@sriinnu/runic 1.0.0

package/Sources/Runic/Core/Stores/MiniMaxCookieHeaderStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol MiniMaxCookieHeaderStoring: Sendable {
+    func loadHeader() throws -> String?
+    func storeHeader(_ header: String?) throws
+}
+
+enum MiniMaxCookieHeaderStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainMiniMaxCookieHeaderStore: MiniMaxCookieHeaderStoring {
+    private static let log = RunicLog.logger("minimax-cookie-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "minimax-cookie-header"
+
+    func loadHeader() throws -> String? {
+        // Try standard keychain first.
+        if let header = try self.readHeader(dataProtection: false) {
+            return header
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let header = try self.readHeader(dataProtection: true) {
+            Self.log.info("Migrating MiniMax cookie header from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeHeader(header)) != nil {
+                try? self.deleteHeader(dataProtection: true)
+            }
+            return header
+        }
+        return nil
+    }
+
+    func storeHeader(_ header: String?) throws {
+        let cleaned = header?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteHeader(dataProtection: false)
+            try? self.deleteHeader(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteHeader(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw MiniMaxCookieHeaderStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readHeader(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw MiniMaxCookieHeaderStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw MiniMaxCookieHeaderStoreError.invalidData
+        }
+        let header = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (header?.isEmpty ?? true) ? nil : header
+    }
+
+    private func deleteHeader(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw MiniMaxCookieHeaderStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/MiniMaxGroupIDStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol MiniMaxGroupIDStoring: Sendable {
+    func loadGroupID() throws -> String?
+    func storeGroupID(_ groupID: String?) throws
+}
+
+enum MiniMaxGroupIDStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainMiniMaxGroupIDStore: MiniMaxGroupIDStoring {
+    private static let log = RunicLog.logger("minimax-groupid-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "minimax-group-id"
+
+    func loadGroupID() throws -> String? {
+        // Try standard keychain first.
+        if let groupID = try self.readGroupID(dataProtection: false) {
+            return groupID
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let groupID = try self.readGroupID(dataProtection: true) {
+            Self.log.info("Migrating MiniMax group ID from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeGroupID(groupID)) != nil {
+                try? self.deleteGroupID(dataProtection: true)
+            }
+            return groupID
+        }
+        return nil
+    }
+
+    func storeGroupID(_ groupID: String?) throws {
+        let cleaned = groupID?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteGroupID(dataProtection: false)
+            try? self.deleteGroupID(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteGroupID(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw MiniMaxGroupIDStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readGroupID(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw MiniMaxGroupIDStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw MiniMaxGroupIDStoreError.invalidData
+        }
+        let groupID = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (groupID?.isEmpty ?? true) ? nil : groupID
+    }
+
+    private func deleteGroupID(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw MiniMaxGroupIDStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/MiniMaxTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol MiniMaxTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum MiniMaxTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainMiniMaxTokenStore: MiniMaxTokenStoring {
+    private static let log = RunicLog.logger("minimax-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "minimax-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating MiniMax token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw MiniMaxTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw MiniMaxTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw MiniMaxTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw MiniMaxTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}

