Spaces:
Running on CPU Upgrade
Running on CPU Upgrade
| """Private per-origin, per-paper credential files. Secrets never enter edit documents.""" | |
| import hashlib | |
| import json | |
| import os | |
| from pathlib import Path | |
| import stat | |
| import tempfile | |
| from pwc_cli.transport import ResponseError | |
| class CredentialStore: | |
| def __init__(self, base_url: str): | |
| self.base_url = base_url | |
| self.root = Path.home() / ".config" / "pwc" / "edit-credentials" | |
| def path(self, paper_id: int) -> Path: | |
| key = hashlib.sha256(f"{self.base_url}:{paper_id}".encode()).hexdigest() | |
| return self.root / f"{key}.json" | |
| def save(self, paper_id: int, credential: dict) -> None: | |
| self.root.mkdir(parents=True, exist_ok=True, mode=0o700) | |
| info = self.root.lstat() | |
| if ( | |
| not stat.S_ISDIR(info.st_mode) | |
| or info.st_uid != os.getuid() | |
| or info.st_mode & 0o077 | |
| ): | |
| raise ResponseError( | |
| "Credential directory must be owned by you with mode 0700" | |
| ) | |
| fd, name = tempfile.mkstemp(dir=self.root) | |
| try: | |
| with os.fdopen(fd, "w") as handle: | |
| json.dump({**credential, "base_url": self.base_url}, handle) | |
| os.replace(name, self.path(paper_id)) | |
| finally: | |
| if os.path.exists(name): | |
| os.unlink(name) | |
| def load(self, paper_id: int) -> dict: | |
| path = self.path(paper_id) | |
| try: | |
| fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW) | |
| except FileNotFoundError as error: | |
| raise ResponseError( | |
| "No authorization for this paper and API. Run pwc auth login --paper PAPER" | |
| ) from error | |
| with os.fdopen(fd) as handle: | |
| info = os.fstat(handle.fileno()) | |
| if ( | |
| not stat.S_ISREG(info.st_mode) | |
| or info.st_uid != os.getuid() | |
| or info.st_mode & 0o077 | |
| ): | |
| raise ResponseError( | |
| "Credential file must be owned by you with mode 0600" | |
| ) | |
| value = json.load(handle) | |
| if value.get("base_url") != self.base_url or value.get("paper_id") != paper_id: | |
| raise ResponseError("Credential origin or paper does not match") | |
| return value | |
| def remove(self, paper_id: int) -> None: | |
| self.path(paper_id).unlink(missing_ok=True) | |