fix(auth): store bearer tokens in native credentials
This commit is contained in:
@@ -0,0 +1,296 @@
|
||||
use std::{
|
||||
fs,
|
||||
io::{self, ErrorKind, Read, Write},
|
||||
path::{Component, Path, PathBuf},
|
||||
};
|
||||
|
||||
use cap_fs_ext::{
|
||||
DirExt, FollowSymlinks, MetadataExt as CrossPlatformMetadataExt, OpenOptionsFollowExt,
|
||||
};
|
||||
use cap_std::{
|
||||
ambient_authority,
|
||||
fs::{Dir, File, OpenOptions, Permissions},
|
||||
};
|
||||
use zeroize::Zeroizing;
|
||||
|
||||
use crate::error::SyncClientError;
|
||||
|
||||
const MARKER_CONTENT: &[u8] = b"ely-bearer-migration-v1\n";
|
||||
|
||||
pub(super) fn read_legacy_bytes(
|
||||
path: &Path,
|
||||
maximum_bytes: usize,
|
||||
) -> Result<Option<Zeroizing<Vec<u8>>>, SyncClientError> {
|
||||
let Some((directory, name)) = open_parent(path, false)? else {
|
||||
return Ok(None);
|
||||
};
|
||||
let Some(file) = open_existing(&directory, name)? else {
|
||||
return Ok(None);
|
||||
};
|
||||
validate_private_file(&file)?;
|
||||
let mut bytes = Zeroizing::new(Vec::new());
|
||||
file.into_std().take((maximum_bytes + 1) as u64).read_to_end(&mut bytes).map_err(storage_io)?;
|
||||
if bytes.len() > maximum_bytes {
|
||||
return Err(storage_error("legacy bearer token is too large"));
|
||||
}
|
||||
Ok(Some(bytes))
|
||||
}
|
||||
|
||||
pub(super) fn ensure_migration_marker(path: &Path) -> Result<(), SyncClientError> {
|
||||
let (directory, name) = open_parent(path, true)?
|
||||
.ok_or_else(|| storage_error("bearer migration marker parent is missing"))?;
|
||||
if let Some(file) = open_existing(&directory, name)? {
|
||||
return validate_migration_marker(file);
|
||||
}
|
||||
let temporary_path = marker_temporary_path(path)?;
|
||||
remove_file_if_present(&temporary_path)?;
|
||||
let temporary_name = temporary_path
|
||||
.file_name()
|
||||
.ok_or_else(|| storage_error("bearer migration marker temp name is missing"))?;
|
||||
let mut options = private_open_options();
|
||||
options.write(true).create_new(true);
|
||||
let mut file = directory.open_with(temporary_name, &options).map_err(storage_io)?;
|
||||
validate_private_file(&file)?;
|
||||
set_private_file_permissions(&file)?;
|
||||
file.write_all(MARKER_CONTENT).map_err(storage_io)?;
|
||||
file.sync_all().map_err(storage_io)?;
|
||||
drop(file);
|
||||
directory.rename(temporary_name, &directory, name).map_err(storage_io)?;
|
||||
sync_directory(&directory)
|
||||
}
|
||||
|
||||
pub(super) fn migration_marker_exists(path: &Path) -> Result<bool, SyncClientError> {
|
||||
let Some((directory, name)) = open_parent(path, false)? else {
|
||||
return Ok(false);
|
||||
};
|
||||
let Some(file) = open_existing(&directory, name)? else {
|
||||
return Ok(false);
|
||||
};
|
||||
validate_migration_marker(file)?;
|
||||
Ok(true)
|
||||
}
|
||||
|
||||
fn validate_migration_marker(file: File) -> Result<(), SyncClientError> {
|
||||
validate_private_file(&file)?;
|
||||
let mut bytes = Vec::new();
|
||||
file.into_std()
|
||||
.take((MARKER_CONTENT.len() + 1) as u64)
|
||||
.read_to_end(&mut bytes)
|
||||
.map_err(storage_io)?;
|
||||
if bytes != MARKER_CONTENT {
|
||||
return Err(storage_error("bearer migration marker content is invalid"));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn marker_temporary_path(path: &Path) -> Result<PathBuf, SyncClientError> {
|
||||
let mut name = path
|
||||
.file_name()
|
||||
.ok_or_else(|| storage_error("bearer migration marker name is missing"))?
