bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-10-02 20:57:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix(credentials): one vault per user, in the config dir (#119)

Browse source 
The credential store resolved its base directory against process.cwd().
Running the CLI from inside a git checkout wrote `.logicsrc/credentials`
into that repo's working tree — a directory containing `vault/`, the one
place raw credential values touch disk — untracked, unignored, and one
`git add -A` from being committed. Two such directories were sitting in
unrelated repos on the machine this was found on.

A per-directory store is also the wrong shape for what the store is for.
It is the record of what was rotated and what the prior values were, and
a record that forks per project folder is several records that disagree.
There is one user, one identity, one vault.

Everything now hangs off a single logicsrcHome(): $LOGICSRC_HOME, else
$XDG_CONFIG_HOME/logicsrc, else ~/.config/logicsrc. The credential store,
the identity and the CLI config all read it rather than each deriving
their own answer — three separate derivations is how the vault ended up
somewhere the config never was.

~/.logicsrc is migrated rather than abandoned. It holds the X25519 secret
key, and losing that loses access to every team vault the member was ever
given, so it is moved on first use; a move that fails says so on stderr
instead of leaving someone silently logged out with a key still on disk
somewhere they were not told about. If the new directory already exists
it wins and the old one is left untouched, because two directories both
claiming to be the identity is how a login writes one and a read finds
the other.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-07-31 22:53:17 -07:00 • committed by GitHub
parent 87266bb815
commit 36236eb1a3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
12 changed files with 223 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

54
plugins/credential-sharing/src/identity.ts
View file

@ -1,4 +1,4 @@
import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync, renameSync } from "node:fs";
import { homedir } from "node:os";
import { dirname, join, resolve } from "node:path";
import { generateIdentityKeyPair, publicKeyForSecret, type IdentityKeyPair } from "./crypto.js";
@ -6,7 +6,7 @@ import { generateIdentityKeyPair, publicKeyForSecret, type IdentityKeyPair } fro
/**
* Local, machine-bound member identity for team credential sharing.
*
* Stored at `$LOGICSRC_HOME/identity.json` (default `~/.logicsrc/identity.json`),
* Stored at `$LOGICSRC_HOME/identity.json` (default `~/.config/logicsrc/identity.json`),
* mode 0600 — it holds the member's X25519 SECRET key and the server API token.
* The secret key never leaves this file; only the public key is uploaded.
*/
@ -25,13 +25,63 @@ export interface LocalIdentity {
updatedAt: string;
}
/**
* The one logicsrc directory for this user, on this machine.
*
* `$LOGICSRC_HOME`, else `$XDG_CONFIG_HOME/logicsrc`, else
* `~/.config/logicsrc`. Never anything derived from the working directory:
* there is a single identity and a single vault per user, and a path that
* moves when you `cd` gives you one of each per directory you happened to be
* standing in — which is how a machine ends up with a `.logicsrc/` inside
* unrelated git repos, holding a directory called `credentials/vault`.
*
* A previous install kept this at `~/.logicsrc`. That directory holds the
* X25519 secret key, so it is moved rather than abandoned — losing it means
* losing access to every team vault the member was ever given.
*/
export function logicsrcHome(): string {
if (process.env.LOGICSRC_HOME) {
return resolve(process.env.LOGICSRC_HOME);
}
const configHome = process.env.XDG_CONFIG_HOME
? resolve(process.env.XDG_CONFIG_HOME)
: join(homedir(), ".config");
const home = join(configHome, "logicsrc");
migrateLegacyHome(home);
return home;
}
/** Where this lived before the move, kept only to be migrated away from. */
export function legacyLogicsrcHome(): string {
return join(homedir(), ".logicsrc");
}
/**
* Move `~/.logicsrc` to the config dir, once, if the new one is not there yet.
*
* Deliberately a move and not a copy: two directories both claiming to be the
* identity is the state where a login writes to one and a read finds the
* other. If it cannot be moved the failure is named on stderr rather than
* swallowed, because the alternative is a member silently logged out with a
* secret key still sitting somewhere they were not told about.
*/
function migrateLegacyHome(target: string): void {
const legacy = legacyLogicsrcHome();
if (legacy === target || existsSync(target) || !existsSync(legacy)) {
return;
}
try {
mkdirSync(dirname(target), { recursive: true });
renameSync(legacy, target);
} catch (error) {
const why = error instanceof Error ? error.message : String(error);
process.emitWarning(
`logicsrc: could not move ${legacy} to ${target} (${why}). ` +
`Move it by hand — it holds your identity key.`
);
}
}
export function identityPath(): string {
return process.env.LOGICSRC_IDENTITY_FILE
? resolve(process.env.LOGICSRC_IDENTITY_FILE)