SNOW-1825789 Secure token cache

lib/authentication/secure_storage/json_credential_manager.js

@@ -1,87 +1,257 @@
 const path = require('path');
 const Logger = require('../../logger');
 const fs = require('node:fs/promises');
-const os = require('os');
 const Util = require('../../util');
-const { validateOnlyUserReadWritePermissionAndOwner } = require('../../file_util');
+const os = require('os');
+const crypto = require('crypto');
+const { getSecureHandle, closeHandle } = require('../../file_util');
+
+const defaultJsonTokenCachePaths = {
+  'win32': ['AppData', 'Local', 'Snowflake', 'Caches'],
+  'linux': ['.cache', 'snowflake'],
+  'darwin': ['Library', 'Caches', 'Snowflake']
+};
+
+function JsonCredentialManager(credentialCacheDir, timeoutMs = 60000) {
+  const tokenMapKey = 'tokens';
+  const retryInterval = 100;
+
+  this.hashKey = function (key) {
+    return crypto.createHash('sha256').update(key).digest('hex');
+  };
+
+  this.getTokenDirCandidates = function () {
+    const candidates = [];
+    candidates.push({ folder: credentialCacheDir, subfolders: [] });
+
+    candidates.push({ folder: process.env.SF_TEMPORARY_CREDENTIAL_CACHE_DIR, subfolders: [] });
+
+    switch (process.platform) {
+    case 'win32':
+      candidates.push({ folder: os.homedir(), subfolders: defaultJsonTokenCachePaths['win32'] });
+      break;
+    case 'linux':
+      candidates.push({ folder: process.env.XDG_CACHE_HOME, subfolders: ['snowflake'] });
+      candidates.push({ folder: process.env.HOME, subfolders: defaultJsonTokenCachePaths['linux'] });
+      break;
+    case 'darwin':
+      candidates.push({ folder: process.env.HOME, subfolders: defaultJsonTokenCachePaths['darwin'] });
+    }
+    return candidates;
+  };
+
+  this.createCacheDir = async function (cacheDir) {
+    const options = { recursive: true };
+    if (process.platform !== 'win32') {
+      options.mode = 0o755;
+    }
+    await fs.mkdir(cacheDir, options);
+    if (process.platform !== 'win32') {
+      await fs.chmod(cacheDir, 0o700);
+    }
+  };
+
+  this.tryTokenDir = async function (dir, subDirs) {
+    if (!Util.exists(dir)) {
+      return false;
+    }
+    const cacheDir = path.join(dir, ...subDirs);
+    try {
+      const stat = await fs.stat(dir);
+      if (!stat.isDirectory()) {
+        Logger.getInstance().info(`Path ${dir} is not a directory`);
+        return false;
+      }
+      const cacheStat = await fs.stat(cacheDir).catch(async (err) => {
+        if (err.code !== 'ENOENT') {
+          throw err;
+        }
+        await this.createCacheDir(cacheDir);
+        return await fs.stat(cacheDir);
+      });
+      if (!cacheStat.isDirectory()) {
+        return false;
+      }
+      if (process.platform === 'win32') {
+        return true;
+      }
+      if ((cacheStat.mode & 0o777) !== 0o700 && cacheStat.uid === os.userInfo().uid) {
+        Logger.getInstance().warn(`Token cache directory ${cacheDir} has unsecure permissions.`);
+      }
+      if (cacheStat.uid !== os.userInfo().uid) {
+        Logger.getInstance().warn(`Token cache directory ${cacheDir} has unsecure owner.`);
+      }
+      return true;
+    } catch (err) {
+      Logger.getInstance().warn(`The path location ${cacheDir} is invalid. Please check this location is accessible or existing`);
+      return false;
+    }
+  };
 
-function JsonCredentialManager(credentialCacheDir) {
-
   this.getTokenDir = async function () {
-    let tokenDir = credentialCacheDir;
-    if (!Util.exists(tokenDir)) {
-      tokenDir = os.homedir();
-    } else {
-      Logger.getInstance().info(`The credential cache directory is configured by the user. The token will be saved at ${tokenDir}`);
+    const candidates = this.getTokenDirCandidates();
+    for (const candidate of candidates) {
+      const { folder: dir, subfolders: subDirs } = candidate;
+      if (await this.tryTokenDir(dir, subDirs)) {
+        return path.join(dir, ...subDirs);
+      }
     }
+    return null;
+  };
+
+  this.getTokenFilePath = async function () {
+    const tokenDir = await this.getTokenDir();
 
     if (!Util.exists(tokenDir)) {
-      throw new Error(`Temporary credential cache directory is invalid, and the driver is unable to use the default location(home). 
+      throw new Error(`Temporary credential cache directory is invalid, and the driver is unable to use the default location. 
       Please set 'credentialCacheDir' connection configuration option to enable the default credential manager.`);
     }
 
