feat: implement interactive TUI api key configuration wizard with zeroize mem security

Author: Ashutosh0x

check_errors.txt

@@ -5,6 +5,7 @@ edition = "2021"
 
 [dependencies]
 serde = { version = "1.0", features = ["derive"] }
+zeroize = { version = "1", features = ["zeroize_derive"] }
 serde_json = "1.0"
 anyhow = "1.0"
 thiserror = "1.0"

crates/common/Cargo.toml

@@ -0,0 +1,103 @@
+use std::collections::BTreeMap;
+use std::fs;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+/// Finds the project .env path (next to Cargo.toml or in working dir)
+pub fn env_path() -> PathBuf {
+    // Check if .env exists in current directory
+    let cwd = std::env::current_dir().unwrap_or_default();
+    cwd.join(".env")
+}
+
+/// Writes key-value pairs to .env, preserving existing entries
+/// Uses atomic write (write to .env.tmp, then rename)
+pub fn save_keys(keys: &[(&str, &str)]) -> std::io::Result<()> {
+    let path = env_path();
+    let mut existing = load_existing(&path);
+
+    // Merge new keys (overwrite if already present)
+    for (k, v) in keys {
+        if !v.trim().is_empty() {
+            existing.insert(k.to_string(), v.to_string());
+        }
+    }
+
+    // Write to temporary file first (atomic write)
+    let tmp_path = path.with_extension("env.tmp");
+    {
+        let mut file = fs::File::create(&tmp_path)?;
+
+        // Write header
+        writeln!(file, "# RustForge Configuration")?;
+        writeln!(file, "# Auto-generated by setup wizard")?;
+        writeln!(file, "# Edit manually or re-run setup with: cargo run -p tui -- --setup")?;
+        writeln!(file)?;
+
+        for (key, value) in &existing {
+            writeln!(file, "{}={}", key, value)?;
+        }
+
+        file.sync_all()?; // Ensure flush to disk
+    }
+
+    // Atomic rename
+    fs::rename(&tmp_path, &path)?;
+
+    // Set secure permissions on Unix systems
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let perms = std::fs::Permissions::from_mode(0o600); // owner read/write only
+        if let Err(e) = std::fs::set_permissions(&path, perms) {
+            eprintln!("Warning: could not set secure .env permissions: {}", e);
+        }
+    }
+
+    // Also inject into current process environment
+    for (k, v) in keys {
+        if !v.trim().is_empty() {
+            std::env::set_var(k, v);
+        }
+    }
+
+    Ok(())
+}
+
+fn load_existing(path: &Path) -> BTreeMap<String, String> {
+    let mut map = BTreeMap::new();
+    if let Ok(content) = fs::read_to_string(path) {
+        for line in content.lines() {
+            let line = line.trim();
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+            if let Some((k, v)) = line.split_once('=') {
+                map.insert(k.trim().to_string(), v.trim().to_string());
+            }
+        }
+    }
+    map
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    #[test]
+    fn test_roundtrip_write_read() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join(".env");
+        std::env::set_current_dir(dir.path()).unwrap();
+
+        save_keys(&[
+            ("FINNHUB_API_KEY", "test_key_123"),
+            ("ALPACA_API_KEY", "AKID_456"),
+        ]).unwrap();
+
+        let loaded = load_existing(&path);
+        assert_eq!(loaded.get("FINNHUB_API_KEY").unwrap(), "test_key_123");
+        assert_eq!(loaded.get("ALPACA_API_KEY").unwrap(), "AKID_456");
+    }
+}

crates/common/src/env_writer.rs

@@ -0,0 +1,27 @@
+/// Quick validation — just checks format, not live API calls
+pub fn validate_key_format(name: &str, value: &str) -> Result<(), String> {
+    match name {
+        "FINNHUB_API_KEY" => {
+            if value.len() < 10 {
+                return Err("Finnhub keys are typically 20+ characters".into());
+            }
+        }
+        "ALPACA_API_KEY" => {
+            if !value.starts_with("AK") && !value.starts_with("PK") {
+                return Err("Alpaca Key IDs typically start with AK or PK".into());
+            }
+        }
+        "ALPACA_SECRET_KEY" => {
+            if value.len() < 20 {
+                return Err("Alpaca secret keys are typically 40+ characters".into());
+            }
+        }
+        "ANTHROPIC_API_KEY" => {
+            if !value.starts_with("sk-ant-") {
+                return Err("Anthropic keys start with sk-ant-".into());
+            }
+        }
+        _ => {}
+    }
+    Ok(())
+}

crates/common/src/key_validator.rs

@@ -4,6 +4,8 @@ pub mod dashboard;
 pub mod events;
 pub mod models;
 pub mod config;
+pub mod env_writer;
+pub mod key_validator;
 
