mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
9d7cf5aca2
## Summary - Cross-platform OS credential storage package for the Composio CLI, structurally modeled on [keyring-rs](https://github.com/open-source-cooperative/keyring-rs) - **macOS FFI backend**: direct `SecItemCopyMatching` via `bun:ffi` — **~1.4ms median reads** (vs 22ms subprocess). Writes delegate to `/usr/bin/security -A` for reliable allow-any ACL - **macOS subprocess fallback**: `/usr/bin/security` for Node/test environments - **Linux backend**: `secret-tool` subprocess with keyring-rs-compatible attribute keys (`{service, username, target}`) - All pointers as `bigint` (`FFIType.u64`) to handle CoreFoundation tagged pointers above `2^53` - `b64:` prefix encoding for cross-backend binary safety - 11-variant `KeyringError` discriminated union matching `keyring-core`'s error model - Effect.ts integration via `@composio/cli-keyring/effect` subpath export (optional peer dep) - `dangerouslySaveApiKeyInUserConfig` escape hatch designed for the CLI migration PR (next in stack) ## Benchmark (100 iterations, Apple Silicon) | operation | subprocess | FFI | speedup | |---|---|---|---| | `getPassword` p50 | 19.95ms | **1.14ms** | **18×** | | `getPassword` p99 | 88.72ms | **7.39ms** | **12×** | ## Test plan - [x] 16 unit tests (errors, entry, shared encoding) — Node vitest - [x] 4 E2E tests against real macOS keychain — gated on `COMPOSIO_KEYRING_E2E=1` - [x] 6 FFI-specific tests — gated on `typeof Bun !== 'undefined'` + E2E flag - [x] `publint` + `attw` clean - [x] `bun build --compile` produces working standalone binary with FFI reads 🤖 Generated with [Claude Code](https://claude.com/claude-code) **Stack: 1/2** — next PR: `cli/keyring-migration` (wires this into the CLI) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
37 lines
1.3 KiB
TypeScript
37 lines
1.3 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { encodeSecret, decodeSecret } from '../src/stores/shared';
|
|
|
|
describe('shared encoding', () => {
|
|
it('roundtrips arbitrary bytes through base64 with the b64: prefix', () => {
|
|
const inputs: Uint8Array[] = [
|
|
new Uint8Array(),
|
|
new Uint8Array([0]),
|
|
new Uint8Array([1, 2, 3, 4, 5]),
|
|
new Uint8Array([0xff, 0xfe, 0xfd]),
|
|
new Uint8Array(Buffer.from('plain string', 'utf8')),
|
|
new Uint8Array(Buffer.from('password with spaces\nand newline', 'utf8')),
|
|
// 1 KiB of pseudo-random data
|
|
crypto.getRandomValues(new Uint8Array(1024)),
|
|
];
|
|
for (const bytes of inputs) {
|
|
const encoded = encodeSecret(bytes);
|
|
expect(encoded.startsWith('b64:')).toBe(true);
|
|
const decoded = decodeSecret(encoded);
|
|
expect(Array.from(decoded)).toEqual(Array.from(bytes));
|
|
}
|
|
});
|
|
|
|
it('tolerates a trailing newline from CLI stdout', () => {
|
|
const encoded = encodeSecret(new Uint8Array([1, 2, 3]));
|
|
expect(Array.from(decodeSecret(encoded + '\n'))).toEqual([1, 2, 3]);
|
|
});
|
|
|
|
it('rejects blobs without the b64: prefix', () => {
|
|
expect(() => decodeSecret('no-prefix-here')).toThrowError();
|
|
});
|
|
|
|
it('rejects blobs with non-base64 characters after the prefix', () => {
|
|
expect(() => decodeSecret('b64:!!!not-base64!!!')).toThrowError();
|
|
});
|
|
});
|