-    const tokenCacheFile = path.join(tokenDir, 'temporary_credential.json');
-    await validateOnlyUserReadWritePermissionAndOwner(tokenCacheFile);
-    return tokenCacheFile;
+    return path.join(tokenDir, 'credential_cache_v1.json');
   };
 
-  this.readJsonCredentialFile = async function () {
+  this.readJsonCredentialFile = async function (fileHandle) {
+    if (!Util.exists(fileHandle)) {
+      return null;
+    }
     try {
-      const cred = await fs.readFile(await this.getTokenDir(), 'utf8');
+      const cred = await fileHandle.readFile('utf8');
       return JSON.parse(cred);
     } catch (err) {
       Logger.getInstance().warn('Failed to read token data from the file. Err: %s', err.message);
       return null;
     }
   };
+
+  this.removeStale = async function (file) {
+    const stat = await fs.stat(file).catch(() => {
+      return undefined;
+    });
+    if (!Util.exists(stat)) {
+      return;
+    }
+    if (new Date().getTime() - stat.birthtimeMs > timeoutMs) {
+      try {
+        await fs.rmdir(file);
+      } catch (err) {
+        Logger.getInstance().warn('Failed to remove stale file. Error: %s', err.message);
+      }
+    }
+
+  };
+
+  this.lockFile = async function (filename) {
+    const lckFile = filename + '.lck';
+    await this.removeStale(lckFile);
+    let attempts = 1;
+    let locked = false;
+    const options = {};
+    if (process.platform !== 'win32') {
+      options.mode = 0o600;
+    }
+    while (attempts <= 10) {
+      Logger.getInstance().debug('Attempting to get a lock on file %s, attempt: %d', filename, attempts);
+      attempts++;
+      await fs.mkdir(lckFile, options).then(() => {
+        locked = true;
+      }, () => {});
+      if (locked) {
+        break;
+      }
+      await new Promise(resolve => setTimeout(resolve, retryInterval));
+    }
+    if (!locked) {
+      Logger.getInstance().warn('Could not acquire lock on cache file %s', filename);
+    }
+    return locked;
+  };
+
+  this.unlockFile = async function (filename) {
+    const lckFile = filename + '.lck';
+    await fs.rmdir(lckFile);
+  };
+
+  this.withFileLocked = async function (fun) {
+    const filename = await this.getTokenFilePath();
+    if (await this.lockFile(filename)) {
+      const res = await fun(filename);
+      await this.unlockFile(filename);
+      return res;
+    }
+    return null;
+  };
 
   this.write = async function (key, token) {
     if (!validateTokenCacheOption(key)) {
       return null;
     }
-
-    const jsonCredential = await this.readJsonCredentialFile() || {};
-    jsonCredential[key] = token;
-
-    try {
-      await fs.writeFile(await this.getTokenDir(), JSON.stringify(jsonCredential), { mode: 0o600 });
-    } catch (err) {
-      throw new Error(`Failed to write token data. Please check the permission or the file format of the token. ${err.message}`);
-    }
+    const keyHash = this.hashKey(key);
+
+    await this.withFileLocked(async (filename) => {
+      const fileHandle = await getSecureHandle(filename, fs.constants.O_RDWR | fs.constants.O_CREAT, fs);
+      const jsonCredential = await this.readJsonCredentialFile(fileHandle) || {};
+      if (!Util.exists(jsonCredential[tokenMapKey])) {
+        jsonCredential[tokenMapKey] = {};
+      }
+      jsonCredential[tokenMapKey][keyHash] = token;
+
+      try {
+        await fileHandle.truncate();
+        await fileHandle.write(JSON.stringify(jsonCredential), 0);
+        await closeHandle(fileHandle);
+      } catch (err) {
+        Logger.getInstance().warn(`Failed to write token data in ${filename}. Please check the permission or the file format of the token. ${err.message}`);
+      }
+    });
   };
 
   this.read = async function (key) {
     if (!validateTokenCacheOption(key)) {
       return null;
     }
 
