test-credential-backends.yml

name: Test Credential Backends
on:
  pull_request:
    paths:
      - src/lib/**
      - src/commands/auth/**
      - tests/lib/**
      - tests/commands/auth/**
      - .github/workflows/test-credential-backends.yml
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: test-credential-backends-${{ github.ref }}
  cancel-in-progress: true
jobs:
  # ── Cross-platform vitest run for credential file plumbing ───
  # The main test workflow runs Linux only. These jobs exercise the
  # file-lock, atomic-write, and auth flows on Windows and macOS too,
  # since POSIX-vs-NTFS semantics (inode reuse, rename, file locking)
  # have already produced one cross-platform regression in this area.
  config-tests:
    name: "Config tests (${{ matrix.os }})"
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile
      - run: pnpm test tests/lib/file-lock.test.ts tests/lib/write-file-atomic.test.ts tests/lib/config.test.ts tests/lib/config-async.test.ts tests/commands/auth/

  # ── Windows ──────────────────────────────────────────────
  win-passwordvault:
    name: "Windows: PasswordVault"
    runs-on: windows-latest
    timeout-minutes: 25
    strategy:
      matrix:
        shell: [powershell]
    defaults:
      run:
        shell: ${{ matrix.shell }}
    steps:
      - name: Test PasswordVault type loading
        run: |
          try {
            $v = New-Object Windows.Security.Credentials.PasswordVault
            Write-Host "PasswordVault: OK"
          } catch {
            Write-Host "PasswordVault: direct load failed, trying WinRT assembly - $_"
            try {
              [Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] | Out-Null
              $v = New-Object Windows.Security.Credentials.PasswordVault
              Write-Host "PasswordVault (WinRT load): OK"
            } catch {
              Write-Host "PasswordVault: FAILED - $_"
              exit 1
            }
          }
      - name: Test PasswordVault store and retrieve
        run: |
          try { [void](New-Object Windows.Security.Credentials.PasswordVault) } catch {
            [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
          }
          try {
            $v = New-Object Windows.Security.Credentials.PasswordVault
            $c = New-Object Windows.Security.Credentials.PasswordCredential('resend-cli-test', 'test-account', 're_test_key_123')
            $v.Add($c)
            Write-Host "Store: OK"

            $r = $v.Retrieve('resend-cli-test', 'test-account')
            $r.RetrievePassword()
            if ($r.Password -eq 're_test_key_123') {
              Write-Host "Retrieve: OK"
            } else {
              Write-Host "Retrieve: WRONG VALUE - got $($r.Password)"
              exit 1
            }

            $v.Remove($r)
            Write-Host "Delete: OK"
          } catch {
            Write-Host "PasswordVault round-trip: FAILED - $_"
            exit 1
          }
  win-credmanager:
    name: "Windows: Win32 CredManager (P/Invoke)"
    runs-on: windows-latest
    timeout-minutes: 30
    strategy:
      matrix:
        shell: [pwsh, powershell]
    defaults:
      run:
        shell: ${{ matrix.shell }}
    steps:
      - name: Test CredWrite + CredRead + CredDelete via P/Invoke
        run: |
          Add-Type -TypeDefinition @"
          using System;
          using System.Runtime.InteropServices;
          using System.Text;

          public class CredManager {
              [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
              private struct CREDENTIAL {
                  public int Flags;
                  public int Type;
                  public string TargetName;
                  public string Comment;
                  public long LastWritten;
                  public int CredentialBlobSize;
                  public IntPtr CredentialBlob;
                  public int Persist;
                  public int AttributeCount;
                  public IntPtr Attributes;
                  public string TargetAlias;
                  public string UserName;
              }

              [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
              private static extern bool CredWrite(ref CREDENTIAL cred, int flags);

              [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
              private static extern bool CredRead(string target, int type, int flags, out IntPtr credential);

              [DllImport("advapi32.dll", SetLastError = true)]
              private static extern bool CredDelete(string target, int type, int flags);

