SNOW-1825789 Secure token cache #1012

sfc-gh-astachowski · 2025-02-18T08:22:33Z

No description provided.

lib/authentication/secure_storage/json_credential_manager.js

lib/file_util.js

sfc-gh-pmotacki · 2025-03-07T08:40:51Z

lib/file_util.js

+    const permission = mode & 0o777;
+
+    //This should be 600 permission, which means the file permission has not been changed by others.
+    const octalPermissions = permission.toString(8);


Isn't it duplication of validateOnlyUserReadWritePermissionAndOwner method?

It is very similar, but operates on file handles in order to mitigate any manipulations between our checks and operations. validateOnlyUserReadWritePermissionAndOwner should probably be replaced with this later on, but I didn't want to do it in this PR. See https://snowflakecomputing.atlassian.net/browse/SNOW-1944224

The issue you attached doesn't address the migration of control for configuration files. Do we need to create a new issue?

test/integration/testCache.js

test/unit/authentication/json_credential_manager_test.js

codecov · 2025-03-07T10:50:33Z

Codecov Report

Attention: Patch coverage is 83.33333% with 27 lines in your changes missing coverage. Please review.

Project coverage is 88.98%. Comparing base (4c38215) to head (669e214).
Report is 40 commits behind head on master.

Files with missing lines	Patch %	Lines
...tication/secure_storage/json_credential_manager.js	83.21%	23 Missing ⚠️
lib/file_util.js	82.60%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1012      +/-   ##
==========================================
+ Coverage   88.85%   88.98%   +0.12%     
==========================================
  Files          73       73              
  Lines        7034     7151     +117     
==========================================
+ Hits         6250     6363     +113     
- Misses        784      788       +4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

sfc-gh-jszczerbinski · 2025-03-18T14:05:05Z

lib/authentication/secure_storage/json_credential_manager.js

+      if (!Util.exists(cacheStat)) {
+        const options = { recursive: true };
+        if (process.platform !== 'win32') {
+          options.mode = 0o700;


We are using here 0o700 permissions and recursive. This is problematic since for example:

0o700 is too narrow for $HOME/.cache directory (this directory has usually 0755 on mac and linux systems)

Fair, changed to creating recursively with 0o755, then changing the final directory's permission to 0o700

sfc-gh-jszczerbinski · 2025-03-18T14:05:34Z

lib/authentication/secure_storage/json_credential_manager.js

+        await fs.mkdir(cacheDir, options);
+        return true;
+      } else {
+        if (!stat.isDirectory()) {


stat or cacheStat?

Good catch, fixed

sfc-gh-jszczerbinski · 2025-03-18T14:05:51Z

lib/authentication/secure_storage/json_credential_manager.js

+        if (process.platform === 'win32') {
+          return true;
+        }
+        if ((cacheStat.mode & 0o777) === 0o700) {


We should also check owner

sfc-gh-jszczerbinski · 2025-03-18T14:10:48Z

lib/authentication/secure_storage/json_credential_manager.js

+      candidates.push({ folder: credentialCacheDir, subfolders: [] });
+    }
+    const sfTemp = process.env.SF_TEMPORARY_CREDENTIAL_CACHE_DIR;
+    if (Util.exists(sfTemp)) {


Checking if this exists seems like redundant code. Can we do it in tryTokenDir?

sfc-gh-jszczerbinski · 2025-03-18T14:15:01Z

lib/file_util.js

+    const permission = mode & 0o777;
+
+    //This should be 600 permission, which means the file permission has not been changed by others.
+    const octalPermissions = permission.toString(8);


Why convert it to string? just compare with octal value?

This was copied from an analogous function, fixed

sfc-gh-jszczerbinski · 2025-03-18T14:19:13Z

lib/authentication/secure_storage/json_credential_manager.js

-    await validateOnlyUserReadWritePermissionAndOwner(tokenCacheFile);
-    return tokenCacheFile;
+    const tokenCacheFile = path.join(tokenDir, 'credential_cache_v1.json');
+    return [await getSecureHandle(tokenCacheFile, fs.constants.O_RDWR | fs.constants.O_CREAT, fs), tokenCacheFile];


I have an issue with how this function is used and O_CREAT flag. It seems to me that it will create cache file (empty one) during read-only operations (retrieving key), and creating file lock

Good point, changed

sfc-gh-jszczerbinski · 2025-03-18T14:21:56Z

lib/authentication/secure_storage/json_credential_manager.js

+      Logger.getInstance().warn('Could not acquire lock on cache file %s', file);
+      return null;
+    }
+    const res = await fun(fileHandle, file);


Nit: Can you more the file locking functionality to a seperate object/functions? I would like this function to look similar to this:

const lck = lockFile() const res = func(fileHandle, file) lck.unlock()

Changed it a bit, is this better?

sfc-gh-jszczerbinski · 2025-03-18T14:23:44Z

lib/authentication/secure_storage/json_credential_manager.js

+      candidates.push({ folder: xdgCache, subfolders: ['snowflake'] });
+    }
+    const home = process.env.HOME;
+    switch (process.platform) {


Nit: it's hard to see what's returned for each system. Can you do it like this

switch(proces.platform) { case 'win32': return [ ... ] case 'linux': return [ ... ] case 'darwin': return [ ... ] }

Didn't do exactly that, but without the null/undefined checks the function is much more readable now

sfc-gh-jszczerbinski · 2025-03-18T14:25:08Z

lib/authentication/secure_storage/json_credential_manager.js

+        return false;
+      }
+      const cacheStat = await fs.lstat(cacheDir).catch((err) => {
+        if (err.code !== 'ENOENT') {


Maybe create dir here when ENOENT? Then stat it again and recover from error?

