@wlfi-agent/cli 1.4.13 → 1.4.15

package/crates/vault-cli-daemon/tests/system_keychain_helper_acl.rs

@@ -0,0 +1,167 @@
+#[cfg(target_os = "macos")]
+mod macos {
+    use std::fs;
+    use std::io::Write;
+    use std::path::{Path, PathBuf};
+    use std::process::{Command, Output, Stdio};
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    fn unique_temp_dir() -> PathBuf {
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock drift")
+            .as_nanos();
+        let path = std::env::temp_dir().join(format!(
+            "wlfi-agent-system-keychain-test-{}-{unique}",
+            std::process::id()
+        ));
+        fs::create_dir_all(&path).expect("create temp dir");
+        path
+    }
+
+    fn run(command: &str, args: &[&str]) -> Output {
+        Command::new(command)
+            .args(args)
+            .output()
+            .unwrap_or_else(|error| panic!("failed to run {command}: {error}"))
+    }
+
+    fn run_with_stdin(command: &Path, args: &[&str], stdin: &str) -> Output {
+        let mut child = Command::new(command)
+            .args(args)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap_or_else(|error| panic!("failed to run {}: {error}", command.display()));
+        child
+            .stdin
+            .as_mut()
+            .expect("stdin pipe")
+            .write_all(stdin.as_bytes())
+            .expect("write stdin");
+        child
+            .wait_with_output()
+            .unwrap_or_else(|error| panic!("failed to wait for {}: {error}", command.display()))
+    }
+
+    fn cleanup_keychain(path: &Path) {
+        let _ = run(
+            "security",
+            &[
+                "delete-keychain",
+                path.to_str().expect("keychain path utf-8"),
+            ],
+        );
+        let _ = fs::remove_file(path);
+    }
+
+    #[test]
+    fn helper_owned_items_are_not_readable_via_security_cli() {
+        let helper = PathBuf::from(env!("CARGO_BIN_EXE_wlfi-agent-system-keychain"));
+        let temp_dir = unique_temp_dir();
+        let keychain_path = temp_dir.join("acl-test.keychain-db");
+        let keychain_path_str = keychain_path.to_str().expect("keychain path utf-8");
+        let keychain_password = "wlfi-test-keychain-password";
+        let service = "wlfi-agent-test-service";
+        let account = "wlfi-agent-test-account";
+        let secret = "wlfi-test-daemon-password";
+
+        let create = run(
+            "security",
+            &[
+                "create-keychain",
+                "-p",
+                keychain_password,
+                keychain_path_str,
+            ],
+        );
+        assert!(
+            create.status.success(),
+            "create-keychain failed: {}",
+            String::from_utf8_lossy(&create.stderr)
+        );
+
+        let unlock = run(
+            "security",
+            &[
+                "unlock-keychain",
+                "-p",
+                keychain_password,
+                keychain_path_str,
+            ],
+        );
+        assert!(
+            unlock.status.success(),
+            "unlock-keychain failed: {}",
+            String::from_utf8_lossy(&unlock.stderr)
+        );
+
+        let replace = run_with_stdin(
+            &helper,
+            &[
+                "replace-generic-password",
+                "--keychain",
+                keychain_path_str,
+                "--service",
+                service,
+                "--account",
+                account,
+                "--password-stdin",
+            ],
+            &format!("{secret}\n"),
+        );
+        assert!(
+            replace.status.success(),
+            "helper replace failed: {}",
+            String::from_utf8_lossy(&replace.stderr)
+        );
+
+        let raw_security = run(
+            "security",
+            &[
+                "find-generic-password",
+                "-w",
+                "-s",
+                service,
+                "-a",
+                account,
+                keychain_path_str,
+            ],
+        );
+        assert!(
+            !raw_security.status.success(),
+            "security CLI unexpectedly read helper-owned password: {}",
+            String::from_utf8_lossy(&raw_security.stdout)
+        );
+
+        let helper_read = run(
+            helper.to_str().expect("helper path utf-8"),
+            &[
+                "read-generic-password",
+                "--keychain",
+                keychain_path_str,
+                "--service",
+                service,
+                "--account",
+                account,
+            ],
+        );
+        assert!(
+            helper_read.status.success(),
+            "helper read failed: {}",
+            String::from_utf8_lossy(&helper_read.stderr)
+        );
+        assert_eq!(
+            String::from_utf8(helper_read.stdout).expect("utf-8 stdout"),
+            format!("{secret}\n")
+        );
+
+        cleanup_keychain(&keychain_path);
+        fs::remove_dir_all(&temp_dir).expect("remove temp dir");
+    }
+}
+
+#[cfg(not(target_os = "macos"))]
+#[test]
+fn helper_acl_test_is_macos_only() {}

package/crates/vault-daemon/Cargo.toml

@@ -0,0 +1,32 @@
+[package]
+name = "vault-daemon"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+
+[dependencies]
+alloy-primitives.workspace = true
+argon2.workspace = true
+async-trait.workspace = true
+chacha20poly1305.workspace = true
+hex.workspace = true
+k256.workspace = true
+nix = { version = "0.30", features = ["user"] }
+libc.workspace = true
+rand.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+thiserror.workspace = true
+time.workspace = true
+tokio.workspace = true
+uuid.workspace = true
+x25519-dalek.workspace = true
+reqwest.workspace = true
+zeroize.workspace = true
+vault-domain = { path = "../vault-domain" }
+vault-policy = { path = "../vault-policy" }
+vault-signer = { path = "../vault-signer" }
+
+[dev-dependencies]