              [DllImport("advapi32.dll")]
              private static extern void CredFree(IntPtr buffer);

              public static void Write(string target, string user, string secret) {
                  byte[] bytes = Encoding.Unicode.GetBytes(secret);
                  CREDENTIAL cred = new CREDENTIAL();
                  cred.Type = 1; // CRED_TYPE_GENERIC
                  cred.TargetName = target;
                  cred.UserName = user;
                  cred.CredentialBlob = Marshal.AllocHGlobal(bytes.Length);
                  Marshal.Copy(bytes, 0, cred.CredentialBlob, bytes.Length);
                  cred.CredentialBlobSize = bytes.Length;
                  cred.Persist = 2; // CRED_PERSIST_LOCAL_MACHINE
                  try {
                      if (!CredWrite(ref cred, 0))
                          throw new Exception("CredWrite failed: " + Marshal.GetLastWin32Error());
                  } finally {
                      Marshal.FreeHGlobal(cred.CredentialBlob);
                  }
              }

              public static string Read(string target) {
                  IntPtr credPtr;
                  if (!CredRead(target, 1, 0, out credPtr))
                      return null;
                  try {
                      CREDENTIAL cred = (CREDENTIAL)Marshal.PtrToStructure(credPtr, typeof(CREDENTIAL));
                      return Marshal.PtrToStringUni(cred.CredentialBlob, cred.CredentialBlobSize / 2);
                  } finally {
                      CredFree(credPtr);
                  }
              }

              public static bool Delete(string target) {
                  return CredDelete(target, 1, 0);
              }
          }
          "@

          [CredManager]::Write("resend-cli:test-account", "test-account", "re_test_key_123")
          Write-Host "CredWrite: OK"

          $val = [CredManager]::Read("resend-cli:test-account")
          if ($val -eq "re_test_key_123") {
            Write-Host "CredRead: OK"
          } else {
            Write-Host "CredRead: FAILED - got '$val'"
            exit 1
          }

          $deleted = [CredManager]::Delete("resend-cli:test-account")
          if ($deleted) {
            Write-Host "CredDelete: OK"
          } else {
            Write-Host "CredDelete: FAILED"
            exit 1
          }

          $val2 = [CredManager]::Read("resend-cli:test-account")
          if ($val2 -eq $null) {
            Write-Host "Verify deleted: OK"
          } else {
            Write-Host "Verify deleted: FAILED - still exists"
            exit 1
          }
      - name: Test stdin piping to PowerShell
        shell: cmd
        run: |
          echo re_test_key_123 | powershell.exe -NoProfile -NonInteractive -Command "$secret = [System.Console]::ReadLine(); Write-Output $secret"
  win-cmdkey:
    name: "Windows: cmdkey"
    runs-on: windows-latest
    timeout-minutes: 15
    steps:
      - name: Test cmdkey store and list
        shell: cmd
        run: |
          cmdkey /generic:resend-cli-test /user:test-account /pass:re_test_key_123
          cmdkey /list:resend-cli-test
          cmdkey /delete:resend-cli-test
  # ── Linux ────────────────────────────────────────────────
  linux-secret-tool:
    name: "Linux: secret-tool (libsecret)"
    runs-on: depot-ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Install libsecret and gnome-keyring
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq libsecret-tools gnome-keyring dbus-x11
      - name: Test secret-tool store + lookup + clear
        run: |
          dbus-run-session -- bash -c '
            echo "" | gnome-keyring-daemon --unlock --components=secrets 2>/dev/null || true

            # Trigger D-Bus activation of the Secret Service (gnome-keyring-daemon
            # --unlock alone does not reliably register the service on the bus).
            dbus-send --session --print-reply --dest=org.freedesktop.secrets \
              /org/freedesktop/secrets org.freedesktop.DBus.Properties.Get \
              string:org.freedesktop.Secret.Service string:Collections >/dev/null 2>&1 || true

            echo -n "re_test_key_123" | secret-tool store --label="Resend CLI test" service resend-cli-test account test-account
            echo "Store: OK"

            val=$(secret-tool lookup service resend-cli-test account test-account)
            if [ "$val" = "re_test_key_123" ]; then
              echo "Lookup: OK"
            else
              echo "Lookup: FAILED - got $val"
              exit 1
            fi

            secret-tool clear service resend-cli-test account test-account
            echo "Clear: OK"

            val2=$(secret-tool lookup service resend-cli-test account test-account || true)
            if [ -z "$val2" ]; then
              echo "Verify cleared: OK"
            else
              echo "Verify cleared: FAILED - still exists"
              exit 1
            fi
          '
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
      - name: Test Node.js spawn + stdin with secret-tool
        run: |
          dbus-run-session -- bash -c '
            echo "" | gnome-keyring-daemon --unlock --components=secrets 2>/dev/null || true

