@wlfi-agent/cli 1.4.12 → 1.4.14

package/crates/vault-cli-daemon/Cargo.toml

@@ -0,0 +1,28 @@
+[package]
+name = "wlfi-agent-daemon"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+clap.workspace = true
+libc.workspace = true
+nix = { version = "0.30", features = ["user"] }
+rpassword.workspace = true
+reqwest.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+time.workspace = true
+tokio.workspace = true
+uuid.workspace = true
+zeroize.workspace = true
+vault-daemon = { path = "../vault-daemon" }
+vault-domain = { path = "../vault-domain" }
+vault-signer = { path = "../vault-signer" }
+vault-transport-unix = { path = "../vault-transport-unix" }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+security-framework.workspace = true
+security-framework-sys.workspace = true

package/crates/vault-cli-daemon/src/bin/wlfi-agent-system-keychain.rs

@@ -0,0 +1,216 @@
+use std::io::{Read, Write};
+use std::path::PathBuf;
+
+use anyhow::{bail, Context, Result};
+use clap::{Parser, Subcommand};
+use zeroize::Zeroize;
+
+const MAX_SECRET_STDIN_BYTES: usize = 16 * 1024;
+
+#[derive(Debug, Parser)]
+#[command(
+    name = "wlfi-agent-system-keychain",
+    about = "Read and replace WLFI generic-password items in a specific macOS keychain"
+)]
+struct Cli {
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Debug, Subcommand)]
+enum Command {
+    ReadGenericPassword {
+        #[arg(long, value_name = "PATH")]
+        keychain: PathBuf,
+        #[arg(long, value_name = "NAME")]
+        service: String,
+        #[arg(long, value_name = "NAME")]
+        account: String,
+    },
+    ReplaceGenericPassword {
+        #[arg(long, value_name = "PATH")]
+        keychain: PathBuf,
+        #[arg(long, value_name = "NAME")]
+        service: String,
+        #[arg(long, value_name = "NAME")]
+        account: String,
+        #[arg(
+            long,
+            default_value_t = false,
+            help = "Read the replacement password from stdin"
+        )]
+        password_stdin: bool,
+    },
+}
+
+fn main() -> Result<()> {
+    let cli = Cli::parse();
+
+    match cli.command {
+        Command::ReadGenericPassword {
+            keychain,
+            service,
+            account,
+        } => read_generic_password(keychain, service, account),
+        Command::ReplaceGenericPassword {
+            keychain,
+            service,
+            account,
+            password_stdin,
+        } => replace_generic_password(keychain, service, account, password_stdin),
+    }
+}
+
+fn required_trimmed(value: String, label: &str) -> Result<String> {
+    let normalized = value.trim().to_owned();
+    if normalized.is_empty() {
+        bail!("{label} is required");
+    }
+    if normalized.chars().any(|character| character.is_control()) {
+        bail!("{label} must not contain control characters");
+    }
+    Ok(normalized)
+}
+
+fn read_secret_from_stdin(label: &str) -> Result<String> {
+    let mut raw = String::new();
+    std::io::stdin()
+        .read_to_string(&mut raw)
+        .with_context(|| format!("failed to read {label} from stdin"))?;
+
+    if raw.as_bytes().len() > MAX_SECRET_STDIN_BYTES {
+        raw.zeroize();
+        bail!("{label} must not exceed {MAX_SECRET_STDIN_BYTES} bytes");
+    }
+
+    let trimmed = raw.trim_end_matches(['\r', '\n']).to_owned();
+    raw.zeroize();
+
+    if trimmed.trim().is_empty() {
+        bail!("{label} must not be empty or whitespace");
+    }
+
+    Ok(trimmed)
+}
+
+#[cfg(target_os = "macos")]
+fn read_generic_password(keychain: PathBuf, service: String, account: String) -> Result<()> {
+    use security_framework::os::macos::keychain::SecKeychain;
+
+    let service = required_trimmed(service, "service")?;
+    let account = required_trimmed(account, "account")?;
+    let _interaction_guard =
+        SecKeychain::disable_user_interaction().context("failed to disable keychain UI")?;