|
||||
.to_os_string();
|
||||
name.push(".tmp");
|
||||
Ok(path.with_file_name(name))
|
||||
}
|
||||
|
||||
pub(super) fn remove_file_if_present(path: &Path) -> Result<(), SyncClientError> {
|
||||
let Some((directory, name)) = open_parent(path, false)? else {
|
||||
return Ok(());
|
||||
};
|
||||
let metadata = match directory.symlink_metadata(name) {
|
||||
Ok(metadata) => metadata,
|
||||
Err(error) if error.kind() == ErrorKind::NotFound => return Ok(()),
|
||||
Err(error) => return Err(storage_io(error)),
|
||||
};
|
||||
if metadata.is_symlink() {
|
||||
return directory.remove_file_or_symlink(name).map_err(storage_io);
|
||||
}
|
||||
let file = open_existing(&directory, name)?.ok_or_else(|| {
|
||||
storage_error("legacy bearer token disappeared during cleanup validation")
|
||||
})?;
|
||||
validate_private_file(&file)?;
|
||||
drop(file);
|
||||
directory.remove_file_or_symlink(name).map_err(storage_io)
|
||||
}
|
||||
|
||||
pub(super) fn open_lock_file(path: &Path) -> Result<fs::File, SyncClientError> {
|
||||
let (directory, name) =
|
||||
open_parent(path, true)?.ok_or_else(|| storage_error("bearer lock parent is missing"))?;
|
||||
let mut options = private_open_options();
|
||||
options.read(true).write(true).create(true);
|
||||
let file = directory.open_with(name, &options).map_err(storage_io)?;
|
||||
validate_private_file(&file)?;
|
||||
set_private_file_permissions(&file)?;
|
||||
Ok(file.into_std())
|
||||
}
|
||||
|
||||
fn open_parent(
|
||||
path: &Path,
|
||||
create: bool,
|
||||
) -> Result<Option<(Dir, &std::ffi::OsStr)>, SyncClientError> {
|
||||
let parent = path.parent().ok_or_else(|| storage_error("credential file parent is missing"))?;
|
||||
let name = path.file_name().ok_or_else(|| storage_error("credential file name is missing"))?;
|
||||
let Some(directory) = open_directory_nofollow(parent, create)? else {
|
||||
return Ok(None);
|
||||
};
|
||||
validate_private_directory(&directory)?;
|
||||
set_private_directory_permissions(&directory)?;
|
||||
Ok(Some((directory, name)))
|
||||
}
|
||||
|
||||
fn open_directory_nofollow(path: &Path, create: bool) -> Result<Option<Dir>, SyncClientError> {
|
||||
let mut root = PathBuf::new();
|
||||
let mut names = Vec::new();
|
||||
for component in path.components() {
|
||||
match component {
|
||||
Component::Prefix(prefix) => root.push(prefix.as_os_str()),
|
||||
Component::RootDir => root.push(std::path::MAIN_SEPARATOR_STR),
|
||||
Component::Normal(name) => names.push(name.to_os_string()),
|
||||
Component::CurDir => {}
|
||||
Component::ParentDir => {
|
||||
return Err(storage_error("credential path traversal is invalid"));
|
||||
}
|
||||
}
|
||||
}
|
||||
if root.as_os_str().is_empty() {
|
||||
return Err(storage_error("credential paths must be absolute"));
|
||||
}
|
||||
let mut directory = Dir::open_ambient_dir(root, ambient_authority()).map_err(storage_io)?;
|
||||
#[cfg(windows)]
|
||||
let strict_component = names.len().saturating_sub(4);
|
||||
#[cfg(windows)]
|
||||
let mut require_nofollow = false;
|
||||
#[cfg(windows)]
|
||||
let mut component_index = 0;
|
||||
#[cfg(not(windows))]
|
||||
let mut require_nofollow = directory_requires_nofollow(&directory)?;
|
||||
for name in names {
|
||||
#[cfg(windows)]
|
||||
{
|
||||
require_nofollow |= component_index >= strict_component;
|
||||
component_index += 1;
|
||||
}
|
||||
if create {
|
||||
match directory.create_dir(&name) {
|
||||
Ok(()) => {}
|
||||
Err(error) if error.kind() == ErrorKind::AlreadyExists => {}
|
||||
Err(error) => return Err(storage_io(error)),
|
||||
}
|
||||
}
|
||||
let opened = match directory.open_dir_nofollow(&name) {
|
||||
Ok(directory) => directory,
|
||||
Err(_) if !require_nofollow => match directory.open_dir(&name) {
|
||||
Ok(directory) => directory,
|
||||
Err(error) if !create && error.kind() == ErrorKind::NotFound => return Ok(None),
|
||||
