) return null
+  return data
+}
+
+function isBase64(value: string): boolean {
+  return value.length > 0 && value.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(value)
 }
 
-function keychainAvailable(): boolean {
-  if (process.platform !== 'darwin') return false
+function keychainProbeSucceeds(): boolean {
   try {
     execFileSync('security', ['help'], { stdio: 'ignore' })
     return true
@@ -113,7 +360,17 @@ function keychainAvailable(): boolean {
   }
 }
 
-export function defaultCredentialStore(env: NodeJS.ProcessEnv = process.env): CredentialStore {
-  if (env['NOTIFAI_CREDENTIALS'] === 'file') return new FileStore(env)
-  return keychainAvailable() ? new KeychainStore() : new FileStore(env)
+export function defaultCredentialStore(
+  env: NodeJS.ProcessEnv = process.env,
+  options: CredentialStoreOptions = {},
+): CredentialStore {
+  const platform = options.platform ?? process.platform
+  if (env['NOTIFAI_CREDENTIALS'] === 'file') return new FileStore(env, { platform })
+  if (platform === 'win32') return new WindowsDpapiStore(env, options)
+  const keychain =
+    options.keychainAvailable !== undefined
+      ? options.keychainAvailable
+      : platform === 'darwin' && keychainProbeSucceeds()
+  if (keychain) return new KeychainStore()
+  return new FileStore(env, { platform })
 }