+    let keychain = SecKeychain::open(&keychain)
+        .with_context(|| format!("failed to open keychain {}", keychain.display()))?;
+    let (password, _) = keychain
+        .find_generic_password(&service, &account)
+        .with_context(|| {
+            format!(
+                "failed to read generic password for service '{}' and account '{}'",
+                service, account
+            )
+        })?;
+    let mut secret = String::from_utf8(password.as_ref().to_vec())
+        .context("generic password data is not valid UTF-8")?;
+    std::io::stdout()
+        .write_all(secret.as_bytes())
+        .context("failed to write generic password to stdout")?;
+    std::io::stdout()
+        .write_all(b"\n")
+        .context("failed to terminate stdout output")?;
+    secret.zeroize();
+    Ok(())
+}
+
+#[cfg(not(target_os = "macos"))]
+fn read_generic_password(_keychain: PathBuf, _service: String, _account: String) -> Result<()> {
+    bail!("wlfi-agent-system-keychain is available only on macOS");
+}
+
+#[cfg(target_os = "macos")]
+fn replace_generic_password(
+    keychain: PathBuf,
+    service: String,
+    account: String,
+    password_stdin: bool,
+) -> Result<()> {
+    use security_framework::os::macos::keychain::SecKeychain;
+    use security_framework_sys::base::errSecItemNotFound;
+
+    if !password_stdin {
+        bail!("replace-generic-password requires --password-stdin");
+    }
+
+    let service = required_trimmed(service, "service")?;
+    let account = required_trimmed(account, "account")?;
+    let mut password = read_secret_from_stdin("password")?;
+
+    let result = (|| {
+        let _interaction_guard =
+            SecKeychain::disable_user_interaction().context("failed to disable keychain UI")?;
+        let keychain = SecKeychain::open(&keychain)
+            .with_context(|| format!("failed to open keychain {}", keychain.display()))?;
+
+        match keychain.find_generic_password(&service, &account) {
+            Ok((_existing_password, item)) => item.delete(),
+            Err(error) if error.code() == errSecItemNotFound => {}
+            Err(error) => {
+                return Err(error).with_context(|| {
+                    format!(
+                        "failed to inspect existing generic password for service '{}' and account '{}'",
+                        service, account
+                    )
+                });
+            }
+        }
+
+        keychain
+            .add_generic_password(&service, &account, password.as_bytes())
+            .with_context(|| {
+                format!(
+                    "failed to store generic password for service '{}' and account '{}'",
+                    service, account
+                )
+            })?;
+        Ok(())
+    })();
+
+    password.zeroize();
+    result
+}
+
+#[cfg(not(target_os = "macos"))]
+fn replace_generic_password(
+    _keychain: PathBuf,
+    _service: String,
+    _account: String,
+    _password_stdin: bool,
+) -> Result<()> {
+    bail!("wlfi-agent-system-keychain is available only on macOS");
+}
+
+#[cfg(test)]
+mod tests {
+    use super::required_trimmed;
+
+    #[test]
+    fn required_trimmed_accepts_spaces_inside_identifiers() {
+        let value = required_trimmed("Jane Doe".to_string(), "account").unwrap();
+        assert_eq!(value, "Jane Doe");
+    }
+
+    #[test]
+    fn required_trimmed_rejects_blank_identifiers() {
+        let error = required_trimmed("   ".to_string(), "service").unwrap_err();
+        assert!(error.to_string().contains("service is required"));
+    }
+
+    #[test]
+    fn required_trimmed_rejects_control_characters() {
+        let error = required_trimmed("bad\naccount".to_string(), "account").unwrap_err();
+        assert!(error
+            .to_string()
+            .contains("account must not contain control characters"));
+    }
+}