WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

cli/internal/secrets/keyring.go

@@ -0,0 +1,80 @@
+package secrets
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/zalando/go-keyring"
+)
+
+// keyringService is the namespace prefix passed to OS keyring backends.
+// Final keyring entries look like service="weknora:<profile>", account="<key>".
+const keyringService = "weknora"
+
+// KeyringStore is the OS-backed credential store: macOS Keychain, GNOME
+// libsecret, KWallet, Windows Credential Manager. Falls back to ErrUnsupported
+// (callers swap to FileStore when this happens, see NewBestEffortStore).
+type KeyringStore struct{}
+
+// NewKeyringStore returns a KeyringStore. The constructor never fails; first
+// real Get/Set surfaces ErrUnsupported on systems with no keyring backend.
+func NewKeyringStore() *KeyringStore { return &KeyringStore{} }
+
+// service returns the per-profile service identifier. Splitting by profile
+// (rather than by host) follows the Supabase pattern: a user with
+// two tenants on the same host gets two distinct keyring namespaces.
+func (k *KeyringStore) service(profile string) string {
+	return keyringService + ":" + profile
+}
+
+func (k *KeyringStore) Get(profile, key string) (string, error) {
+	v, err := keyring.Get(k.service(profile), key)
+	if errors.Is(err, keyring.ErrNotFound) {
+		return "", ErrNotFound
+	}
+	if err != nil {
+		return "", fmt.Errorf("keyring get: %w", err)
+	}
+	return v, nil
+}
+
+func (k *KeyringStore) Set(profile, key, value string) error {
+	if err := keyring.Set(k.service(profile), key, value); err != nil {
+		return fmt.Errorf("keyring set: %w", err)
+	}
+	return nil
+}
+
+func (k *KeyringStore) Delete(profile, key string) error {
+	err := keyring.Delete(k.service(profile), key)
+	if errors.Is(err, keyring.ErrNotFound) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("keyring delete: %w", err)
+	}
+	return nil
+}
+
+// Ref returns the keychain:// URI under which a secret is stored.
+func (k *KeyringStore) Ref(profile, key string) string {
+	return "keychain://" + keyringService + "/" + profile + "/" + key
+}
+
+// NewBestEffortStore returns a Store that prefers keyring (when available)
+// and silently degrades to FileStore on systems without a keyring backend
+// (e.g. headless CI, WSL without DBus, agent containers).
+//
+// Probe is performed by attempting a no-op Get; if the backend signals that
+// it is unsupported we return the file store directly.
+func NewBestEffortStore() (Store, error) {
+	k := NewKeyringStore()
+	// Use a sentinel profile/key that should not exist; we expect either
+	// ErrNotFound (backend works, just empty) or ErrUnsupported (no backend).
+	_, err := keyring.Get(k.service("__probe__"), "__probe__")
+	if err == nil || errors.Is(err, keyring.ErrNotFound) {
+		return k, nil
+	}
+	// Anything else (including keyring.ErrUnsupportedPlatform) → file store.
+	return NewFileStore()
+}

cli/internal/secrets/keyring_test.go

@@ -0,0 +1,67 @@
+package secrets
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zalando/go-keyring"
+)
+
+// Use the in-memory keyring backend for deterministic tests.
+//
+// go-keyring exposes MockInit so tests don't need a real OS keychain.
+func TestKeyringStore_RoundTrip(t *testing.T) {
+	keyring.MockInit()
+	t.Cleanup(func() {
+		// Reset the mock so other test packages don't see leaked state.
+		keyring.MockInit()
+	})
+	k := NewKeyringStore()
+
+	// Get on missing returns ErrNotFound.
+	_, err := k.Get("prod", "access")
+	require.ErrorIs(t, err, ErrNotFound)
+
+	// Set + Get.
+	require.NoError(t, k.Set("prod", "access", "jwt-x"))
+	got, err := k.Get("prod", "access")
+	require.NoError(t, err)
+	assert.Equal(t, "jwt-x", got)
+
+	// Delete + Get.
+	require.NoError(t, k.Delete("prod", "access"))
+	_, err = k.Get("prod", "access")
+	require.ErrorIs(t, err, ErrNotFound)
+
+	// Delete on missing is a no-op.
+	require.NoError(t, k.Delete("prod", "access"))
+}
+
+func TestKeyringStore_NamespaceIsolation(t *testing.T) {
+	keyring.MockInit()
+	t.Cleanup(func() { keyring.MockInit() })
+	k := NewKeyringStore()
+	require.NoError(t, k.Set("prod", "access", "P"))
+	require.NoError(t, k.Set("staging", "access", "S"))
+
+	got, _ := k.Get("prod", "access")
+	assert.Equal(t, "P", got)
+	got, _ = k.Get("staging", "access")
+	assert.Equal(t, "S", got)
+}
+
+func TestNewBestEffortStore(t *testing.T) {
+	keyring.MockInit() // mock backend "supports" keyring → returns KeyringStore
+	t.Cleanup(func() { keyring.MockInit() })
+	s, err := NewBestEffortStore()
+	require.NoError(t, err)
+	_, ok := s.(*KeyringStore)
+	assert.True(t, ok, "with mock keyring backend, BestEffort must return KeyringStore")
+}
+
+func TestKeyringStore_Ref(t *testing.T) {
+	k := NewKeyringStore()
+	got := k.Ref("prod", "access")
+	assert.Equal(t, "keychain://weknora/prod/access", got)
+}

