File size: 5,015 Bytes
7a1ad33 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 | /**
* @license
* Copyright 2026 Google LLC
* SPDX-License-Identifier: Apache-2.0
*/
import { promises as fs } from 'node:fs';
import * as path from 'node:path';
import * as os from 'node:os';
import * as crypto from 'node:crypto';
import type { Keychain } from './keychainTypes.js';
import { GEMINI_DIR, homedir } from '../utils/paths.js';
export class FileKeychain implements Keychain {
private readonly tokenFilePath: string;
private readonly encryptionKey: Buffer;
constructor() {
const configDir = path.join(homedir(), GEMINI_DIR);
this.tokenFilePath = path.join(configDir, 'gemini-credentials.json');
this.encryptionKey = this.deriveEncryptionKey();
}
private deriveEncryptionKey(): Buffer {
const salt = `${os.hostname()}-${os.userInfo().username}-gemini-cli`;
return crypto.scryptSync('gemini-cli-oauth', salt, 32);
}
private encrypt(text: string): string {
const iv = crypto.randomBytes(12);
const cipher = crypto.createCipheriv(
'aes-256-gcm',
this.encryptionKey,
iv,
{
authTagLength: 16,
},
);
let encrypted = cipher.update(text, 'utf8', 'hex');
encrypted += cipher.final('hex');
const authTag = cipher.getAuthTag();
return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted;
}
private decrypt(encryptedData: string): string {
const parts = encryptedData.split(':');
if (parts.length !== 3) {
throw new Error('Invalid encrypted data format');
}
const iv = Buffer.from(parts[0], 'hex');
const authTag = Buffer.from(parts[1], 'hex');
const encrypted = parts[2];
if (iv.length !== 12 && iv.length !== 16) {
throw new Error('Invalid IV length: Must be 12 or 16 bytes');
}
if (authTag.length !== 16) {
throw new Error('Invalid authentication tag length: Must be 16 bytes');
}
const decipher = crypto.createDecipheriv(
'aes-256-gcm',
this.encryptionKey,
iv,
{ authTagLength: 16 },
);
decipher.setAuthTag(authTag);
let decrypted = decipher.update(encrypted, 'hex', 'utf8');
decrypted += decipher.final('utf8');
return decrypted;
}
private async ensureDirectoryExists(): Promise<void> {
const dir = path.dirname(this.tokenFilePath);
await fs.mkdir(dir, { recursive: true, mode: 0o700 });
}
private async loadData(): Promise<Record<string, Record<string, string>>> {
let data: string;
try {
data = await fs.readFile(this.tokenFilePath, 'utf-8');
} catch (error: unknown) {
// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
const err = error as NodeJS.ErrnoException;
if (err.code === 'ENOENT') {
return {};
}
throw error;
}
try {
const decrypted = this.decrypt(data);
// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
return JSON.parse(decrypted) as Record<string, Record<string, string>>;
} catch {
throw new Error(
`Corrupted credentials file detected at: ${this.tokenFilePath}\n` +
`Please delete or rename this file to resolve the issue.`,
);
}
}
private async saveData(
data: Record<string, Record<string, string>>,
): Promise<void> {
await this.ensureDirectoryExists();
const json = JSON.stringify(data, null, 2);
const encrypted = this.encrypt(json);
await fs.writeFile(this.tokenFilePath, encrypted, { mode: 0o600 });
}
async getPassword(service: string, account: string): Promise<string | null> {
const data = await this.loadData();
return data[service]?.[account] ?? null;
}
async setPassword(
service: string,
account: string,
password: string,
): Promise<void> {
const data = await this.loadData();
if (!data[service]) {
data[service] = {};
}
data[service][account] = password;
await this.saveData(data);
}
async deletePassword(service: string, account: string): Promise<boolean> {
const data = await this.loadData();
if (data[service] && account in data[service]) {
delete data[service][account];
if (Object.keys(data[service]).length === 0) {
delete data[service];
}
if (Object.keys(data).length === 0) {
try {
await fs.unlink(this.tokenFilePath);
} catch (error: unknown) {
// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
const err = error as NodeJS.ErrnoException;
if (err.code !== 'ENOENT') {
throw error;
}
}
} else {
await this.saveData(data);
}
return true;
}
return false;
}
async findCredentials(
service: string,
): Promise<Array<{ account: string; password: string }>> {
const data = await this.loadData();
const serviceData = data[service] || {};
return Object.entries(serviceData).map(([account, password]) => ({
account,
password,
}));
}
}
|