package/Sources/Runic/Core/Stores/MistralTokenStore.swift

@@ -0,0 +1,143 @@
+import RunicCore
+import Foundation
+import Security
+
+protocol MistralTokenStoring: Sendable {
+    func loadToken() throws -> String?
+    func storeToken(_ token: String?) throws
+}
+
+enum MistralTokenStoreError: LocalizedError {
+    case keychainStatus(OSStatus)
+    case invalidData
+
+    var errorDescription: String? {
+        switch self {
+        case let .keychainStatus(status):
+            "Keychain error: \(status)"
+        case .invalidData:
+            "Keychain returned invalid data."
+        }
+    }
+}
+
+struct KeychainMistralTokenStore: MistralTokenStoring {
+    private static let log = RunicLog.logger("mistral-token-store")
+
+    private let service = "com.sriinnu.athena.Runic"
+    private let account = "mistral-api-token"
+
+    func loadToken() throws -> String? {
+        // Try standard keychain first.
+        if let token = try self.readToken(dataProtection: false) {
+            return token
+        }
+        // Migrate from the old Data Protection keychain if present.
+        if let token = try self.readToken(dataProtection: true) {
+            Self.log.info("Migrating Mistral token from Data Protection keychain")
+            // Store first, delete old only on success — prevents data loss.
+            if (try? self.storeToken(token)) != nil {
+                try? self.deleteToken(dataProtection: true)
+            }
+            return token
+        }
+        return nil
+    }
+
+    func storeToken(_ token: String?) throws {
+        let cleaned = token?.trimmingCharacters(in: .whitespacesAndNewlines)
+        if cleaned == nil || cleaned?.isEmpty == true {
+            try? self.deleteToken(dataProtection: false)
+            try? self.deleteToken(dataProtection: true)
+            return
+        }
+
+        let data = cleaned!.data(using: .utf8)!
+        let query = self.baseQuery(dataProtection: false)
+        let attributes: [String: Any] = [
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock,
+        ]
+
+        // Try update first.
+        let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        if updateStatus == errSecSuccess { return }
+
+        if updateStatus != errSecItemNotFound {
+            // Item exists but update failed — delete and re-add to reset ACL.
+            try? self.deleteToken(dataProtection: false)
+        }
+
+        var addQuery = query
+        for (key, value) in attributes { addQuery[key] = value }
+
+        // Grant the calling app permanent access so macOS never shows a
+        // Keychain password dialog for this item.
+        if let access = Self.createSelfAccess() {
+            addQuery[kSecAttrAccess as String] = access
+        }
+
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        guard addStatus == errSecSuccess else {
+            Self.log.error("Keychain add failed: \(addStatus)")
+            throw MistralTokenStoreError.keychainStatus(addStatus)
+        }
+    }
+
+    // MARK: - Private
+
+    private func readToken(dataProtection: Bool) throws -> String? {
+        var result: CFTypeRef?
+        var query = self.baseQuery(dataProtection: dataProtection)
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+        query[kSecReturnData as String] = true
+
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound || status == errSecInteractionNotAllowed {
+            return nil
+        }
+        guard status == errSecSuccess else {
+            Self.log.error("Keychain read failed: \(status)")
+            throw MistralTokenStoreError.keychainStatus(status)
+        }
+        guard let data = result as? Data else {
+            throw MistralTokenStoreError.invalidData
+        }
+        let token = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        return (token?.isEmpty ?? true) ? nil : token
+    }
+
+    private func deleteToken(dataProtection: Bool) throws {
+        let query = self.baseQuery(dataProtection: dataProtection)
+        let status = SecItemDelete(query as CFDictionary)
+        if status == errSecSuccess || status == errSecItemNotFound { return }
+        Self.log.error("Keychain delete failed: \(status)")
+        throw MistralTokenStoreError.keychainStatus(status)
+    }
+
+    private func baseQuery(dataProtection: Bool) -> [String: Any] {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: self.service,
+            kSecAttrAccount as String: self.account,
+        ]
+        if dataProtection {
+            q[kSecUseDataProtectionKeychain as String] = true
+        }
+        return q
+    }
+
+    /// Creates a SecAccess that grants the calling application permanent
+    /// read/write access without triggering the macOS Keychain password dialog.
+    private static func createSelfAccess() -> SecAccess? {
+        var trustedSelf: SecTrustedApplication?
+        guard SecTrustedApplicationCreateFromPath(nil, &trustedSelf) == errSecSuccess,
+              let trustedSelf else { return nil }
+        var access: SecAccess?
+        guard SecAccessCreate(
+            "Runic API Token" as CFString,
+            [trustedSelf] as CFArray,
+            &access) == errSecSuccess else { return nil }
+        return access
+    }
+}