Err(error) => return Err(storage_io(error)),
|
||||
},
|
||||
Err(error) if !create && error.kind() == ErrorKind::NotFound => return Ok(None),
|
||||
Err(error) => return Err(storage_io(error)),
|
||||
};
|
||||
#[cfg(not(windows))]
|
||||
{
|
||||
require_nofollow |= directory_requires_nofollow(&opened)?;
|
||||
}
|
||||
directory = opened;
|
||||
}
|
||||
Ok(Some(directory))
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
fn directory_requires_nofollow(directory: &Dir) -> Result<bool, SyncClientError> {
|
||||
use cap_std::fs::MetadataExt;
|
||||
|
||||
let metadata = directory.dir_metadata().map_err(storage_io)?;
|
||||
Ok(metadata.uid() == rustix::process::geteuid().as_raw() || metadata.mode() & 0o022 != 0)
|
||||
}
|
||||
|
||||
#[cfg(not(any(unix, windows)))]
|
||||
fn directory_requires_nofollow(_directory: &Dir) -> Result<bool, SyncClientError> {
|
||||
Ok(true)
|
||||
}
|
||||
|
||||
fn open_existing(directory: &Dir, name: &std::ffi::OsStr) -> Result<Option<File>, SyncClientError> {
|
||||
let mut options = private_open_options();
|
||||
options.read(true);
|
||||
match directory.open_with(name, &options) {
|
||||
Ok(file) => Ok(Some(file)),
|
||||
Err(error) if error.kind() == ErrorKind::NotFound => Ok(None),
|
||||
Err(error) => Err(storage_io(error)),
|
||||
}
|
||||
}
|
||||
|
||||
fn private_open_options() -> OpenOptions {
|
||||
let mut options = OpenOptions::new();
|
||||
options.follow(FollowSymlinks::No);
|
||||
#[cfg(unix)]
|
||||
{
|
||||
use cap_std::fs::OpenOptionsExt;
|
||||
options.mode(0o600);
|
||||
}
|
||||
options
|
||||
}
|
||||
|
||||
fn validate_private_directory(directory: &Dir) -> Result<(), SyncClientError> {
|
||||
let metadata = directory.dir_metadata().map_err(storage_io)?;
|
||||
if !metadata.is_dir() {
|
||||
return Err(storage_error("credential file parent is not a directory"));
|
||||
}
|
||||
#[cfg(unix)]
|
||||
{
|
||||
use cap_std::fs::MetadataExt;
|
||||
if metadata.uid() != rustix::process::geteuid().as_raw() {
|
||||
return Err(storage_error("credential file parent ownership is invalid"));
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn validate_private_file(file: &File) -> Result<(), SyncClientError> {
|
||||
let metadata = file.metadata().map_err(storage_io)?;
|
||||
if !metadata.is_file() || CrossPlatformMetadataExt::nlink(&metadata) != 1 {
|
||||
return Err(storage_error("credential file link state is invalid"));
|
||||
}
|
||||
#[cfg(unix)]
|
||||
{
|
||||
use cap_std::fs::MetadataExt;
|
||||
if metadata.uid() != rustix::process::geteuid().as_raw() {
|
||||
return Err(storage_error("credential file ownership is invalid"));
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn set_private_directory_permissions(directory: &Dir) -> Result<(), SyncClientError> {
|
||||
#[cfg(unix)]
|
||||
directory
|
||||
.set_permissions(".", Permissions::from_std(fs::Permissions::from_mode(0o700)))
|
||||
.map_err(storage_io)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn set_private_file_permissions(file: &File) -> Result<(), SyncClientError> {
|
||||
#[cfg(unix)]
|
||||
file.set_permissions(Permissions::from_std(fs::Permissions::from_mode(0o600)))
|
||||
.map_err(storage_io)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
fn sync_directory(directory: &Dir) -> Result<(), SyncClientError> {
|
||||
directory.try_clone().map_err(storage_io)?.into_std_file().sync_all().map_err(storage_io)
|
||||
}
|
||||
|
||||
#[cfg(not(unix))]
|
||||
fn sync_directory(_directory: &Dir) -> Result<(), SyncClientError> {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
use std::os::unix::fs::PermissionsExt;
|
||||
|
||||
fn storage_io(error: io::Error) -> SyncClientError {
|
||||
storage_error(error.to_string())
|
||||
}
|
||||
|
||||
fn storage_error(message: impl Into<String>) -> SyncClientError {
|
||||
SyncClientError::BearerCredentialStorage(message.into())
|
||||
}
|
||||
Reference in New Issue
Block a user