mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
9d7cf5aca2
## Summary - Cross-platform OS credential storage package for the Composio CLI, structurally modeled on [keyring-rs](https://github.com/open-source-cooperative/keyring-rs) - **macOS FFI backend**: direct `SecItemCopyMatching` via `bun:ffi` — **~1.4ms median reads** (vs 22ms subprocess). Writes delegate to `/usr/bin/security -A` for reliable allow-any ACL - **macOS subprocess fallback**: `/usr/bin/security` for Node/test environments - **Linux backend**: `secret-tool` subprocess with keyring-rs-compatible attribute keys (`{service, username, target}`) - All pointers as `bigint` (`FFIType.u64`) to handle CoreFoundation tagged pointers above `2^53` - `b64:` prefix encoding for cross-backend binary safety - 11-variant `KeyringError` discriminated union matching `keyring-core`'s error model - Effect.ts integration via `@composio/cli-keyring/effect` subpath export (optional peer dep) - `dangerouslySaveApiKeyInUserConfig` escape hatch designed for the CLI migration PR (next in stack) ## Benchmark (100 iterations, Apple Silicon) | operation | subprocess | FFI | speedup | |---|---|---|---| | `getPassword` p50 | 19.95ms | **1.14ms** | **18×** | | `getPassword` p99 | 88.72ms | **7.39ms** | **12×** | ## Test plan - [x] 16 unit tests (errors, entry, shared encoding) — Node vitest - [x] 4 E2E tests against real macOS keychain — gated on `COMPOSIO_KEYRING_E2E=1` - [x] 6 FFI-specific tests — gated on `typeof Bun !== 'undefined'` + E2E flag - [x] `publint` + `attw` clean - [x] `bun build --compile` produces working standalone binary with FFI reads 🤖 Generated with [Claude Code](https://claude.com/claude-code) **Stack: 1/2** — next PR: `cli/keyring-migration` (wires this into the CLI) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
68 lines
2.1 KiB
TypeScript
68 lines
2.1 KiB
TypeScript
/**
|
|
* Real-keystore roundtrip test.
|
|
*
|
|
* Gated behind `COMPOSIO_KEYRING_E2E=1` so CI and the default
|
|
* `pnpm test` run don't touch the user's keychain. Run locally with:
|
|
*
|
|
* COMPOSIO_KEYRING_E2E=1 pnpm --filter @composio/cli-keyring test
|
|
*
|
|
* Each test uses a UUID-suffixed service name so parallel runs (and
|
|
* leftover entries from crashed runs) never collide with the user's
|
|
* real credentials.
|
|
*/
|
|
|
|
import { describe, it, expect, afterAll, beforeAll } from 'vitest';
|
|
import { randomUUID } from 'node:crypto';
|
|
import { Entry } from '../src/core/entry';
|
|
import { KeyringError } from '../src/core/errors';
|
|
import { createDefaultStore, setDefaultStore } from '../src/index';
|
|
|
|
const enabled = process.env.COMPOSIO_KEYRING_E2E === '1';
|
|
const suite = enabled ? describe : describe.skip;
|
|
|
|
suite('e2e: real OS keystore', () => {
|
|
beforeAll(async () => {
|
|
setDefaultStore(await createDefaultStore());
|
|
});
|
|
|
|
const service = `com.composio.cli.test.${randomUUID()}`;
|
|
const user = 'default';
|
|
const entry = new Entry(service, user);
|
|
|
|
afterAll(async () => {
|
|
try {
|
|
await entry.deleteCredential();
|
|
} catch (err) {
|
|
if (!(err instanceof KeyringError) || err.kind !== 'NoEntry') {
|
|
throw err;
|
|
}
|
|
}
|
|
});
|
|
|
|
it('roundtrips a password', async () => {
|
|
const password = `test-${randomUUID()}`;
|
|
await entry.setPassword(password);
|
|
expect(await entry.getPassword()).toBe(password);
|
|
});
|
|
|
|
it('overwrites on repeated setPassword', async () => {
|
|
await entry.setPassword('first');
|
|
await entry.setPassword('second');
|
|
expect(await entry.getPassword()).toBe('second');
|
|
});
|
|
|
|
it('delete then get throws NoEntry', async () => {
|
|
await entry.setPassword('x');
|
|
await entry.deleteCredential();
|
|
await expect(entry.getPassword()).rejects.toSatisfy(
|
|
(err: unknown) => err instanceof KeyringError && err.kind === 'NoEntry'
|
|
);
|
|
});
|
|
|
|
it('roundtrips binary bytes', async () => {
|
|
const bytes = new Uint8Array([0, 1, 2, 3, 255, 254, 253]);
|
|
await entry.setSecret(bytes);
|
|
expect(Array.from(await entry.getSecret())).toEqual(Array.from(bytes));
|
|
});
|
|
});
|