cli/internal/secrets/secrets.go

@@ -0,0 +1,129 @@
+// Package secrets stores and retrieves credentials. Production wires
+// KeyringStore (OS keychain, primary) with FileStore (0600 plaintext under
+// $XDG_CONFIG_HOME/weknora/secrets/, used as a fallback when no keyring
+// backend is available).
+//
+// Namespace convention: "weknora:<profile>:<key>" where key is "access",
+// "refresh", or "api_key".
+package secrets
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/Tencent/WeKnora/cli/internal/xdg"
+)
+
+// ErrNotFound is returned when the requested secret does not exist.
+var ErrNotFound = errors.New("secret: not found")
+
+// Store is the abstraction CLI commands depend on; tests inject in-memory impls.
+//
+// Ref returns a stable URI (e.g. file://<profile>/<key> or
+// keychain://weknora/<profile>/<key>) describing where a saved secret lives.
+// Backends own their scheme so commands never need to type-assert the
+// concrete implementation.
+type Store interface {
+	Get(profile, key string) (string, error)
+	Set(profile, key, value string) error
+	Delete(profile, key string) error
+	Ref(profile, key string) string
+}
+
+// FileStore writes 0600 plain-text files under $XDG_CONFIG_HOME/weknora/secrets/<profile>.
+// It is the headless / CI default and the keychain fallback.
+type FileStore struct {
+	root string
+}
+
+// NewFileStore returns a FileStore rooted at $XDG_CONFIG_HOME/weknora/secrets
+// (or ~/.config/weknora/secrets if XDG_CONFIG_HOME is unset). Same convention
+// as config.Path - see that file for the rationale (CLI convention).
+func NewFileStore() (*FileStore, error) {
+	root, err := defaultRoot()
+	if err != nil {
+		return nil, err
+	}
+	return &FileStore{root: root}, nil
+}
+
+func defaultRoot() (string, error) {
+	return xdg.Path("XDG_CONFIG_HOME", ".config", "secrets")
+}
+
+func (f *FileStore) path(profile, key string) string {
+	return filepath.Join(f.root, profile, key)
+}
+
+func (f *FileStore) Get(profile, key string) (string, error) {
+	data, err := os.ReadFile(f.path(profile, key))
+	if errors.Is(err, os.ErrNotExist) {
+		return "", ErrNotFound
+	}
+	if err != nil {
+		return "", fmt.Errorf("read secret: %w", err)
+	}
+	return string(data), nil
+}
+
+func (f *FileStore) Set(profile, key, value string) error {
+	dir := filepath.Join(f.root, profile)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return fmt.Errorf("mkdir secrets dir: %w", err)
+	}
+	if err := os.WriteFile(f.path(profile, key), []byte(value), 0o600); err != nil {
+		return fmt.Errorf("write secret: %w", err)
+	}
+	return nil
+}
+
+func (f *FileStore) Delete(profile, key string) error {
+	err := os.Remove(f.path(profile, key))
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	return err
+}
+
+// Ref returns the file:// URI under which a secret would be stored. Path
+// component is forward-slash-normalized per RFC 8089 (file:///path on Unix,
+// file:///C:/... on Windows) - the wire format must not depend on platform
+// path separator since this string is persisted to config.yaml and may be
+// consumed by tooling on a different OS.
+func (f *FileStore) Ref(profile, key string) string {
+	p := filepath.ToSlash(f.path(profile, key))
+	if !strings.HasPrefix(p, "/") {
+		// Windows absolute path "C:/..." needs a leading slash to form a
+		// proper file:/// URI ("file:///C:/...").
+		p = "/" + p
+	}
+	return "file://" + p
+}
+
+// MemStore is an in-memory implementation of Store used by tests across
+// packages. It is intentionally exported (not _test.go-only) so that
+// downstream packages can compose it without copying the same 20 lines.
+type MemStore struct{ m map[string]string }
+
+// NewMemStore returns an empty in-memory secrets store.
+func NewMemStore() *MemStore { return &MemStore{m: map[string]string{}} }
+
+func (m *MemStore) k(c, key string) string { return c + ":" + key }
+
+func (m *MemStore) Get(c, key string) (string, error) {
+	v, ok := m.m[m.k(c, key)]
+	if !ok {
+		return "", ErrNotFound
+	}
+	return v, nil
+}
+
+func (m *MemStore) Set(c, key, value string) error { m.m[m.k(c, key)] = value; return nil }
+
+func (m *MemStore) Delete(c, key string) error { delete(m.m, m.k(c, key)); return nil }
+
+// Ref returns a mem:// URI; meaningful only inside tests.
+func (m *MemStore) Ref(c, key string) string { return "mem://" + c + "/" + key }