-    const jsonCredential = await this.readJsonCredentialFile();
-    if (!!jsonCredential && jsonCredential[key]){
-      return jsonCredential[key];
-    } else {
-      return null;
-    }
+    const keyHash = this.hashKey(key);
+
+    return await this.withFileLocked(async (filename) => {
+      const fileHandle = await getSecureHandle(filename, fs.constants.O_RDWR, fs);
+      const jsonCredential = await this.readJsonCredentialFile(fileHandle);
+      await closeHandle(fileHandle);
+      if (!!jsonCredential && jsonCredential[tokenMapKey] && jsonCredential[tokenMapKey][keyHash]) {
+        return jsonCredential[tokenMapKey][keyHash];
+      } else {
+        return null;
+      }
+    });
   };
 
   this.remove = async function (key) {
     if (!validateTokenCacheOption(key)) {
       return null;
     }
-    const jsonCredential = await this.readJsonCredentialFile();
-
-    if (jsonCredential && jsonCredential[key]) {
-      try {
-        jsonCredential[key] = null;
-        await fs.writeFile(await this.getTokenDir(), JSON.stringify(jsonCredential), { mode: 0o600 });
-      } catch (err) {
-        throw new Error(`Failed to write token data from the file in ${await this.getTokenDir()}. Please check the permission or the file format of the token. ${err.message}`);
-      } 
-    }
+
+    const keyHash = this.hashKey(key);
+
+    await this.withFileLocked(async (filename) => {
+      const fileHandle = await getSecureHandle(filename, fs.constants.O_RDWR, fs);
+      const jsonCredential = await this.readJsonCredentialFile(fileHandle);
+
+      if (jsonCredential && jsonCredential[tokenMapKey] && jsonCredential[tokenMapKey][keyHash]) {
+        try {
+          jsonCredential[tokenMapKey][keyHash] = null;
+          await fileHandle.truncate();
+          await fileHandle.write(JSON.stringify(jsonCredential), 0);
+          await closeHandle(fileHandle);
+        } catch (err) {
+          Logger.getInstance().warn(`Failed to remove token data from the file in ${filename}. Please check the permission or the file format of the token. ${err.message}`);
+        }
+      }
+    });
   };
 
   function validateTokenCacheOption(key) {
     return Util.checkParametersDefined(key); 
   }
 }
 
-module.exports = JsonCredentialManager;
+module.exports.defaultJsonTokenCachePaths = defaultJsonTokenCachePaths;
+module.exports.JsonCredentialManager = JsonCredentialManager;

lib/connection/connection.js

@@ -16,7 +16,7 @@ const Logger = require('../logger');
 const { isOktaAuth } = require('../authentication/authentication');
 const { init: initEasyLogging } = require('../logger/easy_logging_starter');
 const GlobalConfig = require('../global_config');
-const JsonCredentialManager = require('../authentication/secure_storage/json_credential_manager');
+const { JsonCredentialManager } = require('../authentication/secure_storage/json_credential_manager');
 const ExecutionTimer = require('../logger/execution_timer');
 
 /**

lib/file_util.js

@@ -183,6 +183,54 @@
   }
 };
 
+/**
+ * Checks if the provided file is writable only by the user and os tha file owner is the same as os user. FsPromises can be provided.
+ * @param filePath
+ * @param expectedMode
+ * @param fsPromises
+ * @returns {Promise<FileHandle>}
+ */
+exports.getSecureHandle = async function (filePath, flags, fsPromises) {
+  const fsp = fsPromises ? fsPromises : require('fs/promises');
+  try {
+    const fileHandle = await fsp.open(filePath, flags, 0o600);
+    if (os.platform() === 'win32') {
+      return fileHandle;
+    }
+    const stats = await fileHandle.stat();
+    const mode = stats.mode;
+    const permission = mode & 0o777;
+
+    //This should be 600 permission, which means the file permission has not been changed by others.
+    if (permission === 0o600) {
+      Logger.getInstance().debug(`Validated that the user has only read and write permission for file: ${filePath}, Permission: ${permission}`);
+    } else {
+      throw new Error(`Invalid file permissions (${permission.toString(8)} for file ${filePath}). Make sure you have read and write permissions and other users do not have access to it. Please remove the file and re-run the driver.`);
+    }
+
+    const userInfo = os.userInfo();
+    if (stats.uid === userInfo.uid) {
+      Logger.getInstance().debug('Validated file owner');
+    } else {
+      throw new Error(`Invalid file owner for file ${filePath}). Make sure the system user are the owner of the file otherwise please remove the file and re-run the driver.`);
+    }
+    return fileHandle;
+  } catch (err) {
+    //When file doesn't exist - return
+    if (err.code === 'ENOENT') {
+      return null;
+    } else {
+      throw err;
+    }
+  }
+};
+
+exports.closeHandle = async function (fileHandle) {
+  if (fileHandle !== undefined && fileHandle !== null) {
+    await fileHandle.close();
+  }
+};
+
 /**
  * Checks if the provided file or directory permissions are correct.
  * @param filePath