Good point, changed that

lib/authentication/secure_storage/json_credential_manager.js

sfc-gh-snowflakedb-snyk-sa · 2025-03-21T07:57:35Z

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

lib/authentication/secure_storage/json_credential_manager.js

sfc-gh-pmotacki

One new comment to create follow-up issue.
Code LGTM.

sfc-gh-jszczerbinski

Looks good, but please look at the comments before merging

lib/authentication/secure_storage/json_credential_manager.js

sfc-gh-jszczerbinski · 2025-03-25T12:00:37Z

lib/authentication/secure_storage/json_credential_manager.js

      if (!Util.exists(jsonCredential[tokenMapKey])) {
        jsonCredential[tokenMapKey] = {};
      }
      jsonCredential[tokenMapKey][keyHash] = token;

      try {
-        const flag = Util.exists(fileHandle) ? fs.constants.O_RDWR | fs.constants.O_CREAT : fs.constants.O_WRONLY;
+        const flag = Util.exists(fileHandle) ? fs.constants.O_WRONLY : fs.constants.O_RDWR | fs.constants.O_CREAT;


Why ternary? isn't it always O_RDWR | O_CREAT?

lib/authentication/secure_storage/json_credential_manager.js

Secure token cache

d72bac3

sfc-gh-astachowski requested a review from a team as a code owner February 18, 2025 08:22

sfc-gh-astachowski added 28 commits February 18, 2025 09:22

Merge branch 'master' into SNOW-1825789-secure-token-cache

89e3b4b

Test fixes

ada2872

Disable tests on windows

f638e60

Enable tests on windows

c9c6bd6

Diagnostic logs

a431cb8

Potential windows fix

770e3b1

More logs

7e3dc4f

Attempted fix

dcc6d2e

Added error log

d51750d

Windows fix

b0c0752

Fixes

1c3dc35

Extra logging

f813df5

Improved logging

9cb1c16

Improved logging

03e376f

Added more logging

800a58a

Test fixes

47a684a

Test fixes

7f4afd4

Further test fixes

ef6e428

Added even more logs

d279ca6

Change to util exists

52a088c

Improved cleanup

43e1040

More logs

6d49ccf

More logs

1778e9f

Fixes, cleanup

7a1b31d

Merge branch 'master' into SNOW-1825789-secure-token-cache

c99010b

Sym link fix

cdc5484

Added key hashing

3ba209a

Switched to file handles

948cd27

sfc-gh-astachowski added 5 commits February 28, 2025 09:02

Handle closing fix

3097c53

Change error handling

c036882

Change flags to use NOFOLLOW

f2ea3b3

Force cleanup

a24a749

Close file handles in tests

50e7e39

sfc-gh-pmotacki reviewed Mar 7, 2025

View reviewed changes

sfc-gh-astachowski added 3 commits March 7, 2025 10:52

Review improvements

25f6ccb

Fix imports

86fd21b

Merge branch 'master' into SNOW-1825789-secure-token-cache

3514cd7

sfc-gh-astachowski added 4 commits March 10, 2025 09:34

Permission fixes

81a56df

Add directory check

24995a4

Remove anti-symlink flag

3048378

Remove chmod

0140865

sfc-gh-jszczerbinski requested changes Mar 18, 2025

View reviewed changes

Review fixes

76462a5

Removed unused import

1d15e2e

sfc-gh-pmotacki reviewed Mar 21, 2025

View reviewed changes

Review feedback

380c2f0

sfc-gh-pmotacki approved these changes Mar 25, 2025

View reviewed changes

sfc-gh-jszczerbinski approved these changes Mar 25, 2025

View reviewed changes

Flag changes

cf9b613

sfc-gh-pmotacki reviewed Mar 25, 2025

View reviewed changes

lib/authentication/secure_storage/json_credential_manager.js Outdated Show resolved Hide resolved

sfc-gh-astachowski added 2 commits March 25, 2025 16:17

Removed duplicated code

55a6b4b

Extract retry interval to a constant

aed35d0

This comment was marked as outdated.

Sign in to view

sfc-gh-ext-simba-jy reviewed Mar 26, 2025

View reviewed changes

lib/authentication/secure_storage/json_credential_manager.js Show resolved Hide resolved

sfc-gh-astachowski and others added 2 commits March 31, 2025 13:16

Review improvements

29c74f2

Merge branch 'master' into SNOW-1825789-secure-token-cache

669e214

SNOW-1825789 Secure token cache #1012

Are you sure you want to change the base?

SNOW-1825789 Secure token cache #1012

Conversation

sfc-gh-astachowski commented Feb 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Mar 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sfc-gh-snowflakedb-snyk-sa commented Mar 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎉 Snyk checks have passed. No issues have been found so far.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sfc-gh-pmotacki left a comment

Choose a reason for hiding this comment

Uh oh!

sfc-gh-jszczerbinski left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 7, 2025 •

edited

Loading

sfc-gh-snowflakedb-snyk-sa commented Mar 21, 2025 •

edited

Loading