 #[derive(Debug, Serialize, Deserialize, Clone)]
 pub struct SwapEvent {

crates/common/src/lib.rs

@@ -9,6 +9,8 @@ crossterm = "0.27"
 anyhow = "1.0"
 tokio = { version = "1.35", features = ["full"] }
 common = { path = "../common" }
+zeroize = { version = "1", features = ["zeroize_derive"] }
+dotenvy = "0.15"
 crossbeam-channel = "0.5"
 serde_json = "1.0"
 tokio-retry = "0.3.0"

crates/tui/Cargo.toml

@@ -50,9 +50,33 @@ pub enum AlertSeverity {
 
 use common::models::exchange::{ExchangeInfo, ExchangeStatus, ExchangeName};
 
+// ── App Screens ───────────────────────────────────────────────────────────────
+
+pub enum AppScreen {
+    Setup(SetupState),
+    Dashboard,
+}
+
+pub struct SetupState {
+    pub fields: Vec<KeyField>,
+    pub active_field: usize,
+    pub error_msg: Option<String>,
+    pub show_confirmation: bool,
+}
+
+pub struct KeyField {
+    pub name: &'static str,
+    pub label: &'static str,
+    pub value: String,
+    pub required: bool,
+    pub masked: bool,
+    pub hint: &'static str,
+}
+
 // ── Main App ──────────────────────────────────────────────────────────────────
 
 pub struct App {
+    pub screen: AppScreen,
     pub should_quit: bool,
     pub connection_status: String,
     pub show_help: bool,
@@ -104,8 +128,9 @@ pub struct App {
 }
 
 impl App {
-    pub fn new() -> Self {
+    pub fn new(initial_screen: AppScreen) -> Self {
         Self {
+            screen: initial_screen,
             should_quit: false,
             connection_status: "Connecting...".to_string(),
             show_help: false,

crates/tui/src/app.rs

@@ -32,6 +32,7 @@ mod event_handler;
 pub mod widgets;
 pub mod layout;
 pub mod state;
+pub mod setup;
 
 use app::App;
 use common::models::exchange::ExchangeStatus;
@@ -45,7 +46,23 @@ async fn main() -> anyhow::Result<()> {
     let backend = CrosstermBackend::new(stdout);
     let mut terminal = Terminal::new(backend)?;
 
-    let mut app = App::new();
+    // Try loading existing .env
+    let _ = dotenvy::dotenv();
+
+    // Determine if setup is needed
+    let needs_setup = std::env::var("FINNHUB_API_KEY").is_err()
+        || std::env::var("ALPACA_API_KEY").is_err()
+        || std::env::var("ALPACA_SECRET_KEY").is_err();
+
+    let force_setup = std::env::args().any(|a| a == "--setup");
+
+    let initial_screen = if needs_setup || force_setup {
+        crate::app::AppScreen::Setup(crate::app::SetupState::new())
+    } else {
+        crate::app::AppScreen::Dashboard
+    };
+
+    let mut app = App::new(initial_screen);
 
     // Event Bus Connection Manager
     let (tx_status, mut rx_status) = mpsc::channel::<String>(100);
@@ -94,15 +111,50 @@ async fn main() -> anyhow::Result<()> {
             app.update_from_event(event);
         }
 
-        terminal.draw(|f| ui(f, &app))?;
+        terminal.draw(|f| {
+            match &app.screen {
+                crate::app::AppScreen::Setup(state) => crate::setup::render_setup(f, state),
+                crate::app::AppScreen::Dashboard => ui(f, &app),
+            }
+        })?;
 
         if crossterm::event::poll(Duration::from_millis(50))? {
             match event::read()? {
                 Event::Key(key) => {
-                    event_handler::handle_key(&mut app, key);
+                    match &mut app.screen {
+                        crate::app::AppScreen::Setup(state) => {
+                            match crate::setup::handle_setup_key(key, state) {
+                                crate::setup::SetupAction::Submit => {
+                                    let pairs: Vec<(&str, &str)> = state.fields.iter()
+                                        .map(|f| (f.name, f.value.as_str()))
+                                        .collect();
+
+                                    match common::env_writer::save_keys(&pairs) {
+                                        Ok(()) => {
+                                            use zeroize::Zeroize;
+                                            for field in &mut state.fields {
+                                                field.value.zeroize();
+                                            }
+                                            app.screen = crate::app::AppScreen::Dashboard;
+                                        }
+                                        Err(e) => {
+                                            state.error_msg = Some(format!("Failed to save .env: {}", e));
+                                        }
+                                    }
+                                }
+                                crate::setup::SetupAction::Quit => break,
+                                crate::setup::SetupAction::Continue => {}
+                            }
+                        }
+                        crate::app::AppScreen::Dashboard => {
+                            event_handler::handle_key(&mut app, key);
+                        }
+                    }
                 }
                 Event::Mouse(mouse_event) => {
-                    event_handler::handle_mouse(&mut app, mouse_event);
+                    if let crate::app::AppScreen::Dashboard = &app.screen {
+                        event_handler::handle_mouse(&mut app, mouse_event);
+                    }
                 }
                 _ => {}
             }