cli/internal/secrets/secrets_test.go

@@ -0,0 +1,87 @@
+package secrets
+
+import (
+	"errors"
+	"os"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/Tencent/WeKnora/cli/internal/testutil"
+)
+
+func TestFileStore_RoundTrip(t *testing.T) {
+	testutil.XDGTempDir(t)
+	s, err := NewFileStore()
+	require.NoError(t, err)
+
+	_, err = s.Get("prod", "access")
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, ErrNotFound))
+
+	require.NoError(t, s.Set("prod", "access", "secret-value"))
+	got, err := s.Get("prod", "access")
+	require.NoError(t, err)
+	assert.Equal(t, "secret-value", got)
+
+	require.NoError(t, s.Delete("prod", "access"))
+	_, err = s.Get("prod", "access")
+	require.True(t, errors.Is(err, ErrNotFound))
+
+	require.NoError(t, s.Delete("prod", "access"), "Delete on missing must be a no-op")
+}
+
+func TestFileStore_FileMode(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("file mode bits don't map to Windows ACLs; 0600 invariant is Unix-only")
+	}
+	testutil.XDGTempDir(t)
+	s, err := NewFileStore()
+	require.NoError(t, err)
+	require.NoError(t, s.Set("prod", "access", "v"))
+
+	st, err := os.Stat(s.path("prod", "access"))
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o600), st.Mode().Perm(), "secrets must be 0600")
+}
+
+func TestFileStore_NamespaceIsolation(t *testing.T) {
+	testutil.XDGTempDir(t)
+	s, err := NewFileStore()
+	require.NoError(t, err)
+	require.NoError(t, s.Set("prod", "access", "P"))
+	require.NoError(t, s.Set("staging", "access", "S"))
+
+	got, _ := s.Get("prod", "access")
+	assert.Equal(t, "P", got)
+	got, _ = s.Get("staging", "access")
+	assert.Equal(t, "S", got)
+}
+
+func TestFileStore_Ref(t *testing.T) {
+	testutil.XDGTempDir(t)
+	s, err := NewFileStore()
+	require.NoError(t, err)
+	ref := s.Ref("prod", "access")
+	// Ref is RFC 8089: scheme + slash-normalized path. On Windows the path
+	// starts with a drive letter (file:///C:/...); on Unix file:///home/...
+	assert.True(t, strings.HasPrefix(ref, "file:///"), "expected file:/// scheme, got %q", ref)
+	assert.Contains(t, ref, "/prod/access")
+}
+
+func TestMemStore_RoundTripAndRef(t *testing.T) {
+	s := NewMemStore()
+	_, err := s.Get("p", "k")
+	require.ErrorIs(t, err, ErrNotFound)
+	require.NoError(t, s.Set("p", "k", "v"))
+	got, err := s.Get("p", "k")
+	require.NoError(t, err)
+	assert.Equal(t, "v", got)
+	assert.Equal(t, "mem://p/k", s.Ref("p", "k"))
+	require.NoError(t, s.Delete("p", "k"))
+	_, err = s.Get("p", "k")
+	require.ErrorIs(t, err, ErrNotFound)
+}