            # Trigger D-Bus activation of the Secret Service
            dbus-send --session --print-reply --dest=org.freedesktop.secrets \
              /org/freedesktop/secrets org.freedesktop.DBus.Properties.Get \
              string:org.freedesktop.Secret.Service string:Collections >/dev/null 2>&1 || true

            node -e "
            const { spawn, execFileSync } = require(\"child_process\");
            const child = spawn(\"secret-tool\", [
              \"store\", \"--label=Node test\", \"service\", \"resend-cli-node\", \"account\", \"node-test\"
            ], { stdio: [\"pipe\", \"ignore\", \"pipe\"] });
            let stderr = \"\";
            child.stderr.on(\"data\", d => stderr += d);
            child.on(\"close\", code => {
              if (code !== 0) { console.log(\"Node store: FAILED -\", stderr); process.exit(1); }
              console.log(\"Node store via stdin: OK\");

              const val = execFileSync(\"secret-tool\", [
                \"lookup\", \"service\", \"resend-cli-node\", \"account\", \"node-test\"
              ]).toString().trim();
              if (val === \"re_node_test_key\") {
                console.log(\"Node lookup: OK\");
              } else {
                console.log(\"Node lookup: FAILED - got\", JSON.stringify(val));
                process.exit(1);
              }

              execFileSync(\"secret-tool\", [\"clear\", \"service\", \"resend-cli-node\", \"account\", \"node-test\"]);
              console.log(\"Node clear: OK\");
            });
            child.stdin.write(\"re_node_test_key\");
            child.stdin.end();
            "
          '
  # ── macOS ────────────────────────────────────────────────
  macos-keychain:
    name: "macOS: security (Keychain)"
    runs-on: macos-latest
    timeout-minutes: 25
    steps:
      - name: Test security add-generic-password + find + delete
        run: |
          # Store
          /usr/bin/security add-generic-password -s resend-cli-test -a test-account -w re_test_key_123 -U
          echo "Store: OK"

          # Retrieve
          val=$(/usr/bin/security find-generic-password -s resend-cli-test -a test-account -w)
          if [ "$val" = "re_test_key_123" ]; then
            echo "Retrieve: OK"
          else
            echo "Retrieve: FAILED - got '$val'"
            exit 1
          fi

          # Delete
          /usr/bin/security delete-generic-password -s resend-cli-test -a test-account
          echo "Delete: OK"

          # Verify deleted (exit code 44 = not found)
          if /usr/bin/security find-generic-password -s resend-cli-test -a test-account -w 2>/dev/null; then
            echo "Verify deleted: FAILED - still exists"
            exit 1
          else
            echo "Verify deleted: OK"
          fi
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
      - name: Test Node.js execFile with security command
        run: |
          node -e "
          const { execFile } = require('child_process');

          // Store
          execFile('/usr/bin/security', [
            'add-generic-password', '-s', 'resend-cli-node', '-a', 'node-test', '-w', 're_node_test_key', '-U'
          ], (err) => {
            if (err) { console.log('Node store: FAILED -', err.message); process.exit(1); }
            console.log('Node store: OK');

            // Retrieve
            execFile('/usr/bin/security', [
              'find-generic-password', '-s', 'resend-cli-node', '-a', 'node-test', '-w'
            ], (err2, stdout) => {
              if (err2) { console.log('Node retrieve: FAILED -', err2.message); process.exit(1); }
              const val = stdout.trim();
              if (val === 're_node_test_key') {
                console.log('Node retrieve: OK');
              } else {
                console.log('Node retrieve: FAILED - got', JSON.stringify(val));
                process.exit(1);
              }

              // Delete
              execFile('/usr/bin/security', [
                'delete-generic-password', '-s', 'resend-cli-node', '-a', 'node-test'
              ], (err3) => {
                if (err3) { console.log('Node delete: FAILED -', err3.message); process.exit(1); }
                console.log('Node delete: OK');
              });
            });
          });
          "